- syslog-ng - lists.balabit.hu

Re: syslog-ng
by Balazs Scheidler 08 Aug '00

08 Aug '00

> The problem with that is everytime syslog-ng restarts (or HUPd) for whatever > reasons there will be a new instance of the process running. syslog-ng sends a TERM signal IIRC on HUPs, if it doesn't it's a bug. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: syslog-ng
by Balazs Scheidler 08 Aug '00

08 Aug '00

> I have been trying syslog-ng and extremely happy with the power of > using it. I have one question, when using the program option under > destination drivers, my PERL script gets launched when I start syslog-ng, > but executes once and then dies. I am using this script to page any time I > see an log entry, but it only runs the first time it runs. you can read log messages on your stdin, so instead of fetching a single line and exiting keep reading your input like this: #!/usr/bin/perl while (<>) { # send to pager } -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Creating sockets?
by Ted Parnefors 05 Aug '00

05 Aug '00

Is it possible to create sockets with "syslog-ng" similar to how you can do so with "syslogd" ? The reason for this beeing that I'm running some applications chrooted, and need to open a /dev/log socket that is in that chroot-jail.

2 1

Re: Re: [syslog-ng]For loghost application
by Franco Cucchi 03 Aug '00

03 Aug '00

Hi John, thanks very much for your replay! As I told in my previous e-mail I'm trying to use a Linux machine as loghost for IBM AIX and SUN Solaris 7 machines. In the AIX machine I tryed to launch the syslogd with this two examples of syslog.conf files: (See attached file: syslog.conf.txt)(See attached file: syslog.conf) The commad to invoke the syslog daemon is: > nohup /usr/sbin/syslogd -d -f /<path>/syslog.conf but the nohup.out file that contains the response tells me that the syslogd can't resolve " * " as all the priority names and no messages appear in /var/log of the Linux machine. Take a look for example at this row: auth.debug;user.debug;daemon.none @cdslog where the cdslog is the name of the log host and ws2 (in the file syslog.conf) is the name of the IBM machine. If I want to write the messages in a particular file in the log host ( example /var/log/messages) where should I have to specify this path (cause I thik that @cdslog isn't enough and I can't see where messages are written)? If I think at using the syslog-ng, the advantage is great or the syslogd is enough for my applications? Thanks in advance Best Regards Franco *.* @192.168.41.15 # Log all kernel messages to the console. # Logging much else clutters up the screen. #kern.* /dev/console # Log anything (except mail) of level info or higher. #Don't log private authentication messages! *.info;mail.none;authpriv.none /var/log/messages # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* /var/log/maillog # Log all ssh1 traffic local1.info /var/log/sshdlog # Everybody gets emergency messages, plus log them on another # machine. *.emerg * # Save mail and news errors of level err and higher in a # special file. uucp,news.crit /var/log/spooler

1 0

For loghost application
by Franco Cucchi 03 Aug '00

03 Aug '00

Hi all, I'm very new of this new feature syslog-ng so every advice is welcome! I try to configure the syslog.conf for the syslog daemon running on a IBM AIX platform to write messages on a loghost machine on Linux platform. Every attempt (following lots of advices) failed till now. So, if it's possible to use the syslog-ng to do this I'm going to do this but I would like to take a look at a simple script that shows more or less what should be written to obtain the result that I want. I'm going to take a look at the documentation but I think that could be very helpful to look at some previous working scripts that make a machine to write messages onto another machine. Thanks in advance. Best regards Please reply to franco.cucchi(a)db.com

2 1

remote logging
by dchristman 03 Aug '00

03 Aug '00

Folks - Newbie question.... I am trying to log all messages from a large number ( >50 ) of remote hosts to a central log host. I am using the syntax: destination all { file(/"var/adm/$HOST/messages" create_dirs(yes) ) ;}; I am running solaris 2.7 on SPARC. Please respond directly to dec(a)corp.talkcity.com TIA Dave Christman TALK CITY IT Group dchristman(a)corp.talkcity.com http://www.talkcity.com

