RE: [syslog-ng]Trying to send log over network
1. No syslog-ng runs as its own daemon. Works much better this way. 2. If the answer to 1 was yes it would make a difference. But since it isn't then no. 3. Could you post a sample of your config file? That might be helpful. Also could you post part of your strace results? That would at least give us info on where to look for your problem. Random thoughts...do you have some sort of port monitor that could be blocking your default ports? I have seen that before. Regards. Drew
-----Original Message----- From: Simeon Johnston [SMTP:simeonuj@eetc.com] Sent: Tuesday, February 20, 2001 11:26 PM To: syslog-ng@lists.balabit.hu Subject: Re: [syslog-ng]Trying to send log over network
I used strace although I didn't get much out of it. I have never used it before. I think that it is not being allowed to initiate a connection or it is trying but is not allowed to connect to the logserver so it stops. I have a few more questions. 1. Does syslog-ng need an entry in the inetd/xinetd configuration? I didn't see anything about it in the manual. 2. Would this disallow any information from getting through if there wasn't an entry? 3. Any other thoughts?
Any help would be appreciated.
sim
Balazs Scheidler wrote:
On Wed, Feb 14, 2001 at 10:07:51AM -0600, Simeon Johnston wrote:
I put the new rule in and it didn't give any errors when I started it. But there seems to be another problem. I don't know why but it looks like the daemon doesn't even start. I restart it with the bootup script and everything appears to run OK but then I do a "ps ax" and the process isn't there. I then start it manually and it gives me this error.
Error creating AF_INET socket (Success) Error initializing configuration, exiting.
What is this?
a truss or strace output should help you out here.
-- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng
Hi I was wondering if anyone has any creative ways to get my apache logs into syslog-ng? Laurence
>>>>>>>>>>>> Original Message <<<<<<<<<<<<<<<<<<
On 2/21/01, 11:17:44 AM, "Hamilton," Andrew Mr RAYTHEON 5 SIG CMD <HamiltonA@hq.5sigcmd.army.mil> wrote regarding RE: [syslog-ng]Trying to send log over network:
1. No syslog-ng runs as its own daemon. Works much better this way. 2. If the answer to 1 was yes it would make a difference. But since it isn't then no. 3. Could you post a sample of your config file? That might be helpful. Also could you post part of your strace results? That would at least give us info on where to look for your problem.
Random thoughts...do you have some sort of port monitor that could be blocking your default ports? I have seen that before.
Regards. Drew
-----Original Message----- From: Simeon Johnston [SMTP:simeonuj@eetc.com] Sent: Tuesday, February 20, 2001 11:26 PM To: syslog-ng@lists.balabit.hu Subject: Re: [syslog-ng]Trying to send log over network
I used strace although I didn't get much out of it. I have never used it before. I think that it is not being allowed to initiate a connection or it is trying but is not allowed to connect to the logserver so it stops. I have a few more questions. 1. Does syslog-ng need an entry in the inetd/xinetd configuration? I didn't see anything about it in the manual. 2. Would this disallow any information from getting through if there wasn't an entry? 3. Any other thoughts?
Any help would be appreciated.
sim
Balazs Scheidler wrote:
On Wed, Feb 14, 2001 at 10:07:51AM -0600, Simeon Johnston wrote:
I put the new rule in and it didn't give any errors when I started it. But there seems to be another problem. I don't know why but it looks like the daemon doesn't even start. I restart it with the bootup script and everything appears to run OK but then I do a "ps ax" and the process isn't there. I then start it manually and it gives me this error.
Error creating AF_INET socket (Success) Error initializing configuration, exiting.
What is this?
a truss or strace output should help you out here.
-- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng
laurence@uwc.ac.za wrote:
Hi I was wondering if anyone has any creative ways to get my apache logs into syslog-ng?
