- syslog-ng - lists.balabit.hu

syslog-ng 1.9.2/eventlog 0.2.2: packaging notes
by Jose Pedro Oliveira 03 Feb '05

03 Feb '05

Balazs, I have a couple of requests to make regarding the packaging of the above packages (for Red Hat/Fedora systems). 1) copyright information I believe both packages are being distributed under the GPL license. Could you mention this in the README files and maybe include the COPYING file in the tarballs? 2) the CFLAGS aren't being inherited The CFLAGS generated by the configure files don't honour the environment CFLAGS variable. Small patches are attached to this email. 3) eventlog static lib Would it be possible to also generate the eventlog static library by default? 4) syslog-ng 1.9.2 Would it be possible to also generate a static linked syslog-ng? Right know it only uses dynamic libraries (glib2.so and libevtlog.so). It would be nice to avoid any dynamic libraries located under /usr as the content of this directory can not yet be available (mounted) at the time the daemon syslog-ng is loaded. Best regards, jpo -- José Pedro Oliveira diff -ruN syslog-ng-1.9.2+20050112+1424-orig/configure.in syslog-ng-1.9.2+20050112+1424/configure.in --- syslog-ng-1.9.2+20050112+1424-orig/configure.in 2005-01-05 12:00:11.000000000 +0000 +++ syslog-ng-1.9.2+20050112+1424/configure.in 2005-01-15 03:22:25.989658032 +0000 @@ -71,7 +71,7 @@ PKG_CHECK_MODULES(GLIB, glib-2.0) PKG_CHECK_MODULES(EVTLOG, eventlog) -CFLAGS="-Wall -g" +CFLAGS="$CFLAGS -Wall -g" DEPS_CPPFLAGS="$CPPFLAGS $GLIB_CFLAGS $EVTLOG_CFLAGS" CPPFLAGS="$DEPS_CPPFLAGS -D_GNU_SOURCE" DEPS_LIBS="$LIBS $GLIB_LIBS $EVTLOG_LIBS" diff -ruN eventlog-0.2.2-orig/configure.in eventlog-0.2.2/configure.in --- eventlog-0.2.2-orig/configure.in 2005-01-05 12:02:18.000000000 +0000 +++ eventlog-0.2.2/configure.in 2005-01-15 03:21:00.591640504 +0000 @@ -5,7 +5,7 @@ AM_CONFIG_HEADER(config.h) AM_DISABLE_STATIC -CFLAGS="-Wall -g" +CFLAGS="$CFLAGS -Wall -g" CPPFLAGS="-D_GNU_SOURCE" AC_ARG_ENABLE(dlsym-wrapper,

5 14

There's no need to run klogd on current linux kernels
by Philip J. Hollenback 03 Feb '05

03 Feb '05

The syslog-ng reference manual http://www.balabit.com/products/syslog_ng/reference/reference.html#AEN279 contains the following: > NOTE: on Linux, the klogd daemon reads kernel messages, and > forwards them to the syslogd process. klogd preprocesses kernel > messages and replaces addresses with symbolic names (from > /boot/System.map). If you don't want to lose this functionality > you'll have to run klogd with syslog-ng as well. That info is obsolete. We run 2.4.22 and 2.6.10 kernels at my company, and both provide symbolic names in backtraces. You can verify this by looking at "dmesg" after an oops - it contains symbolic names, and that is the raw kernel log output. Please adjust the syslog-ng documentation to indicate this. Thanks, P. -- Philip J. Hollenback Telemetry Investments phollenback(a)telemetry-investments.com

2 1

why does syslog-ng open /proc/kmsg read/write?
by Philip J. Hollenback 02 Feb '05

