- syslog-ng - lists.balabit.hu

How can I stop syslog-ng by command
by wei 13 Dec '04

13 Dec '04

Hello everyone: I have a simple question to ask you. Could you tell me a command to stop/start my syslog-ng server? In my Syslog-ng 1.6.5, I can't use "syslog-ng stop" to stop my syslog-ng. I can only use kill, but I don't think it is a good idea. Thx!!

2 1

Syslog-NG / sqlsyslogd Date Issues
by Ronnie Clark 13 Dec '04

13 Dec '04

Hello all, I am using syslog-ng on a FreeBSD 5.3 STABLE platform with the sqlsyslogd template to log syslog messages to a MySQL 4.0.22 database. I noticed that when the date rolled from Nov 30 to Dec 1, that the actual messages were no longer being recorded. So I verified that the messages were being captured in the text files, and they were. Now, that the date is the 10th (2 full digits), messages are again being logged into the database. Is this a bug? Anyone else seen this type of behavior? I am pretty sure that it is not the OS causing the issue, since I have another syslog-ng server running on FreeBSD 4.x STABLE and saw the exact same errors on that as well. Any help is greatly appreciated. Thanks, Ron Clark __________________________________ Do you Yahoo!? Read only the mail you want - Yahoo! Mail SpamGuard. http://promotions.yahoo.com/new_mail

2 2

A remote logging problem..
by 童永昇 13 Dec '04

13 Dec '04

hi ... I am a newbie in syslog-ng I meet some problems in configure syslog-ng I have three machine, A is inside NAT, B is NAT server, C is loghost outside NAT B forward log message from A to C. A's syslog-ng.conf setting options { long_hostnames(off); sync(0); }; source src {unix-dgram("/var/run/log");udp();internal();file("/dev/klog");}; destination loghost{udp("B" port(514));}; log{ source(src);destination(loghost);}; B's syslog-ng.conf setting options { chain_hostnames(yes); keep_hostname(no); long_hostnames(off); sync(0); use_dns(yes); use_fqdn(yes); }; source src { unix-dgram("/var/run/log"); internal(); file("/dev/klog"); }; source fwd {udp( ip(10.1.1.254) port(514));}; destination loghost { udp("C" port(514)); }; log { source(src);source(fwd); destination(loghost); }; C's syslog-ng.conf setting options { chain_hostnames(yes); keep_hostname(no); create_dirs(yes); long_hostnames(off); sync(0); use_dns(yes); use_fqdn(yes); }; source src { unix-dgram("/var/run/log"); udp(); internal(); file("/dev/klog"); }; destination all { file("/var/log/all.log"); }; log { source(src); destination(all); }; three machine all are FreeBSD machine A FreeBSD is 5.3 B is FreeBSD 4.11 C is FreeBSD 4.10 syslog-ng version are the same(syslog-ng 1.6.5) the FAQ say's that.. keep_hostname(yes) keep_hostname(no) chain_hostname(yes) server server/server2 chain_hostname(no) server server2 i have see that FAQ,but i can not produce the log record like scr@host1/host2 when the root login at A machine,syslog-ng record this action,but... A ==> Dec 13 20:42:36 A login: ROOT LOGIN (root) ON ttyv0 B ==> Dec 13 20:42:36 10.1.1.11 login: login on ttyv0 as root Dec 13 20:42:36 10.1.1.11 login: ROOT LOGIN (root) ON ttyv0 Dec 13 20:42:36 10.1.1.11 login: ROOT LOGIN (root) ON ttyv0 C ==> Dec 13 20:42:36 B login: login on ttyv0 as root Dec 13 20:42:36 B login: ROOT LOGIN (root) ON ttyv0 Dec 13 20:42:36 C login: ROOT LOGIN (root) ON ttyv0 Dec 13 20:42:36 B login: ROOT LOGIN (root) ON ttyv0 (B、C is his hostname) it seems quiet strange. Can someone hlep me? thanks a lot (sorry for my poor English ^^")

1 0

Logging to from a windows host to syslog-ng
by Conrad Tiflin (CF) 10 Dec '04

10 Dec '04

Hello, I presume sys-logging is not configured in the same way for windows versus that of unix. Does anyone know were can obtain info. on setting this up? Thanks, Conrad ================================================================== This e-mail and its contents are subject to the Telkom SA Limited e-mail legal notice available at http://www.telkom.co.za/TelkomEMailLegalNotice.PDF

