- syslog-ng - lists.balabit.hu

Doing a regex substitution in syslog-ng
by Donavan Pantke 11 Jun '02

11 Jun '02

Hey guys, I'm trying to make a syslog-ng solution to recieve logs from some custom java apps that output syslog data, but I have an issue. Our programmers have already defined a format for their messages, and our log parsers expect this format. I can pass the data around syslog systems, but at the destination file, I need to strip off the syslog headers to leave me with the raw message that was came out of the ajva app. I was hoping that I could do something akin to a filter that did a regex substitution to modify the message to make it look pretty. Is this possible, and if not, is there any other way of pulling this off? Thanks Donavan Pantke

2 2

sync option not flushing on TERM?
by Clayton L. Scott 07 Jun '02

07 Jun '02

Here are my system stats: Linux 2.4.7-10 i686 ext3 filesystem syslog-ng 1.4.11 I'm trying to do some stress testing of our syslog-ng configuration on a server for log collection and if I send 50 msg/s I find that a bunch are not ending up in the destination file. Where I should I be looking for these dropped messages? It's not the interface I was able to get this machine to accept 1200 msg/s with syslog-ng doing no filtering and writing to a fifo (with a script I wrote sucking messages though the pipe) plus /sbin/ifconfig tells me that things are ok. In our investgation we decided to try the sync option to see if improved the situation where messages were dropped (this is happening with 100 test messages and a log_fifo_size(10000) ). We discovered that the remainder of messages left in the buffer were not flushed to the destination when syslog-ng was TERMed. Looking at the change logs from 1.4.11 to 1.4.15 I don't see a fix mentioned there. Any ideas? Clayton Scott

2 1

feature request
by Nate Campi 06 Jun '02

06 Jun '02

Feature request: (I know you get lots of these from me, sorry Baszi ;) Can output from programs started by syslog-ng get logged by syslog-ng to the logs, perhaps under the syslog facility with the program name as the TAG field: Jun 5 12:15:04 hostname swatch[15895]: syntax error at /root/.swatch_script.1395 line 1581, near "." Or use syslog-ng as the TAG and put the actual program just after: Jun 5 12:15:04 hostname syslog-ng[15892]: swatch: syntax error at /root/.swatch_script.1395 line 1581, near "." I have a separate log architecture I setup for our networking devices, and the network engineers maintain it. The problem is that they didn't know swatch wasn't running due to swatch errors, and swatch is started from syslog-ng (as described here: http://www.campin.net/newlogcheck.html#swatch) Having the swatch errors caught and logged would even have allowed me to send an alert on it via some filters using "match()", or at least been easy for the network staff to see in the logs. They're good with ciscos but not as good with UNIX ;) -- Linux is like an indian's tent: No gates, no windows, and apache inside.

2 2

Re: syslog-ng dying randomly?
by John Morrissey 05 Jun '02

05 Jun '02

I don't mean to be a bother, but do you have anything further on this, Bazsi? thanks, john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

3 5

Re: [syslog-ng]Logging Remotely from Solaris to Linux Update
by Ron Braley 04 Jun '02

04 Jun '02

Bradley - Thanks very much for the information! rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax) >>> arlt(a)cpsc.ucalgary.ca 06/04/02 08:18AM >>> On Tue, Jun 04, 2002 at 09:22:15AM +0200, Balazs Scheidler wrote: > On Mon, Jun 03, 2002 at 11:36:06AM -0500, Ron Braley wrote: > > Hi Bazsi > > > > Here's an update and continued question: Everything seems to be fine > > when syslogging remotely from the Solaris box to the Linux box except > > that cron priorities of debug - critical don't get sent (just emerg). > > Also, Solaris and Linux boxes alike won't send daemon priorities debug > > or information messages to the log host. > > this might be caused by the different facility codes between linux and > solaris. Syslog-ng uses the codes of the host operating system it was > compiled on. Maybe a feature to map facility codes would be useful. Usually I just a bunch of #defines in syslog-names.c and slap the extra facilities on sl_facilities[]. I only ever bother with this on our loghost, but it is very useful. Linux, Solaris, Irix, and BSD are all a little bit different, and it is handy to be able to handle various faculities correctly. For example I handle the Linux/BSD authpriv, auth, and the BSD only "security" facilities the same, but my loghost runs Solaris and doesn't know about the other two facility by default. Having this built in so I can define it in a configuration file would be sweet! But I am looking more for an index than a map (or maybe that is what you meant by map). What I'd like is something like: (9<<3) -> CRON /* !Sun */ (11<<3) -> FTP /* Linux */ (12<<3) -> NTP /* BSD */ (13<<3) -> AUDIT /* Irix */ (13<<3) -> SECURITY /* BSD */ (15<<3) -> CRON /* Sun */ ---------------------------------------------------------------------------- __o Bradley Arlt Security Team Lead _ \<_ arlt(a)cpsc.ucalgary.ca University Of Calgary (_)/(_) http://pages.cpsc.ucalgary.ca/~arlt/ Computer Science _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re:[syslog-ng]Logging Remotely from Solaris to Linux Update
by Ron Braley 04 Jun '02

