- syslog-ng - lists.balabit.hu

filter(DEFAULT)
by Andrew Culver 25 Jan '04

25 Jan '04

I have the following defined in my config: log { source(s_main); filter(DEFAULT); destination(d_default); }; But syslog-ng gives the following error: Starting syslog-ng: unresolved reference: DEFAULT Error initializing configuration, exiting. Anyone know why this might be and what I can do to fix it? TIA Andrew

2 1

Priorities
by Andrew Culver 25 Jan '04

25 Jan '04

Does the filter option: level(debug) filter messages of level debug _and higher_ or only messages of that level? Andrew

2 1

dir creation with IP/Host
by Dylan H. Bouterse 23 Jan '04

23 Jan '04

I have successfully installed syslog-ng and have it doing most of what I want it to do, with the exception of one thing. I have a host that is not reporting it's IP in a standard format (or I guess that's what's happening) because syslog-ng is creating a new directory based on what looks to be command types. See below: %SYS-I-INITSYS, %SSH-W-IDLE_TIMEOUT, %CLI-E-NOFACINST, So my question is, is there a way to force a specific host to a specific log file before the auto-creation of directories happens? Below is a snipped of my log file. Hopefully I am including all the info I need to help figure this out, but if I'm not, please let me know. options { chain_hostnames(no); create_dirs (yes); dir_perm(0755); dns_cache(yes); keep_hostname(yes); log_fifo_size(2048); log_msg_size(8192); long_hostnames(on); perm(0644); stats(3600); sync(0); time_reopen (10); use_dns(yes); use_fqdn(no); }; source src { unix-dgram("/dev/log"); internal(); udp(); tcp(port(514) keep-alive(yes) max-connections(25));}; destination std { file("/var/log/HOSTS/$HOST/$HOST.syslog" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; Dylan Bouterse Network Manager Global Card Services (407) 206-7714 office dhbouterse(a)fhmsi.com Note: This e-mail and any attachments may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of this e-mail and any attachments is strictly prohibited. If you have received this e-mail in error, please notify us immediately by returning it to the sender and deleting it from your computer system. Thank you for your cooperation. First Horizon Merchant Services.

2 1

receiving udp from remote servers
by Wang, Philip R. 23 Jan '04

23 Jan '04

I am new to syslog-ng. I used the following config file to test it out under Solaris. Then I used a pc application to generate udp message to port 514. I started the process using "syslog-ng -f filename". I can see log message in "messages" indicating the process started. However, when I send the simulated message from my PC app. It does not show up in the log file. I was reading some Linux syslog-ng document: an chapter from a book. It mentioned using the '-r' option to allow accepting remote message. I have syslog 1.6.1 and it does not have this option. Not sure if I missed anything? Philip --------------------------------------------------------------------- source local { internal(); udp();}; destination all { file("/opt/syslog-ng/messages"); }; log { source(local); destination(all); }; -----------------------------------------------------------------------

2 1

multiple listen port for centralized syslog-ng
by Alessandro Fiorenzi 23 Jan '04

23 Jan '04

Hi, I would like to setup a very customized version centralize syslog-ng. I would like to divide out server into tree areas - General Porpouse Server - IDS - Firewall for wich I would like to have multiple istance of syslog-ng listening each one on different port like: - General Porpouse Server: port 10000 - IDS : port 10001 - Firewall : port 10002 Is it possible to do? or how can I do to distinguish ? Thanks

2 1

Using full hostnames
by Andrew Culver 20 Jan '04

20 Jan '04

I'm trying to use full hostnames such as www.my.domain.com for both inside the log files, and also for the $HOST macro in the config files (for creating directories based on host). What options should I use to achieve this? I've tried a few different options, but I am only able to get either www or src@www inside the log, and the directories are always simply www. TIA, Andrew

2 1

RE: [syslog-ng]funny character is being inserted into each log li ne + perm(-1) n ot working
by Clemson, Chris 20 Jan '04

