- syslog-ng - lists.balabit.hu

Re: Fwd: [syslog-ng]Logging Remotely from Solaris to Linux
by Ron Braley 29 May '02

29 May '02

Bazsi I'll try this right away!! I really appreciate you and all you do for the people asking syslog questions regularly. rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax) >>> bazsi(a)balabit.hu 05/29/02 06:47AM >>> On Tue, May 28, 2002 at 11:44:22AM -0500, Ron Braley wrote: > Hi bazsi > > Yes, I'm running syslog-ng on both platforms. > > I've attached the configuration files from the Linux box used to record > logs, and from the Solaris box sending logs. I hope this helps. > > Please keep in mind that I've only configured cron to send to the > source s_tcp destination for testing. I've used the logger command > "logger -p cron.crit TEST FROM JUB" to test things. Also, I'm new to > syslogging (as I'm sure you can tell). > > Thanks again, and have a great day! Are you sure that the facility code for cron matches on Solaris and Linux? Try to create a bare bone configuration like: (solaris) source s_all { internal(); sun-streams("/dev/log" door("/etc/.syslog_door"); }; destination d_tcp { tcp("1.2.3.4"); }; log { source(s_all); destination(d_tcp); }; (linux) source s_all { internal(); unix-stream("/dev/log"); tcp(); }; destination d_messages { file("/var/log/messages"); }; log { source(s_all); destination(d_messages); }; And as soon as it works, try playing with filters and the rest. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: Fwd: [syslog-ng]Logging Remotely from Solaris to Linux
by Balazs Scheidler 29 May '02

29 May '02

On Tue, May 28, 2002 at 11:44:22AM -0500, Ron Braley wrote: > Hi bazsi > > Yes, I'm running syslog-ng on both platforms. > > I've attached the configuration files from the Linux box used to record > logs, and from the Solaris box sending logs. I hope this helps. > > Please keep in mind that I've only configured cron to send to the > source s_tcp destination for testing. I've used the logger command > "logger -p cron.crit TEST FROM JUB" to test things. Also, I'm new to > syslogging (as I'm sure you can tell). > > Thanks again, and have a great day! Are you sure that the facility code for cron matches on Solaris and Linux? Try to create a bare bone configuration like: (solaris) source s_all { internal(); sun-streams("/dev/log" door("/etc/.syslog_door"); }; destination d_tcp { tcp("1.2.3.4"); }; log { source(s_all); destination(d_tcp); }; (linux) source s_all { internal(); unix-stream("/dev/log"); tcp(); }; destination d_messages { file("/var/log/messages"); }; log { source(s_all); destination(d_messages); }; And as soon as it works, try playing with filters and the rest. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

stresstest
by Sangbutsarakum, Patai 29 May '02

29 May '02

I'm going to implement central log server in my datacenter to accept many tons of log from many servers and equipments. I'm newbies in syslog-ng, I've run stresstest.sh on my solaris 2.6 [ 2SPARCs, 1 GB RAM] [I've use version 1.4.15] after run just a moment. It show "Segmentation Fault". What does it means for syslog-ng [can't tolerate] or my machine is suck? Should I concern about this? what should i do ? Please suggest Patrick

2 1

"fifo" and "file" source difference?
by Borsenkow Andrej 28 May '02

28 May '02

I needed a source that takes input from a FIFO so I made an obvious "fifo" source. Then I realized I needed log_prefix (that is not supported by fifo) so I changed it to "file". So far I cannot see any real difference. When should "fifo" and when "file" be used? Or are they exactly the same, just under different name? TIA -andrej

2 1

Logging Remotely from Solaris to Linux
by Ron Braley 28 May '02

28 May '02

Greetings! I'm having trouble getting my Solaris servers to log remotely to a Linux 7.1 server. The other Linux boxes log remotely to it OK, and the Solaris boxes will log to a Solaris server configured to listen (source s_tcp { tcp(); };). However, the Linux boxes won't log to a Solaris server, nor will the Solaris boxes log to a Linux server. What am I missing? Is there a format problem or something I need to overcome? Thanks in advance for helping me save the rest of my hair!! rb

