headers
Ron Clark | 1 Oct 2004 03:16

syslog-ng to MySQL question

Hello all, 

This may be off topic, but I would be very appreciative of any help. I
am using the sqlsyslogd file from
http://www.frasunek.com/sources/security/sqlsyslogd/.

But when it reads from the logs coming into syslog, on the time stamp
field, it adds some text in <> signs, and does not fully capture the
time stamp. Does anyone know what these are?  And more important, how
does one get the script to get fully imput the time stamp in the
syslogs? Does anyone have any tricks to the sqlsyslog.c file that might
fix this?

If this is not the correct forum, then please forward me to the right
person or place. 

Thank you in advance,
Ron Clark

actual syslog:
Sep 30 16:03:05 system1 /kernel:

mysql entry:
| 15468 | <118>Sep 30 18: | system1 | psmintr |
Permalink | Reply | 1 comment |
headers
Ron Clark | 1 Oct 2004 03:16

syslog-ng to MySQL question

Hello all, 

This may be off topic, but I would be very appreciative of any help. I
am using the sqlsyslogd file from
http://www.frasunek.com/sources/security/sqlsyslogd/.

But when it reads from the logs coming into syslog, on the time stamp
field, it adds some text in <> signs, and does not fully capture the
time stamp. Does anyone know what these are?  And more important, how
does one get the script to get fully imput the time stamp in the
syslogs? Does anyone have any tricks to the sqlsyslog.c file that might
fix this?

If this is not the correct forum, then please forward me to the right
person or place. 

Thank you in advance,
Ron Clark

actual syslog:
Sep 30 16:03:05 system1 /kernel:

mysql entry:
| 15468 | <118>Sep 30 18: | system1 | psmintr |
Permalink | Reply | 0 comments |
headers
Nate Campi | 1 Oct 2004 07:53

Re: /proc/kmsg and chrooted syslog-ng

Did we ever get a step-by-step on making a chroot jail for syslog-ng?

On Tue, Aug 17, 2004 at 01:48:30PM +0200, bazsi <at> balabit.hu wrote:
> On Mon, Aug 16, 2004 at 10:08:46PM -0500, Michael D. (Mick) Bauer wrote:
> > One more ignorance-betraying question about Syslog-ng chroot-jails:
> > what should one do about /proc/kmsg? Maybe "touch
> > /var/logjail/proc/kmsg; ln -s /var/logjail/proc/kmsg /proc/kmsg"?
> 
> no, this would not work. kernel messages need to be fetched from a "live"
> proc filesystem, however you can mount it directly into the chroot jail
> as well, e.g.
> 
> mount -t proc proc /var/logjail/proc
> 
> that's about it.
> 
> > 
> > And do I take it that, per another recent posting, one should
> > similarly create a new dev/log in the jail and link to it from
> > /dev/log?
> 
> yes, this makes it possible to reload syslog-ng inside the chroot jail, as
> otherwise it is not possible.
> 
> > 
> > I'd like to post a revised Syslog-ng chroot jail procedure later
> > this week. Thanks to the two of you who've replied so far!
> 
> great.
>
(Continue reading)

Permalink | Reply | 0 comments |
headers
Nate Campi | 1 Oct 2004 07:59

Re: syslog-ng to MySQL question

On Thu, Sep 30, 2004 at 08:16:08PM -0500, Ron Clark wrote:
> 
> This may be off topic, but I would be very appreciative of any help. I
> am using the sqlsyslogd file from
> http://www.frasunek.com/sources/security/sqlsyslogd/.

Well it's not off topic, since it deals with syslog-ng also.

> But when it reads from the logs coming into syslog, on the time stamp
> field, it adds some text in <> signs, and does not fully capture the
> time stamp. Does anyone know what these are?  And more important, how
> does one get the script to get fully imput the time stamp in the
> syslogs? Does anyone have any tricks to the sqlsyslog.c file that might
> fix this?

Use templates, as Bazsi said to the last person who asked:

 https://lists.balabit.hu/pipermail/syslog-ng/2004-July/006256.html

In the old days I patched sqlsyslogd to simply not print that part of
the message, pretty simple actually:

diff sqlsyslogd.c sqlsyslogd-orig.c
141c141
<                       loghost = strtok((strstr(buf,">") + 1) + 16, " ");
---
>                       loghost = strtok(buf + 16, " ");
143,144c143
<                               strlen(logprog) + 3; */
<                       logmesg = (strstr(buf,">") + 1) + 16 + strlen(loghost) +
(Continue reading)

Permalink | Reply | 0 comments |
headers
Aaron watkins | 1 Oct 2004 13:38
Picon

syslog-ng loses messages

Hi there,

I have been doing some stress testing of syslog-ng as a possible
facilitator of event messaging for use on our network. I have set up a
system as below:

      Event Process
          |    
         \_/
      FIFO/pipe
          |
    _____\_/_______
    [              ]
    [  Machine 1   ]
    [   running    ] 
    [  syslog-ng   ]
    [______________] 
          |
         \_/
      TCP socket
          |
    _____\_/_______
    [              ]
    [  Machine 2   ]
    [   running    ]
    [  syslog-ng   ]
    [______________] 
          |
         \_/
       FIFO/pipe
(Continue reading)

Permalink | Reply | 1 comment |
headers
Dave Johnson | 1 Oct 2004 18:37
Picon

Re: syslog-ng loses messages

* What happens in your test if you change machine2 fifo's to 0?
* What are the numbers of lines that get dropped in each of those tests?

