- syslog-ng - lists.balabit.hu

figuring out what facility & priority is used
by nick 28 May '01

28 May '01

Maybe I missed something somewhere, I dunno.. Is there anyway to figure out what facility and/or priority a program or logged message is using to log stuff, without going through the source code of the program? -- nick

2 4

kernel logging
by geoffrey 25 May '01

25 May '01

Hi all, I was wondering, sysklogd has two daemons - one for syslogs, and one for kernel logs. Does syslog-ng handle both facilities, or am I missing out on the kernel logs that would be done by klogd? Is there any way to get all of the same logging that I was getting provided by sysklogd? I have read what documentation I can find, but am still a bit confused - obviously. Thanks. geoffrey -- +++++++++++++++++++++++++++++++++++++++++++++++++++ "There really isn't much value in free." -- Doug Miller MS group product manager for competitive strategies +++++++++++++++++++++++++++++++++++++++++++++++++++

4 4

logger & splogger alternatives
by nicholas 25 May '01

25 May '01

Im just wondering if anyone knows of some alternatives to using syslog's logger, or qmail's splogger since it doesnt look like syslog-ng comes with one? -- nick

4 3

simple performance test paradigm
by Jon Marks 25 May '01

25 May '01

Hi, This is in reponse to the request for an alternative logger-- some of this code could probably be adapted for that job without too much fuss. This stuff is tested on Solaris7/8 and AIX4.3.3, but probably not too hard to get to work for other platforms. In any case.. In order to performance-test a syslog-ng installation and compare with vendor syslogd's, I wrote a simple set of three programs. One is the main log message generator (which uses the syslog.h API to log locally), one is a "master" synchronization control, and one gathers the results. These are each little single-sourcefile programs. They're pretty primitive, so don't expect the greatest in command line processing and user interface, but could be useful for setting up, testing, and performance profiling. The main log message generator "syslogtest.c" takes a facility and level, number of repetitions, a sleep interval, and a "server mode" flag on the command line. It locally logs the specified number of messages (like logger, but with with preset content) at the given priority with a sequence number, sleeping the given number of microseconds between each. After logging the battery of messages, the running time for the battery is also logged (and output to the terminal along with PID). In "server mode" it listens to a preset TCP port for a connection from the master synchronization control. The master control "master.c" reads "./servers" for a flat list of hostnames to connect with. Each host runs an instance of "syslogtest" in "server mode". Once connected, the user can give a simple "go" signal or "exit" signal. When the given the "go" signal, each server sends the volley of syslog messages specified on its command line, forks (just to change the reported PID), and waits for another signal. When given "stop" all servers exit. Consider when each host's syslog daemon is configured to send to a common loghost. This lets you recruit a number of synchronized remote hosts to either flood syslog-ng (or syslogd) and measure message loss, or (by using the microsecond sleeping) simulate the intended server load. The last program is a perl script, "results," which takes as arguments a logfile name, a PID, and a number of trials. It reads the logfile, scanning for lines by the given PID, and tracking the sequence numbers to determine which are missing, and reports the results. After running a test trial, this is run at each syslogtest host to determine how many were lost locally (e.g. in AIX's datagram /dev/log socket), and then on the common loghost to determine which ones never made it over the network or were dropped by syslog-ng. You can use this to help you tune output fifo sizes under particular loads, or to determine the maximum reasonable capacity of your loghost. Oh, yeah-- if you invoke the syslogtest.c program as "lasttest" then it omits the sequence numbers. This generates "last message repeated..." output from vendor syslogd's (and was used to develop the patch submitted previously). -- Jonathan Marks Systems Administrator, Production Systems Group Computing and Communication Services Office University of Illinois at Urbana-Champaign

