- syslog-ng - lists.balabit.hu

Syslog-ng & multiple "central" loghosts / HA environment
by Travis Kriza 23 Feb '04

23 Feb '04

Hi everyone, have an interesting question. Let's say I have 2 hosts, both running syslog-ng. These hosts also do a few other tasks and we want them to be highly available. We also don't want them to miss any syslog messages they will be receiving from other hosts. The one thing I can see doing is on the hosts that it is possible, to have them send their information to both syslog hosts. However, I don't think all the equipment supports this. (For instance, I think some cisco equipment supports only 1 syslog host --- please correct me if I am wrong). The other option I thought of was using heartbeat like you would with LVS. That way, you can share an ip and point all of the equipment to that ip. However, what I am trying to figure out, especially with this secondary scenario, is how do you get syslog-ng to report to the other host (for the duplicate/backup) without having syslog-ng push the messages to both of the syslog hosts "regular" ip's and, in doing so, prevent log messages from duplicating exponentially? Does this make sense? Thanks, Travis

4 3

$YEAR/$MONTH/$DAY generates always 2002/12/31
by Piotr Woliński 22 Feb '04

22 Feb '04

Hello, I have PLD Linux kernel 2.4.20 and syslog-ng-1.6.0-0.rc3.2 I put into into syslog-ng.conf lines (for test purpose): source net { udp(); }; destination hosts { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log {source(net); destination(hosts); }; Now i can see directiories like that: /var/log/hosts/localhost/2003/2003/12/01 /var/log/hosts/localhost/2003/2003/12/02 that's OK. But also: /var/log/hosts/localhost/2002/12/31 Inside that dir files: auth, authpriv, local7. Dates inside above 3 files are OK. Anyone could help me? What's going on? Piotr Wolinski

6 12

syslog server do not log itself correctly
by Alessandro Fiorenzi 20 Feb '04

20 Feb '04

Hi, I have set up a wondefull log server with syslog-ng, where I record every host separately. suppose log server name is logserver.localdomain.it, the problem is that I get the logserver.localdomain.it directory but insede i get only messages and syslog file, if i fail a an authentication or what other I get no log about it. someone can help me? Thanks This is part of configuration file: options { long_hostnames(off); sync(0); # no line buffered: scriviamo subito # forse sui client si può rimuovere create_dirs(yes); log_fifo_size(30000); # aumentiamo log_fifo_size per evitare il drop dei pacchetti, use_fqdn(yes); # Inserisce gli host in formato Fully Qualified Domain Name # use_time_recvd(true); # nel caso di client con ora non sincronizzata }; source src { internal(); pipe("/proc/kmsg"); #file("/proc/kmsg" log_prefix("kernel: ")); tcp(ip(192.168.xxx.yyy) port(514) max-connections(100)); udp(ip(0.0.0.0) port(514)); }; destination authlog { file("/opt/syslog-ng/logs/SERVER/$YEAR/$MONTH/$DAY/$HOST/auth.log" owner("root") group("adm") perm(0640)); }; destination syslog { file("/opt/syslog-ng/logs/SERVER/$YEAR/$MONTH/$DAY/$HOST/syslog" owner("root") group("adm") perm(0640)); }; destination cron { file("/opt/syslog-ng/logs/SERVER/$YEAR/$MONTH/$DAY/$HOST/cron.log" owner("root") group("adm") perm(0640)); }; destination daemon { file("/opt/syslog-ng/logs/SERVER/$YEAR/$MONTH/$DAY/$HOST/daemon.log" owner("root") group("adm") perm(0640)); }; destination kern { file("/opt/syslog-ng/logs/SERVER/$YEAR/$MONTH/$DAY/$HOST/kern.log" owner("root") group("adm") perm(0640)); }; destination lpr { file("/opt/syslog-ng/logs/SERVER/$YEAR/$MONTH/$DAY/$HOST/lpr.log" owner("root") group("adm") perm(0640)); }; destination mail { file("/opt/syslog-ng/logs/SERVER/$YEAR/$MONTH/$DAY/$HOST/mail.log" owner("root") group("adm") perm(0640)); }; destination user { file("/opt/syslog-ng/logs/SERVER/$YEAR/$MONTH/$DAY/$HOST/user.log" owner("root") group("adm") perm(0640)); }; destination uucp { file("/opt/syslog-ng/logs/SERVER/$YEAR/$MONTH/$DAY/$HOST/uucp.log" owner("root") group("adm") perm(0640)); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; ------------------------------------------------------------------------ INFOGROUP S.P.A http://www.infogroup.it ------------------------------------------------------------------------- DR. FIORENZI ALESSANDRO Consulente Tribunale Firenze - sicurezza informatica - Security Administrator Socio CLUSIT, ALSI Tel : +39.055.43.65.742 CE : +39.335.64.144.77 @Email : a.fiorenzi(a)infogroup.it PGP Key: http://www.infogroup.it/ds/fiorenzi.asc ------------------------------------------------------------------------- "Faber est suae quisque fortunae" -------------------------------------------------------------------------

