- syslog-ng - lists.balabit.hu

syslog-ng do not work....
by Alessandro Fiorenzi 28 Jan '04

28 Jan '04

Hi, I have set this configuration on central logserver options { long_hostnames(off); sync(0); log_fifo_size(1000); dnscache(yes); use_fqdn(yes); use_time_recvd(true); }; source src { internal(); file("/proc/kmsg" log_prefix("kernel: ")); tcp(ip(192.168.52.100) port(514) max-connections(1000)); udp(ip(0.0.0.0) port(514)); }; but it does not work. The fist errore is on dnscache(yes);, if i remove this I get the second on use_time_recvd(true);, remove this one I get errore on file("/proc/kmsg" log_prefix("kernel: ")); .... why? Thanks Fiorenzi A. ------------------------------------------------------------------------ INFOGROUP S.P.A http://www.infogroup.it ------------------------------------------------------------------------- DR. FIORENZI ALESSANDRO Consulente Tribunale Firenze - sicurezza informatica - Security Administrator Socio CLUSIT, ALSI Tel : +39.055.43.65.742 CE : +39.335.64.144.77 @Email : a.fiorenzi(a)infogroup.it PGP Key: http://www.infogroup.it/ds/fiorenzi.asc ------------------------------------------------------------------------- "Faber est suae quisque fortunae" -------------------------------------------------------------------------

3 2

fallback behaviour
by Andrew Culver 28 Jan '04

28 Jan '04

If I have some log paths, then a log path using the fallback flag, then some more log paths... will that path with the fallback flag not capture message that the log paths after it capture? For example, can I do the following: log { source(src); filter(filt_a); desintation(dest_a); }; log { source(src); destination(dest_b); flags(fallback); }; log { source(src); filter(filt_b); destination(dest_c); }; Will messages not filtered by filt_a be captured by the second log path and then again by the third? If not, is there any way to do this? My understanding was the old filter(DEFAULT) would behave like this, but flags(fallback) would not. Can the same effect still be accomplished? TIA, Andrew

2 1

RE: [syslog-ng] file permissions
by Andrews, Glenn J (Glenn) 28 Jan '04

28 Jan '04

Now for some reason I am getting these messages in /var/log/syslog Jan 27 18:31:34 ma106068-nm01 syslog-ng[2603]: Cannot open file /var/log/HOSTS/10.140.20.12/20040127/ for writing (Is a directory) I have deleted the entire tree from HOSTS on down and killed and restarted syslog-ng. But I still get this error. This is my destination line in syslog-ng.conf destination hosts { file("/var/log/HOSTS/$HOST/$YEAR$MONTH$DAY/$FACILTY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; and options... options { sync (0); perm (0644); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (no); }; Glenn Andrews N.E. Premise Operations Data / Voice Networking Services gjandrews(a)lucent.com <<mailto:gjandrews@lucent.com>>

2 1

file permissions
by Andrews, Glenn J (Glenn) 27 Jan '04

27 Jan '04

Is there a way to set file permssions on the logs syslog-ng creates ? It seems to create them with 600 root:root which makes them read/write by root only. Can I set them to 644 ? Glenn Andrews N.E. Premise Operations Data / Voice Networking Services gjandrews(a)lucent.com <mailto:gjandrews@lucent.com> << mailto:gjandrews@lucent.com <mailto:gjandrews@lucent.com> >> -----Original Message----- From: Andrew Culver [mailto:aculver@uwo.ca] Sent: Tuesday, January 27, 2004 12:45 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng do not work.... Maybe this is too simple but.. is that your entire config file? Do you not have destination and log directives? ----- Original Message ----- From: Alessandro Fiorenzi <mailto:a.fiorenzi@infogroup.it> To: Syslog-ng <mailto:syslog-ng@lists.balabit.hu> Sent: Tuesday, January 27, 2004 10:52 AM Subject: [syslog-ng]syslog-ng do not work.... Hi, I have set this configuration on central logserver options { long_hostnames(off); sync(0); log_fifo_size(1000); dnscache(yes); use_fqdn(yes); use_time_recvd(true); }; source src { internal(); file("/proc/kmsg" log_prefix("kernel: ")); tcp(ip(192.168.52.100) port(514) max-connections(1000)); udp(ip(0.0.0.0) port(514)); }; but it does not work. The fist errore is on dnscache(yes);, if i remove this I get the second on use_time_recvd(true);, remove this one I get errore on file("/proc/kmsg" log_prefix("kernel: ")); .... why? Thanks Fiorenzi A. ------------------------------------------------------------------------ INFOGROUP S.P.A http://www.infogroup.it ------------------------------------------------------------------------- DR. FIORENZI ALESSANDRO Consulente Tribunale Firenze - sicurezza informatica - Security Administrator Socio <file:///home/fiore/signature/www.clusit.it> CLUSIT, <file:///home/fiore/signature/www.alsi.it> ALSI Tel : +39.055.43.65.742 CE : +39.335.64.144.77 @Email : a.fiorenzi(a)infogroup.it PGP Key: http://www.infogroup.it/ds/fiorenzi.asc ------------------------------------------------------------------------- "Faber est suae quisque fortunae" -------------------------------------------------------------------------

