<div dir="ltr"><div><div>Hi,<br><br></div>yes, I need spoof_source to be enabled for source identification ...<br><br></div>Denis<br></div><div class="gmail_extra"><br><div class="gmail_quote">2016-09-28 16:44 GMT+02:00 Szalai, Attila <span dir="ltr"><<a href="mailto:Attila.Szalai@morganstanley.com" target="_blank">Attila.Szalai@morganstanley.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div link="blue" vlink="purple" lang="EN-US">
<p>
</p><div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Just a quick note.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">The warning message about the binding issue caused by the spoof_source option. Is that option necessary?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> <a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.<wbr>balabit.hu</a> [mailto:<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@<wbr>lists.balabit.hu</a>]
<b>On Behalf Of </b>Denis Dolinský<br>
<b>Sent:</b> Wednesday, September 28, 2016 3:47 PM</span></p><div><div class="h5"><br>
<b>To:</b> Syslog-ng users' and developers' mailing list<br>
<b>Subject:</b> Re: [syslog-ng] syslog-ng forwarding and processing issue<u></u><u></u></div></div><p></p>
</div>
</div><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">hi guys,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">this is stats:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">destination;d_net_udp514;;a;<wbr>processed;13<br>
source;s_net_udp514;;a;<wbr>processed;3<br>
dst.syslog;d_net_udp514#0;udp,<wbr>192.168.3.1:514;a;dropped;0<br>
dst.syslog;d_net_udp514#0;udp,<wbr>192.168.3.1:514;a;processed;10<br>
dst.syslog;d_net_udp514#0;udp,<wbr>192.168.3.1:514;a;stored;0<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">from debug:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Incoming log entry; source='s_net_udp514#0', line='<78> remote_server /usr/sbin/cron[24934]: <br>
Can't bind hostname for the IP address, therefore using IP address as hostname; IP address='192.168.2.1'<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Do you see anything what I do not do ?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Thanks.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Denis<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">2016-09-28 14:02 GMT+02:00 Szalai, Attila <<a href="mailto:Attila.Szalai@morganstanley.com" target="_blank">Attila.Szalai@morganstanley.<wbr>com</a>>:<u></u><u></u></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Hi,</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">In case of udp, the syslog source should handle receiving logs with old and the new version too.
(But that is more an exception than the rule, so matching the receiver and the sender is a good idea generaly.)</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Before anything else I would check if the logs arrive to the anonymizer host or not. The statistics
can help on this. Also, if there are parsing issue, the syslog-ng would tell this through its log.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">After that starting the syslog-ng with enabled debug logs can also help on discovering what happening
with the received log.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<div style="border:none;border-left:solid windowtext 1.5pt;padding:0in 0in 0in 4.0pt;border-color:currentColor currentColor currentColor blue">
<div>
<div style="border:none;border-top:solid windowtext 1.0pt;padding:3.0pt 0in 0in 0in;border-color:currentColor currentColor">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">
<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.<wbr>balabit.hu</a> [mailto:<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@<wbr>lists.balabit.hu</a>]
<b>On Behalf Of </b>Fekete, Róbert<br>
<b>Sent:</b> Wednesday, September 28, 2016 1:47 PM<br>
<b>To:</b> Syslog-ng users' and developers' mailing list<br>
<b>Subject:</b> Re: [syslog-ng] syslog-ng forwarding and processing issue</span><u></u><u></u></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<p class="MsoNormal">Hi, <u></u><u></u></p>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">The destination on your remote server and the source on the pseudomizer host do not match: the first one uses the udp() driver (RFC3164 protocol), while the second uses the syslog()
driver (RFC5424) protocol. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Change the destination driver to syslog() on the remote server. (For more possibilities, see
<a href="https://www.balabit.com/documents/syslog-ng-pe-latest-guides/en/syslog-ng-pe-guide-admin/html/concepts-things-to-consider.html" target="_blank">
https://www.balabit.com/<wbr>documents/syslog-ng-pe-latest-<wbr>guides/en/syslog-ng-pe-guide-<wbr>admin/html/concepts-things-to-<wbr>consider.html</a> )<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">HTH<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Robert<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<p class="MsoNormal">On Wed, Sep 28, 2016 at 1:17 PM, Denis Dolinský <<a href="mailto:denis.dolinsky@gmail.com" target="_blank">denis.dolinsky@gmail.com</a>> wrote:<u></u><u></u></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Hi guys,<u></u><u></u></p>
</div>
<p class="MsoNormal">I have following setup in place:<u></u><u></u></p>
</div>
<p class="MsoNormal">remote server - 192.168.1.10<u></u><u></u></p>
