<div dir="ltr"><div>Hi Laci,</div><div><br></div><div>Elaaticsearch is not limited by any means regarding indexable traffic.</div><div>Should you need any real life example then have a look at my blog: <a href="https://balagetech.com/tag/elasticsearch/">https://balagetech.com/tag/elasticsearch/</a></div><div>This page will show you the feature differences between different licenses: <a href="https://www.elastic.co/subscriptions">https://www.elastic.co/subscriptions</a></div><div>Note that the free version does not have AD integration. (Maybe you could put a WAF before Kibana, or handling the AD integration with Apache + LDAP)<br></div><div><br></div><div>ps: I am not paid by anyone to suggest Elasticsearch. It is simply a tool I use.</div><div><br></div><div>Regards,<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr"><<a href="mailto:syslog-ng-request@lists.balabit.hu">syslog-ng-request@lists.balabit.hu</a>> ezt írta (időpont: 2019. szept. 17., K, 12:57):<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Send syslog-ng mailing list submissions to<br>
<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:syslog-ng-request@lists.balabit.hu" target="_blank">syslog-ng-request@lists.balabit.hu</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:syslog-ng-owner@lists.balabit.hu" target="_blank">syslog-ng-owner@lists.balabit.hu</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of syslog-ng digest..."<br>
Today's Topics:<br>
<br>
1. Re: a bit [offtopic] but may not. syslog search solution for<br>
free (Pal, Laszlo)<br>
2. Re: a bit [offtopic] but may not. syslog search solution for<br>
free (Fabien Wernli)<br>
3. Re: Enable SNI (Server Name Identification) in TLS<br>
connection (Attila Szakacs (aszakacs))<br>
<br><br><br>---------- Forwarded message ----------<br>From: "Pal, Laszlo" <<a href="mailto:vlad@vlad.hu" target="_blank">vlad@vlad.hu</a>><br>To: "Syslog-ng users' and developers' mailing list" <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>><br>Cc: <br>Bcc: <br>Date: Tue, 17 Sep 2019 10:55:04 +0200<br>Subject: Re: [syslog-ng] a bit [offtopic] but may not. syslog search solution for free<br><div dir="ltr">Hi,<div><br></div><div>Thanks for the answers. So, I definitely need an onprem solution and yes, Elastic is a good idea, however based on my previous research even the OS version is restricted to some amount of daily log. Maybe I'm wrong and in this case I may give a try again. At this point I don't know how much logs will I ingest daily but because it is more than 30K devices including core routers, firewalls and all sort of servers, I don't think any traffic limited solution will be sufficient.</div><div><br></div><div>Graylog is a very good solution which I already tested but the "free" version is limited to something like 50 Mbyet per day.</div><div><br></div><div>I'll check this onion thingy, thank you Peter for the heads up</div><div><br></div><div>Vlad</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Sep 17, 2019 at 10:01 AM Peter Czanik (pczanik) <<a href="mailto:Peter.Czanik@oneidentity.com" target="_blank">Peter.Czanik@oneidentity.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Hi,</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
These are not my personal experiences, but talking to thousands of syslog-ng users at different events:</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<ul>
<li>Many are happy with grep and hate anything with a GUI. It works relatively well, if you have many small log files (separated by date, host, application, etc.), but if you have lots of logs, you can't avoid message parsing and indexing for efficient search.</li><li>Splunk is one of the most popular destinations with syslog-ng. OSE users tend to use the free version, which can index up to 500MB of logs a day.</li><li>Elasticsearch is the other most popular destination. With the latest version most of the security features are included in the open source version for free, so it does not need 3rd party extensions or a commercial license any more.</li><li>Graylog is also getting popular among syslog-ng users. We can feed it with structured log messages in multiple ways: either GELF or JSON. Free, open source, but commercial extensions and support are available.<br>