Heya, AFAIk there's a tool called "logger" to send snipplets to syslog. As you may know you can pipe logoutput in apache to a commandline-tool (use the pipe[|]), so there you go. -- Regards, Wiktor Wodecki, Unix Administration | Wapme-Systems AG Tel.: +49-211-748450 | Muensterstrasse 248 Fax: +49-211-74845176 | 40470 Duesseldorf E-Mail: wodecki@wapme-systems.de | http://www.wapme-systems.de 1024/E22253B9 084C 7950 4D65 0E92 46D1 48AF F3F7 3201 E222 53B9
At the moment thats what Im doing : ) tail -f /var/lib/apache/logs/access_log | logger -p notice -t apache for the record but I was wondering if there are any more seamless ways around it. Laurence
>>>>>>>>>>>> Original Message <<<<<<<<<<<<<<<<<<
On 2/21/01, 12:28:40 PM, Wiktor Wodecki <wodecki@wapme-systems.de> wrote regarding Re: [syslog-ng]apache logs:
laurence@uwc.ac.za wrote:
Hi I was wondering if anyone has any creative ways to get my apache logs into syslog-ng?
Heya,
AFAIk there's a tool called "logger" to send snipplets to syslog. As you may know you can pipe logoutput in apache to a commandline-tool (use the pipe[|]), so there you go.
-- Regards,
Wiktor Wodecki, Unix Administration | Wapme-Systems AG Tel.: +49-211-748450 | Muensterstrasse 248 Fax: +49-211-74845176 | 40470 Duesseldorf E-Mail: wodecki@wapme-systems.de | http://www.wapme-systems.de 1024/E22253B9 084C 7950 4D65 0E92 46D1 48AF F3F7 3201 E222 53B9
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng
On Wed, Feb 21, 2001 at 10:56:32AM +0000, laurence@uwc.ac.za wrote:
At the moment thats what Im doing : )
tail -f /var/lib/apache/logs/access_log | logger -p notice -t apache for the record but I was wondering if there are any more seamless ways around it.
I haven't tried this yet (nor thought about the deeper implications), but you could make the log files themselves a pipe (a pipe file), and have syslog-ng read from these pipes. This seems to be the simplest way to do it, but I have a feeling this might not be the best approach. ---------------------------------------------------------------------------- __o Bradley Arlt Email: arlt@cpsc.ucalgary.ca o__ _ \<_ WWW: www.acs.ucalgary.ca/~bdarlt _>/ _ (_)/(_) -Eat well, sleep peacefully, drink lots, and ride like hell. (_)\(_)
El 21 Feb 2001 09:41:50 +0000, laurence@uwc.ac.za escribió:
Hi I was wondering if anyone has any creative ways to get my apache logs into syslog-ng?
Laurence
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng
You can configure apache to send the logs to a custom program or script that handles the logs and sends it to syslog-ng using the facility and priority you want. I have setted up my httpd.conf to send the logs to a couple of perl scripts using a pype as shown: ErrorLog "| /usr/local/bin/apache-error-logger www1.tiscali.es" TransferLog "| /usr/local/bin/apache-transfer-logger www1.tiscali.es" This is the perl script I use to sed the logs to syslog-ng. I use local0 facility for error logs and local1 for transfer logs and info priority. This is a good way to filter the log lines when arriving syslog-ng. Here is the script that handles the access logs. It's a perl script, but you can use the logger command to do it with a shell script if you don't feel comfortable with perl :-) #!/usr/local/bin/perl # script: apache-access-logger use Sys::Syslog; $SERVER_NAME = shift || 'www'; $PRIORITY = 'info'; $FACILITY = 'local1'; Sys::Syslog::setlogsock('unix'); openlog ($SERVER_NAME,'ndelay', $FACILITY); while (<>) { chomp; syslog($PRIORITY,$_); } closelog; The only problem I have seen is that syslog-ng will not write the logs received from apache using the apache log format because it adds some additional info at the beggining of each line. You must know it if you intend to get statistics from your apache log files. From syslog-ng 1.5.3 you can define the log file format and it may be a help in this case, but I have not tested it yet. Regards, Santi -- Santiago Gómez Cano Administrador de Sistemas santiago.gomez@tiscali.es Tiscali Telecomunicaciones, S.A. www.tiscali.es T. +34 918370546 T. +34 699459573