04 Jun '02

Hi Bazsi Here's an update and continued question: Everything seems to be fine when syslogging remotely from the Solaris box to the Linux box except that cron priorities of debug - critical don't get sent (just emerg). Also, Solaris and Linux boxes alike won't send daemon priorities debug or information messages to the log host. New problem: We need to send logs from our Cisco 2511 access router and 6509 switch/router to the Linux log host, but it's not working. I've set logging facility and host from the Cisco devices, but they don't get logged on the log host. Any ideas or advise? As always: Thanks much for all your help!! rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax)

4 3

Re: [syslog-ng]Logging Remotely from Solaris to Linux Update
by Ron Braley 04 Jun '02

04 Jun '02

OK Bazsi - thanks again for everything. rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax) >>> bazsi(a)balabit.hu 06/04/02 02:22AM >>> On Mon, Jun 03, 2002 at 11:36:06AM -0500, Ron Braley wrote: > Hi Bazsi > > Here's an update and continued question: Everything seems to be fine > when syslogging remotely from the Solaris box to the Linux box except > that cron priorities of debug - critical don't get sent (just emerg). > Also, Solaris and Linux boxes alike won't send daemon priorities debug > or information messages to the log host. this might be caused by the different facility codes between linux and solaris. Syslog-ng uses the codes of the host operating system it was compiled on. Maybe a feature to map facility codes would be useful. > New problem: We need to send logs from our Cisco 2511 access router > and 6509 switch/router to the Linux log host, but it's not working. > I've set logging facility and host from the Cisco devices, but they > don't get logged on the log host. Any ideas or advise? > > As always: Thanks much for all your help!! I'm not experienced in setting up routers to log remotely, though I'm sure many of us on this list do this regularly. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

parse error in reading configuration file
by Chethan K.R 04 Jun '02

04 Jun '02

Hi , I could execute a syslog-ng client but when i tried to execute a syslog-ng server it failed. The error message is ################### parse error at 13 Parse error reading configuration file, exiting. ################################### The configuration file in remote server is ############################## source shell { unix-dgram("/dev/log"); internal(); # Listen on public interface, port 514 for incoming connections tcp(ip(192.9.200.22) port(514) max-connections(1)); }; destination localhost { file("/var/log/syslog-ng.all")); }; # Again, we tie both statements together with the log function. log { source(shell); destination(localhost); }; ######################################### can anybody help me? TIA, Cheths _________________________________________________________________ Send and receive Hotmail on your mobile device: http://mobile.msn.com

1 0

Here is a patch to allow template with program in syslog-ng.conf
by PWM＠capmon.dk 03 Jun '02

03 Jun '02

Hi, Here is a patch to syslog-ng 1.5.13 that will allow the template() to be used within a program() - something like this: filter f_cap { program(^Cap); }; destination d_cap { program("perl -I /opt/cap/server/../inc /opt/cap/server/cmSyslog.pl" template(" \"DATE'$ISODATE'PROG'$PROGRAM'HOST'$HOST'TAG'$TAG'MSG'$MSG\n") template_escape(yes)); }; log { source(src); filter(f_cap); destination(d_cap); }; log { source(net); destination(d_cap); }; Enjoy! Please be aware, that I'm not a member of this syslog-ng mailing list, so if you want to send me comments, please use pvm(a)nworks.dk. Sincerely, Peter Morch. (See attached file: syslog-ng.patch)

1 0

lost logs when using syslog-ng on Linux due to /dev/log reopen
by Borsenkow Andrej 03 Jun '02

03 Jun '02

I am using syslog-ng on Mandrake (8.2 and post-8.2), glibc-2.2.5. Unfortunately, it tends to lose logs. As far as I can tell it is related to the fact that syslog-ng recreates /dev/log on HUP. It means that every program that has opened syslog connection won't be able to write to /dev/log anymore. The sad thing is, this is _not_ limited to klogd (that has the same problem) but to every other program (I had very bad case of socks server losing some info used for accounting :( It happens to every program (daemon) that does openlog() only once on startup. Which makes drop in replacement for syslog simply impossible :( -andrej

4 11