- syslog-ng - lists.balabit.hu

Syslog 1.4.12, Solaris 8-x86: Too few arguments...
by Sander 17 Jul '01

17 Jul '01

I'm trying to compile syslog-ng 1.4.12 using gcc-2.95.3 and receive this error: gcc -DHAVE_CONFIG_H -I. -I/v/src/syslog-ng-1.4.12/src -I. -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c afstreams.c afstreams.c: In function `io_stream_get': afstreams.c:167: too few arguments to function `init_file' *** Error code 1 make: Fatal error: Command failed for target `afstreams.o' Current working directory /v/src/syslog-ng-1.4.12/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /v/src/syslog-ng-1.4.12/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /v/src/syslog-ng-1.4.12/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Anyone seen this before? Sander P.S.: Another minor point (just a warning), gcc also complains about this: gcc -DHAVE_CONFIG_H -I. -I/v/src/syslog-ng-1.4.12/src -I. -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c log.c log.c: In function `parse_log_msg': log.c:58: warning: subscript has type `char'

3 2

syslog binary error
by Ravi Malghan 16 Jul '01

16 Jul '01

Hello: I created a pkg (using pkgmk, pkgtrans) for syslog1.4.11 for solaris 7. I installed it on another solaris machine. It seems to be running normal, where syslog messages are passed from source to desitnation etc. But when I start the syslog-ng it outputs the string "Terminated". But the syslog is still running in the background. I donot get this error on the machine where I compiled the source code. Anybody noticed this? Thanks Ravi __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/

1 0

RE: [syslog-ng]some basic questions syslog-ng
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 16 Jul '01

16 Jul '01

Ravi, Well, you are close but not quite there. When you set up a network source such as tcp or udp you are merely setting up a socket on which the server listens. It doesn't listen for a particular host. You set the server up to receive from a source and then you have your client log to that ip/port on the server. For example: source s_tcp { tcp(ip(192.168.1.1) port(2222)); }; This will cause syslog-ng to listen for log messages on the interface with 192.168.1.1 ip address and port number 2222. It doesn't matter where the messages is coming from. That is handled with the filters: filter f_host10 { host("192.168.10.1"); }; This will filter out the host with the ip address of 192.168.10.1. Then to log the remote host to the server you would use this line in your server: log { source(s_tcp); filter(f_host10); destination(d_host10); }; where d_host10 is a destination which the definition is not shown here. Hope this helps. Regards, Drew -----Original Message----- From: Ravi Malghan [mailto:rmalghan@yahoo.com] Sent: Friday, July 13, 2001 5:25 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]some basic questions syslog-ng So if I want to accept syslog messages on syslog-ng server X/port: 1111 from host 192.168.1.1, port: 2222 and host 192.168.10.1, port: 2222. I will have the following on server X source host10 {tcp(ip(192.168.1.1) port(2222); tcp(ip(192.168.10.1) port(2222); }; destination host10logs { file("/var/adm/host10.log" compress(on) sync(0); }; log {source(host10);destination(host10logs); }; Is this correct? I will similarly set the destination on the client machines to have destination {tcp(ip(server X) port (1111);} What does filter host10 {host("192.168.1.1"); }; give me ? Thanks Ravi --- "Hamilton, Andrew Mr RAYTHEON 5 SIG CMD" <HamiltonA(a)hq.5sigcmd.army.mil> wrote: > 1. The client syslog-ng makes a TCP connection to > the server which is > listening for a TCP request. > 2. Standard syslog is UDP and doesn't do TCP. You > have to have syslog-ng on > both the client and the server. > 3. The port is the same as the UDP port, 514. You > can have both types on > the same port. Yes you do have control over it. > You can change the source > port on the server and change the destination port > on the client. > > Regards, > Drew > -----Original Message----- > From: Ravi Malghan [mailto:rmalghan@yahoo.com] > Sent: Thursday, July 12, 2001 9:58 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]some basic questions syslog-ng > > > Hi I have few basic questions about syslog-ng. If > somebody can give me answers or give me some > pointers. > I am using syslog-ng to log syslog messages from a > client to server and a firewall between them. > 1. How is the sysloging TCP instead of UDP? Is this > something the syslog-ng needs to be configured. > 2. The client which initiates the syslog logging, is > this normal syslog client? or do I need to install > syslog-ng there too? > 3.When it uses TCP, which port does it use? Does the > user have control over the port number? > > Thanks in advance > Ravi > > > __________________________________________________ > Do You Yahoo!? > Get personalized email addresses from Yahoo! Mail > http://personal.mail.yahoo.com/ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 2

pulling data from a file
by Matt Okeson-Harlow 13 Jul '01

13 Jul '01

i have a question about syslog-ng and it's ability to pull from a non syslog file, i have a cisco network registrar dhcp server that is looking to /var/nwreg2/logs/name_dhcp_1_log (standard location) on Solaris 2.7 however when i have a source of source cnr { file("/var/nwreg2/logs/name_dhcp_1_log"); }; nothing gets logged, i did some reading it seems people have tried using logger to get to these kind of log files (tail -f | logger) however either i am missing something or it does not work here, anyone have any ideas? btw, syslog-ng when it starts up gives a EOF error which i am assuming is because it is expecting the file to never end. any ideas that anyone has would be appreciated -- matt okeson-harlow matt at technomage.net http://www.technomage.net ($do || !$do) && undef($try) ; # Master of Perl, Yoda is. Hmmmm? http://shellforce.com <- shell accounts - web hosting -> http://cyberius.net send icbm here =--> 43°3'11'N-89°28'52"W

