- syslog-ng - lists.balabit.hu

please help find the "parse error" in this small syslog-ng.conf...
by seberino＠spawar.navy.mil 26 Jul '04

26 Jul '04

This syslog-ng.conf: options {long_hostnames(no); keep_hostname(yes); chain_hostnames(no);}; source client_sources {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; destination local_dest {file("/var/log/messages");}; destination remote_dest {tcp(ip("127.0.0.1") port(514));}; log {source(client_sources); destination(local_dest);}; log {source(client_sources); destination(remote_dest);}; gives this error messages when I try to use it... [laptop root /etc/rc.d] # /usr/local/sbin/syslog-ng -f /etc/syslog-ng.conf parse error at 8 Parse error reading configuration file, exiting. (line 8) I've stared at this syslog-ng.conf for a long time and can't see what the problem is. Any help would be greatly appreciated. Sincerely, Chris

2 2

RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers
by Amaral, Angelo 24 Jul '04

24 Jul '04

Andrew, I put in my system, the hosts.allow below: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ # hosts.allow This file describes the names of the hosts which are # allowed to use the local INET services, as decided # by the '/usr/sbin/tcpd' server. # in.tftpd: ALL :allow sshd: ALL :allow ALL: ALL :deny ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ And the configuration continue not working. May you help me, please. Thanks. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Andrew J Caines Sent: quarta-feira, 21 de julho de 2004 20:25 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers Angelo, > I compile the syslog-ng with support tcpwrappers. > I put in hosts.deny my filter and it?s not work. From reading the documentation, you and Joe should be aware that hosts.deny is depreciated and that deny statements go in hosts.allow, eg. ALL : localhost 127.0.0.1 your.server.or.IP : allow sshd : ALL : severity auth.info : allow syslog-ng : your.network : allow ALL : ALL : severity auth.notice : \ twist echo "You are not welcome to use %d from %h." You should also see any errors or warnings when you run tcpdchk. -Andrew- -- _______________________________________________________________________ | -Andrew J. Caines- Unix Systems Engineer A.J.Caines(a)halplant.com | | "They that can give up essential liberty to obtain a little temporary | | safety deserve neither liberty nor safety" - Benjamin Franklin, 1759 | _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

Sensord (lm_sensors) and Syslog-ng using "program()"
by Ann Hopkins 23 Jul '04

23 Jul '04

I was wondering if anyone sees any problem with what I am doing with the following script. I want an "Alarm" which causes an "Alert" message to actually shutdown the machine under certain circumstances, since I run a family server and I don't have a backup. 1) "sensord" (lm_sensors library) is running and I can do "sensors" command to get a result. via686a-isa-6000 Adapter: ISA adapter Algorithm: ISA algorithm CPU core: +1.73 V (min = +1.68 V, max = +2.49 V) +2.5V: +2.59 V (min = +2.24 V, max = +2.74 V) I/O: +3.40 V (min = +2.95 V, max = +3.62 V) +5V: +4.87 V (min = +4.47 V, max = +5.49 V) +12V: +11.74 V (min = +10.79 V, max = +13.18 V) CPU Fan: 0 RPM (min = 3000 RPM, div = 2) P/S Fan: 0 RPM (min = 3000 RPM, div = 2) SYS Temp: +30.0Â°C (high = +45Â°C, hyst = +40Â°C) CPU Temp: +38.5Â°C (high = +60Â°C, hyst = +55Â°C) SBr Temp: +25.1Â°C (high = +65Â°C, hyst = +60Â°C) 2) "syslog-ng" is working and logging the data under 'local5". The following is the pertinent "syslog-ng.conf" data. All the data is logged and the "Alert" data triggers input to a shell program. filter f_local5 { facility(local5); }; filter f_sensorA { level(alert) and facility(local5); }; destination sensord { file("/var/log/local5.log"); }; log { source(src); filter(f_local5); destination(sensord); }; # Sensor Alarm Messages - Programs are loaded once (email) destination sensor_alarm { program("/usr/local/sbin/sensor_alarm.sh"); }; log { source(src); filter(f_sensorA); destination(sensor_alarm); }; 3) Program "sensor_alarm.sh" will try to shutdown the machine if it reaches a too hot condition. I don't have fan sensors so it will never trigger. I am no programmer, please excuse my very primitive (and naive) coding. Is there anything wrong with calling this program? SENSOR_ALARM.SH #!/bin/sh # Make sensord do something useful with syslog-ng # -k does nothing will use a -h halt later # +2 in 2 minutes while read line; do echo $line | /usr/bin/mail -s "SENSORD Alarm" root@localhost AlarmName="" AlarmName=`echo $line | /usr/bin/awk -F":" '{ print $1 }'` case "$AlarmName" in "CPU core") /sbin/shutdown -k +2 "CPU core ALARM - bad voltage" ;; "SYS Temp") /sbin/shutdown -k +2 "SYS Temp ALARM - too hot" ;; "CPU Temp") /sbin/shutdown -k +2 "CPU Temp ALARM - too hot" ;; "CPU Fan") /sbin/shutdown -k +2 "CPU Fan ALARM - fan down" ;; "P/S Fan") /sbin/shutdown -k +2 "P/S Fan ALARM - fan down" ;; *) echo "WARNING SENSORD - Be Careful!" | /usr/bin/wall ;; esac done

1 0

syslog-ng 1.6.4 and tcp_wrappers
by Amaral, Angelo 22 Jul '04

22 Jul '04

My name is Angelo, And I have equal problem of Joe Geek I compile the syslog-ng with support tcpwrappers. I put in hosts.deny my filter and it´s not work. Thanks. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Joe Geek Sent: quinta-feira, 15 de julho de 2004 18:41 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers I've got syslog-ng v 1.6.4 compiled with tcp_wrapper support and tried to block a particular ipaddress in hosts.deny Does the syslog-ng daemon have to be started from inetd for this to work? Does syslog-ng use tcp_wrappers for UDP traffic also? _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

How to get sure if a remote syslog-ng is down?
by julius 21 Jul '04

21 Jul '04

Hi, at the moment my remote syslog-ng prints every 10 minutes a message, theres a message when the remote syslog-ng disconnected, but what happens when the remote host boots up and syslog-ng cant be started?

