- syslog-ng - lists.balabit.hu

syslog on a dec ev6 (es 40) with osf 4.0f?
by Daan Hoogland 14 Jun '01

14 Jun '01

Does anyone have any experience? I try to make this work with gcc and with cxx (from compaq), but neither does. The cxx version cores on startup. The gcc 2.95.2 version starts with 4 alignement messages, and then only reports internal messages and no udp. It also cores when i send it a HUP, after it has said to have reinitialized. I think it is only in compiler options but really haven't a clue. I tried 1.4.11 and 1.5.7. Compiling with -Wcast-align gives warnings on socket operations where a sockaddr_in is used as a sockaddr. Is there an explanation/man/info file for the mechanism with the .x files? tia

1 0

RE: [syslog-ng]newbie Solaris question
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 13 Jun '01

13 Jun '01

What do you mean you can't get it to output every message it receives? I have used syslog-ng on Solaris for 2 years with very few problems and I log over 1000 devices. Do you know if it is receiving messages? You're not running syslogd as well are you? In low volumes the defaults for garbage collection should be sufficient. How many hosts are you logging? Try setting sync(0). Regards, Drew -----Original Message----- From: T. Esting [mailto:T_Esting@excite.com] Sent: Tuesday, June 12, 2001 6:16 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]newbie Solaris question I've been trying to get both 1.4.11 and 1.5.7 to run on my Solaris system, and have met with limited success. Compiling and installing were fairly easy, as was creating a configuration file. I understand from the docs that the mark() feature still doesn't work, and from the mailing list that sync_freq() should actually be sync(). I am having trouble, however, with flushing output in low-volume scenarios. Here is the configuration file I am using: options { use_dns(no); log_fifo_size(XXX); gc_idle_threshold(YYY); gc_busy_threshold(ZZZ); use_time_recvd(yes); }; source sun { sun-streams ( "/dev/log" door("/etc/.syslog_door")); internal(); }; destination testout { file ( "/var/adm/testout.txt" sync(WWW)); } ; log { source (sun); destination (testout); }; I've tried various values for WWW, XXX, YYY, and ZZZ, even setting WWW to 1. I have not been able to influence syslog-ng to write out every message it receives. Does anyone have any pointers on what I might want to try next to get syslog-ng to more reliably receive and log messages on Solaris? Thanks. _______________________________________________________ Send a cool gift with your E-Card http://www.bluemountain.com/giftcenter/ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

have the priority field in the log
by Kai Wang 13 Jun '01

13 Jun '01

Hi, Our network group found that they can view log messages with the priority field on the routers. But after the logs arrive the unix syslog server, the priority field is gone. They prefer to have such a field in their log. Is there a way to have the priority field in the log message by syslog-ng? Kai

2 1

newbie Solaris question
by T. Esting 12 Jun '01

12 Jun '01

I've been trying to get both 1.4.11 and 1.5.7 to run on my Solaris system, and have met with limited success. Compiling and installing were fairly easy, as was creating a configuration file. I understand from the docs that the mark() feature still doesn't work, and from the mailing list that sync_freq() should actually be sync(). I am having trouble, however, with flushing output in low-volume scenarios. Here is the configuration file I am using: options { use_dns(no); log_fifo_size(XXX); gc_idle_threshold(YYY); gc_busy_threshold(ZZZ); use_time_recvd(yes); }; source sun { sun-streams ( "/dev/log" door("/etc/.syslog_door")); internal(); }; destination testout { file ( "/var/adm/testout.txt" sync(WWW)); } ; log { source (sun); destination (testout); }; I've tried various values for WWW, XXX, YYY, and ZZZ, even setting WWW to 1. I have not been able to influence syslog-ng to write out every message it receives. Does anyone have any pointers on what I might want to try next to get syslog-ng to more reliably receive and log messages on Solaris? Thanks. _______________________________________________________ Send a cool gift with your E-Card http://www.bluemountain.com/giftcenter/

