- syslog-ng - lists.balabit.hu

syslog-ng
by Michael Earls 03 Apr '02

03 Apr '02

Will syslog-ng ever be native to log to mysql or any other type of external database? thanks michael

3 2

Re: [syslog-ng]syslog-ng
by bretwatson＠charteredsemi.com 03 Apr '02

03 Apr '02

If you really want there is some work on a system that takes syslog on stdin and feeds into a modified snort IDS - thus you can have stateful inspection of content and all sorts of filtering.. look at sourceforge for snortadapter Bret Balazs Scheidler <bazsi(a)balabit.hu> 03/04/2002 05:55 Sent by: syslog-ng-admin(a)lists.balabit.hu Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: (bcc: WATSON Bret/IT/CHRT/ST Group) Subject: Re: [syslog-ng]syslog-ng On Wed, Apr 03, 2002 at 03:38:03AM -0500, Michael Earls wrote: > Will syslog-ng ever be native to log to mysql or any other type of > external database? I don't understand what the problems with using an external program for such purpose are. Simply write a 10 line long perl script where you can even preprocess messages before they go to the database, and feed this script with a pipe/program destination. Adding support for pgsql/mysql/sybase/whatever into syslog-ng is bloat in my opinion. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng [This e-mail is confidential and may also be privileged. If you are not the intended recipient, please delete it and notify us immediately; you should not copy or use it for any purpose, nor disclose its contents to any other person. Thank you.]

1 0

Filtering out multiple entries in log files due to different level
by Nick Chondropoulos 03 Apr '02

03 Apr '02

I just started testing syslog-ng in our enviroment a few days ago. I've been able to do what I want for the most part but the one thing that I'm stuck on (and it's probably a stupid admin trick I've missed) is to remove multiple entries from a log file due to level reporting. The necessary bit of backgound: Solaris 8 10/01 on both the client and server. The config file is: --------------------------------------------------------------------- options { sync(0); time_reopen(10); log_fifo_size(100); keep_hostname (no); chain_hostnames (no); create_dirs (yes); }; source net { udp (); }; destination all_by_host-facility { file ("/var/logs/$HOST/$FACILITY/$YEAR/$HOST.$FACILITY.$YEAR.$MONTH.log"); }; destination all_by_facility { file ("/var/logs/$FACILITY/$YEAR/$MONTH/$FACILITY.$LEVEL.$YEAR.$MONTH.log"); }; log { source(net); destination(all_by_host-facility); destination(all_by_facility); }; --------------------------------------------------------------------- I get the logs to split out by hostname year etc. but I get multiple entries in a log file the higher the level. The idea was to log a facility per file so I expected a single entry in the log file which I guess was a woring assumption. Is there a way to stop the following from happening: client> logger -p auth.emerg EMERG server> tail <log> Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG and replace it with a single line of: Apr 1 18:20:00 cdm010 nickc: [ID 702911 auth.emerg] EMERG Is it even a syslog-ng config question? Maybe it's an OS question. TIA Nick -------------------------------+------------------+------------------- Nick Chondropoulos | Schlumberger | ZHTW H ELLAS Senior UNIX Systems Manager | 525 3rd Ave S.W. | nickc(a)calgary.geoquest.slb.com | Calgary, AB | If it's not P) 403-509-4000 | CANADA | dedicated hardware F) 403-509-4170 | T2P 0G4 | it's crap! -------------------------------+------------------+------------------- QUOMODO ARDUUM ESSE POSSIT

2 1

Is there a way to define message priority for syslog-ng?
by Antai Ning 03 Apr '02

03 Apr '02

4 5

(no subject)
by joyce_qian 02 Apr '02

02 Apr '02

syslog-ng，您好！致礼！ joyce_qian joyce_qian(a)mail.ihep.ac.cn

1 0

warning
by John_Delisle＠ceridian.ca 02 Apr '02

02 Apr '02

One thing to watch for in the latest version of syslog-ng - If you create a destination of /dev/null it changes the permissions on /dev/null to 0600 by default. This causes all sorts of problems. Perhaps a warning is in order? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 ********************************************************************** This e-mail and any files transmitted with it are considered confidential and are intended solely for the use of the individual or entity to whom they are addressed (intended). This communication is subject to agent/client privilege. If you are not the intended recipient (received in error) or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please notify the sender immediately. **********************************************************************

