- syslog-ng - lists.balabit.hu

RE: [syslog-ng]Can't find syslog-ng
by Jan-Peter Koopmann 01 Apr '03

01 Apr '03

Hi Paul, > I assume you mean Red Hat Linux 8 here. No. FreeBSD and we are talking about /usr/local/etc/syslog-ng/syslog-ng.conf which is the correct file. > Hope this helps... Unfortunately not... :-) Regards, JP

1 0

RE: [syslog-ng]Can't find syslog-ng
by Paul Mansmann 01 Apr '03

01 Apr '03

I assume you mean Red Hat Linux 8 here. On Red Hat Linux 8, this directory and file will be created in the /usr/local/etc directory. The easiest way to work around this little quirk is to create the directory /etc/syslog-ng and then make a link for syslog-ng.conf within that directory to the one under /usr/local/etc/syslog-ng. That way you don't spend an hour and a half editing the file under /etc/syslog-ng and pulling half your hair trying to figure out why it's not working right before remembering your editing the .conf file in the wrong location. Voice of experience here. :) Hope this helps... Paul -----Original Message----- From: Nica Smith [mailto:wanderlust27@lycos.com] Sent: Monday, March 31, 2003 6:06 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Can't find syslog-ng hi, i just installed syslog-ng in linux 8. instructions said that i should see the file syslog-ng.conf in folder /etc/syslog-ng/syslog-ng.conf, but when i type locate syslog-ng, it is in my installation folder as well as my syslog-ng. did i installed it correctly? sorry, im just new with this. thanks, - wander _____________________________________________________________ Get 25MB, POP3, Spam Filtering with LYCOS MAIL PLUS for $19.95/year. http://login.mail.lycos.com/brandPage.shtml?pageId=plus&ref=lmtplus _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]Template configuration problem
by Paul Mansmann 01 Apr '03

01 Apr '03

Try this: destination test { file("test" template("$ISODATE $HOST $MSG);\n" template_escape(yes) ); }; I don't guarantee this will work. If it doesn't I recommend playing around a bit with the placement of the semicolon and parentheses. I had a similar issue with a template function I was trying to use and had to try a few different syntax variations before I could make NG happy. -paul -----Original Message----- From: Jan-Peter Koopmann [mailto:Jan-Peter.Koopmann@seceidos.de] Sent: Tuesday, April 01, 2003 6:36 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Template configuration problem Hi, I am having serious trouble with templates. This is what I have in my syslog-ng.conf destination test { file ("test" template("$ISODATE $HOST $MSG\n") template_escape(yes) ); }; I always get a parse error in the template("$ISODATE $HOST $MSG\n") line. I am running the FreeBSD port of syslog-ng version 1.6.0rc1. What is the problem? I have these options set: options { long_hostnames(on); sync(0); use_time_recvd(yes); use_dns(yes); keep_hostname(no); chain_hostnames(no); use_fqdn(yes); gc_busy_threshold(768); time_reap(12); time_reopen(10); create_dirs(yes); }; Thanks, JP _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]Can't find syslog-ng
by Paul Mansmann 01 Apr '03

01 Apr '03

I assume you mean Red Hat Linux 8 here. On Red Hat Linux 8, this directory and file will be created in the /usr/local/etc directory. The easiest way to work around this little quirk is to create the directory /etc/syslog-ng and then make a link for syslog-ng.conf within that directory to the one under /usr/local/etc/syslog-ng. That way you don't spend an hour and a half editing the file under /etc/syslog-ng and pulling half your hair trying to figure out why it's not working right before remembering your editing the .conf file in the wrong location. Voice of experience here. :) Hope this helps... Paul > hi, > > i just installed syslog-ng in linux 8. instructions said that i should > see the file syslog-ng.conf in folder /etc/syslog-ng/syslog-ng.conf, but > when i type locate syslog-ng, it is in my installation folder as well as > my syslog-ng. did i installed it correctly? sorry, im just new with this. > > thanks, > > - wander

