- syslog-ng - lists.balabit.hu

filtering pre logger script
by Ian Hunt 28 Nov '03

28 Nov '03

Hi, I have some quite busy logs that I would like to pre filter using logger. I had sort of thought that this might be possible using grep but it doesn't seem to work, not a logger problem probably a scripting issue ! tail -200f ${logdir}/${logfile} | egrep -e 'ERR-*' | logger Although if I take off the grep it seem to work i.e. tail -200f ${logdir}/${logfile} | logger Anyone any ideas? (it may be that this is the wrong way to go about it) Ta Ian I was wondering if it is possible to filter Ian Hunt email: ian.hunt(a)swapswire.com Tel: +44 (0) 207 868 2452 --------------------------------------------------------------------- This is a commercial communication sent by SwapsWire Limited. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message which arise as a result of e-mail transmission. If verification is required please request a hard-copy version. Please contact info(a)swapswire.com if you no longer wish to receive commercial communications from us, identifying the email addresses to which you no longer wish commercial emails to be sent.

1 0

UDP driver - display source IP address
by David Aldrich 28 Nov '03

28 Nov '03

Hi I now realise that the answer to my question is to use option: use_dns(no) Thanks David

1 0

Date Format
by Voelkl, Markus 28 Nov '03

28 Nov '03

Is there any Way in Syslog-ng to change the incoming Date Format from "Nov 28" to "11-28-2003" in the logfile. This would help me very much. Eventually after syslog-ng with a script. thanks in advance. Markus

2 1

pipes and tags
by Bedo Sandor 28 Nov '03

28 Nov '03

Hi, Syslog-ng sends to the program destination "<num>blah-blah" formatted lines, where num is a decimal-coded value of the priority and facility. I have a little application that strongly uses this number. There's a master syslog-ng in my system, and there is a chroot-ed syslog-ng with this little application. The two syslog-ngs communicates each other using named pipes found in the chroot-ed environment, but the decimal value does not come across the pipes, and I can only put a hexadecimal value with template("<$PRI>$MSG\n") back. Why doesn't use pipe() the same template like file()? Is it able to send this value in decimal format on the pipe? -- bSanyI

2 1

UDP driver - display source IP address
by David Aldrich 28 Nov '03

28 Nov '03

Hi I wish to use syslog-ng to log messages received on the UDP port. I have a very simple .conf file: ============================== # Syslog-ng test file for BB failure logging # # D Aldrich 27/11/2003 options { long_hostnames(off); sync(0); keep_hostname(yes);}; # Listen on udp port 514 of all available interfaces source net { udp(); }; destination d_net { file("/var/log/bb.log"); }; filter f_auth { facility(auth); }; log { source(net); destination(d_net); }; ============================ An example of a logged message using this file is: Nov 28 11:27:44 embedded This is a test message I assume that "embedded" here is the hostname of the source. Am I correct? Can I configure syslog-ng to display an explicit IP address rather than the host name? Thanks David

1 0

error "Cannot assign requested address"
by Matthew Bassili 27 Nov '03

27 Nov '03

List members, I am trying to setup syslog-ng (Red Hat9, syslog build 1.6.0rc4) with the following syslog-ng.conf file: ############################################################### # First, set some global options # options { keep_hostname(yes); long_hostnames(off); sync(0); log_fifo_size(1024); log_msg_size(8192); }; ############################################################### # # source local { unix-dgram("/dev/log"); internal(); pipe("/proc/kmsg" log_prefix("kernel: ")); }; #source nocpix # { udp(ip("172.31.30.2") port(514)); # }; source nocpix-out { udp(ip("147.76.127.44") port(514)); }; #source mb2-pix # { udp(ip("172.18.1.6") port(514)); # }; source other { udp(); }; # # ############################################################### # # destination local { file("/var/log/syslog-ng/local/local.$YEAR.$MONTH.$DAY"); }; destination other { file("/var/log/syslog-ng/other/other.$YEAR.$MONTH.$DAY"); }; destination nocpix { file("/var/log/syslog-ng/nocpix/nocpix.$YEAR.$MONTH.$DAY"); }; #destination mb2 { file("/var/log/syslog-ng/mb2/mb2.$YEAR.$MONTH.$DAY"); }; # # ############################################################### # # filter f_auth { facility(auth, authpriv); }; filter f_authpriv { facility(authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_messages { facility(daemon, kern, user); }; filter f_news { facility(news); }; filter f_spooler { facility(uucp,news) and level(crit); }; filter f_syslog { not facility(auth, authpriv) and not facility(mail); }; filter f_user { facility(user); }; # # ############################################################### # # log { source(local); destination(local);}; #log { source(nocpix); destination(nocpix);}; log { source(nocpix-out); destination(nocpix);}; #log { source(mb2-pix); destination(mb2);}; log { source(other); destination(other);}; & I get the following error message on startup: "Starting syslog-ng: io.c: bind_inet_socket() bind failed 147.76.127.44:514 Cannot assign requested address" When I comment out the line " source nocpix-out { udp(ip("147.76.127.44") port(514)); };" Everything works fine using udp();, but I really want to separate the sources so I can direct the log files to a different directory. Any help would be GREATLY appreciated. Matthew Bassili Senior Network Engineer NEC Business Solutions P/L 649 Springvale Rd Mulgarve, 3170 AUSTRALIA e-mail: matthew.bassili(a)nec.com.au

