- syslog-ng - lists.balabit.hu

SIGHUP
by Mitja Marondini 02 Apr '04

02 Apr '04

Hi, syslog-ng aborts after receiving SIGHUP. <---- SIGHUP received, restarting syslog-ng Marking fd 3 for closing. Marking fd 4 for closing. Marking fd 5 for closing. Marking fd 6 for closing. syslog-ng: cfgfile.c:166: add_persistent_info: Assertion `!p' failed. Aborted ----> I have Red Hat 7.3 with libol-0.3.13-1 and syslog-ng-1.6.2-1. Thank you for help in advance! Mitja

2 2

fallback with override?
by Mike Nerone 01 Apr '04

01 Apr '04

I want to do something very simple that should be easily configurable, but I can't figure out how to do it. Here's a greatly simplified example that illustrates my need: I want to log specific filters to specific destinations, with a fallback to catch anything non-specific, but ALSO to to log *everything* to the console (I would not do thise in practice, of course, but it should be doable). My first obvious thought was to use this (again, this is very simplified - I don't want anyone to think this would be my real syslog config - that would be embarrassing :D): log { source(src); filter(cron); destination(cron); }; # Catch cron stuff log { source(src); destination(messages); flags(fallback); }; # Everything else log { source(src); destination(console); }; # But no matter what, *everything* to console I assumed that the "fallback" would log anything not caught by a *previous* non-fallback log statement (the fact that the 'final' flag exists suggested to me that ordering was observed), but that does not appear to be the case. Everything does indeed get logged to the console with that config, but the fallback log gets *nothing* (ostensibly because all messages are caught by the console log statement). Can anyone think of a way to do this (I'm probably missing the obvious here)? Or perhaps the fallback algorithm could/should be modified to observe ordering (i.e. ignore log statements that appear after the fallback log statement in the config)? Mike Nerone /* The only secure computer is one that is unplugged from the network -- and the wall. */ <Activism>Did you know that our brilliant legislators recently (and quietly) legalized spam? The law now says that anyone who wants to *can* spam with no fear of punishment. They even named the law the "CAN SPAM" Act. Read about it at http://www.cauce.org/news/index.shtml, then talk about it with your congressman.</Activism>

1 0

Installation Help.
by Chaitanya 01 Apr '04

01 Apr '04

Hi, I was trying to install Syslogd on Redhat Linux 9, for which i am not sure of its compatibilty. I installed the following packages successfully. a. Libol, b. Stunnel. c. Logsentry. But when i couldnot able to install syslog-ng. Is syslog-ng compatible with Red hat linux. Does anybody know the development website for syslog-ng. Thanks a lot. With Regards! Chaitanya.

2 1

remote log server
by Rick S. 01 Apr '04

01 Apr '04

What do I need to put in the .conf file to have the logs sent over the net work to another machine? Rick S.

1 0

maximum config file size
by Scooter T 01 Apr '04

01 Apr '04

Has anyone encountered any problems with a fairly large syslog-ng.conf file? I am seeing substantial UDP packet loss with a file that is roughly 1300 lines (about 70k). If I pare it down to around 1200 lines (about 60k), all is well. Is this a known limitation? --------------------------------- Do you Yahoo!? Yahoo! Finance Tax Center - File online. File on time.

2 1

syslog-ng and net devices.
by cdowns 31 Mar '04

31 Mar '04

Morning, I have all cisco devices coming in on priority local7, and for some reason im not getting them all. I grep'd though all logs and they truly dont exist. Does anyone see anything wrong with my config ? TIA. ~!>D # # Syslog-ng example configuration for for Debian GNU/Linux # Too bad this wasnt debian ;( # # Copyright (c) 1999 anonymous # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.sample,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. # options { long_hostnames(off); sync(1); }; # added /proc/kmsg for replace of klogd - syslogd source src { internal(); pipe("/proc/kmsg"); unix-stream("/dev/log"); }; source net { udp(); }; ## dest destination authlog { file("/log/auth.log"); }; destination syslog { file("/log/syslog"); }; destination cron { file("/log/cron.log"); }; destination daemon { file("/log/daemon.log"); }; destination kern { file("/log/kern.log"); }; destination lpr { file("/log/lpr.log"); }; destination user { file("/log/user.log"); }; destination uucp { file("/log/uucp.log"); }; destination mail { file("/log/mail.log"); }; destination mailinfo { file("/log/mail.info"); }; destination mailwarn { file("/log/mail.warn"); }; destination mailerr { file("/log/mail.err"); }; destination newscrit { file("/log/news/news.crit"); }; destination newserr { file("/log/news/news.err"); }; destination newsnotice { file("/log/news/news.notice"); }; destination debug { file("/log/debug"); }; destination messages { file("/log/messages"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; #destination loghost { udp("loghost" port(999)); }; ## Custon Log Destiniations destination pix { file("/log/Net/pix.log"); }; destination iss { file("/log/Net/iss.log"); }; destination snmp { file("/log/Net/snmp.log"); }; ## Incoming routers and switches with perms destination local7 { file("/log/j1comm1/logs/local7.info" owner(j1comm1) group(j1comm1) perm(0644) dir_perm(0755) create_dirs(yes) ); }; destination std { file("/log/Net/$FACILITY.log" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; destination xconsole { pipe("/dev/xconsole"); }; ## Filters for local machine filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; ## UDP Hosts filter f_net_auth { facility(auth); }; filter f_net_authpriv { facility(auth, authpriv); }; filter f_net_syslog { not facility(authpriv, mail); }; filter f_net_cron { facility(cron); }; filter f_net_daemon { facility(daemon); }; filter f_net_kern { facility(kern); }; filter f_net_lpr { facility(lpr); }; filter f_net_mail { facility(mail); }; filter f_net_user { facility(user); }; filter f_net_uucp { facility(cron); }; filter f_net_news { facility(news); }; filter f_net_debug { not facility(auth, authpriv, news, mail); }; filter f_net_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_net_emergency { level(emerg); }; filter f_net_info { level(info); }; filter f_net_notice { level(notice); }; filter f_net_warn { level(warn); }; filter f_net_crit { level(crit); }; filter f_net_err { level(err); }; ### get all cisco local7.info messages ## filter f_local7 { facility(local7) and level(debug..emerg); }; filter f_pixm { match("PIX"); }; filter f_misclocal7 { filter (f_local7) and not filter(f_pixm); }; filter f_iss { match("issDaemon"); }; filter f_snmp { match("ucd-snmp"); }; ## Local logs log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; log { source(src); destination(console_all); }; ## Custom Logs log { source(net); filter(f_pixm); destination(pix); }; log { source(net); filter(f_misclocal7); destination(local7); }; log { source(net); filter(f_iss); destination(iss); }; log { source(net); filter(f_snmp); destination(snmp); }; ## CatchAll Net log log { source(net); filter(f_net_authpriv); destination(std); }; log { source(net); filter(f_net_syslog); destination(std); }; log { source(net); filter(f_net_cron); destination(std); }; log { source(net); filter(f_net_daemon); destination(std); }; log { source(net); filter(f_net_kern); destination(std); }; log { source(net); filter(f_net_lpr); destination(std); }; log { source(net); filter(f_net_mail); destination(std); }; log { source(net); filter(f_net_user); destination(std); }; log { source(net); filter(f_net_uucp); destination(std); }; log { source(net); filter(f_net_mail); filter(f_net_info); destination(std); }; log { source(net); filter(f_net_mail); filter(f_net_warn); destination(std); }; log { source(net); filter(f_net_mail); filter(f_net_err); destination(std); }; log { source(net); filter(f_net_news); filter(f_net_crit); destination(std); }; log { source(net); filter(f_net_news); filter(f_net_err); destination(std); }; log { source(net); filter(f_net_news); filter(f_net_notice); destination(std); }; log { source(net); filter(f_net_debug); destination(std); }; log { source(net); filter(f_net_messages); destination(std); }; log { source(net); filter(f_net_emergency); destination(std); }; log { source(net); destination(console_all); }; ## EOF

