- syslog-ng - lists.balabit.hu

RE: [syslog-ng]centralized syslog-server.
by Jon Hofstad 04 Dec '02

04 Dec '02

> > source s_send { udp(); internal(); }; ** This will only > pick up messages > from a udp source or internal. **Probably not too many since > you are not > actually sending any messages to this host. > > destination d_send { udp("192.168.80.94"); }; > > filter f_send { level(info); }; > > log { source(s_send); filter(f_send); destination(d_send); }; > ok.. So my host-config only pushes out the syslog-messages that spesifies that it wants to be sent to the remote host? Then my question is, how should I configure the host to send out all messages generated, to a remote syslog-server? -- I also spotted that i wrote the log-entry wrong in my previous mail: source crusher-1 { udp(); internal(); }; > > destination d_crusher-1 { file("/var/log/crusher-1"); }; > > filter f_crusher-1 { host("192.168.80.141"); } > > log { source(local); filter(f_filter2); destination(d_mesg); }; log { source(s_crusher-1); filter(f_crusher-1); destination(d_crusher-1); }; ## Is right :) /J

2 1

RE: [syslog-ng]centralized syslog-server.
by Hamilton, Andrew 04 Dec '02

04 Dec '02

Jon, ** comments in message. -----Original Message----- From: Jon Hofstad [mailto:Jon.Hofstad@ergo.no] Sent: Wednesday, December 04, 2002 9:25 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]centralized syslog-server. Hello. I`ve set up an syslog-ng server that will receive syslog-messages from different hosts. But I have some problems with my configuration. I was hoping some one could point out what I`m doing wrong.. ---------- This is the host`s configuration: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_send { udp(); internal(); }; ** This will only pick up messages from a udp source or internal. **Probably not too many since you are not actually sending any messages to this host. destination d_send { udp("192.168.80.94"); }; filter f_send { level(info); }; log { source(s_send); filter(f_send); destination(d_send); }; --------------------- AND here`s the server-config: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source crusher-1 { udp(); internal(); }; destination d_crusher-1 { file("/var/log/crusher-1"); }; filter f_crusher-1 { host("192.168.80.141"); } log { source(local); filter(f_filter2); destination(d_mesg); }; ----------- I`ve been snooping my interfaces and the host doesn`t seem to send out any messages via udp.. Hints are welcomed:) /Jon Hofstad _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Betr.: [syslog-ng]centralized syslog-server.
by EDL.Essed＠belastingdienst.nl 04 Dec '02

04 Dec '02

Hi, For the host you wrote: source s_send { udp(); internal(); }; This means you don't receive message from the local machine (something like unix_dgram("/dev/log"); is missing). So, are you sure you receive any messages on the host via UDP? I think internal doesn't generate any messages by default (I read here last month). Regards, Esteban. |---------+--------------------------------> | | "Jon Hofstad" | | | <Jon.Hofstad(a)ergo.no>| | | Verzonden door: | | | syslog-ng-admin@lists| | | .balabit.hu | | | | | | | | | 04-12-2002 15:24 | | | Antwoord a.u.b. aan | | | syslog-ng | | | | |---------+--------------------------------> >-------------------------------------------------------------------------------------------------------------------------------| | Aan: "'syslog-ng(a)lists.balabit.hu'" <syslog-ng(a)lists.balabit.hu> | | cc: | |Onderwerp: [syslog-ng]centralized syslog-server. | >-------------------------------------------------------------------------------------------------------------------------------| Hello. I`ve set up an syslog-ng server that will receive syslog-messages from different hosts. But I have some problems with my configuration. I was hoping some one could point out what I`m doing wrong.. ---------- This is the host`s configuration: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_send { udp(); internal(); }; destination d_send { udp("192.168.80.94"); }; filter f_send { level(info); }; log { source(s_send); filter(f_send); destination(d_send); }; --------------------- AND here`s the server-config: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source crusher-1 { udp(); internal(); }; destination d_crusher-1 { file("/var/log/crusher-1"); }; filter f_crusher-1 { host("192.168.80.141"); } log { source(local); filter(f_filter2); destination(d_mesg); }; ----------- I`ve been snooping my interfaces and the host doesn`t seem to send out any messages via udp.. Hints are welcomed:) /Jon Hofstad _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ------------------------------------------------------------------------------ De Belastingdienst gebruikt e-mail niet voor officiele mededelingen. ==============================================================================

1 0

centralized syslog-server.
by Jon Hofstad 04 Dec '02

04 Dec '02

Hello. I`ve set up an syslog-ng server that will receive syslog-messages from different hosts. But I have some problems with my configuration. I was hoping some one could point out what I`m doing wrong.. ---------- This is the host`s configuration: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_send { udp(); internal(); }; destination d_send { udp("192.168.80.94"); }; filter f_send { level(info); }; log { source(s_send); filter(f_send); destination(d_send); }; --------------------- AND here`s the server-config: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source crusher-1 { udp(); internal(); }; destination d_crusher-1 { file("/var/log/crusher-1"); }; filter f_crusher-1 { host("192.168.80.141"); } log { source(local); filter(f_filter2); destination(d_mesg); }; ----------- I`ve been snooping my interfaces and the host doesn`t seem to send out any messages via udp.. Hints are welcomed:) /Jon Hofstad

