- syslog-ng - lists.balabit.hu

Re: [syslog-ng]syslog-ng
by Michael Earls 15 Jan '02

15 Jan '02

I will make things very clear on what i am trying to do with syslog-ng,, i have 200 routers and i want them to all point to my syslog server, that is why i created a sep file for each router, how can i get them to log to a mysql databse, i have tried just loggin one ip to the databse useing sqlsyslogd tables but that did not work, what would be the best way for me to do this, and how do i do this, thanks michael >>> nate(a)campin.net 01/14/02 08:06PM >>> On Mon, Jan 14, 2002 at 07:48:35PM -0500, Michael Earls wrote: > sorry if i am missing something but I do not see that there, i see that u are logging to a host file, or are using sqlsyslog, i am looking for a way to take the statement for syslog-ng then pipe that into a database, Are you saying you only want to insert *certain* messages into the database? I really don't understand. I see now that my example syslog-ng.conf doesn't have an example line for using sqlsyslogd. If that's what you need, here you go: ---- destination sqlsyslogd { program("/usr/local/sbin/sqlsyslogd -u sqlsyslogd -t logs sqlsyslogd -p"); }; log { source(src); destination(sqlsyslogd); }; ---- "src" in this case is all the incoming messages, there's no filtering of messages. You still need to setup your database according to the instructions for sqlsyslogd. Read the docs that come with it. -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 "My computer's sick. I think my modem is a carrier." _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

how to make program destination
by David Monk 15 Jan '02

15 Jan '02

I am fairly new to central logging with syslog-ng and had a couple questions. I tried briefly looking to the mailing list archives, but I couldn't find any way to easily search it. I want to have some matched log entries from various hosts sent to the network admin staff. What would be most preferential is to have the source hostname in the subject line and the log message as the body. I defined the following: destination d_mail { program("mail -s \"Matched log entry from $HOST\" syslog); }; With this I DO get an email, but the $HOST macro is empty and the message body is also empty. Is there a better method? Or can anyone help with an example or two? Thanks, David Monk CCNA, MCSE david(a)purplebear.net

1 0

Re: [syslog-ng]syslog-ng
by Michael Earls 15 Jan '02

15 Jan '02

what do u think about this one, b/c i still can not get to to log to the mysql database, destination rrrouter { program("/usr/bin/mysql -u root -p -D rrrouter -t"); }; filter f_192.168.3.254 { host(192.168.3.254); }; log { source(net); filter(f_192.168.3.254); destination(rrrouter); }; thanks michael >>> nate(a)campin.net 01/14/02 20:16 PM >>> On Mon, Jan 14, 2002 at 07:48:35PM -0500, Michael Earls wrote: > sorry if i am missing something but I do not see that there, i see that u are logging to a host file, or are using sqlsyslog, i am looking for a way to take the statement for syslog-ng then pipe that into a database, Are you saying you only want to insert *certain* messages into the database? I really don't understand. I see now that my example syslog-ng.conf doesn't have an example line for using sqlsyslogd. If that's what you need, here you go: ---- destination sqlsyslogd { program("/usr/local/sbin/sqlsyslogd -u sqlsyslogd -t logs sqlsyslogd -p"); }; log { source(src); destination(sqlsyslogd); }; ---- "src" in this case is all the incoming messages, there's no filtering of messages. You still need to setup your database according to the instructions for sqlsyslogd. Read the docs that come with it. -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 "My computer's sick. I think my modem is a carrier." _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: [syslog-ng]syslog-ng
by Michael Earls 15 Jan '02

