- syslog-ng - lists.balabit.hu

RE: [syslog-ng]pipe destination and HPUX
by Brett Stevens 21 Dec '04

21 Dec '04

Looking at your config you seem to have specified a ip and prot for your tcp. Just try it without such as source s_tcp{();}; This is what I use to log approximately 80-100 devices to two servers (number varies as this is a development site with large amounts of vmware servers. Best of luck Brett Stevens -----Original Message----- From: Stephan Hendl [mailto:Stephan.Hendl@lds.brandenburg.de] Sent: Monday, December 20, 2004 6:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]pipe destination and HPUX Hi all, I try to get syslog messages via tcp and want to write them into a pipe with HPUX 11.11v1 and syslog-ng-1.6.5. The messages arrive perfectly (I conttrolled this via writing in a file) but the pipe is still empty. Only messages from local sources get into it. Does anybody have an idea? Ciao Stephan # syslog-ng configuration file. # # This should behave pretty much like the original syslog on HP-UX. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(8) for more information. # # 20000925 gb(a)sysfive.com options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { pipe("/dev/log" pad_size(2048)); internal(); }; source s_tcp { tcp(ip(10.128.8.173) port(10514) keep-alive(no)); }; destination d_cic.log { file("/var/adm/syslog/cic.$YEAR$MONTH$DAY" owner("root") group("sys") perm(0644) template( "$DATE $HOST $MESSAGE\n") template-escape(yes)); }; destination d_cic.pipe { pipe("/tmp/cic.pipe" owner("root") group("root") perm(0640) template( "$DATE $HOST $MESSA GE\n") template-escape(yes)); }; log { source(s_sys); destination(d_cic.log); }; log { source(s_tcp); destination(d_cic.log); }; log { source(s_sys); destination(d_cic.pipe); }; log { source(s_tcp); destination(d_cic.pipe); }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

how to write efficient filters?
by Timothy Webster 20 Dec '04

20 Dec '04

Which is more efficient? filter f_pop_acc { program("pop3") and match("not have pop"); }; filter f_mail { facility(mail); }; log { source(s_sys); filter(f_mail); filter(f_pop_acc); destination(d_pop_acc); or filter f_pop_acc { facility(mail) and program("pop3") and match("not have pop"); }; log { source(s_sys); filter(f_pop_acc); destination(d_pop_acc); Sorry too lazy to look at the code :) -tim

3 3

pipe destination and HPUX
by Stephan Hendl 20 Dec '04

20 Dec '04

Hi all, I try to get syslog messages via tcp and want to write them into a pipe with HPUX 11.11v1 and syslog-ng-1.6.5. The messages arrive perfectly (I conttrolled this via writing in a file) but the pipe is still empty. Only messages from local sources get into it. Does anybody have an idea? Ciao Stephan # syslog-ng configuration file. # # This should behave pretty much like the original syslog on HP-UX. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(8) for more information. # # 20000925 gb(a)sysfive.com options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { pipe("/dev/log" pad_size(2048)); internal(); }; source s_tcp { tcp(ip(10.128.8.173) port(10514) keep-alive(no)); }; destination d_cic.log { file("/var/adm/syslog/cic.$YEAR$MONTH$DAY" owner("root") group("sys") perm(0644) template( "$DATE $HOST $MESSAGE\n") template-escape(yes)); }; destination d_cic.pipe { pipe("/tmp/cic.pipe" owner("root") group("root") perm(0640) template( "$DATE $HOST $MESSA GE\n") template-escape(yes)); }; log { source(s_sys); destination(d_cic.log); }; log { source(s_tcp); destination(d_cic.log); }; log { source(s_sys); destination(d_cic.pipe); }; log { source(s_tcp); destination(d_cic.pipe); };

1 0

Christmas
by Jay Guerette 19 Dec '04

19 Dec '04

Although 10 days too late, I was thinking: "What can Mikulás bring Balázs for Christmas?" After all, giving us syslog-ng and 5 years of support on this list deserves *something*. Then it hit me; "I'll buy a syslog-ng support contract!" I'm reasonably sure I can get my company to go for it; so how can I get prices on the various support packs available?

3 5

iptables syslog-ng logs way to big
by garvald＠bluemail.ch 19 Dec '04

19 Dec '04

hi there bit of a problem with too many logs being generated and i'm not sure what to do. I'm using a iptables firewall setup like this: $IPTABLES -t filter -N ACCEPTLOG $IPTABLES -t filter -A ACCEPTLOG -j LOG --log-prefix "iptables:" --log-level\ debug $IPTABLES -t filter -A ACCEPTLOG -j ACCEPT the firewall is also a masquerading NAT gateway for about 50 clients. I want to record all traffic flowing through the gateway, so along with the firewall rules stated above i have this in my syslog-ng.conf : destination iptables { file("/var/log/iptables"); }; filter iptables { match("^iptables:"); }; log { source(src); filter(iptables); destination(iptables); }; all very nice, except for the fact that within 24 hours the log grew to 500MB's, which is a little too big. Of course i've configured logrotate to g-zip the file every day which greatly reduces the size, but i'd much prefer to have smaller logs but with the necessary information still there. Here's an example from one client just for a simple request to port 445: Dec 17 11:33:18 iptables:IN=eth1 OUT=eth0 SRC=192.168.1.220 DST=213.220.xxx.xxx LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=974 DF PROTO=TCP SPT=32900 DPT=445 WINDOW=10136 RES=0x00 ACK URGP=0 this entry is repeated 10 times per second !! i've tried different log levels in my firewall but it doesnt seem to change anything. Would be grateful for any help. cheers, garvald

