- syslog-ng - lists.balabit.hu

Re: [syslog-ng]Configure syslog-ng to act as a central logging server
by Bill Nash 31 Mar '05

31 Mar '05

On Thu, 31 Mar 2005, Ryan McCain wrote: > I'm starting to understand the syntax. However, what part of this > statement tells syslog-ng to create a file for each host its receiving > logs from? > destination hosts { > file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$DAY" > owner(bob) group(llamafood) perm(0755) dir_perm(0755) create_dirs(yes)); If the file doesn't exist, it will be created. If the directory doesn't exist, you need the create_dirs directive. - billn

1 0

Re: [syslog-ng]Configure syslog-ng to act as a central logging server
by Ryan McCain 31 Mar '05

31 Mar '05

This is the base config file I'm working with.. Note: i'm using unix_stream. Should I be using unix_dgram since im on a 2.6x kernel? I'm reading through the section on syslog-ng in the book "Building Secure Server with Linux", and it mentions soemthing about using "unix-dgram" .. note the "-" instead of "_". I'm assuming its a type and should be "_". ------ source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix_stream("/dev/log"); internal(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; >>>billn(a)billn.net 03/31 10:00 am >>> On Thu, 31 Mar 2005, Ryan McCain wrote: >Where can I find documentation that will give me information on how to >accept logs from remote hosts and have each of the hosts log to their >own file? > destination hosts { file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$DAY" owner(bob) group(llamafood) perm(0755) dir_perm(0755) create_dirs(yes)); }; - billn syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]Configure syslog-ng to act as a central loggingserver
by Vaibhav Goel 31 Mar '05

31 Mar '05

The $HOST macro... -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Ryan McCain Sent: March 31, 2005 8:08 AM To: billn(a)billn.net; syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Configure syslog-ng to act as a central loggingserver I'm starting to understand the syntax. However, what part of this statement tells syslog-ng to create a file for each host its receiving logs from? Thanks, Ryan >>>billn(a)billn.net 03/31 10:00 am >>> On Thu, 31 Mar 2005, Ryan McCain wrote: >Where can I find documentation that will give me information on how to >accept logs from remote hosts and have each of the hosts log to their >own file? > destination hosts { file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$D AY" owner(bob) group(llamafood) perm(0755) dir_perm(0755) create_dirs(yes)); }; - billn syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: [syslog-ng]Configure syslog-ng to act as a central logging server
by Ryan McCain 31 Mar '05

31 Mar '05

I'm starting to understand the syntax. However, what part of this statement tells syslog-ng to create a file for each host its receiving logs from? Thanks, Ryan >>>billn(a)billn.net 03/31 10:00 am >>> On Thu, 31 Mar 2005, Ryan McCain wrote: >Where can I find documentation that will give me information on how to >accept logs from remote hosts and have each of the hosts log to their >own file? > destination hosts { file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$DAY" owner(bob) group(llamafood) perm(0755) dir_perm(0755) create_dirs(yes)); }; - billn syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Configure syslog-ng to act as a central logging server
by Ryan McCain 31 Mar '05

31 Mar '05

Where can I find documentation that will give me information on how to accept logs from remote hosts and have each of the hosts log to their own file? I've read the man file and looked at the web page, but can't find anything to substantial. Thanks, Ryan

3 2

problem with syslog-ng fork & exec
by niraj 31 Mar '05

31 Mar '05

I m facing problem with this code . When I execute this program it forks 2 process A zombie syslog-ng process on the forked ID syslog-ng on the next pid but without while loop every thing is working properly TIA niraj #include<iostream> #include<unistd.h> using namespace std; int main() { int cpid; cpid=fork(); if(cpid==0) { if(execv( "/usr/local/sbin/syslog-ng" ,NULL)==-1) { cout<<"hello"<<endl; } cout<<"ok"<<endl; } while(1) { ; } return 0; } ~ ~