1 0

syslog-ng problem to added a source section
by Gerard Breiner 19 Feb '04

19 Feb '04

Hello, 1) I've just added a section source in my /etc/syslo-ng.conf . Le type de source is "hpux". its name is "vega" and ip address is : 122.167.44.35. here is the line : source vega { pipe("/dev/log"); udp(ip(122.167.44.35) port(514));}; I restart syslog-ng and the result is : Starting system logger: ..............Changing permissions on special file /dev/log Error opening file /dev/log for reading (No such device or address) I've checked the permissions of the file /dev/log on vega : ls -l /dev/log return : prw-rw-rw root root. 2) I've just added a section source in my /etc/syslo-ng.conf . Le type de source is "Linux". its name is "cerbere" and ip address is : 129.175.64.20. here is the line : source cerbere { unix-stream("/dev/log"); udp(ip(129.175.64.20) port(514)); internal(); }; I restart syslog-ng and the result is : Starting system logger: ..............io.c: bind_inet_socket() bind failed 129.175.64.17:514 Cannot assign requested address permissions is : srw-rw-rw- 1 root root. I' m wondering where is the problem. If you've a bright idea... Best regards Gérard Breiner Service Informatique Institut d'Astrophysique Spatiale 91405 Orsay Campus

1 0

RE: [syslog-ng]Is my default location broken?
by Madziarczyk, Jonathan 19 Feb '04

19 Feb '04

Ok, I see what's going on. If I have this conf: options { dir_perm(0755); perm(0644); chain_hostnames(no); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); dns_cache (yes); create_dirs (yes); keep_hostname(yes); }; source local { unix-dgram("/dev/log"); internal(); }; source s_udpmessages { udp(ip(0.0.0.0) port(514)); }; log { source(s_udpmessages); destination(d_mysql); }; *destinations removed* filter f_c4s1 { host("civic4south1"); }; log { source(s_udpmessages); filter(f_c4s1); destination(civic); }; log { source(s_udpmessages); destination(unsorted); flags(final, fallback); }; What I want to do is all messages that do not fit the host specified in filter f_c4s1 (or any other filter/log commands I put in) to be placed into the destination (unsorted) file. However my pipe to destination (my_sql) seems to be stopping that. How do I fix that so I can still log to My_Sql and my destination files without having to write rules for every item I'm logging? Thanks, JonM -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Thursday, February 19, 2004 1:12 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Is my default location broken? 2004-02-18, sze keltezéssel 19:40-kor Madziarczyk, Jonathan ezt írta: > I just migrated to a new box for syslog-ng and I'm trying to get the > "default" location to work for messages that don't meet any of my rules > yet. > > I've sent multiple syslog messages to the box but they don't seem to be > showing up. Any ideas? I do know that the "rules" messages are working > so udp is binding. > > Thanks, > JonM > > options { dir_perm(0755); perm(0644); chain_hostnames(no); > time_reopen (10); > log_fifo_size (1000); > long_hostnames (off); > use_dns (yes); > use_fqdn (no); > dns_cache (yes); > create_dirs (yes); > keep_hostname(yes); }; > > source local { unix-dgram("/dev/log"); internal(); }; > > source s_udpmessages { udp(ip(0.0.0.0) port(514)); }; > > destination unsorted { file("/logs/unsorted.log" perm(0777)); }; > log { source(s_udpmessages); destination(unsorted); flags(final, > fallback); }; what are those 'rules' messages you are referring to? try stracing the syslog-ng process to see whether it actually receives messages. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng-1.4.17 configure problem
by Treptow, Craig 19 Feb '04

