<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Just another idea that may give a clue.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
If you start syslog-ng with foreground with debug and trace leve (syslog-ng -Fevdt)l, syslog-ng may print something useful about the plugin loads. Please check if it tells something about the http module. I temporarily moved the libcurl shared libraries, for
 the sake of example, and I got this:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>[2020-03-31T07:51:19.908021] Trying to open module; module='http', filename='/home/furiel/workspace/test-syslogng/root/lib/syslog-ng/libhttp.so'<br>
</span>
<div>[2020-03-31T07:51:19.908166] Error opening plugin module; module='http', error='libcurl.so.4: cannot open shared object file: No such file or directory'</div>
<div><br>
</div>
<div>Such problem may happen, if syslog-ng is compiled with libcurl installation at nonstandard location: it is not on the load path, and LD_LIBRARY_PATH is not set, or set to a wrong path. This is probably not the case for you, because you use libcurl from
 package, though.<br>
</div>
<span></span></div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of Russell Fulton <r.fulton@auckland.ac.nz><br>
<b>Sent:</b> Monday, March 30, 2020 21:26<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br>
<b>Subject:</b> Re: [syslog-ng] [FORGED] [FORGED] errors with elasticsearch_http on 2.21 & 3.22 -- correction</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.<br>
<br>
<br>
Thanks Antal!<br>
<br>
This is truely a weird one.  I have now gone through and verified that there are no syslog-ng related packages installed on the machine but no matter which of my compiled versions I run they all behave as if the elasticsearch_http support is missing.<br>
<br>
My gut feeling is that this is nothing to do with syslog-ng as such, something has happened at the OS level.<br>
<br>
I have just used locate to find everything with syslog-ng in the path but can’t find anything that should not be there<br>
<br>
<br>
> On 30/03/2020, at 8:27 PM, Antal Nemes (anemes) <Antal.Nemes@oneidentity.com> wrote:<br>
><br>
> A quick correction. After double checking the geoip related removal stuff: it seems fine. I misread the package list. Actually, the last generated syslog-ng-mod-geoip was in 3.23.<br>
> <a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fdownload.opensuse.org%2Frepositories%2Fhome%3A%2Flaszlo_budai%3A%2Fsyslog-ng%2FxUbuntu_18.04%2Famd64%2F&amp;data=02%7C01%7Cantal.nemes%40oneidentity.com%7C5557745cf0e64ed0839608d7d4e04910%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637211932092640229&amp;sdata=Nyki%2FZEjWMUN%2FgMVWr0lrZFDcbZILqJnd4RsMXgSIRw%3D&amp;reserved=0">
https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fdownload.opensuse.org%2Frepositories%2Fhome%3A%2Flaszlo_budai%3A%2Fsyslog-ng%2FxUbuntu_18.04%2Famd64%2F&amp;data=02%7C01%7Cantal.nemes%40oneidentity.com%7C5557745cf0e64ed0839608d7d4e04910%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637211932092640229&amp;sdata=Nyki%2FZEjWMUN%2FgMVWr0lrZFDcbZILqJnd4RsMXgSIRw%3D&amp;reserved=0</a><br>
> In 3.26, we only have syslog-ng-mod-geoip2.<br>
> From: Antal Nemes (anemes) <Antal.Nemes@oneidentity.com><br>
> Sent: Monday, March 30, 2020 8:48<br>
> To: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br>
> Subject: Re: [syslog-ng] [FORGED] errors with elasticsearch_http on 2.21 & 3.22 -- correction<br>
><br>
>   Hello,<br>
><br>
> I quickly checked 3.21, and elasticsearch-http with compiled source and it works for me. I attached my console log. It might help if you compare the commands with yours.<br>
><br>
> Just couple of ideas that might have went wrong.<br>
><br>
> When you tried to use from package: the only dependency of elasticsearch-http is the http module. You need to install syslog-ng-mod-http, and not syslog-ng-mod-geoip.<br>
><br>
> Depending where you get the packages: but in 3.22, there were two geoip modules: geoip and geoip2. For example if you use OBS, you would have syslog-ng-mod-geoip and syslog-ng-mod-geoip2. You need to install syslog-ng-mod-geoip2 to use geip2.<br>
> In 3.26, however, geoip was removed, and only geoip2 remains. The driver was also renamed, but as I see the package remains geoip2. On the other hand, there is still a syslog-ng-mod-geoip package, looking for the original .so file. I do not understand how
