- syslog-ng - lists.balabit.hu

Startup / Re-read config file
by Dave Johnson 16 Sep '04

16 Sep '04

Configuring a named pipe in syslog-ng and without the named-pipe-file being there causes syslog-ng to not start up. Why not error and continue? And when logs are rotated (kill -hup), check again?

2 1

]RE: [syslog-ng]Log formatting] - syslog-ng $MSG formatting
by Robert.COward＠deploymenthealth.osd.mil 16 Sep '04

16 Sep '04

Loïc, Thanks for the response. I wonder if there is a way I could strip it out, a wrapper perhaps. --- 13 September 2004 "You cannot show real respect to your parents by perpetuating their errors.... Do you consider that the inventor of a steel plow cast a slur upon his father who scratched the ground with a wooden one? I do not consider that an invention by the son is a slander upon the father; I regard each invention simply as an improvement; and every father should be exceedingly proud of an ingenious son. If Mr. Talmage has a son, it will be impossible for him to honor his father except by differing with him." (Robert Green Ingersoll, 1833-1899) --- Robert V. Coward UNIX System Administrator Computer Science Corporation

2 1

logging source: netlink socket ?
by Horváth Ákos 16 Sep '04

16 Sep '04

I am a new syslog-ng user and am very happy with it. But last I found the first thing which I wanted to do and was not able :) Could be possible to log the iptables ULOG target... with that packet filter logging without trashing dmesg could be done. And it had probably many other applications, too :) I did not found anything with netlink sockets in the 1.6.4 source. My primary goal was to know if I missed something? thanks, MaXX

2 1

Re: Log formatting - Solution
by Robert.COward＠deploymenthealth.osd.mil 14 Sep '04

14 Sep '04

Thanks for the response Nick and Loic. I managed to solve my problem. I upgraded to 1.6.5 w/ libol 0.3.14. This allowed me to use the $MSGONLY tag. Works perfectly. Thanks again. --- 14 September 2004 "This is all very interesting, and I daresay you already see me frothing at the mouth in a fit; but no, I am not; I am just winking happy thoughts into a little tiddle cup." (Nabokov, Lolita) --- Robert V. Coward UNIX System Administrator Computer Science Corporation

1 0

RE: [syslog-ng]Splitting up Cisco devices
by Stephen Bargon 13 Sep '04

13 Sep '04

Another way of configuring it with date is... destination messages.network { file("/export/home/ciscologs/$HOST_messages_$YEAR_$MONTH_$DAY" owner(root) group(other) perm(0644) dir_perm(0755) create_dirs(yes) ); }; Then I use a cron job to remove logs from the past so there is no rotation. I just let syslog-ng append new dates to the end of the hostnames everynight and cron remove previous log files that are backuped up nightly anyway. 0 1 * * * find /export/home/ciscologs -mtime 7 -exec /usr/bin/rm {} \; Works on Sun and Linux -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Bill Nash Sent: Monday, September 13, 2004 1:58 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Splitting up Cisco devices Your best option is to split them up by hostname. Syslog has no understanding of differing platform types. Most of the cisco devices will log to the same facility/severity anyway, so hostname is your best bet. destination by_host { file("/var/syslog/$HOST"); }; - billn On Mon, 13 Sep 2004, Rex Petersen wrote: > Hi > > > > Anyone who can show me how I split up the log files, > > so each device has it's own log file. > > > > Something like this: > > > > Devices: > > > > Cisco 3550-12G Switch: cisco3550-12.log > > Cisco 3548XL Switch #1: cisco3548_1.log > > Cisco 3548XL Switch #2: cisco3548_2.log > > Cisco PIX 515UR Firewall: cisco_515.log > > VPN3005 Concentrator: cisco_3005.log > > > > Best regards > > > > Rex Petersen > > > > > > > > > > > > > > > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html The information contained in this message is proprietary of Amdocs, protected from disclosure, and may be privileged. The information is intended to be conveyed only to the designated recipient(s) of the message. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, use, distribution or copying of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you.

