<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.xmsonormal, li.xmsonormal, div.xmsonormal
{mso-style-name:x_msonormal;
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.xmsonormal0, li.xmsonormal0, div.xmsonormal0
{mso-style-name:x_msonormal0;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.xmsochpdefault, li.xmsochpdefault, div.xmsochpdefault
{mso-style-name:x_msochpdefault;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
span.xmsohyperlink
{mso-style-name:x_msohyperlink;
color:#0563C1;
text-decoration:underline;}
span.xmsohyperlinkfollowed
{mso-style-name:x_msohyperlinkfollowed;
color:#954F72;
text-decoration:underline;}
span.xemailstyle18
{mso-style-name:x_emailstyle18;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.xemailstyle19
{mso-style-name:x_emailstyle19;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle27
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Thank you for getting back on this. I am using the following command but I don’t see the parsing logs.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">/opt/syslog-ng/sbin/syslog-ng -e -F -d -v -t<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This is what I saw.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">[2020-12-03T15:03:06+0000] Incoming log entry; source='s_net#0', line='default send string'<o:p></o:p></p>
<p class="MsoNormal">[2020-12-03T15:03:06+0000] Filter rule evaluation begins; filter_rule='f_discreg'<o:p></o:p></p>
<p class="MsoNormal">[2020-12-03T15:03:06+0000] Filter node evaluation result; filter_result='not-match'<o:p></o:p></p>
<p class="MsoNormal">[2020-12-03T15:03:06+0000] Filter rule evaluation result; filter_result='not-match', filter_rule='f_discreg'<o:p></o:p></p>
<p class="MsoNormal">[2020-12-03T15:03:06+0000] Filter rule evaluation begins; filter_rule='f_dlptracker'<o:p></o:p></p>
<p class="MsoNormal">[2020-12-03T15:03:06+0000] Filter node evaluation result; filter_result='not-match'<o:p></o:p></p>
<p class="MsoNormal">[2020-12-03T15:03:06+0000] Filter rule evaluation result; filter_result='not-match', filter_rule='f_dlptracker'<o:p></o:p></p>
<p class="MsoNormal">[2020-12-03T15:03:06+0000] Outgoing message; destination='d_fallback#0', message='2020-12-03T15:03:06+00:00 172.17.236.3 default send string\x0a'<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Also, the <span style="color:black">f_discreg is in a log path.
</span><o:p></o:p></p>
<p class="MsoNormal">log { source(s_net); filter(f_discreg); destination(d_discard); flags(final); };<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Could there be other ways to look into it a bit further to see what’s going wrong?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank you<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt">Saqib M<o:p></o:p></span></p>
<p class="MsoNormal"><i><span style="font-size:10.0pt">Cybersecurity Co-op<o:p></o:p></span></i></p>
<p class="MsoNormal"><span style="font-size:10.0pt">Global Cybersecurity Technologies<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt">Email: <a href="mailto:saqib.m@cummins.com">
saqib.m@cummins.com</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt">Cummins Inc.<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> syslog-ng <syslog-ng-bounces@lists.balabit.hu> <b>
On Behalf Of </b>Gabor Nagy (gnagy)<br>
<b>Sent:</b> Thursday, December 3, 2020 3:17 AM<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br>
<b>Subject:</b> Re: [syslog-ng] Filter matching not working<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p align="right" style="text-align:right"><b><span style="font-size:12.0pt;color:#F39C12">External Sender</span></b><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="color:black">Hello!<br>
<br>
I just took a quick look on the config and on the internal logs. Couldn't be that "f_discreg" is not included in a log path?<br>
<br>
Another thing that could be is parsing: your "s_net" source will try to parse incoming messages as either BSD or Syslog format.<br>
If you've just tested the filter by sending in the message "default send string", then syslog-ng will parse it, which results that MSG macro will not contain "default send string".<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">With trace level logging you can debug how does the message being parsed (-t command line option), and to disable parsing on the source side use the flags("no-parse") option.<br>
<br>
See an example:<br>
[2020-12-03T09:14:51.016256] Incoming log entry; line='default send string' <o:p>
</o:p></span></p>
<div>
<p class="MsoNormal"><span style="color:black">[2020-12-03T09:14:51.016290] Initial message parsing follows;<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">[2020-12-03T09:14:51.016322] Setting value; name='PROGRAM', value='default', msg='0x7f24a8005f30'<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">[2020-12-03T09:14:51.016334] Setting value; name='LEGACY_MSGHDR', value='default ', msg='0x7f24a8005f30'<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">[2020-12-03T09:14:51.016341] Setting value; name='MESSAGE', value='send string', msg='0x7f24a8005f30'<o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><br>
Regards,<br>
