- syslog-ng - lists.balabit.hu

syslog-ng throttling and event reporter
by Russell Adams 07 Jul '03

07 Jul '03

I'm using Event Reporter on my Windows servers to forward their event log to my syslog-ng server. Recently, I've switched all of my Linux syslog clients to use TCP to speak to the syslog-ng server, without any problems. I've just enabled TCP on Event Reporter, and its behaving rather unusually. I'm seeing 30+ open TCP connections from the one Windows host I've enabled TCP on, and am experiencing messages that I'm frequently hitting my max connections value of 100 open connections. Is anyone running a similar configuration and seen similar problems? I suspect that Event Reporter is using one connection per message, as silly as that sounds. Its wild to contemplate it leaving those connections open. If its not a known problem, I'll break out a sniffer to see whats going on. Russell

1 0

Performance
by omar Brihi 03 Jul '03

03 Jul '03

Hello I would like to know how many TCP connections per seconds, the syslog-ng can handle simulteanously? Did anybody can tell me from his experience? how many equipments, bandwidth taken, Mbytes? regards omar ___________________________________________________________ Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! Yahoo! Mail : http://fr.mail.yahoo.com

1 0

last message repeated?
by Chuck Berg 02 Jul '03

02 Jul '03

Is there a particular reason why syslog-ng doesn't generate "last message repeated x times" messages? It's very unfortunate to have the disk on my log server fill up because of one machine flooding the logs. For example, Solaris will send one "WARNING: /tmp: File system full, swap space limit exceeded" message for every write() that fails for that reason. It's easy to get tens of thousands of these per second.

1 0

SEC and SYSLOG-NG
by Sawall, Christopher L 01 Jul '03

01 Jul '03

I'm trying to use SEC now, instead of SWATCH. Any progress on getting things up on your website? If I manually run against a log file, it works great, but I'm trying to integrate it into syslog-ng. I saw a post where you showed the following: ####################################### destination d_sec { program("/usr/local/sbin/sec.pl -input=\"-\" -conf=/usr/local/etc/sec.conf >/var/log/sec.err 2>&1"); }; # send all logs to sec log { source(src); filter(f_not_brightmail); destination(d_sec); }; ####################################### I made up my own filter to include all facilities so as to watch for everything. But I'm not getting it to work, it never reports back. If I do a "ps -ef", I can see that syslog-ng did start up the SEC process... but no luck. Any help would be appreciated. Thanks, Chris ******************************* The information contained in this message may be privileged and/or confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. Note that any views or opinions presented in this message are solely those of the author and do not necessarily represent those of Ameren. All emails are subject to monitoring and archival. Finally, the recipient should check this message and any attachments for the presence of viruses. Ameren accepts no liability for any damage caused by any virus transmitted by this email. If you have received this in error, please notify the sender immediately by replying to the message and deleting the material from any computer. Ameren Corporation *******************************

1 0

Strange behaviour with kernel log
by Zumeo 30 Jun '03

30 Jun '03

Hi, I've downloaded latest syslog-ng and installed it on my box (Mandrake 9.0). Here is my syslog-ng.conf : ---8<--- ### Options ### options { dir_perm(0755); perm(0644); chain_hostnames(no); keep_hostname(yes); }; ### Sources ### source local { unix-stream("/dev/log"); pipe("/proc/kmsg" log_prefix("kernel: ")); udp(ip(127.0.0.1) port(514)); internal(); }; ### Destinations ### destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination kern { file("/var/log/kern.log"); }; destination user { file("/var/log/user.log"); }; destination mail { file("/var/log/mail/log"); }; destination mailinfo { file("/var/log/mail/info"); }; destination mailwarn { file("/var/log/mail/warnings"); }; destination mailerr { file("/var/log/mail/err"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; destination boot { file("/var/log/boot.log"); }; destination explanations { file("/var/log/explanations"); }; ### Filters ### filter f_auth { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_user { facility(user); }; filter f_mail { facility(mail); }; filter f_debug { not facility(auth, authpriv, mail); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail); }; filter f_info { level(info); }; filter f_warn { level(warn); }; filter f_err { level(err); }; filter f_boot { facility(local7); }; filter f_explanations { facility(local1); }; ### Logs ### log { source(local); filter(f_auth); destination(authlog); }; log { source(local); filter(f_syslog); destination(syslog); }; log { source(local); filter(f_cron); destination(cron); }; log { source(local); filter(f_daemon); destination(daemon); }; log { source(local); filter(f_kern); destination(kern); }; log { source(local); filter(f_user); destination(user); }; log { source(local); filter(f_mail); destination(mail); }; log { source(local); filter(f_mail); filter(f_info); destination mailinfo); }; log { source(local); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(local); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(local); filter(f_debug); destination(debug); }; log { source(local); filter(f_messages); destination(messages); }; log { source(local); filter(f_boot); destination(boot); }; log { source(local); filter(f_explanations); destination(explanations); }; --->8--- To try my syslog-ng.conf, I used logger : # logger -p kern.info "test kern.info 1" Then I checked kern.log and saw nothing. The "test kern.info 1" was in user.log ! Can someone explain me this strange behaviour ? --zumeo ________________________________________________________________________ This letter has been delivered unencrypted. We'd like to remind you that the full protection of e-mail correspondence is provided by S-mail encryption mechanisms if only both, Sender and Recipient use S-mail. Register at S-mail.com: http://www.s-mail.com

