- syslog-ng - lists.balabit.hu

Antw: [syslog-ng]syslog on HP-UX 11
by Stephan Hendl 10 Nov '04

10 Nov '04

Hi, your source-line should be like source s_sys { pipe(/dev/log pad_size(2048)); internal(); }; The pad_size is important (see manual and faq) Stephan >>>Olivia.Leonard(a)davy.ie 11/04 12:13 pm >>> Hi I have set up a central logging server using syslog-ng (on solaris 8) - all the solaris servers, windows servers, and routers are logging to it with no big issues. I want to get a HP-UX box logging to it and it's proving difficult. Initially In installed syslog-ng 1.5.8 from a depot and it sent only a startup message to the central server but none of the other messages such as logins, su and so on. So I tried getting it to log to it using it's own native syslog - it just won't log anything. It resolves loghost and gives no errors on startup/restart but it just doesn't log anything (eventhough my central server listens on UDP 514 and gets messages from routers/switches) Could anyone help me out with this?? Attached are both my syslog.conf and my syslog-ng.conf. Thanks Olivia ********************************************************************************************************************************************************************** /etc/syslog.conf # mail.debug /var/adm/syslog/mail.log #*.info;mail.none /var/adm/syslog/syslog.log #*.alert /dev/console #*.alert root #*.emerg * *.emerg;*.alert;*.crit;*.err;*.warning;*.notice;*.info;*.debug @loghost # *********************************************************************************************************************************************************************** /opt/syslog_ng/etc/syslog-ngsyslog-ng.conf options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source src {unix-stream(/dev/log); internal(); }; destination everything {file(/home/leonarol/logfile); }; ## set up logging to loghost destination loghost { tcp(172.16.117.170 port(5140)); }; filter f_ssh_login_attempt { program(sshd.*) and match((Failed|Accepted)) and not match(Accepted (hostbased|publickey)); }; filter f_emergency { level(emerg); }; filter f_alert { level(alert); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_warn { level(warn); }; filter f_notice { level(notice); }; filter f_info { level(info); }; log { source(src); filter(f_emergency); destination(everything); }; log { source(src); filter(f_alert); destination(everything); }; log { source(src); filter(f_crit); destination(everything); }; log { source(src); filter(f_err); destination(everything); }; log { source(src); filter(f_warn); destination(everything); }; log { source(src); filter(f_notice); destination(everything); }; log { source(src); filter(f_info); destination(everything); }; log { source(src); filter(f_emergency); destination(loghost); }; log { source(src); filter(f_alert); destination(loghost); }; log { source(src); filter(f_crit); destination(loghost); }; log { source(src); filter(f_err); destination(loghost); }; log { source(src); filter(f_warn); destination(loghost); }; log { source(src); filter(f_notice); destination(loghost); }; log { source(src); filter(f_info); destination(loghost); }; The information in this e-mail is confidential and may be legally privileged. It is intended solely for the addressee. Access to this e-mail by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any other action taken or any views, opinions or advice contained in this e-mail are those of the sending individual and not necessarily those of the firm. It is possible for data transmitted by e-mail to be deliberately or accidentally corrupted or intercepted. For this reason where the communication is by e-mail, J&E Davy does not accept any responsibility for any breach of confidence which may arise from the use of this medium. If you have received this e-mail in error please notify us immediately at mailto:helpdesk@davy.ie and delete this e-mail from your system.

