November 2012 - syslog-ng - lists.balabit.hu

Debugging tools for syslog-ng
by Anton Koldaev 10 Nov '12

10 Nov '12

Hi, I wanted to know if syslog-ng developers has some tools like mysqltuner or just a shell scripts to check syslog-ng configuration and get some recommendations on tuning? There is a lot of information about all the buffers/window sizes, etc. and it's very complicated to set the proper values if I have a bunch of different sources/destinations. For example if I'm using flow-control+multiple destinations it can stop reading the source at any time and I have no idea when and why it's happening and which value should I tune. -- Best regards, Koldaev Anton

3 12

rsyslog client produces "Error processing log message"
by Andreas Heinlein 08 Nov '12

08 Nov '12

Hello, we have a centralised log server running syslog-ng 3.1 OSE on Debian 6.0. On the client side, we were using syslog-ng but now I'd like to use rsyslog instead (for several reasons). Transport should be TLS-encrypted TCP. I have set up a connection between the two, but apparently syslog-ng fails to parse the log messages sent by rsyslog. Every log line goes like this: Nov 6 11:15:31 admin2-desktop syslog-ng[1578]: Error processing log message: <13>Nov 6 11:15:31 admin2-desktop ah: Test4 Does anyone have an idea what to configure with either rsyslog or syslog-ng so the two understand each other? Relevant server side config: source s_all { syslog(ip(172.16.x.x) port(6514) max_connections(50) tls( key_file("/etc/ssl/private/xxx.pem") cert_file("/etc/ssl/private/xxx.pem") ca_dir("/etc/ssl/certs") peer_verify(optional-untrusted) ) ); }; Relevant client side config: $DefaultNetstreamDriverCAFile /etc/ssl/certs/xxx.pem $DefaultNetstreamDriver gtls # use gtls netstream driver $ActionSendStreamDriverMode 1 # require TLS for the connection $ActionSendStreamDriverAuthMode anon # server is NOT authenticated *.* @@(o)mail:6514;RSYSLOG_TraditionalForwardFormat # (o) seems to be neccessary or syslog-ng will not even accept the connection; RSYSLOG_TraditionalForwardFormat apparently doesn't matter Thanks, Andreas

3 7

syslog-ng Insider - November 2012
by Peter Czanik 08 Nov '12

08 Nov '12

Dear syslog-ng users, This is the 18th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com <mailto:documentation@balabit.com> FEATURED NEWS syslog-ng 3.3.7 is released --------------------------- Version 3.3.7 was released last week, right before the “All Saints Day” holidays. It has many fixes for FreeBSD, so it should compile with the bundled ivykis on FreeBSD 8 and 9. Patches to compile it on FreeBSD 7 will also be included in http://www.freshports.org/sysutils/syslog-ng/ Packages for all supported or development versions of openSUSE are also available: https://build.opensuse.org/project/show?project=home%3Aczanik%3Asyslog-ng33 Packages for Debian and Ubuntu are available at http://asylum.madhouse-project.org/projects/debian/ Announcement for 3.3.7: https://lists.balabit.hu/pipermail/syslog-ng/2012-October/019602.html syslog-ng @ conferences ----------------------- syslog-ng was presented at two conferences in October. Fedora users and developers gathered in Paris: https://czanik.blogs.balabit.com/2012/10/fudcon-fedora-and-syslog-ng/ while openSUSE, SLES and Gentoo developers had their conference in Prague at the technical university: https://czanik.blogs.balabit.com/2012/10/osc-opensuse-and-syslog-ng/ syslog-ng 3.4 news ------------------ Many new features were added during the previous month. AMQP destination, syslog parser, a couple of new parsers for patterndb contributed by Evan Rempel and a few more smaller features and fixes. For a complete list check https://github.com/balabit/syslog-ng-3.4/commits/master NEW RELEASES: * syslog-ng OSE 3.3.7: https://lists.balabit.hu/pipermail/syslog-ng/2012-October/019602.html ARCHIVE http://insider.blogs.balabit.com/ -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