 that could be generated. I will look into that. But I do not think this would be a problem for you.<br>
><br>
> When you compiled from source. Did you install a curl development package? That is necessary for the http module to be compiled. Unless otherwise specified, there is an autodetection, and if libcurl was not found, http module is simply not built. You can
 force availability by adding `--enable-http` during configure, similarly to that I did in the attached log. At the end of the configure, you need to see yes for http module.<br>
><br>
> [...]<br>
>   HTTP support (module)       : yes<br>
> [...]<br>
><br>
> Was the installation directory clean before you make installed? Is it possible syslog-ng modules could be installed there from a different syslog-ng version? Leftover or injected so-s, might be picked up by syslog-ng, even if they are not from the correct
 version. That can cause runtime problems.<br>
><br>
><br>
> Br,<br>
>   Antal<br>
><br>
> From: syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of Russell Fulton <r.fulton@auckland.ac.nz><br>
> Sent: Sunday, March 29, 2020 21:23<br>
> To: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br>
> Subject: Re: [syslog-ng] [FORGED] errors with elasticsearch_http on 2.21 & 3.22 -- correction<br>
><br>
> CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.<br>
><br>
> small correction to the test invocation of syslog-ng below. should be:<br>
><br>
> rful011@secmgrprd02:~$ /usr/local/syslog-ng-3.21/sbin/syslog-ng -s -f ~/short.conf<br>
><br>
> rather than -c.  It does not effect the error messages…. It was running on the full config not the stripped down one.<br>
><br>
> R<br>
><br>
><br>
>> On 29/03/2020, at 4:03 PM, Russell Fulton <r.fulton@auckland.ac.nz> wrote:<br>
>><br>
>> I have had this config running happily for several months and today I tried to add the geoip2 plugin and managed to break everything.<br>
>><br>
>> I first realised that I needed to recompile syslog-ng to get the geoip2 plugin but forgot I was running a locally compiled version .<br>
>><br>
>> I tried  apt install syslog-ng-mod-geoip and this broke things badly and I have been trying to recover for the last few hours :(<br>
>><br>
>> The issue is that any attempt to start syslog-ng with the original config that includes a destination of elasticsearch_http get an error:<br>
>><br>
>> Error parsing destination statement, destination plugin elasticsearch_http not found in /usr/local/syslog-ng-3.22/etc/syslog-ng.conf:33:3-33:21<br>
>><br>
>> Judging from what I found on th ’Net  this is what one would expect if the syslog-ng version was prior to 3.21 and did not support the http dest.<br>
>><br>
>> I first tried recompiling and installing 3.21 (in a different dir) with geoip2 enabled.  That went with out errors but still would not process my config.<br>
>><br>
>> Aside:  At this point I found that in spite of having the geoip2 module included, syslog-ng failed to find it when I copied the setup from the manual.  long story short the manual says the module is ‘geoip2’ when in fact it is ‘geoip2-plugin’ and that is
 the name you have to use in the @module.  Weird!<br>
>><br>
>> I then compiled 3.22 since I had the tar file and this behaved the same.<br>
>><br>
>> rful011@secmgrprd02:~$ cat short.conf<br>
>> @version: 3.21<br>
>> @include "scl.conf"<br>
>><br>
>> @module geoip2-plugin<br>
>><br>
>> source s_loghost {<br>
>>     network( transport("tcp") flags(no-multi-line) port(1514) keep-alive(yes));<br>
>> };<br>
>><br>
>><br>
>> destination d_elastic {<br>
>>   elasticsearch_http(<br>
>>     index("auth_${YEAR}.${MONTH}.${DAY}")<br>
>>    type("auth")<br>
>>    persist-name("auth")<br>
>>     template( "$(format-json --scope rfc3164 --scope nv-pairs --exclude R_DATE --key ISODATE)\n")<br>
>>     url("<a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsecesprd01.its.auckland.ac.nz%3A9200%2F_bulk&amp;data=02%7C01%7Cantal.nemes%40oneidentity.com%7C5557745cf0e64ed0839608d7d4e04910%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637211932092640229&amp;sdata=JUEPJlgOFpbUGGl%2FOAIa6h6A1D%2Fd8gr63A1NRHgRdxY%3D&amp;reserved=0">https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsecesprd01.its.auckland.ac.nz%3A9200%2F_bulk&amp;data=02%7C01%7Cantal.nemes%40oneidentity.com%7C5557745cf0e64ed0839608d7d4e04910%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637211932092640229&amp;sdata=JUEPJlgOFpbUGGl%2FOAIa6h6A1D%2Fd8gr63A1NRHgRdxY%3D&amp;reserved=0</a>")<br>