15 Jan '02

Ok -- this is what i came up with ,, i am able to get syslog-ng to run b/c it does like like "program" thats if i am correct. destination rrouter { program("/usr/bin/mysql -u root -D rrrouter -t -p")}; filter f_192.168.3.254 { host(192.168.3.254); }; log { source(net); filter(f_192.168.3.254); destination(rrrouter); }; thanks michael >>> nate(a)campin.net 01/14/02 20:16 PM >>> On Mon, Jan 14, 2002 at 07:48:35PM -0500, Michael Earls wrote: > sorry if i am missing something but I do not see that there, i see that u are logging to a host file, or are using sqlsyslog, i am looking for a way to take the statement for syslog-ng then pipe that into a database, Are you saying you only want to insert *certain* messages into the database? I really don't understand. I see now that my example syslog-ng.conf doesn't have an example line for using sqlsyslogd. If that's what you need, here you go: ---- destination sqlsyslogd { program("/usr/local/sbin/sqlsyslogd -u sqlsyslogd -t logs sqlsyslogd -p"); }; log { source(src); destination(sqlsyslogd); }; ---- "src" in this case is all the incoming messages, there's no filtering of messages. You still need to setup your database according to the instructions for sqlsyslogd. Read the docs that come with it. -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 "My computer's sick. I think my modem is a carrier." _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: [syslog-ng]syslog-ng
by Michael Earls 15 Jan '02

15 Jan '02

so u are saying that i can write something like this ## tking switch 192.168.3.254 destination 192.168.3.254 {program("/usr/bin/mysql -u sysloguser -t logs 192.168.3.254 -p")}; filter f_192.168.3.254 { host(192.168.3.254); }; log { source(net); filter(f_192.168.3.254); destination(192.168.3.254); }; the databse is logs and the table is 192.168.3.254, am i correct, thanks michael >>> Nate Campi <nate(a)campin.net> 01/14/02 20:07 PM >>> On Mon, Jan 14, 2002 at 07:48:35PM -0500, Michael Earls wrote: > sorry if i am missing something but I do not see that there, i see that u are logging to a host file, or are using sqlsyslog, i am looking for a way to take the statement for syslog-ng then pipe that into a database, Are you saying you only want to insert *certain* messages into the database? I really don't understand. I see now that my example syslog-ng.conf doesn't have an example line for using sqlsyslogd. If that's what you need, here you go: ---- destination sqlsyslogd { program("/usr/local/sbin/sqlsyslogd -u sqlsyslogd -t logs sqlsyslogd -p"); }; log { source(src); destination(sqlsyslogd); }; ---- "src" in this case is all the incoming messages, there's no filtering of messages. You still need to setup your database according to the instructions for sqlsyslogd. Read the docs that come with it. -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 "My computer's sick. I think my modem is a carrier."

1 0

Re: [syslog-ng]syslog-ng
by Nate Campi 15 Jan '02

15 Jan '02

On Mon, Jan 14, 2002 at 07:48:35PM -0500, Michael Earls wrote: > sorry if i am missing something but I do not see that there, i see that u are logging to a host file, or are using sqlsyslog, i am looking for a way to take the statement for syslog-ng then pipe that into a database, Are you saying you only want to insert *certain* messages into the database? I really don't understand. I see now that my example syslog-ng.conf doesn't have an example line for using sqlsyslogd. If that's what you need, here you go: ---- destination sqlsyslogd { program("/usr/local/sbin/sqlsyslogd -u sqlsyslogd -t logs sqlsyslogd -p"); }; log { source(src); destination(sqlsyslogd); }; ---- "src" in this case is all the incoming messages, there's no filtering of messages. You still need to setup your database according to the instructions for sqlsyslogd. Read the docs that come with it. -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 "My computer's sick. I think my modem is a carrier."

1 0

Re: [syslog-ng]syslog-ng
by Michael Earls 15 Jan '02

15 Jan '02

sorry if i am missing something but I do not see that there, i see that u are logging to a host file, or are using sqlsyslog, i am looking for a way to take the statement for syslog-ng then pipe that into a database, do u have an example syslog-ng file and mysql database? mearls >>> nate(a)campin.net 01/14/02 17:57 PM >>> On Mon, Jan 14, 2002 at 04:49:46PM -0500, Michael Earls wrote: > Hi -- i am new here, and was not sure if this has been posted > > i am trying to use syslog-ng to log to a mysql datase, i was told that i could pipe or use program, but i do not know how to, > > my syslog-ng file is very basic, i am adding lines to create sep files like this for each router, is there a way to just pipe this to a mysql database. I put up some pointers on this stuff at http://www.campin.net/newlogcheck.html -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 "Whom computers would destroy, they must first drive mad." -Anon. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: [syslog-ng]syslog-ng
by Michael Earls 15 Jan '02

