July 2013 - syslog-ng - lists.balabit.hu

Time zone problem in Mongodb driver
by Kyaw Kyi 25 Jul '13

25 Jul '13

Hi, I tried to use time_zone() option in mongodb destination driver but it is throwing an error. Error parsing afmongodb, syntax error, unexpected KW_TIME_ZONE, expecting ')' in /usr/local/etc/syslog-ng.conf at line 60, column 2: time_zone("America/New_York") It doesn't seem to a syntax error. It seems more like syslog-ng doesn't understand the time_zone() option in mongodb driver. This is my configuration: @version: 3.4 @include "scl.conf" options { ts_format(iso) ; keep_hostname(yes); keep_timestamp(yes); time_reopen(10); }; destination d_mongodb1 { mongodb( time_zone("America/New_York") ); }; I tried using ("-04:00") instead but no avail. Mongodb destination driver is working well without the time_zone() option. Thanks, Joe ------------------------------------------------------------------------------ Please consider the environment before printing this email. Visit our website at http://www.nyse.com <http://www.nyse.com> ***************************************************************************** Note: The information contained in this message and any attachment to it is privileged, confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately by replying to the message, and please delete it from your system. Thank you. NYSE Euronext.

4 5

XMPP destination for syslog-ng
by IKAC 23 Jul '13

23 Jul '13

Hi, My name is Ilija, and I'm a undergraduate student of computer science. I'm interested if this project is open for contribution apart from GSOC, since as I saw that there is no activity on it's github repository? Best regards, Ilija

5 5

AUTO: James B Horwath is out of the office (returning 07/29/2013)
by James B Horwath 20 Jul '13

20 Jul '13

I am out of the office until 07/29/2013. I will be out of the office until 07/29/2013 with limited access to e-mail. If you have an urgent issue please contact Sunil Gupta at (610)-807-6710 or Dylan Yoder at (610)-807-7230. Regards Jim Horwath IT Security Services & Governance, Corporate BTS and IT Security/Risk Tel 610-807-8795 Mobile 610-533-6972 3900 Burgess Place, Bethlehem, Pa. 18017 Jim_Horwath(a)glic.com Note: This is an automated response to your message "syslog-ng Digest, Vol 99, Issue 20" sent on 7/20/2013 6:00:02. This is the only notification you will receive while this person is away. ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

1 0

Help getting my rewrite to work
by Dave Vernon 19 Jul '13

19 Jul '13

Good morning all, I'm having difficulties getting my rewrite statement to work properly. I've been spending more hours than I care to admit pouring through docs, examples, etc and just can't get it. (I really thought I was on the right track from a post in the May archives) In short, I am using syslog-ng 3.4.2 to receive my Windows event logs. There are several common Windows events that includes a detailed description of the event EVERY TIME that I am trying to drop before writing to my syslog server, leaving just the meat. I originally wanted to start my testing by replacing a single word (i.e. the word "interactive" so that I could make sure the re-write rule was working before I tweaked my regex.) However, whenever I add my rule it's not logging any event that matches at all, and I'm not sure why. I'm doing a tail on the log file and it just doesn't write (literally) anything at all. My examples... source s_syslog { udp(ip(0.0.0.0) port(514)); }; destination d_allwindows { file("/syslog/log/windows/hosts/$HOST/$R_YEAR/$R_MONTH/$R_DAY/$HOST$YEAR$MONTH$DAY" create_dirs(yes)); }; rewrite r_rewrite_4624_2 { subst("interactive", "QuackApple", value("MSGONLY"));}; ("interactive" is contained in the message, so it was an easy one to pickout for testing, and I used the string "QuackApple" as the replacement as I know it won't naturally appear, so I can search on it easily) log { source(s_syslog); filter(f_allwindows); rewrite(r_rewrite_4624_2); destination(d_allwindows); }; With these rules in place, the log is actually dropped, not re-written. If I change my rewrite rule to be something not found (i.e. replace "interactive" with "ZZowkr" then the events start showing up in the tail again) Thanks! Dave Vernon

2 2

[Bug 239] New: syslog-ng refuses to allow 'Common Name' CN wildcards
by bugzilla＠bugzilla.balabit.com 11 Jul '13

