- syslog-ng - lists.balabit.hu

Re: [syslog-ng] ipfw logging
by Ilya 02 Jun '00

02 Jun '00

ok i tried /dev/log - no result, same thing - ipfw is not being logged anywhere. i noiced that i am not the only one with this problem. the other person from japan seems to have similar issue. ---------- Original Message ---------------------------------- From: "Ilya" <maillist(a)krel.org> Reply-To: syslog-ng(a)venus.terrasoft.hu Date: Wed, 31 May 2000 01:36:19 -0400 >I am running on Freebsd 4.0 stable. >i just kept it the way documentation and examples have it and had no problem >except with ipfw

4 4

FW: Newbie...still ty'en
by Mike Novak 01 Jun '00

01 Jun '00

opps sorry did not mean to waste your guys time... Balazs just anwsered my ?..a couple of e-mails ago Thanks Novak > -----Original Message----- > From: Mike Novak > Sent: Thursday, June 01, 2000 10:10 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Newbie...still ty'en > > i have set up syslog-ng on solaris, > and have a stupid ? about destanations > > do i need to create the files in /var/log > > eg.. > > destination security { file("/var/log/security"); }; > > do i need to create the file security... > if so how do i chown it to other? > messages, is owned by other > > > sorry for the trouble i would love any help > Novak

1 0

Newbie...still ty'en
by Mike Novak 01 Jun '00

01 Jun '00

i have set up syslog-ng on solaris, and have a stupid ? about destanations do i need to create the files in /var/log eg.. destination security { file("/var/log/security"); }; do i need to create the file security... if so how do i chown it to other? messages, is owned by other sorry for the trouble i would love any help Novak

1 0

want kernal messages of FreeBSD
by Hideyuki Nishiyama 31 May '00

31 May '00

Hellow. I am H.Nishiyama in japanese. I want syslog-ng to send kernel messages of FreeBSD2.2.8 for ipfw. I tried to use unix-dgram("/de/klog") and file("/dev/klog"). But I didn't successed. Plese tell me how to send kernel messages of FreeBSD2.2.8 for ipfw!! Thank you to ream my letter. ------------------------------------------------------------ 新日本気象海洋株式会社 E-mail:hideyuki@yk.metocean.co.jp 情報システムグループ WWW :http://www.metocean.co.jp/ 西山英之 TEL :045-593-7616 FAX :045-593-7628