1 0

UDP Template
by Gianpiero Porchia 26 Nov '03

26 Nov '03

Hi, I would like to do log relaying, using syslog-ng. But I need to change the log format. The problem is that the "template" directive is not available for the udp destination (even for the tcp destination). Could you suggest me some work around to do that? Thanks in advance. - gian P.S I've thought on a work around, but it doesn't work fine. Hence the "template" directive is available for the pipes, I've used a pipe destination to send the logs. Then, I'm using the same pipe, as source, and I'm relaying the logs from it, to another log server. But syslog-ng thinks that the logs are coming from the server, and I get the following (ie, it uses the standard log format, after the pipe): Message Before the pipe -------------------- [X.Y.Z.K] ufs: [ID 213553 kern.notice] NOTICE: realloccg /u00: file system full Message After the pipe --------------------- Sep 25 18:12:11 Figth_cluB_01 [X.Y.Z.K] ufs: [ID 213553 kern.notice] NOTICE: realloccg /u00: file system full I'm using this configuration: # CONF ############################################# source s_net { udp(); }; source s_pipe_per_NI { pipe(/var/chroot/syslog-ng/dev/pipe_per_NI); }; destination relay_to_NI { udp("A.B.C.D" ); }; destination d_pipe_per_NI { pipe("/dev/pipe_per_NI" template("[$HOST] $MSG\n") ); }; log { source(s_net); destination(d_pipe_per_NI); # Here, I can apply the template }; log { source(s_pipe_per_NI); destination(relay_to_NI); # Here, syslog-ng applies the standard log format :( }; # END CONF ############################################# _____ Ing. Gianpiero Porchia Security Engineer ATS - Advanced Telecom Systems Designing, Testing, Managing Network Quality Via Salgari, 17 - 41100 Modena - ITALY Tel +39 059 821332 Fax +39 059 821492 Cel +39 335 330413 E-mail: gianpiero.porchia(a)atsweb.it messenger.msn.com: http://messenger.msn.com/, gianpiero.porchia(a)atsweb.it Web site: http://www.atsweb.it PGP Key ID: 0xCAE064A4 (pgpkeys.mit.edu:11371) Fingerprint: 080D AD88 C18A FCA3 91BC 0DF2 F05F 7489 CAE0 64A4

2 1

RE: [syslog-ng]syslog-ng 1.6.0rc4 build problems
by David Aldrich 26 Nov '03

26 Nov '03

Hi José > A couple of months ago I placed online SRPMS > of libol and syslog-ng. They build without problems > in Red Hat 7.3, 8.0, and 9.0. The configuration > file included is similar to the one RH includes > with Syslog. > > http://gsd.di.uminho.pt/jpo/software/RPMS/ Thank you for this information. David

