- syslog-ng - lists.balabit.hu

Extension for syslog-ng
by Martin Neimeier 02 Aug '00

02 Aug '00

Hello, for me, there are some features missing: 1. Real boolean expresions in filter statements with: and, or, not , (, ) filter test { ( ( program("abc") or program("cde") ) and level("info") ) or ( program("xyz") and level("debug") ); }; 2. What about actions ? Actions can be used to modify the contents of an log-message (sed-like) befor writing it to its destination. 3. new destination database Is something planed ? Is it interesting ? cu MN -- -------------- Martin Neimeier Tel:+49(6262)912344 Fax:+49(6262)912347

2 1

Unsresolved reference
by Nicholas Brawn 02 Aug '00

02 Aug '00

Using syslog-ng 1.4.4: [root@utumno /etc]# /usr/local/sbin/syslog-ng -d -f /etc/syslog-ng.conf io.c: Preparing fd 3 for reading io.c: listening on fd 4 Warning: Internal messages are not referenced, they'll go to /dev/null unresolved reference: f_ruby Error initializing configuration, exiting. This is the filter it is talking about: filter f_ruby { host(ruby.domain.com); }; Cheers, Nick -- Secure email preferred. PGP key available on request. Phone: +61 2 9025 7571 || Email: nickbrawn(a)onetel.com

2 1

RE: [syslog-ng] Unsresolved reference
by Hamilton, Andrew Mr. 02 Aug '00

02 Aug '00

Try: filter f_ruby { host("ruby.domain.com"); }; Regards, Drew > -----Original Message----- > From: Nicholas Brawn [SMTP:nickbrawn@onetel.com] > Sent: Wednesday, August 02, 2000 2:19 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] Unsresolved reference > > Using syslog-ng 1.4.4: > > [root@utumno /etc]# /usr/local/sbin/syslog-ng -d -f /etc/syslog-ng.conf > io.c: Preparing fd 3 for reading > io.c: listening on fd 4 > Warning: Internal messages are not referenced, they'll go to /dev/null > unresolved reference: f_ruby > Error initializing configuration, exiting. > > This is the filter it is talking about: > > filter f_ruby { host(ruby.domain.com); }; > > Cheers, > Nick > > > > -- > Secure email preferred. PGP key available on request. > Phone: +61 2 9025 7571 || Email: nickbrawn(a)onetel.com > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Printing of Priority in the Log files
by Jonathan Gilpin 28 Jul '00

28 Jul '00

Hi, Is is possible to make syslog-ng print the priority level to the log files? --- { xpedio - where mobile means anywhere, anytime, on anything (almost) } Jonathan Gilpin, +46(0) 733 44 10 09

2 1

Log directory
by Nicholas Brawn 17 Jul '00

17 Jul '00

Is there an 'option' to specify a defined "log directory" instead of having to specify the full path to a log file? I am using syslog-ng 1.4.4. Cheers, Nick -- Secure email preferred. PGP key available on request. Phone: +61 2 9025 7571 || Email: nickbrawn(a)onetel.com

2 1

syslog-ng 1.4.5
by Balazs Scheidler 15 Jul '00

15 Jul '00

Hi, For those who have not noticed I silently released syslog-ng 1.4.5, hopefully getting rid of the memory leak some of you encountered. So if you had a syslog-ng process using >10M RAM, you should upgrade your syslog-ng. (The problem was caused by network destinations) There's still one thing to fix, but I don't think that would be too annoying: while : ; do killall -HUP syslog-ng; done This still results in some leaks, but while : ; do killall -HUP syslog-ng; sleep 1; done doesn't. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

RE: [syslog-ng] Problems with syslog-ng use over a redireted port inside an SSH s ession
by Edwards, David 10 Jul '00

