The time difference could be the hardware clock or local system. Is either syslog chrooted? I had this problem with apache. I needed to put something into the chrooted dir. Some libraries or the date command? I don't remember. Bobby On Thu, 20 May 2004 21:40:24 -0400 "Steven S." <ssurdock@engineered-net.com> wrote:
OK, so let's try one problem at time;-)
When logging udp message the "host" tag is being listed as local host and the time is incorrect. Here is a sample of two different syslog runs. One with syslog-ng 1.6.4 and one with the native OpenBSD 3.5 syslogd. The host "logger01" is the name of the localhost, not a reverse of 172.16.10.20. Also these runs were taken seconds apart yet the timestamps are 11 hours apart.
Any insight would be appreciated.
...running syslog-ng May 19 00:35:29 logger01 %PIX-4-106023: Deny udp src outside:4.4.6.15/57112 dst inside:10.1.2.16/514 by access-group "outside_access_in" May 19 00:36:29 logger01 %PIX-4-106023: Deny udp src outside:4.4.6.15/57112 dst inside:10.1.2.16/514 by access-group "outside_access_in"
...running syslogd on OpenBSD 3.5-stable/sparc64 May 19 11:36:53 172.16.10.20 May 19 2004 00:33:29: %PIX-4-106023: Deny udp src outside:4.4.6.15/57112 dst inside:10.1.2.16/514 by access-group "outside _access_in" May 19 11:37:02 172.16.10.20 May 19 2004 00:33:39: %PIX-4-106023: Deny udp src outside:210.12.158.85/1243 dst inside:10.1.2.15/1434 by access-group "outside_access_in"
# syslog-ng configuration file. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # 20000925 gb@sysfive.com
options { sync (0); time_reopen (10); log_fifo_size (1000); keep_hostname (yes); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); };
source s_sys { unix-dgram ("/dev/log"); internal(); file ("/dev/klog"); }; source s_udp { udp (); };
destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/authlog"); }; destination d_authp { file("/var/log/secure"); }; destination d_cron { file("/var/cron/log"); }; destination d_daem { file("/var/log/daemon"); }; destination d_ftp { file("/var/log/xferlog"); }; destination d_lpr { file("/var/log/lpd-errs"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/uucp"); }; destination d_mlal { usertty("*"); }; destination d_root { usertty("root"); }; destination d_trap { file("/var/log/snmptraps"); }; destination d_cisco { file("/var/log/cisco"); }; destination d_catchudp { file("/var/log/systems/catchudp.log"); }; destination d_catchsys { file("/var/log/catchsys.log"); };
filter f_kern { facility(kern); }; filter f_mesg { level(info..emerg) and not facility(mail, auth, authpriv, ftp, lpr,local0, local7)and not filter(f_croner) and not facility(daemon) and level(info); }; filter f_auth { facility(auth); }; filter f_authp { facility(authpriv); }; filter f_cron { facility(cron); }; filter f_mail { facility(mail); }; filter f_daem { facility(daemon); }; filter f_ftp { facility(ftp); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_emerg { level(emerg); }; filter f_spol { facility(uucp) or (facility(news) and level(crit)); }; filter f_trap { facility(local0); }; filter f_cisco { facility(local7); }; filter f_swatch { level(info..emerg); };
#log { source(s_sys); filter(f_kern); destination(d_cons); }; log { source(s_sys); filter(f_kern); destination(d_mesg); }; log { source(s_sys); filter(f_mesg); destination(d_mesg); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_mail); destination(d_mail); }; log { source(s_sys); filter(f_emerg); destination(d_mlal); }; log { source(s_sys); filter(f_spol); destination(d_spol); }; log { source(s_sys); filter(f_cron); destination(d_cron); }; log { source(s_sys); filter(f_trap); destination(d_trap); }; log { source(s_udp); filter(f_cisco); destination(d_cisco); }; log { source(s_sys); filter(f_swatch); destination(d_catchsys); };
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html