- syslog-ng - lists.balabit.hu

Syslog Daemon Vendors
by Chance, Larry 11 Feb '04

11 Feb '04

Can anyone recommend a Syslog Daemon that works with the Computer Associates Unicenter products for network management? Thanks.

1 0

Sending Email via syslog-ng
by Wilhelm.Greiner＠vaps.de 11 Feb '04

11 Feb '04

Hi, im trying to send email with syslog-ng, i have configurations like this: destination ruf_mich_an { program("/usr/local/sbin/log_to_mail.pl"); }; filter ruf_mich_an2 { facility(cron); }; log { source(net); filter(ruf_mich_an2); destination(ruf_mich_an); }; or things like: destination d_cachos_dns_ldap_errors2 { program("/usr/local/sbin/log_to_mail.pl"); }; filter f_cachos_dns_error { match("Connection refused on DNS lookup to"); }; log { source(net); filter(f_cachos_dns_error); destination(d_cachos_dns_ldap_errors2); }; But there comes no mail, that perl script (see below) works correkt on the Console (takes input for the body from stdin). But, when i restart syslog-ng, i become 4 Mails, but with only "761" inside... Is there any "buffer" available? Means: will i receive a Mail for _every_ LogEntry, or can i say, all logentries in a defined time (minute or so). But i also can do that in the Mail Script. ##################################################### #!/usr/bin/perl #s/^<[\d]{1,2}>//; use Socket; $proto = getprotobyname('tcp'); $port = 25; $address = 192.168.3.12; socket(Socket_Handle, PF_INET, SOCK_STREAM, $proto); $sin = sockaddr_in($port,$address); connect(Socket_Handle,$sin) || die ("Failed $!:"); select(Socket_Handle); $|=1; select(STDOUT); print Socket_Handle "ehlo test\n"; print Socket_Handle "mail from: me\(a)myhouse.net\n"; print Socket_Handle "rcpt to: irgendwer\(a)myhouse.net\n"; print Socket_Handle "data\n"; print Socket_Handle "subject: $_\n\n"; print Socket_Handle "$_\r\n"; print Socket_Handle ".\r\n"; print Socket_Handle "quit\n"; while(<Socket_Handle>) { print $_; } close(Socket_Handle);

3 2

RE: [syslog-ng]Syslog-ng, Mysql, and Cisco routers
by Michael Earls 07 Feb '04

07 Feb '04

Can you email the rest of your syslog-ng config, All I see is a log file called /var/log/cisco, How do you import this into the mysql database? When you issue show logging on the cisco you should see how many message were sent to the log server and type of message sent. ibr01>sh logg Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns) Console logging: level debugging, 1126 messages logged Monitor logging: level debugging, 2 messages logged Buffer logging: level debugging, 1126 messages logged Exception Logging: size (8192 bytes) Trap logging: level debugging, 481 message lines logged Logging to 192.168.1.11, 481 message lines logged The other thing is to run tdpdump on the log server with a filter for only that router. tcpdump host 'router_ip' You could also debug ip packets on the router, instead of a debug all, ! ip access-list 199 permit ip host 'log server ip' host 'router ip' ip access-list 199 permit ip host 'router ip' host 'log server ip' ! deb ip packet 199 detail ! term mon ! undebug all michael Michael Earls Systems Analyst, Information Services Cincinnati Children's Hospital Medical Center Phone: 513-636-5882 Phone: 1-800-344-2462 PGP Info: KeyID 0x5EB59708 Fingerprint 108B A1D8 76F5 08A8 501A F28C 86F4 4BC5 5EB5 9708 >>> dedelman(a)iname.com 02/06/04 09:19PM >>> This may be a problem of somewhat different semantics between Cisco IOS and syslog-ng configuration speak. In IOS logging trap debug says send all messages of priority debug (the lowest possible) and higher to the logging host (10.1.1.91 in this case.) Syslog-ng syntax says if you say priority debug you mean only that priority. I suspect that if you enable yourself on a *test* router and turn on some debugging you will see the messages in the log file. BTW, unless you are attached directly to the router console port, you will need to issue the IOS command term monitor in order to see the debug output locally. Be real careful about debugging a router under a heavy load since it can quickly turn into a self-eating doughnut and disappear into its own hole :( --Dave -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Kevin Rothwell Sent: Friday, February 06, 2004 2:03 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Syslog-ng, Mysql, and Cisco routers Hello, I have syslog-ng installed on all of my Linux boxes, logging to a mysql database. (This works) I would like to configure one of my Cisco routers to send syslog messages to this database as well. I have modified my syslog-ng.conf file on the mysql database box to include the following lines: Facility filters filter f_cisco { facility(local7) and priority(debug); }; destination d_cisco {file(" file("/var/log/cisco")' }; log { source(net); filter(f_cisco); destination(d_cisco); }; I have issued the following commands on my router: logging 10.1.1.91 logging facility local7 logging trap debug logging on Needless to say, it isn't working. Why else would I be sending this message. Is there anyone logging their Cisco syslog messages to a mysql database? If so, how can I do it on Redhat Linux? Any help would be greatly appreciated. Thanks. Kevin Rothwell _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html --- [This E-mail scanned for viruses by ezaccess.net] _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Syslog-ng, Mysql, and Cisco routers
by Kevin Rothwell 07 Feb '04

