0

I have setup syslog-ng to log to a MSSQL destination and that all works well. However, if I specify a second destination (same database but different table) with a seperate log command that uses a different filter to identify the traffic I want in that table, logging does not work.

I assumed it was to do with threading so I enabled threading but still see the same.

I am using Ubuntu 13.04 raring and version 3.5.3 of syslog-ng OSE.

Anyone else seen this problem?

Thanks Pete

Thanks for the reply Tom. The relevant sections of the syslog-ng.conf file are below. I have put on both the destination and log for each table that I want data in. At the moment, this is a test so the parsers are the same but I am trying to split out the traffic as the parsers will be different.

What I find is that if I start syslog-ng, sometimes I get data being sent to one of the database tables but not the other, or neither gets data sent. I've run a SQL profile and the insert statement is not seen so its not a SQL issue.

Other things that may have an effect, the syslog-ng server is running on Hyper-V but I've allocated 4 logical CPU's to it, but I'm thinking that if each SQL destination uses a seperate thread, Ubuntu might not be handling virtualisation and so not presenting the CPUs to the app.

Your thoughts on that would be appreciated.

Relevant sections of the .conf file below:

options { threaded(yes);};

source s_net { udp(ip(x.x.x.x) port(514) flags("syslog-protocol", "threaded")); };

destination d_mssql {
sql(type(mssql) host("x.x.x.x") port (1433) 
username("******") password("********") database("syslog-ng") 
table ("BMTHFWTRAFFICAccepted${R_DAY}${R_MONTH}${R_YEAR}") 
columns ("time varchar(16)", "devname varchar(50)", "device_id varchar(50", 
"log_id varchar(16)", "type varchar(16)", "subtype varchar(16)", "pri varchar(16)", 
"vd varchar(16)", "src varchar(16)", "src_port varchar(16)", "src_int varchar(16)", 
"dst varcar(16)", "dst_port varchar(16)", "dst_int varchar(16)", "sn varchar(16)", 
"statuc varchar(16)", "policyid varchar(16)", "dst_country varchar(255)", 
"src_country varchar(255)", "dir_disp varchar(16)", "tran_disp varchar(16)", 
"tran_ip varchar(16)", "tran_port varchar(16)", "service varchar(16)", "proto varchar(16)", 
"duration varchar(16)", "sent varchar(16)", "rcvd varchar(16)", "sent_pkt varchar(16)", 
"rcvd_pkt varchar(16)" 
values ("${FORTINET.time}", "${FORTINET.time}", "${FORTINET.devname}", "${FORTINET.device_id}", 
"${FORTINET.log_id}", "${FORTINET.type}", "${FORTINET.subtype}", "${FORTINET.pri}", 
"${FORTINET.vd}", "${FORTINET.src}", "${FORTINET.src_port}", "${FORTINET.src_int}", 
"${FORTINET.dst}", "${FORTINET.dst_port}", "${FORTINET.dst_int}", "${FORTINET.sn}", 
"${FORTINET.status}", "${FORTINET.policyid}", "${FORTINET.dst_country}", "${FORTINET.src_country}", 
"${FORTINET.dir_disp}", "${FORTINET.tran_disp}", "${FORTINET.tran_ip}", "${FORTINET.tran_port}", 
"${FORTINET.service}", "${FORTINET.proto}", "${FORTINET.duration}", "${FORTINET.sent}", 
"${FORTINET.rcvd}", "${FORTINET.sent_pkt}", "${FORTINET.rcvd_pkt}"));
};

