- syslog-ng - lists.balabit.hu

Sudo logging
by Chuck Kelly 09 Jan '02

09 Jan '02

I can't seem to get sudo logs logging properly. Would like each host to log to sudo.log instead of local2. /var/log/syslog-ng/$HOST/sudo.log Anyone have any examples of how they did it? -- Chuck

2 1

logging to a central server
by Stephen C Burns 08 Jan '02

08 Jan '02

Hey all, Excuse the ignorance, first of all. I have always just used syslog/syslog-ng as logging sources on local machines, I've yet to use the network functionality. How exactly would one configure a host, so that it sends all logs to a central syslog-ng machine? I am using linux, I assume that I would just change the unix-stream to an IP address, or something of the source? Thanks in advance everyone.

3 2

no logging after HUP (1.5.13)
by Arnold Pulleman 05 Jan '02

05 Jan '02

Because of the template feature I want to use syslog-ng 1.5 on a FreeBSD 4.2 and 4.3 platform. While testing 1.5.13 I found a problem when sending a hangup signal to syslog-ng. The restart message is shown but nothing follows until syslog-ng is stopped and started again. My question is how to solve this problem? The following output of the messages file appeared: Oct 30 11:06:49 humble syslog-ng[5018]: syslog-ng version 1.5.13 starting Oct 30 11:08:56 humble su: BAD SU user to root on /dev/ttyp7 Oct 30 11:09:28 humble su: user to root on /dev/ttyp7 Oct 30 11:16:49 humble syslog-ng[5018]: STATS: dropped 0 Oct 30 11:25:09 humble su: BAD SU user to root on /dev/ttyp7 Oct 30 11:26:05 humble su: user to root on /dev/ttyp3 Oct 30 11:26:49 humble syslog-ng[5018]: STATS: dropped 0 Oct 30 11:27:00 humble syslog-ng[5018]: SIGHUP received, restarting syslog-ng Oct 30 11:35:36 humble syslog-ng[5109]: syslog-ng version 1.5.13 starting Oct 30 11:35:49 humble syslog-ng[5109]: SIGHUP received, restarting syslog-ng

4 6

Messages from AIX 4.3.2 syslog always 'forwarded'
by Douwe Dijkstra 04 Jan '02

04 Jan '02

Hi there! I just installed syslog-ng on a central loghost and it seems to think that messages from AIX systems are 'forwarded'. Messages from AIX machines look like: Jan 4 10:00:20 pg forwarded from pg: Messages from Solaris machines look like: Jan 3 17:16:41 mailhost sshd[1386]: What is wrong here? FYI: Using syslog-ng 1.4.14 on Solarix x86 8.0, AIX client machines are 4.3.2, Solaris client machines are x86 7.0 or 8.0. All machines are in the loghost host file. Douwe

2 1

AW: [syslog-ng]Messages from AIX 4.3.2 syslog always 'forwarded'
by Sippel, Christian 04 Jan '02

04 Jan '02

Hi Douwe, I'm not that shure about it but you could try options { chain_hostnames(no); }; in the syslog-ng.conf file, I think I solved the problem with this. Hope this helps, Regards, Christian > ---------- > Von: Douwe Dijkstra[SMTP:Douwe.Dijkstra@i-pay.com] > Antwort an: syslog-ng(a)lists.balabit.hu > Gesendet: Freitag, 4. Januar 2002 14:03 > An: syslog-ng(a)lists.balabit.hu > Betreff: [syslog-ng]Messages from AIX 4.3.2 syslog always 'forwarded' > > Hi there! > > I just installed syslog-ng on a central loghost and it seems to think that > messages from AIX systems are 'forwarded'. > > Messages from AIX machines look like: > Jan 4 10:00:20 pg forwarded from pg: > > Messages from Solaris machines look like: > Jan 3 17:16:41 mailhost sshd[1386]: > > What is wrong here? > > FYI: Using syslog-ng 1.4.14 on Solarix x86 8.0, AIX client machines are > 4.3.2, Solaris client machines are x86 7.0 or 8.0. > All machines are in the loghost host file. > > Douwe > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

