- syslog-ng - lists.balabit.hu

logger-ng
by Ben Russo 30 Jun '04

30 Jun '04

Many of us are familiar with "logger" that sends syslog messages... I use it all the time when writing scripts. What about a "logger-ng" that has more features? Such as being able to send syslog messages via TCP/UDP to specified port numbers instead of just to the localhost. For example: logger-ng -d 10.10.10.10:5514 [-t|-u] -p local3.warn This is a message I want to send to the syslog daemon listening on port 5514 at the IP address 10.10.10.10 In addition to specifying UDP/TCP and a destination IP address, some other features I can think of are: tailing a log file listening on a named pipe taking standard input to send logs -Ben.

1 0

RE: [syslog-ng]use_time_recvd() not working?
by Trapp, Michael 30 Jun '04

30 Jun '04

hi jonathan, have a look at https://lists.balabit.hu/pipermail/syslog-ng/2002-September/003874.html <https://lists.balabit.hu/pipermail/syslog-ng/2002-September/003874.html> regards michael -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Hall J D (ISeLS) Sent: Mittwoch, 30. Juni 2004 16:53 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]use_time_recvd() not working? Hello all, I've recently installed Syslog-ng 1.6.2 on a FreeBSD 4.9 to act as my new collector and I can't get the use_time_recvd() option to work properly. No matter if I specify use_time_recvd(yes) or use_time_recvd(no) the messages, from a Cisco PIX firewall, are still getting recorded with the time from the message and not the local time. Is this a know issue, or am I doing something really silly? Below are the relevant bits from my config Thanks, Jonathan options { long_hostnames(off); sync(0); use_time_recvd(yes); create_dirs(yes); dir_perm(0750); }; source net { udp(ip(193.63.147.98) port(514)); tcp(ip(193.63.147.98) port(1740) keep-alive(yes)); }; destination fwall { file("/var/log/firewalls/$HOST.$YEAR.$MONTH.$DAY.log" perm(0640)); }; filter f_pixmsg { match("%PIX"); }; filter f_local0 { facility(local0); }; log { source(net); filter(f_local0); filter(f_pixmsg); destination(fwall); };

1 0

RE: [syslog-ng]use_time_recvd() not working?
by Schernau, Ed 30 Jun '04

30 Jun '04

Last I knew, this only worked IF you logged via a template. -----Original Message----- From: Hall J D (ISeLS) [mailto:jdhall@glam.ac.uk] Sent: Wednesday, June 30, 2004 10:53 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]use_time_recvd() not working? Hello all, I've recently installed Syslog-ng 1.6.2 on a FreeBSD 4.9 to act as my new collector and I can't get the use_time_recvd() option to work properly. No matter if I specify use_time_recvd(yes) or use_time_recvd(no) the messages, from a Cisco PIX firewall, are still getting recorded with the time from the message and not the local time. Is this a know issue, or am I doing something really silly? Below are the relevant bits from my config Thanks, Jonathan options { long_hostnames(off); sync(0); use_time_recvd(yes); create_dirs(yes); dir_perm(0750); }; source net { udp(ip(193.63.147.98) port(514)); tcp(ip(193.63.147.98) port(1740) keep-alive(yes)); }; destination fwall { file("/var/log/firewalls/$HOST.$YEAR.$MONTH.$DAY.log" perm(0640)); }; filter f_pixmsg { match("%PIX"); }; filter f_local0 { facility(local0); }; log { source(net); filter(f_local0); filter(f_pixmsg); destination(fwall); }; ----------------------------------------- Use of email is inherently insecure. Confidential information, including account information, and personally identifiable information, should not be transmitted via email, or email attachment. In no event shall Citizens or any of its affiliates accept any responsibility for the loss, use or misuse of any information including confidential information, which is sent to Citizens or its affiliates via email, or email attachment. Citizens does not guarantee the accuracy of any email or email attachment, that an email will be received by Citizens or that Citizens will respond to any email. This email message is confidential and/or privileged. It is to be used by the intended recipient only. Use of the information contained in this email by anyone other than the intended recipient is strictly prohibited. If you have received this message in error, please notify the sender immediately and promptly destroy any record of this email.

