- syslog-ng - lists.balabit.hu

Doubt !!
by Kleyson Rios 29 Sep '00

29 Sep '00

The expression : log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; write for destination(mailinfo) the messages where " filter(f_mail) AND filter(f_info) " is true or " filter(f_mail) OR filter(f_info) " is true ? Because in my syslog-ng.conf I have : destination mailinfo { file("/var/log/syslog-ng/gandalf/mail.info"); }; destination mailwarn { file("/var/log/syslog-ng/gandalf/mail.warn"); }; filter f_mail { facility(mail); }; filter f_info { level(info); }; filter f_warn { level(warn); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; and my logs "mailinfo" and "mailwarn" are same . Kleyson Rios. Brazil.

2 1

syslog-ng 1.4.7 and libol 0.2.20
by Balazs Scheidler 29 Sep '00

29 Sep '00

Hi, I've released syslog-ng 1.4.7 and libol 0.2.20, which you can find at the usual places. This release fixes a quite serious memory leak bug. Scott, please check if this one fixes your problems. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

RE: [syslog-ng]SQL support with syslog
by Hamilton, Andrew Mr. 26 Sep '00

26 Sep '00

The easiest thing to do is to send the log output to scripts. Then you can parse and feed it to whatever application you want, however you want. Drew > -----Original Message----- > From: offset [SMTP:offset@privacyx.com] > Sent: Monday, September 25, 2000 9:46 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]SQL support with syslog > > I am trying to come up with a centralized syslog solution and I wanted > to hear from other people that have a centralized solution in place. > > I was thinking about using syslog-ng running on the collection server > but I'm not sure how to go about doing the real-time alerting and > long-term storage for possible forensics use. > > I've heard good things about logsurfer, so I was going to explore using > this tool http://www.cert.dfn.de/eng/logsurf/ > > How do I go about gathering syslog data directly into a SQL database in > real-time (or near real-time) such as Postgresql, or mysql? > > Thanks, > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

SQL support with syslog
by offset 25 Sep '00

25 Sep '00

I am trying to come up with a centralized syslog solution and I wanted to hear from other people that have a centralized solution in place. I was thinking about using syslog-ng running on the collection server but I'm not sure how to go about doing the real-time alerting and long-term storage for possible forensics use. I've heard good things about logsurfer, so I was going to explore using this tool http://www.cert.dfn.de/eng/logsurf/ How do I go about gathering syslog data directly into a SQL database in real-time (or near real-time) such as Postgresql, or mysql? Thanks,

1 0

RE: [syslog-ng]Simple question.
by Shawn Davenport 25 Sep '00

25 Sep '00

Larry, give this a try... destination all { udp("192.168.0.24" port(514)); }; hope that helps. thanks... shawn -----Original Message----- From: Cashdollar, Larry [mailto:larry.cashdollar@akamai.com] Sent: Monday, September 25, 2000 11:01 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]Simple question. I have setup an OpenBSD logging host. I am installing syslog-ng on all my solaris boxes. I am having a little trouble getting syslog-ng to log to a remote host. From the man page/documentation I came up with destination all {udp ("192.168.0.24","514");}; This returns a syntax error. Any help would be appreciated. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Simple question.
by Cashdollar, Larry 25 Sep '00

25 Sep '00

I have setup an OpenBSD logging host. I am installing syslog-ng on all my solaris boxes. I am having a little trouble getting syslog-ng to log to a remote host. From the man page/documentation I came up with destination all {udp ("192.168.0.24","514");}; This returns a syntax error. Any help would be appreciated.

1 0

Syslog-ng in Solaris
by Kleyson Rios 25 Sep '00

25 Sep '00

Hi, I can run syslog-ng in Solaris Intel ?? Thank You .

2 1

Re: [syslog-ng]chain_hostname(yes) complicates use of $HOST
by John A. Parker 25 Sep '00

