- syslog-ng - lists.balabit.hu

Automatic starting of syslog-ng
by Thomas Reidy 30 Aug '04

30 Aug '04

Running on Red Hat 9.. the application is running, logging perfectly.. I built it w/o the RPMs, and need to know how to get this to start automatically during startup.. its been a long day, so this may be obvious.. Am I right to assume if I reboot the box, I won't get logging until I manually start the script? I could just put something simple in /etc/init.d, etc but need to know what the file should say.. the init scripts never just seem to launch the programs... Thanks in advance... -- --- Tom t_r_e_i_d_y_(a)-g-m-a-i-l-.-c-o-m

3 3

Anyone Get Syslog-NG To Compile on Red Hat?
by Rhugga 27 Aug '04

27 Aug '04

I am trying to get syslog-ng 1.6.5 compiled on a RH 9 system. I compiled libol into /usr/local/libol-0.3.14. I tried the following configuration options when trying to build sysllg-ng: ./configure --prefix=/usr/local/syslog-ng-1.6.5 --with-libol=/usr/local/libol-0.3.14/lib --with-libnet=/usr/local/libol-0.3.14/bin/ ./configure --prefix=/usr/local/syslog-ng-1.6.5 --with-libol=/usr/local/libol-0.3.14/lib --with-libnet=/usr/local/libol-0.3.14 ./configure --prefix=/usr/local/syslog-ng-1.6.5 --with-libol=/usr/local/libol-0.3.14/lib --with-libnet=/usr/local/libol-0.3.14/bin/libol-config Each time is complains that it cannot find libol-config: <snip> checking for strptime... yes checking for TCP wrapper library... -lwrap checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... no checking whether to enable spoof_source support... no checking libol version >= 0.3.14... configure: error: libol-config not found in the specified location Here is libol-config: syslog:~/syslog-ng-1.6.5 #ls -la /usr/local/libol-0.3.14/bin/ total 36 drwxr-xr-x 2 root root 4096 Aug 27 07:22 . drwxr-xr-x 5 root root 4096 Aug 27 07:22 .. -rwxr-xr-x 1 root root 1288 Aug 27 07:22 libol-config -rwxr-xr-x 1 root root 24264 Aug 27 07:22 make_class It finds the libol library correctly, otherwise it dies before it reaches this error. It just doesn't properly detect libol-config. Anyone have any ideas? Thanks, CC

3 5

Question Regarding Syslog-NG Capabilities
by Rhugga 27 Aug '04

27 Aug '04

If I simply want to have the syslogd daemons on my Solaris boxes send their logs to a remote loghost running syslog-ng, I don't need syslog-ng on the solaris boxes correct? So on my solaris box, /etc/syslog.conf would contain an entry like this: auth.info @loghost Loghost of course would be defined in /etc/hosts and contain the IP address of the Linux system running syslog-ng. Will this config work? Some of the documentation confused me implying that syslog-ng is also needed on the client side. I will be using a standard TCP listener with syslog-ng on the loghost machine, likely using port 514. Thanks, rhugga

2 1

Openbsd 3.5 on SPARC64 not login network hostname
by Darren J. Wise 26 Aug '04

26 Aug '04

Hi, I have a Sun Ultra 5 that I am setting up as a log server using OpenBSD 3.5 with the stable port of syslog-ng 1.5.24. In the syslog-ng.conf file I have got the following options: options { sync(0); time_reopen (10); log_fifo_size (1000); long_hostnames (no); use_dns (yes); use_fqdn (no); create_dirs(yes); chain_hostnames (no); keep_hostname (yes); perm (0600); }; And the following network related source, destination and log options: source s_net { udp(); }; destination d_net { file("/export/syslog-ng/$HOST/messages"); }; log { source(s_net); destination(d_net); }; I have got a Sparc Solaris 9 box and Linux box logging to this machine using the default Solaris/Linux syslog. The problem that I am seeing is that the log server logs all messages as if they have came from the localhost, an example from the Linux machine on the log server (loghost-test is the name of the log server) : Aug 24 12:53:38 loghost-test xfs: Entry deleted from font path. I have also compiled syslog-ng 1.6.5 with libol 0.3.14 and still get the same problem. Any help would be greatly appreciated. Thanks Darren

3 2

offline mode?
by Maarten Thibaut 25 Aug '04

25 Aug '04

Hi, First of all, thanks for the neat software you guys make. Our organization is rolling out a mobile pc platform, we want some types of log events stored on a centralized server which is only reachable from the inside of our corporate network. So when the machine is not inside our network, the log entries need to be stored locally until such time as the centralized server is reachable. Then the logs get sent through. Can we do this with syslog-ng? From the features listed at your home page it would seem this is a standard feature... Is that right? -- maarten

3 3

log viewing utilities?
by Ellis.Chris 23 Aug '04

23 Aug '04

Now that I have half of the equation solved (i.e. a better method of collecting log files using syslog-ng), does anyone have suggestions for the "other half", i.e. viewing tools that let me look at the log files without having to use grep with regular expressions and such? Compound text searches would be a great start... ! Thanks... Chris Ellis/ CIC Secure Perimeter

2 1

Michael J. Bock/NetServ/DST/US is out of the office.
by MJBock＠dstsystems.com 23 Aug '04

23 Aug '04

I will be out of the office starting 08/20/2004 and will not return until 08/30/2004. I will respond to your message when I return.

