[syslog-ng] Can't get basic syslog to work for my firewall logs?

[Scot]

Never did get the create_dir option to work right have you tried making the
dirs to see if the files get made ?
On Fri, Feb 24, 2017 at 10:06 AM Tim Tyler <tyler at beloit.edu> wrote:

> Syslog-ng experts.
>
>   I am very new to syslog-ng.  I installed syslog-ng on a fresh Redhat 7.3
> server.   It defaults working with internal logging.  So I configured my
> firewall to send syslog with facility set to log_user.  I turned on
> Wireshark on the syslog-ng server and observed the firewall sending traffic
> to the server on udp 514.
>
>
>
> But the syslog server never created the directory structure and logs.  I
> disabled the redhat firewall just to eliminate it as a possibility.  Still
> no logging.  So I don’t know what I am doing wrong at this point. I don’t
> know if this is a permission problem or some other configuration issue.  I
> found someone that had posted a very basic syslog-ng configuration for
> firewalls.  So I copied It into a firewall.conf I put in conf.d.  Can
> anyone see what might be wrong with it?
>
>
>
> ####################
>
> options {
>
>         create_dirs(yes);
>
>         owner(root);
>
>         group(root);
>
>         perm(0640);
>
>         dir_owner(root);
>
>         dir_group(root);
>
>         dir_perm(0750);
>
> };
>
>
>
>
>
> ##################################################
>
> source s_udp {
>
>         udp(port(514));
>
> };
>
>
>
> #Template for a new firewall in the firewalls.conf file
>
> #Entries to be changed: NAMEOFTHEFIREWALL and IPOFTHEFIREWALL
>
>
>
> ##################################################
>
> filter f_NAMEOFTHEFIREWALL {
>
>         host("192.168.30.1");
>
> };
>
> destination d_NAMEOFTHEFIREWALL {
>
>
> file("/var/log/firewalls/PA/$YEAR/$MONTH/$YEAR-$MONTH-$DAY.PA.log");
>
> };
>
> log {
>
>         source(s_udp);
>
>         filter(f_NAMEOFTHEFIREWALL);
>
>         destination(d_NAMEOFTHEFIREWALL);
>
> };
>
>
>
>
>
> Tim Tyler
>
> Network Engineer
>
> Beloit College
>
>
>
>
>
> ______________________________________________________________________________
>
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
>
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20170310/6aa0e3fd/attachment.html>