2 2

RE: [syslog-ng] ipfw logging
by Hamilton, Andrew Mr. 31 May '00

31 May '00

What are you running on? Your source in src looks a little strange. Most sources are something like /dev/log. What is coming in to /var/run/log? Do you have something putting log messages into a file? Drew > -----Original Message----- > From: maillist [SMTP:maillist@krel.org] > Sent: Tuesday, May 30, 2000 11:21 PM > To: syslog-ng(a)venus.terrasoft.hu > Subject: [syslog-ng] ipfw logging > > hi, ive been trying for two days to log ipfw messages to separate file and > with no success. as soon as i turn on old syslogd with > !ipfw > *.* /var/log/ipfw > it works > but syslog-ng with: > source src { unix-dgram("/var/run/log"); udp(); internal(); } > destination ipfw { file("/var/log/ipfw.log"); }; > filter f_ipfw { program("ipfw"); }; > log { source(src); filter("f_ipfw"); destination("ipfw"); }; > just doesnt catch anything, all the messages from ipfw appear on console, > but not in any file, even not in all.log! > > here is my full config: > # options > options { long_hostnames(off); sync(0); }; > > # sources > source src { unix-dgram("/var/run/log"); udp(); internal(); }; > source src2 { unix-dgram("/var/run/log2"); udp(ip(xxx.xxx.xxx.xxx) > port(514)); }; > > # destinations > destination messages { file("/var/log/messages"); }; > destination security { file("/var/log/security"); }; > destination maillog { file("/var/log/maillog"); }; > destination lpd-errs { file("/var/log/lpd-errs"); }; > destination cron { file("/var/log/cron"); }; > destination all { file("/var/log/all.log"); }; > destination newscrit { file("/var/log/news/news.crit"); }; > destination newserr { file("/var/log/news/news.err"); }; > destination newsnotice { file("/var/log/news/news.notice"); }; > destination slip { file("/var/log/slip.log"); }; > destination ppp { file("/var/log/ppp.log"); }; > destination console { file("/dev/console"); }; > destination root { usertty("root"); }; > destination allusers { usertty("*"); }; > destination rogue { file("/var/log/rogue"); }; > destination cobalt { file("/var/log/cobalt"); }; > destination cisco { file("/var/log/cisco"); }; > destination voyager { file("/var/log/voyager"); }; > destination lists { file("/var/log/lists"); }; > destination lists_m { file("/var/log/lists.sendmail"); }; > destination apollo { file("/var/log/apollo"); }; > destination samson { file("/var/log/samson"); }; > destination samson_d { file("/var/log/samson.bind"); }; > destination bugsy { file("/var/log/bugsy"); }; > #destination loghost { udp("loghost" port(514)); }; > destination goblin { file("/var/log/goblin"); }; > destination allsec { file("/var/log/allsec"); }; > destination samson.named { file("/var/log/named"); }; > destination ipfw { file("/var/log/ipfw.log"); }; > > # log facility filters > filter f_auth { facility(auth); }; > filter f_authpriv { facility(authpriv); }; > filter f_cron { facility(cron); }; > filter f_daemon { facility(daemon); }; > filter f_ftp { facility(ftp); }; > filter f_kern { facility(kern); }; > filter f_lpr { facility(lpr); }; > filter f_mail { facility(mail); }; > filter f_news { facility(news); }; > filter f_security { facility(security); }; > filter f_user { facility(user); }; > filter f_uucp { facility(uucp); }; > filter f_local0 { facility(local0); }; > filter f_local1 { facility(local1); }; > filter f_local2 { facility(local2); }; > filter f_local3 { facility(local3); }; > filter f_local4 { facility(local4); }; > filter f_local5 { facility(local5); }; > filter f_local6 { facility(local6); }; > filter f_local7 { facility(local7); }; > > # log host filters > filter h_rogue { host("rogue"); }; > filter h_cobalt { host("www"); }; > filter h_cisco { host("cisco"); }; > filter h_voyager { host("voyager"); }; > filter h_lists { host("lists"); }; > filter h_apollo { host("apollo"); }; > filter h_samson { host("samson"); }; > filter h_bugsy { host("bugsy"); }; > filter h_goblin { host("goblin"); }; > > # log level filters > filter f_emerg { level(emerg); }; > filter f_alert { level(alert..emerg); }; > filter f_crit { level(crit..emerg); }; > filter f_err { level(err..emerg); }; > filter f_warning { level(warning..emerg); }; > filter f_notice { level(notice..emerg); }; > filter f_info { level(info..emerg); }; > filter f_debug { level(debug..emerg); }; > > # program filters > filter f_ppp { program("ppp"); }; > filter f_slip { program("startslip"); }; > filter f_send { program("sendmail"); }; > filter nf_send { not program("sendmail"); }; > filter f_bind { program("named"); }; > filter nf_bind { not program("named"); }; > filter f_ipfw { program("ipfw"); }; > #filter nf_ipfw { not program("ipfw"); }; > > > > log { source(src2); filter("f_ipfw"); destination("ipfw"); }; > > # *.err;kern.debug;auth.notice;mail.crit /dev/console > log { source(src); filter(f_err); destination(console); }; > log { source(src); filter(f_kern); filter(f_debug); destination(console); > }; > log { source(src); filter(f_auth); filter(f_notice); destination(console); > }; > log { source(src); filter(f_mail); filter(f_crit); destination(console); > }; > > # *.notice;kern.debug;lpr.info;mail.crit;news.err /var/log/messages > log { source(src); filter(f_notice); destination(messages); }; > log { source(src); filter(f_kern); filter(f_debug); destination(messages); > }; > log { source(src); filter(f_lpr); filter(f_info); destination(messages); > }; > log { source(src); filter(f_mail); filter(f_crit); destination(messages); > }; > log { source(src); filter(f_news); filter(f_err); destination(messages); > }; > > # security.* /var/log/security > log { source(src); filter(f_security); destination(security); }; > > # mail.info /var/log/maillog > log { source(src); filter(f_mail); filter(f_info); destination(maillog); > }; > > # lpr.info /var/log/lpd-errs > log { source(src); filter(f_lpr); filter(f_info); destination(lpd-errs); > }; > > # cron.* /var/log/cron > log { source(src); filter(f_cron); destination(cron); }; > > # *.err root > log { source(src); filter(f_err); destination(root); }; > > # *.notice;news.err root > log { source(src); filter(f_notice); destination(root); }; > log { source(src); filter(f_news); filter(f_err); destination(root); }; > > # *.alert root > log { source(src); filter(f_alert); destination(root); }; > > # *.emerg * > log { source(src); filter(f_emerg); destination(allusers); }; > > # uncomment this to enable logging of all log messages to /var/log/all.log > # *.* /var/log/all.log > log { source(src); destination(all); }; > > # uncomment this to enable logging to a remote loghost named loghost > # *.* @loghost > #log { source(src); destination(loghost); }; > > # news.err > /var/log/news/news.err > # news.notice > /var/log/news/news.notice > # > #log { source(src); filter(f_news); filter(f_crit); destination(newscrit); > }; > #log { source(src); filter(f_news); filter(f_err); destination(newserr); > }; > #log { source(src); filter(f_news); filter(f_notice); > destination(newsnotice); }; > > > log { source("src2"); filter("h_rogue"); destination("rogue"); }; > log { source("src2"); filter("h_cobalt"); destination("cobalt"); }; > log { source("src2"); filter("h_cisco"); destination("cisco"); }; > log { source("src2"); filter("h_voyager"); destination("voyager"); }; > log { source("src2"); filter("h_lists"); filter("f_send"); > destination("lists_m"); }; > log { source("src2"); filter("h_lists"); filter("nf_send"); > destination("lists"); }; > log { source("src2"); filter("h_apollo"); destination("apollo"); }; > log { source("src2"); filter("h_samson"); filter("f_bind"); > destination("samson_d"); }; > log { source("src2"); filter("h_samson"); filter("nf_bind"); > destination("samson"); }; > log { source("src2"); filter("h_bugsy"); destination("bugsy"); }; > log { source("src2"); filter("h_goblin"); destination("goblin"); }; > log { source("src2"); filter("f_security"); destination("allsec"); }; > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