1 0

Template configuration problem
by Jan-Peter Koopmann 01 Apr '03

01 Apr '03

Hi, I am having serious trouble with templates. This is what I have in my syslog-ng.conf destination test { file ("test" template("$ISODATE $HOST $MSG\n") template_escape(yes) ); }; I always get a parse error in the template("$ISODATE $HOST $MSG\n") line. I am running the FreeBSD port of syslog-ng version 1.6.0rc1. What is the problem? I have these options set: options { long_hostnames(on); sync(0); use_time_recvd(yes); use_dns(yes); keep_hostname(no); chain_hostnames(no); use_fqdn(yes); gc_busy_threshold(768); time_reap(12); time_reopen(10); create_dirs(yes); }; Thanks, JP

1 0

Can't find syslog-ng
by Nica Smith 01 Apr '03

01 Apr '03

hi, i just installed syslog-ng in linux 8. instructions said that i should see the file syslog-ng.conf in folder /etc/syslog-ng/syslog-ng.conf, but when i type locate syslog-ng, it is in my installation folder as well as my syslog-ng. did i installed it correctly? sorry, im just new with this. thanks, - wander _____________________________________________________________ Get 25MB, POP3, Spam Filtering with LYCOS MAIL PLUS for $19.95/year. http://login.mail.lycos.com/brandPage.shtml?pageId=plus&ref=lmtplus

1 0

syslog-ng keeps erasing my log file - I don't know why
by seberino＠spawar.navy.mil 01 Apr '03

01 Apr '03

I made a little syslog-ng.conf as follows and tried running syslog-ng. I just checked after a few days and now my /var/log/messages is wiped out. Why did syslog-ng wipe out my /var/log/messages?? Is the fault my syslog-ng.conf below?? options {chain_hostnames(off);}; source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; destination dest {file("/var/log/messages");}; log {source(src); destination(dest);}; Chris -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax: (619) 553-6521 Email: seberino(a)spawar.navy.mil _______________________________________

1 0

latest stable version of libol?
by Burv 31 Mar '03

31 Mar '03

Can someone tell me what the latest _stable_ version of libol is? I'm installing syslog-ng, and need to install libol.. __________________________________________________ Do you Yahoo!? Yahoo! Platinum - Watch CBS' NCAA March Madness, live on your desktop! http://platinum.yahoo.com

1 0

RE: [syslog-ng]$MSG into different variables?
by McNutt, Justin M. 31 Mar '03

31 Mar '03

> > Is this possible to do in syslog-ng? Or is there any other method of > > getting the values from the $MSG variable? > > > > I could of course read it from the pipe with some awk or > perl script and > > build the sql-syntax from there. But since I will have quite a few > > different table formats it would then need a perl > interpreter running for > > each table. Not very pretty IMO. > > something similar is available in 1.9.x but that is still not > ready for > production environments. > > the syntax is to use $1 .. $9 in place of $MSG[13] Excellent! We will be waiting anxiously for this. In fact... If you want a server or two to test, I think I could swing that. I have at least one machine here that runs named (hence gets a fair number of log messages) that is just a test box if you want to try it out. RedHat 7.3 (fully patched). --J

1 0

$MSG into different variables?
by m＠ervius.net 29 Mar '03

29 Mar '03

Hi, I'm trying to insert a variety of different logs into a MySql database from syslog-ng. The logs are coming from cisco routers, squid proxys, FW1 etc. and have a varying number of fields. The database tables are created with fields that match the different log formats, - src IP, dest IP, protocol etc. Since I can match the incoming logs with regexps, it is possible to be absolutely sure that a given log message will fit into a given table. What I then would like to do is to split the $MSG into its different columns (separated by whitespace) and call the corresponding destination which would look something like this: destination cisco_icmp { pipe("/tmp/icmp.pipe" template("INSERT INTO router_icmp (host, priority, date, time, program, access_list, if, type_code ) VALUES ( '$HOST', '$PRIORITY', '$YEAR-$MONTH-$DAY', $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG[6]', '$MSG[8]', '$MSG[13]' );\n") template-escape(yes)); }; Is this possible to do in syslog-ng? Or is there any other method of getting the values from the $MSG variable? I could of course read it from the pipe with some awk or perl script and build the sql-syntax from there. But since I will have quite a few different table formats it would then need a perl interpreter running for each table. Not very pretty IMO. Any suggestions? Have I missed something? Thanks! // Martin

2 1