- syslog-ng - lists.balabit.hu

Re:[syslog-ng]file() versus pipe() for kernel logging
by Amodiovalerio Verde 01 Mar '04

01 Mar '04

It seems the only difference between file() and pipe() is the way files are opened. file() open files in read only , while pipe() open them in read-write. There's also defined a source and a destination fifo() that is just another name for pipe(). Amodiovalerio [Hypo] Verde ---------- Initial Header ----------- From : syslog-ng-admin(a)lists.balabit.hu To : syslog-ng(a)lists.balabit.hu Cc : Date : Sun, 29 Feb 2004 12:11:34 +1100 Subject : [syslog-ng]file() versus pipe() for kernel logging > I was just wondering if anyone could explain the differences between pip() > and file() when used as kernel log sources. > > For example the documentation suggests you would use the following statement > to collect kernel logs: > > source s_file { file("/proc/kmsg"); }; > > Most examples of syslog-ng.conf files I have seen have the following > statement: > > source s_pipe { pipe("/proc/kmsg"); }; > > Is there any difference between the two? Is one better than the other? > > Any help much appreciated. > > Thanks > > James Turnbull > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >

1 0

sylog-ng file() options
by Coward, Robert (Contractor) 29 Feb '04

29 Feb '04

Are there any plans to implement the compress() and encrypt() options for the file() driver? Roberto

2 1

RE: [syslog-ng]$HOST $YEAR, etc not working correctly..
by Kelly, Chuck 26 Feb '04

26 Feb '04

My point being try separating the lines out, I do a similar thing with no issues, but keep destinations within their own set of {} -- Chuck -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Doug Peterson Sent: Tuesday, February 24, 2004 2:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]$HOST $YEAR, etc not working correctly.. Howdy, I recently installed the same config file I had in 1.6.0rc1(or rc2?) on redhat 7.3 to a system with syslog-ng 1.6.2 with redhat 9... My log files are not being written in the format that I would expect (or that they WERE on the old box).. I would expect the following rule to write to the file: /var/log/hosts/webserver1/2004/02/24/webserver1_messages_2004_02_24 Instead I get: /var/log/hosts/webserver1/2004/02/24/messsages_24 The rule: destination messages.network { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$HOST_messages_$YEAR_$MONTH _$DAY" owner(root) group(sysadmin) perm(0640) dir_perm(0700) create_dirs(yes) ); }; This happens with all similar destination rules. The $year, $month, $host, etc work fine in the first portion of the destination, but they don't all work in the filename.. but $day does for some strange reason. I can provide my full 164 line config file on request, but all destinations are setup the same as this one, and all get the same result. What am I missing here? :) __________________________________ Do you Yahoo!? Yahoo! Mail SpamGuard - Read only the mail you want. http://antispam.yahoo.com/tools _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

