- syslog-ng - lists.balabit.hu

Syslog Relay Question
by Stevo 13 Aug '04

13 Aug '04

Hi Team, I currently use Syslog-NG to receive all my router syslog messages. Is there a way I can forward these messages on to another syslog server as well?? Stevo

2 1

Logging to a specific destination
by Anoop Rajendra 12 Aug '04

12 Aug '04

I need to log all messages from iptables, ipmasq to a particular file (say iptables.log) and to that only and nothing else. Is there a way to specifically define this, ie say that messages from this daemon should go nowhere else? i've tried - # IPMasq Messages destination ipmasq { file("/var/log/iptables.log" owner("root") group("adm") perm(0640)); }; filter f_iptables( match("iptables"); ); filter fn_iptables( not match("iptables"); ); log { source(src); filter(f_authpriv); filter(fn_iptab); destination(authlog); }; log { source(src); filter(f_syslog); filter(fn_iptab); destination(syslog); }; log { source(src); filter(f_daemon); filter(fn_iptab); destination(daemon); }; log { source(src); filter(f_kern); filter(fn_iptab); destination(kern); }; log { source(src); filter(f_lpr); filter(fn_iptab); destination(lpr); }; log { source(src); filter(f_mail); filter(fn_iptab); destination(mail); }; log { source(src); filter(f_user); filter(fn_iptab); destination(user); }; log { source(src); filter(f_uucp); filter(fn_iptab); destination(uucp); }; log { source(src); filter(f_iptab); destination(ipmasq); }; Yet all the IPMasq messages are passed top both iptables.log and /var/log/messages. All IPMasq messages are prefixed with the string "iptables" using --log-prefix iptables What am I doing wrong? Thanks, Anoop /// ________________________________________________ Everybody has something to conceal. -- Humphrey Bogart

2 1

Logging to a specific destination
by Anoop Rajendra 12 Aug '04

12 Aug '04

I need to log all messages from iptables, ipmasq to a particular file (say iptables.log) and to that only and nothing else. Is there a way to specifically define this, ie say that messages from this daemon should go nowhere else? Thanks, Anoop /// ________________________________________________ To be is to program.

2 1

RE: [syslog-ng] Re: leak in spoof_source support
by G. C. 10 Aug '04

10 Aug '04

Ok, we tried it and... it works! Process is running smoothly with 780k stable memory occupation. Thanks a lot, I want to do some more testing but I'm quite confident the fix is working. Peter. __________________________________________________ Can you check if this one works for you? Index: src/afinet.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/afinet.c,v retrieving revision 1.25.4.6 diff -u -r1.25.4.6 afinet.c --- src/afinet.c 5 Aug 2004 11:35:12 -0000 1.25.4.6 +++ src/afinet.c 6 Aug 2004 18:15:32 -0000 @@ -653,6 +653,7 @@ if (libnet_write(self->lnet_ctx) < 0) { werror("Error sending raw frame, error: %z", libnet_geterror(self->lnet_ctx)); } + ol_string_free(msg_line); } else { fallback_socket: -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _________________________________________________________________ MSN 8 with e-mail virus protection service: 2 months FREE* http://join.msn.com/?page=features/virus

1 0

(no subject)
by Bazsi 09 Aug '04

09 Aug '04

1 0

$TEMPLATE available with unix-stream
by Loic SPINDLER 09 Aug '04

09 Aug '04

Unix stream users : I'd need to have syslog messages catched by the syslog-ng and forwarded to local daemon using unix-stream. Moreover, as I collect different facilities and level I'd like to ask syslog-ng to add to each line forwarded the $FACILITY to the beginning of the line. Is this now possible ? loic

2 1

program driver only works once
by David Schwendinger 06 Aug '04

06 Aug '04

All, I have a program driver setup in the syslog-ng.conf file to execute a perl script which sends an email with fixed content based on a syslog message. This first time I run syslog-ng with the program driver, syslog-ng and the script appear in a "ps -ef" listing as mentioned in the syslog-ng docs.: "NOTE: the program is executed once at startup, and kept running until SIGHUP or exit. The reason is to prevent starting up a large number of programs for messages, which would imply an easy DoS." The first time the conditions are met to send the email it works but the script which was listed with syslog-ng in a "ps-ef" no longer appears in a "ps -ef" and I can not seem to get it to start again. "service syslog-ng restart" or "stop" then "start" does not work. Reboot does not work. How can I get this script ready to send another alert after it has been triggered? The following are pertinent lines from the syslog-ng.conf file. source s_sys { unix-stream("/dev/log"); internal(); }; destination d_mail-me { program("/etc/syslog-ng/test-mail.script"); }; filter f_filter9 { match("for user"); }; log { source(s_sys); filter(f_filter9); destination(d_mail-me); }; thanks, David

1 0

leak in spoof_source support
by Balazs Scheidler 06 Aug '04

06 Aug '04

>Researching the problem we found out that it seems to be related to >the >"address spoofing" options. Enabling this option, under heavy traffic (which >means always, in our case) we experience this memory leak problem. >Disabling the address spoofing option, everything runs smoothly with only >about 720k memory occupation. > >The problem is "we need this option"... And this is getting critical, can >anyone hep? >Thanks, Hmm.. I possible forgot to free something in that path. I'll check it out for you. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 1

possibly missed mail
by Balazs Scheidler 06 Aug '04

06 Aug '04

hi, sorry, I haven't noticed our list manager put me to nomail mode. I quickly grepped through the last couple of mails in the archive, but if you think I missed something, please resend. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Newbie Filter question (Solaris)
by Kenneth Gullberg 06 Aug '04

06 Aug '04

Hi, Im new to syslogng and want to replace the normal syslogd in solaris with -ng because of the filters. I run postfix on 2 loadbalanced machines and i want to get rid of the healthchecks log entries. I setup a conf file that looks like this: options { long_hostnames(off); # doesn't actually help on Solaris, log(3) truncates at 1024 chars log_msg_size(8192); # buffer just a little for performance sync(1); # memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(2048); # The time to wait before a dead connection is reestablished (seconds) time_reopen(10); }; ############################################################### source src { sun-stream("/dev/log" door("/etc/.syslog_door")); internal(); }; ############################################################### destination alteon { file("/var/log/alteon"); }; destination notalteon { file("/var/log/notalteon"); }; destination ipf { file("/var/log/ipf.log"); }; ############################################################### filter f_mail { facility(mail); }; filter f_not_mail { not facility(mail); }; filter f_ipf { facility(local0); }; filter f_alteon { match("10.155.68.2") or match("10.155.68.3"); }; filter f_notalteon { not match("10.155.68.2") or not match("10.155.68.3"); }; ############################################################### log { source(src); filter(f_alteon); destination(alteon); }; log { source(src); filter(f_notalteon); destination(notalteon); }; log { source(src); filter(f_ipf); destination(ipf); }; According to this i should log everything that contains 10.155.68.2 or .3 to /var/log/alteon and if it doesnt contain .2 or .3 to /var/log/notalteon and it will also send the ip filter logs to its own log (which works). It seems that f_alteon och f_ipf works. But f_notalteon logs both stuff that does contain .2 and .3 and stuff that doesnt contain .2 and .3 What have i missed? // Kenneth

2 1