>>   );<br>
>> };<br>
>><br>
>> log {<br>
>>     source(s_loghost);<br>
>>     destination(d_elastic );<br>
>>     flags(flow-control);<br>
>> };<br>
>><br>
>> rful011@secmgrprd02:~$ /usr/local/syslog-ng-3.21/sbin/syslog-ng -s -c ~/short.conf<br>
>> Error parsing destination statement, destination plugin elasticsearch_http not found in /usr/local/syslog-ng-3.21/etc/syslog-ng.conf:33:3-33:21:<br>
>> 28                  file( "/home/rful011/test.log" template(t_db_parsed_test));<br>
>> 29       };<br>
>> 30<br>
>> 31<br>
>> 32      destination d_elastic {<br>
>> 33---->   elasticsearch_http(<br>
>> 33---->   ^^^^^^^^^^^^^^^^^^<br>
>> 34          index("auth_${YEAR}.${MONTH}.${DAY}")<br>
>> 35         type("auth")<br>
>> 36         persist-name("auth")<br>
>> 37          template( "$(format-json --scope rfc3164 --scope nv-pairs --exclude R_DATE --key ISODATE)\n")<br>
>> 38          url("<a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsecesprd01.its.auckland.ac.nz%3A9200%2F_bulk&amp;data=02%7C01%7Cantal.nemes%40oneidentity.com%7C5557745cf0e64ed0839608d7d4e04910%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637211932092640229&amp;sdata=JUEPJlgOFpbUGGl%2FOAIa6h6A1D%2Fd8gr63A1NRHgRdxY%3D&amp;reserved=0”">https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsecesprd01.its.auckland.ac.nz%3A9200%2F_bulk&amp;data=02%7C01%7Cantal.nemes%40oneidentity.com%7C5557745cf0e64ed0839608d7d4e04910%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637211932092640229&amp;sdata=JUEPJlgOFpbUGGl%2FOAIa6h6A1D%2Fd8gr63A1NRHgRdxY%3D&amp;reserved=0”</a>)<br>
>><br>
>> rful011@secmgrprd02:~$ /usr/local/syslog-ng-3.21/sbin/syslog-ng --version<br>
>> syslog-ng 3 (3.21.1)<br>
>> Config version: 3.21<br>
>> Installer-Version: 3.21.1<br>
>> Revision:<br>
>> Compile-Date: Mar 29 2020 11:57:39<br>
>> Module-Directory: /usr/local/syslog-ng-3.21/lib/syslog-ng<br>
>> Module-Path: /usr/local/syslog-ng-3.21/lib/syslog-ng<br>
>> Include-Path: /usr/local/syslog-ng-3.21/share/syslog-ng/include<br>
>> Available-Modules: add-contextual-data,affile,afprog,afsocket,afstomp,afuser,appmodel,basicfuncs,cef,confgen,cryptofuncs,csvparser,date,dbparser,disk-buffer,examples,geoip2-plugin,tfgetent,graphite,hook-commands,http,json-plugin,kvformat,linux-kmsg-format,map-value-pairs,pseudofile,mod-python,snmptrapd-parser,stardate,syslogformat,system-source,tags-parser,xml<br>
>> Enable-Debug: off<br>
>> Enable-GProf: off<br>
>> Enable-Memtrace: off<br>
>> Enable-IPv6: on<br>
>> Enable-Spoof-Source: off<br>
>> Enable-TCP-Wrapper: off<br>
>> Enable-Linux-Caps: off<br>
>> Enable-Systemd: off<br>
>><br>
>><br>
>><br>
>> ______________________________________________________________________________<br>
>> Member info: <a href="https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&amp;data=02%7C01%7Cantal.nemes%40oneidentity.com%7C5557745cf0e64ed0839608d7d4e04910%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637211932092640229&amp;sdata=Tk3ABJNBAZP2%2BrQzvNKqa%2Fsn%2Frm%2B8J%2BKhE73sYwByJU%3D&amp;reserved=0">
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&amp;data=02%7C01%7Cantal.nemes%40oneidentity.com%7C5557745cf0e64ed0839608d7d4e04910%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637211932092640229&amp;sdata=Tk3ABJNBAZP2%2BrQzvNKqa%2Fsn%2Frm%2B8J%2BKhE73sYwByJU%3D&amp;reserved=0</a><br>
>> Documentation: <a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&amp;data=02%7C01%7Cantal.nemes%40oneidentity.com%7C5557745cf0e64ed0839608d7d4e04910%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637211932092640229&amp;sdata=3A%2BM8wi6si9Ox1p6uY6F4rW1XaJ4Yx%2BhJS7nFnUYiqs%3D&amp;reserved=0">
https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&amp;data=02%7C01%7Cantal.nemes%40oneidentity.com%7C5557745cf0e64ed0839608d7d4e04910%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637211932092640229&amp;sdata=3A%2BM8wi6si9Ox1p6uY6F4rW1XaJ4Yx%2BhJS7nFnUYiqs%3D&amp;reserved=0</a><br>
