- syslog-ng - lists.balabit.hu

Preventing syslog-ng from halting if a source is not found
by Nick DeClario 11 Dec '00

11 Dec '00

I am having difficulty trying to setup syslog-ng to continue running if a source is not found. Right now I have it scanning /dev/log and /var/chroot/named/dev/log on my Linux system. In some cases the /var/chroot/named/dev/log will not exist on some systems I have here. Is there a way I can setup the configuration file to say if /var/chroot/named/dev/log doesn't exist to simply ignore it and not look for logs there at all? Right now syslog-ng refuses to start if it doesn't exist. -Nick

1 0

Filtering confusion.
by Brian Leveille 08 Dec '00

08 Dec '00

All, I have a config I need help with: I have 2 Linux boxes running syslog-ng behind a Foundry ServerIron load balancing switch, which provides both load sharing and redundancy. The Foundry maintains it's server farm by both pings and actual syslog messages. It does this by sending garbage to the specified UDP port (514). If it receives a 'Port Unavailable' message, the service must no longer be running and the Foundry removes the server from the farm and redirects traffic to available servers. If it receives nothing, it assumes the service must be running and the message was received successfully. My problem is that my syslog-ng receives this message and processes it. My conf dictates that anything coming over udp 514 get written to a $HOST macro and $DATE macro expanded filename. So, I end up with a directory that contains files with garbage messages from the Foundry switch. How do I put a filter in to redirect these garbage test messages? Preferably redirecting them to pipe("/dev/null"). My foundry is called ns-foundry1 in my DNS server and it's IP is 208.3.134.90. The config file below allows the Foundry garbage messages to hit on the second log statement (log { source(src); destination(everything); };), which is bad. Thanks for your help... Here is my config file: options { sync(0); #use_dns(no); create_dirs(yes);}; source foundry { udp(ip("208.3.134.90") port(514)); }; source int { unix-stream("/dev/log"); internal(); }; source src { udp(port(514)); }; destination everything { file("/NetscreenLogs/$HOST/$HOST.$MONTH-$DAY-$YEAR.log" owner(NetscreenLogs) group(NetscreenLogs) perm(0777) dir_perm(0777)); }; filter foundryfilt { host("ns-foundry1"); }; destination void { pipe("/dev/null"); }; destination internallogs { file("/var/log/messages"); }; log { source(foundry); filter(foundryfilt); destination(void); }; log { source(src); destination(everything); }; log { filter(DEFAULT); destination(internallogs); }; Brian Leveille ------------------- Senior Internetworking Engineer DefendNet Solutions, Inc. www.defendnet.com

1 0

Question....
by Sami Saleh 07 Dec '00

07 Dec '00

We're trying to configure syslog-ng to only accept logs from specific servers. Here is the code we've implemented within syslog-ng.conf. options { long_hostnames(off); sync(0); }; source src { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp(192.168.1.20,514); }; However, we get the following error when we start the daemon: parse error at 5 Parse error reading configuration file, exiting. The objective is to only allow certain hosts to log to this server. Any help would be appreciated. Sami

3 4

Host matching
by Brian E. Seppanen 06 Dec '00

06 Dec '00

Ok, my previous message about it not creating the files. Forget it. My host patterns aren't matching, and the macro expansion works just fine. However. I have a couple of hosts that have lengthy names and don't seem to be cooperating. filter router {host("router-2-fe0-1-bb-vl4");}; I've taken exactly what appears in my message files and put it into this filter. However, the filter won't match. Would this be a problem with all of the - characters? I've attempted to escape these characters with \. How can I match these hostnames? Thanks, Brian Seppanen Charter Communications Regional Data Center 906-228-3100 ext 23 Marquette, MI seppy(a)chartermi.net