1 0

use_time_recvd() not working?
by Hall J D (ISeLS) 30 Jun '04

30 Jun '04

Hello all, I've recently installed Syslog-ng 1.6.2 on a FreeBSD 4.9 to act as my new collector and I can't get the use_time_recvd() option to work properly. No matter if I specify use_time_recvd(yes) or use_time_recvd(no) the messages, from a Cisco PIX firewall, are still getting recorded with the time from the message and not the local time. Is this a know issue, or am I doing something really silly? Below are the relevant bits from my config Thanks, Jonathan options { long_hostnames(off); sync(0); use_time_recvd(yes); create_dirs(yes); dir_perm(0750); }; source net { udp(ip(193.63.147.98) port(514)); tcp(ip(193.63.147.98) port(1740) keep-alive(yes)); }; destination fwall { file("/var/log/firewalls/$HOST.$YEAR.$MONTH.$DAY.log" perm(0640)); }; filter f_pixmsg { match("%PIX"); }; filter f_local0 { facility(local0); }; log { source(net); filter(f_local0); filter(f_pixmsg); destination(fwall); };

1 0

Messages coming in messages.0
by Tandon,Nidhi 30 Jun '04

30 Jun '04

Hi I am using syslog-ng.After certain time my messages start coming in file /var/adm/messages.0 instead of messages.From where can I set the maximum size of file.What is the default size?? Thanks & Regards Nidhi

1 0

Cisco Log
by amy wong 30 Jun '04

30 Jun '04

---------- Forwarded message ---------- From: amy wong <amywsp(a)gmail.com> Date: Tue, 29 Jun 2004 17:03:14 +0800 Subject: Cisco Log To: bazsi(a)balabit.hu Hi, I'm new in syslog-ng. Currently install syslog-ng-1.4.7. I have got the cisco router monitor, and log can be seen on /var/log/messages but not /var/log/cisco.log. My questions are do the cisco.log file will be created automatically? and would you show me the right way in setting up? source remote {tcp(); udp();}; destination d_cisco { file("/var/log/cisco.log); }; filter f_cisco_info { level(info); }; filter f_cisco_notice { level(notice); }; filter f_cisco_warn { level(warn); }; filter f_cisco_crit { level(crit); }; filter f_cisco_err { level(err); }; log { source(remote); filter(f_cisco_info); destination(d_cisco); }; log { source(remote); filter(f_cisco_notice); destination(d_cisco); }; log { source(remote); filter(f_cisco_warn); destination(d_cisco); }; log { source(remote); filter(f_cisco_crit); destination(d_cisco); }; log { source(remote); filter(f_cisco_err); destination(d_cisco); }; destination hosts { file("/var/log/HOSTS/$HOSTS/$YEAR/$MONTH/$DAY/$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(remote); destination(hosts); }; thanks amy

2 1

Re: [syslog-ng]dest. tcp and dest. pipe on HPUX
by Stephan Hendl 28 Jun '04

28 Jun '04

the pipe was already created but it dosn't work. It seems that the local syslog data goes into the pipe but the data received via tcp not ;-((( but that is not always true. Mostly data weren't written into the pipe but it works with file. With version 1.6.2 I have the same problem. Stephan Maybe there is a patch ftom HPUX necessary? >>> bazsi(a)balabit.hu 26.06.2004 09:48:57 >>> 2004-06-22, k keltezéssel 15:47-kor Stephan Hendl ezt írta: > Hi, > > I use the syslog-ng-1.6.0rc4 on HPUX 11 and try to send the syslog data > to a tcp-destination (is a ssh tunnel to a central syslog-server) as > well as to a pipe. Unfortunately the syslog-ng creates the pipe but logs > only to the tcp destination and _not_ to the pipe as well. > > Do you have any ideas? syslog-ng won't create the pipe for you but expects to find it there, so you must create it using mkfifo first. I've quickly tested pipe destinations on my local machines and it seems to work. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

libol, make_class, scsh
by bryanh＠giraffe-data.com 26 Jun '04

26 Jun '04

I'm trying to figure out how the build with libol works. I've read the few pages about it on the web site and the README file. I have libol-0.3.13 and syslog-ng-1.5.26. My first question: The syslog-ng make files appear to expect 'make_class' to be installed in my PATH or in a libol directory I specify. But a 'make install' of libol does not install make_class anywhere. The 'make' of libol does generate utils/make_class, though. Shouldn't 'make install' install it? A related question: 'configure' of syslog-ng finds libol by invoking libol-config from the PATH. But 'make install' of libol did not install libol-config. It did create libol-config and when I inserted it in my PATH, syslog-ng configure worked fine. Next topic: libol 'configure' does not find scsh on my system. I'll fix that later, but the problem is that it reacts to this by creating a 'make_class' with a null string for the scsh path. This is very unfriendly. Wouldn't it be better to generate it with some default path (maybe /usr/bin/scsh)? Then the error message when you try to run it would make it clear that the problem is a missing scsh. -- Bryan Henderson Phone 408-621-2000 San Jose, California