</li><li>I did not test recently, but Security Onion is a nice security analytic platform which also includes log management with analysis, dashboards, etc. It's free, open source, but commercial support is available.<br>
</li><li>Logzilla is focused on Cisco network devices and automation but also works for generic log management. It is commercial software, but a free version is also available.</li></ul>
<div>Of course any time indexing and GUI are involved you need some extra hardware compared syslog-ng, so definitely more expensive even if you go with the free versions.</div>
<div><br>
</div>
<div>Bye,<br>
</div>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div id="gmail-m_-3176808995529774156gmail-m_-441707905041977884Signature">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<div>
<div>
<div dir="ltr">Peter Czanik (CzP) <<a href="mailto:peter.czanik@oneidentity.com" target="_blank">peter.czanik@oneidentity.com</a>><br>
Balabit (a OneIdentity company) / syslog-ng upstream<br>
<a href="https://syslog-ng.com/community/" target="_blank">https://syslog-ng.com/community/</a><br>
<a href="https://twitter.com/PCzanik" target="_blank">https://twitter.com/PCzanik</a></div>
</div>
</div>
<br>
</div>
</div>
<div id="gmail-m_-3176808995529774156gmail-m_-441707905041977884appendonsend"></div>
<hr style="display:inline-block;width:98%">
<div id="gmail-m_-3176808995529774156gmail-m_-441707905041977884divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>> on behalf of Pal, Laszlo <<a href="mailto:vlad@vlad.hu" target="_blank">vlad@vlad.hu</a>><br>
<b>Sent:</b> Tuesday, September 17, 2019 9:16 AM<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>><br>
<b>Subject:</b> [syslog-ng] a bit [offtopic] but may not. syslog search solution for free</font>
<div> </div>
</div>
<div>
<div style="background-color:rgb(255,235,156);width:100%;border:1pt solid rgb(156,101,0);padding:2pt;font-size:10pt;line-height:12pt;font-family:Calibri;color:black;text-align:left">
<span style="color:rgb(156,101,0);font-weight:bold">CAUTION:</span> This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.</div>
<br>
<div>
<div dir="ltr">Hi,
<div><br>
</div>
<div>Our new central syslog collect&store system are almost complete and finally it is based on Syslog-ng OSE. The only issue I want to solve, is how to present those logs to the users. Originally I thought it would be enough if they will get the directories
as NFS exports and they can use their favourite grep to search files, but I thought maybe I can implement some more user friendly solution.</div>
<div><br>
</div>
<div>In the planning phase of the project, I've tested various solutions including Graylog, ELK and of course I'm aware of the beauty of SSB :) , but all of these solutions are too expensive for this project.</div>
<div><br>
</div>
<div>Then I thought maybe if I forward the logs to some database (SQL or noSQL) I can try to find some very simple frontend for that DB provides a simple search interface for those logs. Nothing fancy is required, but AD auth should be an option.</div>
<div><br>
</div>
<div>I'm sure I'm not the only one facing this issue, so I hope someone in the community can share some previous experience on this</div>
<div><br>
</div>
<div>Thanks</div>
<div>Vlad</div>
<div> </div>
<div><br>
</div>
<div><br>
</div>
</div>
</div>
</div>
</div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>
<br><br><br>---------- Forwarded message ----------<br>From: Fabien Wernli <<a href="mailto:wernli@in2p3.fr" target="_blank">wernli@in2p3.fr</a>><br>To: "Syslog-ng users' and developers' mailing list" <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>><br>Cc: <br>Bcc: <br>Date: Tue, 17 Sep 2019 11:05:18 +0200<br>Subject: Re: [syslog-ng] a bit [offtopic] but may not. syslog search solution for free<br>On Tue, Sep 17, 2019 at 10:55:04AM +0200, Pal, Laszlo wrote:<br>
> Thanks for the answers. So, I definitely need an onprem solution and yes,<br>
> Elastic is a good idea, however based on my previous research even the OS<br>
> version is restricted to some amount of daily log. Maybe I'm wrong and in<br>
<br>
It's not. By all means grab the -oss packages, they don't contain any<br>
non-free code.<br>
<br>
<br>