4 3

Error message: No source refers to internal messages,
by R Saroukhanian 30 Jun '03

30 Jun '03

Hi again! Thank you Nate and Bob for responding. I made changes which both of you pointed out. However, my error message persists. That is I am still getting " No source refers to internal messages, they will go to /dev/null unresolved reference:src Error initializing configuration, exiting." error message Now, after the recommended changes, my syslog-ng.conf file looks like this: >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> options {sync(0); }; source src { udp(10.101.54.2) port(514); internal(); }; destination telnet_d {file ("/var/log/telnetlog"); } ; log {source (src); destination (telnet_d); }; >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Specifically, - "internal();" was referenced in the syslog-ng.conf file - telnet_d was properly referenced in both destination and log... - just in case I changed source src_udp to source src...and change log to look like "log {source (src); destination (telnet_d); };"....this is because I am getting " unresolved reference:src" in the error message.. After, I made changes in the syslog-ng.conf AND rebooted the box (blame my Windows mentality) I ran syslog-ng manually from /etc and AGAIN the same error message popped up. Since, I have followed the editing recommendations from Nate Campi and Bob Lister and I am still getting the same error message I am forced to think out of the box now. Here are possible problem areas 1. SYSLOG-NG.CONF SYNTAX 2. SOMETHING WITH MY FREE BSD SET UP 3. Here is another problem area...the way I created telnetlog file in my /var/log folder is by way of running "vi telnetlog" and then exiting vi by way of "ESC...:wq!...." . This created the telnetlog file in /var/log which I CAN observe by way of l"s". The doubts I have is whether syslog-ng is able to write into thus created telnetlog file...does syslog-ng like the format of thus created telnetlog? Because, I am very new to FreeBSD I cannot be more specific in hypothesizing what is wrong with my FreeBSD...however... I managed at a certain point to pick up logs from my NT box...some entries related to the Telnet service start and stop showed up in one of my log files. At that point I had an assistance....from another person....not any more. Since then we terminated SYSLOG service entirely....and also made some changes to the ORIGINAL syslog-ng-conf file that came with the syslog-ng installation. Do you have any pointers...clues? Which other factors may be causing this error message? Here is round up of my setup: SYSLOG-NG release 1.6.0 r3 FreeBSD 4.8 box telnetlog created using vi syslog-ng is in /etc syslog-ng.conf is in /etc My original posting is below. I would greatly appreciate your suggestions. Regards, Ruben Saroukhanian MY ORIGINAL POSTING IN SYSLOG-NG MAILING LIST.... > Hello folks, >=20 > Could somebody help me with this error message I am getting when = trying to run SYSLOG-NG? >=20 > Error message: > No source refers to internal messages, they will go to /dev/null > unresolved reference:src > Error initializing configuration, exiting. >=20 > Here is my setup. >=20 > I installed syslog-ng version 1.6.0 r3 on my FreeBSD 4.8 box. >=20 > The overall plan is to collect log messages sent to by NTSyslog from a = Windows 2000 box to SYSLOG-NG on the FreeBSD 4.8 box. > For a test I have been starting and stopping a telnet service on my = Windows 2000 box to pick up these events in the telnetlog file which I = created on my FreeBSD computer. >=20 > Both syslog-ng and syslog-ng.conf file are located in /etc of the = FreeBSD box. >=20 > I am logged in as root. >=20 > syslog.conf file looks like this: >=20 > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> > options {sync(0); }; >=20 > source src_udp {udp(10.101.54.2) port(514); }; >=20 > destination telnet_d {file ("/var/log/telnetlog"); } ; >=20 > log {source (src_udp); destination (telnet_t); }; >=20 > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >=20 >=20 > I run syslog-ng manually from inside /etc and get the error message = listed above. >=20 > Does the error message I am getting relate to syntax of the = syslog-ng.conf or something else? >=20 > Should I add a filter entry ...inside log statement argument? for it = to lool like >>>>>> log {source (src_udp); filter (DEFAUILT); = destination (telnet_t); }; ??? >=20 > I am looking forward to hearing from you. >=20 > Please send a copy of your response to rex(a)piva.net. >=20 > Thank you, >=20 > Ruben Saroukhanian --__--__-- Message: 8 Date: Thu, 19 Jun 2003 22:34:13 +0100 From: Robert Lister <robl(a)linx.net> To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Need help...with SYSLOG-NG Reply-To: syslog-ng(a)lists.balabit.hu > > > > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> > > options {sync(0); }; > > > > source src_udp {udp(10.101.54.2) port(514); }; > > > > destination telnet_d {file ("/var/log/telnetlog"); } ; ----------------^^^^^^^^ > > log {source (src_udp); destination (telnet_t); }; -----------------------------------------^^^^^^^^ ... maybe it relates to that? Fix that and see what it does. Rob -- Robert Lister - London Internet Exchange - http://www.linx.net/ - tel: +44 (0)20 7645 3510 - RL786-RIPE --__--__-- Message: 9 Date: Thu, 19 Jun 2003 16:54:32 -0700 From: Nate Campi <nate(a)campin.net> To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Need help...with SYSLOG-NG Reply-To: syslog-ng(a)lists.balabit.hu On Thu, Jun 19, 2003 at 05:14:55PM -0400, R Saroukhanian wrote: > > > > Error message: > > No source refers to internal messages, they will go to /dev/null > > unresolved reference:src > > Error initializing configuration, exiting. <DEFANGED_snip> > > syslog.conf file looks like this: > > > > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> > > options {sync(0); }; > > > > source src_udp {udp(10.101.54.2) port(514); }; > > You'll need to declare the "internal" source too. See the FAQ and the links to example syslog-ng.conf files. -- Nate Campi http://www.campin.net --__--__-- Message: 10 Date: Thu, 19 Jun 2003 16:58:15 -0700 From: Nate Campi <nate(a)campin.net> To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Need help...with SYSLOG-NG Reply-To: syslog-ng(a)lists.balabit.hu On Thu, Jun 19, 2003 at 05:14:55PM -0400, R Saroukhanian wrote: > > Hello folks, > > > > Could somebody help me with this error message I am getting when trying to run SYSLOG-NG? > > > > Error message: > > No source refers to internal messages, they will go to /dev/null > > unresolved reference:src > > Error initializing configuration, exiting. > > > > Here is my setup. > > > > I installed syslog-ng version 1.6.0 r3 on my FreeBSD 4.8 box. > > > > The overall plan is to collect log messages sent to by NTSyslog from a Windows 2000 box to SYSLOG-NG on the FreeBSD 4.8 box. > > For a test I have been starting and stopping a telnet service on my Windows 2000 box to pick up these events in the telnetlog file which I created on my FreeBSD computer. > > > > Both syslog-ng and syslog-ng.conf file are located in /etc of the FreeBSD box. > > > > I am logged in as root. > > > > syslog.conf file looks like this: > > > > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> > > options {sync(0); }; > > > > source src_udp {udp(10.101.54.2) port(514); }; > > > > destination telnet_d {file ("/var/log/telnetlog"); } ; > > > > log {source (src_udp); destination (telnet_t); }; > > > > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> I didn't address the error that makes syslog-ng exit, how lame of me :( Here's what I think you want out of syslog-ng: #################################################### options { sync(0); }; source src_udp { udp(10.101.54.2) port(514); internal; }; destination telnet_d { file ("/var/log/telnetlog"); } ; log { source (src); destination (telnet_d); }; #################################################### I fixed the differing destination name, and make your source name consistent, and added the internal source. This should at least get your basic setup working. Sorry I didn't pay more attention the first time. -- Nate Campi http://www.campin.net --__--__-- Message: 11 Date: Thu, 19 Jun 2003 17:00:56 -0700 From: Nate Campi <nate(a)campin.net> To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Need help...with SYSLOG-NG Reply-To: syslog-ng(a)lists.balabit.hu On Thu, Jun 19, 2003 at 04:58:15PM -0700, Nate Campi wrote: > > source src_udp { > udp(10.101.54.2) port(514); > internal; > }; Arg, make that "internal();" I promise not to reply to myself again on this thread, no matter how bad my next mistake is ;) -- Nate Campi http://www.campin.net --__--__-- _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng End of syslog-ng Digest