Here are the configs. I have added as an attachment the strace output files using "strace -f -ff -o localfile syslog-ng". This is the config for the problem conputers. options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_sys { unix-stream ("/dev/log"); internal(); }; destination d_cons { file("/var/log/ng/kern.log"); }; destination d_mesg { file("/var/log/ng/messages"); }; destination d_auth { file("/var/log/ng/secure"); }; destination d_mail { file("/var/log/ng/maillog"); }; destination d_spol { file("/var/log/ng/spooler"); }; destination d_boot { file("/var/log/ng/boot.log"); }; destination d_mlal { file("/var/log/ng/emerg.log"); }; destination d_bg { tcp("192.168.1.19:514"); }; destination d_sshd { file("/var/log/ng/sshd.log"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_tcplog { level(debug); }; filter f_sshd { match("sshd"); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_tcplog); destination(d_bg); }; log { source(s_sys); filter(f_sshd); destination(d_sshd); }; This is the logserver config options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_sys { unix-stream ("/dev/log"); internal(); }; source s_tcp { tcp (ip(192.168.1.1) port(10001)); }; destination d_cons { file("/var/log/ng/kernel"); }; destination d_mesg { file("/var/log/ng/messages"); }; destination d_auth { file("/var/log/ng/secure"); }; destination d_mail { file("/var/log/ng/maillog"); }; destination d_spol { file("/var/log/ng/spooler"); }; destination d_boot { file("/var/log/ng/boot.log"); }; destination d_mlal { file("/var/log/ng/emerg.log"); }; destination d_pptp { file("/var/log/ng/pptpd.log"); }; destination d_daemon { file("/var/log/ng/daemon.log"); }; destination d_firewall { file("/var/log/ng/firewall.log"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not facility(mail,authpriv,kern); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp); }; filter f_pptpd { match("pptpd"); }; filter f_daemon { facility(daemon); }; filter f_boot { facility(local7); }; filter f_firewall { level(debug); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_pptpd); destination(d_pptp); }; log { source(s_sys); filter(f_daemon); destination(d_daemon); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; log { source(s_tcp); filter(f_firewall); destination(d_firewall); }; Thank you for your help. sim "Hamilton, Andrew Mr RAYTHEON 5 SIG CMD" wrote:
1. No syslog-ng runs as its own daemon. Works much better this way. 2. If the answer to 1 was yes it would make a difference. But since it isn't then no. 3. Could you post a sample of your config file? That might be helpful. Also could you post part of your strace results? That would at least give us info on where to look for your problem.
Random thoughts...do you have some sort of port monitor that could be blocking your default ports? I have seen that before.
Regards. Drew