RE: [syslog-ng]syslog duplicate entries
by Hamilton Andrew 25 Feb '04

25 Feb '04

Yep. Drew -----Original Message----- From: Dylan Bouterse [mailto:dbouterse@globalcardservices.com] Sent: Tuesday, February 24, 2004 5:46 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: RE: [syslog-ng]syslog duplicate entries Should I be able to remove all of the destination lines following std and still get the localhost's log information to it's host directory based on the "destination std" line? Dylan -----Original Message----- From: Hamilton Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: Tuesday, February 24, 2004 12:33 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]syslog duplicate entries Look at your filter, f_syslog, destination d_syslog, and your log line that includes d_syslog. Your filter f_syslog includes everything except facilities auth, and authpriv. If you are confident that you don't need your syslog line you can comment that out as well to keep you from getting duplicates in you /var/log/syslog file. Regards, Drew -----Original Message----- From: Dylan (FHMS) [ mailto:dhbouterse@fhmsi.com <mailto:dhbouterse@fhmsi.com> ] Sent: Tuesday, February 24, 2004 12:25 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog duplicate entries I have my syslog-ng setup so that external syslog hosts are creating their own dir and log file (see conf file below). One problem I'm having is that all of the hosts' logs are being written to /var/log/syslog as well...creating a 6Gig file or larger per week. Can someone please point out what I can change with my conf file to eliminate the duplicate entries? Thank you! Dylan ############################################# ### syslog-ng.conf file ############################################# options { check_hostname(yes); chain_hostnames(no); create_dirs (yes); dir_perm(0755); dns_cache(yes); keep_hostname(yes); log_fifo_size(2048); log_msg_size(8192); long_hostnames(on); perm(0644); stats(3600); sync(0); time_reopen (10); use_dns(yes); use_fqdn(no); }; # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-dgram("/dev/log"); internal(); }; # # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. # source src { unix-dgram("/dev/log"); internal(); udp(); tcp(port(514) keep-alive(yes) max-connections(25));}; destination std { # file("/var/log/HOSTS/$YEAR/$HOST/$MONTH/$FACILITY_$HOST_$YEAR_$MONTH_$DAY" file("/var/log/HOSTS/$HOST/$HOST.syslog" owner(nagios) group(nagios) perm(0600) dir_perm(0700) create_dirs(yes) ); }; # After that set destinations. # First some standard logfile # destination authlog { file("/var/log/auth.log" owner("root") group("adm") perm(0640)); }; destination syslog { file("/var/log/syslog" owner("root") group("adm") perm(0640)); }; destination cron { file("/var/log/cron.log" owner("root") group("adm") perm(0640)); }; destination daemon { file("/var/log/daemon.log" owner("root") group("adm") perm(0640)); }; destination kern { file("/var/log/kern.log" owner("root") group("adm") perm(0640)); }; destination lpr { file("/var/log/lpr.log" owner("root") group("adm") perm(0640)); }; destination mail { file("/var/log/mail.log" owner("root") group("adm") perm(0640)); }; destination user { file("/var/log/user.log" owner("root") group("adm") perm(0640)); }; destination uucp { file("/var/log/uucp.log" owner("root") group("adm") perm(0640)); }; # This files are the log come from the mail subsystem. # destination mailinfo { file("/var/log/mail.info" owner("root") group("adm") perm(0640)); }; destination mailwarn { file("/var/log/mail.warn" owner("root") group("adm") perm(0640)); }; destination mailerr { file("/var/log/mail.err" owner("root") group("adm") perm(0640)); }; # Logging for INN news system # destination newscrit { file("/var/log/news/news.crit" owner("root") group("adm") perm(0640)); }; destination newserr { file("/var/log/news/news.err" owner("root") group("adm") perm(0640)); }; destination newsnotice { file("/var/log/news/news.notice" owner("root") group("adm") perm(0640)); }; # Some `catch-all' logfiles. # #destination debug { file("/var/log/debug" owner("root") group("adm") #perm(0640)); }; #destination messages { file("/var/log/messages" owner("root") group("adm") #perm(0640)); }; # The root's console. # destination console { usertty("root"); }; # Virtual console. # destination console_all { file("/dev/tty8"); }; # The named pipe /dev/xconsole is for the nsole' utility. To use it, # you must invoke nsole' with the -file' option: # # $ xconsole -file /dev/xconsole [...] # #destination xconsole { pipe("/dev/xconsole"); }; destination ppp { file("/var/log/ppp.log" owner("root") group("adm") perm(0640)); }; # Here's come the filter options. With this rules, we can set which # message go where. filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_cnews { level(notice, err, crit) and facility(news); }; filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; filter ppp { facility(local2); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; #log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; #log { source(src); filter(f_debug); destination(debug); }; #log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); filter(f_cnews); destination(console_all); }; #log { source(src); filter(f_cother); destination(console_all); }; ####log { source(src); filter(f_cnews); destination(xconsole); }; ###log { source(src); filter(f_cother); destination(xconsole); }; log { source(src); filter(ppp); destination(ppp); }; log { source(src); destination(std); }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html <http://www.campin.net/syslog-ng/faq.html>