20 Jan '04

thank you, that fixed it! > > Correct, this has been fixed by a patch posted to this list > > earlier, and > > in the last 1.6.1 syslog-ng release (which has the posted > > patch merged) > > oh, thanks for the reply! > i must have missed that, i'll check it out > > cheers, > > chris > > -- > The content of this e-mail is confidential, may contain > privileged material > and is intended solely for the recipient(s) named above. If > you receive this > in error, please notify Software AG immediately and delete > this e-mail. > > Software AG (UK) Limited > Registered in England & Wales 1310740 > Registered Office: Hudson House, Hudson Way, > Pride Park, Derby DE24 8HS > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

1 0

RE: [syslog-ng]syslog-ng-1.6.1 make error.
by Andrews, Glenn J (Glenn) 19 Jan '04

19 Jan '04

Yes that corrected the problem. I installed autoconf-2.1.3 and all it right with the world again :-) Glenn -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Sunday, January 18, 2004 10:15 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng-1.6.1 make error. On Fri, 2004-01-16 at 23:52, Andrews, Glenn J (Glenn) wrote: > I have install libol 0.3.12 and I am trying to install > syslog-ng-1.6.1. > The libol install ok. The syslog-ng "./configured" ok but when I try > to make > I get this error... syslog-ng still uses autoconf2.13 and you probably use a newer, incompatible version. it is also interesting that make wants to rebuild the configure script, it is not normally needed, probably one of the timestamps were bogus. > > cd /tmp/syslog-ng-1.6.1 && autoheader > WARNING: Using auxiliary files such as `acconfig.h', `config.h.bot' > WARNING: and `config.h.top', to define templates for `config.h.in' > WARNING: is deprecated and discouraged. > > WARNING: Using the third argument of `AC_DEFINE' and > WARNING: `AC_DEFINE_UNQUOTED' allows to define a template without > WARNING: `acconfig.h': > > WARNING: AC_DEFINE([NEED_MAIN], 1, > WARNING: [Define if a function `main' is needed.]) > > WARNING: More sophisticated templates can also be produced, see the > WARNING: documentation. > autom4te: need GNU m4 1.4 or later: /usr/ccs/bin/m4 > autoheader: /usr/local/bin/autom4te failed with exit status: 1 > *** Error code 1 > make: Fatal error: Command failed for target > `/tmp/syslog-ng-1.6.1/src/stamp-h.in' > Current working directory /tmp/syslog-ng-1.6.1/src > *** Error code 1 > make: Fatal error: Command failed for target `all-recursive' > > I have m4 1.4 in my path. Is there something I am missing ? > > Glenn Andrews > Data / Voice Networking Services > 1 Robbins Road, Westford, MA 01886 > gjandrews(a)lucent.com <<mailto:gjandrews@lucent.com>> > > -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

compiling syslog-ng (latest version) on solaris 9
by Markus Reger 18 Jan '04

18 Jan '04

hello to everybody Made several attempts to compile syslog-ng. Compilation of libol went fine. Whenever I "make" syslog-ng I encounter the error: gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o getopt.o getopt1.o -lpthread -lnsl -lsocket -ldoor -lresolv /usr/local/lib/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file yywrap cfg-lex.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /install/syslog-ng/syslog-ng-1.6.0rc4/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /install/syslog-ng/syslog-ng-1.6.0rc4/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /install/syslog-ng/syslog-ng-1.6.0rc4/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Has anyone ever compiled on Solaris 9 - gcc 3.3. Thanks in advance for every hint. kr

2 1

Configuration file problem
by Laurent Mesuré 18 Jan '04

18 Jan '04

Hi, i've using this in my suslog-ng.conf file: destination d_msgs { file("/var/log/messages" template("$FULLDATE $HOST $FACILITY.$PRIORITY $MSG\n")); }; put syslog-ng give a parse error on the template part. why does it? i can t find any reason :(( can someone help me? Laurent

2 1