1 0

problem compiling under sunOS 7
by ARGEXT-HIDALGO, FRANCISCO 09 Nov '04

09 Nov '04

I have the following compilation error and no clue on what could the problem be. I never had this problem on other systems (Linux). Does anyone know whats the problem? Thank you. Making all in src make all-recursive Making all in . if gcc -DHAVE_CONFIG_H -I. -I/home/fhidalgo/syslog-ng-1.6.5/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -MT main.o -MD -MP -MF ".deps/main.Tpo" \ -c -o main.o `test -f 'main.c' || echo '/home/fhidalgo/syslog-ng-1.6.5/src/'`main.c; \ then mv -f ".deps/main.Tpo" ".deps/main.Po"; \ else rm -f ".deps/main.Tpo"; exit 1; \ fi /usr/ccs/bin/as: "/var/tmp/ccACFkjc.s", line 1210: error: unknown opcode ".subsection" /usr/ccs/bin/as: "/var/tmp/ccACFkjc.s", line 1210: error: statement syntax /usr/ccs/bin/as: "/var/tmp/ccACFkjc.s", line 1218: error: unknown opcode ".previous" /usr/ccs/bin/as: "/var/tmp/ccACFkjc.s", line 1218: error: statement syntax /usr/ccs/bin/as: "/var/tmp/ccACFkjc.s", line 2776: error: unknown opcode ".subsection" /usr/ccs/bin/as: "/var/tmp/ccACFkjc.s", line 2776: error: statement syntax /usr/ccs/bin/as: "/var/tmp/ccACFkjc.s", line 2831: error: unknown opcode ".previous" /usr/ccs/bin/as: "/var/tmp/ccACFkjc.s", line 2831: error: statement syntax *** Error code 1 make: Fatal error: Command failed for target `main.o' Current working directory /home/fhidalgo/syslog-ng-1.6.5/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /home/fhidalgo/syslog-ng-1.6.5/src *** Error code 1 make: Fatal error: Command failed for target `all' Current working directory /home/fhidalgo/syslog-ng-1.6.5/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive'

2 1

Why does this not work in 1.6.x?
by t_esting＠excite.com 09 Nov '04

09 Nov '04

Hello, syslog-ng gurus. I have a question about a config that works for me in 1.5.26 but not in 1.6.x (up to 1.6.5/libol 0.3.14). Here are (what I hope are) the pertinent bits: source s_udp { udp( port(514) ); }; filter f_fwsm_block { match(" \%FWSM-") and not match(": (Teardown|Translation|Built)"); }; filter f_fwsm_misc { match(" \%FWSM-") and match(": (Teardown|Translation|Built)"); }; log { source(s_udp); filter(f_fwsm_misc); destination(d_ipfilters_bymin); }; log { source(s_udp); filter(f_fwsm_block); destination(d_ipmon); }; ## fallthrough log { destination(d_messages); flags(fallback, catchall); }; With syslog-ng 1.5.26, messages matching "%FWSM-Teardown", etc., are written (correctly) to the d_ipmon destination. With syslog-ng 1.6.x, they drop through to d_messages. Can anyone on the list please help me decipher what changes I might need to make to my config (either compiling syslog-ng itself or to my syslog-ng.conf file) to make my logs write to the same place once I upgrade? Thanks in advance. t_esting(a)excite.com _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

2 1

Syslog-ng and mysql
by Chris Vaughan 07 Nov '04

07 Nov '04

Greetings, I am currently trying to get syslog-ng to map to mysql so that it can then be reported by way of php-syslog-ng. However, the destination keeps giving me syntax errors. I am running syslog-ng 1.6.5 and I have tried to follow the documentation in the source code and at www.vermeer.org. Any Suggestions? Chris Vaughan *************************************************************** This message is intended for the addressee named and may contain confidential information. If you are not the intended recipient, please delete it and notify the sender. Views expressed in this message are those of the individual sender, and are not necessarily the views of the Department of Lands. This email message has been swept by MIMEsweeper for the presence of computer viruses. ***************************************************************

1 0

A nice manual
by Martin Schröder 05 Nov '04

05 Nov '04

http://www.cert-in.org.in/knowledgebase/guidelines/CISG-2004-03.pdf This should end up in the FAQ. Best regards Martin -- Martin Schröder, ms(a)artcom-gmbh.de ArtCom GmbH, Lise-Meitner-Str 5, 28359 Bremen, Germany Voice +49 421 20419-44 / Fax +49 421 20419-10 http://www.artcom-gmbh.de

1 0

Problem with logrotation in RedHat installation!?
by Jörgen Ekstedt 04 Nov '04

04 Nov '04

Hi everyone! Got a problem with logrotation in RedHat9 when using syslog-ng. We are using the "logrotate" command, and we dont get syslog-ng to change files. I have included a "postrotate" command in the logrotate.conf file that sends a -HUP signal to the syslog-ng process, and syslog-ng reports in the logs that it got received and it is restarting. But anyway, it still writes its logs to the rotated logfile? For example logging messages to file "message.log" Perform the logrotate command and we get 2 files, "message.log" and message.log.1" BUT now syslog-ng writes its logs to message.log.1, and I want it to start over on the message.log file? Any clues? BR

3 2

Where to put in startup scripts?
by Jörgen Ekstedt 04 Nov '04

04 Nov '04

Hi everyone! Got a nice working installation of syslog-ng in our computers. But I have aquestion about the startup script. We are running a mixed environment with RedHat Linux and IRIX, and for now we have the startupscript for syslog-ng located at S99, ie we start it last of all services. Now where should we start it? Is there any recommendations? BR

