- syslog-ng - lists.balabit.hu

MySQL-Syntax error
by Hermann-Josef Beckers 03 Mar '05

03 Mar '05

HI, I have the same problem as someone else in November. I'm trying to pipe data into MySQL, but Mysql complains about syntax. The proposed solution in November (upgrade von 1.6.4 to 1.6.5) doesn't fit, as I'm using 1.9.3 Here is the generated input for MySQL: ls0003INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '', 'kern', 'notice', 'notice', '05', '2005-03-03', '16:26:07', 'kernel', 'syslog-ng[10686]: syslog-ng starting up; version=\'1.9.3\' ' ); ls0003INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '', 'kern', 'notice', 'notice', '05', '2005-03-03', '16:26:07', 'kernel', 'syslog-ng[10686]: Initializing destination file writer; filename=\'/tmp/mysql.pipe\', template=\'/tmp/mysql.pipe\' ' ); 0.0.0.0INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '', 'daemon', 'err', 'err', '1b', '2005-03-03', '16:27:01', 'Security', 'Security: NT-AUTORIT\37777777704T\\SYSTEM: Fehlgeschlagene Anmeldung: Grund: Unbekannter Benutzername oder falsches Kennwort Benutzername: ANONYMOUS Dom\37777777744ne: KST Anmeldetyp: 3 Anmeldevorgang: NtLmSsp Authentifizierungspaket: NTLM Name der Arbeitsstation: \\\\LS0002 <78>CROND[2516]: (root) CMD (/usr/bin/mrtg /etc/mrtg/mrtg.cfg) ' ); Seems that the value for HOST is printed before the INSERT-string. "ls0003" is the host running syslog-ng. Another point: How do I keep the hostname for remote hosts? The string with "0.0.0.0" at the beginning is from a windows 2000 client. Here is my syslog-ng.conf: options { keep_hostname(yes); chain_hostnames(yes); }; destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(src); destination(d_mysql); }; # source src { unix-dgram("/etc/log/log"); internal(); }; source src { unix-dgram("/dev/log"); internal(); udp(); }; # source src { unix-dgram("/dev/log"); internal(); }; # source net { udp(); }; Yours hjb _________________________________________ Diese E-Mail wurde geprüft von Symantec Antivirus

2 1

client couldn't reconnect to loghost after failure
by Ed Ravin 03 Mar '05

03 Mar '05

We're using syslog-ng 1.5.13 (yes, I know) on a bunch of diskless clients to send log messages to a central host. The main switch in our machine room had a hardware problem, and refused to pass packets for 20 minutes or so until we rebooted it. On two of my clients, syslog-ng subsequently stopped sending log messages to the central host after the switch recovered. Here's what was in the log: Mar 1 08:55:38 syslog-ng[13050]: io.c: do_write: write() failed (errno 9), Broken pipe Mar 1 08:55:38 syslog-ng[13050]: pkt_buffer::do_flush(): Error flushing data Mar 1 08:55:38 syslog-ng[13050]: Connection broken to AF_INET(loghost.example.com:514), reopening in 60 seconds Mar 1 08:57:53 syslog-ng[13050]: Error connecting to remote host AF_INET(loghost.example.com:514), reattempting in 60 seconds Mar 1 09:00:08 syslog-ng[13050]: Error connecting to remote host AF_INET(loghost.example.com:514), reattempting in 60 seconds Mar 1 09:02:24 syslog-ng[13050]: Error connecting to remote host AF_INET(loghost.example.com:514), reattempting in 60 seconds Mar 1 09:04:39 syslog-ng[13050]: Error connecting to remote host AF_INET(loghost.example.com:514), reattempting in 60 seconds Mar 1 09:05:38 syslog-ng[13050]: STATS: dropped 0 Mar 1 09:06:54 syslog-ng[13050]: Error connecting to remote host AF_INET(loghost.example.com:514), reattempting in 60 seconds Mar 1 09:09:10 syslog-ng[13050]: Error connecting to remote host AF_INET(loghost.example.com:514), reattempting in 60 seconds Mar 1 09:25:39 syslog-ng[13050]: STATS: dropped 0 Mar 1 09:35:39 syslog-ng[13050]: STATS: dropped 0 The other host has a remarkably similar log. After 9:25:39, the only messages that made it to the central host are the "STATS: dropped 0" messages. Is this a bug that has been fixed in more recent versions? We've been meaning to upgrade the clients for a while (the central server is using a current syslog-ng), but haven't gotten to it yet.

