- syslog-ng - lists.balabit.hu

syslogd logging to syslog-ng. [2]
by Yan Lau 29 Jan '02

29 Jan '02

I knew I forgot to put this in my previous message. I've distilled my syslog-ng.conf file to: # syslog-ng configuration file. options { sync (0); time_reopen (10); log_fifo_size (1000); create_dirs (yes); chain_hostnames (yes); use_dns (no); use_fqdn (yes); }; source s_sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); tcp(); udp(); }; destination d_file_messages { file("/var/adm/messages" perm(0644)); }; filter f_lvl_err { level(err); }; log { source(s_sys); filter(f_lvl_err); destination(d_file_messages); } When I start syslog-ng, I get this: # /usr/local/sbin/syslog-ng -v -f /tmp/my.conf binding fd 7, inetaddr: 0.0.0.0, port: 514 binding fd 8, inetaddr: 0.0.0.0, port: 514 Yan.

1 0

syslogd logging to syslog-ng.
by Yan Lau 29 Jan '02

29 Jan '02

I've set up a server with syslog-ng. It works find for local messages. On another server I'm running the syslogd that came with the system (Solaris). I've tried to set up the old syslogd server to forward messages to the syslog-ng server. However, I can not get it to work. For instance, I have under the old syslog.conf: user.notice @log.globix.net In debug mode it shows: writemsg(6): Logging msg 'Jan 29 14:26:27 ylau: hi there' to FORW log.globix.net However, when I truss syslog-ng with -dv options, it doesn't receive anything. I'd rather not have to install syslog-ng on all the servers. Yan. (I speak for myself only)

2 1

How do I make logging of a message to stop after certain filter?
by Subodh Nijsure 29 Jan '02

29 Jan '02

Hello, I have seen reference to this in some syslog-ng document but I can not find it now. What I want to do is log ftpd or dhcpd related messages to go to ftpd.log and dhcpd.log respectively. But I also have "default" rule that catches all messages not logged, currently what is happening is all the ftp and dhcpd messages are getting logged to ftpd.log and dhcpd.log , but they are also getting logged to here is the relevant section of the syslog-ng.conf file source scm_messages { unix-dgram("/dev/log"); internal(); }; filter f_ftpd { match("ftpd"); }; filter f_dhcpd { match("dhcpd"); }; destination ftpdlog { file("/var/log/ftpd.log"); }; destination dhcpdlog { file("/var/log/dhcpd.log"); }; destination scmlog { file("/var/log/scm.log"); }; log { source(scm_messages); filter(f_ftpd); destination(ftpdlog); }; log { source(scm_messages); filter(f_dhcpd); destination(dhcpdlog); }; <<- I want ftp logging to stop here log { source(scm_messages); destination(scmlog); }; <<---- This is my catchall entry Also does syslog-ng have any options to set max-size of the log file? or do I have to run logroate? Thanks. /Subodh Nijsure Software Manager - Network Media Routers SkyStream Networks

1 0

Re: [syslog-ng]Leaky syslog-ng files?
by Michael Earls 27 Jan '02

27 Jan '02

What does your config file look like, here is an ex, of mine, i use filters to to force the host to log to the text file. ## tking switch 192.168.3.254 destination 192.168.3.254 { file("/var/log/routers/tking-switch.log"); }; filter f_192.168.3.254 { host(192.168.3.254); }; log { source(net); filter(f_192.168.3.254); destination(192.168.3.254); }; michael http://vw.vermeer.org/syslog-ng/ >>> rob(a)rascal.ca 01/19/02 18:23 PM >>> Hi everyone, I'm pretty new to syslog-ng, but I really like it so far, except for one thing I can't figure out...(it could be a clueless newbie issue.) I'm using syslog-ng on FreeBSD 4.4 to log everything for about 10 cisco routers/switches right now, with about 30 more that will be added over the next week or two. I have them logging to separate files right now, and that works great, with newsyslog archiving stuff, etc etc. Works wonderfully. However, everything keeps leaking into my /var/log/messages file, which I don't want it to do. I *just* want it in their separate files. An example of what I use for filters is: filter f_gig2 { host("gig2-0"); }; And for log: log { source(src); filter(f_gig2); destination(gig2); }; And for destination: destination gig2 { file("/var/log/peer1/vancouver/gig2-0"); }; Anyone have any suggestions? Thanks in advance! -Rob. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