Errors building syslog-ng-3.3.7 under FreeBSD 8.3
by C. L. Martinez 08 Nov '12

08 Nov '12

Hi all, I am trying to build syslog-ng 3.3.7 in a FreeBSD 8.3 i386 host, but make returns me these errors: syslog-ng Open Source Edition 3.3.7 configured Compiler options: compiler : gcc -std=gnu99 compiler options : -g -O2 -Wall -pthread -D_REENTRANT -I/usr/local/include/glib-2.0 -I/usr/local/include/eventlog -I/usr/local/include -I/usr/local/include -I$(top_srcdir)/lib/ivykis/lib/include -I$(top_builddir)/lib/ivykis/lib/include -I$(top_srcdir)/lib/ivykis/modules/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : prefix : /data/soft/syslog-ng linking mode : dynamic __thread keyword : yes Submodules: ivykis : internal libmongo-client : internal Features: Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : yes spoof-source support : yes tcp-wrapper support : yes Linux capability support : no PCRE support : yes Env wrapper support : no systemd support : no (unit dir: none) Modules: Module search path : /data/soft/syslog-ng/lib/syslog-ng Default module list : affile,afprog,afsocket,afuser,basicfuncs,csvparser,dbparser,syslogformat Sun STREAMS support (module): no SSL support (module) : yes SQL support (module) : no PACCT module (EXPERIMENTAL) : no MongoDB destination (module): yes JSON support (module) : no (using no) root@fbsd02:/tmp/u/syslog-ng-3.3.7# make make all-recursive Making all in lib "Makefile", line 1101: Need an operator make: fatal errors encountered -- cannot continue *** Error code 1 Stop in /tmp/u/syslog-ng-3.3.7. *** Error code 1 Stop in /tmp/u/syslog-ng-3.3.7 My package list: bison-2.5.1,1 A parser generator from FSF, (mostly) compatible with Yacc compat6x-i386-6.4.604000.200810_3 A convenience package to install the compat6x libraries eventlog-0.2.12 Replacement of the simple syslog() API providing structure flex-2.5.37 Fast lexical analyzer generator gamin-0.1.10_4 A file and directory monitoring system gettext-0.18.1.1 GNU gettext package gio-fam-backend-2.28.8_1 FAM backend for GLib\'s GIO library glib-2.28.8_4 Some useful routines of C programming (current stable versi gmake-3.82_1 GNU version of 'make' utility libee-0.3.2 An event expression library inspired by CEE libestr-0.1.2 A library for some string essentials libiconv-1.14 A character set conversion library libnet11-1.1.2.1_4,1 A C library for creating IP packets libsysinfo-0.0.2 GNU libc's sysinfo port for FreeBSD libtool-2.4.2 Generic shared library support script m4-1.4.16_1,1 GNU m4 openssl-1.0.1_4 SSL and crypto library pcre-8.31 Perl Compatible Regular Expressions library perl-5.14.2_2 Practical Extraction and Report Language pkgconf-0.8.8 pkg-config compatible utility which does not depend on glib python27-2.7.3_3 An interpreted object-oriented programming language

2 3

XML entities in PatternDB
by Martin Holste 08 Nov '12

08 Nov '12

I'm trying to find a way to use non-printable characters to delimit messages to avoid problems with escaping message delimiters. However, I'm having trouble representing any special characters in the patterndb.xml file. Specifically, I'd like to use characters like those found here: http://en.wikipedia.org/wiki/List_of_XML_and_HTML_character_entity_referenc… as U+200C. Trying to use the XML entity name, &zwnj; results in an error: "Entity name \'zwnj\' is not known." Is there a place that lists what entities are allowed in the XML? Thanks, Martin

2 1

Please help me on this error --- syslog-ng[4687]: Connection failed; error='Connection refused (111)', time_reopen='10' I don't see where is the problem
by Jian Zhu 05 Nov '12

05 Nov '12

Hi, Anyone know what does this mean? please help Oct 4 17:02:07 loghost syslog-ng[4687]: Connection failed; error='Connection refused (111)', time_reopen='10' I don't see where is the problem -- *Thanks & Best Regards* *James Zhu* *Mobile**:* *+86 18**6 8482 2818* *Email: *zhujian0805(a)gmail.com

2 2