</div>
<p class="MsoNormal">pseudomizer - syslog-ng PE in client mode - 192.168.2.10<u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">SIEM - 192.168.3.10<u></u><u></u></p>
</div>
<p class="MsoNormal">So I am sending syslog logs from remote server to pseudomizer:<u></u><u></u></p>
</div>
<p class="MsoNormal">source src { internal()};<u></u><u></u></p>
</div>
<p class="MsoNormal">destination dst { udp ("192.168.2.10) port (514);};<u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">log { source(src); destination (dst);<u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">this is very old config from syslog v4<u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Then on pseudomizer - syslog-ng LTS 6.0.1 PE, I am collecting the logs, processing them - removing private data, putting pseudonyms instead and forwarding them to SIEM.<br>
<br>
source s_net_udp514 {<br>
syslog(<br>
ip(192.168.2.10)<br>
ip-protocol(4)<br>
transport("udp")<br>
so_rcvbuf(2097152)<br>
);<br>
};<br>
<br>
source src {<br>
internal();<br>
unix-dgram("/dev/log");<br>
system ();<br>
};<br>
<br>
destination d_net_udp514 {<br>
syslog ( <br>
"192.168.3.10"<br>
port(514) <br>
transport(udp)<br>
spoof_source(yes) <br>
mark_mode(periodical));};<br>
rewrite r_rewrite {<br>
subst("admin", "pseudonym000001", value("MESSAGE"), flags("global"));<br>
<br>
log {<br>
source(s_net_udp514); source (src);<br>
rewrite(r_rewrite); # do the pseudomizing<br>
destination(d_net_udp514);<br>
};<u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">On SIEM device, I can see only pseudomizer internal logs (src), not processed logs from remote server.<u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Any advice ?<u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Many thanks.<u></u><u></u></p>
</div>
<p class="MsoNormal"><span style="color:#888888">Denis</span><u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">
https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">
http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><u></u><u></u></p>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><u></u> <u></u></p>
<div class="MsoNormal" style="text-align:center" align="center">
<hr align="center" size="2" width="100%">
</div>
<p class="MsoNormal"><br>
<span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:gray">NOTICE: Morgan Stanley is not acting as a municipal advisor and the opinions or views contained herein are not intended to be, and do not constitute, advice within the meaning of Section
975 of the Dodd-Frank Wall Street Reform and Consumer Protection Act. If you have received this communication in error, please destroy all electronic and paper copies and notify the sender immediately. Mistransmission is not intended to waive confidentiality
or privilege. Morgan Stanley reserves the right, to the extent permitted under applicable law, to monitor electronic communications. This message is subject to terms available at the following link:
<a href="http://www.morganstanley.com/disclaimers" target="_blank">http://www.morganstanley.com/<wbr>disclaimers</a> If you cannot access these links, please notify us by reply message and we will send the contents to you. By communicating with Morgan Stanley you
consent to the foregoing and to the voice recording of conversations with personnel of Morgan Stanley.</span><u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">
https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">
http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<u></u><u></u></p>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<br>
-- <u></u><u></u></p>
<div>
<p class="MsoNormal">Ing. Denis Dolinský<br>
<a href="mailto:denis.dolinsky@gmail.com" target="_blank">denis.dolinsky@gmail.com</a><br>
private cell: <u><a href="tel:%2B421%20907%20530711" value="+421907530711" target="_blank">+421 907 530711</a></u><u></u><u></u></p>
</div>
</div>
</div></div></div>
</div><div><div class="h5">
<br><br>
<hr>
<br><span style="FONT-SIZE:7.5pt;FONT-FAMILY:Arial;COLOR:#808080">NOTICE:
Morgan Stanley is not acting as a municipal advisor and the opinions or views
contained herein are not intended to be, and do not constitute, advice within
the meaning of Section 975 of the Dodd-Frank Wall Street Reform and Consumer
Protection Act. If you have received this communication in error, please destroy
all electronic and paper copies and notify the sender immediately.
Mistransmission is not intended to waive confidentiality or privilege. Morgan
Stanley reserves the right, to the extent permitted under applicable law, to
monitor electronic communications. This message is subject to terms available at
the following link: <a href="http://www.morganstanley.com/disclaimers" target="_blank">http://www.morganstanley.com/<wbr>disclaimers</a> If you cannot
access these links, please notify us by reply message and we will send the
contents to you. By communicating with Morgan Stanley you consent to the
foregoing and to the voice recording of conversations with personnel of Morgan
Stanley.</span><br>
<p></p>
<p></p>
<p></p>
<p></p></div></div><p></p></div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature" data-smartmail="gmail_signature">Ing. Denis Dolinský<br>
<a href="mailto:denis.dolinsky@gmail.com" target="_blank">denis.dolinsky@gmail.com</a><br>
private cell: <u>+421 907 530711</u></div>
</div>