<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello Alex,</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
thank you for the output. This part looks good. <span style="color: rgb(0, 0, 0); font-family: Arial, Helvetica, sans-serif; font-size: 12pt;">Unfortunately you have to explicitly enable the IPv6 protocol in the configuration. (Which will indicate that IPv4
will not work simultaneously.)</span></div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Please add: "ip-protocol(6)" to your "<span style="font-family: Arial, Helvetica, sans-serif; background-color: rgb(255, 255, 255); display: inline !important">d_hostnameIPv6_udp" destination.</span></div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
destination d_hostnameIPv6_udp {
<div> syslog("dns6server" transport("udp") port(514) keep-alive(no)</div>
<div> suppress(5)</div>
<div> disk-buffer(</div>
<div> mem-buf-size(2097152)</div>
<div> disk-buf-size(4194304)</div>
<div> reliable(yes)</div>
<div> dir("/tmp")</div>
<div> ip-protocol(6)</div>
<div> )</div>
<div> );</div>
};<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Best regards,</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Laci</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of Alexandre Santos <alexandre.rosas.santos@gmail.com><br>
<b>Sent:</b> Friday, August 28, 2020 13:06<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br>
<b>Subject:</b> Re: [syslog-ng] No remote logging with hostname which has address is IPv6</font>
<div> </div>
</div>
<div>
<div style="background-color:#FFEB9C; width:100%; border-style:solid; border-color:#9C6500; border-width:1pt; padding:2pt; font-size:10pt; line-height:12pt; font-family:'Calibri'; color:Black; text-align:left">
<span style="color:#9C6500; font-weight:bold">CAUTION:</span> This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.</div>
<br>
<div>
<div dir="ltr">
<div>Hi Laci,</div>
<div>Here it goes:</div>
<div><span style="font-family:monospace">root@localhost:~# /usr/sbin/syslog-ng -Fvde $SYSLOGNG_OPTS --cfgfile=/etc/syslog-ng/mgmt-syslog-ng.conf --pidfile=/var/lib/syslog-ng/mgmt-syslog-ng.pid --persist-file=/var/lib/syslog-ng/mgmt-syslog-ng.persist --control=/var/lib/syslog-ng/mgmt-syslog-ng.ctl
--version<br>
syslog-ng 3 (3.19.1)<br>
Config version: 3.19<br>
Installer-Version: 3.19.1<br>
Revision: 3.19.1-5<br>
Compile-Date: May 19 2019 11:03:30<br>
Module-Directory: /usr/lib/syslog-ng/3.19<br>
Module-Path: /usr/lib/syslog-ng/3.19<br>
Include-Path: /usr/share/syslog-ng/include<br>
Available-Modules: affile,hook-commands,basicfuncs,afuser,csvparser,date,pseudofile,confgen,json-plugin,linux-kmsg-format,cef,system-source,syslogformat,afsql,appmodel,http,kvformat,afprog,afsocket,afmongodb,sdjournal,cryptofuncs,disk-buffer,dbparser<br>
Enable-Debug: off<br>
Enable-GProf: off<br>
Enable-Memtrace: off<br>
Enable-IPv6: on<br>
Enable-Spoof-Source: on<br>
Enable-TCP-Wrapper: on<br>
Enable-Linux-Caps: on<br>
Enable-Systemd: on</span></div>
<div><br>
</div>
<div>Thanks, Alex<br>
</div>
</div>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">On Fri, Aug 28, 2020 at 11:58 AM Laszlo Szemere (lszemere) <<a href="mailto:Laszlo.Szemere@oneidentity.com">Laszlo.Szemere@oneidentity.com</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Hello Alex,</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Syslog-ng can be compiled with or without IPv6 support. As a first step please verify if it was compiled that way.</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
If you start Syslog-ng with the "--version" option it will print a little debug information about itself. <span style="color:rgb(0,0,0); font-family:Arial,Helvetica,sans-serif; font-size:12pt">Among other options there w</span><span style="color:rgb(0,0,0); font-family:Arial,Helvetica,sans-serif; font-size:12pt">ill be
a line: "Enable-IPv6"</span></div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="color:rgb(0,0,0); font-family:Arial,Helvetica,sans-serif; font-size:12pt"><br>
