- syslog-ng - lists.balabit.hu

RE: [syslog-ng]Program destination never executes
by Chris Robertson 08 Aug '03

08 Aug '03

Checked that, it works fine from the command line. :( Chris -----Original Message----- From: Nate Campi [mailto:nate@campin.net] Sent: Thursday, August 07, 2003 3:33 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Program destination never executes On Thu, Aug 07, 2003 at 02:10:26PM -0700, Chris Robertson wrote: > I hoping that someone can point out what I'm doing wrong here. I have the > following configuration in my syslog-ng.conf file but the program referenced > in d_mysql_prog is never executed (I've tried a simple version that just > outputs to a file as well). Note the file gets all the messages properly > and I've cut out the non-relevant sections of the config. I don't see anything wrong here, I'd make sure the script isn't just dying as soon as it starts. -- Nate Windows is the answer, but only if the question was 'what is the intellectual equivalent of being a galley slave?' _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Program destination never executes
by Chris Robertson 08 Aug '03

08 Aug '03

I hoping that someone can point out what I'm doing wrong here. I have the following configuration in my syslog-ng.conf file but the program referenced in d_mysql_prog is never executed (I've tried a simple version that just outputs to a file as well). Note the file gets all the messages properly and I've cut out the non-relevant sections of the config. source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); }; source net { udp(ip("0.0.0.0") port(514)); }; destination d_file { file ("/tmp/syslog"); }; destination d_mysql_prog { program ("/root/syslog2.pl"); }; log { source(net);destination(d_mysql_prog); }; log { source(src);destination(d_mysql_prog); }; log { source(src);destination(d_file); }; log { source(net);destination(d_file); }; Thanks, Chris

2 1

RE: [syslog-ng]2 quick (i hope!) libol questions
by Clemson, Chris 07 Aug '03

07 Aug '03

ah, ok, thanks! > -----Original Message----- > From: Balazs Scheidler [mailto:bazsi@balabit.hu] > Sent: 07 August 2003 11:19 > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]2 quick (i hope!) libol questions > > > On Thu, Aug 07, 2003 at 11:13:16AM +0100, Clemson, Chris wrote: > > I'm just about to upgrade to syslog-ng to try and see if it > stops the > > problem with dropping stats that we are having at the moment. > > > > in the docs it mentions that i need libol 0.3.x, which i am about to > > compile. > > however, searching on my system, i cant see any version of > libol, even > > though v1.2 of syslog-ng seems to need 0.2.8. > > > > My questions are, what does libol actually do, and why > wouldn't my machine > > already have a copy of it somewhere? > > libol is compiled into syslog-ng statically (by default), > therefore there's > no shared lib in the system. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD > 804E C82C 8EB1 > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

1 0

2 quick (i hope!) libol questions
by Clemson, Chris 07 Aug '03

07 Aug '03

I'm just about to upgrade to syslog-ng to try and see if it stops the problem with dropping stats that we are having at the moment. in the docs it mentions that i need libol 0.3.x, which i am about to compile. however, searching on my system, i cant see any version of libol, even though v1.2 of syslog-ng seems to need 0.2.8. My questions are, what does libol actually do, and why wouldn't my machine already have a copy of it somewhere? thanks! chris -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

2 1

RE: [syslog-ng]Redhat 7.2, syslog-ng 1.6 and logger, and no loggi ng
by Weidner, Erich 04 Aug '03