<br><br><br>---------- Forwarded message ----------<br>From: "Attila Szakacs (aszakacs)" <<a href="mailto:Attila.Szakacs@oneidentity.com" target="_blank">Attila.Szakacs@oneidentity.com</a>><br>To: "<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>" <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>><br>Cc: <br>Bcc: <br>Date: Tue, 17 Sep 2019 10:57:14 +0000<br>Subject: Re: [syslog-ng] Enable SNI (Server Name Identification) in TLS connection<br>
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
Hi Raghu,</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
Currently we are not sending SNI extension in the Client Hello message.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
However, I made a PR to implement this: <a href="https://github.com/balabit/syslog-ng/pull/2930" target="_blank">https://github.com/balabit/syslog-ng/pull/2930</a></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
Can you build syslog-ng from source? It would be great, if you tested the PR.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
Best regards,</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
Attila</div>
<div id="gmail-m_-3176808995529774156appendonsend"></div>
<hr style="display:inline-block;width:98%">
<div id="gmail-m_-3176808995529774156divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>> on behalf of Raghunath Adhyapak <<a href="mailto:funduraghu@gmail.com" target="_blank">funduraghu@gmail.com</a>><br>
<b>Sent:</b> Tuesday, September 17, 2019 9:05 AM<br>
<b>To:</b> <a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a> <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>><br>
<b>Subject:</b> [syslog-ng] Enable SNI (Server Name Identification) in TLS connection</font>
<div> </div>
</div>
<div>
<div style="background-color:rgb(255,235,156);width:100%;border-style:solid;border-color:rgb(156,101,0);border-width:1pt;padding:2pt;font-size:10pt;line-height:12pt;font-family:"Calibri";color:black;text-align:left">
<span style="color:rgb(156,101,0);font-weight:bold">CAUTION:</span> This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.</div>
<br>
<div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">Hi,
<div><br>
</div>
<div>I am using TLS over TCP connection to forward my syslog events to a remote server.</div>
<div>My remote server uses SNI (Server Name Identification) to route connections/events to one of the available backend servers.</div>
<div><br>
</div>
<div>I observe that syslog-ng doesn't send SNI during TLS handshake.</div>
<div><br>
</div>
<div>How can I enable it?</div>
<div><br>
</div>
<div>My configuration is as follows:</div>
<div><br>
</div>
<div><span style="color:rgb(0,0,0);font-size:medium">===================================</span><br>
</div>
<div>source s_net { syslog(transport(udp) port(1514)); };<br>
</div>
<div>
<div>destination d_tcp {</div>
<div> tcp(</div>
<div> "<a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2FXX.example.net&data=02%7C01%7Cattila.szakacs%40oneidentity.com%7Cf01aaae6998d42d90aa908d73b3d6e1a%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C637043007358265020&sdata=sTv8kJpxK%2FDNONaBFcNArgPiZ8ZbBFuyIHKwfL1Yn7w%3D&reserved=0" target="_blank">XX.example.net</a>"</div>
<div> port(96)</div>
<div> tls(</div>
<div> peer-verify(required-untrusted)</div>
<div> ca_dir("/etc/syslog-ng/ssl")</div>
<div> key-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.key.pem")</div>
<div> cert-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.cert.pem")</div>
<div> )</div>
<div> );</div>
<div>};</div>
</div>
<div>
<div>log {</div>
<div> source(s_net);</div>
<div> destination(d_tcp);</div>
<div>};</div>
</div>
<div>===================================</div>
<div><br>
</div>
<div>I want syslog-ng to send <a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2FXX.example.net&data=02%7C01%7Cattila.szakacs%40oneidentity.com%7Cf01aaae6998d42d90aa908d73b3d6e1a%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C637043007358275016&sdata=ugyIt85VhK6%2FEoZVAJ%2B2gLnPfr7M5n2%2FMHqR0hcuGto%3D&reserved=0" target="_blank">
XX.example.net</a> as SNI to my remote server</div>
<div><br>
</div>
<div>Please advise</div>
<div><br>
</div>
<div>Thanks</div>
<div>Raghu</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
_______________________________________________<br>
syslog-ng maillist - <a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a><br>
<a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
</blockquote></div>