07 Feb '04

Hello, I have syslog-ng installed on all of my Linux boxes, logging to a mysql database. (This works) I would like to configure one of my Cisco routers to send syslog messages to this database as well. I have modified my syslog-ng.conf file on the mysql database box to include the following lines: Facility filters filter f_cisco { facility(local7) and priority(debug); }; destination d_cisco {file(" file("/var/log/cisco")' }; log { source(net); filter(f_cisco); destination(d_cisco); }; I have issued the following commands on my router: logging 10.1.1.91 logging facility local7 logging trap debug logging on Needless to say, it isn't working. Why else would I be sending this message. Is there anyone logging their Cisco syslog messages to a mysql database? If so, how can I do it on Redhat Linux? Any help would be greatly appreciated. Thanks. Kevin Rothwell

3 2

Network masks
by Henning Markussen 06 Feb '04

06 Feb '04

Hi We use syslog-ng - and it is a cool tool. But we have a lot of systems that need to log to our syslog-ng server, and they don't all have to log into there own file Is it possible to make a host mask that matches ex. 10.1.1.0/28 or 10.1.1.130/28 ? The goal is to filter all 10.1.1.0/28 into one file and 10.1.1.130/28 into another file. - Henning

2 1

Syslog-File Analyser
by MGruber＠metzler.com 06 Feb '04

06 Feb '04

Hi! Perhaps it is a little bit out of topic. We are using syslog-ng in a Central-Syslog-Server environment, with very good success, recently my boss asked for an analysing-tool for syslog-Messages. He would like to have a fast browser, which searches thru our Syslog-Files, we are not logging into a Database, for specific occurences of Errormessages, perhaps with the possibility of an statistic evaluation, this should only be as forensic analysis Any clues or hints, because grep/find or exporting an searching with UltraEdit doesnt satisfy him :-( Thanx in Advance Matthias Gruber