2 1

IPv6 support
by Timothy Brown 27 Jun '03

27 Jun '03

Does syslog-ng support communication via IPv6? If not, will it support this in the future, or has someone written a patch? Thanks. Best regards, Tim --

1 0

Re: syslog-ng
by Michael Earls 27 Jun '03

27 Jun '03

This works, Thanks, Michael >>> bazsi(a)balabit.hu 06/27/03 05:41AM >>> On Wed, Jun 25, 2003 at 06:36:38PM -0400, Michael Earls wrote: > syslog-ng > > Is there a way to have syslog-ng write two files, ex > > > destination mailx > { > file("/var/log/mailx/mail.log" owner("root") group("adm") > perm(0640)); > file("/var/log/mailx/remote-mail.log" owner("root") > group("adm") perm(0640)); > }; > > log { source(net); destination(mailx); > } > > I am looking at having a file for mailgraph to use to create stats, > then my other file will be logged into mysql. this is definitely possible. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: syslog-ng
by Balazs Scheidler 27 Jun '03

27 Jun '03

On Wed, Jun 25, 2003 at 06:36:38PM -0400, Michael Earls wrote: > syslog-ng > > Is there a way to have syslog-ng write two files, ex > > > destination mailx > { > file("/var/log/mailx/mail.log" owner("root") group("adm") > perm(0640)); > file("/var/log/mailx/remote-mail.log" owner("root") > group("adm") perm(0640)); > }; > > log { source(net); destination(mailx); > } > > I am looking at having a file for mailgraph to use to create stats, > then my other file will be logged into mysql. this is definitely possible. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RegExp filters / match ?
by Brian Ipsen 25 Jun '03

25 Jun '03

Hi! I'm trying to mask out snmptrap from different hosts.... I've created: filter f_snmptrapd_test { program(snmptrapd) and match("snmptrapd\[[0-9]{1,5}\]: (192.168.0.230|192.168.0.231|192.168.1.230|192.168.1.231|192.168.1.232): "); }; The question is just the match() statement.... Is snmptrapd included for usage with match (since snmptrapd is the program) ? If not, how much of the message below is the string used for the regular expression with match() ? Jun 25 11:26:56 sigma snmptrapd[16138]: 192.168.1.230: Enterprise Specific Trap (1) Uptime: 121 days, 21:32:17.60, OLD-CISCO-TS-MIB::tslineSesType.1.1 = INTEGER: telnet(5), RFC1213-MIB::tcpConnState.192.168.1.230.23.192.168.1.178.43819 = INTEGER: synReceived(4), OLD-CISCO-TCP-MIB::loctcpConnElapsed.192.168.1.230.23.192.168.1.178.43819 = Wrong Type (should be Timeticks): INTEGER: 1150, OLD-CISCO-TCP-MIB::loctcpConnInBytes.192.168.1.230.23.192.168.1.178.43819 = INTEGER: 110, OLD-CISCO-TCP-MIB::loctcpConnOutBytes.192.168.1.230.23.192.168.1.178.43819 = INTEGER: 420, OLD-CISCO-TS-MIB::tsLineUser.1 = "" Or how do I mask traps from specific hosts into a seperate logfile ? Regards, /Brian

1 0