- syslog-ng - lists.balabit.hu

Log TCP
by Darrell 28 Aug '03

28 Aug '03

I'm new to Linux and we've decided to setup syslog-ng 1.4.17 on Redhat 8 at work. I'm trying to centralize the logs using TCP for all of our Cisco routers, Nortel firewalls and switches. I need to know what lines to enter and where to enter them in my syslog-ng.conf file. Any help would be greatly appreciated. ----------------------------------- Darrell IT Support

2 1

RE: [syslog-ng]syslog-ng and logrotate
by William Rhodes 28 Aug '03

28 Aug '03

Had the same problem and found that syslog-ng has a problem with the kill -HUP that logrotate uses. I replaced that command with /etc/rc.d/init.d/syslog-ng reload and all works fine with no problems. William -----Original Message----- From: yannick.haguenier(a)tuxfamily.org [mailto:yannick.haguenier@tuxfamily.org] Sent: Thursday, July 10, 2003 3:57 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng and logrotate Hy, i have squid + syslog-ng 1.0.6.rc1 Syslog-ng look squid/access.log, and write log file (with date format) on a remote server (tcp). On squid there is a logrotate at 6 am. My pb : before the log rotate, all is good. After logrotate, syslog-ng don't write in the remote file. The last line appear in this file was create at 6am. The process run on the both server, and i have no error. If i run syslog-ng restart, syslog-ng write the ligne in remote file . the next error appear after the next logrotate. Does anyone know why this is happening? thanks _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]Forwarding unchanged Syslog messages
by Paul Jasa 28 Aug '03

28 Aug '03

I have the exact same issue with syslog-ng. I run Red Hat 7.3. Despite the claims that the syslog message can be forwarded without being modified, syslog-ng STILL modifies it. The modified syslog message has the original IP address AND the server's IP address in chain format, which is no good. I want to keep the message UNtouched when it gets forwarded. If anyone has the answer to this question I would very much appreciate it. The MAIN reason why I installed syslog-ng was due to the claim that it could forward without changing the message, but so far it just looks like a claim. pj ====================================== Paul Jasa Network Engineer ====================================== -----Original Message----- From: Harrie.van.Arragon(a)steinmuehlen-brot.de [mailto:Harrie.van.Arragon@steinmuehlen-brot.de] Sent: Tuesday, August 19, 2003 05:17 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Forwarding unchanged Syslog messages Is it possible to forward syslogmessages without modifing the Host and the messages. I thought "keep_hostname(yes)" would solve the problem, but it didn't. Normaly i use version 1.5.15 shipped with debian, but I tryed 1.5.26 too. I don't konw if its important, but our syslogserver has a load of 100% the whole day (not from syslog-ng). I tryed the following config: options { use_fqdn(yes); sync(0); use_dns(yes); chain_hostnames(yes); keep_hostname(yes); }; source net { tcp(); udp();}; destination pc1 { udp(192.168.1.1);}; destination pc2 { udp(192.168.1.2);}; destination pc3 { udp(192.168.1.3);}; log { source(net); destination(pc1);}; log { source(net); destination(pc2);}; log { source(net); destination(pc3);}; bye Harrie _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]last message repeated?
by Rule, Ted 28 Aug '03

28 Aug '03

Dear old syslogd has explicit code to save a copy of the last message received, and compare it with the current message ( less the timestamp field and it only saves 256 bytes of message(?) ), so as to throttle out such floods. It's fairly basic, however, as it imposes no time restriction on the history buffer, so duplicate messages hours apart don't cause separate messages to be logged. As far as I'm aware, syslog-ng has never had this feature, but I agree it would be highly desirable to add to future releases. On the face of it, the basic functionality provided in syslogd shouldn't be difficult thing to code. however, the tricky bells&whistles feature would be to add a separate message history/throttle/cache(?)/aging(?) for each source IP so that a server could correctly spot multiple copies of the same message within a given timeframe even if intervening messages were from a different source. Ted -----Original Message----- From: Chuck Berg <chuck(a)encinc.com>@FLEXTECH Sent: Wednesday 02 July 2003 21:53 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]last message repeated? Is there a particular reason why syslog-ng doesn't generate "last message repeated x times" messages? It's very unfortunate to have the disk on my log server fill up because of one machine flooding the logs. For example, Solaris will send one "WARNING: /tmp: File system full, swap space limit exceeded" message for every write() that fails for that reason. It's easy to get tens of thousands of these per second. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

