What's with this libol stuff, and which one do I need?

libol is a library written by the author of syslog-ng, Balazs Scheidler, which is used in syslog-ng. A built copy of libol needs to be present on a system when syslog-ng is built.

If I replace my syslog daemon with syslog-ng, what side effects can it have?

Glad you asked, the most common side effect is being happy with a superior syslog daemon.

I'm new to syslog-ng. Is there a way for syslog-ng and syslogd to co-exist? Our servers are managed by another group, and they don't support syslog-ng. Can you pipe all syslogd messages to syslog-ng?

Yes, syslog-ng can accept messages from stock syslogd using the udp() source.

I want to replace syslogd *and* klogd on my Linux box with syslog-ng.

Use a source line like this in your conf file to read kernel messages, too.

source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); };

Note: do not run klogd and syslog-ng fetching local kernel messages at the same time. It may cause syslog-ng to block which makes all logging local daemons unusable.

I have been trying syslog-ng and extremely happy with the power of using it. I have one question, when using the program option under destination drivers, my PERL script gets launched when I start syslog-ng, but executes once and then dies. I am using this script to page any time I see an log entry, but it only runs the first time it runs.

You can read log messages on your stdin, so instead of fetching a single line and exiting keep reading your input like this:

#!/usr/bin/perl
while (<>) {
        # send to pager
}

Is it possible to create sockets with syslog-ng similar to how you can do so with syslogd? The reason for this being that I'm running some applications chrooted, and need to open a /dev/log socket that is in that chroot-jail.

Of course you can. Just add a source:

source local { unix-stream("/dev/log"); internal(); };
source jail1 { unix-stream("/jail/dns/dev/log"); };
source jail2 { unix-stream("/jail/www/dev/log"); };

source local { 
	unix-stream("/dev/log"); 
	internal(); 
	unix-stream("/jail/dns/dev/log"); 
};

Note that postfix appears to need a log socket in it's chroot jail, or it's logging will stop when you reload syslog-ng:

source postfix { unix-stream("/var/spool/postfix/dev/log" keep-alive(yes)); };

Directories with names like "Error", "SCSI", "", are showing up in the directory that holds the syslogs for the different hosts that we monitor.

From the description it's apparent that logs are being stored in your filesystem with a macro similar to this:

destination std { file( "/var/log/$HOST/$FACILITY"); };

DNS: I want to use fully qualified domain names in my logs, I have many different hosts named ns1, or www, and don't want the logs mixed up. Also, I have a question concerning the use_dns option. Is this a global option only, or is there some way to change this per source or destination?

What is with all the "hostname" options?

When syslog-ng receives a message it tries to rewrite the hostname it contains unless keep_hostname is true. If the hostname is to be rewritten (e.g. keep_hostname is false), it checks whether chain_hostnames (or long_hostname which is an alias for chain_hostnames) is true. If chain_hostnames is true, the name of the host syslog-ng received the message from is appended to the hostname, otherwise it's replaced.

	keep_hostname(yes)	keep_hostname(no)
chain_hostname(yes)	server	server/server2
chain_hostname(no)	server	server2

I hope this makes things clear.

I archive my logs like this:

file("/var/log/HOSTS/$HOST/$YEAR/$MONTH/$DAY/$FACILITY_$HOST_$YEAR_$MONTH_$DAY" 
 owner(root) group(root) perm(0600) dir_perm(0700)  create_dirs(yes) ); 

You don't need syslog-ng to compress them, install bzip2 and run a nightly cronjob like this:

 /usr/bin/find /var/log/HOSTS ! -name "*bz2" -type f ! -path "*`/bin/date +%Y/%m/%d`*" 
  -exec /usr/bin/bzip2 {} \;

My syslog-ng.conf has

destination std { file( "/var/log/$HOST/$YEAR$MONTH/$FACILITY" create_dirs(yes)); };

Yes, you can do this using the owner(), group() and perm() options.
For example:

destination d_file { file("/var/log/$HOST/log" create_dirs(yes) 
 owner("log") group("log") perm(0600)); };

a) I have snmptrapd running so that any trap that it receives should be logged to local1. I have a filter taking anything received via local1 to a specific file:

filter snmptrap {facility(local1);};
destination snmptraps { file("/var/log/snmptraps";};

syslog defaults to 1024 byte long messages, but this value is tunable in syslog-ng 1.5 where you can set it to a higher value.

options { log_msg_size(8192); };

b) Andreas Schulze points out: "We are running snmptrapd and syslog-ng 1.5.x under Solaris 8 and observed exactly the same problem.

Our solution was, to patch snmptrapd to log its messages via a local Unix DGRAM socket and use this socket as message source for syslog-ng. This fix the problem and works pretty fine and very stable for more than one year in our environment.

Basically you're screwed on Solaris, but hopefully other implementations aren't as brain-dead.

It seems I have syslog clients with unsynchronized clocks and I have files that were created with the time macros, and their date is wrong. What I want is the files to be created with the time/date they are received.

It's an option. use_time_recvd() boolean.

options { use_time_recvd(true); };

What conf settings can I use for my syslog-ng.conf file so that messages are written to disk the instant they are received?

Add sync(0) to your config file.

options { sync(0); };

I want to run syslog-ng chrooted and as a non-root user.

Use syslog-ng 1.5.x's own -C and -u flags when starting it.

Can output from programs started by syslog-ng be captured and logged by syslog-ng?

It's on the todo list. As long as it is not implemented, you might try to redirect the program's output to a named pipe like this:

destination d_swatch { program("swatch 2> /var/run/swatch.err"); }; 
 source s_swatch { pipe("/var/run/swatch.err"); };

How much log volume can syslog-ng handle?

A search of the mailing list archives shows sites that exceed five gigabytes per day of log data. The limits to throughput in syslog-ng are similar to that of most other network applications, where network and disk I/O are the limiting factors.

How can I filter messages so that only not-already-routed lines will be routed/filtered again?

This is a catchall statement, and should catch all messages which were not accepted any of the previous statements.

log { source(src); filter(DEFAULT); destination(dst); };

I'm using syslog-ng over redirected ports inside an SSH channel and whenever I HUP syslog-ng, the SSH channel closes

syslog-ng closes TCP connections when a SIGHUP is received, but you can change this behaviour with the keep-alive option.

destination remote_tcp { tcp("loghost" port(1514) keep-alive(yes)); };

source tcp_listen { tcp(ip("10.0.0.1") port(5140) keep-alive(yes)); };

I've successfully set up syslog-ng to tunnel through stunnel. I'm having one problem though, all messages come through with a hostname of "localhost", presumably since stunnel is coming from localhost on the syslog server....

Keep the hostname as sent by the remote syslog daemon:

options { keep_hostname(yes); };