headers
Amodiovalerio Verde | 1 Mar 2004 16:09
Picon
Favicon

Re:file() versus pipe() for kernel logging

It seems the only difference between file() and pipe() is the way files are opened.

file() open files in read only , while pipe() open them in read-write.

There's also defined a source and a destination fifo() that is just another name for pipe().

Amodiovalerio [Hypo] Verde

---------- Initial Header -----------

From      : syslog-ng-admin <at> lists.balabit.hu
To          : syslog-ng <at> lists.balabit.hu
Cc          : 
Date      : Sun, 29 Feb 2004 12:11:34 +1100
Subject : [syslog-ng]file() versus pipe() for kernel logging

> I was just wondering if anyone could explain the differences between pip()
> and file() when used as kernel log sources.
> 
> For example the documentation suggests you would use the following statement
> to collect kernel logs:
> 
> source s_file { file("/proc/kmsg"); };
> 
> Most examples of syslog-ng.conf files I have seen have the following
> statement:
> 
> source s_pipe { pipe("/proc/kmsg"); };
> 
> Is there any difference between the two?  Is one better than the other?
(Continue reading)

Permalink | Reply | 0 comments |
headers
cdowns | 1 Mar 2004 18:11

regex and priority(local7) question

Good Morning,
    Im new to the list and have a couple questions.

    I have a PIX firewalls logging on local7.info, how can I match this 
correctly ? I also have switches logging on local7.info but I need this 
one pix removed and placed into its own destination.

    Where can i get a list of the regex syntax used in syslog-ng ? like 
perl / awk / grep etc.. .

    Here is what I currently have:

------ Snip -------
    ## Regex
filter f_fw01 {
        host("x.x.x.x") and match("PIX");
};
filter f_fw02 {
        host("x.x.x.x") and match("PIX");
};
filter f_fw03 {
        host("x.x.x.x") and match("PIX");
};
filter f_fw04 {
        host("x.x.x.x") and match("PIX");
};

#!!! not working yet.. .
filter f_pix{
        facility(local7) and match("%PIX*");
(Continue reading)

Permalink | Reply | 0 comments |
headers
Loic Minier | 1 Mar 2004 18:50
Picon
Picon

Re: Current stable syslog-ng + libol

Balazs Scheidler <bazsi <at> balabit.hu> - Thu, Feb 26, 2004:

> >  I just upgraded to syslog-ng-1.5.26 and libol-0.3.13. template() works
> >  in file(), but not in program() nor in usertty().  Any hope to see this
> >  fixed/backported in a later 1.5.x release?  Is there a syslog-ng BTS?
> 1.6.2 should be fine.

 It worked indeed!  However, I leave here some notes for Googlers:
 - Sun Door detection did not work in 1.6 (but worked fine in 1.4 and
   1.5), it seems to work with --enable-sun-door for configure;
 - GNU m4 version 1.4 or above is required: I got one from
   SunFreeware.com, and then ran "M4=/usr/local/bin/m4 make" instead of
   make;
 - I kept libol-0.3.13 which seems to be the latest.

 Sorry for not coming back sooner, thanks for your time.

--

-- 
Loïc Minier <lool <at> dooz.org>
_______________________________________________
syslog-ng maillist  -  syslog-ng <at> lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
Permalink | Reply | 0 comments |
headers
Rule, Ted | 2 Mar 2004 10:24
Picon

RE: regex and priority(local7) question

This config snippet works for me .... my PIXies are set to log via TCP1468 rather than UDP/514.
Real IP Addresses replaced with fakes. As with your situation, I have other network
gear running on local7 as well. Syslog-ng's wonderful filtration allows for a nice separation
of all the classes of switch/router/firewall/VPN-bricks.

Ted

......
source local {
        unix_stream("/dev/log" max-connections(200) keep-alive(yes) );

        # UDP listeners for Internal syslog-ng interconnections
        udp(ip(127.0.0.1) port(514));
        udp(ip(1.2.3.4) port(514));

};

source pixtcp {
        tcp(ip(1.2.3.4) port(1468)
                max-connections(10) keep-alive(yes));
};

filter f_local7 { facility(local7) and level(debug..emerg); };
filter f_pixmsg { match("%PIX"); };
filter f_misclocal7 { filter(f_local7)
                        and not filter(f_pixmsg); };

destination d_local7 { file("/var/log/local7.debug" sync(0) ); };
destination d_pixlog { file("/var/log/pixlog.debug" sync(0) ); };
(Continue reading)

Permalink | Reply | 501 comments |
headers
Loic Minier | 2 Mar 2004 11:30
Picon
Picon

Changing permissions on /dev/sysmsg

   Hey,

 While this doesn't cause any noticeable disfunction, I keep getting
 a message from syslog-ng which says:
    syslog-ng[14172]: Changing permissions on special file /dev/sysmsg

 I understand this is the consequence of the owner/group/perm options
 of the following block:

    destination df_dev_sysmsg {
        file("/dev/sysmsg" perm(0777) owner(root) group(other)
            template("$DATE $HOST $MSG\n"));
    };

 On Solaris 8, /dev/sysmsg is a symlink t othe real sysmsg device,
 here's an output of ls -l /dev/sysmsg:

    lrwxrwxrwx   1 root     other         33 Dec 17  2002 /dev/sysmsg ->
    ../devices/pseudo/sysmsg <at> 0:sysmsg

 And here is ls -l /devices/pseudo/sysmsg\ <at> 0\:sysmsg:
    crwxrwxrwx   1 root     other     97,  0 Mar  2 11:26
    /devices/pseudo/sysmsg <at> 0:sysmsg

 As you see, the permissions of /dev/sysmsg and of
 /devices/pseudo/sysmsg <at> 0:sysmsg match the mask I set, and I wonder how
 can I can tell syslog-ng not to touch the permission of this "file".

