- syslog-ng - lists.balabit.hu

syslog-ng and regex
by Micha Holzmann 10 Apr '03

10 Apr '03

Hello, i am very new at syslog-ng and at its list. I am running two Debian GNU/Linux boxes. One as a DSL Router and the other as my workstation. Today i have installed syslog-ng via apt-get (1.5.15-1.1). I tried to setup remote logging. I want my router/firewall logging additional to my workstation. On the router i have the following entries in syslog-ng.conf Hostname of router = xenia >--- cut here ---- destination loghost {udp("192.168.1.1" port(514));}; log { source(src); destination(loghost); }; >--- cut here ---- Hostname of workstation = kaliba On my workstation i have in syslog-ng.conf: >--- cut here ---- destination rlogging { file("/var/log/syslog-ng/$HOST/syslog.log" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(system) perm(0660) dir_perm(0770)); }; filter f_xenia { match("xenia"); }; log { source(src); filter(f_xenia); destination(rlogging); }; >--- cut here ---- I am not sure if this setup is correct. May you can give me some advices. If it is necessary to have my configs, please tell me, i will post them afterwards. Now i have a seceond question, on my workstation runs a cron job which looks for new antivir definition file or new program version (binary file). I tried to put the syslog entries in a separate file. Can i use regex in the match()? May like this: match("antivir\[[0-9]+\]") to catch antivir[19129] >--- cut here ---- destination antivir { file("/var/log/antivir.log"); }; filter f_antivir { match("kaliba antivir"); }; log { source(src); filter(f_antivir); destination(antivir); }; >--- cut here ---- But the logfile entries does not arrive in /var/log/antivir.log. Did i anything wrong? Best regards, Micha Holzmann -- My software never has bugs. It just develops random features.

6 14

Syslog-ng conf file options not working!!!!
by TIM MOORE 10 Apr '03

10 Apr '03

Here is what I am trying to do. We have all of our network monitoring devices logging to a central linux syslog-ng server. The files write to the log server as the day of the week (eg. 01, 02, 03). I am trying to make sure that when the month rolls over and starts writing to file 01 that they old file is blown away. I don't need logs older than one month. I can't seem to get syslog-ng to handle this on its own. I have tried two options from syslog-ng that are given in the extended sample syslog-ng conf files from the website. Neither have worked the way they said they should. First, I tried limiting the number of lines that can be written to a file. I set the log_fifo_size to (12288). The sample config says that this setting is for the number of lines that can be written to the log files. However, I have some log files that are over 1,000,000 lines. So, unless I misunderstood this option it isn't working. Second, I tried to set the option remove_if_older to (172800) or 2 days. The expanded sample config says that this option checks a file to see whether or not it is older than the number of seconds specified. If it is older then it removes the existing file and writes to a new file with the same name. This option would work perfectly, if it worked! When I put it in the config file, it barfs when trying to load syslog-ng and says it is an error. Any ideas on how to do this (without writing a script to blank out each days file at midnight). Attached is a copy of our conf file. Thanks, Tim # Syslog-ng configuration for for ODJFS-NOC Syslog # # Copyright (c) 1999 anonymous # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.sample,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. # options { #remove_if_older(172800); use_fqdn(yes); use_dns(yes); dns_cache(yes); keep_hostname(yes); long_hostnames(off); use_time_recvd(yes); #log_fifo_size=number of lines logged log_fifo_size(12288); sync(0); }; ###################################### #Source Section #source for local data source src { pipe("/proc/kmsg" log_prefix("kernel: ")); unix-stream("/dev/log"); internal(); }; #source for network devices source net { udp(); }; ##################################### #Destination Section #Standard destination destination std { file("/var/log/$HOST/$FACILITY/$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; #Forward Destination destination noc-web { udp("10.3.8.100" port(514)); }; ##################################### #log for src log { source(src); destination(std); }; #log for net log { source(net); destination(std); }; ########END OF FILE########

2 1

Include functionality - is there a way to do it?
by Klun, Jim 10 Apr '03

10 Apr '03

Here is a snippet from I question I received today: Quote: I am currently researching the following, but wanted to run it by you to make sure you weren't already aware of a solution: Does syslog-ng support 'include' type statements in the config file to make the config modular? Here is the problem. The new syslog-ng server runs on a production Solaris 8 box and portions of the syslog-ng.conf file (not the device filters) are not the same as their linux counterparts running on xxxx and yyyyy. An easy way to maintain sync on the phos and Solaris syslog-ng configs would be to simply sync the config file as a whole. For example, we might make changes on phos, then scp the file to the production Solaris box. If the config file were modular, we could break it into 2 pieces/files, 1 specific to Solaris or Linux, and 1 for all of the device filters. ? Close quote I know of no include function in syslog-ng. Is there one?