</span></div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="color:rgb(0,0,0); font-family:Arial,Helvetica,sans-serif; font-size:12pt"> (If it was compiled with "Enable-IPv6: on", please copy the entire output here. It will help with the later investigation.)</span></div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="color:rgb(0,0,0); font-family:Arial,Helvetica,sans-serif; font-size:12pt"><br>
</span></div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="color:rgb(0,0,0); font-family:Arial,Helvetica,sans-serif; font-size:12pt">Best regards,</span></div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="color:rgb(0,0,0); font-family:Arial,Helvetica,sans-serif; font-size:12pt">Laci</span></div>
<div id="x_gmail-m_-3691999137277853748appendonsend"></div>
<hr style="display:inline-block; width:98%">
<div id="x_gmail-m_-3691999137277853748divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>>
on behalf of Alexandre Santos <<a href="mailto:alexandre.rosas.santos@gmail.com" target="_blank">alexandre.rosas.santos@gmail.com</a>><br>
<b>Sent:</b> Friday, August 28, 2020 12:35<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>><br>
<b>Subject:</b> [syslog-ng] No remote logging with hostname which has address is IPv6</font>
<div> </div>
</div>
<div>
<div style="background-color:rgb(255,235,156); width:100%; border-style:solid; border-color:rgb(156,101,0); border-width:1pt; padding:2pt; font-size:10pt; line-height:12pt; font-family:"Calibri"; color:black; text-align:left">
<span style="color:rgb(156,101,0); font-weight:bold">CAUTION:</span> This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.</div>
<br>
<div>
<div dir="ltr">
<div>Hi,</div>
<div><br>
</div>
<div>I have configuration, which is sending log messages to a remote hostname (dns6server). The particularity of this remote server is that it is resolved to an IPv6 address.</div>
<div><br>
</div>
<div>ping works fine:</div>
<div><span style="font-family:monospace">root@localhost:~# ping dns6server -c 3<br>
PING dns6server(2620:38:4::8:4000:238) 56 data bytes<br>
64 bytes from 2620:38:4::8:4000:238: icmp_seq=1 ttl=63 time=0.354 ms<br>
64 bytes from 2620:38:4::8:4000:238: icmp_seq=2 ttl=63 time=0.264 ms<br>
64 bytes from 2620:38:4::8:4000:238: icmp_seq=3 ttl=63 time=0.310 ms</span></div>
<div><br>
</div>
<div>But syslog-ng seems not to be able to resolve the ipv6 address:</div>
<div>
<p style="margin:0cm 0cm 0.0001pt"><span style="font-family:monospace"><font size="2"><span>Aug 27 20:58:37 localhost systemd[1]: mgmt-syslog-ng.service: Succeeded.<span></span></span></font></span></p>
<span style="font-family:monospace"><font size="2"></font></span>
<p style="margin:0cm 0cm 0.0001pt"><span style="font-family:monospace"><font size="2"><span>Aug 27 20:58:37 localhost systemd[1]: Stopped External Logger Daemon.<span></span></span></font></span></p>
<span style="font-family:monospace"><font size="2"></font></span>
<p style="margin:0cm 0cm 0.0001pt"><span style="font-family:monospace"><font size="2"><span>Aug 27 20:58:37 localhost systemd[1]: Starting External Logger Daemon...<span></span></span></font></span></p>
<span style="font-family:monospace"><font size="2"></font></span>
<p style="margin:0cm 0cm 0.0001pt"><span style="font-family:monospace"><font size="2"><span>Aug 27 20:58:37 localhost ip[32709]: [2020-08-27T20:58:37.841389] WARNING: With use-dns(no), dns-cache() will be forced to 'no' too!;<span></span></span></font></span></p>
<span style="font-family:monospace"><font size="2"></font></span>
<p style="margin:0cm 0cm 0.0001pt"><span style="font-family:monospace"><font size="2"><span>Aug 27 20:58:46 localhost ip[32709]: [2020-08-27T20:58:46.854714] Error resolving hostname; host='dns6server'<span></span></span></font></span></p>
<span style="font-family:monospace"><font size="2"></font></span>
<p style="margin:0cm 0cm 0.0001pt"><span style="font-family:monospace"><font size="2"><span>Aug 27 20:58:46 localhost ip[32709]: [2020-08-27T20:58:46.854758] Initiating connection failed, reconnecting; time_reopen='60'<span></span></span></font></span></p>