1 0

io.c read() error?
by SOLIS, ALEX 31 Mar '05

31 Mar '05

I am using syslog-ng 1.6.5 on a Gentoo Linux system running kernel 2.6.9. I have recently modified an open source utility called NTsyslog to send Windows NT style event logs via TCP to my syslog-ng server. Everything seems to work fine except I receive a io.c read() error for every event sent over the network via TCP. Anyone have any ideas of what my problem might be? Here are a few bits of info: Logs that I see when TCP syslog communication is attempted: Mar 30 10:43:48 src@lookout syslog-ng[3166]: AF_INET client connected from 192.168.11.19, port 3038 Mar 30 10:43:48 src@lookout syslog-ng[3166]: io.c: do_read: read() failed (errno 104), Connection reset by peer Mar 30 10:43:48 src@lookout syslog-ng[3166]: AF_INET client dropped connection from 192.168.11.19, port 3038 Mar 30 10:43:48 src@lookout syslog-ng[3166]: AF_INET client connected from 192.168.11.19, port 3039 Mar 30 10:43:48 src@lookout syslog-ng[3166]: io.c: do_read: read() failed (errno 104), Connection reset by peer Mar 30 10:43:48 src@lookout syslog-ng[3166]: AF_INET client dropped connection from 192.168.11.19, port 3039 Mar 30 10:49:05 src@lookout syslog-ng[3166]: AF_INET client connected from 192.168.11.19, port 3066 Mar 30 10:49:05 src@lookout syslog-ng[3166]: io.c: do_read: read() failed (errno 104), Connection reset by peer Mar 30 10:49:05 src@lookout syslog-ng[3166]: AF_INET client dropped connection from 192.168.11.19, port 3066 Mar 30 10:49:05 src@lookout syslog-ng[3166]: AF_INET client connected from 192.168.11.19, port 3067 Mar 30 10:49:05 src@lookout syslog-ng[3166]: io.c: do_read: read() failed (errno 104), Connection reset by peer Mar 30 10:49:05 src@lookout syslog-ng[3166]: AF_INET client dropped connection from 192.168.11.19, port 3067 Mar 30 10:53:59 src@lookout syslog-ng[3166]: AF_INET client connected from 192.168.11.19, port 3077 Mar 30 10:53:59 src@lookout syslog-ng[3166]: io.c: do_read: read() failed (errno 104), Connection reset by peer Mar 30 10:53:59 src@lookout syslog-ng[3166]: AF_INET client dropped connection from 192.168.11.19, port 3077 Mar 30 10:53:59 src@lookout syslog-ng[3166]: AF_INET client connected from 192.168.11.19, port 3078 Mar 30 10:53:59 src@lookout syslog-ng[3166]: io.c: do_read: read() failed (errno 104), Connection reset by peer Mar 30 10:53:59 src@lookout syslog-ng[3166]: AF_INET client dropped connection from 192.168.11.19, port 3078 Mar 30 10:58:53 src@lookout syslog-ng[3166]: AF_INET client connected from 192.168.11.19, port 3092 Mar 30 10:58:53 src@lookout syslog-ng[3166]: io.c: do_read: read() failed (errno 104), Connection reset by peer Mar 30 10:58:53 src@lookout syslog-ng[3166]: AF_INET client dropped connection from 192.168.11.19, port 3092 Mar 30 10:59:16 src@lookout syslog-ng[3166]: AF_INET client connected from 192.168.11.19, port 3093 Mar 30 10:59:16 src@lookout syslog-ng[3166]: io.c: do_read: read() failed (errno 104), Connection reset by peer Mar 30 10:59:16 src@lookout syslog-ng[3166]: AF_INET client dropped connection from 192.168.11.19, port 3093 Afinet.c in syslog-ng 1.6.6 sources where io_read() is called: /* af_inet source connection */ static int do_init_afinet_source_connection(struct log_handler *c, struct syslog_config *cfg, struct persistent_config *persistent) { CAST(afsocket_source_connection, self, c); if (self->client_addr) { CAST(inet_address_info, inet, self->client_addr); /* SOCK_STREAM */ notice("AF_INET client connected from %S, port %i\n", inet->ip, inet->port); io_read(self->client, make_log_reader(0, NULL, cfg->log_msg_size, 0, cfg->check_hostname ? LF_CHECK_HOSTNAME : 0, cfg->bad_hostname, c), make_afsocket_source_close_callback(self)); } else { /* SOCK_DGRAM */ io_read(self->client, make_log_reader(1, NULL, cfg->log_msg_size, 0, cfg->check_hostname ? LF_CHECK_HOSTNAME : 0, cfg->bad_hostname, c), make_afsocket_source_close_callback(self)); } return ST_OK | ST_GOON; } < -----END of CODE ---- > I have been trying to find what values are passed to io_read() and make_log_reader() but I have been unsuccessfull. Thanks in advance for any replies. Alex S. <p class=MsoNormal><span style='font-size:8.5pt'>This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.</p>