19 Feb '04

Hi folks. I downloaded syslog-ng to evaluate it and ran into a problem with the configure script that was included. I already downloaded and build libol-0.3.9. When I went to configure syslog-ng, it kept complaining that the correct version of libol could not be found. I believe I tracked this down to an error in the configure script that flagged 0.3.9 as an invalid version due to the 9 < 23 (required version being at least 0.2.23). I believe I fixed this, but was not sure where to post it. I do not subscribe to this list yet, so forgive me if this has been identified before. Here is the diff: us091:syslog-ng-1.4.17 $ diff configure configure.orig 2632,2633c2632 < $ "$LIBOL_MINOR" -eq "$LIBOL_REQ_MINOR" -a \ < "$LIBOL_PATCH" -lt "$LIBOL_REQ_PATCH" $; then --- > "$LIBOL_PATCH" -lt "$LIBOL_REQ_PATCH"; then Thanks, Craig

2 1

Problem in host() filter
by Salim Pathan 19 Feb '04

19 Feb '04

hi, i'm working on a project based on syslog-ng since last one year...i'm using "host()" filter function to separate logs coming from different hosts... "use_dns()" option is set to "NO",which means the incoming logs will be filtered based on IP address in place of hostname....now the problem is that syslog-ng is unable to separate logs coming from host IP "31.2.2.5" and "31.2.2.51"..... how can i separate logs from hosts having similar IP addresses, as in above case? thanks, salim. --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.581 / Virus Database: 368 - Release Date: 2/9/2004

2 1

recording filter names
by Luigi Augello 19 Feb '04

19 Feb '04

Hi at all this is my firs messag to the list syslog-ns is a wonderful tools, but I have the necessity to record the name of the filter that I create on the configuration file. I have tried a macro for this scope but dosen't exit.anyone have a suggestion thanks Luigi