04 Aug '03

Just a typo, I can't seem to paste into cxoffice running IE (outlook web <sigh>). But I'm getting farther. In spite of the fact that "which syslog-ng" returned /usr/local/sbin/syslog-ng" which when I executed with "-V" reported as version 6rc3, I just noticed the start stop entries in the log file was still version stamped 1.5(somthing). Somehow the redhat init script is calling the wrong one, but I deleted the old one from whereever else it was, then I found that it was failing to start due to looking for it's config file in /usr/local/etc/sysconfig-ng/ not in /etc/sysconfig-ng/ I found the switch for the configure file reconfigured and recompiled and now it's working! The man page indicates that w/o the -f param it looks in /etc/syslog-ng, but if that was the intent, shouldn't hte configure script be changed to actually reflect this? Anyway thanks for the help! -Erich -----Original Message----- From: Hamilton Andrew To: syslog-ng(a)lists.balabit.hu Sent: 8/4/03 2:04 PM Subject: RE: [syslog-ng]Redhat 7.2, syslog-ng 1.6 and logger, and no logging It may be a typo on the message but your filter line says f_fileter2 and your log line says f_filter2. Could this be your problem? Regards -----Original Message----- From: Weidner, Erich [mailto:eweidner@ciber.com] Sent: Monday, August 04, 2003 3:56 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]Redhat 7.2, syslog-ng 1.6 and logger, and no logging I'm unable to get messages into /var/log/messages with logger. I've compiled and installed syslog-ng 1.6rc3, I've the following config. (modified the contrib/syslong-ng.conf.Redhat) config file. Relavent lies of it are: source s_sys { pipe ("proc/kmsg" log_prefix"kernel: ")); unix-dgram ("/dev/log"); internal(); }; filter f_fileter2 { level(info .. emerg) and not (facility(mail) or facility(authpriv) or facility(cron)); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; I've tried the following: logger -p daemon.crit "Testing, Hello?" and various others such as user.crit user.warn, etc. Nothing. Syslog-ng does however log the fact that it starts and stops (at least after I edited the default filter to be (info .. emerg) instead of just (info) I also see a few entries for STATS: dropped 0. Help! -Erich

1 0

RE: [syslog-ng]Redhat 7.2, syslog-ng 1.6 and logger, and no loggi ng
by Hamilton Andrew 04 Aug '03

04 Aug '03

It may be a typo on the message but your filter line says f_fileter2 and your log line says f_filter2. Could this be your problem? Regards -----Original Message----- From: Weidner, Erich [mailto:eweidner@ciber.com] Sent: Monday, August 04, 2003 3:56 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]Redhat 7.2, syslog-ng 1.6 and logger, and no logging I'm unable to get messages into /var/log/messages with logger. I've compiled and installed syslog-ng 1.6rc3, I've the following config. (modified the contrib/syslong-ng.conf.Redhat) config file. Relavent lies of it are: source s_sys { pipe ("proc/kmsg" log_prefix"kernel: ")); unix-dgram ("/dev/log"); internal(); }; filter f_fileter2 { level(info .. emerg) and not (facility(mail) or facility(authpriv) or facility(cron)); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; I've tried the following: logger -p daemon.crit "Testing, Hello?" and various others such as user.crit user.warn, etc. Nothing. Syslog-ng does however log the fact that it starts and stops (at least after I edited the default filter to be (info .. emerg) instead of just (info) I also see a few entries for STATS: dropped 0. Help! -Erich

1 0

Redhat 7.2, syslog-ng 1.6 and logger, and no logging
by Weidner, Erich 04 Aug '03

04 Aug '03

I'm unable to get messages into /var/log/messages with logger. I've compiled and installed syslog-ng 1.6rc3, I've the following config. (modified the contrib/syslong-ng.conf.Redhat) config file. Relavent lies of it are: source s_sys { pipe ("proc/kmsg" log_prefix"kernel: ")); unix-dgram ("/dev/log"); internal(); }; filter f_fileter2 { level(info .. emerg) and not (facility(mail) or facility(authpriv) or facility(cron)); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; I've tried the following: logger -p daemon.crit "Testing, Hello?" and various others such as user.crit user.warn, etc. Nothing. Syslog-ng does however log the fact that it starts and stops (at least after I edited the default filter to be (info .. emerg) instead of just (info) I also see a few entries for STATS: dropped 0. Help! -Erich