1 0

syslogd core on garbage-collect filter
by jamie rishaw 11 Jun '01

11 Jun '01

Greetings all, Hope this isn't FAQ.. I'm trying to filter all of the "garbage collect" messages into /dev/null (but for initial testing, a file). syslog-ng is coring, tho, after startup with code (below). operation without the bad code, however, is fine. I am running syslog-ng 1.4.11 on FreeBSD 4.3-STABLE. bad code: -- start -- # I dont want garbage collecting messages log { source("s_int"); filter("f_isgarbage"); destination("d_garbage"); }; filter f_isgarbage { match("garbage collect"); }; destination d_garbage { file("/logs/garbage"); }; -- end -- related code (does not affect): --start-- source s_int { internal(); }; --end-- startup: noc# /usr/local/sbin/syslog-ng -v binding fd 3, inetaddr: 0.0.0.0, port: 514 binding fd 4, unixaddr: /var/run/log within 60 seconds: -rw------- 1 root wheel 380928 Jun 11 11:16 syslog-ng.core noc# gdb /usr/local/sbin/syslog-ng syslog-ng.core GNU gdb 4.18 (no debugging symbols found)... Core was generated by `syslog-ng'. Program terminated with signal 6, Abort trap. Reading symbols from /usr/lib/libc.so.4...(no debugging symbols found)...done. Reading symbols from /usr/libexec/ld-elf.so.1...(no debugging symbols found)... done. #0 0x280af8e0 in kill () from /usr/lib/libc.so.4 (gdb) bt #0 0x280af8e0 in kill () from /usr/lib/libc.so.4 #1 0x280eb62e in abort () from /usr/lib/libc.so.4 #2 0x280c83cf in __assert () from /usr/lib/libc.so.4 #3 0x805203a in io_iter () #4 0x8049ace in main_loop () #5 0x8049de3 in main () #6 0x80496f9 in _start () Thanks in advance for any advice/help, jamie -- jamie rishaw <jrishaw(a)playboy.com> sr. wan/unix engineer/ninja // playboy enterprises inc. opinions stated are mine, and are not necessarily those of the bunny.

1 0

sending alerts to phones
by foob＠return0.net 10 Jun '01

10 Jun '01

Maybe a bit off topic - but the syslog-ng feature to pipe logs to programs got me thinking: does anyone know of a provider or service that will allow me to send mobile SMS messages from the command line? I like the idea of getting alerts if, say, login fails for root and other such naughtyness :) - foob

4 4

destination { program(); } failures...
by David Douthitt 08 Jun '01

08 Jun '01

I've been trying to use: destination { program("/usr/bin/notify"); }; ...and it doesn't work. No error messages. No log messages. No nothing at all. Then I had a flash, and tried checking my hypothesis against the documentation - nothing there. Then I tried checking my hypothesis in the example *.conf files - nothing there. Then I tried it in practice: destination { program(/usr/bin/notify); }; This works better, but only seems to work when it starts up, but not thereafter. /usr/bin/notify is a /bin/sh script. Does this just not work in v1.4.10?? It's getting rather frustrating. I'm running in Red Hat Linux 6.2 without all the bells and whistles (like X). I'd *REALLY* like to get this to work - it's one of the big draws to syslog-ng for me.

