- syslog-ng - lists.balabit.hu

File descriptor still opened after log rotation
by Xavier de Labouret 22 Jan '03

22 Jan '03

>> I have a strange behaviour with syslog-ng 1.4.16 and rotated files. It >> looks like syslog-ng keeps file descriptors opened, despite the time_reap >> parameter, in a file where very few logs are sent. This generates >> problems with log rotations. > > time_reap() is only used when a filename with macros in it is used. e.g. [Sorry for breaking the thread, i had not subscribed to the list before posting in it] Thank you for this quick answer, for i had no clue with this problem. Here are my questions: 1) Is this by design? I did not find this restriction it in the docs. In this case, it would be of great help to write explicitely in the docs that time_reap applies only to macro-generated file destinations. I can get a turnaround for this by using $FACILITY, which won't change during execution for this destination. 2) Is it planned to stay so? I am inclined to think that this feature would be helpful for any file destination, to prevent conflicts with rotations. Do you intend to extend the time_reap feature to any file destination? Regards, Xavier de Labouret

2 1

File descriptor still opened after log rotation
by Xavier de Labouret 21 Jan '03

21 Jan '03

Hello, I have a strange behaviour with syslog-ng 1.4.16 and rotated files. It looks like syslog-ng keeps file descriptors opened, despite the time_reap parameter, in a file where very few logs are sent. This generates problems with log rotations. Here is my syslog-ng.conf (extract). --------------8<---------------- options { long_hostnames(off); sync(0); owner("root"); group("adm"); perm(0644); time_reap(30); }; source src { unix-stream("/dev/log"); internal(); udp(); }; filter f_heartbeat { facility(local7) and program(heartbeat/syslog-ng); }; destination d_heartbeat { file("/usr2/log/heartbeat.log"); }; log { source(src); filter(f_heartbeat); destination(d_heartbeat); }; -------------->8---------------- Important points are: target file is /usr2/log/heartbeat.log, time_reap is set to 30. My "heartbeat" application is logging every 5 minutes in this file, with the appname "heartbeat/syslog-ng". *This is the only line logged to this destination*. So we have 5 minutes of inactivity between 2 logs. I rotate heartbeat.log every 5 minutes too, 3 minutes after the call to the heartbeat application. I am using savelog for the rotation. My problem: syslog-ng keeps a file descriptor opened on the after the rotation. I don't understand why the time_reap parameter (set to 30) is ignored. Did i miss anything? Thank you in advance for your help, Xavier de Labouret

2 1

Template use to log recieved time?
by Blaise St-Laurent 21 Jan '03

21 Jan '03

Has anyone had any success using the template options to log the recieved time as part of the message? I'd like to do something like: destination d_archive {file("/var/log/archive/$YEAR$MONTH$DAY/$HOST/$FACILITY" template ("$TIME_RCVD : $MSG") ) }; but goign through affile.c, i'm unsure if this is currently possible, or if it will be possible in 1.5.25 (i'm using 24) Anyone used anything similar so far? Blaise St-Laurent Senior Security Architect 613-266-4258 ____________________________________________________________________ Okiok Data http://www.okiok.com (450) 681-1681 Solutions de sécurité d'entreprise et d'affaires électroniques Enterprise and e-business security solutions This e-mail message (including attachments, if any) is intended for the use of the individual or entity to which it is addressed and may contain information that is privileged, proprietary, confidential and exempt from disclosure. If you are not the intended recipient, you are notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender and erase this e-mail message immediately. Le présent message électronique (y compris les pièces qui y sont annexées, le cas échéant) s'adresse au destinataire indiqué et peut contenir des renseignements de caractère privé ou confidentiel. Si vous n'êtes pas le destinataire de ce document, nous vous signalons qu'il est strictement interdit de le diffuser, de le distribuer ou de le reproduire. Si ce message vous a été transmis par erreur, veuillez en informer l'expéditeur et le supprimer immédiatement.

1 0

syslog vs syslog-ng
by Moktar KONE 20 Jan '03

20 Jan '03

hi , I have three machines A B and C which run syslog (not syslog-ng) and they send now their logs toward a remote host S. How is it possible with syslogd (running over S) to manage differents logs from A, B and C according to the log source (i.e create a file for log coming from A , an other file for log coming from B and an other file for C). the machine S, which receive logs is running syslogd , how can it manage the logs coming from the others machines according to their source. If syslog is not able to manage this , can syslog-ng do it?how? thanks

1 0

syslog-ng and logconf
by Systems Administrator 17 Jan '03

17 Jan '03

Hi. I thought I'd write you an e-mail about a package I made called "logconf". It's basically designed to automatically generate configuration for things that interact with logs. At the moment, it only configures syslog-ng, logwatch, and logrotate. I thoguht it might interest. http://sourceforge.net/projects/logconf Thanks, Tim Nelson Systems Administrator Sunet Internet Tel: +61 3 5241 1155 Fax: +61 3 5241 6187 Web: http://www.sunet.com.au/ Email: sysadmin(a)sunet.com.au