1 0

Connection broken, line before lose
by Benoit DOLEZ 25 Feb '04

25 Feb '04

Hi, When a connection broken is detected (error when writing a line to an invalid socket), the line that make the "connection broken" to be detected is definitly lost. In a local file Feb 24 22:09:47 src@loki root: 10 11 12 13 14 15 16 17 18 19 20 21 22 23 Feb 24 22:09:48 src@loki root: 10 11 12 13 14 15 16 17 18 19 20 21 22 23 Feb 24 22:09:48 src@loki syslog-ng[18900]: Connection broken to AF_INET(127.0.0.1:40000), reopening in 60 seconds Feb 24 22:09:49 src@loki root: 10 11 12 13 14 15 16 17 18 19 20 21 22 23 In the remote process # nc -l -p 40000 (...) Feb 24 22:09:47 src@loki root: 10 11 12 13 14 15 16 17 18 19 20 21 22 23 <Ctrl-C> # nc -l -p 40000 <43>Feb 24 22:09:48 src@loki syslog-ng[18900]: Connection broken to AF_INET(127.0.0.1:40000), reopening in 60 seconds <13>Feb 24 22:09:49 src@loki root: 10 11 12 13 14 15 16 17 18 19 20 21 22 23 le log line at Feb 24 22:09:48 is definitly lost, is it normal? B DOLEZ -- Benoit DOLEZ, EXOSEC (http://www.exosec.fr/) 12 av des Pres - BL233, 78059 St Quentin en Yvelines cedex Tel: +33 1 61 37 05 35 - Fax: +33 1 61 38 10 65 GSM: +33 6 21 05 91 69 - mailto:bdolez@exosec.fr

2 1

RE: [syslog-ng]$HOST $YEAR, etc not working correctly..
by Kelly, Chuck 24 Feb '04

24 Feb '04

I left off something on the end as well. destination messages.network { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$HOST_messages_$YEAR_$MONTH _$DAY"); }; -- Chuck -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Doug Peterson Sent: Tuesday, February 24, 2004 2:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]$HOST $YEAR, etc not working correctly.. Howdy, I recently installed the same config file I had in 1.6.0rc1(or rc2?) on redhat 7.3 to a system with syslog-ng 1.6.2 with redhat 9... My log files are not being written in the format that I would expect (or that they WERE on the old box).. I would expect the following rule to write to the file: /var/log/hosts/webserver1/2004/02/24/webserver1_messages_2004_02_24 Instead I get: /var/log/hosts/webserver1/2004/02/24/messsages_24 The rule: destination messages.network { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$HOST_messages_$YEAR_$MONTH _$DAY" owner(root) group(sysadmin) perm(0640) dir_perm(0700) create_dirs(yes) ); }; This happens with all similar destination rules. The $year, $month, $host, etc work fine in the first portion of the destination, but they don't all work in the filename.. but $day does for some strange reason. I can provide my full 164 line config file on request, but all destinations are setup the same as this one, and all get the same result. What am I missing here? :) __________________________________ Do you Yahoo!? Yahoo! Mail SpamGuard - Read only the mail you want. http://antispam.yahoo.com/tools _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]$HOST $YEAR, etc not working correctly..
by Kelly, Chuck 24 Feb '04