2 1

Not remotely logging...
by Matt Mencel 24 May '01

24 May '01

Hi all. I'm hoping someone can help me with this because I'm stumped. I'm running 1.4.11 and am trying to send my logs to another machine. It is working (kind of) for the messages log and some of the other logs though sometimes it is extremely slow. Sometimes taking an hour or more to get logs to the other machine. My main problem though is that my ftp and http logs are not getting there at all. My FTP server is set to log to the LOCAL7 facility and is logging correctly to the machine it is on. My remote logger is not recieving anything however. Same goes for my HTTP logs. One logs to LOCAL6 facility, and another is logging to a named_pipe file that syslog-ng is "listening" to. Both HTTP logs are working on the host box but I get nothing at the remote logger. I've included my .conf files from both machines. Any help at all would be appreciated. Thanks. Matt Mencel matt(a)cmitech.com ************ MAIN SERVER CONF FILE ************ # # Syslog-ng example configuration for for Debian GNU/Linux # # Copyright (c) 1999 anonymous # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.sample,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. # options { long_hostnames(off); sync(0); log_fifo_size(1000); gc_busy_threshold(5000); }; source src { unix-dgram("/var/run/log"); internal(); file("/dev/klog"); }; source httpd { pipe("/var/run/httpd-access"); }; destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination cron { file("/var/log/cron"); }; destination daemon { file("/var/log/daemonlog"); }; destination kern { file("/var/log/kern.log"); }; destination lpr { file("/var/log/lpr.log"); }; destination user { file("/var/log/userlog"); }; destination uucp { file("/var/log/uucp.log"); }; #destination ppp { file("/var/log/ppp.log"); }; destination mail { file("/var/log/maillog"); }; destination mailinfo { file("/var/log/mail.info"); }; destination mailwarn { file("/var/log/mail.warn"); }; destination mailerr { file("/var/log/mail.err"); }; #destination newscrit { file("/var/log/news/news.crit"); }; #destination newserr { file("/var/log/news/news.err"); }; #destination newsnotice { file("/var/log/news/news.notice"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; # Added/modified by Matt destination ftpd { file("/var/log/ftp.log"); }; destination loghost { tcp("192.168.0.9" port(514)); }; destination httpd { file("/var/log/httpd-access.log"); }; destination httpderr { file("/var/log/httpd-error.log"); }; #destination xconsole { pipe("/dev/xconsole"); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; #filter f_ppp { facility(ppp); }; #filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; # Added/modified by Matt filter f_ftpd { facility(local7); }; filter f_httpderr { facility(local6); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; #log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; #log { source(src); filter(f_news); filter(f_err); destination(newserr); }; #log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); filter(f_ppp); destination(ppp); }; log { source(src); destination(console_all); }; # Added/modified by Matt log { source(src); destination(loghost); }; log { source(src); filter(f_ftpd); destination(ftpd); }; log { source(httpd); destination(httpd); destination(loghost); }; log { source(src); filter(f_httpderr); destination(httpderr); }; ************ REMOTE LOGGING SERVER CONF FILE ************ # # Syslog-ng example configuration for for Debian GNU/Linux # # Copyright (c) 1999 anonymous # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.sample,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. # options { long_hostnames(off); sync(0); log_fifo_size(1000); gc_busy_threshold(5000); }; source src { unix-dgram("/var/run/log"); tcp(ip(192.168.0.9) port(514)); internal(); file("/dev/klog"); }; destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination cron { file("/var/log/cron"); }; destination daemon { file("/var/log/daemonlog"); }; destination kern { file("/var/log/kern.log"); }; destination lpr { file("/var/log/lpr.log"); }; destination user { file("/var/log/userlog"); }; destination uucp { file("/var/log/uucp.log"); }; #destination ppp { file("/var/log/ppp.log"); }; destination mail { file("/var/log/maillog"); }; destination mailinfo { file("/var/log/mail.info"); }; destination mailwarn { file("/var/log/mail.warn"); }; destination mailerr { file("/var/log/mail.err"); }; #destination newscrit { file("/var/log/news/news.crit"); }; #destination newserr { file("/var/log/news/news.err"); }; #destination newsnotice { file("/var/log/news/news.notice"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; #destination xconsole { pipe("/dev/xconsole"); }; # Added/modified by Matt destination ftpd { file("/var/log/ftp.log"); }; destination httpd { file("/var/log/httpd-access.log"); }; destination httpderr { file("/var/log/httpd-error.log"); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; #filter f_ppp { facility(ppp); }; #filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; # Added/modified by Matt filter f_ftpd { facility(local7); }; filter f_httpderr { facility(local6); }; filter f_httpd { match("apache:"); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; #log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; #log { source(src); filter(f_news); filter(f_err); destination(newserr); }; #log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); filter(f_ppp); destination(ppp); }; log { source(src); destination(console_all); }; # Added/modified by Matt log { source(src); filter(f_ftpd); destination(ftpd); }; log { source(src); filter(f_httpderr); destination(httpderr); }; log { source(src); filter(f_httpd); destination(httpd); };

1 0

RE: [syslog-ng]filter question: already matched
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 21 May '01

