<div dir="ltr"><div>Dear Saqib,</div><div><br></div><div>Perhaps it would be easier if you could share a debug bundle with us.</div><div>Syslog-ng OSE has a debug bundle generator script included, which should take care of the process.</div><div>If your OS's package doesn't include it, you can download it from: <a href="https://raw.githubusercontent.com/syslog-ng/syslog-ng/master/contrib/syslog-ng-debun">https://raw.githubusercontent.com/syslog-ng/syslog-ng/master/contrib/syslog-ng-debun</a></div><div><br></div><div>If you you add executable rights to it, and run it with the options:</div><div><br></div><div># ./syslog-ng-debun -r -d -t 600 -p</div><div><br></div><div>It will run syslog-ng in debug mode for 10 minutes, and will create a packet capture of the logs coming in on ports 514 (udp+tcp) and 601 (tcp) plus the DNS traffic. (You should also make sure that your problematic device actually sends traffic to the syslog server in those 10 minutes!)<br></div><div>If you'd like, you can look at the bundle's contents to verify you are not sending us anything sensitive. If you send the bundle to us (Laszlo, Gabor and/or me) privately, that will also help in preserving your deployment's information.</div><div><br></div><div>Thank you!</div><div><br></div><div>Best Regards,</div><div>János Szigetvári<br></div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr">--</div><div dir="ltr">Janos SZIGETVARI<br><span>RHCE, License no. <a href="https://www.redhat.com/rhtapps/verify/?certId=150-053-692" target="_blank">150-053-692</a></span><br></div><div dir="ltr"><span><br></span></div><div dir="ltr"><span>LinkedIn: <a href="http://linkedin.com/in/janosszigetvari" target="_blank">linkedin.com/in/janosszigetvari</a></span><br><br>__@__˚V˚<br>Make the switch to open (source) applications, protocols, formats now:<br>- windows -> Linux, iexplore -> Firefox, msoffice -> LibreOffice<br>- msn -> jabber protocol (Pidgin, Google Talk)<br>- mp3 -> ogg, wmv -> ogg, jpg -> png, doc/xls/ppt -> odt/ods/odp</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Laszlo Szemere (lszemere) <<a href="mailto:Laszlo.Szemere@oneidentity.com">Laszlo.Szemere@oneidentity.com</a>> ezt írta (időpont: 2020. dec. 7., H, 8:22):<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Hello Saqib M,</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
I think your problem still can be just a small misconfiguration. It would be really good if you can share the exact version of Syslog-ng, your whole configuration and multiple example messages. So we won't accidentally overlook something. (<span style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12pt">If
your configuration contains private information you can either scramble it or send it in private to one of us.)</span></div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Example: (What was Gábor referring to) With a fresh Syslog-ng, you should see these additional debug messages in the output:</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<div style="color:rgb(197,200,198);background-color:rgb(30,30,30);font-family:"Droid Sans Mono","monospace",monospace,"Droid Sans Fallback";font-weight:normal;font-size:12px;line-height:16px">
<div><span>Incoming log entry; line</span><span style="color:rgb(103,104,103)">=</span><span style="color:rgb(154,168,58)">'default send string'</span></div>
<div><span>Initial message parsing follows</span><span style="color:rgb(255,11,0)">;</span></div>
<div><span>Setting value; name</span><span style="color:rgb(103,104,103)">=</span><span style="color:rgb(154,168,58)">'PROGRAM'</span><span>, value</span><span style="color:rgb(103,104,103)">=</span><span style="color:rgb(154,168,58)">'default'</span><span>, msg</span><span style="color:rgb(103,104,103)">=</span><span style="color:rgb(154,168,58)">'0x7f8214006fc0'</span></div>
<div><span>Setting value; name</span><span style="color:rgb(103,104,103)">=</span><span style="color:rgb(154,168,58)">'LEGACY_MSGHDR'</span><span>, value</span><span style="color:rgb(103,104,103)">=</span><span style="color:rgb(154,168,58)">'default '</span><span>, msg</span><span style="color:rgb(103,104,103)">=</span><span style="color:rgb(154,168,58)">'0x7f8214006fc0'</span></div>
<div><span>Setting value; name</span><span style="color:rgb(103,104,103)">=</span><span style="color:rgb(154,168,58)">'MESSAGE'</span><span>, value</span><span style="color:rgb(103,104,103)">=</span><span style="color:rgb(154,168,58)">'send string'</span><span>, msg</span><span style="color:rgb(103,104,103)">=</span><span style="color:rgb(154,168,58)">'0x7f8214006fc0'</span></div>