10 Jul '00

Hi, > -----Original Message----- > From: Balazs Scheidler [mailto:bazsi@balabit.hu] > Subject: Re: [syslog-ng] Problems with syslog-ng use over a redireted > port inside an SSH s ession > > > > > I'm using syslog-ng over redirected ports inside an SSH > > > > channel and whenever I HUP syslog-ng, the SSH channel > > > > closes > > > > > > Maybe you should try to handle the SIGPIPE signal in your > perl script? > > > though SIGPIPE should occur only on output, reading from a > > > broken socket > > > should result in an EPIPE to be returned. From what I can tell, the channel drops when the child process writing to it exits. I can trap the SIGPIPE and the channel stays up but as soon as the child closes the socket and exits, the channel drops. I think the script needs a re-think :-) > syslog-ng closes TCP connections when a SIGHUP is received, > but you can > change this behaviour with the keep-alive option. > > destination all { tcp("loghost" port(1514) keep-alive(yes)); }; Thanks, this works a treat! RTFM eh.. I've used it in the source rules however. tcp(ip("127.0.0.12") port(51400) keep-alive(yes)); The script _sends_ logs to a remote syslog-ng loghost which listens on a localhost port redirected over the ssh channel. I'm sure the problem is in the script now so I'll leave you folks alone. Looks like it's back to the drawing board again. Thanks for the help! ciao dave ---- Dave Edwards mailto:david.edwards@eds.com Ph: +61 8 83015720 EDS Network Support Glenside, South Australia ---- PGP Fingerprint: B9C0 AB83 F18B CE88 C167 67B9 6AB2 C630 3DC9 ACC2

1 0

RE: [syslog-ng] Problems with syslog-ng use over a redireted port inside an SSH s ession
by Edwards, David 10 Jul '00

10 Jul '00

Hi > -----Original Message----- > From: Balazs Scheidler [mailto:bazsi@balabit.hu] > Subject: Re: [syslog-ng] Problems with syslog-ng use over a redireted > port inside an SSH s ession > > > I'm using syslog-ng over redirected ports inside an SSH > > channel and whenever I HUP syslog-ng, the SSH channel > > closes > > Maybe you should try to handle the SIGPIPE signal in your perl script? > though SIGPIPE should occur only on output, reading from a > broken socket > should result in an EPIPE to be returned. Well that's what I would have thought, the child process _is_ writing the socket but does not recieve any such signal (or appears not to..) The child lives on and when it next writes the socket, the channel drops and then it dies. Netcat dies imediately when syslog-ng is HUPPED, which points again at the script of course.. I'll capture the ssh (openssh 2.1) debug output and I can post the key bits of the script if you think it would help? And I'll add a trap for SIGPIPE. Thanks for the responce. ciao dave ---- Dave Edwards mailto:david.edwards@eds.com Ph: +61 8 83015720 EDS Network Support Glenside, South Australia ---- PGP Fingerprint: B9C0 AB83 F18B CE88 C167 67B9 6AB2 C630 3DC9 ACC2

2 1

Problems with syslog-ng use over a redireted port inside an SSH s ession
by Edwards, David 10 Jul '00

10 Jul '00

Hi, I'm using syslog-ng over redirected ports inside an SSH channel and whenever I HUP syslog-ng, the SSH channel closes. This appears to be a problem with syslog-ng, as if I kill -KILL syslog-ng, the channel remains in place. I copy logs over the channel using a perl script. This also may be suspect of course.. The channel seems to close when the script writes to the (possibly disrupted tcp) socket. If I don't write to the socket, the channel stays up.. I use the IO::Socket method $socket->can_write to attempt to find out if the socket is still writable but this does not show any problems but the channel dies anyway. Anyone else seeing this problem? ciao dave ---- Dave Edwards mailto:david.edwards@eds.com Ph: +61 8 83015720 EDS Network Support Glenside, South Australia ---- PGP Fingerprint: B9C0 AB83 F18B CE88 C167 67B9 6AB2 C630 3DC9 ACC2

2 1

Multiple criteria per filter and hostnames?
by Nicholas Brawn 10 Jul '00

10 Jul '00

I have been testing both nsyslog and syslog-ng recently (after discovering syslog-ng is based on nsyslog). One thing I have noticed while testing syslog-ng 1.4.4, is that it doesn't appear to allow filters such as: filter myfilter { facility(auth); host(system); }; which were valid in nsyslog. In addition, nsyslog appeared to support reverse lookups of the source ip, to resolve into fqdn. So a message received by nsyslog from host "blah1" would appear in logs as "blah1.mydomain.com". Whereas in syslog-ng it would appear as "blah1" OR with the long_hostnames(yes) option, would log the hostname as "blah1/blah1". Questions: 1. Is it possible to specify multiple criteria per filter? 2. Is it possible to enable reverse lookups and log hostname in fqdn? Cheers, Nick -- GPG/PGP key available on request.

2 1