2 1

syslog on HP-UX 11
by Olivia Leonard 04 Nov '04

04 Nov '04

Hi I have set up a central logging server using syslog-ng (on solaris 8) - all the solaris servers, windows servers, and routers are logging to it with no big issues. I want to get a HP-UX box logging to it and it's proving difficult. Initially In installed syslog-ng 1.5.8 from a depot and it sent only a startup message to the central server but none of the other messages such as logins, su and so on. So I tried getting it to log to it using it's own native syslog - it just won't log anything. It resolves loghost and gives no errors on startup/restart but it just doesn't log anything (eventhough my central server listens on UDP 514 and gets messages from routers/switches) Could anyone help me out with this?? Attached are both my syslog.conf and my syslog-ng.conf. Thanks Olivia **************************************************************************** **************************************************************************** ************** /etc/syslog.conf # mail.debug /var/adm/syslog/mail.log #*.info;mail.none /var/adm/syslog/syslog.log #*.alert /dev/console #*.alert root #*.emerg * *.emerg;*.alert;*.crit;*.err;*.warning;*.notice;*.info;*.debug @loghost # **************************************************************************** **************************************************************************** *************** /opt/syslog_ng/etc/syslog-ngsyslog-ng.conf options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source src {unix-stream("/dev/log"); internal(); }; destination everything {file("/home/leonarol/logfile"); }; ## set up logging to loghost destination loghost { tcp("172.16.117.170" port(5140)); }; filter f_ssh_login_attempt { program("sshd.*") and match("(Failed|Accepted)") and not match("Accepted (hostbased|publickey)"); }; filter f_emergency { level(emerg); }; filter f_alert { level(alert); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_warn { level(warn); }; filter f_notice { level(notice); }; filter f_info { level(info); }; log { source(src); filter(f_emergency); destination(everything); }; log { source(src); filter(f_alert); destination(everything); }; log { source(src); filter(f_crit); destination(everything); }; log { source(src); filter(f_err); destination(everything); }; log { source(src); filter(f_warn); destination(everything); }; log { source(src); filter(f_notice); destination(everything); }; log { source(src); filter(f_info); destination(everything); }; log { source(src); filter(f_emergency); destination(loghost); }; log { source(src); filter(f_alert); destination(loghost); }; log { source(src); filter(f_crit); destination(loghost); }; log { source(src); filter(f_err); destination(loghost); }; log { source(src); filter(f_warn); destination(loghost); }; log { source(src); filter(f_notice); destination(loghost); }; log { source(src); filter(f_info); destination(loghost); }; The information in this e-mail is confidential and may be legally privileged. It is intended solely for the addressee. Access to this e-mail by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any other action taken or any views, opinions or advice contained in this e-mail are those of the sending individual and not necessarily those of the firm. It is possible for data transmitted by e-mail to be deliberately or accidentally corrupted or intercepted. For this reason where the communication is by e-mail, J&E Davy does not accept any responsibility for any breach of confidence which may arise from the use of this medium. If you have received this e-mail in error please notify us immediately at mailto:helpdesk@davy.ie and delete this e-mail from your system.

1 0

not (x and y)
by Thomas Richter 03 Nov '04

03 Nov '04

Hi, is this correct or is there a better possibility? filter f_LCP-Echo { match("pppd") and match("EchoRe");}; filter f_not_LCP-Echo { not match("pppd") or not match("EchoRe");}; wkr Thomas Richter -- dss1://49.431.801306 Wot're we going to do tonight, Brain ? gsm://49.179.5192431 The same thing we do every night, Pinky . icq://124849926 Try to TAKE OVER THE WORLD ! mailto:richter@thomas-richter.de http://www.thomas-richter.de

1 0

group () doesn't work
by przemolicc＠poczta.fm 03 Nov '04

03 Nov '04

Hello, I am trying to allow group ('it') members to read logs. Therefore I used following lines: ... destination hosts { file("/var/log/HOSTS/$HOST/$YEAR/$MONTH/$DAY/$HOUR:00" owner("root") group("it") perm(0640) dir_perm(0750) create_dirs(yes) ); }; ... But it doesn't work: new files are in group 'it' but new directories aren't. What can I do to have newly created directories in group 'it' ? przemol

2 2