1 1

Using File Macros.
by Brian E. Seppanen 06 Dec '00

06 Dec '00

Hi: I just got a working config going. I'm trying to set up my config to auto create files based on Priority Level. The files are not being created. What am I missing? These are logs from cisco routers that have been configured to log to this host. source udp_src {udp();}; destination up.cisco { file("/var/log/cisco/up.cisco.$PRIORITY");}; log { source(udp_src); filter(esc7223); filter(imt7206); destination(up.cisco);$ It was working previously with syslog, and I know that I'd get some output immediately. Also does this auto create files? What is the proper way of shutting down the daemon? Will it take -HUP -USR1 or any of the other signals? Thanks for the help. Brian Seppanen Charter Communications Regional Data Center 906-228-3100 ext 23 Marquette, MI seppy(a)chartermi.net

1 0

BSDi strptime function ?
by Bharath Aleti 06 Dec '00

06 Dec '00

Hi Wanted to know if anyone on this list had any success with a function to replace strptime() function for BSDi ? Any inputs (pros and cons) regarding working with syslog-ng on BSDi systems are most welcome. Thanks in advance Bharath Aleti

3 3

TCP based Windows syslog client
by Dan Schleifer 06 Dec '00

06 Dec '00

Howdy Folks, I've been looking at syslog clients for windows, and have not yet found one that can do tcp based logging. Does anyone know of such a program (OpenSource/Commercial/Free Software, doesn't matter)? I'm in the unfortunate situation of needing to log events from about 100 NT machines, and would rather not rely upon UDP... Thank. -Dan -- Dan Schleifer | 804.242.5088 | dan(a)soyjew.com Super Jew

3 2

Encryption?
by Brian E. Seppanen 06 Dec '00

06 Dec '00

Hello: I've started looking into using syslog-ng and it looks very nice. I was curious about the encryption option in the sample config. How is that accomplished? Where would the documentation for that option be? How comparible is syslog-ng to syslog in performance terms? Obviously encryption would increase the load and that is acceptable to a point. Thanks for your assistance. Brian Seppanen Charter Communications Regional Data Center 906-228-3100 ext 23 Marquette, MI seppy(a)chartermi.net

2 1

Re: Syslog-ng and SNMP traps
by Balazs Scheidler 06 Dec '00

06 Dec '00

> Sorry if this is a stupid question. > As I don't know many things about SNMP > by reading the documentation for syslog-ng > I didn't understand whether syslog-ng > can actually send SNMP traps or not. > If it does, how does it do it? syslog-ng by itself cannot send SNMP traps, but you can extend it with a small program which can. For example: source src { unix-stream("/dev/log"); internal(); }; destination traps { program("/usr/local/sbin/sendtraps"); }; log { source(src); destination(traps); }; And /usr/local/sbin/sendtraps contains: #!/bin/sh while read line; do snmptrap ... done of course you might need to filter messages going out as traps. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

couple of questions about configs
by Deja User 01 Dec '00

01 Dec '00

Hi All, I'm running ver 1.4.9a and I'm need of some assistance on the configs, I'm going to be using syslog to receive remote messages from approximately 60+ routers. the problem I'm having is that I cant seem to set up syslog-ng to run in real time. By doing an strace I do see that I'm receiving the message but syslog appears to hold them and dump multiple messages at one time, I've enabled sync(0) but that doesn't seem to help. Second is that when syslog-ng does write to the file it removes the carriage returns at the end of the lines, thus making it difficult to read. Below is a copy of my test config, any suggestions would be appreciated. Aaron options { sync(0); use_dns(NO); create_dirs(yes); }; source UDP { udp(); }; destination ATLSSR1 { file("logs/ATLSSR1.html"); }; destination Default { file("logs/default.html"); }; filter ATLSSR1 { host(10.192.224.1); }; log { source(UDP); filter(ATLSSR1); destination (ATLSSR1); }; log { source(UDP); filter(DEFAULT); destination(Default); }; ------------------------------------------------------------ --== Sent via Deja.com http://www.deja.com/ ==-- Before you buy.

1 0