1 0

RE: [syslog-ng]syslog-ng survey
by Ohrberg, Mick 27 May '02

27 May '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bazsi, Do you have any preliminary results for the survey? I'm very curious to see how popular syslog-ng really is! /Mick | -----Original Message----- | From: Balazs Scheidler [mailto:bazsi@balabit.hu] | Sent: Wednesday, May 15, 2002 5:58 AM | To: syslog-ng(a)lists.balabit.hu | Subject: [syslog-ng]syslog-ng survey | | | Hi, | | Please find the time to fill out the survey below to help us | to further | improve syslog-ng. You can either fill it out in this mail message | by entering the appropriate marks in the brackets, or on-line by | pointing your | browser to this url: | | http://www.balabit.hu/en/downloads/syslog-ng/survey/ | | Thanks in advance, [snip] | -- | Bazsi | PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD | 804E C82C 8EB1 | | _______________________________________________ | syslog-ng maillist - syslog-ng(a)lists.balabit.hu | https://lists.balabit.hu/mailman/listinfo/syslog-ng | -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> iQA/AwUBPO5bUueVnE5KiyKKEQKHMQCeLlhisonB112W6+3nrUoKn1+sOBwAoLNB RbMXeluositTHLBtN9x1+kIQ =x5iJ -----END PGP SIGNATURE-----

2 1

Re: [syslog-ng]Problem with HP-UX 11.0
by dcntrnoc＠cmp.com 23 May '02

23 May '02

Thanks for the info - I did try a number of different source statements, none of which gave me anything useful. I'll deal with syslogd on the HP boxes until we're able to upgrade. Thanks, Sharon. Balazs Scheidler <bazsi(a)balabit.hu> To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin@lists bcc: .balabit.hu Subject: Re: [syslog-ng]Problem with HP-UX 11.0 05/17/2002 03:51 AM Please respond to syslog-ng On Thu, May 16, 2002 at 12:53:33PM -0600, Brad Arlt wrote: > On Thu, May 16, 2002 at 02:16:58PM -0400, dcntrnoc(a)cmp.com wrote: > > Hi all, > > > > I have been running syslog-ng on a handful of Solaris boxes for some time > > now with no problems, and am attempting to get it running on HP-UX. > > I have compiled (with gcc) and installed syslog-ng 1.5.16 and libol 0.3.2 on > > a system running HP-UX 11.00. I am using the following source statement > > in my config file: > > > > source s_sys { pipe("/dev/log"); internal(); }; > > Err... Ah, are you sure that opening a pipe from /dev/log will yeild > what you want? /dev/log is usually a Unix domain socket, which might > put more in the stream asside from ASCII. I'd turn off any syslog > daemons you have and just cat /dev/log | od Sorry, but HP-UX's /dev/log is really a pipe and not a socket. The problem seems to be that programs sending messages to /dev/log write a whole 2048 bytes block regardless the real length of the message. As syslog-ng reads _lines_ from a pipe, the rest of the 2048 bytes block is also read, which is what you see there. Currently my development branch of syslog-ng 2.0 supports this, but 1.5.x doesn't. A temporary solution would be to use both original syslogd from HP-UX and have it send messages to localhost where a syslog-ng is listening. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Christopher Leonardos/Triumph is out of the office.
by Christopher_Leonardos＠interliant.com 23 May '02

23 May '02

I will be out of the office starting 05/22/2002 and will not return until 05/28/2002. If you need immediate assistance please send email too either scott_tobias(a)interliant.com or mitchell_hryckowian(a)interliant.com Thank You

1 0

Newbie Question - Error Upon Installation - Help!
by Ron Braley 20 May '02

20 May '02

Greetings! Upon installing syslog-ng-1.4.10-1.0.24, and trying to run syslog-ng, I received an error: Cannot open configuration file /etc/syslog-ng/syslog-ng.conf for reading Parse error reading configuration file, exiting. So, I specified the configuration file and now am getting the following error: # syslog-ng -f /etc/syslog-ng.conf io.c: bind_unix_socket(): /var/chroot/named/dev/log not a socket Error initializing configuration, exiting. I'd greatly appreciate any help given by anyone. Take care. rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax)

1 0

RE: Syslog-ng should have a companion "logger-ng"
by Russo, Ben 17 May '02

17 May '02

I humbly apologize for sending HTML. Please don't kill me. :}

1 0