2 1

[PATCH] Unixtime Macros
by Gert Menke 29 Mar '02

29 Mar '02

Hi! The following patch adds the Macros $UNIXTIME, $S_UNIXTIME and $R_UNIXTIME. They give you the time in the internal unix time format (seconds since 1970 or so). Since it is useful for me, it is probably useful for others, too. This patch is against syslog-ng-1.5.14 with my sourceip127-patch (which I posted on 05.Feb.2002), but will also work with the plain syslog-ng-1.5.14 sources (with an offset of -3 lines). Balazs, please include this patch in the next release if you find it useful. Greetings Gert

1 0

templates...
by Dave Patterson 29 Mar '02

29 Mar '02

Hello, has anyone had any luck /w templates <to configure the way syslog-ng writes its log> I'd like to call a template file containing the information if possible. this is my current config: template {date '+%b %e %T' hostname PROGRAM:} destination d_program {file("/var/syslog-ng/$HOST/$PROGRAM/$MONTH_$DAY" perm(0644) compress (yes) template(template)) }; I'm not haveing any luck at all,... any help is apprecated, Thanks Dave Patterson

2 1

RE: [syslog-ng]syslog-ng pix help
by John Coke 28 Mar '02

28 Mar '02

Are you still having problems? I have my pixen logging, I might be able to help. -----Original Message----- From: Steve [mailto:steve_slog_ml@timko.com] Sent: Thursday, March 28, 2002 1:49 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng pix help ok now I got pix.log file collecting info but It seems the pix is sending syslog out to err so messages and console is still logging everything which is ugly.. what am I donig wrong? I tried filter f_not_pix { host(regexp to match host); }; that didn't work.. -steve On Thu, 28 Mar 2002, Steve wrote: > ok I got logging in debug mode working on the pix but now everything is > coming to console and messages.. > > I'm trying to get it just to log to pix.log filename.. > > nothing there.. > > -s > > > On Thu, 28 Mar 2002, Steve wrote: > > > Hello, > > > > I saw this post: > > > > http://lists.balabit.hu/pipermail/syslog-ng/2001-November/002760.html > > > > and I'm kinda having a simular problem, but I can't even get logging to > > work. At one point I had the pix logs going to console... > > > > > > Now I got nothing.. > > > > Heres what I got in syslog-ng.conf > > > > destination pix { file("/var/log/pix.log"); }; > > # > > # host filters > > # > > filter f_pix { host(10.1.5.3); }; > > log { source(src); filter(f_pix); destination(pix); }; > > > > > > Does it matter where you put this lines? > > > > thanks for the help if u can.. > > > > > > oh yea > > > > pix has this enabled: > > > > pixfirewall# show loggi > > Syslog logging: enabled > > Timestamp logging: disabled > > Standby logging: disabled > > Console logging: disabled > > Monitor logging: disabled > > Buffer logging: disabled > > Trap logging: disabled > > History logging: disabled > > > > along with > > > > ogging on > > no logging timestamp > > no logging standby > > no logging console > > no logging monitor > > no logging buffered > > no logging trap > > no logging history > > logging facility 20 > > logging queue 512 > > logging host inside 10.1.5.222 > > > > > > > > thanks for any help > > > > -steve > > > > > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

syslog-ng pix help
by Steve 28 Mar '02

28 Mar '02

Hello, I saw this post: http://lists.balabit.hu/pipermail/syslog-ng/2001-November/002760.html and I'm kinda having a simular problem, but I can't even get logging to work. At one point I had the pix logs going to console... Now I got nothing.. Heres what I got in syslog-ng.conf destination pix { file("/var/log/pix.log"); }; # # host filters # filter f_pix { host(10.1.5.3); }; log { source(src); filter(f_pix); destination(pix); }; Does it matter where you put this lines? thanks for the help if u can.. oh yea pix has this enabled: pixfirewall# show loggi Syslog logging: enabled Timestamp logging: disabled Standby logging: disabled Console logging: disabled Monitor logging: disabled Buffer logging: disabled Trap logging: disabled History logging: disabled along with ogging on no logging timestamp no logging standby no logging console no logging monitor no logging buffered no logging trap no logging history logging facility 20 logging queue 512 logging host inside 10.1.5.222 thanks for any help -steve

1 2