- syslog-ng - lists.balabit.hu

Filter on severity range
by Jon Marks 29 Dec '00

29 Dec '00

Hello, I'm very sorry if this is answered somewhere else, or if the answer is so obvious that it's a waste of time :) I can't see anything in the documentation which explicitly addresses this. I have a question about filtering on ranges of severities. A filter such as filter f_daemon { facility(daemon) and level(info); }; catches messages logged to the daemon facility at severity info. It differs from the traditional behavior of syslogd in that it doesn't catch severities beyond info, however. Is there a shorthand way to specify a range of priorities (i.e. to achieve behavior similar to the traditional syslogd)? Or, is it necessary to write a filter such as the following one? filter f_info { level(info) or level(notice) or .. or level(emerg); }; filter f_daemon { facility(daemon) and filter(f_info); }; Thank you very much. -- Jonathan Marks Systems Administrator, Production Systems Group Computing and Communication Services Office University of Illinois at Urbana-Champaign

3 3

Matching hostnames problem
by Keith McDuffee 28 Dec '00

28 Dec '00

One problem I've found after installing syslog-ng 1.4.10 on a Solaris 2.6 system is with repeating messages, especially those originating from remote hosts. For example, here's some lines from my config file: ---- source s_udp { udp(); }; destination d_udp { file("/var/log/remote/$HOST.$FACILITY"); }; filter f_udp { level(notice) or (facility(local0) and level(info)) or (facility(local1) and level(info)) or (facility(local2) and level(info)); }; log ( source(s_udp); filter(f_udp); destination(d_udp); }; ---- Using this configuration, I get files in /var/log/remote that look like this: hostname1.local0 hostname2.local2 hostname1.auth last.local2 See that "last.local2"? Well, "last" is not a host -- it's taking it from the log message and mistakenly turning it into a hostname. Here's a line from "last.local2": --- Dec 22 10:14:13 last message repeated 2 times --- Any idea at all how to fix that besides making a filter for any hosts named "last"? Thanks, Keith

1 0

Re: syslog-ng encryption
by Balazs Scheidler 27 Dec '00

27 Dec '00

> Hello. I have been running syslog-ng for some now and I am quiet pleased. I > am writing to ask about the encryption algorithm in syslog-ng. Not only > about how it is implemented (I can't read Hungarian and neither can > babelfish), but also if or when it will become part of the distribution. I > could not find information in the mailing lists archives. thank you for your > time. I'm currently very busy developing Zorp (it's a proxy firewall suite at http://www.balabit.hu/products/zorp/) so I don't have too much time to spend on syslog-ng. I only write bugfixes, and merge in patches sent by others. So there's no development schedule, and I can't say anything for sure. I'd like to add SSL support to syslog-ng, but I don't know when. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: syslogng
by Balazs Scheidler 27 Dec '00

27 Dec '00

On Fri, Oct 20, 2000 at 04:33:31PM -0400, Keith Meyers wrote: > Balazs, > > I was wondering if there is a way to introduce new "Facilities" into > syslog-ng. Do i have to modify the source code, or can it be done > through the config file. In the end, I am trying to allow logging to > individual files on a per process basis.... > > Any suggestions or comments greatly appreciated... Syslog-ng can filter on facilities specified by number, for example: filter f_numfac { facility(16); }; This is the same as facility(local0), but the number can be anything. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Bug in syslog-ng 1.4.10 ?
by Keith McDuffee 22 Dec '00

22 Dec '00

One problem I've found after installing syslog-ng 1.4.10 on a Solaris 2.6 system is with repeating messages. For example, here's some lines from my config file: ---- source s_udp { udp(); }; destination d_udp { file("/var/log/remote/$HOST.$FACILITY"); }; filter f_udp { level(notice) or (facility(local0) and level(info)) or (facility(local1) and level(info)) or (facility(local2) and level(info)); }; log ( source(s_udp); filter(f_udp); destination(d_udp); }; ---- Using this configuration, I get files in /var/log/remote that look like this: hostname1.local0 hostname2.local2 hostname1.auth last.local2 See that "last.local2"? Well, "last" is not a host -- it's taking it from the log message and mistakenly turning it into a hostname. Here's a line from "last.local2": --- Dec 22 10:14:13 last message repeated 2 times --- Any idea at all how to fix that? Thanks, Keith

