Re: [syslog-ng] multi-line logs and program/facility filters
Ok, well that cannot be a solution for us because of different reasons: performance (embedded environment), probability to add bugs ... I guess we'll have to go reconsider keeping syslogd which doesn't have this issue. Regards, Michael
Don't give up quite yet. There are better people than I by far on this list :-) Btw ... the program destination ran pretty well with no performance impact or anything. "Use the source young padawan " On Fri, Aug 10, 2018, 10:51 AM Michael Thénault <michael.thenault@gmail.com> wrote:
Ok, well that cannot be a solution for us because of different reasons: performance (embedded environment), probability to add bugs ... I guess we'll have to go reconsider keeping syslogd which doesn't have this issue.
Regards, Michael
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Hi, this is probably because syslogd used SOCK_DGRAM socket for /dev/log whereas your syslog-ng configuration tells syslog-ng to use SOCK_STREAM. The libc implementation supports both. Make sure you use unix-dgram() in syslog-ng. the system() source in syslog-ng defaults to unix-dgram() if I remember correctly. btw: multi-line log messages are not supported over syslog network transports in general, though its original UDP transport may work. Bazsi On Fri, Aug 10, 2018 at 5:36 PM, Jim Hendrick <james.r.hendrick@gmail.com> wrote:
Don't give up quite yet. There are better people than I by far on this list :-)
Btw ... the program destination ran pretty well with no performance impact or anything. "Use the source young padawan "
On Fri, Aug 10, 2018, 10:51 AM Michael Thénault < michael.thenault@gmail.com> wrote:
Ok, well that cannot be a solution for us because of different reasons: performance (embedded environment), probability to add bugs ... I guess we'll have to go reconsider keeping syslogd which doesn't have this issue.
Regards, Michael ____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Hi, Indeed it works with unix-dgram("/dev/log" ); Thanks ! I have another question : I have a system with different packages. Each package brings its own syslog-ng conf file to define its filters and log { } blocks. All those conf files are in a directory which is included by the main syslog-ng conf file. In the main syslog-ng conf file I want to log all the unfiltered lines into /var/log/messages. Problem: I cannot reference previously defined filters without knowing their name. The main conf file doesn't know those names. Is there a way to solve this ? Sadly wildcards don't work on filter names... Regards, Michael Le ven. 10 août 2018 à 20:06, Scheidler, Balázs <balazs.scheidler@oneidentity.com> a écrit :
Hi,
this is probably because syslogd used SOCK_DGRAM socket for /dev/log whereas your syslog-ng configuration tells syslog-ng to use SOCK_STREAM. The libc implementation supports both. Make sure you use unix-dgram() in syslog-ng. the system() source in syslog-ng defaults to unix-dgram() if I remember correctly.
btw: multi-line log messages are not supported over syslog network transports in general, though its original UDP transport may work.
Bazsi
On Fri, Aug 10, 2018 at 5:36 PM, Jim Hendrick <james.r.hendrick@gmail.com> wrote:
Don't give up quite yet. There are better people than I by far on this list :-)
Btw ... the program destination ran pretty well with no performance impact or anything. "Use the source young padawan "
On Fri, Aug 10, 2018, 10:51 AM Michael Thénault <michael.thenault@gmail.com> wrote:
Ok, well that cannot be a solution for us because of different reasons: performance (embedded environment), probability to add bugs ... I guess we'll have to go reconsider keeping syslogd which doesn't have this issue.
Regards, Michael ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Hi, Try adding a log path with the fallback flag: https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edit... Regards, Robert On Tue, Aug 14, 2018 at 11:48 AM, Michael Thénault < michael.thenault@gmail.com> wrote:
Hi, Indeed it works with unix-dgram("/dev/log" ); Thanks !
I have another question : I have a system with different packages. Each package brings its own syslog-ng conf file to define its filters and log { } blocks. All those conf files are in a directory which is included by the main syslog-ng conf file.
In the main syslog-ng conf file I want to log all the unfiltered lines into /var/log/messages. Problem: I cannot reference previously defined filters without knowing their name. The main conf file doesn't know those names. Is there a way to solve this ? Sadly wildcards don't work on filter names...
Regards, Michael
Le ven. 10 août 2018 à 20:06, Scheidler, Balázs <balazs.scheidler@oneidentity.com> a écrit :
Hi,
this is probably because syslogd used SOCK_DGRAM socket for /dev/log
whereas your syslog-ng configuration tells syslog-ng to use SOCK_STREAM. The libc implementation supports both. Make sure you use unix-dgram() in syslog-ng. the system() source in syslog-ng defaults to unix-dgram() if I remember correctly.
btw: multi-line log messages are not supported over syslog network
transports in general, though its original UDP transport may work.
Bazsi
On Fri, Aug 10, 2018 at 5:36 PM, Jim Hendrick <
james.r.hendrick@gmail.com> wrote:
Don't give up quite yet. There are better people than I by far on this
list :-)
Btw ... the program destination ran pretty well with no performance
impact or anything. "Use the source young padawan "
On Fri, Aug 10, 2018, 10:51 AM Michael Thénault <
michael.thenault@gmail.com> wrote:
Ok, well that cannot be a solution for us because of different reasons: performance (embedded environment), probability to add bugs ... I guess we'll have to go reconsider keeping syslogd which doesn't have this issue.
Regards, Michael ____________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
____________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
____________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Awesome, flags(fallback); in the main log{} fixed it. Thanks ! Regards, Michael Le mar. 14 août 2018 à 12:32, Fekete, Róbert <robert.fekete@oneidentity.com> a écrit :
Hi,
Try adding a log path with the fallback flag: https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edit...
Regards,
Robert
On Tue, Aug 14, 2018 at 11:48 AM, Michael Thénault <michael.thenault@gmail.com> wrote:
Hi, Indeed it works with unix-dgram("/dev/log" ); Thanks !
I have another question : I have a system with different packages. Each package brings its own syslog-ng conf file to define its filters and log { } blocks. All those conf files are in a directory which is included by the main syslog-ng conf file.
In the main syslog-ng conf file I want to log all the unfiltered lines into /var/log/messages. Problem: I cannot reference previously defined filters without knowing their name. The main conf file doesn't know those names. Is there a way to solve this ? Sadly wildcards don't work on filter names...
Regards, Michael
Le ven. 10 août 2018 à 20:06, Scheidler, Balázs <balazs.scheidler@oneidentity.com> a écrit :
Hi,
this is probably because syslogd used SOCK_DGRAM socket for /dev/log whereas your syslog-ng configuration tells syslog-ng to use SOCK_STREAM. The libc implementation supports both. Make sure you use unix-dgram() in syslog-ng. the system() source in syslog-ng defaults to unix-dgram() if I remember correctly.
btw: multi-line log messages are not supported over syslog network transports in general, though its original UDP transport may work.
Bazsi
On Fri, Aug 10, 2018 at 5:36 PM, Jim Hendrick <james.r.hendrick@gmail.com> wrote:
Don't give up quite yet. There are better people than I by far on this list :-)
Btw ... the program destination ran pretty well with no performance impact or anything. "Use the source young padawan "
On Fri, Aug 10, 2018, 10:51 AM Michael Thénault <michael.thenault@gmail.com> wrote:
Ok, well that cannot be a solution for us because of different reasons: performance (embedded environment), probability to add bugs ... I guess we'll have to go reconsider keeping syslogd which doesn't have this issue.
Regards, Michael ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
-- Mit freundlichen Grüßen / best regards, Michaël Thénault
participants (4)
-
Fekete, Róbert
-
Jim Hendrick
-
Michael Thénault
-
Scheidler, Balázs