- syslog-ng - lists.balabit.hu

no kernel facility
by Stephan Uhlmann 14 Mar '02

14 Mar '02

Hello. It seems that syslog-ng doesn't receive syslog messages of the "kern" facility. I have the following configuration (in reality a bit bigger but the other stuff is mostly configuration for receiving log messages from other hosts, it shouldn't affect this problem): --------- options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source src { unix-stream("/dev/log"); internal(); }; destination han_messages { file("/var/log/messages"); }; log { source(src); destination(han_messages); }; --------- I don't think that there are no kernel messages generated by the system. Also with normal syslog I get the following messages when killing/starting klogd: Mar 14 13:11:59 han kernel: klogd 1.3-3, log source = /proc/kmsg started. Mar 14 13:11:59 han kernel: Inspecting /boot/System.map-2.2.16-SMP Mar 14 13:11:59 han kernel: Loaded 9539 symbols from /boot/System.map-2.2.16-SMP. Mar 14 13:11:59 han kernel: Symbols match kernel version 2.2.16. Mar 14 13:11:59 han kernel: Loaded 290 symbols from 7 modules. Mar 14 13:12:03 han kernel: Kernel logging (proc) stopped. Mar 14 13:12:03 han kernel: Kernel log daemon terminating. With syslog-ng I don't get these messages. So I suspect that there is a problem with syslog-ng getting the messages from klogd. I updated to version 1.4.14 and the problem still exists. Any hint appreciated :-) Thank you, Stephan

4 6

Question
by Roscoe 13 Mar '02

13 Mar '02

Been playing with syslog-ng for a few days and have a question: I have set up a unix-stream src and only get messages (ususaly several hundred) on when syslog-ng starts up. Have set sync (0). Any suggestions?

1 0

Extra info padded when syslog-ng forwards syslog messages
by lukechung 12 Mar '02

12 Mar '02

Hi There, Is there a way for syslog-ng to forward syslog messages to another machine, without padding the additional information? (e.g. Feb 23 02:55:23 [203.208.161.105.28.128] 33: Feb 23 02:52:53.167 Singapo: %SYS-5-CONFIG_I: Configured from console by console) The [203.208.161.105.28.128] is the additional info padded. I have tried setting the option chain_hostnames=no, but to no effect. I would really appreciate it if you can shed some light on this matter. Thank you very much, Luke

1 0

RE: [syslog-ng]use_time_recvd(no) not working?
by Nicholas Berry 08 Mar '02

08 Mar '02

I have emailed a problem I've had a couple times, but I was playing around with the template() feature and found a little more preciously what the problem may be. With template() defined as template("$DATE $HOST $MSG\n"), this is the output I receive: Mar 8 16:32:29 smf-jumpstart AÂ Ã¡ AÂ Ã¡<149>Mar 8 16:32:29 sudo: [ID 850335 local2.notice] nberry : TTY=pts/1 ; PWD=/export/home/nberry ; USER=root ; COM MAND=/usr/ucb/whoami With template() defined as template("$MSG\n"), this is the output I receive: <149>Mar 8 16:40:15 sudo: [ID 850335 local2.notice] nberry : TTY=pts/1 ; PWD=/export/home/nberry ; USER=root ; COMMAND=/usr/ucb/whoami The examples were from a Solaris 8 host using its default syslog daemon, but I have similar issues on *all* other syslog reporting devices (routers, modem banks, etc.) One thing that seems to be consistent between all syslog reporting devices is <X>. Is this some sort of reference that syslogd uses? Can I filter this out? Or will it cause a problem? Also, in the first example " AÂ Ã¡ AÂ Ã¡" is another commonality between hosts. What is the default template() used? I've seen reference to use of "$DATE_RECVD" as an acceptable macro, but I don't see this listed in the documentation. Is there a document set with these new available macros? Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. 2710 Gateway Oaks Dr., Suite 300 South Sacramento, CA 95833 Phone: 916.286.4048 Fax: 916.921.4148 E-mail: nberry(a)ragingwire.com www.ragingwire.com -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Friday, March 08, 2002 12:37 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]use_time_recvd(no) not working? > a) do you have any tips on tracking down the problem with the broken > pam-timestamps? > b) is the use_time_recvd() option broken/non-existant in 1.5.14 ? it exists, but only affects macro expansion. the timestamp in the message itself is never touched unless you use template output files like this: destination d_file { file("/var/log/messages" template("$DATE_RECVD $HOST $MSG\n")); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

