- syslog-ng - lists.balabit.hu

Documentation/manual etc..
by bretwatson＠charteredsemi.com 08 Nov '01

08 Nov '01

Hi All, I'm looking to have a go at a configuration manual for Syslog-ng.. the reason being that the current one sucks (sorry, but true).. It will be for teh stable branch only For starters I'm pulling variables from the c code... so here are the globals.. chain_hostnames keep_hostname mark_freq sync_freq time_reopen time_reap log_fifo_size use_time_recvd use_fqdn use_dns create_dirs uid gid perm dir_uid dir_gid dir_perm gc_busy_threshold gc_idle_threshold Can someone tell me what inputs these configs take and what their function is? - some are in the docs, but some (like create_dirs) are not... I'll post to this list as it comes together... Cheers, Bret

2 1

link error
by Holger.Woehle＠arcor.net 06 Nov '01

06 Nov '01

Hello, i want to compile syslog-ng under linux kernel 2.4.13 glibc 2.2.4 . After ./configure, i get following error running make: make[3]: Entering directory `/usr/src/syslog-ng-1.4.14/src' gcc -O2 -Wall -I/usr/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o utils.o syslog-names.o /usr/lib/libol.a -lnsl cfg-lex.o: In function `yylex': cfg-lex.o(.text+0x4ae): undefined reference to `yywrap' cfg-lex.o: In function `input': cfg-lex.o(.text+0xa28): undefined reference to `yywrap' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 make[2]: *** [all-recursive] Error 1 make[1]: *** [all-recursive-am] Error 2 make: *** [all-recursive] Error 1 anonybody a idea where the bug sits ? with regards cu Holgi

2 1

syslog-ng messages sent to outside prog
by Nate Campi 06 Nov '01

06 Nov '01

I setup a match line to match the string "attackalert" from portsentry, and I pipe this off to a script that mails it to me. This works great, but I get emails with "<29>" prepended to it. Example: <29>Nov 5 12:46:37 skitzo portsentry[121]: attackalert: Host 209.202.221.43 has been blocked via dropped route using command: "/usr/local/sbin/iptables -I INPUT -s 209.202.221.43 -j DROP" I just setup sqlsyslogd to output to a mysql database from a program() destination, and it prepends the <29> to the messages sent there as well. I checked out http://www.ietf.org/rfc/rfc3164.txt and it looks like this is a priority. How can I keep this from showing up in the output? I hacked sqlsyslogd to print the string from 4 chars into the timestamp, so my mysql inputs are clean, but what do I do to clean up the mail? -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79

4 6

RE: [syslog-ng]syslog-ng messages sent to outside prog
by Robert Glad 06 Nov '01

06 Nov '01

Relax man, this is not one of those eLiTe-BBSes in the early nineties.. ;) Robert -----Original Message----- From: Snortball [mailto:snortball@hotmail.com] Sent: den 6 november 2001 16:53 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng messages sent to outside prog I'M VERY VERY SORRY! This was supposed to go to the sender, not the list....I promise I'll stop being stupid.... ----- Original Message ----- From: "Snortball" <snortball(a)hotmail.com> To: <syslog-ng(a)lists.balabit.hu> Sent: Tuesday, November 06, 2001 9:25 AM Subject: Re: [syslog-ng]syslog-ng messages sent to outside prog > Hi, > > Is there any chance that I can get a copy of your mail script? I can't seem > to get one to work. Yes, I'm a newbie.....but I'm trying! > > Thanks, > > Sb > ----- Original Message ----- > From: "Nate Campi" <nate(a)campin.net> > To: <syslog-ng(a)lists.balabit.hu> > Sent: Monday, November 05, 2001 6:03 PM > Subject: [syslog-ng]syslog-ng messages sent to outside prog > > > > I setup a match line to match the string "attackalert" from portsentry, > > and I pipe this off to a script that mails it to me. > > > > This works great, but I get emails with "<29>" prepended to it. Example: > > > > <29>Nov 5 12:46:37 skitzo portsentry[121]: attackalert: Host > > 209.202.221.43 has been blocked via dropped route using command: > > "/usr/local/sbin/iptables -I INPUT -s 209.202.221.43 -j > > DROP" > > > > I just setup sqlsyslogd to output to a mysql database from a program() > > destination, and it prepends the <29> to the messages sent there as > > well. > > > > I checked out http://www.ietf.org/rfc/rfc3164.txt and it looks like this > > is a priority. How can I keep this from showing up in the output? I > > hacked sqlsyslogd to print the string from 4 chars into the timestamp, > > so my mysql inputs are clean, but what do I do to clean up the mail? > > -- > > Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 > > Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79 > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

NEWBIE question: Email as destination
by Snortball 05 Nov '01

05 Nov '01

Hello all, Sorry if this has already been covered, but I can't find the answer in any docs. I am trying to have syslog-ng send certain syslog messages via email so that I don't have to bother with a log watcher like swatch, etc. I tried different combinations of: destination email { pipe("/bin/mail"); }; But that just overwrote the mail bianry (not fun). Any advice? TIA Sb