11 Jul '13

https://bugzilla.balabit.com/show_bug.cgi?id=239 Summary: syslog-ng refuses to allow 'Common Name' CN wildcards Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Windows Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: shawn.starr(a)statpro.com Type of the Report: bug Estimated Hours: 0.0 Distribution package version: 3.3.4.dfsg-2ubuntu1 (3.3.4) When attempting to use the following configuration: source system_stuff { system(); }; destination dest_kern { tcp("192.168.70.4" port(514) tls( #peer-verify(optional-untrusted) peer-verify(required-trusted) cipher_suite("AES256-SHA") trusted_dn("*, O=MyCompany Name, L=Toronto, ST=Ontario, C=CA") cert_file("/etc/syslog-ng/certs/genericServer.crt") ca_dir("/etc/syslog-ng/ca")) ); }; log { source(system_stuff); destination(dest_kern); }; Jul 9 12:20:01 testad syslog-ng[12607]: Certificate subject does not match configured hostname; hostname='192.168.70.4', certificate='*.dev.company.com' When trying to use trusted_tn("CN=*.dev.company.com, O=MyCompany Name, L=Toronto, ST=Ontario, C=CA) it then shows: Jul 9 11:21:20 testad syslog-ng[12473]: Certificate valid, but DN constraints were not met, rejecting; If I read this right, CN is provided (as per default CA policy) but we should be able to match hosts to the wildcard. Similar to what rsyslog has: http://www.rsyslog.com/doc/tls_cert_server.html I don't know if this also happens in 3.5.x but I can test this on my Fedora systems at home -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