use_time_recvd(no) not working?
by Michael Renner 08 Mar '02

08 Mar '02

Hi! I've got a server (syslog-ng 1.5.14) with a innacurate system time (off by a minute) which logs to my master server (also syslog-ng 1.5.14). The option use_time_recvd(no) is in the masters config but the last changed time of the current logfile and the timestamps in the logfile are those of the senders server. Shouldn't the master syslog-ng strip all timestamp information from the logmessage and insert its own? I noticed this (obviously mis)behaviour because the PAM-stuff on the inaccurate server went mad and sends syslog entries with (nearly) correct time but the date is set to 2001-12-31; all other services log with correct timestamps. Here are some messages which cause the broken log-dates --- snip --- Mär 7 18:12:49 backup su: FAILED SU (to root) robe on /dev/pts/0 Mär 7 18:12:53 backup su: (to root) robe on /dev/pts/0 Mär 7 18:12:53 backup PAM-unix2[10112]: session started for user root, service su --- snap --- modify times of the two opened logfiles on the sending host (format is $HOST/$YEAR-$MONTH-$DAY): -rw------- 1 root root 3193 Mar 7 18:12 2001-12-31 -rw------- 1 root root 196130 Mar 7 19:17 2002-03-07 and here on the master server: -rw------- 1 root root 1814 Mar 7 18:13 2001-12-31 -rw------- 1 root root 39016 Mar 7 19:18 2002-03-07 a) do you have any tips on tracking down the problem with the broken pam-timestamps? b) is the use_time_recvd() option broken/non-existant in 1.5.14 ? mfg -- Renner Michael Junior System Engineer Inode Telekommunikationsdienstleistungs GmbH - http://www.inode.at support(a)inode.at, Tel.: 05 9999-0, Fax.: 05 9999-2699

2 2

logrotate and killall -HUP syslog-ng
by Jerome Peducasse 06 Mar '02

06 Mar '02

Hello, I am testing syslog-ng 1.4.14 and 1.5.15 on Redhat 6.2 with SOCK_DGRAM. In both version, each times I send SIGHUP to syslog-ng, syslog-ng lost kernel packet. I can execute "/etc/rc.d/init.d/syslog-ng restart" instead of "killall -HUP syslog-ng" in logrotate configuration file but this solution requires restart syslog-ng deamon for each logfile rotated :-( Thx. -- Jerome Peducasse

2 2

remote logging and logfile naming
by Christian Hammers 05 Mar '02

05 Mar '02

Hello I like to have the following logfile names: /var/log/remote/proxy.d.westend.com.2002-03-05.log or at least /var/log/remote/212.117.2.4.2002-03-05.log /var/log/remote/212.117.4.5.2002-03-05.log etc. Strangely, now I have a file /var/log/remote/proxy.2002-03-05.log which contains data from both, proxy.d.westend.com and proxy.westend.com. And, in addition, when trying to turn of hostname lookup, all syslog-ng exporters still have filenames with their short hostnames and all syslog (old) exporters have IPs as hostnames! /var/log/remote/proxy.2002-03-05 /var/log/remote/212.117.77.123.2002-03-05 (of course I restarted the server after each modification) On all three syslog-ng hosts (2xProxy and 1xCollector) I use syslog-ng-1.5.13. My collector config looks like this: options { long_hostnames(on); use_dns(no); use_fqdn(on); keep_hostname(on) chain_hostnames(on); use_time_recvd(yes); sync(0); mark(120); log_fifo_size(1000); }; source remote { udp(); tcp(); }; destination westend_remote_hosts_dir { file("/var/log/remote/$HOST.$YE..... Any ideas, how to archive "proxy.d.westend.com.2002-03-05.log"? The content of the files is uninteresting, although chained hostnames would be nice if I ever log over more than one host. bye, -christian- -- Christian Hammers WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 ch(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified

5 8

which 1.5.x version works on solaris 8?
by Bernd Jucknischke 05 Mar '02

05 Mar '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all! I'd like to run a version of the development branch of syslog-ng on a solaris 8 machine (because of all the nice new features). I've tried 1.5.13, which doesn't compile and 1.5.15, which simply dies (without a single log line of output) with my config files (the same configs work with 1.4.14, though). Are there any known problems with 1.5.x on solaris 8? Can somebody point me to a working version? Are there incompatibilities in the configuration apart from the new features? TIA, Bernd -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE8hIeSH+EzFoDhBKcRAi/LAJ9+VUp8WIKsL5cMx8VqA8XrQz5MMACdGU1e qvAv8fFj5gx1plHQch7nwqQ= =xYQv -----END PGP SIGNATURE-----

2 2

Log Stoppage
by Gorm Jensen 01 Mar '02

01 Mar '02

I run syslog 1.4.12 on Redhat 7.1, kernel 2.4.17. Occasionally, I find that my logserver has stopped logging some packets. This is after, or during, a log rotation. Processes 'CRON' and 'minilogd' are running. Killing minilogd and HUPping all processes restores normal operations. Any help would be appreciated.

2 2

Splitting routerlogs from servers
by Ken Paris 01 Mar '02

01 Mar '02

>On Thu, Feb 28, 2002 at 05:18:43PM +0100, Michael Renner wrote: > > Hiya! > > > > I've got a setup like this with many log hosts (~200, raising) and want to > > split the server logfiles from those of our routers. i've got a setup like > > this: > > [] > > > > This is a very ugly setup because i always have to add new servers to the > > f_server filter, otherwise it would get logged in the router/unknown dir > > > > Is there a better way to solve this with one ip address or should i add a > > secondary interface to the server and let the routers log to the second ip? Maybe I am missing something here, but why not source from a different facility for routers than local or servers. Facility can still be useful ;-/ if only to differ from a handful of source types, rather easily. Most syslog sources allow some method to set the syslog facility they speak to. Basically .... or am I over simplifying this? filter f_router { facility(local7); }; filter f_server { facility(local6); }; filter f_local { facility(local1); }; Good luck, Ken Paris

2 1