- syslog-ng - lists.balabit.hu

syslog-ng on Solaris 2.4 Sparc
by Andrew A. Razdolsky 20 Jun '00

20 Jun '00

Hi all! I'v just installed syslog-ng v.1.4.4 and for now can't make it to work. First, i can't write test log to it from localhost only it listen for remote connections. Second, i can't compile "match" statements, error occur like this: 'Error compiling regular expression: "match" () Parse error reading configuration file, exiting.' I can't solve this. Any help will by appreciated! P.S. I make configure with '--enable-sun-streams' setting. - Best Regards, Andrew A. Razdoslky NSC KIPT Network Operation Center

1 0

weird problems logging kern.notice with syslog-ng
by Robert Coli 20 Jun '00

20 Jun '00

Hi. I am running the latest syslog-ng under Solaris 2.7 and I'm having problems getting it to do anything with messages of type "kern.notice". Here are the relevant lines in my syslog-ng conf : filter f_auth { facility(auth); }; filter f_kern { facility(kern); }; filter f_notice { level(notice); }; destination messages { file("/var/adm/messages"); }; destination syslog { file("/var/log/syslog"); }; destination authlog { file("/var/log/authlog"); }; destination remote { tcp("xxx.xxx.xxx.xxx" port(514) ); }; # kern.notice /dev/console log { source("system"); filter("f_kern"); filter("f_notice"); destination("console"); destination("messages"); destination("remote"); }; # auth.notice /dev/console log { source("system"); filter("f_auth"); filter("f_notice"); destination("console"); destination("authlog"); destination("messages"); destination("remote"); }; --- Notice that the auth.notice and kern.notice areas are identical, except for the f_kern vs. f_auth filters. -- [happy] /var/adm # logger -p auth.notice AUTH NOTICE TEST #5 [happy] /var/adm # logger -p kern.notice KERN NOTICE TEST #5 [happy] /var/adm # tail messages Jun 8 11:19:32 system@w4 root: AUTH NOTICE TEST #5 -- Anyone have any idea why syslog-ng is picking up auth notice just fine and not picking up kern notice? Thanks! -RC

3 4

Re: klogd on Linux
by klaas.vangend＠philips.com 20 Jun '00

20 Jun '00

Stefan Stammler wrote: > I run syslog-ng 1.4.4, and it works fine except for one thing: the > Linux klogd seems to have problems with it. When both daemons are > running, no kernel messages are logged at all. Stefan, I experience the same thing when running SuSE Linux 6.4 (kernel 2.2.14, gcc 2.95.2) I however didn't have any troubles on Caldera OpenLinux 2.3 (kernel 2.2.10, gcc 2.91.66) I haven't found any solution yet. -- Groetjes, Klaas --------------------------------------------------------------------- Philips CryptoWorks 040-2738472 klaas.vangend(a)philips.com Sioux Technische Software Ontwikkeling BV 040-2677100 klaas.van.gend(a)sioux.nl

1 0

chroot
by Ted Parnefors 19 Jun '00

19 Jun '00

If I'm running some applications in a "chroot"-ed environment, is there any way that I could create a /dev/log socket in the chroot-environment, just like the normal syslog can do? (I'm running on a Linux system) -- Ted Parnefors <ted(a)mtv.se>, KeyID 0x6627DEE4 PGP Fingerprint 1C39FA94703EB54A011CF18932018E256627DEE4

1 0

syslog-ng 1.4.4 and IRIX 6.x
by C. Chan 19 Jun '00

19 Jun '00

Hello, I recently downloaded and built syslog-ng-1.4.4 under IRIX 6.5 without difficulty. I created a syslog-ng.conf similar to my existing syslog.conf. However, none of unix-stream/dgram or sun-streams would work. IRIX uses a a stream /dev/log but apparently it isn't close enough to Sun's. I've seen mention of OSF1 and AIX mentioned in the list archives, but didn't see one re. IRIX in my brief search. Has someone ported syslog-ng to IRIX or has some ideas about where to begin? -- C. Chan < c-chan(a)uchicago.edu > Dept. of Radiology, The University Of Chicago Advanced and High Performance Computing PGP Public Key: finger cchan(a)surya.bsd.uchicago.edu

2 2

AIX Performance
by John A. Parker 19 Jun '00

19 Jun '00

Hi. You've touched on tweaking the gc_idle_threshold, gc_busy_threshold, and log_fifo_size settings to improve syslog-ng performance. I wondered if you might expound upon why altering these has an effect on performance? My central syslog-ng server (handling syslogs for about 30 other systems) is loaded to 50% or more by syslog-ng alone. As our other real time processing of the output from syslog-ng is consuming a comparable amount of system resource, we're going to have to boost the hardware or tune the processes. We don't have "spikes" in logs, just a ton of constant messages. If I understood better what each of the option settings accomplished I think I'd have a better chance of getting the tuning as right as possible. Thanks! John --- John A. Parker Senior Programmer/Analyst - AIX Cornell University jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