3 2

RE: [syslog-ng]Where is the web page
by Ohrberg, Mick 24 Jan '02

24 Jan '02

http://www.balabit.hu/ works fine for me. > -----Original Message----- > From: Mihai Barbos [mailto:Mihai.Barbos@eurospider.com] > Sent: Thursday, January 24, 2002 11:57 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]Where is the web page > > > Hi, > > I'm trying to connect to www.balabit.hu (hompage for > syslog-ng) but it > seems that it dissapeard. Can anyone tell me where is it gone ? > > Regards, > > Mihai > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

1 0

Where is the web page
by Mihai Barbos 24 Jan '02

24 Jan '02

Hi, I'm trying to connect to www.balabit.hu (hompage for syslog-ng) but it seems that it dissapeard. Can anyone tell me where is it gone ? Regards, Mihai

2 1

log rotation features for syslog-ng
by klaas.vangend＠philips.com 24 Jan '02

24 Jan '02

Gentlemen, I'd like enhance syslog-ng with some features in order to get rid of some log rotation scripts. For some of our systems, we log on a centralised system, but also store the logs locally. These logs only need limited availability, say a week or so. The file() destination currently is already able to use the target $WEEKDAYS (which is undocumented, btw), but in that case, logs from both Jan 17 and Jan 24 are logged in messages.Thu.log Therefore, I'd like to add a new option clear_old(X) which removes a logfile with a timestamp older than X days prior to writing the new message to that file. (default should be 0 (=never), which means that for a disabled feauture only one C 'if' statement additional overhead is caused) But I can imagine that people also wants to set a max size on a logfile. E.g. to be able to compress it afterwards, or for simple log rotation, like: file('/var/log/mesages' max_size_old(200, 'gzip')) will rename the existing 200 kB file to /var/log/messages.old and then run 'gzip /var/log/messages.old' Maybe it is better to add a new destination rotatedfile(), maybe it's better to do something else... I'd to know wheter everyone agrees that these features are a good idea, and that the proper approach is taken to keep the configurationfile syntax simple. Groetjes, Klaas van Gend

3 2

Syslog-ng on Boot
by jesse.keefe＠convergys.com 23 Jan '02

23 Jan '02

For those who asked about starting syslog-ng on boot, here is what I did for Solaris 8. I simply modified the /etc/rc2.d/S74syslog script: case "$1" in 'start') if [ -f /etc/syslog-ng/syslog-ng.conf -a -f /usr/sbin/syslog-ng ]; then echo 'syslog-ng service starting.' # # Before syslogd starts, save any messages from previous # crash dumps so that messages appear in chronological order. # /usr/bin/savecore -m if [ -r /etc/dumpadm.conf ]; then . /etc/dumpadm.conf [ "x$DUMPADM_DEVICE" != xswap ] && \ /usr/bin/savecore -m -f $DUMPADM_DEVICE fi if [ ! -f /var/adm/messages ]; then /usr/bin/cp /dev/null /var/adm/messages /usr/bin/chmod 0644 /var/adm/messages fi /usr/sbin/syslog-ng >/dev/msglog 2>&1 & fi ;; 'stop') echo 'syslog-ng service stopping.' if [ -f /var/run/syslog-ng.pid ]; then syspid=`/usr/bin/cat /var/run/syslog-ng.pid` [ "$syspid" -gt 0 ] && kill -15 $syspid fi ;; *) echo "Usage: $0 { start | stop }" exit 1 ;; esac ------------------------------------------ Jesse Keefe <jesse.keefe(a)convergys.com> | Systems Administrator | Convergys Corp. | 229 West Seventh Street | P.O. Box 1638 | Cincinnati, Oh 45201 | (513)723-3689 | -- NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected.

