- syslog-ng - lists.balabit.hu

complex filtering
by Un L'Unique 25 Apr '00

25 Apr '00

Hello, Im currently building our loghost syslog-ng conf file and encounter a problem. How can I filter message so that only not-alredy-routed line will be routed/filtered again ? For example, I am trying to send ssh line to a dedicated log file, since sshd send its message to the deamon facility and that ( generic) daemon facility are send to a generic file, a given line appereas in both file and that waste my disk space :-). I am trying to solve that by adding "and not filter(f_ssh)" in my dameon filter but it does nothing ( not even syntax error message). Is there any error ? Is there another way ? Thanks for any help. Un .... filter f_ssh { program("ssh.*"); }; filter f_cyrus-imapd { program("deliver.*") or program( "imapd.*"); }; filter f_named { program("named.*"); }; filter f_ntp { program(".*ntp.*"); }; filter f_kern { facility(kern); }; filter f_user { facility(user); }; filter f_mail { facility(mail); }; filter f_daemon { facility(daemon) and not filter(f_cyrus-imapd) and not filter(f_ssh) and not filter(f_ntp) and not filter(f_named); }; ....

2 2

regexp in match() function
by Przemek Bak 21 Apr '00

21 Apr '00

Does match() function really use regexp to match a string ? For example I'd like to match following strings: Err err ERR eRR ... What should I write in config file ? Is something like that ok: filter f { match ("[Ee][Rr][Rr]"); }; przemol

1 0

bug ?
by Jan Niemann 21 Apr '00

21 Apr '00

Hi, I think i found a bug in syslog-ng-1.4.3; I'm currently running SuSE's Linux 6.3. every user account uses his own language with glibc's locales. So if I'm logged in as normal user i speak german with my computer; some months have other abbreviations : March (Mar) -> März (Mär) May (May) -> Mai (Mai) So if the time is somewhere in may, and my user logs something it'll look like this : May ... May ... Mai ... :-( May ... The problem : if i have a destination like destination{ file("/var/log/messages-$MONTH-$YEAR"); }; and i'm in March/May 2000 and my normal user uses logger or other programs like su; a file /var/log/messages-12-1999 gets created containing all localized log-entrys. Bye, Jan Niemann

1 0

Re: Syslog - log_fifo_size?
by Balazs Scheidler 20 Apr '00

20 Apr '00

On Wed, Apr 19, 2000 at 11:20:54PM -0400, Scott Galambos wrote: > I can't get log_fifo_size to work. It appears to done nothing at all. > > For example: > destination file_misc { file("/var/log/misc.log" log_fifo_size(4)); }; > > The number of lines in misc.log goes far beyond 4. Same thing if in the > options line. How can I limit the size of the log files? Is that what > log_fifo_size is suppose to do? no. log_fifo_size controls the number of log entries in the output queue, and for files it may not be used at all, since files are always writable. output queues are used for example on TCP connections, when the destination host or network can't accept messages fast enough. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Full date?
by bryan＠tummy.com 19 Apr '00

19 Apr '00

Is there any way I can have syslog-ng include the year when it writes the current date/time of a log entry? For example currently a log entry looks like this: Apr 19 13:49:00 src@testbox PAM_pwdb[6498]: (su) session closed for user root Is there any way to have it print this instead: Apr 19 2000 13:49:00 src@testbox PAM_pwdb[6498]: (su) session closed for user root Thanks, Bryan -- http://www.tummy.com/ Consulting and Software for Linux and Unix KRUD - Kevin's Red Hat Uber Distribution - the Freshest Red Hat every month

1 0

non-root and chroot
by Aleph One 19 Apr '00

19 Apr '00

Is there any work in allowing syslog-ng to: a) change its uid and gids to non-root after is has started and opened the appropriate inputs. b) chroot itself after it has started an opened the appropriate inputs. (a) is simple to implement. (b) requires a little more thought. e.g. it should be smart enough to know that if a destination file is under /var/log/logfiles/$DAY if it chroots to /var/log it should try to open /logfiles/$DAY and not /var/log/logfiles/$DAY. -- Aleph One / aleph1(a)underground.org http://underground.org/ KeyID 1024/948FD6B5 Fingerprint EE C9 E8 AA CB AF 09 61 8C 39 EA 47 A8 6A B8 01