ipfw logging
by maillist 30 May '00

30 May '00

hi, ive been trying for two days to log ipfw messages to separate file and with no success. as soon as i turn on old syslogd with !ipfw *.* /var/log/ipfw it works but syslog-ng with: source src { unix-dgram("/var/run/log"); udp(); internal(); } destination ipfw { file("/var/log/ipfw.log"); }; filter f_ipfw { program("ipfw"); }; log { source(src); filter("f_ipfw"); destination("ipfw"); }; just doesnt catch anything, all the messages from ipfw appear on console, but not in any file, even not in all.log! here is my full config: # options options { long_hostnames(off); sync(0); }; # sources source src { unix-dgram("/var/run/log"); udp(); internal(); }; source src2 { unix-dgram("/var/run/log2"); udp(ip(xxx.xxx.xxx.xxx) port(514)); }; # destinations destination messages { file("/var/log/messages"); }; destination security { file("/var/log/security"); }; destination maillog { file("/var/log/maillog"); }; destination lpd-errs { file("/var/log/lpd-errs"); }; destination cron { file("/var/log/cron"); }; destination all { file("/var/log/all.log"); }; destination newscrit { file("/var/log/news/news.crit"); }; destination newserr { file("/var/log/news/news.err"); }; destination newsnotice { file("/var/log/news/news.notice"); }; destination slip { file("/var/log/slip.log"); }; destination ppp { file("/var/log/ppp.log"); }; destination console { file("/dev/console"); }; destination root { usertty("root"); }; destination allusers { usertty("*"); }; destination rogue { file("/var/log/rogue"); }; destination cobalt { file("/var/log/cobalt"); }; destination cisco { file("/var/log/cisco"); }; destination voyager { file("/var/log/voyager"); }; destination lists { file("/var/log/lists"); }; destination lists_m { file("/var/log/lists.sendmail"); }; destination apollo { file("/var/log/apollo"); }; destination samson { file("/var/log/samson"); }; destination samson_d { file("/var/log/samson.bind"); }; destination bugsy { file("/var/log/bugsy"); }; #destination loghost { udp("loghost" port(514)); }; destination goblin { file("/var/log/goblin"); }; destination allsec { file("/var/log/allsec"); }; destination samson.named { file("/var/log/named"); }; destination ipfw { file("/var/log/ipfw.log"); }; # log facility filters filter f_auth { facility(auth); }; filter f_authpriv { facility(authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_ftp { facility(ftp); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_security { facility(security); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; # log host filters filter h_rogue { host("rogue"); }; filter h_cobalt { host("www"); }; filter h_cisco { host("cisco"); }; filter h_voyager { host("voyager"); }; filter h_lists { host("lists"); }; filter h_apollo { host("apollo"); }; filter h_samson { host("samson"); }; filter h_bugsy { host("bugsy"); }; filter h_goblin { host("goblin"); }; # log level filters filter f_emerg { level(emerg); }; filter f_alert { level(alert..emerg); }; filter f_crit { level(crit..emerg); }; filter f_err { level(err..emerg); }; filter f_warning { level(warning..emerg); }; filter f_notice { level(notice..emerg); }; filter f_info { level(info..emerg); }; filter f_debug { level(debug..emerg); }; # program filters filter f_ppp { program("ppp"); }; filter f_slip { program("startslip"); }; filter f_send { program("sendmail"); }; filter nf_send { not program("sendmail"); }; filter f_bind { program("named"); }; filter nf_bind { not program("named"); }; filter f_ipfw { program("ipfw"); }; #filter nf_ipfw { not program("ipfw"); }; log { source(src2); filter("f_ipfw"); destination("ipfw"); }; # *.err;kern.debug;auth.notice;mail.crit /dev/console log { source(src); filter(f_err); destination(console); }; log { source(src); filter(f_kern); filter(f_debug); destination(console); }; log { source(src); filter(f_auth); filter(f_notice); destination(console); }; log { source(src); filter(f_mail); filter(f_crit); destination(console); }; # *.notice;kern.debug;lpr.info;mail.crit;news.err /var/log/messages log { source(src); filter(f_notice); destination(messages); }; log { source(src); filter(f_kern); filter(f_debug); destination(messages); }; log { source(src); filter(f_lpr); filter(f_info); destination(messages); }; log { source(src); filter(f_mail); filter(f_crit); destination(messages); }; log { source(src); filter(f_news); filter(f_err); destination(messages); }; # security.* /var/log/security log { source(src); filter(f_security); destination(security); }; # mail.info /var/log/maillog log { source(src); filter(f_mail); filter(f_info); destination(maillog); }; # lpr.info /var/log/lpd-errs log { source(src); filter(f_lpr); filter(f_info); destination(lpd-errs); }; # cron.* /var/log/cron log { source(src); filter(f_cron); destination(cron); }; # *.err root log { source(src); filter(f_err); destination(root); }; # *.notice;news.err root log { source(src); filter(f_notice); destination(root); }; log { source(src); filter(f_news); filter(f_err); destination(root); }; # *.alert root log { source(src); filter(f_alert); destination(root); }; # *.emerg * log { source(src); filter(f_emerg); destination(allusers); }; # uncomment this to enable logging of all log messages to /var/log/all.log # *.* /var/log/all.log log { source(src); destination(all); }; # uncomment this to enable logging to a remote loghost named loghost # *.* @loghost #log { source(src); destination(loghost); }; # news.err /var/log/news/news.err # news.notice /var/log/news/news.notice # #log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; #log { source(src); filter(f_news); filter(f_err); destination(newserr); }; #log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; log { source("src2"); filter("h_rogue"); destination("rogue"); }; log { source("src2"); filter("h_cobalt"); destination("cobalt"); }; log { source("src2"); filter("h_cisco"); destination("cisco"); }; log { source("src2"); filter("h_voyager"); destination("voyager"); }; log { source("src2"); filter("h_lists"); filter("f_send"); destination("lists_m"); }; log { source("src2"); filter("h_lists"); filter("nf_send"); destination("lists"); }; log { source("src2"); filter("h_apollo"); destination("apollo"); }; log { source("src2"); filter("h_samson"); filter("f_bind"); destination("samson_d"); }; log { source("src2"); filter("h_samson"); filter("nf_bind"); destination("samson"); }; log { source("src2"); filter("h_bugsy"); destination("bugsy"); }; log { source("src2"); filter("h_goblin"); destination("goblin"); }; log { source("src2"); filter("f_security"); destination("allsec"); };