>> FAQ: <a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&amp;data=02%7C01%7Cantal.nemes%40oneidentity.com%7C5557745cf0e64ed0839608d7d4e04910%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637211932092640229&amp;sdata=bq0EJElx9kfYQ8N2hxY2%2BEQhfdR1FiNwjsOu5M7QUNI%3D&amp;reserved=0">
https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&amp;data=02%7C01%7Cantal.nemes%40oneidentity.com%7C5557745cf0e64ed0839608d7d4e04910%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637211932092640229&amp;sdata=bq0EJElx9kfYQ8N2hxY2%2BEQhfdR1FiNwjsOu5M7QUNI%3D&amp;reserved=0</a><br>
>><br>
><br>
> ______________________________________________________________________________<br>
> Member info: <a href="https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&amp;data=02%7C01%7Cantal.nemes%40oneidentity.com%7C5557745cf0e64ed0839608d7d4e04910%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637211932092640229&amp;sdata=Tk3ABJNBAZP2%2BrQzvNKqa%2Fsn%2Frm%2B8J%2BKhE73sYwByJU%3D&amp;reserved=0">
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&amp;data=02%7C01%7Cantal.nemes%40oneidentity.com%7C5557745cf0e64ed0839608d7d4e04910%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637211932092640229&amp;sdata=Tk3ABJNBAZP2%2BrQzvNKqa%2Fsn%2Frm%2B8J%2BKhE73sYwByJU%3D&amp;reserved=0</a><br>
> Documentation: <a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&amp;data=02%7C01%7Cantal.nemes%40oneidentity.com%7C5557745cf0e64ed0839608d7d4e04910%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637211932092640229&amp;sdata=3A%2BM8wi6si9Ox1p6uY6F4rW1XaJ4Yx%2BhJS7nFnUYiqs%3D&amp;reserved=0">
https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&amp;data=02%7C01%7Cantal.nemes%40oneidentity.com%7C5557745cf0e64ed0839608d7d4e04910%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637211932092640229&amp;sdata=3A%2BM8wi6si9Ox1p6uY6F4rW1XaJ4Yx%2BhJS7nFnUYiqs%3D&amp;reserved=0</a><br>
> FAQ: <a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&amp;data=02%7C01%7Cantal.nemes%40oneidentity.com%7C5557745cf0e64ed0839608d7d4e04910%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637211932092640229&amp;sdata=bq0EJElx9kfYQ8N2hxY2%2BEQhfdR1FiNwjsOu5M7QUNI%3D&amp;reserved=0">
https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&amp;data=02%7C01%7Cantal.nemes%40oneidentity.com%7C5557745cf0e64ed0839608d7d4e04910%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637211932092640229&amp;sdata=bq0EJElx9kfYQ8N2hxY2%2BEQhfdR1FiNwjsOu5M7QUNI%3D&amp;reserved=0</a><br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&amp;data=02%7C01%7Cantal.nemes%40oneidentity.com%7C5557745cf0e64ed0839608d7d4e04910%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637211932092640229&amp;sdata=Tk3ABJNBAZP2%2BrQzvNKqa%2Fsn%2Frm%2B8J%2BKhE73sYwByJU%3D&amp;reserved=0">
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&amp;data=02%7C01%7Cantal.nemes%40oneidentity.com%7C5557745cf0e64ed0839608d7d4e04910%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637211932092640229&amp;sdata=Tk3ABJNBAZP2%2BrQzvNKqa%2Fsn%2Frm%2B8J%2BKhE73sYwByJU%3D&amp;reserved=0</a><br>
Documentation: <a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&amp;data=02%7C01%7Cantal.nemes%40oneidentity.com%7C5557745cf0e64ed0839608d7d4e04910%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637211932092640229&amp;sdata=3A%2BM8wi6si9Ox1p6uY6F4rW1XaJ4Yx%2BhJS7nFnUYiqs%3D&amp;reserved=0">
https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&amp;data=02%7C01%7Cantal.nemes%40oneidentity.com%7C5557745cf0e64ed0839608d7d4e04910%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637211932092640229&amp;sdata=3A%2BM8wi6si9Ox1p6uY6F4rW1XaJ4Yx%2BhJS7nFnUYiqs%3D&amp;reserved=0</a><br>
FAQ: <a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&amp;data=02%7C01%7Cantal.nemes%40oneidentity.com%7C5557745cf0e64ed0839608d7d4e04910%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637211932092640229&amp;sdata=bq0EJElx9kfYQ8N2hxY2%2BEQhfdR1FiNwjsOu5M7QUNI%3D&amp;reserved=0">
https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&amp;data=02%7C01%7Cantal.nemes%40oneidentity.com%7C5557745cf0e64ed0839608d7d4e04910%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637211932092640229&amp;sdata=bq0EJElx9kfYQ8N2hxY2%2BEQhfdR1FiNwjsOu5M7QUNI%3D&amp;reserved=0</a><br>
<br>
</div>
</span></font></div>
</body>
</html>