2 1

RE: [syslog-ng]syslog-ng do not work....
by Hamilton Andrew 27 Jan '04

27 Jan '04

I would, at the very least, get the latest, which is, I believe, 1.6.1. The 1.4.x line is very old and not nearly as feature rich as 1.6.x. Drew -----Original Message----- From: Alessandro Fiorenzi [mailto:a.fiorenzi@infogroup.it] Sent: Tuesday, January 27, 2004 11:41 AM To: Syslog-ng Subject: RE: [syslog-ng]syslog-ng do not work.... Well I have syslog-ng version 1.4.17, perhaps could be that, infact dns_cache(yes) use_time_recvd(yes) does not go . Alessandro On Tue, 2004-01-27 at 17:01, Hamilton Andrew wrote: What version of syslog-ng are you using? dnscache(yes) should be dns_cache(yes) use_time_recvd(true) should be use_time_recvd(yes) try pipe("/proc/kmsg" log_prefix("kernel: ")); instead of file(... Regards, Drew -----Original Message----- From: Alessandro Fiorenzi [mailto:a.fiorenzi@infogroup.it] Sent: Tuesday, January 27, 2004 10:53 AM To: Syslog-ng Subject: [syslog-ng]syslog-ng do not work.... Hi, I have set this configuration on central logserver options { long_hostnames(off); sync(0); log_fifo_size(1000); dnscache(yes); use_fqdn(yes); use_time_recvd(true); }; source src { internal(); file("/proc/kmsg" log_prefix("kernel: ")); tcp(ip(192.168.52.100) port(514) max-connections(1000)); udp(ip(0.0.0.0) port(514)); }; but it does not work. The fist errore is on dnscache(yes);, if i remove this I get the second on use_time_recvd(true);, remove this one I get errore on file("/proc/kmsg" log_prefix("kernel: ")); .... why? Thanks Fiorenzi A. ------------------------------------------------------------------------ INFOGROUP S.P.A http://www.infogroup.it ------------------------------------------------------------------------- DR. FIORENZI ALESSANDRO Consulente Tribunale Firenze - sicurezza informatica - Security Administrator Socio <file:///home/fiore/signature/www.clusit.it> CLUSIT, <file:///home/fiore/signature/www.alsi.it> ALSI Tel : +39.055.43.65.742 CE : +39.335.64.144.77 @Email : a.fiorenzi(a)infogroup.it PGP Key: http://www.infogroup.it/ds/fiorenzi.asc ------------------------------------------------------------------------- "Faber est suae quisque fortunae" ------------------------------------------------------------------------- ------------------------------------------------------------------------ INFOGROUP S.P.A http://www.infogroup.it ------------------------------------------------------------------------- DR. FIORENZI ALESSANDRO Consulente Tribunale Firenze - sicurezza informatica - Security Administrator Socio <file:///home/fiore/signature/www.clusit.it> CLUSIT, <file:///home/fiore/signature/www.alsi.it> ALSI Tel : +39.055.43.65.742 CE : +39.335.64.144.77 @Email : a.fiorenzi(a)infogroup.it PGP Key: http://www.infogroup.it/ds/fiorenzi.asc ------------------------------------------------------------------------- "Faber est suae quisque fortunae" -------------------------------------------------------------------------