02 Feb '05

While setting up syslog-ng 1.6.5 on Fedora Core 1 linux, I noticed a discrepancy between it and regular syslog: syslog-ng opens /proc/kmsg read/write. Here's my source entry in syslog-ng.conf: source local { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); udp(); internal(); }; And lsof says: COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME syslog-ng 11320 root 3u REG 0,2 0 4112 /proc/kmsg The 'u' in the FD field means the file is open read/write. Regular syslog opens /proc/kmsg read-only. This seems to be the correct behavior, as you only ever read from that file. I notice syslog-ng also opens /dev/log read/write, so I suspect it opens all input files with that mode. Does someone have an explanation for this, or is it a bug in syslog-ng? Thanks, P. -- Philip J. Hollenback Telemetry Investments phollenback(a)telemetry-investments.com

2 2

Hernan Cortez/ADEXUS is out of the office.
by Hernan Cortez 01 Feb '05

01 Feb '05

I will be out of the office starting 31-01-2005 and will not return until 14-02-2005. Estare de vacaciones entre el 19/01 y el 30/01, si es urgente favor comuniquese con Marco Jara al Anexo 1746 e-mail: mjara(a)adexus.cl

1 0

making syslog_NG redundant / NFS / HA possibilities
by Oliver Tönsmann 31 Jan '05

31 Jan '05

Hi, we like to setup a central logging service for our distributed datacenter environment. Our idea is to use syslog_ng as an HA (high available) service running on two separate servers. The syslog clients (Solaris machines, network components, firewall appliances) should post the log data via UDP to a loadbalancer which will forward the log data to the two syslog_ng hosts. Now we have the problem how to merge the log data from the two syslog_ng hosts to one location. Most of our data is stored on centralised storage subsystems and this storage is distributed via NFS (NetApp file server). We like to store the logdata also into nfs directories. Following figure describes a possible dataflow: syslog clients --> LB --> --> syslog_ng host1 --> syslog_ng host2 --> NFS:/.../log/$HOST/$FACILITY/$PRIORITY/one_logfile_for_both_syslog_hosts Performance and nfs overhead is not a problem in our environment and nfs works very reliable due to our HA structures; logdata per day ~2-3 GB. Is there a possibilty to let syslog_ng hosts write the logdata simultaenously into the same logfile (NFS)? What are the disadvantages? What are your experiences in using syslog_ng as an HA service? What would be a good practice to setup syslog_ng and to make it high available? Ideas and helpful suggestions are welcome - Thanxx. Oliver ------------------------------------------------ Oliver Toensmann Universitaet Bielefeld - Hochschulrechenzentrum Email: Oliver.Toensmann(a)uni-bielefeld.de

2 1

Re: [syslog-ng] re-inserting syslog messages for testing
by Ed Ravin 31 Jan '05

31 Jan '05

On Tue, Jan 18, 2005 at 11:29:07AM -0500, Ed Ravin wrote: > I've written a perl script that takes as input a file with syslog > I use this for test environments, especially when I'm testing things > results when parsed by logsurfer. > > My tool does two things logger doesn't - (1) it trims off the existing > timestamps from the input before logging it, and more interestingly, (2) > can parse those timestamps and replay the log messages at the same rate > that they were originally logged. Or you can tell it to "time warp" > and play the messages back 2x 3x, 1/5x as fast, etc. This is why it's > good for testing logsurfer files, since you can test whether your > timeouts work. > > I have to spruce it up slightly (get rid of the XXX comments :-) before > I release it, will do so Real Soon. OK, here it is, as an attachment. With perldoc documentation, too. One possible bug not mentioned in the doc is that sleeping between messages to simulate the original delivery times seems to be getting rounded to the nearest second, a problem I thought using Time::HiRes would fix, but could conceivably be limited to my local environment. If anyone uses this, please let me know what you think. It's still in the beta stage, but since it's only a tool for testing rather than production, that should be sufficient for most purposes :-) -- Ed

2 3

Re: [syslog-ng]Entries being logged to /var/log/messages aswellas/var/log/HOSTS//$MONTH/$DAY/$HOS
by Fred Turner 29 Jan '05

