- syslog-ng - lists.balabit.hu

RE: [syslog-ng]Syslog-ng and Mysql
by Michael Earls 06 May '02

06 May '02

what ver of syslog-ng? -----Original Message----- From: nelsotob(a)ohsu.edu Sent: Monday, May 06, 2002 11:14 AM To: <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng]Syslog-ng and Mysql Yes that is actually what I have in my script is INSERT just a typo in the messages. Toby >>> sander(a)sanderscorner.com 05/04/02 04:39AM >>> (Response to message from Toby Nelson, nelsotob(a)ohsu.edu) Hello Toby, Should'nt it be 'template("INSERT INTO...'? Regards, Sander Saturday, May 04, 2002, 1:14:08 AM, you wrote: > Can someone help me? > I have syslog ng running perfectly getting all info from all of my hosts. I would like to take this one step farther and start adding it to a mysql data base. I have made the mysql.pipe using > mkfifo and add the following lines to my syslog ng.conf: > destination d_mysql { > pipe("/etc/mysql.pipe" template("INSET INTO logs(host, facility, priority, level, tag, date, time, program, msg) VALUES('$HOST', '$FACILILITY', '$PRIORITY', '$LEVEL', '$TAG', > '$YEAR $MONTH $DAY', $HOUR:$MIN:$SEC', '$PROGRAM', $MSG');\n") template escape(yes)); > }; _______________________________________________ syslog ng maillist syslog ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog ng

1 0

How does the log_fifo_size option work?
by Eric Benzacar 06 May '02

06 May '02

Can someone please clarify what the log_fifo_size option does within the file() option for me please? I don't understand the docs, nor how to use it: log_fifo_size() number The number of entries in the output fifo. Use global setting. What is the "output fifo"? Thanks! Eric

2 1

Syslog-ng and Mysql
by Toby Nelson 04 May '02

04 May '02

Can someone help me? I have syslog-ng running perfectly getting all info from all of my hosts. I would like to take this one step farther and start adding it to a mysql data base. I have made the mysql.pipe using mkfifo and add the following lines to my syslog-ng.conf: destination d_mysql { pipe("/etc/mysql.pipe" template("INSET INTO logs(host, facility, priority, level, tag, date, time, program, msg) VALUES('$HOST', '$FACILILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', $HOUR:$MIN:$SEC', '$PROGRAM', $MSG');\n") template-escape(yes)); }; log { source("src"); destination("d_mysql"); }; With that in place I continue to get a parse error. Can any one help? Thanks, Toby

2 1

Penny L Creech/Nationwide/NWIE is out of the office.
by CREECHP＠Nationwide.com 04 May '02

04 May '02

I will be out of the office starting 05/03/2002 and will not return until 05/13/2002. I will respond to your message when I return.