25 Sep '00

In order to get around the problem I mentioned earlier with messages being logged to the $HOST (s) "Message" and "last", I altered the sources.c file do_add_source_name subroutine lines from: if (logmsg->host) logmsg->host = c_format("%fS/%fS", logmsg->host, name); to: if (logmsg->host) logmsg->host = c_format("%fS/%fS", name, logmsg->host); After making this change (swapping name and logmsg->host arguments), messages that used to look like: Sep 20 02:08:22 Message/aaaa.bbbb.cornell.edu forwarded from aaaa: sshd[40128]: log: ... Now appear as: Sep 20 02:08:22 aaaa.bbbb.cornell.edu/Message forwarded from aaaa: sshd[40128]: log: ... (To be honest, I think the second format looks better anyway.) I actually changed (simplified) the entire do_add_source_name subroutine chain_hostnames block in accordance with our needs. I'm including below the patch I generated to show how that code now looks. *** sources.c Tue Aug 22 04:44:55 2000 --- sources.c.new Wed Sep 20 06:25:53 2000 *************** *** 198,223 **** name = get_source_hostname(logmsg->saddr, self->use_dns, self->use_fqdn); if (self->chain_hostnames) { ! if (logmsg->flags & LF_LOCAL) { ! /* local */ ! ol_string_free(logmsg->host); ! logmsg->host = c_format("%S@%fS", ! self->name, name); ! } ! else if (!logmsg->host) { ! /* remote && no hostname */ ! logmsg->host = c_format("%S/%fS", name, name); ! } ! else { ! /* everything else, append source hostname */ ! if (logmsg->host) ! logmsg->host = ! c_format("%fS/%fS", ! logmsg->host, name); ! else ! logmsg->host = ! c_format("%fS", name); ! } } else { ol_string_free(logmsg->host); --- 198,208 ---- name = get_source_hostname(logmsg->saddr, self->use_dns, self->use_fqdn); if (self->chain_hostnames) { ! if (logmsg->host) ! logmsg->host = c_format("%fS/%fS", ! name, logmsg->host); ! else ! logmsg->host = c_format("%fS", name); } else { ol_string_free(logmsg->host); --- John A. Parker Senior Programmer/Analyst - AIX Cornell University jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

3 4

RE: [syslog-ng][daan@sambal.hobby.nl: syslog-ng on rm/sinix-y]
by Looy.Gert-Jan 25 Sep '00

25 Sep '00

This is what I get on sinix (ReliantUnix v5.43c40) : (and on any version of syslog-ng I've tried) io.c: bind_inet_socket() bind failed 0.0.0.0:9876 Socket operation on non-socket Error initializing configuration, exiting. Where is that libxnet and could it have anything to do with this? The port choosen is definitely not in use by any other program.. Thanks! -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: maandag 25 september 2000 10:55 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng][daan(a)sambal.hobby.nl: syslog-ng on rm/sinix-y] For those trying to run syslog-ng on sinix. As it seems removing the the library libxnet from the makefile fixes network related problems on sinix. ----- Forwarded message from daan <daan(a)sambal.hobby.nl> ----- Date: Sun, 24 Sep 2000 21:39:03 +0200 (MEST) From: daan <daan(a)sambal.hobby.nl> To: Balazs Scheidler <bazsi(a)balabit.hu> Subject: syslog-ng on rm/sinix-y -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I should have reported this back a week ago, sorry. The problem was libxnet. I removed it from the Makefile after running configure in both libol and syslog-ng. It now runs as perfect as could be (to me). I didn't compile in the unix-streams i think, because /dev/log seems quiet. (It is not a sun-stream is it?). Thank you for a great package. :wq! Daan Hoogland v v dhoogland(a)snow.nl OO developers / ### ## ## # >---X---< http://snow.nl # # # # # # # # / Snow B.V. ## # # # # # # # ^ ^ Tel. (+31)418-653333 # # # # # # # # Fax. (+31)418-653666 ### # # ## ## ## -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.1 (GNU/Linux) Comment: For info see http://www.gnupg.org Filter: gpg4pine 4.0 (http://azzie.robotics.net) iD8DBQE5zlhZ8i4+cJqeNIwRAl03AJ9QntcWIK6Y1QLAjsR9thgaIPO+8ACdEIBw 4ZqXSflktFIMsS3918oCY0E= =ukV5 -----END PGP SIGNATURE----- ----- End forwarded message ----- -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

[daan@sambal.hobby.nl: syslog-ng on rm/sinix-y]
by Balazs Scheidler 25 Sep '00

25 Sep '00

For those trying to run syslog-ng on sinix. As it seems removing the the library libxnet from the makefile fixes network related problems on sinix. ----- Forwarded message from daan <daan(a)sambal.hobby.nl> ----- Date: Sun, 24 Sep 2000 21:39:03 +0200 (MEST) From: daan <daan(a)sambal.hobby.nl> To: Balazs Scheidler <bazsi(a)balabit.hu> Subject: syslog-ng on rm/sinix-y -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I should have reported this back a week ago, sorry. The problem was libxnet. I removed it from the Makefile after running configure in both libol and syslog-ng. It now runs as perfect as could be (to me). I didn't compile in the unix-streams i think, because /dev/log seems quiet. (It is not a sun-stream is it?). Thank you for a great package. :wq! Daan Hoogland v v dhoogland(a)snow.nl OO developers / ### ## ## # >---X---< http://snow.nl # # # # # # # # / Snow B.V. ## # # # # # # # ^ ^ Tel. (+31)418-653333 # # # # # # # # Fax. (+31)418-653666 ### # # ## ## ## -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.1 (GNU/Linux) Comment: For info see http://www.gnupg.org Filter: gpg4pine 4.0 (http://azzie.robotics.net) iD8DBQE5zlhZ8i4+cJqeNIwRAl03AJ9QntcWIK6Y1QLAjsR9thgaIPO+8ACdEIBw 4ZqXSflktFIMsS3918oCY0E= =ukV5 -----END PGP SIGNATURE----- ----- End forwarded message ----- -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0