24 Feb '04

Try this. destination messages.network { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$HOST_messages_$YEAR_$MONTH _$DAY"); I added paren and semni-colon to end -- Chuck -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Doug Peterson Sent: Tuesday, February 24, 2004 2:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]$HOST $YEAR, etc not working correctly.. Howdy, I recently installed the same config file I had in 1.6.0rc1(or rc2?) on redhat 7.3 to a system with syslog-ng 1.6.2 with redhat 9... My log files are not being written in the format that I would expect (or that they WERE on the old box).. I would expect the following rule to write to the file: /var/log/hosts/webserver1/2004/02/24/webserver1_messages_2004_02_24 Instead I get: /var/log/hosts/webserver1/2004/02/24/messsages_24 The rule: destination messages.network { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$HOST_messages_$YEAR_$MONTH _$DAY" owner(root) group(sysadmin) perm(0640) dir_perm(0700) create_dirs(yes) ); }; This happens with all similar destination rules. The $year, $month, $host, etc work fine in the first portion of the destination, but they don't all work in the filename.. but $day does for some strange reason. I can provide my full 164 line config file on request, but all destinations are setup the same as this one, and all get the same result. What am I missing here? :) __________________________________ Do you Yahoo!? Yahoo! Mail SpamGuard - Read only the mail you want. http://antispam.yahoo.com/tools _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]syslog duplicate entries
by Dylan Bouterse 24 Feb '04

24 Feb '04

Should I be able to remove all of the destination lines following std and still get the localhost's log information to it's host directory based on the "destination std" line? Dylan -----Original Message----- From: Hamilton Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: Tuesday, February 24, 2004 12:33 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]syslog duplicate entries Look at your filter, f_syslog, destination d_syslog, and your log line that includes d_syslog. Your filter f_syslog includes everything except facilities auth, and authpriv. If you are confident that you don't need your syslog line you can comment that out as well to keep you from getting duplicates in you /var/log/syslog file. Regards, Drew -----Original Message----- From: Dylan (FHMS) [ mailto:dhbouterse@fhmsi.com <mailto:dhbouterse@fhmsi.com> ] Sent: Tuesday, February 24, 2004 12:25 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog duplicate entries I have my syslog-ng setup so that external syslog hosts are creating their own dir and log file (see conf file below). One problem I'm having is that all of the hosts' logs are being written to /var/log/syslog as well...creating a 6Gig file or larger per week. Can someone please point out what I can change with my conf file to eliminate the duplicate entries? Thank you! Dylan ############################################# ### syslog-ng.conf file ############################################# options { check_hostname(yes); chain_hostnames(no); create_dirs (yes); dir_perm(0755); dns_cache(yes); keep_hostname(yes); log_fifo_size(2048); log_msg_size(8192); long_hostnames(on); perm(0644); stats(3600); sync(0); time_reopen (10); use_dns(yes); use_fqdn(no); }; # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-dgram("/dev/log"); internal(); }; # # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. # source