</div>
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
>From this you can see, that the "udp" and "network" sources (without any other instruction) are trying to parse the incoming message as an RFC5424 message, which will result to unexpected values in certain macros. For example, in this particular case the "MESSAGE"
macro only contains the string "send string", that is why "default send string" do not match on it.</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Best regards,</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Laci</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div id="gmail-m_3022476807991980199appendonsend"></div>
<hr style="display:inline-block;width:98%">
<div id="gmail-m_3022476807991980199divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>> on behalf of Gabor Nagy (gnagy) <<a href="mailto:Gabor.Nagy@oneidentity.com" target="_blank">Gabor.Nagy@oneidentity.com</a>><br>
<b>Sent:</b> Friday, December 4, 2020 10:29<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>><br>
<b>Subject:</b> Re: [syslog-ng] Filter matching not working</font>
<div> </div>
</div>
<div dir="ltr">
<div style="background-color:rgb(255,235,156);width:100%;border-style:solid;border-color:rgb(156,101,0);border-width:1pt;padding:2pt;font-size:10pt;line-height:12pt;font-family:"Calibri";color:black;text-align:left">
<span style="color:rgb(156,101,0);font-weight:bold">CAUTION:</span> This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.</div>
<br>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:11pt;color:rgb(0,0,0)">
I still can't see more debug logs in your internal log. I guess you are using an older version of syslog-ng. Unfortunately trace level debugging can only be used if syslog-ng was compiled with trace level support.<br>
Can you tell us what version of syslog-ng are you using?</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:11pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:11pt;color:rgb(0,0,0)">
<span style="color:rgb(0,0,0);font-family:Calibri,Arial,Helvetica,sans-serif;font-size:11pt">Can you test your filter with the following BSD format message, please?</span><br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:11pt;color:rgb(0,0,0)">
<13>Dec 4 10:27:20 localhost myprogram: default send string</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:11pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:11pt;color:rgb(0,0,0)">
Regards,<br>
Gabor</div>
<div id="gmail-m_3022476807991980199x_appendonsend"></div>
<hr style="display:inline-block;width:98%">
<div id="gmail-m_3022476807991980199x_divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>> on behalf of Saqib M <<a href="mailto:saqib.m@cummins.com" target="_blank">saqib.m@cummins.com</a>><br>
<b>Sent:</b> Thursday, December 3, 2020 16:26<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>><br>
<b>Subject:</b> Re: [syslog-ng] Filter matching not working</font>
<div> </div>
</div>
<div lang="EN-US">
<div style="background-color:rgb(255,235,156);width:100%;border-style:solid;border-color:rgb(156,101,0);border-width:1pt;padding:2pt;font-size:10pt;line-height:12pt;font-family:"Calibri";color:black;text-align:left">
<span style="color:rgb(156,101,0);font-weight:bold">CAUTION:</span> This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.</div>
<br>
<div>
<div>
<p>Thank you for getting back on this. I am using the following command but I don’t see the parsing logs.
</p>
<p> </p>
<p>/opt/syslog-ng/sbin/syslog-ng -e -F -d -v -t</p>
<p> </p>
<p>This is what I saw.</p>
<p> </p>
<p>[2020-12-03T15:03:06+0000] Incoming log entry; source='s_net#0', line='default send string'</p>
<p>[2020-12-03T15:03:06+0000] Filter rule evaluation begins; filter_rule='f_discreg'</p>
<p>[2020-12-03T15:03:06+0000] Filter node evaluation result; filter_result='not-match'</p>
<p>[2020-12-03T15:03:06+0000] Filter rule evaluation result; filter_result='not-match', filter_rule='f_discreg'</p>
<p>[2020-12-03T15:03:06+0000] Filter rule evaluation begins; filter_rule='f_dlptracker'</p>
<p>[2020-12-03T15:03:06+0000] Filter node evaluation result; filter_result='not-match'</p>
<p>[2020-12-03T15:03:06+0000] Filter rule evaluation result; filter_result='not-match', filter_rule='f_dlptracker'</p>
<p>[2020-12-03T15:03:06+0000] Outgoing message; destination='d_fallback#0', message='2020-12-03T15:03:06+00:00 172.17.236.3 default send string\x0a'</p>
<p> </p>
<p>Also, the <span style="color:black">f_discreg is in a log path.