destination d_mssql2 {
sql(type(mssql) host("x.x.x.x") port (1433) 
username("******") password("********") database("syslog-ng") 
table ("BMTHFWTRAFFICAccepted${R_DAY}${R_MONTH}${R_YEAR}") 
columns ("time varchar(16)", "devname varchar(50)", "device_id varchar(50", 
"log_id varchar(16)", "type varchar(16)", "subtype varchar(16)", "pri varchar(16)", 
"vd varchar(16)", "src varchar(16)", "src_port varchar(16)", "src_int varchar(16)", 
"dst varcar(16)", "dst_port varchar(16)", "dst_int varchar(16)", "sn varchar(16)", 
"statuc varchar(16)", "policyid varchar(16)", "dst_country varchar(255)", 
"src_country varchar(255)", "dir_disp varchar(16)", "tran_disp varchar(16)", 
"tran_ip varchar(16)", "tran_port varchar(16)", "service varchar(16)", "proto varchar(16)", 
"duration varchar(16)", "sent varchar(16)", "rcvd varchar(16)", "sent_pkt varchar(16)", 
"rcvd_pkt varchar(16)" 
values ("${FORTINET.time}", "${FORTINET.time}", "${FORTINET.devname}", "${FORTINET.device_id}", 
"${FORTINET.log_id}", "${FORTINET.type}", "${FORTINET.subtype}", "${FORTINET.pri}", 
"${FORTINET.vd}", "${FORTINET.src}", "${FORTINET.src_port}", "${FORTINET.src_int}", 
"${FORTINET.dst}", "${FORTINET.dst_port}", "${FORTINET.dst_int}", "${FORTINET.sn}", 
"${FORTINET.status}", "${FORTINET.policyid}", "${FORTINET.dst_country}", "${FORTINET.src_country}", 
"${FORTINET.dir_disp}", "${FORTINET.tran_disp}", "${FORTINET.tran_ip}", "${FORTINET.tran_port}", 
"${FORTINET.service}", "${FORTINET.proto}", "${FORTINET.duration}", "${FORTINET.sent}", 
"${FORTINET.rcvd}", "${FORTINET.sent_pkt}", "${FORTINET.rcvd_pkt}"));
};

filter f_fortinetaccept { match("accept" value("FORTINET.status") type("string")); };
filter f_fortinetreserverd { match("Reserved" value("FORTINET.src_country") type("string")); };


parser p_fortinetaccept {
csv-parser(columns("FORTINET.timecol", 
"FORTINET.time", "FORTINET.devnamecol", "FORTINET.devname", 
"FORTINET.device_idcol", "FORTINET.device_id", "FORTINET.log_idcol", "FORTINET.log_id", 
"FORTINET.typecol", "FORTINET.type", "FORTINET.subtypecol", "FORTINET.subtype", "FORTINET.pricol", 
"FORTINET.pri", "FORTINET.vdcol", "FORTINET.vd", "FORTINET.srccol", "FORTINET.src", 
"FORTINET.src_protcol", "FORTINET.src_prot", "FORTINET.src_intcol", "FORTINET.src_int", 
"FORTINET.dstcol", "FORTINET.dst", "FORTINET.dst_portcol", "FORTINET.dst_port", 
"FORTINET.dst_intcol", "FORTINET.dst_int", "FORTINET.sncol", "FORTINET.sn", 
"FORTINET.statuscol", "FORTINET.status", "FORTINET.policyidcol", "FORTINET.policyid", 
"FORTINET.dst_countrycol", "FORTINET.dst_country", "FORTINET.src_countrycol", 
"FORTINET.src_country", "FORTINET.dir_dispcol", "FORTINET.dir_disp", 
"FORTINET.tran_dispcol", "FORTINET.tran_disp", "FORTINET.tran_ipcol", "FORTINET.tran_ip", 
"FORTINET.tran_portcol", "FORTINET.tran_port", "FORTINET.servicecol", "FORTINET.service", 
"FORTINET.protocol", "FORTINET.proto", "FORTINET.durationcol", "FORTINET.duration", 
"FORTINET.sentcol", "FORTINET.sent", "FORTINET.rcvdcol", "FORTINET.rcvd", 
"FORTINET.sentpktcol", "FORTINET.sent_pkt", "FORTINET.rcvd_pktcol", "FORTINET.rcvd_pkt")
flags(escape-double-char,strip-whitespace)
delimiters("= ")
quote-pairs('""'));
};

log { source(s_net); parser(p_fortinetaccept); filter(f_fortinetaccept); destination(d_mssql);  };

log { source(s_net); parser(p_fortinetaccept); filter(f_fortinetreserved); destination(d_mssql2);  };
  • Can you post your syslog-ng.conf? – Tom Damon Jan 24 '14 at 18:08
0

I'll go ahead and try to answer without seeing your conf file. When you're creating a new destination, you need to add the destination and a log. Here's an example from a blog post I wrote:

destination d_tls {
    tcp("your.logzilla.server" port(1999)
    tls( ca_dir("/etc/syslog-ng/ssl/")) );
};

log {
    source(s_src);
    destination(d_tls);
};

My guess would be that you're missing the log section tying the source and destination together.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.