- syslog-ng - lists.balabit.hu

RE: [syslog-ng]Newbie question
by Vilmos Branyik 09 Mar '03

09 Mar '03

Dale, Thanks for the response. The configs you pointed me to are the ones that I am using. The program starts just fine but nothing from the server logs. Any other suggestions? Vilmos -----Original Message----- From: Dale B. Sorry [mailto:io@hypodermic.net] Sent: Friday, March 07, 2003 11:33 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: Re: [syslog-ng]Newbie question you got the right idea, but the log parsing/filtering is all done on the server side. some great examples can be found here: http://venus.ece.ndsu.nodak.edu/~jezerr/linux/secure-remote-logging.html#sys log-ng-config On Fri, 7 Mar 2003, Vilmos Branyik wrote: > Hello, > > I'm setting up syslog-ng for the first time. I used the Central Loghost > Mini-HOWTO. > > I followed the instructions step by step but there are no local messages > being logged to the system. I haven't tried remote logging yet. > > I have posted my config file below this message. If someone could point out > my error, I would appreciate it. > > I'm using: > > syslog-ng 1.4.15 > RedHat 7.2 > > Thanks for any help you can give me. > > > Vilmos > > ***** Configuration file ***** > > options { sync (3); > log_fifo_size (300); > long_hostnames (off); > use_dns (yes); > use_fqdn (yes); > keep_hostname (yes); > }; > > source src { unix-stream("/dev/log"); internal(); }; > source remote { tcp(ip("127.0.0.1") port(514) keep-alive(yes)); }; > > source src { unix-stream("/dev/log"); internal(); }; > > destination lpr { file("/var/log/lpr.log"); }; > destination mail { file("/var/log/mail.log"); }; > > destination messages { file("/var/log/messages"); }; > > destination console_all { file("/dev/tty8"); }; > > filter f_lpr { facility(lpr); }; > filter f_mail { facility(mail); }; > filter f_messages { level(info.emerg) and not facility(mail,lpr); }; > filter f_emergency { level(emerg); }; > > log { source(src); filter(f_lpr); destination(lpr); }; > log { source(src); filter(f_mail); destination(maillog); }; > log { source(src); filter(f_messages); destination(messages); }; > log { source(src); filter(f_emergency); destination(console); }; > > destination hosts { file("/var/log/HOSTS/$HOST/$FACILITY" owner(root) > group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; > > log { source(remote); destination(hosts); }; > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > -- Daniel Simonton Hypodermic.NET Owner/Admin _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Block syslogd
by Hong Tian 08 Mar '03

08 Mar '03

Hi, We have a log server built on RedHat 7.3. We allow some specific Unix servers (Solaris and Linux) to send the log messages to this log server remotely. My question is how to only allow the specific Unix machines to send log messages to this log server and deny all other machines sending syslog messages to this log server. Thanks, Hong

