[syslog-ng] syslog-ng Digest, Vol 39, Issue 20

Anurag Agarwal Anurag.Agarwal at telsima.com
Thu Jul 24 13:24:20 CEST 2008


Thanks Bazsi for reply.

Relevant portion is below
**************************************************************
destination console {
usertty("wimaxnoc"); 
};

 filter ps_nt_re {
   match("PS NOT REACHABLE");
}; 
 
log { source(network); filter(ps_nt_re); destination(console); };
**************************************************************

Please help.



Anurag aggarwal



-----Original Message-----
From: syslog-ng-bounces at lists.balabit.hu
[mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of
syslog-ng-request at lists.balabit.hu
Sent: Thursday, July 24, 2008 3:30 PM
To: syslog-ng at lists.balabit.hu
Subject: syslog-ng Digest, Vol 39, Issue 20

Send syslog-ng mailing list submissions to
	syslog-ng at lists.balabit.hu

To subscribe or unsubscribe via the World Wide Web, visit
	https://lists.balabit.hu/mailman/listinfo/syslog-ng
or, via email, send a message with subject or body 'help' to
	syslog-ng-request at lists.balabit.hu

You can reach the person managing the list at
	syslog-ng-owner at lists.balabit.hu

When replying, please edit your Subject line so it is more specific than
"Re: Contents of syslog-ng digest..."


Today's Topics:

   1. Re:  Re :  Re : Re :  Syslogd + Syslog-ng (Christopher Cashell)
   2. Re:  Re :  Re : Re :  Syslogd + Syslog-ng
      (Leandro Ferreira da Silva)
   3. Re:  Using regexp in match() (Balazs Scheidler)
   4. Re:  Usertty sending messages to all user and	without	login
      also (Balazs Scheidler)


----------------------------------------------------------------------

Message: 1
Date: Wed, 23 Jul 2008 10:04:34 -0500
From: Christopher Cashell <ChristopherCashell at solutionary.com>
Subject: Re: [syslog-ng] Re :  Re : Re :  Syslogd + Syslog-ng
To: Syslog-ng users' and developers' mailing list
	<syslog-ng at lists.balabit.hu>
Message-ID: <48874882.8070904 at solutionary.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed

Leandro Ferreira da Silva did thus speak on 7/23/2008 7:14 AM:
> The configuration is the standart, I only do the follow changes.
> 
> # sources
> source src { unix-dgram("/var/run/log");
>              unix-dgram("/var/run/logpriv" perm(0600));
>              udp(); internal(); file("/dev/klog"); };
> 
> I add this,
> source r_src { udp(ip("*client.domain*") port(514));  };

Here's your problem.  For src, you define 'udp()' as one of your log
sources, without including any specific options for it.  This will cause
syslog-ng to go with its defaults for udp(), which is bind to *all* IP
addresses assigned to the box, on port 514.

Then, for r_src, you are telling syslog-ng to bind to a specific IP
address on the box and port 514.  When syslog-ng attempts to start, it
will fail with the error message you received because that ip/port is
already in use (by the source src, which is bound to all IP's).

Unless you have a need to bind to a specific IP address on the box, I'd
recommend removing 'udp();' from src, and replacing the current
'udp(ip("*client.domain*") port(514));' in r_src with 'udp();'.

--
Christopher Cashell


------------------------------

Message: 2
Date: Wed, 23 Jul 2008 14:39:03 -0300
From: Leandro Ferreira da Silva <ferreira at iqm.unicamp.br>
Subject: Re: [syslog-ng] Re :  Re : Re :  Syslogd + Syslog-ng
To: Syslog-ng users' and developers' mailing list
	<syslog-ng at lists.balabit.hu>
Message-ID: <48876CB7.7080909 at iqm.unicamp.br>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed

Christopher Cashell wrote:
> Leandro Ferreira da Silva did thus speak on 7/23/2008 7:14 AM:
>> The configuration is the standart, I only do the follow changes.
>>
>> # sources
>> source src { unix-dgram("/var/run/log");
>>              unix-dgram("/var/run/logpriv" perm(0600));
>>              udp(); internal(); file("/dev/klog"); };
>>
>> I add this,
>> source r_src { udp(ip("*client.domain*") port(514));  };
>
> Here's your problem.  For src, you define 'udp()' as one of your log 
> sources, without including any specific options for it.  This will 
> cause syslog-ng to go with its defaults for udp(), which is bind to 
> *all* IP addresses assigned to the box, on port 514.
>
> Then, for r_src, you are telling syslog-ng to bind to a specific IP 
> address on the box and port 514.  When syslog-ng attempts to start, it

> will fail with the error message you received because that ip/port is 
> already in use (by the source src, which is bound to all IP's).
>
> Unless you have a need to bind to a specific IP address on the box, 
> I'd recommend removing 'udp();' from src, and replacing the current 
> 'udp(ip("*client.domain*") port(514));' in r_src with 'udp();'.
>
It worked!!
The real problem was udp () at src.
Thank you very much for all the help...
Now I'll go complete my rules..