3 4

Logging to mysql
by Richard Wallace 22 Jan '02

22 Jan '02

Hello, I've setup a rule to send all log messages received for the local0 facility to a program which then inserts info into a local mysql database. The problem is this isn't working. The script doesn't appear to be being called, since there are no messages in the mysql.log file stating that anyone has tried to connect. Here are the lines I've added. Any help would be greatly appreciated. destination local0 { program("/usr/local/sbin/rsynclog.pl"); }; filter f_local0 { facility(local0); }; log { source(src); filter(f_local0); destination(local0); }; Thanks -- _ Richard Wallace /\ | | /\ /| AIM, Inc. (www.a--i--m.com) / \ | | / \ / | Information Systems Consultants \ \ | | \ \ / | / \ | | | \ / | "Providing New Technology, / /\ \ | | | \ / | the Old-Fashioned Way" / / \ \ | | | |\ \//| | / / /\ \ \ | | | | \ / | | / / \/ \ / | | | | \/ | | \/ \/ |_| |_| |___|

1 0

Re: Re: [syslog-ng]syslog-ng mistreating data as part of the hos tname ?
by Hildenbrand, Patrick 20 Jan '02

20 Jan '02

On Wed, Jan 16, 2002 at 07:45:26PM +0100, Nate Campi wrote: >On Wed, Jan 16, 2002 at 05:14:11PM +0100, Hildenbrand, Patrick wrote: >> some more info. >> >> tracing the output of the SSR, the packet does not contain the hostname at >> the proper place but only the timestamp. So the output looks like >> (translated into ascii): >> <174>Jan 13 04:02:12 %ACL_LOG-I-DENY, ACL [280] on "rtfa" UDP 192.168.1.2:4721 -> 14.9.1.3:53 this is the ascii converted hexdump of the package, there is only a single space between date and message. > [ ... ] > >Linux syslog sends messages like this: > ><123>named[123]: another error from BIND, you should use djbdns my debugging showed the prio beeing only two digits (ex. <23>) but yes and the difference is, there is even no timestamp, why this case is explicitly covered in the RFC, while the case of the cabeltron ssr is not. This is probably also why syslog-ng does not have a problem with this case, it gets logged as: Jan 17 08:11:21 hwdf0006/hwdf0006 PAM_pwdb[22525]: (sshd) session close so syslog-ng correctly adds time and hostname to the log entry. The format of linux (and others) is: <Prio>message The format of the SSR is: <Prio>datetime<space>message The format the RFC suggests is: <Prio>datetime{space}hostname{space}message >It is up to the relay/collector to input the complete header. this is my understanding from the rfc too, but how do I get this using syslog-ng ? >I missed the beggining of this thread, is "%ACL_LOG-I-DENY" getting set >as your hostname? I had the same problem with solaris logs when the >"TAG" field had a space in it, so syslog-ng (correctly) thinks the first >part of the process name (in the "TAG") was the hostname. I wrote a >syslog proxy to overcome this, since I can't ask syslog-ng to stop >following standards. as said above, there is one space between date and message but according to the standard, there is no standard on how devices do send their messages >Perhaps syslog-ng can have a configuration setting where if it receives >a certain string in the hostname field, you can set keep-hostname to no >for just that message. That would save the day for me, but I don't know >how hard it would be to implement that. Well I would vote for getting a setting just the other way around, so for being able to configure something like options( addhostname(<pattern>) which would lead to the hostname being added if the pattern is matched and the pattern then being treated as part of the message. For me this just would be a '^%' as every message of the ssr is prepended with the percent sign ;-) still do not know how much work it would be but ..... BTW: I do not know how the linux syslog does it, but it does not have this problem. Maybe because '%' is not a valid char for hostnames. linux syslog is a pretty standard syslog I'd guess, though you could argue, wether this is correct according to the standard. Linux syslog displays the message above as: Jan 13 04:02:12 1.2.3.4 %ACL_LOG-I-DENY, ACL [280] on "rtfa" UDP 192.168.1.2:4721 -> 14.9.1.3:53 so it automagically adds the ip address to the message. Again maybe because of the '%' and ',' signs inside the string at the <hostname> position. >-- >Nate Campi <http://www.campin.net> GnuPG key: 0xC17AEF79 Kind regards, Patrick Hildenbrand > Patrick Hildenbrand > Operations & Technology > SAP Hosting AG & Co. KG > Raiffeisenring 45 > 68789 St. Leon-Rot, Germany > T +49/6227/7-66410 > F +49/6227/7-66301 > E patrick.hildenbrand(a)sap.com > http://www.saphosting.com >

3 3