- syslog-ng - lists.balabit.hu

compression question
by Dave Patterson 07 Jul '04

07 Jul '04

hello all, how do you evoke compression of recently rotated files from within syslog-ng.conf ? Thanks, Dave Patterson Open LabNet Staff

1 0

syslog-ng conf confusion
by Chet Harvey 07 Jul '04

07 Jul '04

Hi all, I am trying to change a box from syslog to syslog-ng but I cant quite get the syntax down. Here is my current syslog.conf: local0.* %/var/log/filter.log local7.* %/var/log/dhcpd.log *.notice;kern.debug;lpr.info;mail.crit;news.err;local0.none;local7.none %/var/log/system.log security.* %/var/log/system.log auth.info;authpriv.info;daemon.info %/var/log/system.log *.emerg * This is how I did my syslog-ng.conf: # # This sample configuration file is essentially equilivent to the stock # FreeBSD /etc/syslog.conf file. # # # options options { long_hostnames(off); sync(0); }; source src { unix-stream("/var/run/log"); pipe("/dev/klog"); internal(); }; destination dest { file("/var/log/filter.log"); }; destination stunnel { tcp("127.0.0.1" port(514)); }; log { source(src);destination(dest); }; log { source(src);destination(stunnel); }; # # destinations # destination messages { file("/var/log/system.log"); }; destination firewall { file("/var/log/filter.log"); }; destination dhcp { file("/var/log/dhcp.log"); }; # log facility filters # filter f_auth { facility(auth); }; filter f_authpriv { facility(authpriv); }; filter f_console { facility(console); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_ftp { facility(ftp); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_security { facility(security); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; # # log level filters # filter f_emerg { level(emerg); }; filter f_alert { level(alert..emerg); }; filter f_crit { level(crit..emerg); }; filter f_err { level(err..emerg); }; filter f_warning { level(warning..emerg); }; filter f_notice { level(notice..emerg); }; filter f_info { level(info..emerg); }; filter f_debug { level(debug..emerg); }; # # *.err;kern.debug;auth.notice;mail.crit /dev/console # # # *.notice;kern.debug;lpr.info;mail.crit;news.err /var/log/messages # log { source(src); filter(f_notice); destination(messages); }; log { source(src); filter(f_kern); filter(f_debug); destination(messages); }; log { source(src); filter(f_news); filter(f_err); destination(messages); }; # # security.* /var/log/security # log { source(src); filter(f_security); destination(messages); }; ## firewall specific log { source(src); filter(f_local0); destination(firewall); }; log { source(src); filter(f_local7); destination(dhcp); }; Hopelessly lost......thanks for any insight/education... -- Chet

1 0

Syslog-NG 1.6.3/1.6.4 broken under OpenBSD 3.5.
by Gustavo Chamone 07 Jul '04

07 Jul '04

Folks, Syslog-NG 1.6.3 and 1.6.4 fails to compile on OpenBSD 3.5 -- although, 1.6.2 works 'smoothly'. Compilation stops at: In file included from macros.c:64: /usr/include/arpa/inet.h:74: warning: `struct in_addr' declared inside parameter list /usr/include/arpa/inet.h:74: warning: its scope is only this definition or declaration, which is probably not what you want. /usr/include/arpa/inet.h:75: warning: `struct in_addr' declared inside parameter list /usr/include/arpa/inet.h:75: warning: parameter has incomplete type /usr/include/arpa/inet.h:79: warning: parameter has incomplete type /usr/include/arpa/inet.h:85: warning: parameter has incomplete type macros.c: In function `format_tzofs': macros.c:118: `tm' undeclared (first use in this function) macros.c:118: (Each undeclared identifier is reported only once macros.c:118: for each function it appears in.) *** Error code 1 Stop in /root/source/syslog-ng/syslog-ng-1.6.3/src. *** Error code 1 Stop in /root/source/syslog-ng/syslog-ng-1.6.3/src (line 253 of Makefile). *** Error code 1 Stop in /root/source/syslog-ng/syslog-ng-1.6.3/src (line 418 of Makefile). *** Error code 1 Stop in /root/source/syslog-ng/syslog-ng-1.6.3 (line 168 of Makefile). Keep up the good work! Best regards, Gustavo Chamone

3 2

Syslog-ng-Mysql error
by Venkata Phani Kiran Achanta 07 Jul '04

07 Jul '04

Greetings all, Everything was going well until I got this error while loading the Mysql tables.... DBD::mysql::db do failed: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '192.168.254.250', 'auth', 'notice', 'notice', '25', '2004-07-01 at ./db-loader.pl line 19, <FH> line 1. And my line 1 in mysql.pipe looks like this INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '192.168.254.250', 'auth', 'notice', 'notice', '25', '2004-07-01', '15:26:28', 'DNS_NS25','DNS_NS25: NetScreen device_id=DNS_NS25 [No Name]system-notification-00257(traffic): start_time=\"2004-07-01 15:30:26\" duration=2 policy_id=0 service=dns proto=17 src zone=Trust dst zone=Untrust action=Permit sent=99 rcvd=274 src=192.168.254.2 dst=63.209.70.231 src_port=1116 dst_port=53 src-xlated ip=12.28.143.203 port=1116 /etc/syslog-ng/syslog-ng.conf destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM','$MSG' )\n") template-escape(no)); }; The problem obviously is with the msg field, at times the msg field wouldn't get terminated with the Single quote that is required for the SQL INSERT syntax. I am sure that atleast one of you may have already came across this problem. Is there a work around for this? Any ideas....let me know if you need more info to get me out of this error. Thanks in advance. Thanks, Venkata Achanta

1 0

Newbie - packet format
by A Ananth 06 Jul '04

06 Jul '04

Hello, After trying to find the answer in the FAQ and archives without success, I am hoping this group can answer the questions below: Q. Does syslog-ng send UDP messages formatted as per RFC3164 to port 514? If not by default, can it configured to do so? I have a syslog receiver that is able to correctly receive standard syslog messages but seems unable to receive messages from a Solaris box where syslog-ng has been installed. Thanks in advance, -- A N Ananth Prism Microsystems --------------------------------- Do you Yahoo!? New and Improved Yahoo! Mail - Send 10MB messages!