</span></p>
<p>log { source(s_net); filter(f_discreg); destination(d_discard); flags(final); };</p>
<p> </p>
<p>Could there be other ways to look into it a bit further to see what’s going wrong?</p>
<p> </p>
<p>Thank you</p>
<p> </p>
<div>
<p><span style="font-size:10pt">Regards,</span></p>
<p><span style="font-size:10pt"> </span></p>
<p><span style="font-size:10pt">Saqib M</span></p>
<p><i><span style="font-size:10pt">Cybersecurity Co-op</span></i></p>
<p><span style="font-size:10pt">Global Cybersecurity Technologies</span></p>
<p><span style="font-size:10pt">Email: <a href="mailto:saqib.m@cummins.com" target="_blank">
saqib.m@cummins.com</a></span></p>
<p><span style="font-size:10pt">Cummins Inc.</span></p>
</div>
<p> </p>
<div>
<div style="border-color:rgb(225,225,225) currentcolor currentcolor;border-style:solid none none;border-width:1pt medium medium;padding:3pt 0in 0in">
<p><b>From:</b> syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>>
<b>On Behalf Of </b>Gabor Nagy (gnagy)<br>
<b>Sent:</b> Thursday, December 3, 2020 3:17 AM<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>><br>
<b>Subject:</b> Re: [syslog-ng] Filter matching not working</p>
</div>
</div>
<p> </p>
<p style="text-align:right" align="right"><b><span style="font-size:12pt;color:rgb(243,156,18)">External Sender</span></b></p>
<div>
<div>
<p><span style="color:black">Hello!<br>
<br>
I just took a quick look on the config and on the internal logs. Couldn't be that "f_discreg" is not included in a log path?<br>
<br>
Another thing that could be is parsing: your "s_net" source will try to parse incoming messages as either BSD or Syslog format.<br>
If you've just tested the filter by sending in the message "default send string", then syslog-ng will parse it, which results that MSG macro will not contain "default send string".</span></p>
</div>
<div>
<p><span style="color:black">With trace level logging you can debug how does the message being parsed (-t command line option), and to disable parsing on the source side use the flags("no-parse") option.<br>
<br>
See an example:<br>
[2020-12-03T09:14:51.016256] Incoming log entry; line='default send string' </span>
</p>
<div>
<p><span style="color:black">[2020-12-03T09:14:51.016290] Initial message parsing follows;</span></p>
</div>
<div>
<p><span style="color:black">[2020-12-03T09:14:51.016322] Setting value; name='PROGRAM', value='default', msg='0x7f24a8005f30'</span></p>
</div>
<div>
<p><span style="color:black">[2020-12-03T09:14:51.016334] Setting value; name='LEGACY_MSGHDR', value='default ', msg='0x7f24a8005f30'</span></p>
</div>
<div>
<p><span style="color:black">[2020-12-03T09:14:51.016341] Setting value; name='MESSAGE', value='send string', msg='0x7f24a8005f30'</span></p>
</div>
<p style="margin-bottom:12pt"><span style="color:black"> </span></p>
</div>
<div>
<p><span style="color:black"><br>
Regards,<br>
Gabor</span></p>
</div>
<div style="text-align:center" align="center">
<hr width="98%" size="2" align="center">
</div>
<div id="gmail-m_3022476807991980199x_x_divRplyFwdMsg">
<p><b><span style="color:black">From:</span></b><span style="color:black"> syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>> on behalf of Saqib M <<a href="mailto:saqib.m@cummins.com" target="_blank">saqib.m@cummins.com</a>><br>
<b>Sent:</b> Thursday, December 3, 2020 1:48<br>
<b>To:</b> <a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a> <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>><br>
<b>Subject:</b> [syslog-ng] Filter matching not working</span> </p>
<div>
<p> </p>
</div>
</div>
<div>
<div style="border:1pt solid rgb(156,101,0);padding:2pt">
<p style="line-height:12pt;background:rgb(255,235,156) none repeat scroll 0% 0%"><b><span style="font-size:10pt;color:rgb(156,101,0)">CAUTION:</span></b><span style="font-size:10pt;color:black"> This email originated from outside of the organization. Do not follow guidance,
click links, or open attachments unless you recognize the sender and know the content is safe.</span></p>
</div>
<p> </p>
<div>
<div>
<p>Greetings –</p>
<p> </p>
<p>I have been trying to create a very basic filter that looks up a string in the incoming log. However, it would not match any filter and would go to the default filter. I have tried both match() and message(), neither worked for me.