1 0

RE : [syslog-ng]Installation problem on Fedora C3
by Marquis Thibodeau 03 Mar '05

03 Mar '05

Hi, Thanks for your quick answer... I didn't find the version I need.. the 1.5.x because I want to store the log in MySQL and it says that only 1.5.x is working with template (MySQL) Any other idea?? Thanks Marquis ________________________________ De: syslog-ng-admin(a)lists.balabit.hu de la part de Viper sec Date: mer. 2005-03-02 13:01 À: syslog-ng(a)lists.balabit.hu Objet : Re: [syslog-ng]Installation problem on Fedora C3 Hi I installed on FC3, it was ok. I used rpm from rpm.pbone.net. Regards, Viper$ec On Wed, 2 Mar 2005 12:53:03 -0500, Marquis Thibodeau <mthibodeau(a)avance.info> wrote: > Hi, > > I tried to install syslog-ng on my Fedora Core3 server and I get a bunch of > error in the compilation... > > Is someone can help me out... > > What thing do I need to provide here to get better help...??? > > Thanks > > Marquis _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng stopped logging at beginning of month (March 1)
by Deras, Angel R./Information Systems 03 Mar '05

03 Mar '05

Hi Friends, For some reason, syslog-ng did not create a new dir and destination file after it closed the last log on February 28 @ 23:59. It should have created a new dir in the form: <path>/2005/03/ and a file named "2005-03-01". However, this did not happen and I am still not able to get logging going. I am using syslog-ng version 1.6.6, running on FreeBSD 5.3. I installed it recently and it worked great from Feb 17 to Feb 28, each day creating that day's file; but it not create the March directory nor any other file. tcpdump sessions show that the udp packets to port 514 are arriving at the log server. Any help will be greatly appreciated. thanks, ard ===================================================================== Please note that this e-mail and any files transmitted with it may be privileged, confidential, and protected from disclosure under applicable law. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any reading, dissemination, distribution, copying, or other use of this communication or any of its attachments is strictly prohibited. If you have received this communication in error, please notify the sender immediately by replying to this message and deleting this message, any attachments, and all copies and backups from your computer.

2 1

Installation problem on Fedora C3
by Marquis Thibodeau 02 Mar '05

02 Mar '05

Hi, I tried to install syslog-ng on my Fedora Core3 server and I get a bunch of error in the compilation... Is someone can help me out... What thing do I need to provide here to get better help...??? Thanks Marquis

2 1

1.9.3 bug proposal : resolving $HOSTS in destination
by Gilles Demarty 02 Mar '05

02 Mar '05

We have an issue on syslog-ng 1.9.3 on this following case : when using the destination : destination d_tag {file("/var/log/hosts/$HOST/$FACILITY $YEAR-$MONTH-$DAY.$LEVEL");}; the following error appeared : Error opening file for writing; error='No such file or directory (2)', filename='localhost/var/log/hosts//mail 2005-02-28.notice' The resolved filename looks bugged. Here are the revelant debugging infos : Incoming log entry; line='<21>Feb 28 15:24:46 logger: test' Initializing destination file writer; filename='/var/log/messages', template='/var/log/messages' Initializing destination file writer; filename='localhost/var/log/hosts//mail 2005-02-28.notice', template='/var/log/hosts/$HOST/$FACILITY $YEAR-$MONTH-$DAY.$LEVEL' Error opening file for writing; error='No such file or directory (2)', filename='localhost/var/log/hosts//mail 2005-02-28.notice' This bug produce rapidly a 99% CPU load, mainly because all the sources are redirected to this "destination". syslog-ng 1.6.4 don't produce the bug. Attached is syslog-ng.conf that produce the bug. (ASCII \r\n format, sorry). -- Gilles DEMARTY ExaProtect Technology Tél: +33 (0) 4 26 23 25 25 Fax: +33 (0) 4 26 29 99 09 email(at)exaprotect.com www.exaprotect.com - "Be alert with your alerts" options { sync(0); create_dirs(on); time_reopen (10); log_fifo_size(1000); long_hostnames (off); keep_hostname (yes); use_dns (off); use_fqdn (off); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; source src { udp(ip(0.0.0.0)); }; destination d_tag { file("/var/log/hosts/$HOST/$FACILITY $YEAR-$MONTH-$DAY.$LEVEL"); }; destination d_dest {file("/var/log/messages"); }; log { source(s_sys); source(src); destination(d_dest); }; log { source(s_sys); source(src); destination(d_tag); };