1 0

dhcp3-server logging problem
by natxete＠xs4all.nl 23 Aug '04

23 Aug '04

Hallo everybody, This is my first message to this list. I have a problem with the way syslog-ng 1.5.15 (stock debian woody) is logging the dhcp3-server messages. I have searched in the mailing-list archives and through google but could not find the answer to my problem. Which is: In the conf file for dhcp3-server, one can specify the facility where the log messages should go. The specific lines are: # Use this to send dhcp log messages to a different log file (you also # have to hack syslog.conf to complete the redirection). log-facility local7; So I created some new entries in /etc/syslog-nl/syslog-ng.conf, which are: # dest file where i want the dhcpd stuff: destination dhcpd { file("/var/log/dhcpd.log" owner("root") group("adm") perm(0640)); }; # this is all in one line, obviously. filter f_local7 { facility(local7); }; log { source(src); filter(f_local7); destination(dhcpd); }; So I restarted both services in order to reload their config files, and yes, now I get all the dhcp logging in /var/log/dhcpd.log, *but* I also get it in /var/log/syslog, which is driving me nuts, because I also have logcheck installed and every hour I get all the dhcpd messages in the logcheck emails. Is there a way I have overlooked to prevent this? TIA, N.Asenjo

2 1

RE: [syslog-ng]check_hostname(yes) - parse error
by Smith, Krista 17 Aug '04

17 Aug '04

Yes, I finally figured that out. :) As other options are added though, it might be handy to know which ones are available with which versions, maybe on the online manual options page? I didn't download syslog-ng very long ago and at the time it was the most recent one listed on the download page. So I didn't realize so many others had come out in the meantime and thought that if it was listed on the options page with all the rest, it must be a standard one available to me. I stand corrected. :) Thanks, Krista -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, August 16, 2004 11:54 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]check_hostname(yes) - parse error On Wed, 2004-08-11 at 23:36, Smith, Krista wrote: > Hello, > > I've got syslog-ng (1.4.17) working on a Solaris 9 central logserver, > except for one small thing. I'm trying to use the option > "check_hostname(yes)" but I get a parse error when I add it to my > options. My options line looks like this: > > options { create_dirs(yes); keep_hostname(yes); check_hostname(yes); > }; > > If I remove that portion of the line, it gives no error. I've checked > for invisible characters, searched Google and the syslog-ng archives, > but cannot find anything suggesting what the problem might be. If > anyone can point me in the right direction I'd be grateful. try it with syslog-ng 1.6.4, you'll be surprised :) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]chroot/syslog-ng/Solaris8
by Roy G Davis 16 Aug '04

16 Aug '04

yes, thank you i have syslog-ng accepting normal things using streams/doors. but it is not picking up anything generated from whithin the chroot jail. i actually get the same behavior w sun's syslog too. that is: i have sftp-logging patch applied to openssh code. it works for a non-chroot user - you see them login, change directory, upload/download file, log out etc. but all i see is initial login for a chroot user. THX -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Monday, August 16, 2004 12:58 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]chroot/syslog-ng/Solaris8 On Sat, 2004-08-14 at 20:00, Roy G Davis wrote: > -----Original Message----- > From: syslog-ng-admin(a)lists.balabit.hu on behalf of Nate Campi > Sent: Fri 8/13/2004 7:30 PM > To: syslog-ng(a)lists.balabit.hu > Cc: > Subject: Re: [syslog-ng]chroot/syslog-ng/Solaris8 > On Fri, Aug 13, 2004 at 01:26:54PM -0500, Roy G Davis wrote: > > does anyone have experience using syslog-ng with chroot-ed > applications > > on Solaris 8? > > specifically, i am running ssh/sftp chroot-ed (with sftp logging > patch) > > and i get no logging. > > i know it is something about /dev/log etc in the chroot environment > but > > cant find exact info. > > Try this, you might not have found it since it might seem postfix > specific, but it applies to anything chrooted: > > http://www.campin.net/syslog-ng/faq.html#postfix maybe the link is linux specific, you need to use sun-streams combined with the door option on Solaris. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0