2 1

parse error on configuration file
by Laurent Mesuré 19 Feb '04

19 Feb '04

Hi, I'm using syslog-ng 1.6 on a Mandrake Linux server. I have the follosing error while starting: parse error reading configuration file, exiting. (line 42) I can't find the error. Here is my configuration file: ------------------------START OF FILE------------------------ # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # 20000925 gb(a)sysfive.com # # Updated by Frank Crawford (<Frank.Crawford(a)ac3.com.au>) - 10 Aug 2002 # - for Red Hat 7.3 # - totally do away with klogd # - add message "kernel:" as is done with klogd. # # Updated by Frank Crawford (<Frank.Crawford(a)ac3.com.au>) - 22 Aug 2002 # - use the log_prefix option as per Balazs Scheidler's email # options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (yes); create_dirs (yes); keep_hostname (yes); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; destination d_cons { file("/dev/console"); }; destination d_tty12 { file("/dev/tty12"); }; destination d_mesg { file("/var/log/messages"); }; destination d_secure { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron_info { file("/var/log/cron/info"); }; destination d_cron_warnings { file("/var/log/cron/warnings"); }; destination d_cron_errors { file("/var/log/cron/errors"); }; destination d_syslog { file("/var/log/syslog"); }; destination d_user { file("/var/log/user.log"); }; destination d_auth { file("/var/log/auth.log"); ); <-------- here is line 42 destination d_mail_info { file("/var/log/mail/info"); ); destination d_mail_warnings { file("/var/log/mail/warnings"); ); destination d_mail_errors { file("/var/log/mail/errors"); ); destination d_kernel_info { file("/var/log/kernel/info"); ); destination d_kernel_warnings { file("/var/log/kernel/warnings"); ); destination d_kernel_errors { file("/var/log/kernel/errors"); ); destination d_lpr_info { file("/var/log/lpr/info"); ); destination d_lpr_warnings { file("/var/log/lpr/warnings"); ); destination d_lrp_errors { file("/var/log/lpr/errors"); ); destination d_news_notice { file("/var/log/news/notice"); ); destination d_news_crit { file("/var/log/news/crit"); ); destination d_news_err { file("/var/log/news/err"); ); destination d_daemon_info { file("/var/log/daemons/info"); ); destination d_daemon_warnings { file("/var/log/daemons/warnings"); ); destination d_daemon_errors { file("/var/log/daemons/errors"); ); destination d_spooler { file("/var/log/spooler"); ); destination d_explain { file("/var/log/explainations"); ); destination d_postgresql { file("/var/log/postgresql"); ); destination d_mlal { usertty("*"); }; filter f_auth { facility(auth,authpriv); }; filter f_syslog { not facility(auth,authpriv); }; filter f_user { facility(user); }; filter f_messages { level(info) or not facility(mail,news,authpriv); }; filter f_secure { facility(authpriv); }; filter f_mail_info { facility(mail) and (level(debug,info,notice)); }; filter f_mail_warnings { facility(mail) and (level(warn)); }; filter f_mail_errors { facility(mail) and (level(err)); }; filter f_cron_info { facility(cron) and (level(debug,info,notice)); }; filter f_cron_warnings { facility(cron) and (level(warn)); }; filter f_cron_errors { facility(cron) and (level(err)); }; filter f_kernel_info { facility(kern) and (level(debug,info,notice)); }; filter f_kernel_warnings { facility(kern) and (level(warn)); }; filter f_kernel_errors { facility(kern) and (level(err)); }; filter f_lpr_info { facility(lpr) and (level(debug,info,notice)); }; filter f_lpr_warnings { facility(lpr) and (level(warn)); }; filter f_lpr_errors { facility(lpr) and (level(err)); }; filter f_news_info { facility(news) and (level(debug,info,notice)); }; filter f_news_crit { facility(news) and (level(crit)); }; filter f_news_err { facility(news) and (level(err)); }; filter f_daemon_info { facility(daemon) and (level(debug,info,notice)); }; filter f_daemon_crit { facility(daemon) and (level(warn)); }; filter f_daemon_err { facility(daemon) and (level(err)); }; filter f_emerg { level(emerg); }; filter f_spooler { facility(uucp) or (facility(news) and level(crit)); }; filter f_boot { facility(local7); }; filter f_explanation { facility(local1); }; filter f_postgresql { facility(local0); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_auth); destination (d_auth); }; log { source(s_sys); destination(d_syslog); }; log { source(s_sys); filter(f_user); destination (d_user); }; log { source(s_sys); filter(f_messages); destination(d_mesg); }; log { source(s_sys); filter(f_secure); destination(d_secure); }; log { source(s_sys); filter(f_mail_info,f_mail_warnings,f_mail_errors); destination(d_mail); }; log { source(s_sys); filter(f_emerg); destination(d_mlal); }; log { source(s_sys); filter(f_spooler); destination(d_spooler); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; log { source(s_sys); filter(f_mail_info); destination(d_mail_info); }; log { source(s_sys); filter(f_mail_warnings); destination(d_mail_warnings); }; log { source(s_sys); filter(f_mail_errors); destination(d_mail_errors); }; log { source(s_sys); filter(f_cron_info); destination(d_cron_info); }; log { source(s_sys); filter(f_cron_warnings); destination(d_cron_warnings); }; log { source(s_sys); filter(f_cron_errors); destination(d_cron_errors); }; log { source(s_sys); filter(f_kernel_info); destination(d_kernel_info); }; log { source(s_sys); filter(f_kernel_warnings); destination(d_kernel_warnings); }; log { source(s_sys); filter(f_kernel_errors); destination(d_kernel_errors); }; log { source(s_sys); filter(f_lpr_info); destination(d_lpr_info); }; log { source(s_sys); filter(f_lpr_warnings); destination(d_lpr_warnings); }; log { source(s_sys); filter(f_lpr_errors); destination(d_lpr_errors); }; log { source(s_sys); filter(f_news_info); destination(d_news_info); }; log { source(s_sys); filter(f_news_crit); destination(d_news_crit); }; log { source(s_sys); filter(f_news_err); destination(d_news_err); }; log { source(s_sys); filter(f_daemon_info); destination(d_daemon_info); }; log { source(s_sys); filter(f_daemon_warnings); destination(d_daemon_warnings); }; log { source(s_sys); filter(f_daemon_errors); destination(d_daemon_errors); }; log { source(s_sys); filter(f_postgresql); destination(d_postgresql); }; -------------------------END OF FILE-------------------------

2 1

Is my default location broken?
by Madziarczyk, Jonathan 19 Feb '04

19 Feb '04

I just migrated to a new box for syslog-ng and I'm trying to get the "default" location to work for messages that don't meet any of my rules yet. I've sent multiple syslog messages to the box but they don't seem to be showing up. Any ideas? I do know that the "rules" messages are working so udp is binding. Thanks, JonM options { dir_perm(0755); perm(0644); chain_hostnames(no); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); dns_cache (yes); create_dirs (yes); keep_hostname(yes); }; source local { unix-dgram("/dev/log"); internal(); }; source s_udpmessages { udp(ip(0.0.0.0) port(514)); }; destination unsorted { file("/logs/unsorted.log" perm(0777)); }; log { source(s_udpmessages); destination(unsorted); flags(final, fallback); };

2 1