1 0

klogd on Linux
by Stefan Stammler 19 Jun '00

19 Jun '00

I run syslog-ng 1.4.4, and it works fine except for one thing: the Linux klogd seems to have problems with it. When both daemons are running, no kernel messages are logged at all. An strace on klogd shows the following error: connect(1, {sun_family=AF_UNIX, sun_path="/dev/log"}, 10) = -1 EPROTOTYPE (Protocol wrong type for socket) Killing syslog-ng and starting syslogd without touching klogd makes it run fine. What could be the problem? I've read on the list that the starting order of the daemons is important, but I tried all possibilities, always with the same behaviour. My source config: source src { unix-stream( "/dev/log" ); internal(); } ; Stefan

3 2

Destination systax fail ??
by Leonardo Marques de Souza 18 Jun '00

18 Jun '00

Helo, I would like to know what's happen with syslog-ng.conf systax in this part of confiruration: # --------8<------------- # Leitura da porta UDP do syslog padrão (514) # # Por padrão, ele não esta ligado na instalação # Para iniciá-lo, basta descomentar a linha abaixo source net { udp(ip("10.0.2.4") port(514)); }; # --------------------------- # Destino dos dados Filtrados # --------------------------- destination remotenet {udp(ip("10.0.0.10") port(514)); }; <-------(this part have errors ????) destination console { pipe("/dev/console"); }; destination messages { file("/var/log/messages"); }; destination secure { file("/var/log/secure"); }; destination maillog { file("/var/log/maillog"); }; destination spooler { file("/var/log/spooler"); }; destination boot { file("/var/log/boot.log"); }; # -------8<------------------ [root@patolino syslog-ng-1.4.4]# /usr/sbin/syslog-ng -d -v -f /etc/syslog-ng/syslog-ng.conf parse error at 33 Parse error reading configuration file, exiting. [root@patolino syslog-ng-1.4.4]# (line 33 refers to destination remotenet ...) i tryed this syntaxes: **** destination remotenet { udp(ip("10.0.0.10") port(514)); }; destination remotenet { udp(ip(10.0.0.10) port(514)); }; destination remotenet { udp(ip("10.0.0.10") port(514);); }; destination remotenet { udp(ip("10.0.0.10"); port(514)); }; destination remotenet { udp(ip("10.0.0.10"); port(514);); }; destination remotenet { udp(ip("10.0.0.10")); }; destination remotenet { tcp(ip("10.0.0.10") port(514)); }; destination remotenet { udp(ip(10.0.0.10) port(514);); }; destination rtteste { udp(ip("10.0.0.10") port(514)); }; destination remote_net { udp(ip("10.0.0.10") port(514) ); }; ** no sucess.. :( egcs-1.1.2 glibc 2.1.3~ 2.1.2 libol-0.2.17 syslog-ng-1.4.4 kernel-2.2.16 Any one can help me?? who can i increase de Debug?? What i can do to fix that (in source font)? thanks.. PS.: This program have any restriction?? Its realy 100% GPL?? We are thinking to put this program in our distribution here, in Brazil. I built a RPM package, but i trying to a log of tests in our servers (430 servers)... syslog fails to do that :(( lose data, do not restart veri well, use a lot os CPU... :(( i trying syslog-ng to eliminate (or decrese) this problems.. Thank's in advanced!! Leonardo Marques de Souza +--------------------------+ | Conectiva S/A | |Curitiba - Paraná - Brazil| | Suporte Interno | +--------------------------+

4 6

Re: Your sugestion about my problem
by Balazs Scheidler 17 Jun '00

17 Jun '00

> So my intention is very simple, separate log files under firewall events, > this proceedings are necessary to run after special programs to create > security reports, so to do this bellow are my conf files: Case telnet service. > > > > syslog-ng.conf > > options { long_hostnames(off); sync(0); }; > source src { unix-dgram("/dev/log"); internal(); }; > destination messages { file("/var/log/telnet.log"); }; > filter f_telnet { match ("192.168.0.4:23"); }; > log { source(src); filter (f_telnet); destination(messages); }; > > firewall log file > > Packet log: input DENY eth0 PROTO=6 192.168.0.2:1323 192.168.0.4:23 L=48 S=0x00 > I=62731 F=0x4000 T=128 SYN (#1) > Packet log: input DENY eth0 PROTO=6 192.168.0.2:1323 192.168.0.4:23 L=48 S=0x00 > I=62987 F=0x4000 T=128 SYN (#1) > > > I'm running a linux redhat 6.2, ipchains and 2.2.15 kernel version, so I > think right or what do you sugest to resolv this problem because the file > telnet.log is always empty, what wrong. Your klogd is not running. The events above are produced by the kernel, and klogd may not be sending logs. Try to restart it, after you started syslog-ng. -- Bazsi

1 0

Broadcast message on syslog-ng HUP
by Lee Melvin 17 Jun '00

17 Jun '00

I've got syslog-ng 1.4.3 running on a Solaris 2.6 host. When I modify the syslog-ng.conf file and HUP the server, I get an (apparent) empty wall from root: Broadcast message from root (???) on syslog Tue Jun 13 17:00:16... Is this a feature or a bug? Is there any way to mask it? I've tried disabling all lines in the syslog-ng.conf file which output to users or ttys to no avail. Thanks! - Lee

2 1