21 May '01

James, Well, I'm not sure if you are still making an error in your cut and paste, but the destination and filter you put in the message don't match your log line. You mention that they are set correctly but you didn't post the correct one. Not sure we can help without the correct line. The idea you put forth is sound and should work with what you have. What exactly is happening? Is it not logging? As a first look take off the hostname part of the filter to see what you are getting in the DEFAULT filter. I do this on occasion and sometimes will surprise you that you aren't getting what you expect. Regards, Drew -----Original Message----- From: James Hamilton [mailto:jamesh@swcp.com] Sent: Friday, May 18, 2001 8:08 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]filter question: already matched And yes the destination and filter is set correctly in my rules. I just did a poor copy and paste job in my email :-) On Fri, May 18, 2001 at 11:42:16AM -0600, James Hamilton wrote: > > Hi, I'm having some trouble setting up a filter. In plain english the rule would read something like below, any suggestions? > > Match everything for this host except things that have already been matched for this host then drop them into a messages file. > > ## > ## hosts messages log > ## > destination d_messages { > file("/var/log/$MONTH/$HOST/$HOST_messages.$MONTH-$DAY-$YEAR" > owner(root) > group(staff) > perm(0640) > dir_perm(0750) > create_dirs(yes)); > }; > > filter f_messages { > (filter(DEFAULT) and host("somehostname")); > }; > > log { > source(root); > filter(f_cron); ^^^^^^^^^^^^^^^^^^^^ > destination(d_cron); ^^^^^^^^^^^^^^^^^^^^ > }; > > > -- > > James Hamilton > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng -- James Hamilton _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

filter question: already matched
by James Hamilton 18 May '01

18 May '01

Hi, I'm having some trouble setting up a filter. In plain english the rule would read something like below, any suggestions? Match everything for this host except things that have already been matched for this host then drop them into a messages file. ## ## hosts messages log ## destination d_messages { file("/var/log/$MONTH/$HOST/$HOST_messages.$MONTH-$DAY-$YEAR" owner(root) group(staff) perm(0640) dir_perm(0750) create_dirs(yes)); }; filter f_messages { (filter(DEFAULT) and host("somehostname")); }; log { source(root); filter(f_cron); destination(d_cron); }; -- James Hamilton

1 1

syslog-ng and stunnel
by Eric Parusel 16 May '01

16 May '01

Hello, I've been able to find anything in the archives pertaining to this.... I've successfully set up syslog-ng to tunnel through stunnel. I'm having one problem though, all messages come through with a hostname of "localhost", presumably since stunnel is coming from localhost on the syslog server.... Obviously it's hard to tell which server is generating the syslog message if they're all showing up as "localhost"... :) Does anyone have any workarounds for this problem? Thanks, Eric Parusel

3 3

-u and -g switches on syslog-ng 1.5.6
by MURVAI-BUZOGANY Laszlo 15 May '01

15 May '01

Hi! I tried to run my newly-compiled syslog-ng-1.5.6 with different user and group values than usually (root). As trying it, got segfault several times, so after a short time I discovered some silly coding in src/main.c. In order to make it work, only _really_ simple changes have to be made, I also made a diff-file of the release and my (working) source. I attach it. Hope I got the problem right, and didn't get messed up :) sci -- Murvai-Buzogány László Laszlo.Murvai-Buzogany(a)gt-systems.hu

2 1

TCP reliability
by Chris Sibbitt 15 May '01

15 May '01

Greetings. I'm running syslog-ng 1.4.11 and am having trouble getting the tcp destination to work reliably. My major concern is with what happens when the receiving end of the tcp link is reset. In my scenario I have one syslog-ng machine forwarding messages to another syslog-ng machine using a tcp() destination on one end and a tcp() source on the other. All works fine until I interrupt the socket on the receiving machine. Rebooting, HUP'ing syslog-ng, etc all cause the logs to stop coming in. I assume that the sender is simply trying to write the messages to an existing TCP socket and failing. What happens to these messages (are they queued anywhere for later delivery?), and is there anything that I can do to ensure that messages continue to flow when the receiver comes back up? Losing messages while the receiving end if offline is an acceptable loss, but when it comes back up, I would really like it to continue to receive. In the current scenario I have to restart every syslog-ng machine that is forwarding messages to my central logger when I change its configuration, this is definitely not sane. Anyone with hints/tips for setting up TCP based messaging, please contact me. Chris Sibbitt JetNet Internetworking Services Inc. Providing Secure Internet Communications Phone 613-271-6220x228 FAX 613-271-6229 Email csibbitt(a)jetnet.ca Web www.jetnet.ca <http://www.jetnet.ca/>

2 1