src { unix-dgram("/dev/log"); internal(); udp(); tcp(port(514) keep-alive(yes) max-connections(25));}; destination std { # file("/var/log/HOSTS/$YEAR/$HOST/$MONTH/$FACILITY_$HOST_$YEAR_$MONTH_$DAY" file("/var/log/HOSTS/$HOST/$HOST.syslog" owner(nagios) group(nagios) perm(0600) dir_perm(0700) create_dirs(yes) ); }; # After that set destinations. # First some standard logfile # destination authlog { file("/var/log/auth.log" owner("root") group("adm") perm(0640)); }; destination syslog { file("/var/log/syslog" owner("root") group("adm") perm(0640)); }; destination cron { file("/var/log/cron.log" owner("root") group("adm") perm(0640)); }; destination daemon { file("/var/log/daemon.log" owner("root") group("adm") perm(0640)); }; destination kern { file("/var/log/kern.log" owner("root") group("adm") perm(0640)); }; destination lpr { file("/var/log/lpr.log" owner("root") group("adm") perm(0640)); }; destination mail { file("/var/log/mail.log" owner("root") group("adm") perm(0640)); }; destination user { file("/var/log/user.log" owner("root") group("adm") perm(0640)); }; destination uucp { file("/var/log/uucp.log" owner("root") group("adm") perm(0640)); }; # This files are the log come from the mail subsystem. # destination mailinfo { file("/var/log/mail.info" owner("root") group("adm") perm(0640)); }; destination mailwarn { file("/var/log/mail.warn" owner("root") group("adm") perm(0640)); }; destination mailerr { file("/var/log/mail.err" owner("root") group("adm") perm(0640)); }; # Logging for INN news system # destination newscrit { file("/var/log/news/news.crit" owner("root") group("adm") perm(0640)); }; destination newserr { file("/var/log/news/news.err" owner("root") group("adm") perm(0640)); }; destination newsnotice { file("/var/log/news/news.notice" owner("root") group("adm") perm(0640)); }; # Some `catch-all' logfiles. # #destination debug { file("/var/log/debug" owner("root") group("adm") #perm(0640)); }; #destination messages { file("/var/log/messages" owner("root") group("adm") #perm(0640)); }; # The root's console. # destination console { usertty("root"); }; # Virtual console. # destination console_all { file("/dev/tty8"); }; # The named pipe /dev/xconsole is for the nsole' utility. To use it, # you must invoke nsole' with the -file' option: # # $ xconsole -file /dev/xconsole [...] # #destination xconsole { pipe("/dev/xconsole"); }; destination ppp { file("/var/log/ppp.log" owner("root") group("adm") perm(0640)); }; # Here's come the filter options. With this rules, we can set which # message go where. filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_cnews { level(notice, err, crit) and facility(news); }; filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; filter ppp { facility(local2); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; #log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; #log { source(src); filter(f_debug); destination(debug); }; #log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); filter(f_cnews); destination(console_all); }; #log { source(src); filter(f_cother); destination(console_all); }; ####log { source(src); filter(f_cnews); destination(xconsole); }; ###log { source(src); filter(f_cother); destination(xconsole); }; log { source(src); filter(ppp); destination(ppp); }; log { source(src); destination(std); }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html <http://www.campin.net/syslog-ng/faq.html>

