- syslog-ng - lists.balabit.hu

Destination driver and variables
by Casimir Leonard 16 Mar '03

16 Mar '03

Hello, For begining, for me syslog-ng is the best syslog dameon. I have a question about a option for the destination driver. It's possible to have the variable HOST (equal at the dns name) but i would like to know if it's possible to have in 2 different variables the dns name and the IP address of the transmitter. (ex : HOST=www.balabit.com and IP=212.92.18.33) Thank's in advance for the response. Bye Damien FONTAINE - France --------------------------------- Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! Testez le nouveau Yahoo! Mail

1 0

How to disable logging to the console?
by Alexander von Hedenstroem 16 Mar '03

16 Mar '03

Hello! I am using syslog-ng 1.5.15 for a couple of days now on my Debian (woody/stable) system, but have some problems configuring it properly. I switched to syslog-ng because I've read that it is able to filter messages. I'd like to use it to filter the iptables stuff away from my console. Fortunately, I'm not the first with this problem, so I found some help in the archives and in newsgroups, leading me to the following setup: First, I modified the standard source for reading kernel messages (I tried this with file instead of pipe, too -- which one is preferred?): source src { unix-dgram("/dev/log"); pipe("/proc/kmsg"); internal(); }; Then I added some filters and destinations; f_netfilter recognizes iptables stuff by a custom log-prefix, while netfilter2 looks for common strings a message (i tried this because there are some log messages from iptables which seem not to be produced by my iptables script, however...): destination netfilter { file("/var/log/netfilter.log" owner("root") group("adm") perm(0640)); }; filter f_netfilter { match("netfilter: "); }; filter f_netfilter2 { match(".* (IN|OUT|SRC|DST|LEN|MAC|PROTO|WINDOW|TTL|TOS)=.*"); }; filter f_apic { match("APIC error on CPU"); }; Finally, I added some log paths: log { source(src); filter(f_netfilter); destination(netfilter); flags(final); }; log { source(src); filter(f_netfilter2); destination(netfilter); flags(final); }; log { source(src); filter(f_apic); destination(kern); flags(final); }; (My syslog-ng.conf lists first the sources, then destinations, filters, and finally logs. It's not mixed. I understood it this way that the order is only important for log statements. I hope this is correct.) After a reboot (I had problems with restarting it), there are messages directed to the netfilter log, and the messages log is kept clean too, but my console is still flooded! I commented out ALL the log paths of syslog-ng.conf and rebootet which results in empty log files but still console logging. Then I tried klogd -c 0 (which should stop klogd from logging to the console if it is not extremely important) as well as stopping klogd completely which has no visible effect either. So here's my question: Where are those console messages from? Is it possible to log them through syslog-ng and finally stop logging to the console? I really tried to help myself, so please excuse if this question was asked earlier -- I didn't found it! Thanks for your help!!! Alexander von Hedenstroem.

4 4

Re: syslog-ng
by garvald＠bluemail.ch 13 Mar '03

13 Mar '03

> >You might have noticed that I still had trouble believing that the >packets are making it to the loghost, despite your 'netstat -a'. Just >run 'netstat -t' on linux to see the TCP connections and see if you see >the other box actually connected. Try the telnet test that I mentioned >in the earlier post. Cover the lower layers of the stack before you >concentrate on the app layer. That was exactly my problem, there were no packages going anywhere, neither locally or remote. However if syslog-ng is runnin smoothly on the linux side of things, I assume tcp-wrappers has been installed and configured correctly. If the hosts.allow entry is correct then there's no reason it shouldnt accept the logs Anyway, I have now solved the problem. I tried installing 1.6.0rc1 (on solaris) however it wouldnt accept the fact that libol-0.3.9 really was that version. So I tried 1.5.26 and it runs smoothly, which 1.5.25 never did. next thing was on the linux side, I had to downgrade from a _very_ buggy 1.6.0_rc1-r1 syslog-ng gentoo release to (a still unstable) 1.5.26-r1. Now things seems to be working the way they should...logging locally and remotely seems to be working. Syslog-ng = a very touchy, senstive, but capable logger (once its runnin) cheers -AlanCB

2 1

Spec files...
by Blaise St-Laurent 13 Mar '03

13 Mar '03

I've been talking to Robert, and we were wondering if the spec file and associated files he created could be in the main distribution of syslog-ng. If there's any work that needs to be done (such as creating a patch file for it all) please let me know, and i'll get it done. BTW Any news on a new rc of syslog-ng?