1 0

new member
by Ravi shetkar 02 Aug '03

02 Aug '03

Hi My name is Shetkar Ravi and AS i am new to syslog-ng I am interested to become a new syslog-ng member to learn more about syslog-ng. I am currently working on logging server project. I searched the web and found lot of good things and recommendations about the syslog-ng and decided install and test in my solaris/HP/Aix environment. I down loaded libol-0.3.9 and syslog-ng-1.6.0rc3 and installed and compiled on solaris 8 server. I added /etc/syslog-ng/syslog-ng.conf file and modified the /etc/init.d/syslog file, but when try to start the syslog-ng (/etc/init.d/syslog start) it giving me following error on the console.. io.c: bind_inet_socket() bind failed 0.0.0.0:514 Address already in use Need your help and suggestion for syslog-ng configuration...to make it work on my syslog -ng centralize logging server. Do i need to install syslog-ng on all the clients also or the default syslog will work.? and then what will be the syslog.conf file on clients. Follwing are my configuration files.. /etc/syslog-ng/syslog-ng.conf file.. # more syslog-ng.conf # # Syslog-ng example configuration file for Solaris # #use_fqdn() add FQDN instead of short hostname #use_dns() use DNS (may cause DOS) #sync() number of lines buffered before written to file #log_fifo_size() number of lines fitting to the output queue # #options { use_fqdn(no); # keep_hostname(yes); # use_dns(no); # long_hostnames(off); # sync(0); # log_fifo_size(1000); }; options { sync(0); keep_hostname(yes); chain_hostnames(no); log_fifo_size(30000); }; source s_local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source s_net_udp { udp(); }; destination d_local { file("/logs/messages"); }; log { source(s_local); source(s_net_udp); destination(d_local); }; # # local and network sources # # + will accept udp/tcp connections on port 514 from any host # + keepalive option is for tcp only and will keep connection open # when the SIGHUP signal is seen # #source s_stream { sun-streams("/dev/log" door("/etc/.syslog_door"); }; #source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal();}; #source network { udp(); tcp(); }; #source s_tcp { tcp(ip(127.0.0.1) port(19990) max-connections(10)); }; #Source s_udp { udp(); }; # # standard destinations for local standard system messages # destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination kern { file("/var/log/kern.log"); }; destination maillog { file("/var/log/maillog"); }; # # special log destinations for our remote hosts # (pixlog, switchlog) and for our IP Filter firewall (ipflog) # #destination ipflog { file("/var/log/ipf.log"); }; #destination pixlog { file("/var/log/pix.log"); }; #destination switchlog { file("/var/log/switch.log"); }; # # Some log files used to catch remaining messages # destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; # # console destination # destination console { file("/dev/sysmsg"); }; # # filters for standard local system messages which come # in on non-local facilities # filter f_authpriv { facility(auth) ; }; filter f_syslog { not facility(auth) and not facility(mail); }; filter f_kern { facility(kern); }; filter