1 0

RE: syslog-ng digest, Vol 1 #683 - 3 msgs
by Aerts,Bas 03 May '02

03 May '02

probably you should recompile tcpwrappers with the 'process_options' feature enabled in the Makefile (or something like that) for enhanced language options (:-((: ########################################### # Optional: Turning on language extensions # # Instead of the default access control language that is documented in # the hosts_access.5 document, the wrappers can be configured to # implement an extensible language documented in the hosts_options.5 # document. This language is implemented by the "options.c" source # module, which also gives hints on how to add your own extensions. # Uncomment the next definition to turn on the language extensions # (examples: allow, deny, banners, twist and spawn). # #STYLE = -DPROCESS_OPTIONS # Enable language extensions. chrs. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] Sent: Friday, April 26, 2002 6:25 AM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng digest, Vol 1 #683 - 3 msgs Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-admin(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: syslog-ng and AIX (Ed Ravin) 2. Re: Error when compiling with tcp-wrappers (Ed Ravin) 3. Re: Random Directories (Nate Campi) --__--__-- Message: 1 Subject: Re: [syslog-ng]syslog-ng and AIX To: syslog-ng(a)lists.balabit.hu Date: Thu, 25 Apr 2002 13:43:57 -0400 (EDT) From: "Ed Ravin" <eravin(a)panix.com> Reply-To: syslog-ng(a)lists.balabit.hu Balazs Scheidler writes: > > -F or --foreground options Oh dear, this is what I get for reading an outdated man page instead of looking at the program itself. --__--__-- Message: 2 Subject: Re: [syslog-ng]Error when compiling with tcp-wrappers To: syslog-ng(a)lists.balabit.hu Date: Thu, 25 Apr 2002 13:49:45 -0400 (EDT) From: "Ed Ravin" <eravin(a)panix.com> Reply-To: syslog-ng(a)lists.balabit.hu Balazs Scheidler writes: > > On Wed, Apr 24, 2002 at 11:38:25PM -0400, Ed Ravin wrote: > > ./configure --prefix=/install/syslog-ng-1.5.16 --enable-tcp-wrapper --with- libol=/src/build/libol-0.3.2 [...] > > checking for hosts_access in -lwrap... no > > checking whether to enable TCP wrapper support... yes > > > > So clearly something is broken in the configure process. > > can you check config.log why it fails? Here's the log: configure:2725: checking for tcpd.h configure:2735: gcc -E conftest.c >/dev/null 2>conftest.out configure:2762: checking for hosts_access in -lwrap configure:2781: gcc -o conftest -g -O2 conftest.c -lwrap 1>&5 /usr/lib/libwrap.so: undefined reference to `allow_severity' /usr/lib/libwrap.so: undefined reference to `deny_severity' collect2: ld returned 1 exit status configure: failed program was: #line 2770 "configure" #include "confdefs.h" /* Override any gcc2 internal prototype to avoid an error. */ /* We use char because int might match the return type of a gcc2 builtin and then its argument prototype would still apply. */ char hosts_access(); int main() { hosts_access() ; return 0; } configure:2811: checking whether to enable TCP wrapper support I think the fix is that the test program should define "allow_severity" and "deny_severity", since those are required to be in the user program for it to compile successfully. --__--__-- Message: 3 Date: Thu, 25 Apr 2002 18:26:51 -0700 From: Nate Campi <nate(a)campin.net> To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Random Directories protocol="application/pgp-signature"; boundary="bKyqfOwhbdpXa4YI" Reply-To: syslog-ng(a)lists.balabit.hu --bKyqfOwhbdpXa4YI Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Apr 25, 2002 at 10:59:43AM +0200, Balazs Scheidler wrote: > On Wed, Apr 24, 2002 at 10:47:11AM -0700, Nate Campi wrote: > > On Wed, Apr 24, 2002 at 10:32:20AM -0700, Painter, Jennifer wrote: > > > Directories with names like " Error", " SCSI", "," > > >=20 > > > Are showing up in the directory that holds the syslogs for the differ= ent hosts that we monitor. =20 > > >=20 > > > Has anyone seen these random directories. Any suggestions on how to = deal with them. > >=20 > > I want a macro taken from gethostbyaddr() instead of from the message > > contents that could be used to force a valid hostname no matter what. > >=20 > try the attached patch.=20 >=20 > ps: if this patches proves to be stable, I'll release 1.5.17 Working as expected, on a lightly loaded loghost. I'll report back tomorrow. Thanks. --=20 "Press any key... no, no, no, NOT THAT ONE!" -Anon. =20 =20 "Enter any 11-digit prime number to continue..." -Anon. =20 --bKyqfOwhbdpXa4YI Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE8yKzbWpDEZMF673kRAh6FAJ0Ss0ojsCDCKwUg8YIf6ItBYFLrSwCeJOnK l5Tnlp4KTRExjeYW0FZa48M= =Q0Lh -----END PGP SIGNATURE----- --bKyqfOwhbdpXa4YI-- --__--__-- _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng End of syslog-ng Digest

1 0

Syslog-ng newbie needs help with remote logging. Please?
by Jeroen Baten 03 May '02

03 May '02

Hello, I tried to get remote loggin to work but somehow it doesn't. I've put the following line on the host that should sent the messages: (as you can see, there are two attempts). destination server_syslog { udp("10.1.1.2" port(514); }; log { source(src); destination(server_syslog); }; destination d_udp { udp("10.1.1.2" port(514); localport(514)); }; log { source(src); destination(d_udp); }; on the receiving host my config is: source net { udp(); }; log { source(net); destination(allmessages); }; Can you tell me what my error is? I am using SuSE 7.3 with syslog-ng 1.4.12 All help is appreciated. Kind regards, -- Jeroen Baten | EMAIL : JEROEN(a)I2RS.NL ____ _ __ | web : www.i2rs.nl | )|_)(_ | tel : +31 (0)30 221 00 11 _|_/_| \__) | fax : +31 (0)30 220 31 91 Kometenlaan 26, 3721 JT, Bilthoven

