- syslog-ng - lists.balabit.hu

Syslog: Router konfiguration
by kblumer＠gmx.ch 08 Mar '05

08 Mar '05

Hi all I tried to get syslog messages from a router, but I do not get any messages. From ohter Systems it works. Does it something have to do with my syslog configuration on the routers (operational state = inactive)? TK>show syslog base SYSLOG Base Information ----------------------- Configured Maximum # of Poll iteration State hosts allowed timer ---------- ------------- -------------- Enabled 5 5 Operational # of Active # of Active # of Syslog State Seq Hosts Non-seq Hosts Messages Sent ----------- ----------- ------------- ------------- DOWN 0 0 0 TK>show syslog hosts SYSLOG Configured Hosts ----------------------- Host Ip Operational Address State Time Sequencing ---------------- ------------ --------------- 10.xx.xx.xx INACTIVE ENABLED If yes, how can I ACTIVATE the Operational State ? Thanks in advance -- Lassen Sie Ihren Gedanken freien Lauf... z.B. per FreeSMS GMX bietet bis zu 100 FreeSMS/Monat: http://www.gmx.net/de/go/mail

2 1

not proper logs
by jack alex 08 Mar '05

08 Mar '05

Dear All, Iam using syslog-ng! I facing problem in my log rotation for postgres, it is not rotation properly. I am using syslog-ng package for loging. My logs for postgres looks like this, code: -rw-r--r-- 1 root root 10M Feb 28 23:24 postgres.log.20 -rw-r--r-- 1 root root 0 Feb 28 20:16 postgres.log.21 -rw-r--r-- 1 root root 10M Feb 28 20:15 postgres.log.22 -rw-r--r-- 1 root root 0 Feb 28 17:04 postgres.log.23 -rw-r--r-- 1 root root 10M Feb 28 17:03 postgres.log.24 -rw-r--r-- 1 root root 0 Feb 28 13:52 postgres.log.25 -rw-r--r-- 1 root root 10M Feb 28 13:51 postgres.log.26 -rw-r--r-- 1 root root 0 Feb 28 10:56 postgres.log.27 -rw-r--r-- 1 root root 10M Feb 28 10:55 postgres.log.28 -rw-r--r-- 1 root root 0 Feb 28 08:40 postgres.log.29 -rw-r--r-- 1 root root 0 Mar 2 00:12 postgres.log.3 That's after rotation it generates two files one with 0MB size and another with is of 10MB, so, why it is generating 0MB size log files?? Does it supports syslogng package for loging? If yes then what is the difference is its configuration from normal syslog package. Any help appreciated. -jack __________________________________ Celebrate Yahoo!'s 10th Birthday! Yahoo! Netrospective: 100 Moments of the Web http://birthday.yahoo.com/netrospective/

1 0

2 configuration questions
by ARGEXT-HIDALGO, FRANCISCO 07 Mar '05

07 Mar '05

Hi, I would like to ask you about two things: 1. I have a central syslog-ng server logging everything as IP's because we need it that way, but for php-syslog-ng I would like to see them as hostnames. It is possible to resolve hostnames to some destinations only? 2. We have one syslog-ng server in each region and each of them logs to the central server, I would like to be able to log each region to a diferent file. I think I can do it by sending from a different facility from each region. Unfortunatelly reconfiguring every router and switch from the network is not an option, so I was thinking I could do it if each regional server resends it's logs with a particular facility, changing the original one that it received from it's routers. Is this possible?, if not, do you know another way to do it?, I was thinking that I could send each region to a different port of the central syslog, but I prefer not changing the current configuration if possible. Thank you, Francisco

1 0

Fedora Core 3, SELinux, and syslog-ng
by Mike Pepe 05 Mar '05

05 Mar '05

I'm wondering if anyone knows the magic incantation you need in order to make FC3 with selinux turned on to like syslog-ng. it won't let syslog-ng access /proc/kmesg and therefore prevents it from working. If I turn off selinux, of course, it works fine. This selinux stuff is nice, but hard to figure out!

