- syslog-ng - lists.balabit.hu

List of supported macros?
by ger 05 May '00

05 May '00

Hi, are the macros listed in affile.c the only ones that will be supported, or will support be introduced for others, such as $HOUR, $MIN, etc, for better granularity in creating directory structures? Thanks, Ger.

1 0

CISCO
by Ilya Krel 05 May '00

05 May '00

can syslog-ng accept logs from cisco routers?

3 2

RE: [syslog-ng] Syslog-ng Dies - core dump
by Ohrberg, Mick 02 May '00

02 May '00

I have heard that 105181-20 might not be the ultimate patch. One thing to try is to rollback -20 and apply -19. I've heard from sources within SUN that -20 is known to have a few bugs. The nature of these bugs - I don't know. Just my $.02 /Mick Well.. It was a good shot.. but. I updated the system to the latest recommended patch set. Now I have 105181-20 as well as 105181-15. Still getting nice core dump. :-( Un L'Unique wrote: John Wingenbach wrote: > > I just installed and configured syslog-ng 1.4.3 on a Solaris 2.6 system. It cores out on startup. It apparently doesn't like part of my configuration. Debug output is: > > #> /opt/syslog-ng/sbin/syslog-ng -d -v > binding fd 5, inetaddr: 0.0.0.0, port: 514 > io.c: Preparing fd 5 for reading > syslog-ng version 1.4.3 starting > Segmentation Fault(coredump) > > My configuration is (Note below the comments regarding code which if removed allows it to live): Your patch kernel may be too low, I remember some similar probleme when starting syslog-ng for the first time. Pre 105181-15 core dump and 15-17 make system crash. I have no probleme since -19. S.R. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng <http://lists.balabit.hu/mailman/listinfo/syslog-ng> -- John C. Wingenbach Pliant Systems, Inc. Sr. Systems Administrator Work: (919) 405-4627 Fax: (919) 405-4544

1 0

Pre-processing ability?
by Dotson, Mike G 02 May '00

02 May '00

Hey, I'm fairly new to syslog-ng (got it today as a matter of fact). The config file is very easy to configure and get going (hat's off to you guys) even with sparse documentation (up and running in under 2 hours including compile time). I do, however, need to know if there is any pre-processing ability with m4 or cpp, etc. I plan on rolling syslog-ng to our enterprise and would like one syslog-ng.conf file on all our hosts. In order to do this I need to parse off the platform type to set the source since we're primarily a sun shop but do have other platforms we support (sco, hp, linux and sun). Is there any way of doing this with builtin functionality? I also forsee the need to have some sort of pre-processing based on whether it's a loghost, etc. Any plans on adding this or is it already there and I have to dig deeper into the documentation, etc. Thanks... Mike Dotson System Analyst Email: dotson.mike(a)emeryworld.com

2 1

strange thing
by Stefan Seufert 01 May '00

01 May '00

Hi, yesterday I experienced a very strange problem with syslog-ng which I'd like to report. Maybe someone here has a clue what might have caused this. I am not able to reproduce that problem (on a different machine and I don't want to try it on the machnie I had experienced it since this fast the main server of my company. Well, what happened? I was playing around with syslog-ng. I had added a program(); destination but for some reason it seemed not to work as i wanted (due to a name resolution problem, there always was the IP instead of the hostname in the logfiles so my script did not parse the input correctly, but that not relevant). In order to see what was going on I added a "destination home { udp(1.2.3.4); };" and a "log (source(net); destination(home); };" At home, from where i was working I had a simple VB program running on my win workstation which was listening on port 514 udp and putting everything it recieved in a log-window. However, no messages appaered. So I decided to write the messages to a log file wich should be more reliable than sending them about a dialup connection, so I modified the log statement to "log (source(net); destination(home); destination(all); };" where all was "destination all { file("/var/log/allmessages"); };". From that moment on (i.e. after the HUP) the whole system went to sleep. Every process trying to use syslog blocked. Within a few seconds I had some hundred pop3d and sendmail tasks running, my own ssh was blocked since I tried to issued a logger command. I was not able to telnet or ssh to this host since both daemon tried to log when I connected. Luckily enough someone else at my company still had an open telnet. I called him and advised him to remove the malicious lines from the config and send syslog-ng a SIGHUP. No Effect. Only a SIGKILL was able to help us out of this strange situation. Within seconds all the daemons went back to work again. I really have no idea what might have caused this and I am not able to give you more details. As I said, I was not able to reproduce this situation on a test server. I am an developer myself and I perfectly know that this description is nearly useless because it is lacking facts, but I am not able to deliever some and I thought that it might be better to state that their might be a problem so that if someone else will report something similar it might help to make it easier to puzzle the whole thing together. Please note that the system is very old (Kernel 2.0.35, still libc) and has an uptime of more than 300 days now without having ECC ram. This system became "to important to be upgraded". It will be replaced in the near future with a new machine so that we do not have to take it down but could switch softly. Maybe I can reproduce that situation then and send you some straces etc. Stefan --- Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning.