execve("/usr/local/sbin/syslog-ng", ["/usr/local/sbin/syslog-ng"], [/* 23 vars */]) = 0 uname({sys="Linux", node="home.electroniceasel.com", ...}) = 0 brk(0) = 0x8059f84 open("/etc/ld.so.preload", O_RDONLY) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 4 fstat64(4, 0xbfffec8c) = -1 ENOSYS (Function not implemented) fstat(4, {st_mode=S_IFREG|0644, st_size=17563, ...}) = 0 old_mmap(NULL, 17563, PROT_READ, MAP_PRIVATE, 4, 0) = 0x40018000 close(4) = 0 open("/lib/libnsl.so.1", O_RDONLY) = 4 read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\360>\0"..., 1024) = 1024 fstat(4, {st_mode=S_IFREG|0755, st_size=409599, ...}) = 0 old_mmap(NULL, 89888, PROT_READ|PROT_EXEC, MAP_PRIVATE, 4, 0) = 0x4001d000 mprotect(0x40030000, 12064, PROT_NONE) = 0 old_mmap(0x40030000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 4, 0x12000) = 0x40030000 old_mmap(0x40031000, 7968, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x40031000 close(4) = 0 open("/lib/libc.so.6", O_RDONLY) = 4 read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0`\300\1"..., 1024) = 1024 fstat(4, {st_mode=S_IFREG|0755, st_size=5155229, ...}) = 0 old_mmap(NULL, 1214792, PROT_READ|PROT_EXEC, MAP_PRIVATE, 4, 0) = 0x40033000 mprotect(0x40153000, 35144, PROT_NONE) = 0 old_mmap(0x40153000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 4, 0x11f000) = 0x40153000 old_mmap(0x40158000, 14664, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x40158000 close(4) = 0 open("/lib/libc.so.6", O_RDONLY) = 4 read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0`\300\1"..., 1024) = 1024 fstat(4, {st_mode=S_IFREG|0755, st_size=5155229, ...}) = 0 close(4) = 0 munmap(0x40018000, 17563) = 0 getpid() = 25135 brk(0) = 0x8059f84 brk(0x8059fd4) = 0x8059fd4 brk(0x805a000) = 0x805a000 brk(0x805b000) = 0x805b000 open("/etc/syslog-ng/syslog-ng.conf", O_RDONLY) = 4 brk(0x8060000) = 0x8060000 ioctl(4, TCGETS, 0xbffff8c0) = -1 ENOTTY (Inappropriate ioctl for device) fstat64(4, 0xbffff330) = -1 ENOSYS (Function not implemented) fstat(4, {st_mode=S_IFREG|0777, st_size=2016, ...}) = 0 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40018000 read(4, "# syslog-ng configuration file.\n"..., 8192) = 2016 read(4, "", 4096) = 0 read(4, "", 8192) = 0 ioctl(4, TCGETS, 0xbffff390) = -1 ENOTTY (Inappropriate ioctl for device) close(4) = 0 munmap(0x40018000, 4096) = 0 fork() = 25136 rt_sigaction(SIGTERM, {0x8049a94, [TERM], SA_RESTART|0x4000000}, {SIG_DFL}, 8) = 0 pause() = ? ERESTARTNOHAND (To be restarted) --- SIGTERM (Terminated) --- --- SIGCHLD (Child exited) --- rt_sigaction(SIGTERM, {0x8049a94, [TERM], SA_RESTART|0x4000000}, {0x8049a94, [TERM], SA_RESTART|0x4000000}, 8) = 0 sigreturn() = ? (mask now []) _exit(0) = ? open("/var/run/syslog-ng.pid", O_WRONLY|O_CREAT|O_TRUNC|O_NOCTTY, 0600) = 4 getpid() = 25136 write(4, "25136\n", 6) = 6 close(4) = 0 socket(PF_UNIX, SOCK_STREAM, 0) = 4 fcntl64(4, F_GETFL) = -1 ENOSYS (Function not implemented) fcntl(4, F_GETFL) = 0x2 (flags O_RDWR) fcntl(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0 fcntl(4, F_SETFD, FD_CLOEXEC) = 0 stat("/dev/log", {st_mode=S_IFSOCK|0666, st_size=0, ...}) = 0 unlink("/dev/log") = 0 bind(4, {sin_family=AF_UNIX, path=" /dev/log"}, 110) = 0 chown32("/dev/log", 0, 0) = -1 ENOSYS (Function not implemented) chown("/dev/log", 0, 0) = 0 chmod("/dev/log", 0666) = 0 listen(4, 256) = 0 socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 5 fcntl(5, F_GETFL) = 0x2 (flags O_RDWR) fcntl(5, F_SETFL, O_RDWR|O_NONBLOCK) = 0 fcntl(5, F_SETFD, FD_CLOEXEC) = 0 brk(0x8061000) = 0x8061000 gettimeofday({982687040, 137493}, NULL) = 0 getpid() = 25136 open("/etc/resolv.conf", O_RDONLY) = 6 fstat(6, {st_mode=S_IFREG|0644, st_size=78, ...}) = 0 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40018000 read(6, "domain electroniceasel.com\nsearc"..., 4096) = 78 read(6, "", 4096) = 0 close(6) = 0 munmap(0x40018000, 4096) = 0 close(5) = 0 write(2, "Error creating AF_INET socket (S"..., 40) = 40 write(2, "Error initializing configuration"..., 43) = 43 getppid() = 25135 kill(25135, SIGTERM) = 0 _exit(2) = ?
participants (6)
-
Brad Arlt
-
Hamilton, Andrew Mr RAYTHEON 5 SIG CMD
-
laurence＠uwc.ac.za
-
Santiago Gómez Cano
-
Simeon Johnston
-
Wiktor Wodecki