1 0

RE: [syslog-ng]syslog-ng do not work....
by Hamilton Andrew 27 Jan '04

27 Jan '04

What version of syslog-ng are you using? dnscache(yes) should be dns_cache(yes) use_time_recvd(true) should be use_time_recvd(yes) try pipe("/proc/kmsg" log_prefix("kernel: ")); instead of file(... Regards, Drew -----Original Message----- From: Alessandro Fiorenzi [mailto:a.fiorenzi@infogroup.it] Sent: Tuesday, January 27, 2004 10:53 AM To: Syslog-ng Subject: [syslog-ng]syslog-ng do not work.... Hi, I have set this configuration on central logserver options { long_hostnames(off); sync(0); log_fifo_size(1000); dnscache(yes); use_fqdn(yes); use_time_recvd(true); }; source src { internal(); file("/proc/kmsg" log_prefix("kernel: ")); tcp(ip(192.168.52.100) port(514) max-connections(1000)); udp(ip(0.0.0.0) port(514)); }; but it does not work. The fist errore is on dnscache(yes);, if i remove this I get the second on use_time_recvd(true);, remove this one I get errore on file("/proc/kmsg" log_prefix("kernel: ")); .... why? Thanks Fiorenzi A. ------------------------------------------------------------------------ INFOGROUP S.P.A http://www.infogroup.it ------------------------------------------------------------------------- DR. FIORENZI ALESSANDRO Consulente Tribunale Firenze - sicurezza informatica - Security Administrator Socio <file:///home/fiore/signature/www.clusit.it> CLUSIT, <file:///home/fiore/signature/www.alsi.it> ALSI Tel : +39.055.43.65.742 CE : +39.335.64.144.77 @Email : a.fiorenzi(a)infogroup.it PGP Key: http://www.infogroup.it/ds/fiorenzi.asc ------------------------------------------------------------------------- "Faber est suae quisque fortunae" -------------------------------------------------------------------------

2 1

RE: [syslog-ng]syslog-ng do not work....
by Schernau, Ed 27 Jan '04

27 Jan '04

FYI, use_time_recvd only works if you are logging with a template. Or has this been fixed in the latest? -----Original Message----- From: Alessandro Fiorenzi [mailto:a.fiorenzi@infogroup.it] Sent: Tuesday, January 27, 2004 10:53 AM To: Syslog-ng Subject: [syslog-ng]syslog-ng do not work.... Hi, I have set this configuration on central logserver options { long_hostnames(off); sync(0); log_fifo_size(1000); dnscache(yes); use_fqdn(yes); use_time_recvd(true); }; source src { internal(); file("/proc/kmsg" log_prefix("kernel: ")); tcp(ip(192.168.52.100) port(514) max-connections(1000)); udp(ip(0.0.0.0) port(514)); }; but it does not work. The fist errore is on dnscache(yes);, if i remove this I get the second on use_time_recvd(true);, remove this one I get errore on file("/proc/kmsg" log_prefix("kernel: ")); .... why? Thanks Fiorenzi A. ------------------------------------------------------------------------ INFOGROUP S.P.A http://www.infogroup.it ------------------------------------------------------------------------- DR. FIORENZI ALESSANDRO Consulente Tribunale Firenze - sicurezza informatica - Security Administrator Socio <file:///home/fiore/signature/www.clusit.it> CLUSIT, <file:///home/fiore/signature/www.alsi.it> ALSI Tel : +39.055.43.65.742 CE : +39.335.64.144.77 @Email : a.fiorenzi(a)infogroup.it PGP Key: http://www.infogroup.it/ds/fiorenzi.asc ------------------------------------------------------------------------- "Faber est suae quisque fortunae" ------------------------------------------------------------------------- *****This information may be confidential and/or privileged. Use of this information by anyone other than the intended recipient is prohibited. If you received this in error, please inform the sender and remove any record of this message.*****

1 0

Anyone have syslog-ng running on Darwin/Mac OS X?
by Cary, Kim 26 Jan '04

26 Jan '04

Hi All, The libol & syslog-ng compile with no fuss on Mac OS X (10.3.2/GCC 3.3). However, it exits when I kill syslogd and try to run syslog-ng. Any success stories, tips for fixing? Any pointers so I can figure out what the issue is? Thanks for any reply. ksc

2 1

syslog-ng 1.4.17 netzwerk logging
by julius 26 Jan '04

26 Jan '04

i used the example Debian GNU/Linux config and added these options on the log host(192.168.0.1): source s_tcp { tcp(ip(0.0.0.0) port(514) max-connections(10)); }; log { source(s_tcp); destination(messages); }; and on the "source host" (192.168.0.3): destination d_tcp { tcp(192.168.0.1); }; log { source(src); filter(f_messages); destination(d_tcp); }; now i get name queries from my bind thats running on the source host, but syslog queries the bind without stopping, the name server uses nearly 100% from the 133mhz... whats wrong?

2 1

receiving external events
by Wang, Philip R. 25 Jan '04

25 Jan '04

I am new to syslog-ng. I used the following config file to test it out under Solaris. Then I used a pc application to generate udp message to port 514. I started the process using "syslog-ng -f filename". I can see log message in "messages" indicating the process started. However, when I send the simulated message from my PC app. It does not show up in the log file. I was reading some Linux syslog-ng document: an chapter from a book. It mentioned using the '-r' option to allow accepting remote message. I have syslog 1.6.1 and it does not have this option. Not sure if I missed anything? Philip --------------------------------------------------------------------- source local { internal(); udp();}; destination all { file("/opt/syslog-ng/messages"); }; log { source(local); destination(all); }; -----------------------------------------------------------------------

2 1