2 1

TCP interconnection between syslog-ng Servers
by Rule, Ted 06 Feb '04

06 Feb '04

I have a requirement to interconnect a few syslog-ng Servers. The overall idea is to provide a sub-master syslog server per building, and then have all the sub-master's log up to the master syslog server in the main site. The hope is to reduce the impact on total log visibility of loss of either the master server or the master server's site. Two basic questions arise from this, though the 2nd has some sub-clauses: 1) Is there a preferred TCP port and formatting to be used on the syslog-ng interconnect? I'd like to conform as much as is practicable with RFCs and so on, but of course TCP Port 514 is already taken by rsh as noted in the syslog-ng documentation. Some of the more recent Internet Drafts make reference to XML style formatting on the syslog stream, but I don't think that's supported in syslog-ng as yet. 2) What is the overall impact on the sub-master of a sudden death of the master? Are there any deadlocks involved here where the outbound stream from the sub-master pumps TCP data to a non-existent host and the syslog-ng client hangs waiting for TCP session to complete? Does the syslog-ng client and/or the syslog-ng server set TCP_KEEPALIVE flag on the socket to ensure that the socket eventually gets closed if the master ( OR slave ) is dead for an extended period? FWIW, I'm running version 1.6.0rc3 at present. Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

Timezone problem with syslog-ng
by "Pedroche, Raúl" 04 Feb '04

04 Feb '04

Greetings. First of all, hello to everybody as this is my first post. I am not too sure if this falls into the "problems" or "feature requests" section. The matter is I have noticed that syslog-ng is using UTC instead of local time, as I'd like it to do. I am using the "use_time_recv" option and server is configured for MET timezone (BTW it is Solaris 9). This is affecting both filenames (I am using variations of .../$WEEKDAY/$HOST and yesterday files have a timestamp of "dec 19 00:59" local time) and the file contents (i.e. first columns). syslog-ng version is 1.6.0rc4. I must, anyway, congratulate the authors: we have been running syslog-ng for quite a while (in a server configured with UTC :>) and it has been proved being very effective (it is a very dated host being log server for a lot of networking devices, some of them generating more than 1GB logs/day and has a 0.05-0.08 load). Regards, Raúl Pedroche COLT Telecom Av. Manoteras, 42 - Calle 3, 28050 Madrid Teléfono de soporte técnico: 901 88 99 88 Para llamadas desde el extranjero: +34 91 320 60 18 Email: raul.pedroche(a)colt-telecom.es www.colt.net ********************************************************************** COLT Telecom Espana S.A. Oficina Registrada en: Telemaco, 5 28027 Madrid Tel. +34 91 789 9000 This message is subject to and does not create or vary any contractual relationship between COLT Telecommunications, its subsidiaries or affiliates ("COLT") and you. Internet communications are not secure and therefore COLT does not accept legal responsibility for the contents of this message. Any view or opinions expressed are those of the author. The message is intended for the addressee only and its contents and any attached files are strictly confidential. If you have received it in error, please telephone the number above. Thank you. **********************************************************************

3 3

RE: [syslog-ng]Re: Timezone problem with syslog-ng
by "Pedroche, Raúl" 04 Feb '04

04 Feb '04

Greetings. That seemed to be the problem. I was using the init.d.solaris file included in the distribution and I modified it adding a . /etc/TIMEZONE before the "$DAEMON $OPTIONS..." line. It is now working flawlessly. I assume nother alternative would be to use "TZ=whatever $DAEMON...". Anyway, sorry for not sharing this before. Regards, Raúl Pedroche COLT Telecom Systems Operations Customer Support Email: raul.pedroche(a)colt-telecom.es www.colt.net -----Original Message----- From: Nate Campi [mailto:nate@campin.net] Sent: Tuesday, February 03, 2004 5:16 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Re: Timezone problem with syslog-ng On Tue, Feb 03, 2004 at 04:53:24PM +0100, Roberto.Re(a)cu.mi.it wrote: > [iso-8859-1] "Pedroche, Ra???l" writes: > > > The matter is I have noticed that syslog-ng is using UTC instead of local > >time, as I'd like it to do. I am using the "use_time_recv" option and > >server > >is configured for MET timezone (BTW it is Solaris 9). > > I have the same problem on linux RH9. > I dont understand how to solve it ? Any Idea? You might be starting syslog-ng from an environment where all the environmental variables are scrubbed, I've had similar things happen. How are you starting syslog-ng? -- Nate "The IBM compatible sector has not yet recognized that 95% of computer usage is devoted to experimenting with different fonts and character styles in documents." - Reiner, Ron _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ********************************************************************** COLT Telecom Espana S.A. Oficina Registrada en: Telemaco, 5 28027 Madrid Tel. +34 91 789 9000 This message is subject to and does not create or vary any contractual relationship between COLT Telecommunications, its subsidiaries or affiliates ("COLT") and you. Internet communications are not secure and therefore COLT does not accept legal responsibility for the contents of this message. Any view or opinions expressed are those of the author. The message is intended for the addressee only and its contents and any attached files are strictly confidential. If you have received it in error, please telephone the number above. Thank you. **********************************************************************