1 0

$HOST $YEAR, etc not working correctly..
by Doug Peterson 24 Feb '04

24 Feb '04

Howdy, I recently installed the same config file I had in 1.6.0rc1(or rc2?) on redhat 7.3 to a system with syslog-ng 1.6.2 with redhat 9... My log files are not being written in the format that I would expect (or that they WERE on the old box).. I would expect the following rule to write to the file: /var/log/hosts/webserver1/2004/02/24/webserver1_messages_2004_02_24 Instead I get: /var/log/hosts/webserver1/2004/02/24/messsages_24 The rule: destination messages.network { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$HOST_messages_$YEAR_$MONTH_$DAY" owner(root) group(sysadmin) perm(0640) dir_perm(0700) create_dirs(yes) ); }; This happens with all similar destination rules. The $year, $month, $host, etc work fine in the first portion of the destination, but they don't all work in the filename.. but $day does for some strange reason. I can provide my full 164 line config file on request, but all destinations are setup the same as this one, and all get the same result. What am I missing here? :) __________________________________ Do you Yahoo!? Yahoo! Mail SpamGuard - Read only the mail you want. http://antispam.yahoo.com/tools

1 0

RE: [syslog-ng]syslog duplicate entries
by Dylan Bouterse 24 Feb '04

24 Feb '04

Should I be able to remove all of the destination lines following std and still get the localhost's log information to it's host directory based on the "destination std" line? Dylan -----Original Message----- From: Hamilton Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: Tuesday, February 24, 2004 12:33 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]syslog duplicate entries Look at your filter, f_syslog, destination d_syslog, and your log line that includes d_syslog. Your filter f_syslog includes everything except facilities auth, and authpriv. If you are confident that you don't need your syslog line you can comment that out as well to keep you from getting duplicates in you /var/log/syslog file. Regards, Drew -----Original Message----- From: Dylan (FHMS) [ mailto:dhbouterse@fhmsi.com <mailto:dhbouterse@fhmsi.com> ] Sent: Tuesday, February 24, 2004 12:25 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog duplicate entries I have my syslog-ng setup so that external syslog hosts are creating their own dir and log file (see conf file below). One problem I'm having is that all of the hosts' logs are being written to /var/log/syslog as well...creating a 6Gig file or larger per week. Can someone please point out what I can change with my conf file to eliminate the duplicate entries? Thank you! Dylan ############################################# ### syslog-ng.conf file ############################################# options { check_hostname(yes); chain_hostnames(no); create_dirs (yes); dir_perm(0755); dns_cache(yes); keep_hostname(yes); log_fifo_size(2048); log_msg_size(8192); long_hostnames(on); perm(0644); stats(3600); sync(0); time_reopen (10); use_dns(yes); use_fqdn(no); }; # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-dgram("/dev/log"); internal(); }; # # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. # source src { unix-dgram("/dev/log"); internal(); udp(); tcp(port(514) keep-alive(yes) max-connections(25));}; destination std { # file("/var/log/HOSTS/$YEAR/$HOST/$MONTH/$FACILITY_$HOST_$YEAR_$MONTH_$DAY" file("/var/log/HOSTS/$HOST/$HOST.syslog" owner(nagios) group(nagios) perm(0600) dir_perm(0700) create_dirs(yes) ); }; # After that set destinations. # First some standard logfile # destination authlog { file("/var/log/auth.log" owner("root") group("adm") perm(0640)); }; destination syslog { file("/var/log/syslog" owner("root") group("adm") perm(0640)); }; destination cron { file("/var/log/cron.log" owner("root") group("adm") perm(0640)); }; destination daemon { file("/var/log/daemon.log" owner("root") group("adm") perm(0640)); }; destination kern { file("/var/log/kern.log" owner("root") group("adm") perm(0640)); }; destination lpr { file("/var/log/lpr.log" owner("root") group("adm") perm(0640)); }; destination mail { file("/var/log/mail.log" owner("root") group("adm") perm(0640)); }; destination user { file("/var/log/user.log" owner("root") group("adm") perm(0640)); }; destination uucp { file("/var/log/uucp.log" owner("root") group("adm") perm(0640)); }; # This files are the log come from the mail subsystem. # destination mailinfo { file("/var/log/mail.info" owner("root") group("adm") perm(0640)); }; destination mailwarn { file("/var/log/mail.warn" owner("root") group("adm") perm(0640)); }; destination mailerr { file("/var/log/mail.err" owner("root") group("adm") perm(0640)); }; # Logging for INN news system # destination newscrit { file("/var/log/news/news.crit" owner("root") group("adm") perm(0640)); }; destination newserr { file("/var/log/news/news.err" owner("root") group("adm") perm(0640)); }; destination newsnotice { file("/var/log/news/news.notice" owner("root") group("adm") perm(0640)); }; # Some `catch-all' logfiles. # #destination debug { file("/var/log/debug" owner("root") group("adm") #perm(0640)); }; #destination messages { file("/var/log/messages" owner("root") group("adm") #perm(0640)); }; # The root's console. # destination console { usertty("root"); }; # Virtual console. # destination console_all { file("/dev/tty8"); }; # The named pipe /dev/xconsole is for the nsole' utility. To use it, # you must invoke nsole' with the -file' option: # # $ xconsole -file /dev/xconsole [...] # #destination xconsole { pipe("/dev/xconsole"); }; destination ppp { file("/var/log/ppp.log" owner("root") group("adm") perm(0640)); }; # Here's come the filter options. With this rules, we can set which # message go where. filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_cnews { level(notice, err, crit) and facility(news); }; filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; filter ppp { facility(local2); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; #log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; #log { source(src); filter(f_debug); destination(debug); }; #log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); filter(f_cnews); destination(console_all); }; #log { source(src); filter(f_cother); destination(console_all); }; ####log { source(src); filter(f_cnews); destination(xconsole); }; ###log { source(src); filter(f_cother); destination(xconsole); }; log { source(src); filter(ppp); destination(ppp); }; log { source(src); destination(std); }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html <http://www.campin.net/syslog-ng/faq.html>

1 0