2 1

syslog-ng 1.4.17 on Solaris 8
by enelson＠FLEETCC.COM 13 Mar '03

13 Mar '03

Hi all, I am having a problem with syslog-ng 1.4.17 on solaris 8. When I start syslog-ng I get parse errors at my firs "log" statement. Here is a shortened syslog-ng.conf file I'm using. All destination files are created and owned by root. Like I said, it dies at that first log statement (or any log statement) with a "Parse error at line (line number), Parse error reading configuration file, exiting. I have checked this over and over again, I'm just not seeing it. Thanks in advance for any information! Oh, I know I should upgrade to the 1.5.x tree, I am fighting that battle with our software maintainter now, I asked for "latest stable" and got 1.4.17. Eric Nelson enelson(a)fleetcc.com -------------------- source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source network { tcp(); udp(); }; destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination kern { file("/var/log/kern.log"); }; destination maillog { file("/var/log/maillog"); }; destination console { file("/dev/sysmesg"); }; destination switch { file("/data/logs/switch.log"); }; destination test { file("/data/logs/test.log"); }; destination debug { file("/var/log/debug"); }; destination messages { file("var/log/messages"); }; filter f_authpriv { facility(auth); }; filter f_syslog { not facility(auth) and not facility(mail); }; filter f_kern { facility(kern); }; filter f_mail { facility(mail); }; filter f_switch { facility(local6, local7); }; filter f_debug { not facility(kern, auth, mail, local6, local7, local4, local0); }; filter f_messages { level(info .. warn) and not facility(kern, auth, mail, local6, local7, local4, local0); } log { source(local); filter(f_authpriv); destination(authlog); };

2 1

Macro question
by McNutt, Justin M. 12 Mar '03

12 Mar '03

Hey all, I'm new to the list, and fairly new to syslog-ng, so I hope I'm not asking a VFAQ (although a perusal of the documentation and the mailing list archives suggests that I'm not, so here goes). I have a server (dnps-linux2) that is set up as an SNMP trap receiver (Net-SNMP 5.0.3). Traps are then reformatted and sent to the local host's syslog service (via logger(2), I think). They arrive using facility local0. This part works. The part that sucks is that the IP address of the original trap sender is embedded in the $MSG portion of the entry. Here's an example: Mar 12 15:33:47 dnps-linux2 snmptrapd[797]: 128.206.169.240: Enterprise Specific Trap (blah blah blah) I'm trying to set up a destination that will split these up by sender, but $HOST always returns "dnps-linux2". $PROGRAM will return snmptrapd. I need to do something like this: source s_sys { (all the usual sources) }; filter f_snmptrap { facility(local0) and program(snmptrapd); }; destination d_snmptrap { file("/usr/log/traps/$SENDER/$YEAR.$MONTH.$DAY.traps"); }; log { source(s_sys); filter(f_snmptrap); destination(d_snmptrap); }; In the examples above, $SENDER should resolve to "128.206.169.240", perhaps by somehow matching $MSG against "^(\d+\.\d+\.\d+\.\d+):". Is this possible in any version of syslog-ng? I'm currently running 1.5.25 (on RedHat 7.3), but I don't have any qualms about upgrading if I can get this function (which I assume would go in the filter{} clause?). Any help is appreciated. Thanks! Justin McNutt Network Systems Analyst DNPS, Mizzou Telecom (573) 882-5183 In personal conversations with technical people, I call myself a hacker. But when I'm talking to journalists I just say "programmer" or something like that. -- Linus Torvalds

1 0

RE: [syslog-ng]syslog-ng 1.4.17 on Solaris 8
by Hamilton, Andrew 12 Mar '03

12 Mar '03

You are missing a semicolon on the last filter statement at the end. -----Original Message----- From: enelson(a)FLEETCC.COM [mailto:enelson@FLEETCC.COM] Sent: Wednesday, March 12, 2003 2:54 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng 1.4.17 on Solaris 8 Hi all, I am having a problem with syslog-ng 1.4.17 on solaris 8. When I start syslog-ng I get parse errors at my firs "log" statement. Here is a shortened syslog-ng.conf file I'm using. All destination files are created and owned by root. Like I said, it dies at that first log statement (or any log statement) with a "Parse error at line (line number), Parse error reading configuration file, exiting. I have checked this over and over again, I'm just not seeing it. Thanks in advance for any information! Oh, I know I should upgrade to the 1.5.x tree, I am fighting that battle with our software maintainter now, I asked for "latest stable" and got 1.4.17. Eric Nelson enelson(a)fleetcc.com -------------------- source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source network { tcp(); udp(); }; destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination kern { file("/var/log/kern.log"); }; destination maillog { file("/var/log/maillog"); }; destination console { file("/dev/sysmesg"); }; destination switch { file("/data/logs/switch.log"); }; destination test { file("/data/logs/test.log"); }; destination debug { file("/var/log/debug"); }; destination messages { file("var/log/messages"); }; filter f_authpriv { facility(auth); }; filter f_syslog { not facility(auth) and not facility(mail); }; filter f_kern { facility(kern); }; filter f_mail { facility(mail); }; filter f_switch { facility(local6, local7); }; filter f_debug { not facility(kern, auth, mail, local6, local7, local4, local0); }; filter f_messages { level(info .. warn) and not facility(kern, auth, mail, local6, local7, local4, local0); } log { source(local); filter(f_authpriv); destination(authlog); }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Who can help a newbie?
by Martijn Koopsen 12 Mar '03

