The syslog-ng Administrator Guide

Product Planning and Documentation Department

The information in this documentation is subject to change without notice and describes only the product defined in the introduction of this documentation. This documentation is intended for the use of BalaBit's customers only for the purposes of the agreement under which the documentation is submitted. No part of the documentation may be reproduced or transmitted in any form or means without the prior written permission of BalaBit, except for making the latest version of the documentation available electronically in its entirety, without any modification or change, and keeping all copyright and other notices intact. The latest version is always available at http://www.balabit.com/support/documentation.

The documentation has been prepared to be used by professional and properly trained personnel, and the customer assumes full responsibility when using it. BalaBit welcomes customer comments as part of the process of continuous development and improvement of the documentation.

The information or statements given in this documentation concerning the suitability, capacity, or performance of the mentioned hardware or software products cannot be considered binding but shall be defined in the agreement made between BalaBit and the customer. However, BalaBit has made all reasonable efforts to ensure that the instructions contained in the documentation are adequate and free of material errors and omissions. BalaBit will, if necessary, explain issues which may not be covered by the documentation.

BalaBit's liability for any errors in the documentation is limited to the documentary correction of errors. BALABIT WILL NOT BE RESPONSIBLE IN ANY EVENT FOR ERRORS IN THIS DOCUMENTATION OR FOR ANY DAMAGES, INCIDENTAL OR CONSEQUENTIAL (INCLUDING MONETARY LOSSES), that might arise from the use of this documentation or the information in it.

This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/). This product includes cryptographic software written by Eric Young (eay@cryptsoft.com)

This documentation and the product it describes are considered protected by copyright according to the applicable laws.

The syslog-ng™ name and the syslog-ng™ logo are registered trademarks of BalaBit.

The BalaBit™ name and the BalaBit™ logo are registered trademarks of BalaBit.

Linux™ is a registered trademark of Linus Torvalds.

Debian™ is a registered trademark of Software in the Public Interest Inc.

Windows™ 95, 98, ME, 2000, XP, and 2003 Server are registered trademarks of Microsoft Corporation.

MySQL™ is a registered trademark of MySQL AB in the United States, the European Union and other countries.

Oracle™, JD Edwards™, PeopleSoft™, and Siebel™ are registered trademarks of Oracle Corporation and/or its affiliates.

Red Hat™, Inc., Red HatEnterprise Linux™ and Red HatLinux™ are trademarks of Red Hat, Inc.

SUSE™ is a trademark of SUSE AG, a Novell business.

Solaris™ is a registered trademark of Sun Microsystems, Inc.

AIX™, AIX 5L™, AS/400™, BladeCenter™, eServer™, IBM™, the IBM™ logo, IBM System i™, IBM System i5™, IBM System x™, iSeries™, i5/OS™, Netfinity™, NetServer™, OpenPower™, OS/400™, PartnerWorld™, POWER™, ServerGuide™, ServerProven™, and xSeries™ are trademarks or registered trademarks of International Business Machines.

Alliance Log Agent for System i™ is a registered trademark of Patrick Townsend & Associates, Inc.

All other product names mentioned herein are the trademarks of their respective owners.

All rights reserved.

DISCLAIMER

BalaBit is not responsible for any third-party Web sites mentioned in this document. BalaBit does not endorse and is not responsible or liable for any content, advertising, products, or other material on or available from such sites or resources. BalaBit will not be responsible or liable for any damage or loss caused or alleged to be caused by or in connection with use of or reliance on any such content, goods, or services that are available on or through any such sites or resources.

April 11, 2008

Revision History
Revision 1.0.20 April 11, 2008
Added documentation about the installing syslog-ng on FreeBSD.
Revision 1.0.19 April 1, 2008
Added documentation about the new sql driver that supports MSSQL databases, and updated the Solaris 8-9 and Solaris 10 installation instructions.
Revision 1.0.18 March 20, 2008
Updated for syslog-ng Agent for Windows 2.1.5.
Revision 1.0.17 February 29, 2008
Added documentation about the syslog-ng Agent for IBM System i application, and about compiling syslog-ng from source.
Revision 1.0.16 January 17, 2008
Corrections in the description of the program() destination.
Revision 1.0.15 January 8, 2008
Updated for syslog-ng Open Source Edition 2.0.7
Revision 1.0.14 December 19, 2007
Added a section on log statistics and on methods to avoid losing messages. Options in Chapter 5 and drivers and options in Chapter 8 are in alphabetical order.
Revision 1.0.13 November 28, 2007
Updated Chapter 5 for syslog-ng Agent for Windows version 2.1.4.
Revision 1.0.12 November 14, 2007
The appendix includes the syslog-ng.conf manual page. Corrections in the flow-control section. Updated Chapter 5 for syslog-ng Agent for Windows version 2.1.3. Added information on logging to Oracle databases.
Revision 1.0.11 September 14, 2007
Documented the installation of syslog-ng PE on Solaris 10, minor corrections and improvements.
Revision 1.0.10 August 17, 2007
Documented the installation of syslog-ng PE on HP-UX and corrected typos in various examples.
Revision 1.0.9 August 6, 2007
Corrected the templates example on page 20.
Revision 1.0.8 August 3, 2007
Corrected a typo in the SQL example on page 67.
Revision 1.0.7 July 26, 2007
Updated for syslog-ng Premium Edition 2.1.5b and improved the Installing syslog-ng chapter.
Revision 1.0.6 July 10, 2007
Updated for syslog-ng Premium Edition 2.1.5a
Revision 1.0.5 June 28, 2007
Updated for syslog-ng Premium Edition 2.1.5 and syslog-ng Agent for Windows 2.1.1.
Revision 1.0.4 May 18, 2007
Documented the syslog-ng agent for Microsoft Windows application available in syslog-ng Premium Edition.
Revision 1.0.3 May 16, 2007
Documented case-insensitive regular expressions.
Revision 1.0.2 May 11, 2007
Updated for syslog-ng Open Source Edition 2.0.3 and syslog-ng Premium Edition 2.1.4
Revision 1.0.1 May 2, 2007
Minor corrections
Revision 1.0 April 13, 2007
Initial release

Abstract

This guide is the primary documentation of syslog-ng.



© 2007 BalaBit IT Security
Please send your comments or documentation bugs to: documentation@balabit.com