2 1

RE: [syslog-ng]-linux/bin/ld: cannot find -lglib-2.0
by Philipp Snizek 30 Mar '05

30 Mar '05

> > > static glib, syslog-ng tries to link to glib statically. > > > > Thanks for your answer. > > What do I have to do ? > > the static library is in the devel package usually, you need > to look for something like libglib-2.0.a Please excuse, but I still don't understand. libglib-2.0.la is in /usr/local/lib what do I have to do? I still have /usr/lib/gcc-lib/i486-slackware-linux/3.3.4/../../../../i486-slackware -linux/bin/ld: cannot find -lglib-2.0 What lib is it exactly looking for ? in /usr/local/lib I also have the glib-2.0 directory which includes a header file. Thank you Philipp

2 1

RE: [syslog-ng]-linux/bin/ld: cannot find -lglib-2.0
by Philipp Snizek 30 Mar '05

30 Mar '05

> /usr/lib/gcc-lib/i486-slackware-linux/3.3.4/../../../../i486-slackware > > -linux/bin/ld: cannot find -lglib-2.0 > > collect2: ld returned 1 exit status > > make[2]: *** [syslog-ng] Error 1 > > make[2]: Leaving directory `/root/syslog-ng-1.9.3/src' > > make[1]: *** [all-recursive] Error 1 > > make[1]: Leaving directory `/root/syslog-ng-1.9.3' > > make: *** [all] Error 2 > > > > However, glib-2.0 is installed and the path in ld.config.so > points to > > /usr/local/lib > > static glib, syslog-ng tries to link to glib statically. Thanks for your answer. What do I have to do ? > ps: use the latest snapshot of 1.9.x as plain 1.9.3 contains > a problem in macro expansion. Thanks. I changed to the snapshot. Philipp

2 1

-linux/bin/ld: cannot find -lglib-2.0
by Philipp Snizek 29 Mar '05

29 Mar '05

Hi I have a problem with installing syslog-ng 1.9.3 gcc -g -O2 -Wall -g -o syslog-ng main.o misc.o utils.o messages.o gsockaddr.o syslog-names.o macros.o logmsg.o cfg.o logpipe.o driver.o sgroup.o dgroup.o center.o filter.o logsource.o logreader.o logwriter.o affile.o afunix.o afinet.o afsocket.o afstreams.o afuser.o afprog.o afinter.o cfg-lex.o cfg-grammar.o fdwrite.o fdread.o memtrace.o templates.o children.o -lnsl -Wl,-static -lfl -L/usr/local/lib -lglib-2.0 -levtlog -Wl,-call_shared /usr/lib/gcc-lib/i486-slackware-linux/3.3.4/../../../../i486-slackware -linux/bin/ld: cannot find -lglib-2.0 collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/root/syslog-ng-1.9.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/root/syslog-ng-1.9.3' make: *** [all] Error 2 However, glib-2.0 is installed and the path in ld.config.so points to /usr/local/lib What am I missing? thanks Philipp

2 1