Re: syslog-ng digest, Vol 1 #1032 - 9 msgs (Vacation)
by TIM MOORE 28 Aug '03

28 Aug '03

FYI: I will be out on vacation from 8/28 until 9/8. Please contact the NOC if you need immediate assistance. Thanks, Tim Moore

1 0

Re: syslog-ng digest, Vol 1 #1031 - 10 msgs (Vacation)
by TIM MOORE 28 Aug '03

28 Aug '03

FYI: I will be out on vacation from 8/28 until 9/8. Please contact the NOC if you need immediate assistance. Thanks, Tim Moore

1 0

template_escape character not valid for oracle
by Matt Scifo 27 Aug '03

27 Aug '03

Hello I just started using syslog-ng with an oracle database as my destination. I have discovered that Oracle does not accept a backslash as an escape character (I thought backslash was a standard). The following query does not work in Oracle... INSERT INTO messages (ID, TIMESTAMP, HOST ,FACILITY, PRIORITY, TAG, PROGRAM, MESSAGE) VALUES ('', to_date('2003-08-26 11:51:00', 'yyyy-mm-dd hh24:mi:ss'), 'host1', 'local0', 'warning', '84', '1', 'STOP: \'edrasmu\' message') It will only accept a single quote for escaping a single quote... INSERT INTO messages (ID, TIMESTAMP, HOST ,FACILITY, PRIORITY, TAG, PROGRAM, MESSAGE) VALUES ('', to_date('2003-08-26 11:51:00', 'yyyy-mm-dd hh24:mi:ss'), 'host1', 'local0', 'warning', '84', '1', 'STOP: ''edrasmu'' message') How hard would it be to change the escape character that syslog-ng is looking for, or even better, make a template_escape(string) option which accepts a custom escape string? Where is the code that handles the escaping of characters located in the source? Matt Scifo mscifo(a)o1.com

2 2

newbie linux/syslog-ng server question...
by Matt Miller 25 Aug '03

25 Aug '03

When running syslog-ng on linux, do I still need to run klogd... or does syslog-ng replace syslogd and klogd? matt -- Matt Miller IT Infrastructure Team Duke University - Fuqua School of Business

2 1

RE: [syslog-ng]$DAY in
by Jérôme Fenal 25 Aug '03

25 Aug '03

It seems that syslog-ng thinks you're looking for $DAY_ and not $DAY. Try to replace the underscore by a dot, or RTFM to see if syslog-ng supports specifying variables that way : ${DAY}. Regards, J. -----Original Message----- From: William Pope [mailto:pope.william@epa.gov] Sent: Mon 8/25/2003 20:43 To: syslog-ng(a)lists.balabit.hu Cc: Subject: [syslog-ng]$DAY in I recently upgraded syslog-ng from version 1.4.17 to 1.6.0rc3. After the upgrade, the system logs do not include the DAY when sent to the following destination. destination hosts { file("/var/adm/logs/$HOST/$YEAR/$MONTH/$DAY_$FACILITY"); }; I get logs like /var/logs/HOST/2003/08/kern.log instead of /var/logs/HOST/2003/08/25_kern.log like I did with version 1.4.17. The day and the underscore are missing. I am using the same conf file as 1.4.17. Any help would be greatly appreciated! I am sure I am missing something stupid. Thank you, Will ------------------------------------------------------------------- This is a PRIVATE message, intended for the designated recipient(s) only and may contain privileged or confidential information. If you have received this message in error, please notify me immediately, delete the original, and destroy any paper copies. Any other use of the email by you is prohibited. NOTE: Regardless of content, this e-mail shall not operate to bind the sender to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of e-mail for such purpose. This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

1 0

$DAY in
by William Pope 25 Aug '03

25 Aug '03

I recently upgraded syslog-ng from version 1.4.17 to 1.6.0rc3. After the upgrade, the system logs do not include the DAY when sent to the following destination. destination hosts { file("/var/adm/logs/$HOST/$YEAR/$MONTH/$DAY_$FACILITY"); }; I get logs like /var/logs/HOST/2003/08/kern.log instead of /var/logs/HOST/2003/08/25_kern.log like I did with version 1.4.17. The day and the underscore are missing. I am using the same conf file as 1.4.17. Any help would be greatly appreciated! I am sure I am missing something stupid. Thank you, Will ------------------------------------------------------------------- This is a PRIVATE message, intended for the designated recipient(s) only and may contain privileged or confidential information. If you have received this message in error, please notify me immediately, delete the original, and destroy any paper copies. Any other use of the email by you is prohibited. NOTE: Regardless of content, this e-mail shall not operate to bind the sender to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of e-mail for such purpose.

1 0