1 0

host labels with version 1.6
by Brian C. Hill 10 Apr '03

10 Apr '03

Hello, How do I make sure that syslog-ng labels an entry with the host that is came from and NOT the host that received it? None of the options, except possibly keep_hostname seem to be involved with that, and setting/unsetting that option seems to have no effect. Do I need to go back to 1.4? Thanks! Brian

2 1

RE: [syslog-ng]syslog-ng 1.6.0 insists on log files with 600 perm issions
by Hamilton, Andrew 10 Apr '03

10 Apr '03

Have you tried: destination all { file("/var/log/messages" perm(0640) ); }; This works for me on 1.6.0. Regards, Drew -----Original Message----- From: nate [mailto:syslog-ng@aphroland.org] Sent: Tuesday, April 08, 2003 4:08 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng 1.6.0 insists on log files with 600 permissions I upgraded to freebsd 4.8 from 4.7 last week and portupgrade reported it upgraded syslog-ng from syslog-ng-1.4.17 to syslog-ng-1.6.0.r1 and libol-0.2.23 to libol-0.3.9 (libol is required by syslog-ng) and while syslog-ng is working I cannot get it to store files that are group readable. In the past this has been no problem, but now syslog-ng seems to insist upon permissions of 600. I even went sofar as to set a umask of 137, in the syslog-ng init script, which sets permissions on newly created files to 640, but that seems to have no effect, syslog-ng randomly(?) changes permissions back to 600 even after I set them to 640 myself. I have logrotate run weekly and create files that are 640: /var/log-ng/* { create 0640 root wheel notifempty errors my(a)email.address rotate 26 weekly compress delaycompress olddir /var/log-ng/archive missingok } but syslog-ng again changes it back to 600. driving me crazy :) I don't see anything in the syslog-ng manpage that can set file permissions..so I'm at a loss! I have been running syslog-ng on freebsd 4.7 with no problems since about september 2002. anyone else experience this? thanks nate _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

Filters not working (as expected)
by Harry Hoffman 10 Apr '03

10 Apr '03

Hi All, We've got a linux client running syslog-ng 1.6 sending to a linux server running syslog-ng 1.5.17 For the client I have taken the example redhat conf file and added the following to it: destination loghost { tcp("myloghost.fq.dn" port(514)); }; filter f_filter9 { level(notice); }; log { source(s_sys); filter(f_filter9); destination(loghost); }; If I use logger to test I see the message come thru: logger -p kern.notice -t WARNING "This is a KERNEL test warning" However, if I do: logger -p kern.emerg -t WARNING "This is a KERNEL test warning" Nothing comes thru. Do I need to specify multiple prioity levels? I want anything of notice or higher to be sent to the syslog server. Any help is greatly appreciated. TIA, Harry -- Harry Hoffman ITSS Systems Team Leader University of Auckland hhoffman(a)auckland.ac.nz hhoffman(a)ip-solutions.net STANDARD DISCLAIMER: ********************************************** *This universe shipped by weight, not volume.* *Some expansion may have occured in shipping.* ********************************************* ------------------------------------------------- This mail sent through IpSolutions: http://www.ip-solutions.net/

2 2

New to syslog-ng
by Annie Chaiyakul 10 Apr '03

10 Apr '03

I am trying to setup a syslog-ng server running on redhat 7.3, Can my clients still run old syslogd?

2 1

RE: [syslog-ng]New to syslog-ng
by Dennis, Richard 10 Apr '03

10 Apr '03

Yes. Your syslog-ng server will be your central syslog server. There's a good how to in a sample chapter from the Building Secure Linux Servers on www.oreilly.com --Rick -----Original Message----- From: Annie Chaiyakul [mailto:AChaiyakul@idecpharm.com] Sent: Wednesday, April 09, 2003 8:18 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]New to syslog-ng I am trying to setup a syslog-ng server running on redhat 7.3, Can my clients still run old syslogd? _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ------------------------------------------------------------------------------ This message is intended only for the personal and confidential use of the designated recipient(s) named above. If you are not the intended recipient of this message you are hereby notified that any review, dissemination, distribution or copying of this message is strictly prohibited. This communication is for information purposes only and should not be regarded as an offer to sell or as a solicitation of an offer to buy any financial product, an official confirmation of any transaction, or as an official statement of Lehman Brothers. Email transmission cannot be guaranteed to be secure or error-free. Therefore, we do not represent that this information is complete or accurate and it should not be relied upon as such. All information is subject to change without notice.

1 0

long IP entry in Sun syslog
by Brian C. Hill 09 Apr '03

09 Apr '03

I am still having the problem where remote messages to syslog-ng 1.6.0rc1 are labeled with the receiving host's name instead of the IP/hostname of the sending host. I have keep_hostname set to yes and use_dns set to no. I turned on Sun's syslogd to compare some things and noticed that entries that Sun's syslog cannot resolve are labeled with the IP address (10.10.5.13) and 2 additional 'octets' in brackets like this: Apr 9 14:28:34 [10.10.5.13.224.124] venue1258 PPTP-1 down: Remote clearing Is this related to the problem I am seeing with 1.6.0rc1? Is the sun streams device sending it an address it can't interpret? I figure one of those octets is the source port, but I don't know what the last one is... Brian

1 0

Hostname - IP Address
by Chris Paalman 09 Apr '03

09 Apr '03

I am trying to log using the IP address only, yet I get the hostname instead. I would like to be able to send the syslog from multiple machines to a central server which will then log to a database. Ultimately I would like to be able to search by IP address. I have all the pieces of this working just fine, all except the hostname problem. All of the computers report the hostname instead of the IP address, even with the following options. use_dns (no); use_fqdn (no); chain_hostnames(no); keep_hostname (yes); <- I have tried no also, to no avail. long_hostnames (off); I have tried various combinations of the above with no success. Thanks in advance for any help. Chris Paalman

1 0