2 1

RE: [syslog-ng] (no subject)
by David 03 Aug '00

03 Aug '00

Sorry - It seems that messages from remote hosts are ending up in /var/adm/messages instead of /var/adm/<remote-host>/messages. How to tie the source hostname to the destination filename is the question, I guess. Thanks, Dave --- "Ohrberg, Mick" <Mick.Ohrberg(a)umb.com> wrote: > David, > > What is the question? > > : -----Original Message----- > : From: David [mailto:david_christman@yahoo.com] > : Sent: Wednesday, August 02, 2000 4:23 PM > : To: syslog-ng(a)lists.balabit.hu > : Subject: [syslog-ng] (no subject) > : > : > : Folks - > : > : > : Newbie question.... > : I am trying to log all messages from a large > number ( > : >50 ) of remote hosts to a central log host. I am > : using the syntax: > : > : destination all { file(/"var/adm/$HOST/messages" > : create_dirs(yes) ) ;}; > : > : > : I am running solaris 2.7 on SPARC. > : > : > : TIA > : > : > : ===== > : > : Dave Christman > : Email: david_christman(a)yahoo.com > : > : > : > : __________________________________________________ > : Do You Yahoo!? > : Kick off your party with Yahoo! Invites. > : http://invites.yahoo.com/ > : > : _______________________________________________ > : syslog-ng maillist - syslog-ng(a)lists.balabit.hu > : http://lists.balabit.hu/mailman/listinfo/syslog-ng > : > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng ===== Dave Christman Email: david_christman(a)yahoo.com __________________________________________________ Do You Yahoo!? Kick off your party with Yahoo! Invites. http://invites.yahoo.com/

2 2

RE: [syslog-ng] (no subject)
by Ohrberg, Mick 02 Aug '00

02 Aug '00

David, What is the question? : -----Original Message----- : From: David [mailto:david_christman@yahoo.com] : Sent: Wednesday, August 02, 2000 4:23 PM : To: syslog-ng(a)lists.balabit.hu : Subject: [syslog-ng] (no subject) : : : Folks - : : : Newbie question.... : I am trying to log all messages from a large number ( : >50 ) of remote hosts to a central log host. I am : using the syntax: : : destination all { file(/"var/adm/$HOST/messages" : create_dirs(yes) ) ;}; : : : I am running solaris 2.7 on SPARC. : : : TIA : : : ===== : : Dave Christman : Email: david_christman(a)yahoo.com : : : : __________________________________________________ : Do You Yahoo!? : Kick off your party with Yahoo! Invites. : http://invites.yahoo.com/ : : _______________________________________________ : syslog-ng maillist - syslog-ng(a)lists.balabit.hu : http://lists.balabit.hu/mailman/listinfo/syslog-ng :

1 0

(no subject)
by David 02 Aug '00

02 Aug '00

Folks - Newbie question.... I am trying to log all messages from a large number ( >50 ) of remote hosts to a central log host. I am using the syntax: destination all { file(/"var/adm/$HOST/messages" create_dirs(yes) ) ;}; I am running solaris 2.7 on SPARC. TIA ===== Dave Christman Email: david_christman(a)yahoo.com __________________________________________________ Do You Yahoo!? Kick off your party with Yahoo! Invites. http://invites.yahoo.com/

1 0

Extension for syslog-ng
by Martin Neimeier 02 Aug '00

02 Aug '00

Hello, for me, there are some features missing: 1. Real boolean expresions in filter statements with: and, or, not , (, ) filter test { ( ( program("abc") or program("cde") ) and level("info") ) or ( program("xyz") and level("debug") ); }; 2. What about actions ? Actions can be used to modify the contents of an log-message (sed-like) befor writing it to its destination. 3. new destination database Is something planed ? Is it interesting ? cu MN -- -------------- Martin Neimeier Tel:+49(6262)912344 Fax:+49(6262)912347

2 1