2 2

syslog-ng and Cisco boxes
by Brian D. Olesen 05 Nov '01

05 Nov '01

I am in the process of setting up a syslog server for a large number of Cisco boxes, and have faced some difficulties which may be due to an error in syslog-ng 1.4.13 on Solaris 8 regarding the source statement. source net { udp(); }; As far as I can understand from the documentation, this ought to listen to all incoming udp packets on port 514. Contrary to the documentation, I never got this to work at all. I even tried to stop the native syslogd, but to no avail. source net { udp(ip("xxx.xxx.xxx.22") port(514)); }; Stating the service ip address and syslog port works perfectly. On the Cisco IOS side, it took me some time to realize that logging source-interface Ethernet0 is essential to do remote logging. This is the interface with the ip address which have access to the remote syslog host. Other experiences, especially best practices, with syslog-ng and Cisco boxes are greatly appreciated. Best regards, Brian D. Olesen UNIX Administrator Orange DK

6 6

issues using NOT in an filter.
by Matthew Schumacher 05 Nov '01

05 Nov '01

Hello all, I can't seem to figure this out. I want to log level(info) and facility(authpriv) to my messages file, but I don't want to see facility(local4). Now some of the facility(local4) messages are level(info) but I still don't want them. Anyway, I was trying something like this and it doesn't work: filter f_messages { (level(info) or facility(authpriv)) not facility(local4); }; I tried using () to clean it up and that doesn't work. In all of the combinations I tried it simply will not parse the config file with NOT in the filter unless I put an and in front of it like this: "and not" Anyone have a sec to help me out with this? Thanks, schu

2 1

RE: [syslog-ng]question about flags + fix to compile under solaris (PATH_SYSCONFDIRprob)
by Nicholas Berry 02 Nov '01

02 Nov '01

I have also noticed this problem with PATH_SYSCONFDIR in src/config.h. After running the configure script, PATH_SYSCONFDIR is defined in src/config.h, but when running `make`, something (perhaps autoconf) removes PATH_SYSCONFDIR from src/config.h and causes the compile to fail. After re-adding '#define PATH_SYSCONDIR "/usr/local/etc/syslog-ng"' back into src/config.h, everything compiles fine. Also, defining "--sysconfdir=<alternate dir>" when running the configure script is not reflected in src/config.h I'm using autoconf 2.13, automake 1.4, make 3.79, m4 1.4, and gcc 2.95.3 all under Solar 8 SPARC. Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. 2710 Gateway Oaks Dr., Suite 300 South Sacramento, CA 95833 Phone: 916.286.4048 Fax: 916.921.4148 E-mail: nberry(a)ragingwire.com www.ragingwire.com -----Original Message----- From: Asher Yanich [mailto:ayanic01@cs.fiu.edu] Sent: Friday, November 02, 2001 9:41 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]question about flags + fix to compile under solaris (PATH_SYSCONFDIRprob) I am currently running syslog-ng 1.5.7 and using the DEFAULT keyword. I see that this is removed from the newer 1.5.x releases in favor of flags. I cant seem to find any documentation on the syntax or usage. Can someone help me out? Also, I had not been able to compile any syslog-ng 1.5.x releases for awhile, I finally fixed the compilation problem. --- syslog-ng.h Wed Jul 25 05:20:53 2001 +++ /depot/syslog-ng/src/syslog-ng-1.5.13/src/syslog-ng.h Fri Nov 2 11:42:39 2001 @@ -34,7 +34,7 @@ #define PATH_SYSLOG_NG_CONF "syslog-ng.conf" #define PATH_PIDFILE "syslog-ng.pid" #else -#define PATH_SYSLOG_NG_CONF PATH_SYSCONFDIR "/syslog-ng.conf" +#define PATH_SYSLOG_NG_CONF "/syslog-ng.conf" #define PATH_PIDFILE "/var/run/syslog-ng.pid" #endif -asher yanich _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

question about flags + fix to compile under solaris (PATH_SYSCONFDIR prob)
by Asher Yanich 02 Nov '01

02 Nov '01

I am currently running syslog-ng 1.5.7 and using the DEFAULT keyword. I see that this is removed from the newer 1.5.x releases in favor of flags. I cant seem to find any documentation on the syntax or usage. Can someone help me out? Also, I had not been able to compile any syslog-ng 1.5.x releases for awhile, I finally fixed the compilation problem. --- syslog-ng.h Wed Jul 25 05:20:53 2001 +++ /depot/syslog-ng/src/syslog-ng-1.5.13/src/syslog-ng.h Fri Nov 2 11:42:39 2001 @@ -34,7 +34,7 @@ #define PATH_SYSLOG_NG_CONF "syslog-ng.conf" #define PATH_PIDFILE "syslog-ng.pid" #else -#define PATH_SYSLOG_NG_CONF PATH_SYSCONFDIR "/syslog-ng.conf" +#define PATH_SYSLOG_NG_CONF "/syslog-ng.conf" #define PATH_PIDFILE "/var/run/syslog-ng.pid" #endif -asher yanich

1 0

syslog record size limitation?
by Ed.Schernau＠guardent.com 02 Nov '01

02 Nov '01

Hello all, Solaris 8. I'm logging some rather long text entries via TCP, and they are getting chopped off at 1024 characters. Is this a limitation of syslog-ng itself, or Solaris native syslog? Any help appreciated. Ed

1 0