2 1

Kernel logging stops on reload
by Paul Chambers 07 Mar '03

07 Mar '03

I saw some discussion on a similar subject on the list a while back, but I don't think it dealt with this specifically. I run logrotate nightly, and it executes '/usr/bin/killall -HUP syslog-ng' after rotating the logs. After that, I get no more logging from the kernel until I manually restart syslog-ng ('service syslog-ng restart'). I realize I could ditch klogd and use syslog-ng exclusively, but I'm reluctant to drop support for kernel symbols. Any insights? Paul __________________________ Versions: syslog-ng 1.6.0rc1 (also seen with 1.5.26) klogd 1.4.1 linux kernel 2.4.18-15clx (Celestix distro, mandrake-based) killall (psmisc v19) __________________________ Here's my syslog-ng.conf. I've tried the unix-dgram statement with and without 'keep-alive(yes) max-connections(512)' just to be sure (I don't think those options apply to unix-dgram?). I'll be changing the 'logall' target to feed logsurfer, once I've got that working the way I'd like. # syslog-ng configuration file. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source sys { unix-dgram ("/dev/log" keep-alive(yes) max-connections(512)); internal(); }; source remote { udp(); }; destination auth { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination user { file("/var/log/user.log"); }; destination mesg { file("/var/log/messages"); }; destination secure { file("/var/log/secure"); }; destination mailinfo { file("/var/log/mail/info"); }; destination mailwarn { file("/var/log/mail/warnings"); }; destination mailerr { file("/var/log/mail/errors"); }; destination croninfo { file("/var/log/cron/info"); }; destination cronwarn { file("/var/log/cron/warnings"); }; destination cronerr { file("/var/log/cron/error"); }; destination kerninfo { file("/var/log/kernel/info"); }; destination kernwarn { file("/var/log/kernel/warnings"); }; destination kernerr { file("/var/log/kernel/error"); }; destination lprinfo { file("/var/log/lpr/info"); }; destination lprwarn { file("/var/log/lpr/warnings"); }; destination lprerr { file("/var/log/lpr/error"); }; destination newsinfo { file("/var/log/news/info"); }; destination newswarn { file("/var/log/news/warnings"); }; destination newserr { file("/var/log/news/error"); }; destination daemoninfo { file("/var/log/daemons/info"); }; destination daemonwarn { file("/var/log/daemons/warnings"); }; destination daemonerr { file("/var/log/daemons/errors"); }; destination spool { file("/var/log/spooler"); }; destination boot { file("/var/log/boot.log"); }; destination logall { file("/var/log/everything.log"); }; destination mailall { usertty("*"); }; # Generic filters filter f_info { level(debug,info,notice); }; filter f_warn { level(warn); }; filter f_error { level(error); }; filter f_emergency { level(emerg); }; filter f_mail { facility(mail); }; filter f_cron { facility(cron); }; filter f_kernel { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_news { facility(news); }; filter f_daemon { facility(daemon); }; # Specific filters filter f_authonly { facility(auth,authpriv); }; filter f_user { facility(user); }; # Log anything (except mail) of level info or higher # Don't log private authentication messages filter f_mesgs { level(info..warn) and not facility(mail,authpriv); }; # authpriv logging (restricted) filter f_secure { facility(authpriv); }; filter f_spool { facility(uucp) or (facility(news) and level(crit)); }; filter f_boot { facility(local7); }; filter f_syslog { not facility(auth, authpriv); }; # Log to logfiles log { source(sys); destination(logall); }; log { source(sys); filter(f_spool); destination(spool); }; log { source(sys); filter(f_boot); destination(boot); }; log { source(sys); filter(f_user); destination(user); }; log { source(sys); filter(f_secure); destination(secure); }; log { source(sys); filter(f_syslog); destination(syslog); }; log { source(sys); filter(f_mesgs); destination(mesg); }; log { source(sys); filter(f_authonly); destination(auth); }; log { source(sys); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(sys); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(sys); filter(f_mail); filter(f_error); destination(mailerr); }; log { source(sys); filter(f_cron); filter(f_info); destination(croninfo); }; log { source(sys); filter(f_cron); filter(f_warn); destination(cronwarn); }; log { source(sys); filter(f_cron); filter(f_error); destination(cronerr); }; log { source(sys); filter(f_kernel); filter(f_info); destination(kerninfo); }; log { source(sys); filter(f_kernel); filter(f_warn); destination(kernwarn); }; log { source(sys); filter(f_kernel); filter(f_error); destination(kernerr); }; log { source(sys); filter(f_lpr); filter(f_info); destination(lprinfo); }; log { source(sys); filter(f_lpr); filter(f_warn); destination(lprwarn); }; log { source(sys); filter(f_lpr); filter(f_error); destination(lprerr); }; log { source(sys); filter(f_news); filter(f_info); destination(newsinfo); }; log { source(sys); filter(f_news); filter(f_warn); destination(newswarn); }; log { source(sys); filter(f_news); filter(f_error); destination(newserr); }; log { source(sys); filter(f_daemon); filter(f_info); destination(daemoninfo); }; log { source(sys); filter(f_daemon); filter(f_warn); destination(daemonwarn); }; log { source(sys); filter(f_daemon); filter(f_error); destination(daemonerr); }; # Log to console log { source(sys); filter(f_emergency); destination(mailall); }; __________________________ Here's my logrotate.conf: # see "man logrotate" for details # rotate log files weekly weekly # keep 4 weeks worth of backlogs rotate 4 # send errors to root errors root # create new (empty) log files after rotating old ones create # uncomment this if you want your log files compressed compress # don't archive if the log is empty notifempty # RPM packages drop log rotation information into this directory include /etc/logrotate.d # no packages own wtmp -- we'll rotate it here /var/log/wtmp { monthly create 0664 root utmp rotate 1 } # system-specific logs may be configured here # catchall that will rotate anything with the normal naming convention /var/log/*log { weekly notifempty sharedscripts prerotate /usr/local/etc/logcheck.sh endscript postrotate /usr/bin/killall -HUP syslog-ng endscript }

