- syslog-ng - lists.balabit.hu

syslog-ng and Redhat 7.3
by Kai Backhaus 22 Jun '02

22 Jun '02

Hello List, I tried to install/compile syslog-ng vers. 15.18 on to my RH 7.3 System. My System is using glibc vers. 2.5.5 While compiling a lot of errors occurred, so I could not run syslog-ng. Is syslog-ng vers. 15.18 not compatible with RH 7.3 and libc vers. 2.5.5? Does any body has any answer for that question? It is my intention to setup an win-nt40-eventlog-messages collecting linux server which keeps all NT-Eventlog from my network send by EventReporter. I just want to use the enhanced features of syslog-ng for that project. Thanx for helping in advance Kai

1 0

Syslog-ng makes my server crash.
by Yan DENET 21 Jun '02

21 Jun '02

Hi all, Some quite strange things have happened in my network since i set up my syslog-ng as a log centralizer... Actually, when launched, my syslog-ng ends up to grab all resources of the machine on which it's installed. Then, no way to ssh to it... It's really strange cause normally, syslog-ng should use only very few resources... like syslog ! Whereas with syslog, everything goes well.. Don't know what's happening. Could somebody help me ? -- Yan DENET

2 1

Re: ERROR...
by Balazs Scheidler 21 Jun '02

21 Jun '02

First of all the mysql howto was not written by me, second template() destinations are only supported by the 1.5.x releases. please ask these kind of questions on the mailing list. Thanks. On Fri, Jun 21, 2002 at 02:38:05PM +0800, shan tenorio wrote: > i follwed the step-step procedures on the mysql-log but i do get a parse error when starting syslog-ng. > > this is the line where i get the parsing error... > > ## Log syslog-ng to mysql database > ## > destination d_mysql { > pipe("/tmp/mysql.pipe" > this line ----> template("INSERT INTO logs (host, facility, priority, level, tag, date, > time, program, msg) VALUES ( '$HOST', '$FACILILITY', '$PRIORITY', '$LEVEL', '$TAG', > '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); > }; > log { source(net); destination(d_mysql); > }; > > > -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

What's the diffrence in internal() between 1.5.15 and 1.5.18
by Andreas Schulze 20 Jun '02

20 Jun '02

Hi Batzi, we switched from 1.5.15 to 1.5.18 and observed the following difference in handling logging 'STATS' and daemon start/stop to the internal() source: 1.5.15: works fine for us. STATS and daemon start/stop are logged to a file attached to internal() 1.5.18: seems nothing is logged to internal(). Where are we wrong. We don't changed the config file. Thanks for hints. -- Best regards --Andreas Schulze [phone: +49.5246.80.1275, fax: +49.5246.80.2275] | I believe, it was Dennis Ritchie who said something like: | "C is rarely the best language for a given task, | but it's often the second-best". | The implication being that: "[...]" | | sh# cat>$$.c<<EOT | main(l,a,n,d)char**a;{for(d=atoi(a[1])/10*80-atoi(a[2])/5-596;n="@NK\ | ACLCCGZAAQBEAADAFaISADJABBA^SNLGAQABDAXIMBAACTBATAHDBANZcEMMCCCCAAhE\ | IJFAEAAABAfHJETBdFLDAANEfDNBPHdBcBBBEA_AL H E L L O, W O R L D! " | [l++-3];)for(;n-->64;)putchar(!d+++33^l&1);} | EOT | gcc -o$$ $$.c;clear;./$$ 52 8;rm -f $$*

1 0

Pb with messages contain '\n'
by Jerome Peducasse 20 Jun '02

20 Jun '02

Hello, When a message contains 2 chunks (or more) separated by '\n', next message losts its facility.level because it contains end of previous log. For example: jerome@peducasse:~/> logger -psyslog.debug "Test #1 > Test #2" jerome@peducasse:~/> logger -psyslog.debug "Test #3" Result is: Jun 20 12:54:42 peducasse [syslog.debug] jerome jerome: Test #1 Jun 20 12:54:45 peducasse [user.notice] Test Test #2<47>Jun 20 12:54:45 jerome: Test #3 ^^^^^^^^^^^->end of previous message Thanks for your help. -- Jerome Peducasse Wanadoo Portails - Sophia Antipolis