2 1

Central syslog with relays configuration
by SPINDLER Loïc TRANSPAC 26 Jun '04

26 Jun '04

I am on designing a central log system in order to "concentrate" gigabytes (~12 daily) of logs from 3 delocalized platforms. Quickly here is how it works. I have 3 sites on which approximately 100 hosts push syslog messages to local relay over udp. My 3 relays just forward over tcp the syslog messages to a centralhost using syslog-ng. On my concentrator (centralhost) I receive and store those messages using syslog-ng. I have the configuration running in a lab with no problem. But what happens in case the concentrator fails (f.o. hardware pb) : Will the relays keep the messages somewhere ? can this be set up someway ? At this time I did not success in programming a fifo to have the messages written in case the network forward could not be done. Anybody did ? thanks, loïc spindler

2 1

dest. tcp and dest. pipe on HPUX
by Stephan Hendl 26 Jun '04

26 Jun '04

Hi, I use the syslog-ng-1.6.0rc4 on HPUX 11 and try to send the syslog data to a tcp-destination (is a ssh tunnel to a central syslog-server) as well as to a pipe. Unfortunately the syslog-ng creates the pipe but logs only to the tcp destination and _not_ to the pipe as well. Do you have any ideas? Stephan -------------------------------- # syslog-ng configuration file. # # This should behave pretty much like the original syslog on HP-UX. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(8) for more information. # # 20000925 gb(a)sysfive.com options { sync (0); time_reopen (10); log_fifo_size (20000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_sys { pipe("/dev/log" pad_size(2048)); internal(); }; source s_pns1_tcp { tcp(ip(194.76.232.136) port(10514) max-connections(20)); }; destination d_syslog_tcp { tcp("localhost" port(10514)); }; destination d_cic { pipe("/tmp/cic.pipe" owner("root") group("root") perm(0640) template( "$DATE $HOST $PRIORITY [$FACILITY] $MESSAGE\n") template-escape(yes)); }; destination d_syslog { file("/var/adm/syslog/syslog.log" owner("root") group("sys") perm(0644)); }; destination d_console { file("/dev/console"); }; destination d_root { usertty("root"); }; destination d_all { usertty("*"); }; destination d_auth { file("/var/adm/syslog/auth"); }; destination d_user { file("/var/adm/syslog/user/log.$YEAR$MONTH$DAY"); }; destination d_mailerr { file("/var/adm/syslog/mailerr/log.$YEAR$MONTH$DAY"); }; destination d_mail { file("/var/adm/syslog/mail/log.$YEAR$MONTH$DAY" owner("root") group("mailadm") perm(0440)); }; filter f_syslog { not facility(mail); }; filter f_auth { (not facility(mail) and level(alert)) or (facility(auth) and level(warning)); }; filter f_filter1 { not facility(mail) and level(alert); }; filter f_filter2 { level(emerg); }; filter f_filter3 { facility(user) and level(info); }; filter f_mailerr { facility(mail) and not level(info); }; filter f_mail { facility(mail); }; log { source(s_pns1_tcp); destination(d_syslog_tcp); }; log { source(s_sys); destination(d_syslog_tcp); }; log { source(s_pns1_tcp); destination(d_cic); }; log { source(s_sys); destination(d_cic); }; log { source(s_sys); filter(f_syslog); destination(d_syslog); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_filter1); destination(d_console); destination(d_root); }; log { source(s_sys); filter(f_filter2); destination(d_all); }; log { source(s_sys); filter(f_filter3); destination(d_user); }; log { source(s_sys); filter(f_mailerr); destination(d_mailerr); }; log { source(s_sys); filter(f_mail); destination(d_mail); };

2 1