Re: [syslog-ng] syslog-ng Digest, Vol 99, Issue 9
by Yarick Tsagoyko 11 Jul '13

11 Jul '13

Dear Satish, multiline is supported in open source version of syslog-ng, as bazsi wrote. To glue the lines together, into one line you can do one of two things. First, configure syslog-ng not to break messages into separate lines, by disabling native multiline support. Second, define a pattern that identifies the beginning of a new line. I encourage you to read the manual prior to engaging entire list to solve your issue, which is clearly not an issue with the way code is written. Thanks. Y. This is my source declaration and i have put flags which you have mentioned. source s_tomcat { syslog( transport("udp") flags(indent-multi-line)); }; I got following error when i am trying to put flags Error parsing afsocket, Unknown flag indent-multi-line in /usr/local/syslog-ng-3.4.2/etc/syslog-ng.conf at line 54, column 33: syslog( transport("udp") flags(indent-multi-line) ); On Thu, Jul 11, 2013 at 10:22 AM, <syslog-ng-request(a)lists.balabit.hu>wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Re: Multi-line support issue (Balazs Scheidler) > 2. Re: Multi-line support issue (Satish Patel) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 11 Jul 2013 13:53:56 +0200 > From: Balazs Scheidler <bazsi(a)balabit.hu> > Subject: Re: [syslog-ng] Multi-line support issue > To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> > Message-ID: <1373543636.3171.17.camel@bzorp> > Content-Type: text/plain; charset="UTF-8" > > > I can't see the source declaration, it must be something along the lines > of: > > source s_tomcat { > file("/var/log/tomcat/xxx.log" flags(indent-multi-line)); > }; > > On Wed, 2013-07-10 at 12:54 -0400, Satish Patel wrote: > > Hi Balazs, > > > > > > what is your thought about my config? did you see? > > > > > > > > On Mon, Jul 8, 2013 at 12:30 PM, Satish Patel <satish.txt(a)gmail.com> > > wrote: > > This is what i have configured and no luck with it.. can you > > suggest what i am missing? > > > > destination d02_tc74_log > > { file("/logs/server1/tomcat7.4/catalina_$YEAR$MONTH$DAY.log" > > template("$(indent-multi-line ${MESSAGE})\n") > > template(t_tomcatlog) owner("root") group("root") perm(0644) > > dir_perm(0755) create_dirs(yes)); }; > > filter server1 { host("server1.example.com") }; > > log { > > source (s_tomcat); > > filter (server1); > > filter (tomcat7_4); > > destination (d02_tc74_log); > > }; > > > > > > > > > > On Mon, Jul 8, 2013 at 12:08 PM, Satish Patel > > <satish.txt(a)gmail.com> wrote: > > How do i use indented-multi-line ? I meant where do i > > configure it? I tried but my syslog-ng doesn't > > recognizing this option i have syslog-ng 3.3.7 could > > you give me example where and how do i check whether > > it is supported or not > > > > > > > > On Sat, Jul 6, 2013 at 2:12 AM, Balazs Scheidler > > <bazsi77(a)gmail.com> wrote: > > This looks.like the format that should be > > supported by indented-multi-line > > > > On Jul 5, 2013 9:33 PM, "Satish Patel" > > <satish.txt(a)gmail.com> wrote: > > Here is my tomcat catalina.out log > > file sample. See there is a tab space > > in logs > > > > 2013-06-27 05:30:00,065 > > [EDISN-Scheduler_Worker-2] ERROR > > com.example.edisn.sftp.SftpSession - > > Exception attempting to work with an > > SFTP Session: connection is closed by > > foreign host > > 2013-06-27 05:30:00,066 > > [EDISN-Scheduler_Worker-2] ERROR > > org.quartz.core.JobRunShell - Job > > EDISN.CTMS_Upload threw an unhandled > > Exception: > > com.example.edisn.EdisnRuntimeException: > Exception attempting to work with an SFTP Session: connection is closed by > foreign host > > at > > > com.example.edisn.sftp.SftpSession.doSession(SftpSession.java:64) > > at > > > com.example.edisn.EdisnSession.exec(EdisnSession.java:13) > > at > > > com.example.ctms.CtmsScheduledJob.executeInternal(CtmsScheduledJob.java:27) > > at > > > org.springframework.scheduling.quartz.QuartzJobBean.execute(QuartzJobBean.java:86) > > at > > > org.quartz.core.JobRunShell.run(JobRunShell.java:202) > > at > > org.quartz.simpl.SimpleThreadPool > > > $WorkerThread.run(SimpleThreadPool.java:525) > > Caused by: > > com.jcraft.jsch.JSchException: > > connection is closed by foreign host > > at > > com.jcraft.jsch.Session.connect(Unknown > Source) > > at > > com.jcraft.jsch.Session.connect(Unknown > Source) > > at > > > com.example.edisn.sftp.SftpSession.doSession(SftpSession.java:45) > > ... 5 more > > > > > > > > > > On Fri, Jul 5, 2013 at 3:27 PM, Balazs > > Scheidler <bazsi77(a)gmail.com> wrote: > > No, I implemented a different > > multiline style support first > > (that is not in pe), where > > continuation lines are > > indicated by indentation, like > > mime. > > > > Iirc tomcat has this kind of > > log file. Can you show a > > sample log entry? > > > > The infrastructure for > > multiline-prefix is also there > > but not added yet. > > > > Let me see the sample, I'll > > tell if the current solution > > works or not. > > > > On Jul 5, 2013 8:24 PM, > > "Satish Patel" > > <satish.txt(a)gmail.com> wrote: > > Thanks for reply > > Balazs, > > > > > > You mean say this > > feature is available > > in Open Source Edition > > (OSE) 3.4? Once after > > specifying flag > > "indented-multi-line" > > i can use > > multi-line-prefix? > > > > > > > > On Fri, Jul 5, 2013 at > > 1:26 