1 0

RE: [syslog-ng]syslog-ng
by Abraham, Ajamu 03 May '02

03 May '02

I am trying to do the same thing. I got three datacenters and I am logging all my routers and switches to syslog-ng servers in each location. I finally got sqlsyslogd working on a test server but noticed that the format in which my logs come into the database is wrong. Can you tell me if you was able to accomplish your goal and if so can you send me a sample config on how to tailor the logs before it is entered into the database. Thanks in advance. Ajamu Abraham Network Engineer About The Human Internet <http://about.com> 1440 Broadway, 20th Floor New York, NY 10018 Direct: (212) 204-1525 Cell: (917) 416-3800 "l'argent comptant règne tout autour de moi" -----Original Message----- From: Michael Earls [mailto:Michael.Earls@chmcc.org] Sent: Monday, April 08, 2002 2:18 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]syslog-ng The reason I want it to log to a database is that I have over 100 routers and switches in different cities, I want a central Syslog server, I want all of techs in each city to be able to view the Syslog messages from a web browser anywhere. The only way I know to do this is have Syslog log to some database then have php/perl search from the web. What is the best way for me to do this with Syslog-ng? thanks michael -----Original Message----- From: bazsi(a)balabit.hu Sent: Wednesday, April 03, 2002 4:55 AM To: <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng]syslog-ng On Wed, Apr 03, 2002 at 03:38:03AM 0500, Michael Earls wrote: > Will syslog ng ever be native to log to mysql or any other type of > external database? I don't understand what the problems with using an external program for such purpose are. Simply write a 10 line long perl script where you can even preprocess messages before they go to the database, and feed this script with a pipe/program destination. Adding support for pgsql/mysql/sybase/whatever into syslog ng is bloat in my opinion. Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog ng maillist syslog ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Trouble with using syslog-ng "source" with specific IP address and UDP ...
by John E Spence, CISSP 30 Apr '02

30 Apr '02

Hi; I've installed syslog-ng onto my Sun Solaris 8 machine. I'm using syslog-ng-1.4.15 and libol-0.2.23. Everything works well unless I try to setup a source statement with a specific IP address in it. This works fine: source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source nonlocalA { udp(ip(0.0.0.0) port(514)); }; source nonlocalB { udp(ip(0.0.0.0) port(2000)); }; destination local-dest { file("/var/log/messages"); }; destination nonA-dest { file("/export/home0/syslog-ng/logA"); }; destination nonB-dest { file("/export/home0/syslog-ng/logB"); }; log { source(local); destination(local-dest); }; log { source(nonlocalA); destination(nonA-dest); }; log { source(nonlocalB); destination(nonB-dest); }; If I add these lines . source eval1 { udp(ip(10.55.70.113) port(514)); }; destination eval1-dest { file("/export/home0/syslog-ng/eval1"); } log { source(eval1); destination(eval1-dest); }; .. syslog-ng fails to start and I get this message: "io.c: bind_inet_socket() bind failed 10.55.70.113:514 Cannot assign requested address Error initializing configuration, exiting." I've looked carefully at other examples and the documents, and I don't understand what I've done wrong. Can anyone help? Thanks very much. ----------------------------------------------- John E Spence, CISSP --------------------------------------------

2 1

syslog-ng-1.4.15: libol-0.3.2 < libol-0.2.23
by Ed Grimm 29 Apr '02

29 Apr '02

Your configure script is messed. I managed to get it to compile using the following patch, although I don't know if the precidence rules are right for this to be the full working version. Ed --- configure Sat Apr 27 14:56:29 2002 +++ configure.new Sat Apr 27 14:56:11 2002 @@ -2626,6 +2626,7 @@ LIBOL_PATCH=`echo $LIBOL_VERSION | sed -e 's/[0-9]*\.[0-9]*\.$[0-9]*$/\1/'` if test "$LIBOL_MAJOR" != "$LIBOL_REQ_MAJOR" -o \ "$LIBOL_MINOR" -lt "$LIBOL_REQ_MINOR" -o \ + "$LIBOL_MINOR" -eq "$LIBOL_REQ_MINOR" -a \ "$LIBOL_PATCH" -lt "$LIBOL_REQ_PATCH"; then echo "$ac_t""no" 1>&6 { echo "configure: error: Required libol version not found, found $LIBOL_VERSION instead" 1>&2; exit 1; }

2 1

syslog-ng and DNS
by Jerome Peducasse 29 Apr '02

29 Apr '02

If a computer reboot before DNS server, syslog-ng disallows starting because it can't resolve IP address of loghost. It's akward because computer can't write in local destination. Thx. -- Jerome Peducasse

9 17