1 0

Some missunderstanding in filter
by Serge Leschinsky 19 Jun '02

19 Jun '02

Dear sirs. I'm newbie in syslog-ng therefore I beg you to treat my question with indulgence if it is primitive. I'm very sorry for an attached conf but I think I can't explain my problem without this. I have linux (RH) box with syslog-ng-1.4.10 (it's some outdated package but I haven't enough knowledge for its rebuilding). My problem is following: the log from MTA comes to /var/log/messages. So I have duplicate MTA log in mail.log and messages. As far as I understand the problem point is in following filters: > filter f_messages { level(info, emerg, debug, notice, warn, crit, err); }; >log { source(src); filter(f_messages); destination(messages); }; There was an attempt to "log anything (except mail) of level info or higher". But mail is logging to /var/log/messages anyway. How should I modify the filters for resolving this? I will be very appreciate for your kind help. -- Yours sincerely Serge Leschinsky mailto:fish@artlife.tomsknet.ru Wednesday, June 19, 2002

3 2

Multi filters
by Sofox 18 Jun '02

18 Jun '02

Hi, I am playing with syslog-ng, it seems that config log{ source(src); filter(filterA); filter(filterB); destination(dest); } means log those messages which satisfy both filterA and filterB to dest, am I right? now the question is if i want log messages satisfy filterA or filterB to dest, how should I write the config? Oscar Yen.

2 1

Re: [syslog-ng]BUG: Number in Hostnames?
by Jonathan Marchand 17 Jun '02

17 Jun '02

Balazs, On both hosts the DNS lookup and reverse lookup are working fine: Name: nexus1.webnet.qc.ca Address: 209.71.224.10 And reverse: 10.224.71.209.in-addr.arpa name = nexus1.webnet.qc.ca. Also, I added the line: 209.71.224.10 nexus1.webnet.qc.ca nexus1 to /etc/hosts on both hosts. I did try to sniff the traffic using tcpdump, I used "sniff" to translate the output from hex to ascii. However, the messages were fine but the hostname was not translated properly, it was still hex codes. You know a tool I could use to reliably sniff and translate syslog traffic? Thanks, Jonathan. > > ----- Original Message ----- > From: "Balazs Scheidler" <bazsi(a)balabit.hu> > To: <syslog-ng(a)lists.balabit.hu> > Sent: Monday, June 17, 2002 1:02 PM > Subject: Re: [syslog-ng]BUG: Number in Hostnames? > > > > On Mon, Jun 17, 2002 at 12:05:07PM -0400, Jonathan wrote: > > > Hi, > > > > > > I've been toying a bit with syslog-ng, I'm quite happy so far with all > the > > > possibilities it offer me. But I got a problem getting it to work in my > > > environment. > > > > > > I want to log normal syslogd machines to a LogHost which would run > > > syslog-ng. I've installed syslog-ng 1.5.18 on my LogHost and ran a few > > > tests. > > > > > > With this config: > > > > > > options { sync (0); > > > time_reopen (10); > > > log_fifo_size (1000); > > > long_hostnames (no); > > > chain_hostnames (no); > > > use_dns (no); > > > use_fqdn (no); > > > create_dirs (no); > > > keep_hostname (yes); > > > }; > > > > > > source s_sys { unix-stream ("/dev/log"); internal(); > > > udp (ip(209.71.224.21) port (514)); }; > > > destination mail1 { file("/var/log/mail1"); }; > > > filter filter_mail1 { host("mail1");}; > > > log { source(s_sys); filter(filter_mail1); destination(mail1); }; > > > > > > As you can see, I want to log a host named "mail1" to a file "mail1". > > > However, it doesn't work. The host send its log entries syslog-ng but > > > doesn't recognize "mail1". > > > > > > But, if I change the host("mail1") to host("mail"), it work perfectly. > The > > > hostname in the /var/log/mail1 file is "mail" tho, not "mail1". > > > > > > I ran syslogd into debug mode on my "mail1" machine. I saw it does send > the > > > logs out with the "mail1" tag. > > > > > > I tried this with another of my host, its name is nexus1, I experienced > the > > > same behavior. > > > > > > So, I'm wondering if syslog-ng doesn't like having a number at the end > of > > > the hostname. > > > > > > The hosts running syslogd are RedHat 7.2 and 7.1. > > > > > > Any ideas? :) I'd like to get this working, all my hostnames got > numbers.... > > > > hmm.. I don't care if hostnames contain numbers or not. Does reverse DNS > of > > those hosts contain the correct name (with the number ?) > > > > You could sniff your network interface to see if the hostname is really > > present. (sometimes it is missing, and is added by syslog-ng based on the > > DNS name of the host) > > > > -- > > Bazsi > > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C > 8EB1 > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > > >

1 0

BUG: Number in Hostnames?
by Jonathan 17 Jun '02

17 Jun '02

Hi, I've been toying a bit with syslog-ng, I'm quite happy so far with all the possibilities it offer me. But I got a problem getting it to work in my environment. I want to log normal syslogd machines to a LogHost which would run syslog-ng. I've installed syslog-ng 1.5.18 on my LogHost and ran a few tests. With this config: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (no); chain_hostnames (no); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { unix-stream ("/dev/log"); internal(); udp (ip(209.71.224.21) port (514)); }; destination mail1 { file("/var/log/mail1"); }; filter filter_mail1 { host("mail1");}; log { source(s_sys); filter(filter_mail1); destination(mail1); }; As you can see, I want to log a host named "mail1" to a file "mail1". However, it doesn't work. The host send its log entries syslog-ng but doesn't recognize "mail1". But, if I change the host("mail1") to host("mail"), it work perfectly. The hostname in the /var/log/mail1 file is "mail" tho, not "mail1". I ran syslogd into debug mode on my "mail1" machine. I saw it does send the logs out with the "mail1" tag. I tried this with another of my host, its name is nexus1, I experienced the same behavior. So, I'm wondering if syslog-ng doesn't like having a number at the end of the hostname. The hosts running syslogd are RedHat 7.2 and 7.1. Any ideas? :) I'd like to get this working, all my hostnames got numbers.... Thanks! Jonathan.

2 1

again: qmgr stops logging
by Florian Kessler 15 Jun '02

15 Jun '02

Hi all, i discussed an obviously well-known problem on postfix-users yesterday: me: > Hi all, > > i'm using debian/testing with postfix and syslog-ng here. > I have the same problems a lot of people (i.e. Othmar, > http://archives.neohapsis.com/archives/postfix/2000-12/0432.html) have > had long time before: > > qmgr entries are all missing in log after restarting syslog(-ng)! > > The only proposal to solve the problem i could find on the web is to > update syslogd > I've tried syslog-ng/unstable and sysklogd, but this didn't solve the > problem. > > Any other hints? > > Thanks in advance, > Florian Wietse and Varadi: -specify an extra logging socket: not done, because i´m not using chrooted postfix! -update to syslog-ng 1.5.15: done -try SIGHUP instead of restart: done but i keep loosing qmgr messages after a syslog-ng restart/reload in the meantime i updated my system to postfix from unstable (mail_version = 1.1.7) Wietses final word: > There's little Postfix can do about it. > > The syslog() CLIENT code is part of your system library. Some > syslog() implementations will attempt to reconnect when they find > out that the server is disconnected. > > Wietse So, any hints? Thanks in advance, Florian

1 0