2 1

syslog-ng and sqlsyslogd
by John Jason Brzozowski 05 Jul '04

05 Jul '04

Hello, I recently setup syslog-ng to use sqlsyslogd to insert syslog information into a MySQL database. After some testing I found that the some extra data is being added to each record only when called by syslog-ng. Each record in the database has <###> where ### is some random number. Has anyone seen this? Thanks, John

3 3

Help with sorting by host
by phusion 05 Jul '04

05 Jul '04

Hi, I can't figure out why the following won't work. My server config file is at the bottom. I'm trying to get it to log service logs locally on the server to the directory /var/log/ (multiple files) like normal, and also to the directory /storage/logs/$YEAR/$MONTH/$DAY/$HOST/ (multiple files), so all the service logs for each host will go into that specific host directory like host1 or host2. Also, named and sshd log messages to syslog-ng. I'm not sure what the problem is. Let me know what you think. Thanks. # CONFIG FILE # Options # options { long_hostnames(off); sync(0); }; # Sources # source local { unix-dgram("/var/run/log"); internal(); file("/dev/klog"); }; source network { tcp(port(514) max-connections(10) keep-alive(yes)); }; # Destinations # destination localhost { file("/var/log/all.log"); }; destination hosts { file("/storage/logs/$YEAR/$MONTH/$DAY/$HOST" owner(root) group(wheel) perm(0600) dir_perm(0700) create_dirs(yes)); }; # Filters # filter d_named { match("named[\[0-9]+\]"); }; filter d_sshd { match("sshd[\[0-9]+\]") and match("Server listening") or match("Connection from") or match("(Accepted|Failed) password") or match("Connection closed") or match("Closing connection"); }; filter h_host1 { host("host1"); }; filter h_host2 { host("host2"); }; # Logs # log { source(local); destination(localhost); }; log { source(local); filter(h_host1); filter(d_named); filter(d_sshd); destination(hosts); }; log { source(remote); filter(h_host2); filter(d_sshd); destination(hosts); }; __________________________________ Do you Yahoo!? Yahoo! Mail is new and improved - Check it out! http://promotions.yahoo.com/new_mail

1 0

garbled kernel messages
by Balazs Scheidler 04 Jul '04

04 Jul '04

Hi, I discovered a problem recently and I wanted to let you know about it. The Linux kernel may drop bytes from its ringbuffer which causes a garbled message to reach the logs. For example, I enabled logging on my notebook for all loopback traffic, and used ping -f to generate a lot of messages. To avoid syslog-ng's complexity in the picture, I simply used "cat" to read kernel messages: # cat /proc/kmsg > kmsg ## generated about 40000 packets # grep -v '^<4>IN=lo OU' kmsg RC=127.0.0.1 DST=127.0.0.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=15957 DF PROTO=ICMP TYPE=8 CODE=0 ID=21848 SEQ=21822 IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=11274 DF PROTO=ICMP TYPE=8 CODE=0 ID=22104 SEQ=2604 As you can see both messages missed the syslog header (the string <4>), but messages might be garbled in different ways, in general the linux kernel shifts the ring buffer whenever it is full, without flow control. I also checked the the cat process with "strace" to confirm that the kernel itself returns garbled messages. A workaround is to increase the kernel ring buffer size which is possible using a compile time option in recent kernels, but it is also possible to change by patching the value of LOG_BUF_LEN in the beginning kernel/printk.c to a greater value (must be power of two) However this will not necessarily fix the problem, the kernel can always "outperform" its userspace, e.g. it can generate way more messages than a userspace program can handle. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

error when installing libol on HP UX
by Albert Collazo 03 Jul '04

03 Jul '04

Hi, i'm new to this...and when i hit the "make" command for libol i get the following error: (Bundled) cc: "format.c", line 306: error 1549: Modifiable lvalue required for a ssignment operator. do you know why? and what is the work around? i have libol-0.3.13. thanks!! al _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/

2 1

Antw: [syslog-ng]error when installing libol on HP UX
by Stephan Hendl 03 Jul '04

03 Jul '04

Using the newest gcc (3.2.? I think) available from the hp porting centre it worked for me. With the hpux ansi c compiler I had trouble. Alternatively on monday I can send a binary distribution of libol-0.3.13 for hpux 11.0 to you if you want... Please let me know. Stephan Dr. Stephan Hendl Systemmanagement ----------------------------------- Landesbetrieb für Datenverarbeitung und Statistik Land Brandenburg Adresse: 14467 Potsdam, Dortustr. 46 Telefon: +49-(0)331 39-471 Fax: +49-(0)331 27548-1187 Mobil: +49-(0)160 90 645 893 EMail: Stephan.Hendl(a)lds.brandenburg.de Internet: http://www.lds-bb.de >>> nme2nme(a)hotmail.com 03.07.2004 00:52:35 >>> Hi, i'm new to this...and when i hit the "make" command for libol i get the following error: (Bundled) cc: "format.c", line 306: error 1549: Modifiable lvalue required for a ssignment operator. do you know why? and what is the work around? i have libol-0.3.13. thanks!! al _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar * get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0