- syslog-ng - lists.balabit.hu

some basic questions syslog-ng
by Ravi Malghan 12 Jul '01

12 Jul '01

Hi I have few basic questions about syslog-ng. If somebody can give me answers or give me some pointers. I am using syslog-ng to log syslog messages from a client to server and a firewall between them. 1. How is the sysloging TCP instead of UDP? Is this something the syslog-ng needs to be configured. 2. The client which initiates the syslog logging, is this normal syslog client? or do I need to install syslog-ng there too? 3.When it uses TCP, which port does it use? Does the user have control over the port number? Thanks in advance Ravi __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/

1 0

unscribe
by Simon Yang 11 Jul '01

11 Jul '01

unscribe

1 0

RE: [syslog-ng]syslog-ng.conf
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 11 Jul '01

11 Jul '01

And there is always a macro filter $HOST that you could separate all the hosts into their own files. destination d_host_logs { file("/var/adm/hosts/$HOST.log"); }; That would save you the performance hit unless there were a great deal of hosts and you may run out of open file descriptor slots. Of course this may not be really what you want as this would put everything in a separate file by host. Depends on what you need to do. Regards, Drew -----Original Message----- From: Nijs, Daniel [mailto:NijsD@telergy.net] Sent: Wednesday, July 11, 2001 3:13 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: RE: [syslog-ng]syslog-ng.conf This is what I had in mind, but I am not sure what the performance overhead will be when I have many rules of this type where I want the data in a seperate file. For now it will do the job, but hopefully this (a directive to stop processing the rules any further) could be an option added to the filter statement in a future release. Thanks for the help. Best regards, Dan -----Original Message----- From: Hamilton, Andrew Mr RAYTHEON 5 SIG CMD [mailto:HamiltonA@hq.5sigcmd.army.mil] Sent: Wednesday, July 11, 2001 6:13 AM To: 'syslog-ng(a)lists.balabit.hu' Cc: Nijs, Daniel Subject: RE: [syslog-ng]syslog-ng.conf Dan, It's true that syslog-ng continues to log after a match was found and this is a necessary function of the software. It logs as long as a match is found. Your best bet on filtering out the things you don't want in the log by using the boolean operators in you filters: filter f_host_ip { facility(daemon) and not host("10.10.10.10"); }; Something of this nature and then add your host in a filter: filter f_myhost { facility(daemon) and host("10.10.10.10"); }; Like that. Hope that helps. Regards, Drew -----Original Message----- From: Nijs, Daniel [mailto:NijsD@telergy.net] Sent: Tuesday, July 10, 2001 9:28 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog-ng.conf Hello, I am relatively new to syslog-ng (only been running it for a month) and love the software. I would like to congratulate the author on doing such a great job. This is a powerful product, and with this comes complexity, and I have a few questions I am not able to find an answer for. I have a webserver logging to a centralized host, and I filter the logs using specific criteria (i.e. document name). Let's give this file a name to make this question easier to understand. I log this data to hits.log. Now, I want to filter out a certain IP to a separate file (ip.log), and not show the entries that were logged to ip.log in hits.log. It seems that syslog-ng keeps processing all rules, even after there was a match. I was hoping that there was an option to stop processing any further rules for that matched data to solve this problem, but am unable to find any solution. Does anyone have any suggestions on how to do this? Thanks. Best regards, Dan _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]syslog-ng.conf
by Nijs, Daniel 11 Jul '01