4 4

Syslog-ng not receiving remote logs from stock Syslogd
by Igor Gueths 10 Dec '04

10 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all. I'm running the latest version of Syslog-ng (1.6.5). I've got all manner of local logging via unix-stream working just fine. My problem comes when I try and pull remote logs from a machine that's running the stock Syslogd, as shipped with Slackware-10.0. I first made sure my Iptables rules were accepting any traffic to UDP port 514. I then set up something like this in syslog-ng.conf. Note h14me is the hostname of the remote machine. source h14me { udp(); }; destination h14melog { file("/var/log/h14me.log"); }; log { source(h14me); destination(h14melog); }; Syslog-ng -s didn't report any errors with this syntax, therefore I assumed it was correct. However, when I restart Syslog-ng I don't see an h14me.log file in /var/log. On the remote machine I did this: @24.249.27.228 That was in /etc/syslog.conf. I had this type of setup going on another machine, however the difference was that I was running stock Syslogd as well. Does anyone know what I might be doing wrong here? Shouldn't Syslog-ng/regular Syslogd be able to communicate since they can both use the UDP standard? Should I instead specify the udp driver in the source that's already working, and then write a filter rule to take anything that comes from given host and put it in its own logfile? Or should I be able to specify 2 completely seperate sources? Thanks! - -- "The answer to life, the universe, and everything is 42." -- Douglas Adams -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) iD8DBQFBuQ4BNohoaf1zXJMRApsTAKCcODwcOdfajdKoldQVFbOf5Ew7lQCfTYYe cKJDLElWmMeJNv4FWC1+Tl0= =FsH9 -----END PGP SIGNATURE-----

1 0

Problem reading the source file("/etc/httpd/logs/access_log")
by torpedo 09 Dec '04

09 Dec '04

Hi All , I have installed the syslog-ng 1.6.5 In configuration file I have defined source as the /etc/httpd/logs/access_log and destination as the terminal : /dev/tty1 Syslog-ng get started with no problem but it doesnot logs the information from the access_log file or any other log file ... i think thr is problem reading the file (but syslog-ng does not give any error) ... Plz help me out Thanks in advance torpedo

3 5

RE: [syslog-ng]Can't receive syslog by UDP protocol
by Xiaodong Lin 08 Dec '04

08 Dec '04

I think you should use the following: udp(ip(0.0.0.0) port(514)); instead of udp(); Xiaodong ________________________________ From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of wei Sent: Tuesday, December 07, 2004 3:29 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Can't receive syslog by UDP protocol Greeting! I have set up my syslog-ng environment by the default syslog-ng.conf file. By the linux default logger command, I can generate syslog to file. But when I use a syslog client send out syslog to the syslog-ng server, I can't receive the log by UDP protocol. But I can get TCP protocol syslog. Could anyone tell me why? Thanks! My system is RedHat 9.0. The syslog client is Kiwi Syslog Gen in windows. The following is part of my syslog.conf file: source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); udp(); tcp(port(5140) keep-alive(yes)); }; log { source(src); destination(file); };

3 2

Can't receive syslog by UDP protocol
by wei 07 Dec '04

07 Dec '04

Greeting! I have set up my syslog-ng environment by the default syslog-ng.conf file. By the linux default logger command, I can generate syslog to file. But when I use a syslog client send out syslog to the syslog-ng server, I can't receive the log by UDP protocol. But I can get TCP protocol syslog. Could anyone tell me why? Thanks! My system is RedHat 9.0. The syslog client is Kiwi Syslog Gen in windows. The following is part of my syslog.conf file: source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); udp(); tcp(port(5140) keep-alive(yes)); }; log { source(src); destination(file); };

1 0

Question about file handles, programs and time_reopen
by Mike Tremaine 06 Dec '04

06 Dec '04

I was doing a little experimenting on syslog-ng [syslog-ng-1.6.5-6 from rpm package] and was curious what happens if the destination object is destroyed. I read the configs option "time_reopen" [mine is set to 10, I assume that is secs], does this control all output options or just network connections? 2 examples. If you have a log file that is removed while syslog-ng is running is there a way to have syslog-ng re-create the file. I tried it and the file didn't not come back even though there was more data. Same experiment with a program. Syslog-ng forks a child program at start-up but what happens if that child dies. I did a kill -9 just to see if it would detect the absence and try to re-fork. If I want these features do I need to look outside of syslog-ng [some sort of daemon watcher that will throw a HUP]. Thanks, Mike Tremaine

3 3

UNSUBSCRIBE.
by Conrad Tiflin (CF) 06 Dec '04

06 Dec '04

================================================================== This e-mail and its contents are subject to the Telkom SA Limited e-mail legal notice available at http://www.telkom.co.za/TelkomEMailLegalNotice.PDF

1 0