1 0

��ӭ��
by �� 01 Dec '02

01 Dec '02

点击进入深圳网络书店：　http://www.szbookshop.com 送货上门，货到付款，还有打折哦使用极星邮件群发，无须通过邮件服务器，直达对方邮箱，速度绝对一流！下载网址：http://love2net.51.net/，更多免费的超酷软件等你来下…… ---------------------------------------------------- INFORMATION This message has been sent using a trial-run version of the TSmtpRelayServer Delphi Component. ----------------------------------------------------

1 0

Unsupported address family 63280
by Andreas Piesk 30 Nov '02

30 Nov '02

i'm trying to switch from syslogd to syslog-ng, but something goes wrong: # syslog-ng -d -F io.c: Preparing fd 3 for reading syslog-ng version 1.5.23 starting io.c: sockaddr2info(): Unsupported address family 63280. Aborted what causes it and how can i fix it? -ap -- Andreas Piesk <a.piesk(a)gmx.net> PGP-Fingerprint: 23CB A7E2 2E53 373C DBCD 8EFC 7777 61C1

2 1

Filters
by Sergio Alves de Lima Jr. 29 Nov '02

29 Nov '02

Hellow list, I am needing create filter for not log entries of connections of the pop3. Some a idea for resolution? Thanks a lot. []'s Sergio A Lima

2 2

Wrong timestamp on internal messages
by henriksa＠telia.com 29 Nov '02

29 Nov '02

These are the last two lines in the log after restarting syslog-ng: Nov 29 12:49:15 src@xxxx syslog-ng[5120]: syslog-ng version 1.5.23 going down Nov 29 12:49:16 src@xxxx syslog-ng[5133]: syslog-ng version 1.5.23 starting But 'date' gives the following: Fri Nov 29 13:49:23 MET 2002 'date -u' gives the same time as the internal message. So messages coming from other sources are timestamped with local time, internal() messages are stamped with GMT. Why is that?

3 2

Syslog-ng on Solaris 8
by Ja Wallaby 29 Nov '02

29 Nov '02

Hi, Are any of you running syslog-ng on solaris8? If so, what are the differences in the config file? I am trying to change my logging host from linux to solaris and am getting errors starting ng when using the same config file. J

3 3

Wish listt
by Peter_STRAKA＠tatrabanka.sk 28 Nov '02

28 Nov '02

Hello, With Regards Peter STRAKA TatraBanka a.s. Cernysevskeho 48 85005 Bratislava Slovak Republic Tel: +421-2-6866 3765 Email: straka(a)tatrabanka.sk ----- Forwarded by Peter STRAKA/TATRABANKA/SK on 11/28/2002 02:24 PM ----- |---------+---------------------------> | | Peter STRAKA | | | | | | 11/28/2002 01:57| | | PM | | | | |---------+---------------------------> >-------------------------------------------------------------------------------------------------------------------------------| | | | To: syslog-ng(a)lists.balabit.huu | | cc: | | Subject: Wish listt | >-------------------------------------------------------------------------------------------------------------------------------| Hello, I use syslog-ng for longer time but I am new in this mailinglist. I didn't find any wish-list for syslog-ng on web page. I use it on linux platform and I in crontab I use chattr to change log files (imutable and appendable) I think it would be goot to have option attr() {like perm()} in config to do this. And for acl somethinf like acl option. And what about log-checking? I tried logcheck,logscanner,logsurger,logwatch,swatch, but every-one is only like better grep. I expect somethink on statistical base - somethink like http analyze. What are you thinking about? With Regards Peter STRAKA ____________________________________________________________________ Informacie obsiahnute v tomto dokumente su urcene vylucne pre potreby jeho adresata. Dokument moze obsahovat informacie chranene ako bankove alebo obchodne tajomstvo, pripadne informacie podliehajuce ochrane podla inych pravnych predpisov. Preto Vas v pripade, ak Vam bol mylne doruceny, vyzyvame, aby ste sa zdrzali jeho odtajnenia ci jeho pouzitia pre vlastne potreby. Zaroven si Vas dovolujeme poziadat, aby ste nas o takomto pripade bez zbytocneho odkladu informovali a dokument nasledne zlikvidovali. Information stated in this document is intended only for needs of proper addressees of this document. This document can contain information protected as a bank or business secret, or information protected by other legal regulations. Thus in case of receiving the document by error, we kindly ask you not to disclose, or use the document for your own needs. Likewise we kindly ask you to notify us immediately upon such a case by sending an email message to the sender's address, and subsequently delete the document. Tatra banka, a.s. Hodzovo namestie 3, 811 06 Bratislava 1 ICO: 00 686 930 Zapisana v obchodnom registri Okresneho sudu Bratislava I Oddiel: Sa, vlozka cislo: 71/B

1 0