1 0

Filtering by time or date
by Wesolowski Michal 30 Mar '04

30 Mar '04

Hi I'm testing syslog-ng for centralized log server on Solaris 8. It acts very well and I was even able to create real-time notification mechanizm based on syslog-ng and some scripts (without any additional log analizer). The problem I've lately met is that some computers sending their messages to central system frequently perform additional maintanence tasks during nights or off days. For example they scan disks and other i/o devices and in effect produce many warnings. That messages almost always countain information which are suspicous within work hours and they cannot be filtered permanently. My question is: Is it possible or planed for future releases to include time conditions in filter functions?. The "match" statement doesn't seem to check date or time and using program as destination is quite hard due to it "destination" not filter role in log paths. In my opinion very interesting option would be including external program as filter (ie. returning filter decision as std output or exit code). Greetings Michal Wesolowski

2 1

template syntax
by John Minson 30 Mar '04

30 Mar '04

The 'template' syntax for a 'file' destination has defeated me . destination d_db { file("/var/log/ng/db.inserts" template("$MSG\n")); }; every variation of the above line gives 'parsing error' syslog-ng 1.4.17 many thanks

2 1

Not logging to the correct file
by allanwind＠lifeintegrity.com 28 Mar '04

28 Mar '04

I have been running with: file("/var/log/syslog-ng/$YEAR-$MONTH-$DAY/$HOST.log" dir_owner("root") dir_group("adm") dir_perm(0 750) owner("root") group("adm") perm(0640) create_dirs(yes)); (or $PROGRAM instead of $HOST), but still get some log events in: /var/log/syslog-ng/$YEAR-$MONTH-$DAY/$FACILITY.log?! daemon.log: Mar 28 11:48:42 log_source@pawan dhcpd: Wrote 8 leases to leases file mail.log: Mar 28 00:04:14 log_source@pawan amavis[6299]: (06299-03) Passed, <bounce-debian-devel=allanwind=lifeintegrity. com(a)lists.debian.org> -> <allanwind(a)lifeintegrity.com>, Message-ID: <87r7vdsgum.fsf(a)mrvn.homelinux.org>, Hits: -4.9 syslog.log: Mar 28 00:01:05 internal_source@pawan syslog-ng[341]: STATS: dropped 0 My syslog-ng.conf is pretty complicated as I use it to filter my logs real-time, but it looks something like this: # sources # source internal_source { internal(); }; source log_source { unix-stream("/dev/log"); }; source kmsg_source { file("/proc/kmsg" log_prefix("kernel: ")); }; destination syslog_destination { file("/var/log/syslog-ng/$YEAR-$MONTH-$DAY/$HOST.log" dir_owner("root") dir_group("adm") dir_perm(0750) owner("root") group("adm") perm(0640) create_dirs(yes)); }; # log paths # log { source(internal_source); source(log_source); source(kmsg_source); destination(syslog_destination); }; /Allan -- Allan Wind P.O. Box 2022 Woburn, MA 01888-0022 USA

1 0

regex question
by cdowns 28 Mar '04

28 Mar '04

When regexing in syslog-ng, does this stament below do: get all local7 ( all levels ) and _/ALSO/_ match %ETHC-5 / %CLEAR-5 ? Its not just matching those is it ? Im kinda confused on this syntax. filter f_local7 { facility(local7) and level(debug..emerg) and match("%ETHC-5") and match("%CLEAR-5"); }; I just want to make shure that is what this is doing... . Thanks all. ~!>D

2 2