3 2

Re: [syslog-ng]Syslog-NG 1.6.6 memory leak when sending UDP logs
by henry＠shoelacecity.com 05 Mar '05

05 Mar '05

>There is no version 1.2.2, the latest version is 1.1.2.1 (or 1.1.3 which >is BETA) My bad, (typo) 1.1.2(.1) to be specific. >This patch fixes the byte order issue, and I'm still hunting the memory >leak with your configuration: > >diff -u -r1.25.4.6 afinet.c >--- afinet.c 5 Aug 2004 11:35:12 -0000 1.25.4.6 >+++ afinet.c 3 Mar 2005 12:26:47 -0000 >@@ -617,11 +617,10 @@ > ADDRESS2SOCKADDR(msg->saddr, sizeof(src_addr), (struct sockaddr *) &src_addr); > ADDRESS2SOCKADDR(self->super.dest_addr, sizeof(dst_addr), (struct sockaddr *) >&dst_addr); > >- > libnet_clear_packet(self->lnet_ctx); > >- udp = libnet_build_udp(src_addr.sin_port, >- dst_addr.sin_port, >+ udp = libnet_build_udp(ntohs(src_addr.sin_port), >+ ntohs(dst_addr.sin_port), > LIBNET_UDP_H + msg_line->length, > 0, > msg_line->data, I applied the patch, and recompiled. You are not going to beleive this: Data is STILL getting to the destination properly - despite the ntohs function. Yes, I checked the binary to be certain it recompiled, and threw a printf statement in there to be certain. It would seem that the ntohs function has no effect.

2 1

Resolve hostnames for some destinations only
by ARGEXT-HIDALGO, FRANCISCO 04 Mar '05

04 Mar '05

Is this possible?, I have everything logged as IP's because we need it that way, but for php-syslog-ng I would like to see it as hostnames. Any solutions? Thank you. Francisco

1 0

Syslog-NG 1.6.6 memory leak when sending UDP logs
by henry＠shoelacecity.com 04 Mar '05

04 Mar '05

I'm running 1.6.6 on Linux Redhat ES 3.0 logging Cisco router logs to local files and it's been running just fine for over a week. I just enabled forwarding for local4 and local7 (with spoof UDP) to 2 additional hosts via UDP and noticed, within a day, that it syslog-NG has consumed all available memory. It continues to log, however, the system starts killing processes off unless I restart syslog-ng. I checked the list, it seems like the closest similar problem I could find was back in 2000. Any advice for fixing/identifying the problem?

4 18

Fedora Core configuration files
by José Pedro Oliveira 04 Mar '05

04 Mar '05

Balazs, Could you add the four attached files to the contrib directory? They will be needed by the new specfile. Regards, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B * # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # 20000925 gb(a)sysfive.com # # Updated by Frank Crawford (<Frank.Crawford(a)ac3.com.au>) - 10 Aug 2002 # - for Red Hat 7.3 # - totally do away with klogd # - add message "kernel:" as is done with klogd. # # Updated by Frank Crawford (<Frank.Crawford(a)ac3.com.au>) - 22 Aug 2002 # - use the log_prefix option as per Balazs Scheidler's email # # Updated by Jose Pedro Oliveira (<jpo at di.uminho.pt>) - 05 Apr 2003 # - corrected filters 'f_filter2' and 'f_filter6' # these filters were only allowing messages of one specific # priority level; they should be allowing messages from that # priority and upper levels. # # Updated by Jose Pedro Oliveira (<jpo at di.uminho.pt>) - 25 Jan 2005 # - Don't sync the d_mail destination # # Updated by Jose Pedro Oliveira (<jpo at di.uminho.pt>) - 01 Feb 2005 # - /proc/kmsg is a file not a pipe. # (https://lists.balabit.hu/pipermail/syslog-ng/2005-February/006963.html) # options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); # udp(ip(0.0.0.0) port(514)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" sync(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; #filter f_filter1 { facility(kern); }; filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; #!/bin/sh # # syslog-ng This starts and stops syslog-ng # # chkconfig: 2345 12 88 # description: reads and logs messages to the system console, log \ # files, other machines and/or users as specified by \ # its configuration file. # processname: /sbin/syslog-ng # config: /etc/syslog-ng/syslog-ng.conf # config: /etc/sysconfig/syslog-ng # pidfile: /var/run/syslog-ng.pid # ### BEGIN INIT INFO # Provides: $syslog ### END INIT INFO # Source function library. . /etc/rc.d/init.d/functions exec="/sbin/syslog-ng" prog=$(basename $exec) [ -f $exec ] || exit 0 # Source config [ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog lockfile=/var/lock/subsys/$prog umask 077 start() { echo -n $"Starting $prog: " daemon $exec $SYSLOGNG_OPTIONS retval=$? echo [ $retval -eq 0 ] && touch $lockfile return $retval } stop() { echo -n $"Stopping $prog: " killproc $prog retval=$? echo [ $retval -eq 0 ] && rm -f $lockfile return $retval } restart() { stop start } reload() { echo -n $"Reloading syslog-ng.conf file: " killproc $prog -HUP retval=$? echo return $retval } force_reload() { restart } fdr_status() { status $prog } case "$1" in start|stop|restart|reload) $1 ;; force-reload) force_reload ;; status) fdr_status ;; condrestart|try-restart) [ ! -f $lockfile ] || restart ;; *) echo $"Usage: $0 {start|stop|status|restart|try-restart|reload|force-reload}" exit 2 esac /var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron { sharedscripts postrotate /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || true endscript } #--- # Syslog-ng command line options # See syslog-ng(8) for more details #--- SYSLOGNG_OPTIONS=""