<span style="font-family:monospace"><font size="2"></font></span>
<p style="margin:0cm 0cm 0.0001pt; font-size:11pt"><span style="font-family:monospace"><span style="font-size:8pt"><font size="2">Aug 27 20:58:46 localhost systemd[1]: Started External Logger Daemon.</font></span></span></p>
<p style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
<span style="font-size:8pt; font-family:Consolas"><font size="2"><span style="font-family:arial,sans-serif"><br>
</span></font></span></p>
<p style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
<span style="font-size:8pt; font-family:Consolas"><font size="2"><span style="font-family:arial,sans-serif">Any Ideas?<br>
</span></font></span></p>
<p style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
<span style="font-size:8pt; font-family:Consolas"><font size="2"><span style="font-family:arial,sans-serif"><br>
</span></font></span></p>
<p style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
<span style="font-size:8pt; font-family:Consolas"><font size="2"><span style="font-family:arial,sans-serif">I am sending the configuration and debug log in attachment.<br>
</span></font></span></p>
<p style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
<span style="font-size:8pt; font-family:Consolas"><font size="2"><span style="font-family:arial,sans-serif"><br>
</span></font></span></p>
<p style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
<span style="font-size:8pt; font-family:Consolas"><font size="2"><span style="font-family:arial,sans-serif">Thanks in Advance,</span></font></span></p>
<p style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
<span style="font-size:8pt; font-family:Consolas"><font size="2"><span style="font-family:arial,sans-serif">Alex<br>
</span></font></span></p>
<p style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
<span style="font-size:8pt; font-family:Consolas"><font size="2"><span style="font-family:arial,sans-serif"></span></font><span></span></span></p>
</div>
</div>
</div>
</div>
</div>
______________________________________________________________________________<br>
Member info: <a href="https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Claszlo.szemere%40oneidentity.com%7C4370da7bbe7c46ec493b08d84b426c29%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637342095943843156&sdata=vmrCsyOtbaTHBGJ%2BpNscXIihsumvePhcmSmAelRZQ0s%3D&reserved=0" originalsrc="https://lists.balabit.hu/mailman/listinfo/syslog-ng" shash="zkgaCUVj3+6SJZxAC7/5l5WJEknoza32THXxinFgcScqaO6nlYkctfmw0qK1oMq2VyqXDVPDuGzK36LkObk1UkXr1gTG+gmMddXYeltfHIk4DkmRfnePIlJ4fRICLIRFDUp1E3nlEgMm1qKnVgJ0V8h7qEgKXlFs4ufwwX213H4=" rel="noreferrer" target="_blank">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02%7C01%7Claszlo.szemere%40oneidentity.com%7C4370da7bbe7c46ec493b08d84b426c29%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637342095943843156&sdata=5M87v3dv77VOtDJ791Odg1lel5b6E3Cr4bnVB4ZG5Go%3D&reserved=0" originalsrc="http://www.balabit.com/support/documentation/?product=syslog-ng" shash="mXDQ3IdpKQKTnFlhNxtvOnMfFWgvbmVR/7fu/oxDwwWay0jpXom4yBR6StIas2MFBD8NiIVqwYbEKjZ3rFelzabLLurMjt1CaiHKgVkMfaC+AFShFS1LvD4aEPDy97aFDimf+CV+wAm01C7Vn9lHPyYGBhIYcSY7bOUoIOSXsE8=" rel="noreferrer" target="_blank">
http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Claszlo.szemere%40oneidentity.com%7C4370da7bbe7c46ec493b08d84b426c29%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637342095943843156&sdata=kiMZ9Tymaun06gdFnWgUkUr6P6FXim9H2NsqQnBtLxs%3D&reserved=0" originalsrc="http://www.balabit.com/wiki/syslog-ng-faq" shash="PvAjuafgQKLV0VPItrRwr7vrBUSbMhrB6hdXSUf7x2Btk6lZ47wZGoqr5N3dbL4Qj6nienfs2mIRZxKmwGTydlNVgAScDi2Mcm6AJbBpo3yS0/xllF/dx5ItRHPVOR58xfVRRQpmM++nArqRi+4VXY9x1E+tgCQ39rg1NC6ndV8=" rel="noreferrer" target="_blank">
http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote>
</div>
</div>
</div>
</body>
</html>