On Fri, 1 Oct 2004 12:38:56 +0100, Aaron watkins
<aaron.j.watkins <at> gmail.com> wrote:
> Hi there,
> 
> I have been doing some stress testing of syslog-ng as a possible
> facilitator of event messaging for use on our network. I have set up a
> system as below:
> 
>       Event Process
>           |
>          \_/
>       FIFO/pipe
>           |
>     _____\_/_______
>     [              ]
>     [  Machine 1   ]
>     [   running    ]
>     [  syslog-ng   ]
>     [______________]
>           |
>          \_/
>       TCP socket
>           |
>     _____\_/_______
>     [              ]
>     [  Machine 2   ]
>     [   running    ]
(Continue reading)

Permalink | Reply | 0 comments |
headers
Aaron watkins | 4 Oct 2004 17:43
Picon

Re: syslog-ng loses messages

Dave,

> * What are the numbers of lines that get dropped in each of those tests?

If I kill (-TERM or -9) the receiving server while messages are not
being written to the input pipe, I will lose message 0 and message 1.

When I kill -TERM while writing to the input pipe: 
Test 1: Messages 27->34 are lost (8 in total)
Test 2: Messages 24->31 are lost (8 in total)

When I kill -9 while writing to the input pipe:
Test 1: Messages 35->38 are lost (4 in total)
Test 2: Messages 23->29 are lost (7 in total)

> * What happens in your test if you change machine2 fifo's to 0?

I presume you mean the log_fifo_size option... When I set this to 0,
the following messages got through:
Iteration 1: Message 0,1,14,28
Iteration 2: Message 0,1,12,21,32
Iteration 3: Message 0,1,12,21,30,39

That is to say, in every iteration, around 37 messages were lost. And
this was with the system operating normally (ie. without killing the
machine2's syslog-ng).

Any ideas?

Thanks,
(Continue reading)

Permalink | Reply | 1 comment |
headers
Ben Nelson | 6 Oct 2004 04:05

What facility do the 'STATS' messages come in on?


I am able to see my internal() STATS messages only by sending all
messages (unfiltered) to a single file.  I'm not sure which of my
filters may be dropping them.  So, which syslog facility do those
messages happen under?

Thanks,
--Ben
Permalink | Reply | 3 comments |
headers
lists | 7 Oct 2004 10:14
Picon
Favicon

perl syslog::parse problem

hi,

i've switched to syslog-ng and now mailgraph stoped working. i've read that 
there is a patch requiered for syslog::parse but i can't find it anywhere. 
can some one please point me to this patch ?

TIA
matthias

--

-- 

Matthias Henze                matthias <at> mhcsoftware.de

Use PGP!! http://www.mhcsoftware.de/MatthiasHenze.asc
- - - - - - - - - - - - - - - - - - - - - - - - - - - -
MHC SoftWare GmbH          voice: +49-(0)9533-92006-0
Fichtera 17                  fax: +49-(0)9533-92006-6
96274 Itzgrund/Germany    e-Mail: info <at> mhcsoftware.de
- - - - - - - - - - - - - - - - - - - - - - - - - - - -
Permalink | Reply | 0 comments |
headers
Dave Johnson | 7 Oct 2004 16:24
Picon

Re: What facility do the 'STATS' messages come in on?

Ben, its one of the "syslog" levels -- ie: syslog.notice

On Tue, 05 Oct 2004 20:05:17 -0600, Ben Nelson <lists <at> venom600.org> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> I am able to see my internal() STATS messages only by sending all
> messages (unfiltered) to a single file.  I'm not sure which of my
> filters may be dropping them.  So, which syslog facility do those
> messages happen under?
> 
> Thanks,
> - --Ben
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.4 (GNU/Linux)
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
> 
> iD8DBQFBY1Ld3cL8qXKvzcwRAg3eAJ0a/Vxz810kkCqXzizKTag9Yb05zACg1r/X
> rZpVs4HsMSAlO3Xygs80JYI=
> =PKRl
> -----END PGP SIGNATURE-----
> _______________________________________________
> syslog-ng maillist  -  syslog-ng <at> lists.balabit.hu
> https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
> 
>
_______________________________________________
syslog-ng maillist  -  syslog-ng <at> lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
(Continue reading)

Permalink | Reply | 2 comments |

Gmane