f_mail { facility(mail); }; # # filters for IPFilter and the Cisco equipment # #filter f_ipf { facility(local0); }; #filter f_pix { facility(local4); }; #filter f_switch { facility(local6, local7); }; # # catch the rest # filter f_debug { not facility(kern, auth, mail, local6, local7, local4, local0); }; filter f_messages { level(info .. warn) and not facility(auth, mail, local0, local4 , local6, local7); }; # # filters for various emergency level messages # filter f_emergency { level(emerg); }; # # log emergency level messages out to console # log { source(local); filter(f_emergency); destination(console); }; # # log messages from local machine # log { source(local); filter(f_authpriv); destination(authlog); }; log { source(local); filter(f_syslog); destination(syslog); }; log { source(local); filter(f_kern); destination(kern); }; log { source(local); filter(f_mail); destination(maillog); }; # # log IP Filter messages to the ipf.log # #log { source(local); filter(f_ipf); destination(ipflog); }; # # log switch and pix messages # #log { source(network); filter(f_pix); destination(pixlog); }; #log { source(network); filter(f_switch); destination(switchlog); }; # # catch the rest of the messages # log { source(local); source(network); filter(f_debug); destination(debug); }; log { source(local); source(network); filter(f_messages); destination(messages); }; # # Automatic sorting of host messages by $HOST and $YEAR$MONTH$DAY # # + will automatically create a directory structure for all messages # sorted first by host, then by date, then by facility. # + with use_dns(no) we will have files based on ip address not hostname # destination hosts { file("/var/log/HOSTS/$HOST/$YEAR$MONTH$DAY/$FACILITY" owner(roo t) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; # # logs all incoming messages from network source to the sorted # destination # log { source(network); destination(hosts); }; My /etc/init.d/syslog file is # more syslog #!/sbin/sh # # script to start syslog-ng on boot up for a Solaris machine. # This script replaces /etc/init.d/syslog on a Solaris machine. # case "$1" in 'start') if [ -f /etc/syslog-ng.conf -a -f /usr/local/sbin/syslog-ng ]; then echo 'syslog-ng service starting.' # # Before syslogd starts, save any messages from previous # crash dumps so that messages appear in chronological order. # /usr/bin/savecore -m if [ -r /etc/dumpadm.conf ]; then . /etc/dumpadm.conf [ "x$DUMPADM_DEVICE" != xswap ] && \ /usr/bin/savecore -m -f $DUMPADM_DEVICE fi if [ ! -f /var/adm/messages ]; then /usr/bin/cp /dev/null /var/adm/messages /usr/bin/chmod 0644 /var/adm/messages fi /usr/local/sbin/syslog-ng >/dev/msglog 2>&1 & fi ;; 'stop') echo 'syslog-ng service stopping.' if [ -f /var/run/syslog-ng.pid ]; then syspid=`/usr/bin/cat /var/run/syslog-ng.pid` [ "$syspid" -gt 0 ] && kill -15 $syspid fi ;; *) echo "Usage: $0 { start | stop }" exit 1 ;; esac my daemon is in /usr/loca/sbin/syslog-ng thanks for your help. Shetkar Ravi Unix systel Administrator. WebMD rshetkar(a)webmd.net rshetkar88(a)yahoo.com --------------------------------- Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software