12 Mar '03

All, As a relative newbie in the world syslog-ng i tried a few things. I am able to split all the information that comes into the logging-server into seperate files. Now i would like to change the config in a way that when a specific message comes in it is written to a file but at the same time triggers a shell script that starts running. Who can help me with this? Regards, Martijn Koopsen

2 1

solaris linux
by garvald＠bluemail.ch 12 Mar '03

12 Mar '03

Hi all trying to log from solaris 8 to Linux (gentoo). I'm using 1.5.26 on the linux side and 1.5.25 on the solaris. I've tried several linux versions ranging from 1.4x to current with no luck. Logging from linux -> linux is no problem. I've tried googling and newsgroups etc and writing mails but nobody can help. If nobody replies to this i'll be switching to another logger ;c] here's the configuration I'm using, its very basic and according to an earlier post from the "maintainer" it should work: solaris: source s_all { sun-stream("/dev/log" door("/etc/.syslog_door")); internal(); }; destination d_tcp { tcp("1.2.3.4"); }; log { source(s_all); destination(d_tcp); }; linux: source s_all { internal(); unix-stream("/dev/log"); tcp(); }; destination d_messages { file("/var/log/HOSTS/$HOST/$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(s_all); destination(d_messages); }; ## why is nothing logged from the solaris box ? ##

2 2

Re: [syslog-ng]Syslog-ng 1.6.0rc1 and AIX 4.3.3
by EDL.Essed＠belastingdienst.nl 12 Mar '03

12 Mar '03

To make my own describtion a bit less criptic: In the file configure I changed these 3 lines: LIBOL_MAJOR=`echo $LIBOL_VERSION | sed -e 's/^$[0-9]\+$\.[0-9]\+\.[0-9] \+$+[0-9]*$\?$/\1/'` LIBOL_MINOR=`echo $LIBOL_VERSION | sed -e 's/^[0-9]\+\.$[0-9]\+$\.[0-9] \+$+[0-9]*$\?$/\1/'` LIBOL_PATCH=`echo $LIBOL_VERSION | sed -e 's/^[0-9]\+\.[0-9]\+\.$[0-9]\+$ $+[0-9]*$\?$/\1/'` to these lines: LIBOL_MAJOR=`echo $LIBOL_VERSION | sed -e 's/$[0-9]*$\.[0-9]*\.[0-9] */\1/'` LIBOL_MINOR=`echo $LIBOL_VERSION | sed -e 's/[0-9]*\.$[0-9]*$\.[0-9] */\1/'` LIBOL_PATCH=`echo $LIBOL_VERSION | sed -e 's/[0-9]*\.[0-9]*\.$[0-9] *$/\1/'` and run configure again. ___________________________________________ Esteban Essed B/CICT, Sector Continuiteit MPS/Midrange WBC-G2.36 Tel: (055 - 528) 3586 ___________________________________________ wok, n.: Something to thwow at a wabbit. ___________________________________________ |---------+--------------------------------> | | robertmg(a)WellsFargo.C| | | OM | | | Verzonden door: | | | syslog-ng-admin@lists| | | .balabit.hu | | | | | | | | | 12-03-2003 01:05 | | | Antwoord a.u.b. aan | | | syslog-ng | | | | |---------+--------------------------------> >-------------------------------------------------------------------------------------------------------------------------------| | Aan: syslog-ng(a)lists.balabit.hu | | cc: | |Onderwerp: RE: [syslog-ng]Syslog-ng 1.6.0rc1 and AIX 4.3.3 | >-------------------------------------------------------------------------------------------------------------------------------| From: Gehring, Andrew x66132 >I'm trying to compiling 1.60rc1 on AIX 4.3.3 >I've tried both gcc-2.95 and gcc-3.2 both with make-3.80 >Not matter what I've tried it always fails to find libol 0.3.9 which I've >successfully compiled and installed in /usr/local >as a note I successfully compiled 1.5.26 on the same box, and it found libol-0.3.9 >all by itself... :-) <from_archive> > From: EDL.Essed(a)belastingdienst.nl > Sent: Monday, February 24, 2003 2:33 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]syslog-ng 1.6.0rc1 available > > > > Hi, > > I'm having problems building, checking for libol fails. > > ./configure --with-libol=/home/essee05/logging/src/libol-0.3.9 > checking libol version >= 0.3.9... no > configure: error: Required libol version not found > > Looking at configure.in, I see the sed part has changed. > Changing it back > to the 3 lines from 1.5.26 makes it work again. <snip> </from_archive> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ------------------------------------------------------------------------------ De Belastingdienst gebruikt e-mail niet voor officiele mededelingen. ==============================================================================

1 0