1 0

rotate files
by Sergio A Lima Jr. 16 Jan '03

16 Jan '03

Hello all, how to for determine log files rotate in the syslog-ng? Below, this syslog-ng.conf: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source stdlog { unix-stream("/dev/log"); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_iptl { file("/var/log/filtering.log"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) or facility(mail) or facility(authpriv); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or facility(news) and level(crit); }; filter f_filter7 { facility(mail) and not match ("i[pP]op3"); }; filter f_filter8 { facility(mail) and not match ("ipop3d"); }; filter f_filter9 { facility(kern) and match ("Bad packet from localnet"); }; log { source(stdlog); filter(f_filter1); destination(d_cons); }; log { source(stdlog); filter(f_filter2); destination(d_mesg); }; log { source(stdlog); filter(f_filter3); destination(d_auth); }; log { source(stdlog); filter(f_filter4); destination(d_mail); }; log { source(stdlog); filter(f_filter5); destination(d_mlal); }; log { source(stdlog); filter(f_filter6); destination(d_spol); }; log { source(stdlog); filter(f_filter9); destination(d_iptl); }; thank's for the help me!!! []'s Sergio Lima

2 1

filter(xxx); filter(DEFAULT); - flaw known ?
by Arnold Schommer 16 Jan '03

16 Jan '03

Hello, i have syslog-ng 1.4.14; there seems to be a flaw in config-parsing that lets the parser accept filter(xxx); filter(DEFAULT); but filter(DEFAULT); filter(xxx); leads to an error message Default statement may not have additional filters. (and syslog-ng does not start). My question: is this already known/fixed or should i send a note to the programmers ? tia Arnold Schommer -- FS EDV Service & Beratung GmbH An der Pönt 48 40885 Ratingen fon: +49 2102 186 400 fax: +49 2102 186 499 mailto:aschommer@fs-edv.de http://www.fs-edv.de

1 0

directing logs by application
by rich coco 15 Jan '03

15 Jan '03

I am confused by the documentation with respect to the possibility of directing output based on the *name* of an application. For example, consider 2 legacy applications - appName1 and appName2 - that historically wrote to syslogd via the LOG_USER facility. Using syslog-ng, can I redirect each app's log to different files via the syslog-ng.conf file? if this is do-able, is the following the correct approach? source src { unix-stream("/dev/log"); internal(); }; destination app1 { file("/var/log/app1.log") }; destination app2 { file("/var/log/app2.log") }; filter f_app1 { program("appName1") }; filter f_app2 { program("appName2") }; log { source(src); filter(f_app1); destination(app1); }; log { source(src); filter(f_app2); destination(app2); }; Also, it is not clear to me how i make the program-name (eg, "appName1") known to syslog-ng in the first place. Any help/advice welcome. (Oh, Running RH 7.x Linux, to the extent this may matter) Tia, - rich -- racoco(a)sockeye.com Sockeye Networks 52 Second Ave Suite 100 Waltham, MA 02451 781.693.7051

1 0

Re: [syslog-ng]syslog-ng and MySQL
by Michael Earls 14 Jan '03

14 Jan '03

What is the source of the syslog messages? Are you trying to log messages though UDP or local messages? michael PGP Info: KeyID 0x5EB59708 Fingerprint 108B A1D8 76F5 08A8 501A F28C 86F4 4BC5 5EB5 9708 >>> james.fleet(a)upbna.com 01/13/03 01:57PM >>> > Hello, > > I have been trying to create a syslog server with MySQL and with several > attempts it does not work. I have attached my configs for the system which > runs on Linux RH 7.3. > > > This is my syslog-ng.conf file : > > # > # Syslog-ng example configuration file showing all the existing/future > # features. > # > # Copyright (c) 1999 Balazs Scheidler > # $Id: syslog-ng.conf.demo,v 1.2 1999/11/15 12:30:41 bazsi Exp $ > # > # Note that some of the keywords do _nothing_, this includes: > # mac, authentication, encryption, compress > # > > #options { sync(0); time_reopen(10); log_fifo_size(100); }; > ## Log syslog-ng to mysql database > ## > destination d_mysql { > pipe("/tmp/mysql.pipe" > template ("INSERT INTO logs (host, facility, priority, level, tag, date, > time, program, msg) VALUES ( '$HOST', '$FACILITY', > '$PRIORITY','$LEVEL','$TAG','$YEAR-$MONTH-$DAY','$HOUR:$MIN:$SEC','$PROGRAM' > ,'$MSG' );\n") template-escape(yes)); > }; > log { source(net); destination(d_mysql); > > }; > #source src { > # unix-stream("/dev/log"); > # udp(); > # tcp(ip("127.0.0.1") port(1000) mac(allow) authentication(required) > encrypt(allow)); > # tcp(); > # sun-streams("/dev/log" door("/etc/.syslog_door")); > # internal(); > #}; > source src { unix-dgram("/etc/log/log"); internal(); }; > source net { udp(); }; > > #log { source(src); destination(everything); }; > > > I also have this script running which says that /tmp/msql.pipe is my fifo > directory. > > But I am still not receiving logs into the database but when I switch it > will log to messages. > > > -James Fleet - > > Systems Engineer > Union Planters Bank > > > > > > > > > > > > > -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng for cygwin ?
by a12 14 Jan '03

14 Jan '03

Hi gurus, Is there a syslog-ng package for cygwin ?

1 0