1 0

Enterasys SSR syslog message date format patch fix
by Rule, Ted 31 Jul '03

31 Jul '03

As previously posted, my old v 1.5 syslog-ng daemon had a little problem with SSR syslog messages which incorrectly use "MMM 0D" format instead of "MMM D" format for days 1 to 9 of each month, against RFC3164's strictures, and unlike all other hosts and routers I've come across. As a fix, I first upgraded to 1.6.0rc3 latest snapshot, manually forced one of the SSR's into "tomorrow", and thereby forced a syslog message of the wrong format to be issued as per below: Jul 31 16:54:35 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (exit ) executed Jul 31 16:55:46 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (system show date ) executed Aug 01 01:01:01 fttv-e7D-ssr-sl1 %SYS-I-DATE_CHANGE, The system's date has been changed to: 2003-08-01 01:01:01 Aug 01 01:01:07 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (system show date ) executed Aug 01 01:01:33 fttv-e7D-ssr-sl1 %CONFIG-W-NOTSAVED, Changes made to the running system are not saved to Startup Aug 01 01:01:36 fttv-e7D-ssr-sl1 %SYS-A-CLI_MODE_CHANGE, CLI mode changed to (guest). Aug 01 01:01:36 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (logout ) executed Which goes to prove that even v1.6 code still 'fails' to auto-correct the broken date-stamp. The patch fix below corrects the problem in src/log.c - simply patch log.c and touch log.c.x and remake the syslog-ng binary. [user@host syslog-ng]$ pwd /usr/src/patches/syslog-ng [user@host syslog-ng]$ diff -u log.c-1.6.0rc3.orig log.c-1.6.0rc3.patched --- log.c-1.6.0rc3.orig Tue Jul 29 09:36:59 2003 +++ log.c-1.6.0rc3.patched Tue Jul 29 10:05:44 2003 @@ -108,6 +108,22 @@ src[9] == ':' && src[12] == ':') { /* Expected buffer format: MMM DD HH:MM:SS ... */ + /* Catcher for violation of RFC3164 para 4.1.2: + "If the day of the month is less than 10, then it MUST + be represented as a space and then the number. + For example, the 7th day of August would be represented + as "Aug 7", with two spaces between the "g" and + the "7"." + + Enterasys Expedition Routers are known to violate + this clause. + + Ted_Rule(a)flextech.co.uk: 29/07/2003 */ + if ( src[4] == '0' && isdigit(src[5]) && + isdigit(src[7]) && isdigit(src[8]) ) { + src[4] = ' '; + } + /* Just read the buffer data into a textual datestamp. */ lm->date = c_format_cstring("%s", 15, src); [user@host syslog-ng]$ Which resulted in the correct format messages appearing in the actual syslog files, after which time, I flipped the router back to "today" and re-enabled NTP. Jul 31 16:54:35 fttv-e7D-ssr-sl1 %SYS-A-CLI_MODE_CHANGE, CLI mode changed to (enabled). Jul 31 16:54:35 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (exit ) executed Jul 31 16:55:46 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (system show date ) executed Aug 01 01:01:01 fttv-e7D-ssr-sl1 %SYS-I-DATE_CHANGE, The system's date has been changed to: 2003-08-01 01:01:01 Aug 01 01:01:07 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (system show date ) executed Aug 01 01:01:33 fttv-e7D-ssr-sl1 %CONFIG-W-NOTSAVED, Changes made to the running system are not saved to Startup Aug 01 01:01:36 fttv-e7D-ssr-sl1 %SYS-A-CLI_MODE_CHANGE, CLI mode changed to (guest). Aug 01 01:01:36 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (logout ) executed Aug 1 01:10:22 fttv-e7D-ssr-sl1 %SYS-A-CLI_MODE_CHANGE, CLI mode changed to (guest). Aug 1 01:10:22 fttv-e7D-ssr-sl1 %TELNETD-A-LOGIN, Telnet user login Aug 1 01:10:24 fttv-e7D-ssr-sl1 %SYS-A-CLI_MODE_CHANGE, CLI mode changed to (enabled). Aug 1 01:10:24 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (en ) executed Jul 31 17:08:00 fttv-e7D-ssr-sl1 %SYS-I-DATE_CHANGE, The system's date has been changed to: 2003-07-31 17:08:00 Jul 31 17:08:05 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (system show date ) executed Jul 31 17:08:23 fttv-e7D-ssr-sl1 %SYS-A-CLI_MODE_CHANGE, CLI mode changed to (guest). Jul 31 17:08:23 fttv-e7D-ssr-sl1 %CLI-A-COMMAND_EXEC, CLI command (logout ) executed I believe the reason that the date parsing of the original message fails to auto-correct the problem is that the write of msg->date to msg->line in src/affile.c/do_handle_dest__writer() uses the original 15 byte raw date string, rather than rebuild a date string on the fly from the tm struct which is parsed by log.c: static void do_handle_dest_writer(struct log_handler *c, struct log_info *msg) { CAST(affile_dest_writer, self, c); if (self->dest) { struct ol_string *msg_line; if (self->owner->template_output) { msg_line = expand_macros( self->owner->cfg, self->owner->template_output, self->owner->template_escape, msg); } else { msg_line = c_format("%S %S %S\n", msg->date, msg->host, msg->msg); } A_WRITE_STRING(&self->dest->buffer->super, msg_line); if (self->reap) io_callout_set_timeout(self->reap, self->time_reap); } log_info_free(msg); } Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

Remote log receive
by MiikaT 30 Jul '03

30 Jul '03

Hi, I'm new to syslog-ng and was wondering if following scenario is possible with it. I'm sending log from remote device to syslog-ng with these facilities: local0.info local1.info local2.info Can I make all logs go into one separate log file based on the source ip, or all three log facilities to different files also based on the source ip? I tried to implement the sample configurations, with no luck so far. -MiikaT ------------------------------------------------- This mail sent through IMP: http://horde.org/imp/

2 2