- syslog-ng - lists.balabit.hu

syslog-ng-announce mailing list ?
by José Pedro Oliveira 15 Apr '04

15 Apr '04

Hi, In the past message https://lists.balabit.hu/pipermail/syslog-ng/2004-January/005701.html there is a reference to the creation of a syslog-ng announcement list. Does it exists? At least it isn't mentioned in the following web pages: http://www.balabit.com/products/syslog-ng/ https://lists.balabit.hu/mailman/listinfo/ Regards, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B *

8 8

$MSG contains $PROGRAM
by Loic Minier 14 Apr '04

14 Apr '04

Hey, When expanding the template macro $MSG, it will result in "program: message" when a program part is present. I think this shouldn't be. It is easy to fix with attached patch (remove a couple of lines at the end of parse_msg in log.c). Regards, -- Loïc Minier <lool(a)dooz.org>

1 1

syslog-ng email alerts
by Agnelo dsouza 14 Apr '04

14 Apr '04

Hi, I've configured syslog-ng for receiving alerts from remote system( /var/log/messages). I've configured 2 destinations 1. A file snort.log , i'm getting alerts in this file 2. email alerts, i'm unable to receive email alerts I've tested the script alert_mail.sh externally and it works.(i'm able to get mails, so sendmail is working) can someone help in solving this problem. Regards, Agnelo syslog-ng.conf ================== source sensors { internal(); tcp(ip(10.0.41.175) port(514) max-connections(7)); unix-stream("/dev/log"); }; destination localhost { file("/var/log/snort.log"); }; destination email_alert_script {program ("/usr/local/bin/alert_mail.sh"); }; log { source(sensors); destination(localhost); }; log {source(sensors); destination(email_alert_script); }; ========================== alert_mail.sh ==================== #!/bin/sh while read line; do echo $line |mail -s "Snort Alert" idsalert(a)xxxx.com done --------------------------------- Do you Yahoo!? Yahoo! Small Business $15K Web Design Giveaway - Enter today

2 1

Scaling for a central loghost ?
by Michael Arndt 13 Apr '04

13 Apr '04

Hello *, Question: does syslog-ng scale well on a central syslog_Server collecting messages from about 200 unix hosts ? I have read old threads about this issue and found infos about a fixed bug and mention about one list member planning measurements with respect to scaling / message dropping. I am still a bit insecure: Can the receive buffer in syslog-ng made large enough to handle incomming syslog messages from about 200 hosts without dropping messages ? Can i take measures on client side (syslog-ng sender to avoid that sent informations are dropped either client side or server side) TIA Micha

3 2

Syslog-ng snapshots
by José Pedro Oliveira 13 Apr '04

13 Apr '04

Hi, The syslog-ng snapshots aren't being created any more. Is it possible to start generating them again? Snapshots location: http://www.balabit.com/downloads/syslog-ng/1.6/src-snapshot/ Regards, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B *

2 1

hostname is replaced by the relay server's name
by Rich Armstrong 06 Apr '04

06 Apr '04

I have two logging servers. One is logging data from lots of clients, using syslog-ng 1.6.0rc3 - lets call that Host1. I want to forward the data via tcp/udp to the other host as well - lets call that Host2 using 1.6.2. At the moment, the $HOST field in data logged on Host2 contains Host1, instead of Client1, or Client2, etc. On both Host1 and Host2, I have set :- options { use_fqdn(yes); keep_hostname(yes); }; but the $HOST variable (in the destination variable, and in the message) on Host2 is still being replaced, so I line I know is from Client1, appears to come from Host1. Host1 transfers data to Host2 using :- destination d_netmon { udp("195.215.3.7"); }; log { source(net); destination(d_netmon); }; Am I using the wrong version of syslog-ng ? It seems that many on the list have had this problem before, and used keep_hostname(yes) to fix it. Is this a bug in the latest version ? -- Richard Armstrong

1 0

RE: [syslog-ng]remote log server
by Schernau, Ed 06 Apr '04

06 Apr '04

http://www.campin.net/syslog-ng/faq.html -----Original Message----- From: Rick S. [mailto:rsheppar@midnight.ecet.vtc.edu] Sent: Thursday, April 01, 2004 10:58 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]remote log server What do I need to put in the .conf file to have the logs sent over the net work to another machine? Rick S. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ----------------------------------------- Use of email is inherently insecure. Confidential information, including account information, and personally identifiable information, should not be transmitted via email, or email attachment. In no event shall Citizens or any of its affiliates accept any responsibility for the loss, use or misuse of any information including confidential information, which is sent to Citizens or its affiliates via email, or email attachment. Citizens does not guarantee the accuracy of any email or email attachment, that an email will be received by Citizens or that Citizens will respond to any email. This email message is confidential and/or privileged. It is to be used by the intended recipient only. Use of the information contained in this email by anyone other than the intended recipient is strictly prohibited. If you have received this message in error, please notify the sender immediately and promptly destroy any record of this email.

2 1

Re: [syslog-ng]maximum config file size
by Scooter T 05 Apr '04

05 Apr '04

There are 272 log statements in the "large" config file, 243 in the pared down version. What's the magic number? 256? 2004-03-31, sze keltezéssel 21:13-kor Scooter T ezt írta: > Has anyone encountered any problems with a fairly large syslog-ng.conf > file? I am seeing substantial UDP packet loss with a file that is > roughly 1300 lines (about 70k). If I pare it down to around 1200 > lines (about 60k), all is well. Is this a known limitation? the log routing might be the culprit here, do you have many log statements in your file? can you reduce those? -- Bazsi --------------------------------- Do you Yahoo!? Yahoo! Small Business $15K Web Design Giveaway - Enter today

2 1

Could offline-mode be done with TCP option?
by Jason Haar 05 Apr '04

05 Apr '04

Hi there We're running a multi-country network of syslog-ng with centralized logging (via TCP). However, due to the possibility of network failure, I am not willing to rely on the central server for triggering alerts - so we do that on the actual leaf syslog servers instead. However, it would be much better if we could actually centralize our alerting system (due to what we are alerting about). So I was wondering if syslog-ng's TCP transport layer could be turned into something like MySQL's master-slave mode: write to a cache file first, then write to remote server, and if that succeeds, remove from cache file. That way if a network outage occurred, the cache file would just get larger and larger, then when the network came up again, it would flow through without any records being lost. [I know the fifo option allows this in RAM - I guess all that I'm wondering about is could that be done on disk instead?. A cache file would survive restarts/etc.] -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

2 1

Re: [syslog-ng] SIGHUP
by Mitja Marondini 05 Apr '04

05 Apr '04

Balasz, thank you for your help. Now it works! Mitja 2004-04-02, p keltezéssel 17:33-kor Balazs Scheidler ezt írta: > 2004-04-02, p keltezéssel 13:30-kor Mitja Marondini ezt írta: > can you paste your configuration file? you seem to have two sources with > the same name, probably you have two unix domain socket sources > (unix-stream and unix-dgram) I mean you seem to have two unix-domain sources referring to the same socket. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0