15 Jan '02

sorry if i am missing something but I do not see that there, i see that u are logging to a host file, or are using sqlsyslog, i am looking for a way to take the statement for syslog-ng then pipe that into a database, do u have an example syslog-ng file and mysql database? mearls >>> nate(a)campin.net 01/14/02 17:57 PM >>> On Mon, Jan 14, 2002 at 04:49:46PM -0500, Michael Earls wrote: > Hi -- i am new here, and was not sure if this has been posted > > i am trying to use syslog-ng to log to a mysql datase, i was told that i could pipe or use program, but i do not know how to, > > my syslog-ng file is very basic, i am adding lines to create sep files like this for each router, is there a way to just pipe this to a mysql database. I put up some pointers on this stuff at http://www.campin.net/newlogcheck.html -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 "Whom computers would destroy, they must first drive mad." -Anon. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

syslog-ng
by Michael Earls 14 Jan '02

14 Jan '02

Hi -- i am new here, and was not sure if this has been posted i am trying to use syslog-ng to log to a mysql datase, i was told that i could pipe or use program, but i do not know how to, my syslog-ng file is very basic, i am adding lines to create sep files like this for each router, is there a way to just pipe this to a mysql database. ### ### 7206-core ### destination 192.168.1.245 { file("/var/log/routers/7206-core.log"); }; filter f_192.168.1.245 { host(192.168.1.245); }; log { source(net); filter(f_192.168.1.245); destination(192.168.1.245); }; ## main router destination 192.168.1.1 { file("/var/log/routers/main-rr.log"); }; filter f_192.168.1.1 { host(192.168.1.1); }; log { source(net); filter(f_192.168.1.1); destination(192.168.1.1); }; ## switch 192.168.1.254 destination 192.168.1.254 { file("/var/log/routers/michaeleaarls-switch.log"); }; filter f_192.168.1.254 { host(192.168.1.254); }; log { source(net); filter(f_192.168.1.254); destination(192.168.1.254); }; ### ### this should work... ### ## tony kings router destination 192.168.3.1 { file("/var/log/routers/tking-main.log"); }; filter f_192.168.3.1 { host(192.168.3.1); }; log { source(net); filter(f_192.168.3.1); destination(192.168.3.1); }; ## tking switch 192.168.3.254 destination 192.168.3.254 { file("/var/log/routers/tking-switch.log"); }; filter f_192.168.3.254 { host(192.168.3.254); }; log { source(net); filter(f_192.168.3.254); destination(192.168.3.254); };

2 1

syslog-ng mistreating data as part of the hostname ?
by Hildenbrand, Patrick 14 Jan '02

14 Jan '02

Hi everybody, getting logs from cabeltron ssr's into syslog-ng, we've some trouble. The data sent (the was syslog will fromat it) is like the line below: Jan 13 04:02:12 loghost %ACL_LOG-I-DENY, ACL [280] on "rtfa" UDP 192.168.1.2:4721 -> 14.9.1.3:53 using options keep_hostname(no); long_hostnames(no); chain_hostnames(on) syslog-ng presents us: Jan 13 04:02:12 %ACL_LOG-I-DENY,/loghost ACL [280] on "rtfa" UDP 192.168.1.2:4721 -> 14.9.1.3:53 changing chain_hostnames to off, we even get: Jan 13 04:02:12 loghost ACL [280] on "rtfa" UDP 192.168.1.2:4721 -> 14.9.1.3:53 so the important part about what happend to the router is lost (all messages on the cabletron routers are formatted like this). It appears to me as if syslog-ng while parsing adds the first value of the message to the hostname. Is there some configuration setting to disable this ? BTW: this is using 1.4.11 as well as with 1.5.13 Kind regards, Patrick Hildenbrand

1 0