- syslog-ng - lists.balabit.hu

Passing IP address to a program
by Kevin Welch 09 Apr '02

09 Apr '02

When my log events come in, I want to pass some of them to an external program to e-mail them, since the log event does not contain the ip address of the host, is there a way to pass this information along with the syslog event? -- Kevin

1 0

Secondary date code
by Kevin Welch 08 Apr '02

08 Apr '02

All my syslog events have two date codes, is there any way to stop this? Apr 8 15:11:29 208.224.0.252 32200: Apr 8 14:11:28.307 EST: %SYS-5-CONFIG_I: Configured from console by vty1 (206.114.47.144) -- Kevin

1 0

RE: [syslog-ng]syslog-ng
by Michael Earls 08 Apr '02

08 Apr '02

i never ran into that problem on debian, i did have have it working to log to mysql,. but i was using mysql / pipe to enter stuff in the table, but the mysql client would die, for some unknow reason, that is why i am looking at a differnet way to set it up, and i need advise/help thanks michael www.vermeer.org -----Original Message----- From: AGehring(a)bis.adp.com Sent: Monday, April 08, 2002 2:28 PM To: "'syslog-ng(a)lists.balabit.hu'" <syslog-ng(a)lists.balabit.hu> Subject: RE: [syslog-ng]syslog-ng I don't see how adding the ability for syslog ng to write to a database (SQL based) is any more different/difficult the allowing it to write to a file... We've modified it to natively write to Sybase... The problem with external programs, at least in our case, was that we would end up having 20+ process running to get the data where we needed it.... Andrew

1 0

RE: [syslog-ng]syslog-ng
by Gehring, Andrew x66132 08 Apr '02

08 Apr '02

I don't see how adding the ability for syslog-ng to write to a database (SQL based) is any more different/difficult the allowing it to write to a file... We've modified it to natively write to Sybase... The problem with external programs, at least in our case, was that we would end up having 20+ process running to get the data where we needed it.... Andrew

1 0

RE: [syslog-ng]syslog-ng
by Michael Earls 08 Apr '02

08 Apr '02

The reason I want it to log to a database is that I have over 100 routers and switches in different cities, I want a central Syslog server, I want all of techs in each city to be able to view the Syslog messages from a web browser anywhere. The only way I know to do this is have Syslog log to some database then have php/perl search from the web. What is the best way for me to do this with Syslog-ng? thanks michael -----Original Message----- From: bazsi(a)balabit.hu Sent: Wednesday, April 03, 2002 4:55 AM To: <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng]syslog-ng On Wed, Apr 03, 2002 at 03:38:03AM 0500, Michael Earls wrote: > Will syslog ng ever be native to log to mysql or any other type of > external database? I don't understand what the problems with using an external program for such purpose are. Simply write a 10 line long perl script where you can even preprocess messages before they go to the database, and feed this script with a pipe/program destination. Adding support for pgsql/mysql/sybase/whatever into syslog ng is bloat in my opinion. Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog ng maillist syslog ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog ng

1 0

RE: [syslog-ng]syslog-ng
by Michael Earls 08 Apr '02

08 Apr '02

the ver of syslog-ng 1.5.15, does it support templates? i can not get this line to work in this ver,, ## Log syslog-ng to mysql database ## destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(net); destination(d_mysql); }; is there a debug mode and where does that debug file go? thanks michael

1 0

io.c: do_write: write() failed (errno 146), Connection refused
by Vaningh, Ronny 08 Apr '02

08 Apr '02

My syslog-ng sometimes dies with the following message Apr 8 11:20:02 local@loghost syslog-ng[18617]: io.c: do_write: write() failed (errno 146), Connection refused I`m writing to a file on a local disk and forwarding over udp to a plain unix syslog server destination pix { file("/prod/log/$HOST/pix.log" create_dirs(yes) ); }; destination blah { udp(1.2.3.4); }; # # Lets chain everything together # log { source(net); filter(f_pix); destination(pix); destination(blah); }; Any idea what is causing this Thanks Ronny

1 0

RE: Filter Question.
by Kevin Welch 04 Apr '02

04 Apr '02

I fixed it.... after I found the link to the archives, I managed to figure out that the ; makes a big difference. -- Kevin -----Original Message----- From: Kevin Welch Sent: Thursday, April 04, 2002 2:57 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: Filter Question. Im trying to setup a filter as follows: filter f_terse { facility(local7); and match("%CALLRECORD-3-MICA_TERSE_CALL_REC"); }; filter f_notterse { facility(local7); and not match("%CALLRECORD-3-MICA_TERSE_CALL_REC"); }; Now my problem is that this doesnt work and kicks back an error, it seems I cannot use the match keyword and define other parameters. Is this correct or do I have the syntax messed up? My reason for needing this is that terse call records from my my dial systems take over 10000 calls a day and generate alot of syslog information, I need a way to filter these to a different logfile from other syslog events. Thanks -- Kevin

1 0

Filter Question.
by Kevin Welch 04 Apr '02

04 Apr '02

Im trying to setup a filter as follows: filter f_terse { facility(local7); and match("%CALLRECORD-3-MICA_TERSE_CALL_REC"); }; filter f_notterse { facility(local7); and not match("%CALLRECORD-3-MICA_TERSE_CALL_REC"); }; Now my problem is that this doesnt work and kicks back an error, it seems I cannot use the match keyword and define other parameters. Is this correct or do I have the syntax messed up? My reason for needing this is that terse call records from my my dial systems take over 10000 calls a day and generate alot of syslog information, I need a way to filter these to a different logfile from other syslog events. Thanks -- Kevin

1 0

Newbie questions.
by Stephen Amadei 04 Apr '02

04 Apr '02

Hello. I have been considering changing to syslog-ng for a while now, but I've been unable to wrap my brain around the idea since I don't exactly understand how syslog-ng replaces the old syslog. My first question is just that: How does syslog-ng replace the syslog? Do you simply remove klogd and syslogd from running and run syslog-ng instead? Is there a sample syslog-ng.conf that I can use to approximate the old syslog functionality until I get brave enough to tinker with it myself? My next concern is the "syslog -a" function. Where chrooting programs, I need to create extra /dev/log things by using the -a option. Can Syslog-ng also do this? Does syslog-ng still use the normal /dev/log device? I'm sorry if these are simple questions, but I think I will be pretty well set if I understand how closely to syslog syslog-ng works. ----Steve Stephen Amadei Dandy.NET! CTO Atlantic City, NJ

1 0