Please let me know if you think I am missing something.</p>
<p> </p>
<p><b>Following are the chunks from the syslog-ng.conf</b></p>
<p> </p>
<p>source s_net {</p>
<p># All syslog traffic on port 514 - this is direct from network devices.</p>
<p> udp(port (514));</p>
<p> network(transport("tcp") max-connections(20000) log_iw_size(100000000) ); # tags("fortigate", "cisco", "default") );</p>
<p>};</p>
<p> </p>
<p>filter f_discreg { message("default send string") };</p>
<p> </p>
<p>log { source(s_net); filter(f_dlptracker); destination(d_dlptracker); flags(final); };</p>
<p> </p>
<p><b>Here is the log from the test I ran.</b></p>
<p><b> </b></p>
<p>[2020-12-02T22:00:36+0000] Incoming log entry; source='s_net#0', line='default send string'</p>
<p>[2020-12-02T22:00:46+0000] Filter node evaluation result; filter_result='not-match', filter_type='OR'</p>
<p>[2020-12-02T22:00:46+0000] Filter rule evaluation result; filter_result='not-match', filter_rule='f_tanium'</p>
<p>[2020-12-02T22:00:46+0000] Filter rule evaluation begins; filter_rule='f_palo_alto'</p>
<p>[2020-12-02T22:00:46+0000] Filter node evaluation result; filter_result='not-match'</p>
<p>[2020-12-02T22:00:46+0000] Filter node evaluation result; filter_result='not-match'</p>
<p>[2020-12-02T22:00:46+0000] Filter node evaluation result; filter_result='not-match'</p>
<p>[2020-12-02T22:00:46+0000] Filter node evaluation result; filter_result='not-match', filter_type='OR'</p>
<p>[2020-12-02T22:00:46+0000] Filter node evaluation result; filter_result='not-match', filter_type='OR'</p>
<p>[2020-12-02T22:00:46+0000] Filter rule evaluation result; filter_result='not-match', filter_rule='f_palo_alto'</p>
<p>[2020-12-02T22:00:46+0000] Filter rule evaluation begins; filter_rule='f_dlptracker'</p>
<p>[2020-12-02T22:00:46+0000] Filter node evaluation result; filter_result='not-match'</p>
<p>[2020-12-02T22:00:46+0000] Filter rule evaluation result; filter_result='not-match', filter_rule='f_dlptracker'</p>
<p>[2020-12-02T22:00:46+0000] Outgoing message; destination='d_fallback#0', message='2020-12-02T22:00:46+00:00 172.17.236.3 default send string\x0a'</p>
<p> </p>
<p><span style="font-size:10pt">Regards,</span></p>
<p><span style="font-size:10pt"> </span></p>
<p><span style="font-size:10pt">Saqib M</span></p>
<p><i><span style="font-size:10pt">Cybersecurity Co-op</span></i></p>
<p><span style="font-size:10pt">Global Cybersecurity Technologies</span></p>
<p><span style="font-size:10pt">Email: <a href="mailto:saqib.m@cummins.com" target="_blank">
saqib.m@cummins.com</a></span></p>
<p><span style="font-size:10pt">Cummins Inc.</span></p>
<p> </p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>