2 1

syslog-ng 1.4.3
by Balazs Scheidler 19 Apr '00

19 Apr '00

Hi, I've released the latest stable release of syslog-ng, versioned 1.4.3. It contains a few bugfixes, for more information check out the changelog. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

mountd log entries...
by Jan Niemann 19 Apr '00

19 Apr '00

Hi, every log-file entry from mountd is followed by an empty log-message (only time and source are displayed) is this a bug in syslog-ng or mountd ? regards, Jan Niemann

2 1

Missing log entry on HUP
by bryan＠tummy.com 14 Apr '00

14 Apr '00

Ok, I've been continuing my testing of syslog-ng for reliability, and I've run into this problem/bug. When I HUP syslog-ng on the server and then a client tries to send a message, the connection is re-established to the server but the server loses the message. Example: server: [root@testbox syslog-ng]# killall -HUP syslog-ng client: [root@reptile syslog-ng]# logger test2; logger test3 log file: Apr 14 14:08:14 src@testbox syslog-ng[30283]: AF_INET client connected from 10.1.1.16, port 3724 Apr 14 14:13:51 src@reptile/reptile syslog-ng[8069]: Connection broken, reopening in 1 seconds Apr 14 14:13:51 src@reptile/reptile bryan: test3 Where did test2 go??? I have time_reopen(1); just for during testing. I'm planning on changing that to 15 or so later. Thanks, Bryan -- http://www.tummy.com/ Consulting and Software for Linux and Unix KRUD - Kevin's Red Hat Uber Distribution - the Freshest Red Hat every month

1 0

syslog-ng 1.4.2 and kernel messages on SunOS 5.6
by Massimo Loschi 14 Apr '00

14 Apr '00

Hi, I used syslog-ng 1.4.0 (very useful!) on a SunOS 5.6 sun4u host, with the following configuration: options { create_dirs(yes); sync(0); chain_hostnames(off); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source net { udp(ip(A.B.C.D) port(514)); }; [...] destination dstandard { file("/var/log/host/$HOST/$PROGRAM/$YEAR-$MONTH/$DAY.log" group("mygroup") dir_perm(0755) perm(0644) ); }; [...] log { source(local); source(net); destination(dstandard); }; When I start syslog-ng, in /var/log/host/machine appears several strange directories: drwxr-xr-x 3 other 512 Mar 31 14:48 PCI-device drwxr-xr-x 3 other 512 Mar 31 14:48 SUNW,hme0 drwxr-xr-x 3 other 512 Mar 31 14:48 SUNW,hme1 drwxr-xr-x 3 other 512 Mar 31 14:48 SunOS Release 5.6 Version Generic_105181-17 drwxr-xr-x 3 other 512 Mar 31 14:48 WARNING drwxr-xr-x 3 other 512 Mar 31 14:48 cpu0 drwxr-xr-x 3 other 512 Mar 31 14:48 glm0 drwxr-xr-x 3 other 512 Mar 31 14:48 pci0 at root drwxr-xr-x 3 other 512 Mar 31 14:48 root on drwxr-xr-x 3 other 512 Mar 31 14:48 sd0 at glm0 drwxr-xr-x 3 other 512 Mar 31 14:48 sd1 at glm0 drwxr-xr-x 3 other 512 Mar 31 14:50 sshd drwxr-xr-x 3 other 512 Mar 31 14:48 su0 at ebus0 drwxr-xr-x 3 other 512 Mar 31 14:48 su1 at ebus0 drwxr-xr-x 3 other 512 Mar 31 14:48 syslog-ng It appears the problem that the version 1.4.2 should be fix (function parse_log_msg in file src/log.c), but instaling and running this version, it works like the 1.4.0. Another strange thing happens (with both 1.4.0 and 1.4.2): the directories and the files create by syslog-ng don't have the permissions specified in the configuration ( dir_perm(0755) perm(0644) ), but those coherent with the umask of the root user. It is a my stupid error in syslog-ng.conf file or someother people have this problems? Thanks in advance Massimo ------------------------------------------------------------------------------ Massimo Loschi E-mail: m.loschi(a)nextra.it Network & Core Systems NEXTRA S.p.A. WWW: http://www.nextra.it Via Isonzo, 55/2 Tel: +39 51 6139211 40033 Casalecchio di Reno Fax: +39 51 6114455 Bologna - ITALY ------------------------------------------------------------------------------

1 0