1 0

RE: [syslog-ng]help
by Nicholas Berry 02 Jan '02

02 Jan '02

Here is an example script that I'm using for Solaris: ---SOF #!/bin/sh # syslog-ng start|stop|restart script USAGE="Usage: `basename $0` start|stop|restart" CFG="/usr/local/etc/syslog-ng.conf" PATH="/usr/bin:/usr/local/bin:/usr/sbin:/usr/local/sbin" LD_LIBRARY_PATH="/usr/lib:/usr/local/lib:/usr/local/ssl/lib" export LD_LIBRARY_PATH PATH case "$1" in 'start') if [ -f $CFG ]; then echo "Starting syslog-ng: " mount /syslog syslog-ng else echo "-syslog-ng failed! Missing configuration file." fi ;; 'stop') echo "Stopping syslog-ng: " pkill -x -u 0 syslog-ng rm /var/run/syslog-ng.pid 1>&2 echo "done." ;; 'restart') $0 stop $0 start ;; *) echo $USAGE 1>&2 exit 1 esac ---EOF Things you might want to change: 1. If you're not using Solaris, LD_LIBRARY_PATH is not needed 2. pkill is another Solaris specific reference, and can be replaced with "kill -9 `cat /var/run/syslog-ng.pid`" 3. If your syslog-ng.conf is located elsewhere, update the CFG variable. In order to have this start on (re)boot, place in your default run-level directory (most linux distros use /etc/rc?.d, redhat uses /etc/rc.d/rc?.d - rc3.d is most commonly the default). Name the file S99syslog-ng (the 99 can change to whatever you like). Hope that answers your question. Thanks, Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. 2710 Gateway Oaks Dr., Suite 300 South Sacramento, CA 95833 Phone: 916.286.4048 Fax: 916.921.4148 E-mail: nberry(a)ragingwire.com www.ragingwire.com -----Original Message----- From: Nocentino, Anthony [mailto:anocentino@cardioworks.net] Sent: Wednesday, October 10, 2001 10:22 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]help how do i config syslog-ng to start up automatically on boot _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]help
by Ohrberg, Mick 02 Jan '02

02 Jan '02

...or as an alternative, locate your /etc/rc2.d directory and put a file in there that's tied to /usr/local/sbin/syslog-ng and specify configfile. :) > -----Original Message----- > From: jamie rishaw [mailto:jamie@playboy.com] > Sent: Wednesday, January 02, 2002 9:16 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]help > > > On Wed, Oct 10, 2001 at 12:21:55PM -0500, Nocentino, Anthony wrote: > > how do i config syslog-ng to start up automatically on boot > > 1) You configure your workstation to be in the correct year. > 2) You install the auto boot dll. :) > 3) UNIX for dummies; you're trying to change out the onboard > sensors when > you apparently don't know how to even start the engine .. > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

1 0

help
by Nocentino, Anthony 02 Jan '02

02 Jan '02

how do i config syslog-ng to start up automatically on boot

2 1

problems with file template directive
by Nathan Rawling 02 Jan '02

02 Jan '02

I'm attempted to use the template() option to specify the file format for a file destination, and I keep getting the error: parse error at 12 ...which isn't too helpful. Here is my syslog-ng.conf file: > > log { source(src); destination(all); }; > > source src { > udp(); > tcp(); > sun-streams("/dev/log" door("/etc/.syslog_door")); > internal(); > }; > > destination all { > file("/var/log/template" template("$FACILITY $PRIORITY $ISODATE $FULLHOST $PROGRAM $MESSAGE")); > file("/var/log/messages"); > }; Can anybody tell me what I'm doing wrong? I tried looking at the source code to figure out what was wrong, but I don't have any experience with yacc. Also, it would be useful if the template() directive could be used with the program() or pipe() destinations for what I'm working on. Perhaps I'll try and dig through the code to see how hard it would be to add that. Thanks in advance! Nathan

2 1

RE: [syslog-ng]What are the installation requirements???-<<New er ror>>>
by Ohrberg, Mick 02 Jan '02

02 Jan '02

Krishna, You need to set your LD_LIBRARY_PATH to include the path to wherever your libol libs are installed, as well as specify the include:s path to /usr/local/include (most likely) at compilation time. /Mick > -----Original Message----- > From: Krishna [mailto:krishna_shekhar@gmx.net] > Sent: Saturday, December 29, 2001 4:13 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]What are the installation > requirements???-<<New > error>>> > > > Hi, > I have already installed libol. > > regards > Krishna Shekhar > Network Administrator > Wiplash.com > ----- Original Message ----- > From: "Balazs Scheidler" <bazsi(a)balabit.hu> > To: <syslog-ng(a)lists.balabit.hu> > Sent: Saturday, December 29, 2001 2:55 PM > Subject: Re: [syslog-ng]What are the installation > requirements???-<<New > error>>> > > > > On Sat, Dec 29, 2001 at 02:37:22PM +0530, Krishna wrote: > > > Hi, > > > I got flex and bison installed. But after doing > make install I > got > > > the following errors > > > > install libol (also found at > http://www.balabit.hu/en/downloads/syslog-ng/) > > > > -- > > Bazsi > > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 > 9CFD 804E C82C > 8EB1 > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

1 0