1 0

Re: [syslog-ng] (syslog-ng): unaligned access: (SOLVED)
by Balazs Scheidler 27 May '00

27 May '00

> Looks like there's yet another, I'll dig into it again today and send some > more, unless you're still working on one of the two I already sent. I thought this fixed both, since this malloc debugger allocated memory chunks on a 4 bytes boundary (instead of 8), if memory was accessed later it could cause this at several places. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: [syslog-ng] (syslog-ng): unaligned access: (SOLVED)
by Balazs Scheidler 26 May '00

26 May '00

> pid 29068 (syslog-ng): unaligned access: va=0x14001645c pc=0x12001b2b0 > ra=0x12001b2b0 op=stt > pid 29068 (syslog-ng): unaligned access: va=0x14001644c pc=0x12001b018 > ra=0x12001b018 op=stq > pid 29068 (syslog-ng): unaligned access: va=0x140016454 pc=0x12001b028 > ra=0x12001b028 op=stt > pid 29068 (syslog-ng): unaligned access: va=0x140016454 pc=0x12001b030 > ra=0x12001b030 op=ldq > pid 29068 (syslog-ng): unaligned access: va=0x14001644c pc=0x12001b040 > ra=0x12001b040 op=ldq > 0x12000f3f0 288 conn->queue_node = I've got this one, it's caused by the optional malloc debugger which was errouneously included even in --with-debug was not given (it was not 64bit clean). The new libol version 0.2.17 should fix this. http://www.balabit.hu/downloads/libol/0.2/libol-0.2.17.tar.gz -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

syslog-ng 1.4.4 and libol 0.2.17
by Balazs Scheidler 26 May '00

26 May '00

Hi, I've released syslog-ng 1.4.4: NEWS for syslog-ng 1.4.4 * file permission specifiers readded for pipe() * fixed a configure.in bug on systems without snprintf() * updated documentation (New chapter: Finetuning, added some things about DEFAULT filter evaluation) NEWS for libol 0.2.17 * will not compile in the malloc debugger if --with-debug is specified, caused unaligned memory accesses on Alpha -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

A Bug and few sugestions..
by Felix Meulenkamp 26 May '00

26 May '00

Hi... I'm running Syslog-ng 1.4.3 as a loghost and on a workstation behind a gateway... both RedHat 6.1 hmmm problems i've found... '#' seems to work not correctly... i've comment a few things in my syslog-ng.conf... and if the comment was not at the beginning of a line.. i got a parsing error.. '#' seems not to comment out log, source, ... -statements.... if i comment out the destination and filter rule for ppp from the standart debian example syslog-ng.conf .... i got a parsing error... saying something like... ppp was an unresolve identifer... and here my sugestions... what about ...say 'virtual pipes'.... or bracket rules... what i meen is... if you have a logingstatement like this log {source(src1); filter(f_1); source(src2); destination(dst1); }; (this seems to work on my maschine... throu this is not documented) and you now want to filter src2 with another filter.... when filter f_2 will filter both.... and not just the 2nd source... There would be something like a internal pipe helpy... So you define a pipe and use this to curving around the 2nd source and filter... or what would be even better... to create brackets around the 2nd source and filter... so the filter will just afect src2.... customized macros... what about just defining your own macros... say like constants... for example you can define LOGDIR="/var/log"; and then in a destination-rule it will sound like destination warn {file("$LOGDIR/warn");}; ....or just... FNW="not filter(warn);"; but i thing macros an const have to be captalized by definition... Felix... ICQ: 5227897/samon007 PS:Thanxs for writing this great programm...

3 3