PM, Balazs > > Scheidler > > <bazsi77(a)gmail.com> > > wrote: > > You have found > > the PE > > documentation > > but I have > > already ported > > this to the > > OSE tree and > > has been > > released as > > part of 3.4. > > > > You have to > > specify > > > indented-multi-line as a flag to the file source. > > > > On Jul 5, 2013 > > 6:28 PM, > > "Satish Patel" > > < > satish.txt(a)gmail.com> wrote: > > > > We > > have > > tomcat > > shop > > and at > > everyone > know tomcat has a java call trace in logs with tab space but syslog-ng > doesn't know about it and printing lines as a new line. I have read here > syslog-ng 3.x does support multi-line logs > http://www.balabit.com/sites/default/files/documents/syslog-ng-pe-4.0-guide… > > > > > > But > > does > > this > > feature > available in Open Source syslog-ng? If yes then why its not working for me? > > > > > > > > > ______________________________________________________________________________ > > Member > > info: > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: > > > http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > ______________________________________________________________________________ > > Member info: > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: > > > http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > > > > > ______________________________________________________________________________ > > Member info: > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: > > > http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > ______________________________________________________________________________ > > Member info: > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: > > > http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > > > > > ______________________________________________________________________________ > > Member info: > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: > > > http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > ______________________________________________________________________________ > > Member info: > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > > > > > > > > > > > ______________________________________________________________________________ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > ------------------------------ > > Message: 2 > Date: Thu, 11 Jul 2013 10:22:45 -0400 > From: Satish Patel <satish.txt(a)gmail.com> > Subject: Re: [syslog-ng] Multi-line support issue > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <CAPgF-fpPdRswwj2HNUXAxfgRekHVhwwF6O= > 7N39q9mfggN-nUQ(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > This is my source declaration and i have put flags which you have > mentioned. > > source s_tomcat { > syslog( transport("udp") flags(indent-multi-line)); > }; > > I got following error when i am trying to put flags > > Error parsing afsocket, Unknown flag indent-multi-line in > /usr/local/syslog-ng-3.4.2/etc/syslog-ng.conf at line 54, column 33: > > syslog( transport("udp") flags(indent-multi-line) ); > ^^^^^^^^^^^^^^^^^ > > > > > On Thu, Jul 11, 2013 at 7:53 AM, Balazs Scheidler <bazsi(a)balabit.hu> > wrote: > > > > > I can't see the source declaration, it must be something along the lines > > of: > > > > source s_tomcat { > > file("/var/log/tomcat/xxx.log" flags(indent-multi-line)); > > }; > > > > On Wed, 2013-07-10 at 12:54 -0400, Satish Patel wrote: > > > Hi Balazs, > > > > > > > > > what is your thought about my config? did you see? > > > > > > > > > > > > On Mon, Jul 8, 2013 at 12:30 PM, Satish Patel <satish.txt(a)gmail.com> > > > wrote: > > > This is what i have configured and no luck with it.. can you > > > suggest what i am missing? > > > > > > destination d02_tc74_log > > > { file("/logs/server1/tomcat7.4/catalina_$YEAR$MONTH$DAY.log" > > > template("$(indent-multi-line ${MESSAGE})\n") > > > template(t_tomcatlog) owner("root") group("root") perm(0644) > > > dir_perm(0755) create_dirs(yes)); }; > > > filter server1 { host("server1.example.com") }; > > > log { > > > source (s_tomcat); > > > filter (server1); > > > filter (tomcat7_4); > > > destination (d02_tc74_log); > > > }; > > > > > > > > > > > > > > > On Mon, Jul 8, 2013 at 12:08 PM, Satish Patel > > > <satish.txt(a)gmail.com> wrote: > > > How do i use indented-multi-line ? I meant where do i > > > configure it? I tried but my syslog-ng doesn't > > > recognizing this option i have syslog-ng 3.3.7 could > > > you give me example where and how do i check whether > > > it is supported or not > > > > > > > > > > > > On Sat, Jul 6, 2013 at 2:12 AM, Balazs Scheidler > > > <bazsi77(a)gmail.com> wrote: > > > This looks.like the format that should be > > > supported by indented-multi-line > > > > > > On Jul 5, 2013 9:33 PM, "Satish Patel" > > > <satish.txt(a)gmail.com> wrote: > > > Here is my tomcat catalina.out log > > > file sample. See there is a tab space > > > in logs > > > > > > 2013-06-27 05:30:00,065 > > > [EDISN-Scheduler_Worker-2] ERROR > > > com.example.edisn.sftp.SftpSession - > > > Exception attempting to work with an > > > SFTP Session: connection is closed by > > > foreign host > > > 2013-06-27 05:30:00,066 > > > [EDISN-Scheduler_Worker-2] ERROR > > > org.quartz.core.JobRunShell - Job > > > EDISN.CTMS_Upload threw an unhandled > > > Exception: > > > > com.example.edisn.EdisnRuntimeException: > > Exception