5 6

levtlog error udring compile
by Colin O'Keeffe 01 Mar '05

01 Mar '05

Iam using suse 9.2 ive done ./configure then i do make and i get gcc -g -O2 -Wall -g -o syslog-ng main.o misc.o utils.o messages.o gsockaddr.o syslog-names.o macros.o logmsg.o cfg.o logpipe.o driver.o sgroup.o dgroup.o center.o filter.o logsource.o logreader.o logwriter.o affile.o afunix.o afinet.o afsocket.o afstreams.o afuser.o afprog.o afinter.o cfg-lex.o cfg-grammar.o fdwrite.o fdread.o memtrace.o templates.o children.o -lnsl -Wl,-static -lfl -L/opt/gnome/lib -lglib-2.0 -levtlog -Wl,-call_shared /usr/lib/gcc-lib/i586-suse-linux/3.3.4/../../../../i586-suse-linux/bin/ld: cannot find -levtlog collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/home/cokeeffe/syslog-ng-1.9.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/cokeeffe/syslog-ng-1.9.3' make: *** [all] Error 2 whats up? -- Colin O'Keeffe

2 4

Changing what source port syslog-ng uses, when sending a syslog
by Henning Markussen 01 Mar '05

01 Mar '05

Hi Is there a way to change what source port syslog-ng uses, when it is sending a syslog ? I can see in our firewall log that it uses a high port Deny udp src inside:xxxx/32772 dst outside:xxx/514 by access-group "FromInside4" - Henning

2 2

Logs lost in the FIFO
by torpedo 01 Mar '05

01 Mar '05

Hi All, I have the confusion regarding logs which are not read by the Destination programs. In case of FIFO, if the destination program which is reading the logs from syslog-ng is slow and unable to sysnchronise with the syslog-ng and there is also a limit for the fifo buffer(amount of data it holds) then where does thoses logs goes , are those logs recoverable. In other case of FIFO, if there is no destination program reading the logs from the FIFO what happens to the logs which are collected by the syslog-ng are those logs droped. How syslog-ng handles all these situations. Please help me out. Thank you all in advance, Regards, torpedo

3 7

Logserver doesn't receving remote logs
by Viper sec 28 Feb '05

28 Feb '05

Hey , I have a central logserver with syslog-ng installed and configured (see above syslog-ng.conf), some clients (in conf just remotehost5) send (514/udp) their logs to this logserver; but logserver isn't receiving these logs. When I try to use local system logs, it's ok, create the log files, but with remote host doesn't. I have created /var/log/HOSTS/{nameserver}, and clients, that use syslog has in syslog.conf *.warning @logserver (/etc/hosts is ok). remotehost5 is pinging logserver. Anybody has any ideia about it? (thanks too much) logserver: linux Fedora Core 3 syslog-ng-1.6.5-6 libol-0.3.14-1 /* syslog-ng.conf logserver = = local server */ options{ sync(0); keep_hostname(no); log_fifo_size(1000); long_hostnames(off); use_dns(no); use_fqdn(no); create_dirs(yes); }; source s_sys{ unix-stream("/dev/log"); internal(); }; source s_udp{ udp(ip(192.168.100.100) ); }; #listenned interface on server filter f_remotehost5sec{ host( "web5" ) and level( warning .. emerg ) and facility( authpriv ); }; filter f_logservermesg{ level(info .. emerg) and not (facility(authpriv) and facility(mail) and facility(cron)); }; filter f_logserversec { facility(authpriv) and level(info .. emerg); }; destination d_remotehost5mesg { file("/var/log/HOSTS/remotehost5/$YEAR-$MONTH-$DAY.secure" ); }; destination d_remotehost5sec { file("/var/log/HOSTS/remotehost5/$YEAR-$MONTH-$DAY.secure" ); }; destination d_logservermesg { file("/var/log/HOSTS/logserver/$YEAR-$MONTH-$DAY.message"); }; destination d_logserversec { file("/var/log/HOSTS/logserver/$YEAR-$MONTH-$DAY.secure"); }; log { source(s_udp); filter(f_remotehost5mesg); destination(d_remotehost5mesg); }; log { source(s_sys); filter(f_logservermesg); destination(d_logservermesg); }; log { source(s_sys); filter(f_logserversec); destination(d_logserversec); };

3 3