11 Jul '01

This is what I had in mind, but I am not sure what the performance overhead will be when I have many rules of this type where I want the data in a seperate file. For now it will do the job, but hopefully this (a directive to stop processing the rules any further) could be an option added to the filter statement in a future release. Thanks for the help. Best regards, Dan -----Original Message----- From: Hamilton, Andrew Mr RAYTHEON 5 SIG CMD [mailto:HamiltonA@hq.5sigcmd.army.mil] Sent: Wednesday, July 11, 2001 6:13 AM To: 'syslog-ng(a)lists.balabit.hu' Cc: Nijs, Daniel Subject: RE: [syslog-ng]syslog-ng.conf Dan, It's true that syslog-ng continues to log after a match was found and this is a necessary function of the software. It logs as long as a match is found. Your best bet on filtering out the things you don't want in the log by using the boolean operators in you filters: filter f_host_ip { facility(daemon) and not host("10.10.10.10"); }; Something of this nature and then add your host in a filter: filter f_myhost { facility(daemon) and host("10.10.10.10"); }; Like that. Hope that helps. Regards, Drew -----Original Message----- From: Nijs, Daniel [mailto:NijsD@telergy.net] Sent: Tuesday, July 10, 2001 9:28 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog-ng.conf Hello, I am relatively new to syslog-ng (only been running it for a month) and love the software. I would like to congratulate the author on doing such a great job. This is a powerful product, and with this comes complexity, and I have a few questions I am not able to find an answer for. I have a webserver logging to a centralized host, and I filter the logs using specific criteria (i.e. document name). Let's give this file a name to make this question easier to understand. I log this data to hits.log. Now, I want to filter out a certain IP to a separate file (ip.log), and not show the entries that were logged to ip.log in hits.log. It seems that syslog-ng keeps processing all rules, even after there was a match. I was hoping that there was an option to stop processing any further rules for that matched data to solve this problem, but am unable to find any solution. Does anyone have any suggestions on how to do this? Thanks. Best regards, Dan _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]syslog-ng.conf
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 11 Jul '01

11 Jul '01

Dan, It's true that syslog-ng continues to log after a match was found and this is a necessary function of the software. It logs as long as a match is found. Your best bet on filtering out the things you don't want in the log by using the boolean operators in you filters: filter f_host_ip { facility(daemon) and not host("10.10.10.10"); }; Something of this nature and then add your host in a filter: filter f_myhost { facility(daemon) and host("10.10.10.10"); }; Like that. Hope that helps. Regards, Drew -----Original Message----- From: Nijs, Daniel [mailto:NijsD@telergy.net] Sent: Tuesday, July 10, 2001 9:28 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog-ng.conf Hello, I am relatively new to syslog-ng (only been running it for a month) and love the software. I would like to congratulate the author on doing such a great job. This is a powerful product, and with this comes complexity, and I have a few questions I am not able to find an answer for. I have a webserver logging to a centralized host, and I filter the logs using specific criteria (i.e. document name). Let's give this file a name to make this question easier to understand. I log this data to hits.log. Now, I want to filter out a certain IP to a separate file (ip.log), and not show the entries that were logged to ip.log in hits.log. It seems that syslog-ng keeps processing all rules, even after there was a match. I was hoping that there was an option to stop processing any further rules for that matched data to solve this problem, but am unable to find any solution. Does anyone have any suggestions on how to do this? Thanks. Best regards, Dan _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

syslogging snmptraps
by Brian E. Seppanen 10 Jul '01

10 Jul '01

Hello: I'm using syslog-ng-1.4.11 on a solaris 2.6 host. The box is likewise configured as an snmptrap host, which are then logged. Is there a field length limit for the messages that will be logged with syslog-ng or syslog in general. Some traps seem to run out of space and stop prematurely. An example below Jul 10 14:53:09 host snmptrapd[8971]: host: Enterprise Specific Trap (ciscoNetRegFreeAddressLow) Uptime: 21 days, 10:02:46.00, system.sysDescr = Cisco Systems, Inc. blah blah blah blah blah blah, enterprises.cisco.ciscoMgmt.ciscoNetworkRegistrarMIB.ciscoNetworkRegistrarMIBObjects.cnrDHCP.cnrDHCPScopeTable.cnrDHCPScopeEntry.cnrDHCPScopeFreeAddrLowThreshold.78.87.45.84.86.67.45.85.66.82.49.45.73.80.66.85.78.68.76.69.53.45.80.67 = Wrong Type (should be Gauge32 or Unsigned32): 20, enterprises.cisco.ciscoMgmt.ciscoNetworkRegistrarMIB.ciscoNetworkRegistrarMIBObjects.cnrDHCP.cnrDHCPScopeTable.cnrDHCPScopeEntry.cnrDHCPScopeFreeAddrValue.78.87.45.84.86.67.45.85.66.82.49.45.73.80.66.85.78.68.76.69.53.45.80.67 = Wrong Type (should be Gauge32 or Unsigned32): 20, enterprises.cisco.ciscoMgmt.ciscoNetworkRegistrarMIB.ciscoNetworkRegistrarMIBObjects.cnrDHCP.cnrDHCPScopeTable.cnrDHCPScopeEntry.cnrDHCPScopeFreeAddrUnits.78.87.45.84.86.67.45.85.66.82.49.45.73.80.66.85.78.68.76.69.53.45.80.67 = percen Any insights appreciated. Thanks, Brian Seppanen seppy(a)chartermi.net 906-228-4226 ext 23

