<div dir="ltr">Ultimately I want to have syslog-ng running with ipvsadm so I send logs from legacy system to my new k8s graylog that is running in production. So I need to setup syslog-ng to talk to graylog. </div><br><div class="gmail_quote"><div dir="ltr">On Thu, Oct 11, 2018 at 9:22 AM Szemere, László <<a href="mailto:laszlo.szemere@oneidentity.com">laszlo.szemere@oneidentity.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div dir="ltr">Dear Rodney Bizzell,</div><div> sorry for the misunderstanding, now it is clear for us, that you anonymised your config. just a note: it is preferable to use different masking addresses for different original IP's. i.e.: I can not check this source: "<span style="font-size:12.8px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">udp(ip(0.0.0.0) port(514));"</span></div><div><span style="font-size:12.8px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></div><div><span style="font-size:12.8px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"> Back to your problem. It is not clear for me what do you mean by "once<span style="text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><span> </span>changes are made syslog-ng is failing"</span></span></div><div><span style="font-size:12.8px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><span style="text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"> It is not starting up at all? Or just not forwarding logs to your Graylog server?</span></span></div><div><span style="font-size:12.8px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><span style="text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></span></div><div><span style="font-size:12.8px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><span style="text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">Br,</span></span></div><div><span style="font-size:12.8px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><span style="text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">Laci</span></span></div><div><span style="font-size:12.8px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><span style="text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></span></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Oct 11, 2018 at 2:03 PM, Rodney Bizzell <span dir="ltr"><<a href="mailto:hardworker30@gmail.com" target="_blank">hardworker30@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I just changed my information on my graylog box 0.0.0.0 isn't what I had in there. The way the config is did that look syntax correctly</div><div class="m_-2333126433893035600HOEnZb"><div class="m_-2333126433893035600h5"><div dir="auto"></div><br><div class="gmail_quote"><div dir="ltr">On Thu, Oct 11, 2018, 12:26 AM Péter, Kókai <<a href="mailto:peter.kokai@oneidentity.com" target="_blank">peter.kokai@oneidentity.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello,<div><br></div><div>If you starg syslogng with -Fe it might give you a clue. </div><div>Also 0.0.0.0 is a no - routable address, so it is fine for source, not so much for destination, you should check out on which ip graylog listening, if it is 0.0.0.0 you could use the loopback device 120.0.0.1 (or other valid ip, but lo would be preferable). </div><div><br></div><div>--</div><div>Kokan<br><br><div class="gmail_quote"><div dir="ltr">On Wed, 10 Oct 2018, 10:57 pm Rodney Bizzell, <<a href="mailto:hardworker30@gmail.com" rel="noreferrer" target="_blank">hardworker30@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div dir="ltr">I have install syslog-ng 3.5 and I am configuring it to send all logs to Graylog but once changes are made syslog-ng is failing. I change the address of graylog server to 0.0.0.0<div><br></div><div><br></div><div><div>@version:3.5</div><div>@include "scl.conf"</div><div><br></div><div># syslog-ng configuration file.</div><div>#</div><div># This should behave pretty much like the original syslog on RedHat. But</div><div># it could be configured a lot smarter.</div><div>#</div><div># See syslog-ng(8) and syslog-ng.conf(5) for more information.</div><div>#</div><div># Note: it also sources additional configuration files (*.conf)</div><div># located in /etc/syslog-ng/conf.d/</div><div><br></div><div>options {</div><div> flush_lines (0);</div><div> time_reopen (10);</div><div> log_fifo_size (1000);</div><div> chain_hostnames (off);</div><div> use_dns (no);</div><div> use_fqdn (no);</div><div> create_dirs (no);</div><div> keep_hostname (yes);</div><div>};</div><div><br></div><div>source s_sys {</div><div> system();</div><div> internal();</div><div> udp(ip(0.0.0.0) port(514));</div><div>};</div><div><br></div><div>source s_net {</div><div>udp(ip(0.0.0.0) port(514));</div><div>tcp(ip(0.0.0.0) port(514) max-connections(256));</div><div>};</div><div><br></div><div>destination d_cons { file("/dev/console"); };</div><div>destination d_mesg { file("/var/log/messages"); };</div><div>destination d_auth { file("/var/log/secure"); };</div><div>destination d_mail { file("/var/log/maillog" flush_lines(10)); };</div><div>destination d_spol { file("/var/log/spooler"); };</div><div>destination d_boot { file("/var/log/boot.log"); };</div><div>destination d_cron { file("/var/log/cron"); };</div><div>destination d_kern { file("/var/log/kern"); };</div><div>destination d_mlal { usertty("*"); };</div><div><br></div><div><br></div><div>destination d_graylog {</div><div>tcp("0.0.0.0"</div><div>port (12201)</div><div>spoof_sources(yes)</div><div>);</div><div>};</div><div><br></div><div><br></div><div>filter f_kernel { facility(kern); };</div><div>filter f_default { level(info..emerg) and</div><div> not (facility(mail)</div><div> or facility(authpriv) </div><div> or facility(cron)); };</div><div>filter f_auth { facility(authpriv); };</div><div>filter f_mail { facility(mail); };</div><div>filter f_emergency { level(emerg); };</div><div>filter f_news { facility(uucp) or</div><div> (facility(news) </div><div> and level(crit..emerg)); };</div><div>filter f_boot { facility(local7); };</div><div>filter f_cron { facility(cron); };</div><div><br></div><div>#log { source(s_sys); filter(f_kernel); destination(d_cons); };</div><div>log { source(s_sys); filter(f_kernel); destination(d_kern); };</div><div>log { source(s_sys); filter(f_default); destination(d_mesg); };</div><div>log { source(s_sys); filter(f_auth); destination(d_auth); };</div><div>log { source(s_sys); filter(f_mail); destination(d_mail); };</div><div>log { source(s_sys); filter(f_emergency); destination(d_mlal); };</div><div>log { source(s_sys); filter(f_news); destination(d_spol); };</div><div>log { source(s_sys); filter(f_boot); destination(d_boot); };</div><div>log { source(s_sys); filter(f_cron); destination(d_cron); };</div><div><br></div><div><br></div><div><br></div><div>log { source(s_net); destination(d_graylog); };</div><div>log { source(s_sys); filter(f_default); destination(d_graylog);};</div><div><br></div><div># Source additional configuration files (.conf extension only)</div><div>@include "/etc/syslog-ng/conf.d/*.conf"</div><div><br></div><div><br></div><div># vim:ft=syslog-ng:ai:si:ts=4:sw=4:et:</div></div><div><br></div></div></div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div></div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>
</div></div><br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>