Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to set up a seperate log file for all windows messages. I've set up a match for MSWinEventLog, but it's completely ignoring my configuration

Here's my config, which is straight after the src object

filter f_windows    { match("MSWinEventLog"); };
destination winFIFO { file("/var/log/splunk/syslog-ng/winFIFO"); };
log { source(src); filter(f_windows); destination(winFIFO); flags(final); };

It all ends up in this one instead:

filter f_messages   { not facility(news, mail) and not filter(f_iptables); };
destination messages { file("/var/log/messages"); };
log { source(src); filter(f_messages); destination(messages); };

Can anyone see what i'm doing wrong?

share|improve this question

2 Answers 2

up vote 0 down vote accepted

hmm... here's mine lifted from gentoo's security handbook w/ some iptables modifications. honestly I don't remember how I wrote it but maybe the term 'value' has some meaning?


@version: 3.0                      
#                                  
# /etc/syslog-ng.conf              
#                                  

options {
  stats_freq (0);
  flush_lines (0);
  time_reopen (10);
  log_fifo_size (1000);
  long_hostnames(off); 
  use_dns (no);        
  use_fqdn (no);       
  create_dirs (no);    
  keep_hostname (yes); 
  perm(0640);          
  group("log");        
};                     

source src {
  unix-stream("/dev/log");
  internal();             
  file("/proc/kmsg");     
};                        

destination d_authlog { file("/var/log/auth.log"); };
destination d_syslog { file("/var/log/syslog.log"); };
destination d_cron { file("/var/log/crond.log"); };   
destination d_daemon { file("/var/log/daemon.log"); };
destination d_kernel { file("/var/log/kernel.log"); };
destination d_lpr { file("/var/log/lpr.log"); };      
destination d_user { file("/var/log/user.log"); };    
destination d_uucp { file("/var/log/uucp.log"); };    
destination d_mail { file("/var/log/mail.log"); };    
destination d_news { file("/var/log/news.log"); };    
destination d_ppp { file("/var/log/ppp.log"); };      
destination d_debug { file("/var/log/debug.log"); };  
destination d_messages { file("/var/log/messages.log"); };
destination d_errors { file("/var/log/errors.log"); };    
destination d_everything { file("/var/log/everything.log"); };
destination d_iptables { file("/var/log/iptables.log"); };    
destination d_acpid { file("/var/log/acpid.log"); };          
destination d_console { usertty("root"); };                   

# Log everything to tty12
destination console_all { file("/dev/tty12"); };

filter f_auth { facility(auth); };
filter f_authpriv { facility(auth, authpriv); };
filter f_syslog { program(syslog-ng); };        
filter f_cron { facility(cron); };              
filter f_daemon { facility(daemon); };          
filter f_kernel { facility(kern) and not filter(f_iptables); };
filter f_lpr { facility(lpr); };                               
filter f_mail { facility(mail); };                             
filter f_news { facility(news); };                             
filter f_user { facility(user); };                             
filter f_uucp { facility(cron); };                             
filter f_news { facility(news); };                             
filter f_ppp { facility(local2); };                            
filter f_debug { not facility(auth, authpriv, news, mail); };  
filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news, cron) and not program(syslog-ng) and not filter(f_iptables); };              
filter f_everything { level(debug..emerg) and not facility(auth, authpriv); };
filter f_emergency { level(emerg); };
filter f_info { level(info); };
filter f_notice { level(notice); };
filter f_warn { level(warn); };
filter f_crit { level(crit); };
filter f_err { level(err); };
filter f_iptables { match("IN=" value("MESSAGE")) and match("OUT=" value("MESSAGE")); };
filter f_acpid { program("acpid"); };

log { source(src); filter(f_acpid); destination(d_acpid); };
log { source(src); filter(f_authpriv); destination(d_authlog); };
log { source(src); filter(f_syslog); destination(d_syslog); };
log { source(src); filter(f_cron); destination(d_cron); };
log { source(src); filter(f_daemon); destination(d_daemon); };
log { source(src); filter(f_kernel); destination(d_kernel); };
log { source(src); filter(f_lpr); destination(d_lpr); };
log { source(src); filter(f_mail); destination(d_mail); };
log { source(src); filter(f_news); destination(d_news); };
log { source(src); filter(f_ppp); destination(d_ppp); };
log { source(src); filter(f_user); destination(d_user); };
log { source(src); filter(f_uucp); destination(d_uucp); };
#log { source(src); filter(f_debug); destination(d_debug); };
log { source(src); filter(f_messages); destination(d_messages); };
log { source(src); filter(f_err); destination(d_errors); };
log { source(src); filter(f_emergency); destination(d_console); };
log { source(src); filter(f_everything); destination(d_everything); };
log { source(src); filter(f_iptables); destination(d_iptables); };

# Log everything to tty12
#log { source(src); destination(console_all); };
share|improve this answer

Syslog had got itself in a bit of a knot. When I stopped the service, it would still be visible when I did a 'ps -ef |grep syslog' - I killed it, and restarted the service anew and it works fine now.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.