   Thanks for any hint,
     Regards,
(Continue reading)

Permalink | Reply | 0 comments |
headers
Loic Minier | 2 Mar 2004 11:34
Picon
Picon

Log prefix under Solaris

   Hey again,

 All log messages that syslog-ng reads from sun-streams("/dev/log"
 door("/etc/.syslog_door")); are prefixed with the following string:
    "[ID 702911 local3.alert] "

 If I understand correctly, it seems that any program using the standard
 syslog interface under Solaris will see there messages prefixed with an
 ID and the facility they used.  This is despite any formatting option I
 can tell, this is simply the content of $MSG.

 This, however, doesn't happen with UDP messages.

 I wonder if there's a way to remove this part, either at on syslog-ng
 side or in the calls to the syslog interface of Solaris?

   Regards,

--

-- 
Loïc Minier <lool <at> dooz.org>
_______________________________________________
syslog-ng maillist  -  syslog-ng <at> lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
Permalink | Reply | 0 comments |
headers
Paul Jasa | 2 Mar 2004 13:56
Favicon

Issue while logging to messages file

Good morning!  I am testing syslog-ng to find an alternative to syslog.   So far, so good, the instructions
have been great and I got it to work.  However, I have one issue I can't seem to fix nor find literature which
addresses it.   I discovered that when the /var/log/messages file gets switched to messages.1 (then
messages.2 and so forth), syslog-ng keeps logging to the new file name messages.1 instead of messages as I
defined it in the conf file.   I was hoping someone might know why does syslog-ng do this, and how can it be
fixed?    Thanks in advance for any info.  Best regards to all,
Paul

====================================== 
Paul Jasa 
Network Engineer 
====================================== 

The information contained in this e-mail and any attached documents 
may be privileged, confidential and protected from disclosure.  If you 
are not the intended recipient you may not read, copy, distribute or 
use this information.  If you have received this communication in 
error, please notify the sender immediately by replying to this 
message and then delete it from your system.
_______________________________________________
syslog-ng maillist  -  syslog-ng <at> lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
Permalink | Reply | 1 comment |
headers
Balazs Scheidler | 2 Mar 2004 14:17
Picon

Re: Issue while logging to messages file

2004-03-02, k keltezéssel 13:56-kor Paul Jasa ezt írta:
> Good morning!  I am testing syslog-ng to find an alternative to syslog.   So far, so good, the instructions
have been great and I got it to work.  However, I have one issue I can't seem to fix nor find literature which
addresses it.   I discovered that when the /var/log/messages file gets switched to messages.1 (then
messages.2 and so forth), syslog-ng keeps logging to the new file name messages.1 instead of messages as I
defined it in the conf file.   I was hoping someone might know why does syslog-ng do this, and how can it be
fixed?    Thanks in advance for any info.  Best regards to all,
> Paul

you need to send a SIGUP to the syslog-ng process after rotating the
file. Probably the cron job doing the rotation still tries to SIGHUP
syslogd, thus syslog-ng is not notified about the change.

Either fix the rotating cronjob or write a separate cron job which sends
a SIGHUP to syslog-ng.

--

-- 
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

_______________________________________________
syslog-ng maillist  -  syslog-ng <at> lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
Permalink | Reply | 0 comments |
headers
cdowns | 2 Mar 2004 14:36

Re: regex and priority(local7) question

Ted,
    Thank you for the reply, Ill give this a try.

Sincerely,
    Christopher M Downs

Rule, Ted wrote:

>This config snippet works for me .... my PIXies are set to log via TCP1468 rather than UDP/514.
>Real IP Addresses replaced with fakes. As with your situation, I have other network
>gear running on local7 as well. Syslog-ng's wonderful filtration allows for a nice separation
>of all the classes of switch/router/firewall/VPN-bricks.
>
>
>Ted
>
>......
>source local {
>        unix_stream("/dev/log" max-connections(200) keep-alive(yes) );
>
>        # UDP listeners for Internal syslog-ng interconnections
>        udp(ip(127.0.0.1) port(514));
>        udp(ip(1.2.3.4) port(514));
>
>};
>
>source pixtcp {
>        tcp(ip(1.2.3.4) port(1468)
>                max-connections(10) keep-alive(yes));
>};
(Continue reading)

Permalink | Reply | 501 comments |
headers
Amodiovalerio Verde | 2 Mar 2004 15:06
Picon
Favicon

Re:Log prefix under Solaris

You can disable solaris message ID generation editing the file /kernel/drv/log.conf

Just set msgid=0 instead of msgid=1.

That way message IDs will not be generated.

Amodiovalerio [Hypo] Verde

---------- Initial Header -----------

From      : syslog-ng-admin <at> lists.balabit.hu
To          : "Syslog-NG" syslog-ng <at> lists.balabit.hu
Cc          : 
Date      : Tue, 2 Mar 2004 11:34:52 +0100
Subject : [syslog-ng]Log prefix under Solaris

>    Hey again,
> 
>  All log messages that syslog-ng reads from sun-streams("/dev/log"
>  door("/etc/.syslog_door")); are prefixed with the following string:
>     "[ID 702911 local3.alert] "
> 
>  If I understand correctly, it seems that any program using the standard
>  syslog interface under Solaris will see there messages prefixed with an
>  ID and the facility they used.  This is despite any formatting option I
>  can tell, this is simply the content of $MSG.
> 
>  This, however, doesn't happen with UDP messages.
> 
>  I wonder if there's a way to remove this part, either at on syslog-ng
(Continue reading)

Permalink | Reply | 501 comments |

Gmane