4 4

anybody have syslog-ng binary?
by Ravi Malghan 13 Jul '01

13 Jul '01

Hi: Does anybody have syslog-ng binary to run on Solaris 2.7? If yes, could you please share it Thanks Ravi __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/

1 0

RE: [syslog-ng]some basic questions syslog-ng
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 13 Jul '01

13 Jul '01

1. The client syslog-ng makes a TCP connection to the server which is listening for a TCP request. 2. Standard syslog is UDP and doesn't do TCP. You have to have syslog-ng on both the client and the server. 3. The port is the same as the UDP port, 514. You can have both types on the same port. Yes you do have control over it. You can change the source port on the server and change the destination port on the client. Regards, Drew -----Original Message----- From: Ravi Malghan [mailto:rmalghan@yahoo.com] Sent: Thursday, July 12, 2001 9:58 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]some basic questions syslog-ng Hi I have few basic questions about syslog-ng. If somebody can give me answers or give me some pointers. I am using syslog-ng to log syslog messages from a client to server and a firewall between them. 1. How is the sysloging TCP instead of UDP? Is this something the syslog-ng needs to be configured. 2. The client which initiates the syslog logging, is this normal syslog client? or do I need to install syslog-ng there too? 3.When it uses TCP, which port does it use? Does the user have control over the port number? Thanks in advance Ravi __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

filter(DEFAULT); not working?
by Volker Apelt 13 Jul '01

13 Jul '01

Hallo, I tried to use the filter(DEFAULT); expression but failed. Entries like <<datum>> www imapd[27520]: open: user va opened INBOX.misc.Tipps-und-Tricks <<datum>> www imapd[27520]: open: user va opened INBOX.OS.Netware.Tools <<datum>> www imapd[27520]: open: user va opened INBOX.Abfall <<datum>> www imapd[27555]: login: apelt-pc.in-house[192.168.51.2] va plaintext <<datum>> www imapd[27555]: seen_db: user va opened /var/imap/user/v/va.seen <<datum>> www imapd[27555]: open: user va opened user.va.Listen.SuSE.Security go to the default destination, too, although they have been written to some other destination already _and_ are explicitly excluded in the DEFAULT expression. Here is the log expression, which is responsible for the mysterious filter results. #all, not yet handled, should be low traffic log { source(src); filter(l_warn_or_worse); filter(F_not_mail); filter(F_not_news); filter(F_not_syslog); filter(f_not_kommunikation); filter(DEFAULT); destination(daemon); }; Is this a case of docu missinterpretation ? I have appended a shortend version of my syslog-ng.conf file a below. Thanks Volker Apelt -- Volker Apelt Group of Prof. Dr. Ch. Griesinger Dipl. Chem. Johann Wolfgang Goethe Universität +49 6172 31126 Frankfurt am Main, Germany va .@. org.chemie.uni-frankfurt.de (remove the dots, please) ###### part of syslog-ng.conf options { long_hostnames(off); sync(0); }; source src { unix-stream("/dev/log"); file("/proc/kmsg"); unix-stream("/cache/chroot/named/dev/log"); internal(); }; destination daemon { file("/var/log/daemon"); }; destination mailstore_info { file("/var/log/mail/mail_store.info"); }; destination mailstore_warn { file("/var/log/mail/mail_store.warn"); }; destination mailstore_err { file("/var/log/mail/mail_store.err"); }; filter F_news { facility(news); }; filter F_not_mail { not facility(mail); }; filter F_not_user { not facility(user); }; filter F_not_news { not facility(news); }; ### Levels # debug, info, notice, warning, err, crit, alert, emerg filter l_debug { level(debug); }; filter l_debug_or_worse { level(debug..emerg); }; filter l_info { level(info); }; filter l_info_or_worse { level(info..emerg); }; filter l_normal { level(info..notice); }; filter l_not_debug { level(info..emerg); }; filter l_notice { level(notice); }; filter l_notice_or_worse { level(notice..emerg); }; filter l_warn { level(warn); }; filter l_warn_or_worse { level(warn..emerg); }; filter l_err { level(err); }; filter l_err_or_worse { level(err..emerg); }; filter l_crit { level(crit); }; filter l_crit_or_worse { level(crit..emerg); }; filter l_alert { level(alert); }; filter l_alert_or_worse { level(alert..emerg); }; filter l_emergency { level(emerg); }; filter f_mailstore { not program("postfix.*") and ( program("imapd.*") or program("imap.*") or program("popper.*") or program("procmail.*") ) ; }; filter f_not_kommunikation { not program("imap.*") and not program("imapd.*") and not program("leafnode.*") and not program("mailfw.*") and not program("popper.*") and not program("postfix.*") and not program("procmail.*") and not program("qmgr.*") and not program("sendmail.*") and not program("test_filter.*") and not program("fetchnews") and not program("imapd.*") and not program("postfix.*") and not program("texpire"); }; # # a lot of other log {}; destinations .. # ## mail store server log { source(src); filter(F_mail);filter(f_mailstore); filter(l_debug_or_worse); destination(dev_null);}; log { source(src); filter(F_mail);filter(f_mailstore); filter(l_normal); destination(mailstore_info);}; log { source(src); filter(F_mail);filter(f_mailstore); filter(l_warn_or_worse); destination(mailstore_warn);}; log { source(src); filter(F_mail);filter(f_mailstore); filter(l_err_or_worse); destination(mailstore_err);}; #all, not yet handled, should be low traffic log { source(src); filter(l_warn_or_worse); filter(F_not_mail); filter(F_not_news); filter(F_not_syslog); filter(f_not_kommunikation); filter(DEFAULT); destination(daemon); };