Gabor<o:p></o:p></span></p>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="divRplyFwdMsg">
<p class="MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu">syslog-ng-bounces@lists.balabit.hu</a>> on behalf of Saqib M <<a href="mailto:saqib.m@cummins.com">saqib.m@cummins.com</a>><br>
<b>Sent:</b> Thursday, December 3, 2020 1:48<br>
<b>To:</b> <a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a> <<a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a>><br>
<b>Subject:</b> [syslog-ng] Filter matching not working</span> <o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
<div>
<div style="border:solid #9C6500 1.0pt;padding:2.0pt 2.0pt 2.0pt 2.0pt">
<p class="MsoNormal" style="line-height:12.0pt;background:#FFEB9C"><b><span style="font-size:10.0pt;color:#9C6500">CAUTION:</span></b><span style="font-size:10.0pt;color:black"> This email originated from outside of the organization. Do not follow guidance,
click links, or open attachments unless you recognize the sender and know the content is safe.<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="xmsonormal">Greetings –<o:p></o:p></p>
<p class="xmsonormal"> <o:p></o:p></p>
<p class="xmsonormal">I have been trying to create a very basic filter that looks up a string in the incoming log. However, it would not match any filter and would go to the default filter. I have tried both match() and message(), neither worked for me. Please
let me know if you think I am missing something.<o:p></o:p></p>
<p class="xmsonormal"> <o:p></o:p></p>
<p class="xmsonormal"><b>Following are the chunks from the syslog-ng.conf</b><o:p></o:p></p>
<p class="xmsonormal"> <o:p></o:p></p>
<p class="xmsonormal">source s_net {<o:p></o:p></p>
<p class="xmsonormal"># All syslog traffic on port 514 - this is direct from network devices.<o:p></o:p></p>
<p class="xmsonormal"> udp(port (514));<o:p></o:p></p>
<p class="xmsonormal"> network(transport("tcp") max-connections(20000) log_iw_size(100000000) ); # tags("fortigate", "cisco", "default") );<o:p></o:p></p>
<p class="xmsonormal">};<o:p></o:p></p>
<p class="xmsonormal"> <o:p></o:p></p>
<p class="xmsonormal">filter f_discreg { message("default send string") };<o:p></o:p></p>
<p class="xmsonormal"> <o:p></o:p></p>
<p class="xmsonormal">log { source(s_net); filter(f_dlptracker); destination(d_dlptracker); flags(final); };<o:p></o:p></p>
<p class="xmsonormal"> <o:p></o:p></p>
<p class="xmsonormal"><b>Here is the log from the test I ran.</b><o:p></o:p></p>
<p class="xmsonormal"><b> </b><o:p></o:p></p>
<p class="xmsonormal">[2020-12-02T22:00:36+0000] Incoming log entry; source='s_net#0', line='default send string'<o:p></o:p></p>
<p class="xmsonormal">[2020-12-02T22:00:46+0000] Filter node evaluation result; filter_result='not-match', filter_type='OR'<o:p></o:p></p>
<p class="xmsonormal">[2020-12-02T22:00:46+0000] Filter rule evaluation result; filter_result='not-match', filter_rule='f_tanium'<o:p></o:p></p>
<p class="xmsonormal">[2020-12-02T22:00:46+0000] Filter rule evaluation begins; filter_rule='f_palo_alto'<o:p></o:p></p>
<p class="xmsonormal">[2020-12-02T22:00:46+0000] Filter node evaluation result; filter_result='not-match'<o:p></o:p></p>
<p class="xmsonormal">[2020-12-02T22:00:46+0000] Filter node evaluation result; filter_result='not-match'<o:p></o:p></p>
<p class="xmsonormal">[2020-12-02T22:00:46+0000] Filter node evaluation result; filter_result='not-match'<o:p></o:p></p>
<p class="xmsonormal">[2020-12-02T22:00:46+0000] Filter node evaluation result; filter_result='not-match', filter_type='OR'<o:p></o:p></p>
<p class="xmsonormal">[2020-12-02T22:00:46+0000] Filter node evaluation result; filter_result='not-match', filter_type='OR'<o:p></o:p></p>
<p class="xmsonormal">[2020-12-02T22:00:46+0000] Filter rule evaluation result; filter_result='not-match', filter_rule='f_palo_alto'<o:p></o:p></p>
<p class="xmsonormal">[2020-12-02T22:00:46+0000] Filter rule evaluation begins; filter_rule='f_dlptracker'<o:p></o:p></p>
<p class="xmsonormal">[2020-12-02T22:00:46+0000] Filter node evaluation result; filter_result='not-match'<o:p></o:p></p>
<p class="xmsonormal">[2020-12-02T22:00:46+0000] Filter rule evaluation result; filter_result='not-match', filter_rule='f_dlptracker'<o:p></o:p></p>
<p class="xmsonormal">[2020-12-02T22:00:46+0000] Outgoing message; destination='d_fallback#0', message='2020-12-02T22:00:46+00:00 172.17.236.3 default send string\x0a'<o:p></o:p></p>
<p class="xmsonormal"> <o:p></o:p></p>
<p class="xmsonormal"><span style="font-size:10.0pt">Regards,</span><o:p></o:p></p>
<p class="xmsonormal"><span style="font-size:10.0pt"> </span><o:p></o:p></p>
<p class="xmsonormal"><span style="font-size:10.0pt">Saqib M</span><o:p></o:p></p>
<p class="xmsonormal"><i><span style="font-size:10.0pt">Cybersecurity Co-op</span></i><o:p></o:p></p>
<p class="xmsonormal"><span style="font-size:10.0pt">Global Cybersecurity Technologies</span><o:p></o:p></p>
<p class="xmsonormal"><span style="font-size:10.0pt">Email: <a href="mailto:saqib.m@cummins.com">
saqib.m@cummins.com</a></span><o:p></o:p></p>
<p class="xmsonormal"><span style="font-size:10.0pt">Cummins Inc.</span><o:p></o:p></p>
<p class="xmsonormal"> <o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>