2 3

solaris -> linux
by garvald＠bluemail.ch 07 Mar '03

07 Mar '03

Hallo Im experiencing severe problems in logging from solaris 8 (client) to Linux (server). Linux to linux is working well, absolutely no problem there. I have the following (basic) config setup on the 1 boxes: Solaris Client: source s_all { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal();};destination d_tcp { tcp("192.168.1.2"); }; log { source(s_all); destination(d_tcp); }; Linux: source s_all { internal(); unix-stream("/dev/log"); tcp(); }; destination d_messages { file("/var/log/HOSTS/$HOST/$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(s_all); destination(d_messages); }; the result of this config is that absolutely nothing gets logged from the solaris box. A netstat -a shows that the client is connected to the server on the correct port. As already mentioned, logs from a linux client are successfully collected. Ideas anyone ? any help/tips would be appreciated. Cheers AlanCB

1 0

Writing a custom filter
by Rohit Dewan 03 Mar '03

03 Mar '03

What is the best way to write a custom filter for syslog-ng? Any pointers would be most appreciated. Thanks, Rohit

2 2

Strange Directories created [I have read the listserv to no avail]
by Harry Hoffman 01 Mar '03

01 Mar '03

Hi All, My syslog-ng server reports various directories based off of kernel-messages instead of hostnames. I've read the listserv and tried the various options suggested by to no avail. Perhaps someone can help with a suggestion as to what is going wrong here? Info: syslog-ng-1.5.17-1 config file looks like options { use_fqdn(yes); keep_hostname(no); use_dns(yes); long_hostnames(on); sync(3); log_fifo_size(1000); }; ... destination hosts { file("/var/log/HOSTS/$HOST/$FACILITY/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; ... log { source(src); destination(hosts); }; Directories look like this: /var/log/HOSTS ?for ?set host.auckland.ac.nz Any help would be greatly appreciated. I can't figure out where to go next. Thanks, Harry -- Harry Hoffman ITSS Systems Team Leader University of Auckland hhoffman(a)auckland.ac.nz hhoffman(a)ip-solutions.net STANDARD DISCLAIMER: ********************************************** *This universe shipped by weight, not volume.* *Some expansion may have occured in shipping.* ********************************************* ------------------------------------------------- This mail sent through IpSolutions: http://www.ip-solutions.net/

2 4

syslog-ng 1.5.26 dies after remote logging host goes down
by Peter Bieringer 28 Feb '03

28 Feb '03

Hi, looks like a bug, can't be a feature... I have defined a remote destination like: destination d_remotelog { udp( "192.168.1.1" port(514) ) ;}; And use it like log { source(s_local); filter(f_emerg); destination(d_all); destination(d_remotelog); }; Today, I've rebooted "remotelog" host, and detect, that the syslog-ng daemon on the other box dies without any "die now" notice. Last log entries: Feb 28 09:12:38 host syslog-ng[28338]: STATS: dropped 0 Feb 28 09:19:47 host syslog-ng[28338]: Connection broken to AF_INET(192.168.1.1.50:514), reopening in 60 seconds Looks like it dies short after this time, because a running mailman-2.0.x cron job stops logging, too: cron-200302:Feb 28 09:18:01 host CROND[368]: (mailman) CMD (/usr/bin/python -S /var/mailman/cron/qrunner) cron-200302:Feb 28 09:19:00 host CROND[388]: (root) CMD (/usr/local/sbin/AVP_update_bases.pl) cron-200302:Feb 28 09:19:00 host CROND[389]: (mailman) CMD (/usr/bin/python -S /var/mailman/cron/qrunner) cron-200302:Feb 28 09:20:01 host CROND[407]: (root) CMD (/usr/local/sbin/ipacc-get tmplog) cron-200302:Feb 28 09:20:01 host CROND[408]: (root) CMD (/usr/lib/sa/sa1 1 1) cron-200302:Feb 28 09:20:01 host CROND[409]: (mailman) CMD (/usr/bin/python -S /var/mailman/cron/qrunner) cron-200302:Feb 28 09:20:01 host CROND[410]: (mailman) CMD (/usr/bin/python -S /var/mailman/cron/gate_news) cron-200302:Feb 28 09:21:00 host CROND[450]: (mailman) CMD (/usr/bin/python -S /var/mailman/cron/qrunner) [ no further lines :-( ] Nothing else was logged except this 5 cron lines, checked by # grep "Feb 28 09:2" * |more BTW (hopefully off-topic): "host" is IPv6 enabled in general. Runned kernel: RHL 2.4.18-18.7.x with OpenWall patch Hopefully someone can help me. Peter -- Dr. Peter Bieringer http://www.bieringer.de/pb/ GPG/PGP Key 0x958F422D mailto: pb at bieringer dot de Deep Space 6 Co-Founder and Core Member http://www.deepspace6.net/