2 1

syslog-ng and mysql
by Deepu George 19 Jul '04

19 Jul '04

I am trying to configure syslog-ng to write to mysql. I have already installed mysql and created the database and tables. When I am enabling the syslog-ng to mysql using the following script in syslog-ng.conf , I get a parse error when staring syslog-ng destination d_mysql { pipe("/tmp/mysql.pipe" template ("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST','$FACILITY','$PRIORITY','$LEVEL','$TAG','$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n")template-escape(yes)); }; log { source(net); destination(d_mysql); }; Best regards Deepu

1 0

[Q]Syslog-ng 1.6.4 compile help
by Martin Raines (mraines) 16 Jul '04

16 Jul '04

Team, I have Solaris 8 and syslog-ng 1.6.4 and libol 3.13 I would appreciate some clear intructions on how to get them compliled on my system please. I have them installed OK using pkgadd but cannot find any info about getting them compliled. Many thanks Martin

1 0

RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers
by Amaral, Angelo 16 Jul '04

16 Jul '04

My name is Angelo, And I have equal problem of Joe Geek I compile the syslog-ng with support tcpwrappers. I put in hosts.deny my filter and log come in. Thanks. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Joe Geek Sent: quinta-feira, 15 de julho de 2004 18:41 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers I've got syslog-ng v 1.6.4 compiled with tcp_wrapper support and tried to block a particular ipaddress in hosts.deny Does the syslog-ng daemon have to be started from inetd for this to work? Does syslog-ng use tcp_wrappers for UDP traffic also? _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]syslog-ng 1.6.4 and tcp_wrappers
by Rule, Ted 16 Jul '04

16 Jul '04

In /etc/hosts.allow you need something like this listing all the permitted clients and denying anything else. syslog-ng: 172.22.2.13: allow syslog-ng: 172.18.112.3: allow syslog-ng: ALL: deny It doesn't need any inetd configuration. I don't believe it works for UDP, but I wouldn't lockout UDP syslog traffic that way anyway; better to block it at the layer beneath with ipchains/iptables/ipfilter or similar. For extra resilience where a firewall separates the syslog-ng client and server, I added some TCP Keepalive code to ensure a relatively quiet syslog-ng TCP stream is always kept alive in the face of Firewall-1/iptables idling out the connection, but it's not essential, and it may even have been included in later releases anyway. Ted $ diff -u afinet.c-1.6.0rc3.orig afinet.c-1.6.0rc3.patched --- afinet.c-1.6.0rc3.orig Sat Feb 28 11:42:50 2004 +++ afinet.c-1.6.0rc3.patched Sat Feb 28 11:42:50 2004 @@ -28,6 +28,8 @@ #include "cfgfile.h" #include "pkt_buffer.h" +#include <sys/socket.h> +#include <sys/types.h> #include <errno.h> #include <string.h> #include <assert.h> @@ -217,8 +219,13 @@ CAST(afinet_source, self, c); struct afsocket_source_connection *conn; UINT32 res; + int socklen,sockval; + + socklen=sizeof(sockval); + if ( ( getsockopt(client->super.fd, SOL_SOCKET, SO_TYPE, &sockval, &socklen) == 0 ) && + ( sockval == SOCK_STREAM ) ) { #if ENABLE_TCP_WRAPPER - { + { struct request_info req; request_init(&req, RQ_DAEMON, "syslog-ng", RQ_FILE, client->super.fd, 0); @@ -230,9 +237,19 @@ close_fd(&client->super, 0); return ST_OK | ST_GOON; } + } +#endif + +#ifdef SO_KEEPALIVE + sockval=1; socklen=sizeof(sockval); + if ( setsockopt(client->super.fd, SOL_SOCKET, SO_KEEPALIVE, &sockval, socklen) < 0 ) { + notice("setsockopt SO_KEEPALIVE failure during do_open_afinet_connection()"); + } else { + notice("setsockopt SO_KEEPALIVE Ok in do_open_afinet_connection()"); } - #endif + } + if (c->num_connections >= c->max_connections) { CAST(inet_address_info, inet_addr, client_addr); @@ -250,8 +267,6 @@ } return res; } - - } static int @@ -488,6 +503,17 @@ if (self->conn_fd) { return ST_OK | ST_GOON; +#ifdef SO_KEEPALIVE + if ( (self->super.flags & 0x0003) == AFSOCKET_STREAM ) { + int sockval=1; + + if ( setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &sockval, sizeof(sockval)) < 0 ) { + notice("setsockopt SO_KEEPALIVE failure during do_init_afinet_dest()"); + } else { + notice("setsockopt SO_KEEPALIVE Ok in do_init_afinet_dest()"); + } + } +#endif } else { io_callout(self->cfg->backend, $ Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

syslog-ng 1.6.4 and tcp_wrappers
by Joe Geek 15 Jul '04

15 Jul '04

I've got syslog-ng v 1.6.4 compiled with tcp_wrapper support and tried to block a particular ipaddress in hosts.deny Does the syslog-ng daemon have to be started from inetd for this to work? Does syslog-ng use tcp_wrappers for UDP traffic also?

1 0