1 0

Splitting up Cisco devices
by Rex Petersen 13 Sep '04

13 Sep '04

Hi Anyone who can show me how I split up the log files, so each device has it's own log file. Something like this: Devices: Cisco 3550-12G Switch: cisco3550-12.log Cisco 3548XL Switch #1: cisco3548_1.log Cisco 3548XL Switch #2: cisco3548_2.log Cisco PIX 515UR Firewall: cisco_515.log VPN3005 Concentrator: cisco_3005.log Best regards Rex Petersen

2 1

Re: [syslog-ng]Dumping Core on FreeBSD 4.10
by Emre Bastuz 13 Sep '04

13 Sep '04

Hi, thanks for the quick response. Zitat von rmkml <rmkml(a)wanadoo.fr>: > Do you have compiled syslog-ng ? > or package ? > what version you have ? I use the one from the ports collection, i.e. I have compiled it on the system where it is supposed to run. The version is 1.6.5. Cheers, Emre -- http://www.emre.de UIN: 561260 PGP Key ID: 0xAFAC77FD I don't see why some people even HAVE cars. -- Calvin

1 0

Dumping Core on FreeBSD 4.10
by Emre Bastuz 13 Sep '04

13 Sep '04

Hi, I´ve installed syslog-ng on one of my FreeBSD 4.10 machines a couple of days ago. I would like to have internal log-handling being done by BSD´s own syslog and network related syslogging by syslog-ng. Though I have checked my config file over and over again for any apparent mistakes I can not find any reason why the proccess should die. The config is as follows: ---------------------------------- options { use_fqdn(yes); keep_hostname(yes); use_dns(no); long_hostnames(off); sync(0); log_fifo_size(1000); }; source network { udp(ip("192.168.0.1") port(514)); }; destination hosts { file("/var/log/myrouters/$HOST/$FACILITY.$YEAR$MONTH$DAY.log" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(network); destination(hosts); }; ---------------------------------- Doing a 'strings syslog-ng.core | more' shows me things like ... [...] io_set_nonblocking: fcntl() failed, %z Can't set close-on-exec flag for fd %i: %z io.c: connecting using fd %i io.c: listening on fd %i io.c: Preparing fd %i for reading and writing io.c: Preparing fd %i for reading io.c: Preparing fd %i for writing reopen_fd: open failedfor %S: %z Marking fd %i for closing. Internal error, too long message to werror() [...] ... which I am too dumb to understand. Does anyone have any suggestion? Any help would be greatly appreciated. Cheers, Emre -- http://www.emre.de UIN: 561260 PGP Key ID: 0xAFAC77FD I don't see why some people even HAVE cars. -- Calvin

1 0

Log formatting
by Robert.COward＠deploymenthealth.osd.mil 10 Sep '04

10 Sep '04

Why is it that syslog-ng places the program name in the message string? As in: [CODE] source shell { unix-dgram("/dev/log"); internal(); udp(); }; destination deadman { file("/var/log/deadman" template ("PROGRAM:$PROGRAM <MESSAGE:$MSG> LEVEL:$LEVEL PRIORITY:$PRIORITY FACILITY:$FACILITY\n") template_escape(no) ); }; log { source(shell); destination(deadman); }; [/CODE] [OUTPUT] PROGRAM:roberto <MESSAGE:roberto: this is a test> LEVEL:notice PRIORITY:notice FACILITY:user [/OUTPUT] I'd like to see just the words "this is a test" in the $MSG variable. I am using syslog-ng version 1.5.24, on OpenBSD 3.5. Thanks in advanced.

3 2

Syslog-ng 1.6.5/libol 0.3.14 core dump on FreeBSD 4.x
by Mike Williams 09 Sep '04

09 Sep '04

Has anyone else experienced problems with the new release on FreeBSD? I have upgraded to 1.6.5 from 1.6.2 on FreeBSD 4.8-RELEASE-p10 and and 4.10-RELEASE-p2 and in both instances I get a core dump. If you have solved this already please let me know what to do, otherwise I'll be glad to send you any information you will need to troubleshoot, but I don't know where to begin. Thanks, Mike _______________________________ Do you Yahoo!? Win 1 of 4,000 free domain names from Yahoo! Enter now. http://promotions.yahoo.com/goldrush

4 6