1 0

RE: [syslog-ng]syslog-ng 1.6.0rc4 build problems
by David Aldrich 26 Nov '03

26 Nov '03

Hi Andrew Thank you very much for your reply. I will give it a try. David > -----Original Message----- > From: Hamilton Andrew [mailto:Andrew.Hamilton@afccc.af.mil] > Sent: Wednesday, November 26, 2003 2:39 PM > To: syslog-ng(a)lists.balabit.hu > Subject: RE: [syslog-ng]syslog-ng 1.6.0rc4 build problems > > > #set up your source: > > source net { udp(); } # default port all interfaces > #or > source net { udp(ip("10.10.10.10") port(514)); };# specific > interface and specific port > > #any sort of filter or none: > > filter f_local7 { facility(local7); }; > > #a destination > > destination d_net { file("/var/log/netmessages" perm(644)); > }; # perm is an option, you can leave it off. #or > destination d_macro_net { > file("/var/log/net/$HOST/$YEAR/$MONTH/$DAY/$FACILITY.log" > create_dirs(yes) perm(600)); } #macros > > #and a log line > > log { source(net); destination(d_macro_net); }; # everything > from the port is logged to the macro determined file log { > source(net); filter(f_local7); destination(d_net); }; # only > local7 messages logged > > That shows you a couple of different options as well as some > defaults. This really just scratches the surface of what > syslog-ng is capable of... > > -----Original Message----- > From: David Aldrich [mailto:david.aldrich@t-modus.nec.co.uk] > Sent: Wednesday, November 26, 2003 9:22 AM > To: 'syslog-ng(a)lists.balabit.hu' > Subject: RE: [syslog-ng]syslog-ng 1.6.0rc4 build problems > > > Hi > > > I in no way meant to sound condescending and apologize if it > > came across that way. It was interesting as I was trying to > > imagine situations in which that could happen to you, thus > > trying to help. > > Thanks for your help - I wasn't offended at all! > > I want to experiment with syslog-ng's ability to log messages > received on the UDP port. For now, I want to continue to use > syslogd to log all other messages - so as not to disturb the > system. Please could you or anyone else briefly explain how > to make a simple .conf file to log UDP messages with syslog-ng? > > David > > > Telecom MODUS is an ISO9001/TickIT approved Company. > LRQA Certificate of Approval reference 0965133 > ************************************************************ > THIS MESSAGE IS INTENDED ONLY FOR THE USE OF THE INDIVIDUAL > TO WHOM IT IS ADDRESSED AND CONTAINS INFORMATION THAT IS > PRIVATE AND/OR PROPRIETARY. If the reader of this message is > not the intended recipient, or the employee or agent > responsible for delivering the message to the intended > recipient, you are hereby notified that any dissemination, > distribution or copying of this communication is strictly > prohibited. If you have received this communication in error, > please forward the whole message to admin(a)t-modus.nec.co.uk > Company Registration No.3493954 Telephone Number +44 (0) 1372 > 381880 Fax Number +44 (0) 1372 381804 Email general(a)t-modus.nec.co.uk > ************************************************************ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/sysl> og-ng > > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/sysl> og-ng > > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html >

2 1

RE: [syslog-ng]syslog-ng 1.6.0rc4 build problems
by Hamilton Andrew 26 Nov '03

26 Nov '03

#set up your source: source net { udp(); } # default port all interfaces #or source net { udp(ip("10.10.10.10") port(514)); };# specific interface and specific port #any sort of filter or none: filter f_local7 { facility(local7); }; #a destination destination d_net { file("/var/log/netmessages" perm(644)); }; # perm is an option, you can leave it off. #or destination d_macro_net { file("/var/log/net/$HOST/$YEAR/$MONTH/$DAY/$FACILITY.log" create_dirs(yes) perm(600)); } #macros #and a log line log { source(net); destination(d_macro_net); }; # everything from the port is logged to the macro determined file log { source(net); filter(f_local7); destination(d_net); }; # only local7 messages logged That shows you a couple of different options as well as some defaults. This really just scratches the surface of what syslog-ng is capable of... -----Original Message----- From: David Aldrich [mailto:david.aldrich@t-modus.nec.co.uk] Sent: Wednesday, November 26, 2003 9:22 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: RE: [syslog-ng]syslog-ng 1.6.0rc4 build problems Hi > I in no way meant to sound condescending and apologize if it > came across that way. It was interesting as I was trying to > imagine situations in which that could happen to you, thus > trying to help. Thanks for your help - I wasn't offended at all! I want to experiment with syslog-ng's ability to log messages received on the UDP port. For now, I want to continue to use syslogd to log all other messages - so as not to disturb the system. Please could you or anyone else briefly explain how to make a simple .conf file to log UDP messages with syslog-ng? David Telecom MODUS is an ISO9001/TickIT approved Company. LRQA Certificate of Approval reference 0965133 ************************************************************ THIS MESSAGE IS INTENDED ONLY FOR THE USE OF THE INDIVIDUAL TO WHOM IT IS ADDRESSED AND CONTAINS INFORMATION THAT IS PRIVATE AND/OR PROPRIETARY. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please forward the whole message to admin(a)t-modus.nec.co.uk Company Registration No.3493954 Telephone Number +44 (0) 1372 381880 Fax Number +44 (0) 1372 381804 Email general(a)t-modus.nec.co.uk ************************************************************ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0