See you!! =P


------------------------------

Message: 3
Date: Thu, 24 Jul 2008 10:16:27 +0200
From: Balazs Scheidler <bazsi at balabit.hu>
Subject: Re: [syslog-ng] Using regexp in match()
To: Syslog-ng users' and developers' mailing list
	<syslog-ng at lists.balabit.hu>
Cc: documentation at balabit.com
Message-ID: <1216887387.8130.5.camel at bzorp.balabit>
Content-Type: text/plain; charset=UTF-8

On Tue, 2008-07-22 at 09:45 +0200, Jan Kreps wrote:
> > ------------ P?vodn? zpr?va ------------
> > Od: Jan Kreps <krepsj at seznam.cz>
> > P?edm?t: Re: [syslog-ng] Using regexp in match()
> > Datum: 10.7.2008 10:29:35
> > ----------------------------------------
> > 
> > > > I'm trying to setup central syslog-ng server for my Exchange
servers. On
> > > windows servers I use Epilog agent (brother of Snare) forwarding
tracking
> > > logs to central syslog.
> 
> > Obviously I have used bad regexp. Exchange tracking log uses tabs as
delimiters.
> > But when I saved $MSG string to text log, tabs was changed to
'\011'. 
> > 
> > So now I changed my regexp to use tabs as delimiters:
> > 
> > filter f_parsing {
> >   match("([^\t]*)\t([^\t]*)\t");
> > }; 
> > 
> > This works like charm and saves first two tab delimited fields (date
and time in
> > this case) to $1 and $2.
> > 
> 
> Some more remarks to subject. 
> 
> Syslog-ng Administrator guide 1.1.1 Edition from May 2008 says on page
111:
> 
> "The regular expressions can use up to 255 regexp matches ($1 ...
$255)."
> 
> and on page 112:
> 
> "Regarding braces around macro names, the following two formats are
equivalent "$MSG" and "${MSG}"."
> 
> Fact is that for regexp matches greater than 9 it MUST be in ${}
format. If you use for instance $12 it resolves as content of $1 +
character '2'. I found that I have to use ${} syntax in ChangeLog remark
for patch 137. I guess that should be stated in Admin Guide more
clearly. In this respect, statement "The regular expressions can use up
to 255 regexp matches ($1 ... $255)" is not true and should be
corrected. 
> 

right, this should be fixed in the documentation.

> And I have one question about file creation.
> 
> When something is logged a file is created according to destination().
But when I delete the file, it's not created anymore, until restart of
syslog-ng. Is that correct/expected behaviour?
> 
> I run Debian Etch and syslog-ng 2.0.9-1 from unstable branch (in
stable is still version 2.0.0)

Yes, you need to send the HUP signal to syslog-ng in order to reopen log
files. This is the way UNIX works. (the application does not know about
the deletion of a logfile)

-- 
Bazsi



------------------------------

Message: 4
Date: Thu, 24 Jul 2008 10:28:06 +0200
From: Balazs Scheidler <bazsi at balabit.hu>
Subject: Re: [syslog-ng] Usertty sending messages to all user and
	without	login also
To: Syslog-ng users' and developers' mailing list
	<syslog-ng at lists.balabit.hu>
Message-ID: <1216888086.8130.10.camel at bzorp.balabit>
Content-Type: text/plain

On Wed, 2008-07-23 at 13:39 +0530, Anurag Agarwal wrote:
> Hello everybuddy,
>  
> I am using syslog-ng and used usertty in destination. I am using a
user
> 'test' as destination. But other users can also see the message on
their
> console e.g root and other users. Please help as this is creating a
> problem and NG not working as desired.
>  OS: Solaris 10
> 

It does work for me. Can you show us the relevant portions of your
configuration file? I tried with this:

source local { sun-streams("/dev/log" door("/etc/.syslog_door"));
internal(); };

destination all { file("/var/log/messages"); };

log { source(local); destination(all); };

destination all_users {
  usertty("bazsi");
};

filter alert_emerg {
  level(err..emerg);
};
log {
  source(local);
  filter(alert_emerg);
  destination(all_users);
};


It correctly printed err..emerg messages on my tty, and not on others.
The relevant portion of the code is here:

#if HAVE_MODERN_UTMP
      if (ut->ut_type == USER_PROCESS &&
          ((self->username->len == 1 &&
            self->username->str[0] == '*') ||
           (self->username->len <= sizeof(ut->ut_user) &&
            memcmp(self->username->str, ut->ut_user,
self->username->len) == 0))) 
#else
      if ((self->username->len == 1 &&
           self->username->str[0] == '*') ||
          (self->username->len <= sizeof(ut->ut_name) &&
           memcmp(self->username->str, ut->ut_name, self->username->len)
== 0)) 
#endif

I don't see how this condition could match for everyone. Even if the
wtmp format is different and ut->ut_name would contain a bogus value,
the expected breakage would be to not display anywhere, not to display
everywhere.

-- 
Bazsi



------------------------------

_______________________________________________
syslog-ng maillist  -  syslog-ng at lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng


End of syslog-ng Digest, Vol 39, Issue 20
*****************************************



More information about the syslog-ng mailing list