1 0

syslog-ng daemon meltdown
by vj23x＠netscape.net 29 Jan '04

29 Jan '04

Ran into this meltdown, thought it would be interesting to the list. Running Syslog-ng 1.6RC3 on Solaris 2.8. 400 mHz dual processor Sun box. This is a somewhat sanitized version of the actual messages. From /var/adm/messages: Jan 27 15:23:44 nms1 syslog-ng[5651]: STATS: dropped 0 Jan 27 16:06:09 nms1 syslog-ng[5651]: io.c: do_write: write() failed (errno 28), No space left on device Jan 27 16:06:09 nms1 syslog-ng[5651]: pkt_buffer::do_flush(): Error flushing data Jan 27 16:06:09 nms1 ufs: [ID 845546 kern.notice] NOTICE: alloc: /data: file system full Jan 27 16:06:09 nms1 syslog-ng[5651]: io.c: do_write: write() failed (errno 28), No space left on device Jan 27 16:06:09 nms1 syslog-ng[5651]: pkt_buffer::do_flush(): Error flushing data ... [These messages repeat for a few minutes, until suddenly massive drops] [This was strange to me, because the /data filesystem did not appear to actually fill up. I never did anything to clear it, and I had a few hundred MB free space when I looked at the server after the failure the next day.] Jan 27 16:23:44 nms1 syslog-ng[5651]: STATS: dropped 525887 Jan 27 17:23:44 nms1 syslog-ng[5651]: STATS: dropped 1897106 Jan 27 18:23:44 nms1 syslog-ng[5651]: STATS: dropped 1915287 ... [about 2M drops every hour until midnight] Jan 28 00:23:44 nms1 syslog-ng[5651]: STATS: dropped 46122 [syslog-ng continues dropping messages at our "normal" rate. I.e. the flood is over at around midnight.] From the network device syslogs: [this is the critter that was flooding us] Jan 27 14:19:09 content1 US/Eastern:%SYS-2-CE: SCSI I/O error: POSSIBLE BAD DISK -- device 0x807, sector 4672 Jan 27 14:19:09 content1 US/Eastern:%SYS-2-CE: SCSI I/O error: POSSIBLE BAD DISK -- device 0x808, sector 768 ... [this continues for almost 3 more hours, hundreds of various sector errors per second] Finally, syslog-ng "freezes up" with these last two/three messages: (After 17:06:09, syslog-ng dropped all messages. Syslog-ng logged nothing more to the files until I stopped and restarted syslog-ng daemon.) Jan 27 17:06:09 content1 US/Eastern:%SYS-2-CE: SCSI I/O error: POSSIBLE BAD DISK -- device 0x807, sector 537872 Jan 27 17:06:09 conJan 28 10:09:17 content2 US/Eastern:%OVERLOAD-5-CE: %CE-BYPS-5-130007: OVERLOAD: Preload did not receive overload message. Preload may not be running The last message from content1 device is interrupted in mid-stream. __________________________________________________________________ New! Unlimited Netscape Internet Service. Only $9.95 a month -- Sign up today at http://isp.netscape.com/register Act now to get a personalized email address! Netscape. Just the Net You Need.

1 0