attempting to work with an SFTP Session: connection is closed > by > > foreign host > > > at > > > > > com.example.edisn.sftp.SftpSession.doSession(SftpSession.java:64) > > > at > > > > > com.example.edisn.EdisnSession.exec(EdisnSession.java:13) > > > at > > > > > > com.example.ctms.CtmsScheduledJob.executeInternal(CtmsScheduledJob.java:27) > > > at > > > > > > org.springframework.scheduling.quartz.QuartzJobBean.execute(QuartzJobBean.java:86) > > > at > > > > > org.quartz.core.JobRunShell.run(JobRunShell.java:202) > > > at > > > org.quartz.simpl.SimpleThreadPool > > > > > $WorkerThread.run(SimpleThreadPool.java:525) > > > Caused by: > > > com.jcraft.jsch.JSchException: > > > connection is closed by foreign host > > > at > > > com.jcraft.jsch.Session.connect(Unknown > > Source) > > > at > > > com.jcraft.jsch.Session.connect(Unknown > > Source) > > > at > > > > > com.example.edisn.sftp.SftpSession.doSession(SftpSession.java:45) > > > ... 5 more > > > > > > > > > > > > > > > On Fri, Jul 5, 2013 at 3:27 PM, Balazs > > > Scheidler <bazsi77(a)gmail.com> wrote: > > > No, I implemented a different > > > multiline style support first > > > (that is not in pe), where > > > continuation lines are > > > indicated by indentation, like > > > mime. > > > > > > Iirc tomcat has this kind of > > > log file. Can you show a > > > sample log entry? > > > > > > The infrastructure for > > > multiline-prefix is also there > > > but not added yet. > > > > > > Let me see the sample, I'll > > > tell if the current solution > > > works or not. > > > > > > On Jul 5, 2013 8:24 PM, > > > "Satish Patel" > > > <satish.txt(a)gmail.com> wrote: > > > Thanks for reply > > > Balazs, > > > > > > > > > You mean say this > > > feature is available > > > in Open Source Edition > > > (OSE) 3.4? Once after > > > specifying flag > > > "indented-multi-line" > > > i can use > > > multi-line-prefix? > > > > > > > > > > > > On Fri, Jul 5, 2013 at > > > 1:26 PM, Balazs > > > Scheidler > > > <bazsi77(a)gmail.com> > > > wrote: > > > You have found > > > the PE > > > documentation > > > but I have > > > already ported > > > this to the > > > OSE tree and > > > has been > > > released as > > > part of 3.4. > > > > > > You have to > > > specify > > > > > indented-multi-line as a flag to the file source. > > > > > > On Jul 5, 2013 > > > 6:28 PM, > > > "Satish Patel" > > > < > > satish.txt(a)gmail.com> wrote: > > > > > > We > > > have > > > tomcat > > > shop > > > and at > > > > everyone > > know tomcat has a java call trace in logs with tab space but syslog-ng > > doesn't know about it and printing lines as a new line. I have read here > > syslog-ng 3.x does support multi-line logs > > > http://www.balabit.com/sites/default/files/documents/syslog-ng-pe-4.0-guide… > > > > > > > > > But > > > does > > > this > > > feature > > available in Open Source syslog-ng? If yes then why its not working for > me? > > > > > > > > > > > > > > > ______________________________________________________________________________ > > > Member > > > info: > > > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > > Documentation: > > http://www.balabit.com/support/documentation/?product=syslog-ng > > > FAQ: > > > > > http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > > > > > > > ______________________________________________________________________________ > > > Member info: > > > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Documentation: > > > > > http://www.balabit.com/support/documentation/?product=syslog-ng > > > FAQ: > > > > > http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > > > > > > > > > > > > > ______________________________________________________________________________ > > > Member info: > > > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Documentation: > > > > > http://www.balabit.com/support/documentation/?product=syslog-ng > > > FAQ: > > > > > http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > > > > > > > ______________________________________________________________________________ > > > Member info: > > > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Documentation: > > > > > http://www.balabit.com/support/documentation/?product=syslog-ng > > > FAQ: > > > > > http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > > > > > > > > > > > > > ______________________________________________________________________________ > > > Member info: > > > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Documentation: > > > > > http://www.balabit.com/support/documentation/?product=syslog-ng > > > FAQ: > > > > > http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > > > > > > > ______________________________________________________________________________ > > > Member info: > > > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Documentation: > > > > > http://www.balabit.com/support/documentation/?product=syslog-ng > > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > ______________________________________________________________________________ > > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Documentation: > > http://www.balabit.com/support/documentation/?product=syslog-ng > > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > > > > > > ______________________________________________________________________________ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > >

1 0

iv_port_poll socket operation on non-socket -- syslog-ng 3.3.7 Solaris 10 opterron
by Rakesh Rajasekharan 09 Jul '13

09 Jul '13

Hello everyone, I am using syslog-ng 3.3.7 compiled on solaris 10 opteron. When I try to run the daemon I get this error.. "iv_port_poll socket operation on non-socket". But this same binary works fine on Soalris 11 opteron. Any ideas on this please, why the error comes...? Thanks, Rakesh.

1 0

IPv6 TLS source question
by Jeff Lange 05 Jul '13

05 Jul '13

I'm attempting to setup a TCP IPv6 source declaration that uses TLS but syslog-ng is not happy with the configuration file. The following is what I use for IPv4 and it works fine: source s_tls { syslog( ip(0.0.0.0) port(6514) transport( "tls" ) tls ( key_file("/srv/syslog-ng/certs/priv-key.pem") cert_file("/srv/syslog-ng/certs/id-cert.pem") ca_dir("/srv/syslog-ng/certs") cipher_suite("SHA256:!aNULL:!eNULL:!ECDH:!DSS") ) ); }; However the following is not valid: source s_tls6 { syslog( ip("::") port(6515) transport( "tls" ) tls ( key_file("/srv/syslog-ng/certs/priv-key.pem") cert_file("/srv/syslog-ng/certs/id-cert.pem") ca_dir("/srv/syslog-ng/certs") cipher_suite("SHA256:!aNULL:!eNULL:!ECDH:!DSS") ) ); }; I've tried the ip with and without quotes with no luck. What am I doing wrong? Thanks -Jeff

3 4

[GSoC2013][syslog-ng:MySQL destination] Status update
by Gyula Petrovics 04 Jul '13

04 Jul '13

Hello, I published a new status update on my blog http://petrovicsgyula.blogspot.hu/ , and some source code on github https://github.com/gyula/mysqlclient/. Best regards, Gyula

1 0

Upcoming changes regarding my Debian/Ubuntu packages
by Gergely Nagy 04 Jul '13

04 Jul '13

Hi! For a good while now, I've been providing Debian and Ubuntu packages[1] for syslog-ng, and rest assured, I will continue to do so. However, the way they are prepared and how the repository is structured, will change. At the moment, there are two different components one can choose from: syslog-ng and syslog-ng-devel, which have packages for 3.3 and 3.4, respectively. However, -devel is not appropriate for 3.4 anymore, but I don't want to move it to syslog-ng either, partly because up to this point, there were no Ubuntu Lucid packages of 3.4. So, I will be making the following changes: * I'll create syslog-ng-3.3, syslog-ng-3.4 and syslog-ng-3.5 components * syslog-ng will point to the latest stable branch (3.4) * syslog-ng will point to the current development branch (3.5) * I'll be preparing Ubuntu Lucid packages for 3.4 too, so all branches will be available for every debian or ubuntu system that are still supported by their respective vendors. To be able to provide Ubuntu Lucid (10.04) packages sanely, I have to do the packaging a little bit differently: the source package will not be shared between debian and ubuntu anymore, and systemd support will be explicitly disabled on Ubuntu. But since Ubuntu uses upstart by default, ubuntu systems with systemd are fairly unlikely anyway. I plan to make these changes once 3.4.2 comes out. Until then, I'll introduce the syslog-ng-3.3 and -3.4 components, but syslog-ng will point to -3.3 still, and -devel to -3.4. Once 3.4.2 is out, though, I'll change the symlinks. [1]: http://asylum.madhouse-project.org/projects/debian/ -- |8]

1 2