29 Jan '05

Works great! Thanks... >>> Bill Nash <billn(a)billn.net> 1/29/2005 2:01:52 PM >>> On Sat, 29 Jan 2005, Fred Turner wrote: > Here is my source.. How would I go about doing that? Sorry I'm still pretty new with syslog0ng (3 hrs)... > No worries =) > > > > source src { > unix-stream("/dev/log"); > internal(); > udp(); > tcp(port(5140) keep-alive(yes)); > > Grab the udp and tcp entries, and create a new source. source src { unix-stream("/dev/log"); internal; }; source remote_hosts { tcp(port(5140) keep-alive(yes); udp()); log { source(remotes_hosts); destination(std); } Changing just the 'src' source, and adding the other two entries, will keep your existing config working as I described, local logging from your loghost processes to /var/log/messages where you'd expect them, and all your remote hosts logging to your 'dst' directory structure. Make sense? =) - billn >>>> Bill Nash <billn(a)billn.net> 1/29/2005 1:46:15 PM >>> > > Syslog will log to multiple destinations if you set them. As below, you > have multiple facilities still logging to messages. > > Does your 'src' source include your network ports, for receiving data from > remote hosts? If it does, separate it to a new source and pair it with > your 'std' destination, exclusively. This will keep your local logs > separate from your remote logs. > > - billn > > On Sat, 29 Jan 2005, Fred Turner wrote: > >> Sure, it's as follows. >> >> destination debug { file("/var/log/debug"); }; >> destination messages { file("/var/log/messages"); }; >> >> >> log { source(src); filter(f_daemon); destination(messages); }; >> log { source(src); filter(f_kern); destination(messages); }; >> log { source(src); filter(f_lpr); destination(lpr); }; >> log { source(src); filter(f_mail); destination(mail); }; >> log { source(src); filter(f_user); destination(messages); }; >> log { source(src); filter(f_uucp); destination(uucp); }; >> log { source(src); filter(f_mail); destination(maillog); }; >> log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; >> log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; >> log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; >> log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; >> log { source(src); filter(f_news); filter(f_err); destination(newserr); }; >> log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; >> log { source(src); filter(f_messages); destination(messages); }; >> log { source(src); filter(f_emergency); destination(console); }; >> >> >> >> >>>>> Bill Nash <billn(a)billn.net> 1/29/2005 1:15:26 PM >>> >> >> Can you include your log directive? Chances are, that's the culprit. >> >> - billn >> >> >> On Sat, 29 Jan 2005, Fred Turner wrote: >> >>> Hi, I'm new to syslog-ng and have configured it to be a loghost for many different firewall appliances. So I setup an automatic sorting entry as per the faq as follows: >>> >>> destination std { >>> file("/var/log/HOSTS/$MONTH/$DAY/$HOST-$YEAR-$MONTH-$DAY" >>> owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) >>> ); >>> >>> >>> Which works prefect The only problem is that it's also putting them in the /var/log/messages log. >>> >>> How Can I stop the behavior as it's creating a huge /var/log/messages log. >>> >>> >>> Thanks >>> >>> >>> ================================================================== >>> >>> NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. >>> Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email. >>> >>> >>> _______________________________________________ >>> syslog-ng maillist - syslog-ng(a)lists.balabit.hu >>> https://lists.balabit.hu/mailman/listinfo/syslog-ng >>> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >>> >>> >> _______________________________________________ >> syslog-ng maillist - syslog-ng(a)lists.balabit.hu >> https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >> >> >> >> ================================================================== >> >> NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. >> Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email. >> >> >> _______________________________________________ >> syslog-ng maillist - syslog-ng(a)lists.balabit.hu >> https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >> >> > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > ================================================================== > > NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. > Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email. > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.huhs that it's also putting them in the https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ================================================================== NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email.