4 3

-v and -p parameters not working as advertised
by syslogng＠sanitarium.net 16 Dec '04

16 Dec '04

Excerpts from man syslog-ng: -p <filename> Write the current PID information to the specified file. -v Enable verbose mode. Process will not become a daemon. Prints out fewer messages, compared to -d. Despite what that says, syslog-ng forks into the background when -v is used. Also, when -d is used to force syslog-ng to run in the foreground it does not create a pid file even when -p is used. I need the pidfile to be created even when running in the foreground. I am running syslog-ng with: syslog-ng -d -p /var/run/syslog-ng.pid -- Kevin

1 0

repost: line truncation with spamd
by scott 15 Dec '04

15 Dec '04

Is anyone looking into this issue? To refresh your memory, all five of these entries appear on the same line: 2004-12-09T01:09:35+1000 chloe spamd[704]: connection from localhost [127.0.0.1] at port 40811 2004-12-09T01:09:35+1000 chloe spamd[13558]: info: setuid to slittle succeeded 2004-12-09T01:09:35+1000 chloe spamd[13558]: processing message <35089309.09501@cbuki@getherbalnow.info> for slittle:1000. 2004-12-09T01:09:36+1000 chloe spamd[13558]: identified spam (20.8/5.0) for slittle:1000 in 0.8 seconds, 1475 bytes. 2004-12-09T01:09:36+1000 chloe qmail: 1102514976.416174 new msg 12808775

3 4

[PATCH] syslog-ng-1.6.5+20041206 fixes missing facility/priority in afinet.c
by Roberto Nibali 15 Dec '04

15 Dec '04

Hello, Somehow we either forgot this piece or it dropped out of the CVS again ;). The inlined patch fixes a missing facility/priority addition for template expansion over the network in afinet.c The goal is to be able to send the node name in each syslog message in order to distinguish the two systems: unfortunately when using templates in destination files, the facility/priority is lost. This fixes it I hope: --- syslog-ng-1.6.5+20041206/src/afinet.c 2004-08-05 13:35:12.000000000 +0200 +++ syslog-ng-1.6.5+20041206-fixed/src/afinet.c 2004-12-08 20:44:15.000000000 +0100 @@ -595,7 +595,8 @@ struct ol_string *msg_line; if (self->template_output) { - msg_line = c_format("%fS", + msg_line = c_format("<%i>%fS", + msg->pri, expand_macros( self->cfg, self->template_output, I'm under the distinct impression that something like that has already been addressed in the past. Maybe it was a copy'n'paste error or so ... Take care, Roberto Nibali, ratz -- ------------------------------------------------------------- addr://Rathausgasse 31, CH-5001 Aarau tel://++41 62 823 9355 http://www.terreactive.com fax://++41 62 823 9356 ------------------------------------------------------------- terreActive AG Wir sichern Ihren Erfolg -------------------------------------------------------------

2 9

Using logger with syslog-ng
by Vaibhav Goel 15 Dec '04

15 Dec '04

Hi all, I am new syslog-ng user. I am trying to figure out how to get a loghost going and taking baby steps with the documentation available :-) I got syslog-ng configured on a Linux server as such: source s_test { tcp(ip(0.0.0.0) port(514)); }; destination d_test { file("/var/log/test.log"); }; log { source(s_test); destination(d_test); }; I can connect to localhost on 514 fine: telnet localhost 514 Trying 127.0.0.1... Connected to localhost.localdomain (127.0.0.1). Escape character is '^]'. So it appears that syslog-ng is at least running fine. I would like to use logger to send a test log message to syslog-ng. I googled and looked at the FAQ and docs but cannot find a way. Can anyone help or point me to a relevant document I could read? :-) Thanks!

2 3

Re: [syslog-ng]How can I stop syslog-ng by command
by 童永昇 15 Dec '04

15 Dec '04

In FreeBSD ,you may can use /usr/local/etc/rc.d/syslog-ng.sh \ [start|stop] -----Original message----- From:wei<wei00(a)126.com> To:syslog-ng<syslog-ng(a)lists.balabit.hu> Date: Mon, 13 Dec 2004 17:56:51 +0800 Subject: [syslog-ng]How can I stop syslog-ng by command Hello everyone: I have a simple question to ask you. Could you tell me a command to stop/start my syslog-ng server? In my Syslog-ng 1.6.5, I can’t use “syslog-ng stop” to stop my syslog-ng. I can only use kill, but I don’t think it is a good idea. Thx!! _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 3