1 0

config file problem in 1.5.8
by Balazs Scheidler 13 Jul '01

13 Jul '01

Hi, syslog-ng won't be able to open its config file because of a missing slash, the following patch fixes this problem: Index: syslog-ng.h =================================================================== RCS file: /var/cvs/syslog-ng/src/syslog-ng.h,v retrieving revision 1.19 diff -u -r1.19 syslog-ng.h --- syslog-ng.h 2001/07/08 17:04:21 1.19 +++ syslog-ng.h 2001/07/13 10:50:55 @@ -34,7 +34,7 @@ #define PATH_SYSLOG_NG_CONF "syslog-ng.conf" #define PATH_PIDFILE "syslog-ng.pid" #else -#define PATH_SYSLOG_NG_CONF PATH_SYSCONFDIR "syslog-ng.conf" +#define PATH_SYSLOG_NG_CONF PATH_SYSCONFDIR "/syslog-ng.conf" #define PATH_PIDFILE "/var/run/syslog-ng.pid" #endif -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

syslog-ng 1.4.12 and 1.5.8 release
by Balazs Scheidler 13 Jul '01

13 Jul '01

Hi, I released syslog-ng 1.4.12 and 1.5.8 yesterday. You can find it at the usual places. 1.5.8 users beware: - filter(DEFAULT) was removed, and some log processing flags were added instead: * catchall * final * fallback The usage is: log { source(src); destination(dst); fallback; }; I still don't like the syntax it is using, so this might change in the future. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RE: [syslog-ng]stupid regexp question
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 13 Jul '01

13 Jul '01

Michael, Your format is annoying and make take some tweaking of your filters to get around. Syslog-ng, as you know, does various types of matching, on the program, the host, the message, etc, there are different functions that do those things. For the message portion there is match(), for the program portion there is program(), and for host there is host(), you get the idea. I think you are matching a field other than the message when you are using the match function. It's hard to be sure since I'm not familiar with the NT logging format, but that is what I am guessing. Try using one of the other functions to match your expression. Another way you might get a handle on the structure as syslog-ng sees the messages is to use a destination that structures the messages using the DEFAULT filter and the macros, $HOST, $FACILITY, $PRIORITY, etc that will tell you the format of the message so you can filter out the way syslog-ng sees it. In version 1.5.X there is also the template() function that lets you format the output from syslog-ng however you want. Hope this helps. Regards, Drew -----Original Message----- From: Michael Hargadon [mailto:MHargadon@ITDepartment.com] Sent: Thursday, July 12, 2001 11:41 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]stupid regexp question Good afternoon. I use a linux box as a concentration point for the system logs of several NT servers I monitor. This is done through services running on the NT machine which provide standard syslog functionality -- they forward any messages written to the NT event log to a destination I specify. The format in which the messages are received is somewhat irritating, eg: Jul 12 17:36:25 1.2.3.4 Thu Jul 12 17:34:00 2001: SOMEHOST/Security (528) - "Successful Logon: User Name: xservice Domain: SOMEDOMAIN Logon ID: (0x0,0x34616CAB) Logon Type: 3 Logon Process: NtLmSsp Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Workstation Name: SOMESTATION" A large number of the messages we receive we'd prefer not to log to disk. I set up a destination pointing to /dev/null for this purpose. My intention is to use regular expressions to separate useful messages from the useless (and repetitive) ones. As an example of the above, I defined a filter as follows: filter f_nt0001 { match("Security (528)"); }; As well as a log rule as follows: log { source(src); filter(f_nt0002); destination(null); }; However, I'm having issues getting the match rule to work. I suspect it's the parantheses, since AFAIK they're supposed to be a regexp-reserved character. If, however, I escape them with \( messages received which fall into this category don't hit the filter. I know there's something fundamentally obvious that I'm overlooking here but I can't figure it out. Can anyone offer any assistance? Regards, Michael Hargadon mhargadon(a)itdepartment.com _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0