1 0

Re: [syslog-ng]Entries being logged to /var/log/messages as wellas/var/log/HOSTS//$MONTH/$DAY/$HOS
by Fred Turner 29 Jan '05

29 Jan '05

Here is my source.. How would I go about doing that? Sorry I'm still pretty new with syslog0ng (3 hrs)... source src { unix-stream("/dev/log"); internal(); udp(); tcp(port(5140) keep-alive(yes)); >>> Bill Nash <billn(a)billn.net> 1/29/2005 1:46:15 PM >>> Syslog will log to multiple destinations if you set them. As below, you have multiple facilities still logging to messages. Does your 'src' source include your network ports, for receiving data from remote hosts? If it does, separate it to a new source and pair it with your 'std' destination, exclusively. This will keep your local logs separate from your remote logs. - billn On Sat, 29 Jan 2005, Fred Turner wrote: > Sure, it's as follows. > > destination debug { file("/var/log/debug"); }; > destination messages { file("/var/log/messages"); }; > > > log { source(src); filter(f_daemon); destination(messages); }; > log { source(src); filter(f_kern); destination(messages); }; > log { source(src); filter(f_lpr); destination(lpr); }; > log { source(src); filter(f_mail); destination(mail); }; > log { source(src); filter(f_user); destination(messages); }; > log { source(src); filter(f_uucp); destination(uucp); }; > log { source(src); filter(f_mail); destination(maillog); }; > log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; > log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; > log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; > log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; > log { source(src); filter(f_news); filter(f_err); destination(newserr); }; > log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; > log { source(src); filter(f_messages); destination(messages); }; > log { source(src); filter(f_emergency); destination(console); }; > > > > >>>> Bill Nash <billn(a)billn.net> 1/29/2005 1:15:26 PM >>> > > Can you include your log directive? Chances are, that's the culprit. > > - billn > > > On Sat, 29 Jan 2005, Fred Turner wrote: > >> Hi, I'm new to syslog-ng and have configured it to be a loghost for many different firewall appliances. So I setup an automatic sorting entry as per the faq as follows: >> >> destination std { >> file("/var/log/HOSTS/$MONTH/$DAY/$HOST-$YEAR-$MONTH-$DAY" >> owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) >> ); >> >> >> Which works prefect The only problem is that it's also putting them in the /var/log/messages log. >> >> How Can I stop the behavior as it's creating a huge /var/log/messages log. >> >> >> Thanks >> >> >> ================================================================== >> >> NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. >> Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email. >> >> >> _______________________________________________ >> syslog-ng maillist - syslog-ng(a)lists.balabit.hu >> https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >> >> > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > ================================================================== > > NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. > Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email. > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ================================================================== NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email.

2 1

Re: [syslog-ng]Entries being logged to /var/log/messages as wellas /var/log/HOSTS//$MONTH/$DAY/$HOS
by Fred Turner 29 Jan '05

29 Jan '05

Sure, it's as follows. destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; log { source(src); filter(f_daemon); destination(messages); }; log { source(src); filter(f_kern); destination(messages); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(messages); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); destination(maillog); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; >>> Bill Nash <billn(a)billn.net> 1/29/2005 1:15:26 PM >>> Can you include your log directive? Chances are, that's the culprit. - billn On Sat, 29 Jan 2005, Fred Turner wrote: > Hi, I'm new to syslog-ng and have configured it to be a loghost for many different firewall appliances. So I setup an automatic sorting entry as per the faq as follows: > > destination std { > file("/var/log/HOSTS/$MONTH/$DAY/$HOST-$YEAR-$MONTH-$DAY" > owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) > ); > > > Which works prefect The only problem is that it's also putting them in the /var/log/messages log. > > How Can I stop the behavior as it's creating a huge /var/log/messages log. > > > Thanks > > > ================================================================== > > NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. > Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email. > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ================================================================== NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email.

2 1

Entries being logged to /var/log/messages as well as /var/log/HOSTS//$MONTH/$DAY/$HOST-$YEAR-$MONTH
by Fred Turner 29 Jan '05

29 Jan '05

Hi, I'm new to syslog-ng and have configured it to be a loghost for many different firewall appliances. So I setup an automatic sorting entry as per the faq as follows: destination std { file("/var/log/HOSTS/$MONTH/$DAY/$HOST-$YEAR-$MONTH-$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); Which works prefect The only problem is that it's also putting them in the /var/log/messages log. How Can I stop the behavior as it's creating a huge /var/log/messages log. Thanks ================================================================== NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email.

2 1