3 4

millisecond timestamps
by tmk＠lordzork.com 28 Feb '03

28 Feb '03

Is it possible to have syslog-ng support millisecond timestamps? A look at macros.c seems to indicate that it does currently does not, but I can't imagine it would be too difficult to add. It would certainly be useful. t. -- his eye will freeze in the wood, his blood will not be traced while I live.

2 1

RE: [syslog-ng]Solaris 8 Syslog-ng not logging
by robertmg＠WellsFargo.COM 26 Feb '03

26 Feb '03

> From: Ratliff, Lonnie > <snip> > Here is my system and configuration. > > Sun V880 > Solaris 8 > syslog-ng version 1.6.0rc1 > > No errors noted during compiling and I verified it did come back with > Sun Streams and door support. > > I've carved my config file down to the following, just to get > something. I've even tried the default filter and all it logged was > Syslog-ng was starting. > > options { sync(0); > use_dns(no); > use_fqdn(no); > }; You need to use: source net { udp(); tcp(); }; > > source local { sun-streams("/dev/log" door("/etc/.syslog_door")); > internal(); }; > > filter f_host { host("10.0.0.1"); }; > > destination pix01 { file("/syslog/firewalls/pix01"); }; > > log { source(local); filter(f_host); destination(pix01); }; log { source(net); filter(f_host); destination(pix01); }; log { source(local); filter(new local filter); destination(new local dest); }; -mike

1 0

Solaris 8 Syslog-ng not logging
by Ratliff, Lonnie 26 Feb '03

26 Feb '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings, I'm in the process of replacing the native syslog daemon on my Solaris 8 loghost, however syslog-ng doesn't log anything except local messages. I've searched back through the archives and have found alittle help, however its still not working. Any assistance would be greatly appreciated. Here is my system and configuration. Sun V880 Solaris 8 syslog-ng version 1.6.0rc1 No errors noted during compiling and I verified it did come back with Sun Streams and door support. I've carved my config file down to the following, just to get something. I've even tried the default filter and all it logged was Syslog-ng was starting. options { sync(0); use_dns(no); use_fqdn(no); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; filter f_host { host("10.0.0.1"); }; destination pix01 { file("/syslog/firewalls/pix01"); }; log { source(local); filter(f_host); destination(pix01); }; I've verified through tcpdump that the remote system (Cisco Pix) is actually sending me messages. What am I missing or screwing up?? Thank You Lonnie Ratliff lratliff(a)tmh.tmc.edu -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> iQA/AwUBPlzlFMflBxQ642uCEQI5mwCgvuR/BYzlVq5xuWYlZ7lacnH9wrAAoK3A tx25MqZCYAuKYV/U1tKSzfbG =ks+m -----END PGP SIGNATURE----- ----------------------------------------- ____________________________________________________________________________________ ****CONFIDENTIALITY NOTICE**** This e-mail is the property of The Methodist Hospital and/or its relevant affiliates and may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient(or authorized to receive for the recipient), please contact the sender or reply to The Methodist Hospital at datasecurity(a)tmh.tmc.edu and delete all copies of the message. Thank you.

1 0