2 6

Re: syslog-ng && kern.*
by Balazs Scheidler 30 Apr '00

30 Apr '00

> Have you managed to log any kernel messages with syslog-ng? > I have tried almost anything already. What I have is latest version > of syslog-ng and redhat-6.1 klogd running. I've just checked, and it does write kernel messages to the appropriate file. > and on other console.. > [root@cyrex /root]# klogd > [root@cyrex /root]# > [root@cyrex /root]# logger -p kern.info somemessage > and on first console.. > io.c: Preparing fd 4 for reading > io.c: Preparing fd 5 for writing > io.c: Preparing fd 6 for writing > io.c: Preparing fd 7 for writing > io.c: Preparing fd 8 for writing > io.c: Preparing fd 9 for writing > Read EOF on fd 4. > Marking fd 4 for closing. > Closing fd 4. > Garbage collecting while idle... > Objects alive: 160, garbage collected: 5 > > .. and surprise: > [root@cyrex syslog-ng-1.4.3]# tail /var/log/syslog -n 1 > Apr 28 11:05:27 cyrex tontsa: somemessage > [root@cyrex syslog-ng-1.4.3]# tail /var/log/kern.log -n 1 > > Shows up nothing. Any ideas? I'm almost willing to try anything :). > Normal syslog kills my machine when I'm running syslog intensive > jobs and printk() logging isn't nice to look when klogd -f /somefile is run. hmm.. try an strace dump of klogd, and check the priority value it sends to syslog-ng. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

1.5.x?
by Jeremy Hansen 29 Apr '00

29 Apr '00

Just got on the list?. Is there an archive anywhere? Basically I'm looking for information on 1.5.x and the purposed encryption implimentation. We're looking for a way to setup a centralized syslog server and have the traffic from remote machines encrypt the data going to the syslog server. I looked at ssyslog, but it doesn't seem to work the way I initially thought. Data on the local machine is encrpyted but attackers could still potentially screw things up on the local machine. -jeremy -- http://www.xxedgexx.com | jeremy(a)xxedgexx.com ---------------------------------------------

2 1

delay
by Balazs Scheidler 26 Apr '00

26 Apr '00

Hi, Sorry for the long delay it takes for me to answer messages nowadays, but I'm in the middle of several things. (incorporating a new firm, getting furniture to my office, completing my major's thesis etc) Things will be better in one or two weeks, so please be patient, I'll answer all questions and also fix bugs. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

A question concerning filter(DEFAULT);
by Jan Niemann 26 Apr '00

26 Apr '00

Hi, can I use other log paths after using filter(DEFAULT); ? is the order of the log-path entrys important for filter(DEFAULT); ? regards, Jan Niemann

1 0

complex filtering
by Un L'Unique 25 Apr '00

25 Apr '00

Hello, Im currently building our loghost syslog-ng conf file and encounter a problem. How can I filter message so that only not-alredy-routed line will be routed/filtered again ? For example, I am trying to send ssh line to a dedicated log file, since sshd send its message to the deamon facility and that ( generic) daemon facility are send to a generic file, a given line appereas in both file and that waste my disk space :-). I am trying to solve that by adding "and not filter(f_ssh)" in my dameon filter but it does nothing ( not even syntax error message). Is there any error ? Is there another way ? Thanks for any help. Un .... filter f_ssh { program("ssh.*"); }; filter f_cyrus-imapd { program("deliver.*") or program( "imapd.*"); }; filter f_named { program("named.*"); }; filter f_ntp { program(".*ntp.*"); }; filter f_kern { facility(kern); }; filter f_user { facility(user); }; filter f_mail { facility(mail); }; filter f_daemon { facility(daemon) and not filter(f_cyrus-imapd) and not filter(f_ssh) and not filter(f_ntp) and not filter(f_named); }; ....

2 2