1 0

syslog-ng and sendmail
by Serge van Thillo 20 Dec '00

20 Dec '00

Hi people. I compiled syslog-ng today and tried out some things. It works quite ok, there only a few things I am missing. When I log facility mail I only see to adressen. this is the same when I log everything to one file. so for example: Dec 20 02:27:34 linux sendmail[10439]: eBK1RX410437: to=<serge(a)mydomain.nl>, delay=00:00:00, xdelay=00:00:00, mailer=cyrus, pri=38193, dsn=2.0.0, stat=Sent Only the line telling me who send the message is missing. I will include the config file. Can anyone tell me what is wrong? Thanks in advance. Greets, Serge. --------------------------------- options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { unix-stream ("/dev/log"); internal(); }; destination console { file("/dev/console"); }; destination messages { file("/var/log/messages"); }; destination secure { file("/var/log/secure"); }; destination maillog { file("/var/log/maillog"); }; destination spooler { file("/var/log/spooler"); }; destination boot { file("/var/log/boot.log"); }; destination imap { file("/var/log/imap.log"); }; destination auth { file("/var/log/auth.log"); }; destination cron { file("/var/log/cron"); }; destination console { file("/dev/console"); }; destination root { usertty("root"); }; destination allusers { usertty("*"); }; destination all { file("/var/log/all.log"); }; # Facility Filters filter f_auth { facility(auth); }; filter f_authpriv { facility(authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_ftp { facility(ftp); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_security { facility(security); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; # Level Filters filter f_emerg { level(emerg); }; filter f_alert { level(alert..emerg); }; filter f_crit { level(crit..emerg); }; filter f_err { level(err..emerg); }; filter f_warning { level(warning..emerg); }; filter f_notice { level(notice..emerg); }; filter f_info { level(info..emerg); }; filter f_debug { level(debug..emerg); }; # Filters filter f_messages { level(info..emerg) and (not facility(mail)) and (not facility(authpriv)); }; # Log all kernel messages to the console. log { source(s_sys); filter(f_kern); destination(console); }; # Log anything (except mail) of level info or higher. log { source(s_sys); filter(f_messages); destination(messages); }; # The authpriv file has restricted access. log { source(s_sys); filter(f_authpriv); destination(secure); }; # Log all the mail messages in one place. log { source(s_sys); filter(f_mail); destination(maillog); }; # Everybody gets emergency messages, plus log them on another machine. log { source(s_sys); filter(f_emerg); destination(allusers); }; # Save mail and news errors of level err and higher in a special file. log { source(s_sys); filter(f_uucp); filter(f_news); filter(f_crit); destination(spooler); }; # Save boot messages also to boot.log log { source(s_sys); filter(f_local7); destination(boot); }; # Log cyrus imap in seperate file log { source(s_sys); filter(f_local6); filter(f_debug); destination(imap); }; log { source(s_sys); filter(f_auth); filter(f_debug); destination(auth); }; # Debuging Sending all messages to all.log log { source(s_sys); destination(all); };

2 1

Can I prevent syslog-ng from prepending logs from other servers?
by Matt Mencel 20 Dec '00

20 Dec '00

I am recieving web and ftp logs from another machine on my central logging machine. Syslog-ng prepends the logs with a bunch of information that I don't need and it prevents Analog and Webalizer from parsing the logs correctly. Is there a way to tell syslog-ng not to prepend this information to certain logs? Thanks. Matt mmatt(a)freew3.com

6 10

RE: [syslog-ng]syslog-ng and sendmail
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 20 Dec '00

