Logserver doesn't receving remote logs
Hey , I have a central logserver with syslog-ng installed and configured (see above syslog-ng.conf), some clients (in conf just remotehost5) send (514/udp) their logs to this logserver; but logserver isn't receiving these logs. When I try to use local system logs, it's ok, create the log files, but with remote host doesn't. I have created /var/log/HOSTS/{nameserver}, and clients, that use syslog has in syslog.conf *.warning @logserver (/etc/hosts is ok). remotehost5 is pinging logserver. Anybody has any ideia about it? (thanks too much) logserver: linux Fedora Core 3 syslog-ng-1.6.5-6 libol-0.3.14-1 /* syslog-ng.conf logserver = = local server */ options{ sync(0); keep_hostname(no); log_fifo_size(1000); long_hostnames(off); use_dns(no); use_fqdn(no); create_dirs(yes); }; source s_sys{ unix-stream("/dev/log"); internal(); }; source s_udp{ udp(ip(192.168.100.100) ); }; #listenned interface on server filter f_remotehost5sec{ host( "web5" ) and level( warning .. emerg ) and facility( authpriv ); }; filter f_logservermesg{ level(info .. emerg) and not (facility(authpriv) and facility(mail) and facility(cron)); }; filter f_logserversec { facility(authpriv) and level(info .. emerg); }; destination d_remotehost5mesg { file("/var/log/HOSTS/remotehost5/$YEAR-$MONTH-$DAY.secure" ); }; destination d_remotehost5sec { file("/var/log/HOSTS/remotehost5/$YEAR-$MONTH-$DAY.secure" ); }; destination d_logservermesg { file("/var/log/HOSTS/logserver/$YEAR-$MONTH-$DAY.message"); }; destination d_logserversec { file("/var/log/HOSTS/logserver/$YEAR-$MONTH-$DAY.secure"); }; log { source(s_udp); filter(f_remotehost5mesg); destination(d_remotehost5mesg); }; log { source(s_sys); filter(f_logservermesg); destination(d_logservermesg); }; log { source(s_sys); filter(f_logserversec); destination(d_logserversec); };
Fedora Core 3 has a firewall enabled by default. Is the firewall enabled in your install? Allow port 514 udp traffic. On Fri, 25 Feb 2005 10:47:45 -0300, Viper sec <vipersec@gmail.com> wrote:
I have a central logserver with syslog-ng installed and configured (see above syslog-ng.conf), some clients (in conf just remotehost5) send (514/udp) their logs to this logserver; but logserver isn't receiving these logs. When I try to use local system logs, it's ok, create the log files, but with remote host doesn't. I have created /var/log/HOSTS/{nameserver}, and clients, that use syslog has in syslog.conf *.warning @logserver (/etc/hosts is ok). remotehost5 is pinging logserver.
Anybody has any ideia about it? (thanks too much)
logserver: linux Fedora Core 3 syslog-ng-1.6.5-6 libol-0.3.14-1
<snip> source s_udp{ udp(ip(192.168.100.100) ); }; #listenned interface on server </snip>
Thanks, that's ok! On Mon, 28 Feb 2005 01:19:36 -0500, Jay Guerette <jayguerette@gmail.com> wrote:
Fedora Core 3 has a firewall enabled by default. Is the firewall enabled in your install? Allow port 514 udp traffic.
On Fri, 25 Feb 2005 10:47:45 -0300, Viper sec <vipersec@gmail.com> wrote:
I have a central logserver with syslog-ng installed and configured (see above syslog-ng.conf), some clients (in conf just remotehost5) send (514/udp) their logs to this logserver; but logserver isn't receiving these logs. When I try to use local system logs, it's ok, create the log files, but with remote host doesn't. I have created /var/log/HOSTS/{nameserver}, and clients, that use syslog has in syslog.conf *.warning @logserver (/etc/hosts is ok). remotehost5 is pinging logserver.
Anybody has any ideia about it? (thanks too much)
logserver: linux Fedora Core 3 syslog-ng-1.6.5-6 libol-0.3.14-1
<snip> source s_udp{ udp(ip(192.168.100.100) ); }; #listenned interface on server </snip>
syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
bump. On Fri, 2005-02-25 at 10:47 -0300, Viper sec wrote:
Hey , I have a central logserver with syslog-ng installed and configured (see above syslog-ng.conf), some clients (in conf just remotehost5) send (514/udp) their logs to this logserver; but logserver isn't receiving these logs. When I try to use local system logs, it's ok, create the log files, but with remote host doesn't. I have created /var/log/HOSTS/{nameserver}, and clients, that use syslog has in syslog.conf *.warning @logserver (/etc/hosts is ok). remotehost5 is pinging logserver.
Anybody has any ideia about it? (thanks too much)
logserver: linux Fedora Core 3 syslog-ng-1.6.5-6 libol-0.3.14-1
/* syslog-ng.conf logserver = = local server */
options{ sync(0); keep_hostname(no); log_fifo_size(1000); long_hostnames(off); use_dns(no); use_fqdn(no); create_dirs(yes); };
source s_sys{ unix-stream("/dev/log"); internal(); }; source s_udp{ udp(ip(192.168.100.100) ); }; #listenned interface on server
filter f_remotehost5sec{ host( "web5" ) and level( warning .. emerg ) and facility( authpriv ); }; filter f_logservermesg{ level(info .. emerg) and not (facility(authpriv) and facility(mail) and facility(cron)); }; filter f_logserversec { facility(authpriv) and level(info .. emerg); };
destination d_remotehost5mesg {
file("/var/log/HOSTS/remotehost5/$YEAR-$MONTH-$DAY.secure" ); }; destination d_remotehost5sec {
file("/var/log/HOSTS/remotehost5/$YEAR-$MONTH-$DAY.secure" ); }; destination d_logservermesg {
file("/var/log/HOSTS/logserver/$YEAR-$MONTH-$DAY.message"); }; destination d_logserversec {
file("/var/log/HOSTS/logserver/$YEAR-$MONTH-$DAY.secure"); };
log { source(s_udp); filter(f_remotehost5mesg); destination(d_remotehost5mesg); }; log { source(s_sys); filter(f_logservermesg); destination(d_logservermesg); }; log { source(s_sys); filter(f_logserversec); destination(d_logserversec); }; _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
-- -------------------------- Ed Davison Sr. Systems Analyst McCombs School of Business 512-232-6620 voice
participants (3)
-
Ed Davison
-
Jay Guerette
-
Viper sec