6 12

Re: [syslog-ng]SNMP source and destination
by todd.glassey＠att.net 07 Jun '01

07 Jun '01

The nice thing about SNMP style traffic logs is that you can process them with MRTG and generate good graphical content for reports and the like. I suggest that you look at http://www.mrtg.org for more details on this. T. -- Regards, Todd > I don't know if anyone has answered this, and I'm too lazy to look in > the archive. But here it goes: > > On Tue, Jun 05, 2001 at 01:44:30PM -0400, Mark W. Alexander wrote: > > I just installed syslog-ng as a syslog concentrator for multiple > > network management applications that feed off syslog. I need to do the > > same thing with SNMP traps. I tried simple source and destination on > > the SNMP udp ports and it does grab and forward but not in any manner > > that makes sense to SNMP listeners on the detinations. > > Assuming you were using syslog-ng this make sense. Syslog and SNMP > Trap are very different protocols. > > > Has anyone done any work on SNMP specific sources or destinations? If > > not, is anyone else interested and can anyone give me a gentle push > > into the sources (like where the udp source/destination code is)? > > I have, but since I am not a big fan of SNMP I used an SNMP Trap > daemon that turned everything into syslog traffic (decoding what it > could of those nasty SNMP OIDs). This has worked well for me, as it > unifies logging into one resource. > > http://net-snmp.sourceforge.net/ > > Another package, Scotty, is also quite good, and is written in TCL/Tk. > I don't have the URL handy. > ---------------------------------------------------------------------------- > __o Bradley Arlt Email: arlt(a)cpsc.ucalgary.ca o__ > _ \<_ WWW: www.acs.ucalgary.ca/~bdarlt _>/ _ > (_)/(_) -Eat well, sleep peacefully, drink lots, and ride like hell. (_)\(_) > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Question on using syslog-ng
by Heeres, Ken 07 Jun '01

07 Jun '01

I am looking for a package that will provide application level logging and it looks to me like syslog-ng has the capabilities I am looking for. I am not quite sure that I would want to replace syslogd with syslog-ng. Would it be possible to have syslog-ng coexist with syslogd by having it listen on a different port? I would have write a version of syslog to communicate using the alternate port. Correct? Thanks, Ken ---------------------------------------------- Kenneth J. Heeres Johns Hopkins University Group Supervisor Applied Physics Laboratory Ground Applications Group (SIG) Johns Hopkins Road Laurel, MD 20723-6099 Wash.: 240-228-5853 Balt: 443-778-5853 kenneth.heeres(a)jhuapl.edu

4 3

RE: [syslog-ng]Feature Request
by Andrew Fort 07 Jun '01

07 Jun '01

David, I guess you dont need this badly enough to hack it yourself :-) But if anyone is interested in adding this functionality for a patch, start here-- main.c main_loop() for the config file parsing debug output. center.c do_distribute_log() for the core of the filter matching. Also, do_distribute_log() could benefit from some sort of accelerated matching to (possibly) improve performance in heavy-filtering configurations, at the moment it's O(n) n~= number of rules. >Let me say first that this is a fantastic piece of software - I'm >starting to implement it in our UNIX environment. It's almost TOO >powerful :-) But that is a Good Thing. > >I don't THINK this is in the current sources, but anyway.... > >I'd like to have some serious debugging available in the logs ... for >example, right now we get: > >syslog-ng[99]: Syntax error reading config file, using old >configuration > >...and this is all you know. To actually find out the error, you have >to run syslog-ng from the command line. Then testing gets complicated >as you attempt to restart the active syslog-ng while finding out what >the syntax errors are by running it at the command line. Wouldn't be >better to do the following: > >syslog-ng[99]: Syntax error in configuration file /etc/syslog-ng.conf >at line 45 >syslog-ng[99]: Retaining old configuration > >Also, messages like these would be nice for debugging purposes: > >syslog-ng[99]: Message from source(src) received: level auth.info >syslog-ng[99]: Log #1: filter not matched >syslog-ng[99]: Log #2: filter not matched >syslog-ng[99]: Log #3: filter not matched >syslog-ng[99]: Log #4: filter f_authonly matched >syslog-ng[99]: Log #4: log used >syslog-ng[99]: Log #5: filter not matched >syslog-ng[99]: Log #6: source not matched > >...and so on. > >It would even be nice to be able to send a SIGINT or a SIGUSR1 or a >SIGUSR2 to the running syslog to manipulate the debugging messages >similar to BIND. > >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >

2 1