20 Dec '00

Sendmail logs two lines for each message. The other one should be above this one in the logfile. There is nothing wrong with your configuration. Regards, Drew > -----Original Message----- > From: Serge van Thillo [SMTP:tila@zeelandnet.nl] > Sent: Wednesday, December 20, 2000 2:40 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]syslog-ng and sendmail > > Hi people. > > I compiled syslog-ng today and tried out some things. > It works quite ok, there only a few things I am missing. > > When I log facility mail I only see to adressen. this is the same when I > log > everything to one file. > so for example: > > Dec 20 02:27:34 linux sendmail[10439]: eBK1RX410437: > to=<serge(a)mydomain.nl>, > delay=00:00:00, xdelay=00:00:00, mailer=cyrus, pri=38193, dsn=2.0.0, > stat=Sent > > Only the line telling me who send the message is missing. > > I will include the config file. Can anyone tell me what is wrong? > > Thanks in advance. > > Greets, > Serge. > --------------------------------- > > options { sync (0); > time_reopen (10); > log_fifo_size (1000); > long_hostnames (off); > use_dns (no); > use_fqdn (no); > create_dirs (no); > keep_hostname (yes); > }; > > source s_sys { unix-stream ("/dev/log"); internal(); }; > > destination console { file("/dev/console"); }; > destination messages { file("/var/log/messages"); }; > destination secure { file("/var/log/secure"); }; > destination maillog { file("/var/log/maillog"); }; > destination spooler { file("/var/log/spooler"); }; > destination boot { file("/var/log/boot.log"); }; > destination imap { file("/var/log/imap.log"); }; > destination auth { file("/var/log/auth.log"); }; > destination cron { file("/var/log/cron"); }; > destination console { file("/dev/console"); }; > destination root { usertty("root"); }; > destination allusers { usertty("*"); }; > destination all { file("/var/log/all.log"); }; > > # Facility Filters > filter f_auth { facility(auth); }; > filter f_authpriv { facility(authpriv); }; > filter f_cron { facility(cron); }; > filter f_daemon { facility(daemon); }; > filter f_ftp { facility(ftp); }; > filter f_kern { facility(kern); }; > filter f_lpr { facility(lpr); }; > filter f_mail { facility(mail); }; > filter f_news { facility(news); }; > filter f_security { facility(security); }; > filter f_user { facility(user); }; > filter f_uucp { facility(uucp); }; > filter f_local0 { facility(local0); }; > filter f_local1 { facility(local1); }; > filter f_local2 { facility(local2); }; > filter f_local3 { facility(local3); }; > filter f_local4 { facility(local4); }; > filter f_local5 { facility(local5); }; > filter f_local6 { facility(local6); }; > filter f_local7 { facility(local7); }; > > # Level Filters > filter f_emerg { level(emerg); }; > filter f_alert { level(alert..emerg); }; > filter f_crit { level(crit..emerg); }; > filter f_err { level(err..emerg); }; > filter f_warning { level(warning..emerg); }; > filter f_notice { level(notice..emerg); }; > filter f_info { level(info..emerg); }; > filter f_debug { level(debug..emerg); }; > > # Filters > filter f_messages { level(info..emerg) and (not facility(mail)) and (not > facility(authpriv)); }; > > # Log all kernel messages to the console. > log { > source(s_sys); > filter(f_kern); > destination(console); > }; > > # Log anything (except mail) of level info or higher. > log { > source(s_sys); > filter(f_messages); > destination(messages); > }; > > # The authpriv file has restricted access. > log { > source(s_sys); > filter(f_authpriv); > destination(secure); > }; > > # Log all the mail messages in one place. > log { > source(s_sys); > filter(f_mail); > destination(maillog); > }; > > # Everybody gets emergency messages, plus log them on another machine. > log { > source(s_sys); > filter(f_emerg); > destination(allusers); > }; > > # Save mail and news errors of level err and higher in a special file. > log { > source(s_sys); > filter(f_uucp); > filter(f_news); > filter(f_crit); > destination(spooler); > }; > > # Save boot messages also to boot.log > log { > source(s_sys); > filter(f_local7); > destination(boot); > }; > > # Log cyrus imap in seperate file > log { > source(s_sys); > filter(f_local6); > filter(f_debug); > destination(imap); > }; > log { > source(s_sys); > filter(f_auth); > filter(f_debug); > destination(auth); > }; > > # Debuging Sending all messages to all.log > log { > source(s_sys); > destination(all); > }; > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Syslog-ng adds unwanted entries to my logs...
by Matt Mencel 19 Dec '00

19 Dec '00

Let me try this again. Sorry for inconveniencing you all with multiple emails last night. I have several servers logging to one central server through a firewall. No big deal. However the central logging server is adding entries to the beginning of each line of each log. This is great for most of the logs as it lets me know where each entry came from. In the case of my web and ftp logs however this information is unnecessary and prevents Analog and Webalizer from parsing through the logs correctly. Here's an example from my httpd-access log on my logging server. Dec 19 08:22:28 otherserver root: www.somewebpage.com 123.123.123.123 - - [19/Dec/2000:08:22:28 -0600] "GET /index.html HTTP/1.1" 200 2026 http://www.somewebpage.com/ "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)" The stuff it adds, and that I don't want is everything up to the first entry of the virtualserver. In this case, www.somewebpage.com. So "Dec 19 08:22:28 otherserver root:" needs to be tossed out somehow. Is anyone else doing this or is it not possible to tell syslog-ng not to add these entries? Thanks for any help. Matt mmatt(a)freew3.com

2 1

Re: syslog-ng question on filter facility/priority
by Balazs Scheidler 19 Dec '00

19 Dec '00

> I would like to filter out kern.debug info from messages when we HUP > syslog-ng. I have set up a filter: "filter f_kern.debug { not > facility(kern); };" which filters out all kern messages from going to > /var/adm/messages. I set up another filter "filter f_kern { facility(kern); > };" that logs to destination file /var/log/kern.log" so I can pick up any > other kernel messages. Is there a way to set up a filter for facilty(kern) > that will filter out the debug info but still log the higher level messages > to /var/adm/messages? We are running on Solaris 2.6. filter f_kern { facility(kern) and not level(debug); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

3 3