2 1

central log server not working
by Ed Davison 04 Mar '05

04 Mar '05

I am trying to setup a central log host and am having trouble getting events registered on the central server. It looks like the remote host does register with the central host but nothing shows in a log anywhere for it. I really need another set of eyes on this as I cannot figure this out for the life of me and I need to get this going. Here is the excerpt from /var/log/messages (cleaned on the ip numbers): --------8<--------8<--------8<-------- Feb 18 14:19:45 sec5 syslog-ng[27866]: syslog-ng version 1.6.5 starting Feb 18 14:19:45 sec5 syslog-ng[27866]: Changing permissions on special file /dev/tty12 Feb 18 14:24:00 sec5 syslog-ng[27866]: AF_INET client connected from 1.2.3.4, port 50378 --------8<--------8<--------8<-------- Here is the central loghost config file: --------8<--------8<--------8<-------- options { long_hostnames(off); sync(0); stats(43200); dns_cache(yes); use_fqdn(no); keep_hostname(yes); use_dns(yes); }; source gateway { unix-stream("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; source tcpgateway { unix-stream("/dev/log"); internal(); tcp(ip(0.0.0.0) port(514) max_connections(1000)); }; destination hosts { file("/var/log/syslogs/$HOST/$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(gateway); destination(hosts); }; log { source(tcpgateway); destination(hosts); }; --------8<--------8<--------8<-------- The remote host config file is: --------8<--------8<--------8<-------- options { long_hostnames(off); sync(0); stats(43200); }; source src { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; source gateway { unix-stream("/dev/log" max_connections(1000)); internal(); }; destination messages { file("/var/log/messages"); }; # By default messages are logged to tty12... destination console_all { file("/dev/tty12"); }; destination shell { tcp("1.2.3.1" port(514)); }; log { source(src); destination(messages); }; log { source(src); destination(console_all); }; log { source(gateway); destination(shell); }; --------8<--------8<--------8<-------- -- -------------------------- Ed Davison Sr. Systems Analyst McCombs School of Business 512-232-6620 voice

2 5

changed macro to $R_YEAR/$YEAR.$MONTH.$DAY
by Deras, Angel R./Information Systems 04 Mar '05

04 Mar '05

Joerg, I was able to start logging again after your pointer. I am still not able to create a dir with the $MONTH (nor $R_MONTH) macro, but am getting around the problem by using the macro "$R_YEAR/$YEAR.$MONTH.$DAY", which should be enough to distinguish each day's log. thank you very much, ard ===================================================================== Please note that this e-mail and any files transmitted with it may be privileged, confidential, and protected from disclosure under applicable law. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any reading, dissemination, distribution, copying, or other use of this communication or any of its attachments is strictly prohibited. If you have received this communication in error, please notify the sender immediately by replying to this message and deleting this message, any attachments, and all copies and backups from your computer.

1 0