1 0

syslog-ng.conf
by Nijs, Daniel 10 Jul '01

10 Jul '01

Hello, I am relatively new to syslog-ng (only been running it for a month) and love the software. I would like to congratulate the author on doing such a great job. This is a powerful product, and with this comes complexity, and I have a few questions I am not able to find an answer for. I have a webserver logging to a centralized host, and I filter the logs using specific criteria (i.e. document name). Let's give this file a name to make this question easier to understand. I log this data to hits.log. Now, I want to filter out a certain IP to a separate file (ip.log), and not show the entries that were logged to ip.log in hits.log. It seems that syslog-ng keeps processing all rules, even after there was a match. I was hoping that there was an option to stop processing any further rules for that matched data to solve this problem, but am unable to find any solution. Does anyone have any suggestions on how to do this? Thanks. Best regards, Dan

1 0

From Linux to Solaris
by Brian E. Seppanen 09 Jul '01

09 Jul '01

Hello: I'm in the process of moving logging from a linux box to a solaris 2.6 box. Can someone who's done similar point out any caveats of doing so? Will I only need to enable a new source for door? Are kernel messages still handled by /proc/kmesg? Any help appreciated...Thanks, Brian Seppanen seppy(a)chartermi.net 906-228-4226 ext 23

2 1

Log Stopage
by Gorm Jensen 08 Jul '01

08 Jul '01

After upgrading from RH6.1 and syslog-ng-1.4.2 to RH7.1 and syslog-ng-1.4.11, only the first hit of a series of hits on the firewall is logged. Restarting the daemon will cause the next hit to be logged, but no more than that. Only the logging of firewall hits is effected. After a great deal of trial and error, I traced the problem to a specific destination in the configuration file. I have attached two verions (Linux text and MS.txt) of the config file. To simplify the configuraton for testing, I deleted several other log destinations, filters and actions. The anomaly persisted, even with the simplified configuration. When the lines containing the destination 'whodat' are commented out, logging proceeds as expected. When the comments are aranged to include either one of the lines containing the whodat destination, the logging reverts to what is described in para one. Can anyone tell what is required to fix the problem?

2 1

Duplicate Entries
by Vinay Bharel 08 Jul '01

08 Jul '01

I just started running syslog-ng on a Linux box. I have also configured one of my Solaris 8 servers to send logs to this machine. I have noticed that I get duplicate log entries sometimes. I can't figure out why. For example: Jul 3 20:32:44 dns-a vinay: [ID 702911 daemon.warning] test Jul 3 20:32:44 dns-a vinay: [ID 702911 daemon.warning] test Jul 3 20:32:44 dns-a vinay: [ID 702911 daemon.warning] test Jul 3 20:32:44 dns-a vinay: [ID 702911 daemon.warning] test The Solaris 8 box has the following entry in it's syslog.conf: *.debug @loghost This is my syslog-ng.conf: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_sys { unix-stream ("/dev/log"); internal(); }; source external { udp(ip (0.0.0.0) port(514)); }; filter f_filter1 { level(info) and facility(user) or facility(kern) or facility(mail) or facility(daemon) or facility(daemon) or facility(auth) or facility(lpr) or facility(news) or facility(uucp) or facility(cron) or facility(syslog) or facility(ftp) or facility(authpriv) or facility(cron); }; filter f_dns-a { host(dns-a); }; destination d_dns-a { file("/var/log/machine/$YEAR/$MONTH/$HOST.$DAY");}; log { source(external); filter(f_dns-a); destination (d_dns-a); }; - Vinay Bharel <vinay(a)bharel.com>

2 1