September 2014 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] Injecting environment variables?
by jetjnkr＠gmail.com 22 Sep '14

22 Sep '14

Balazs, Thanks, do you have any examples in using the backtick it in a message template? Do you have to assign it to a config variable in a "define" first? How much 'earlier' versions of syslog-ng will this work (e.g. before 3.2 ?) Jim. > > > From: Balazs Scheidler <bazsi77(a)gmail.com> > Subject: Re: [syslog-ng] Injecting environment variables? > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu>, wernli(a)in2p3.fr > Message-ID: > <CAKcfE+ZKqqPnPOOSJek81eq_EPa7y3jUrPyKYH94jc3mxvPsmg(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Earlier you could use the backtick env variable format. > > This one is substituted at config parsing. > On Sep 18, 2014 5:26 PM, "Fabien Wernli" <wernli(a)in2p3.fr> wrote: > >> Hi Jim, >> >> As of version 3.5 you can use the `env` template function: >> >> template("<$PRI> $DATE $HOST $MSG $(env <environment-variable>) \n") >> template_escape(no)); >> >> Cheers >> >> >> ______________________________________________________________________________ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: >> http://www.balabit.com/support/documentation/?product=syslog-ng >> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >> >> >

2 1

Re: [syslog-ng] syslog-ng Digest, Vol 113, Issue 9
by jetjnkr＠gmail.com 20 Sep '14

20 Sep '14

Hi Famien, Thanks - just need to get the Ops team to push out 3.5 and I'll give it a shot! Jim. On Sep 19, 2014, at 2:46 AM, syslog-ng-request(a)lists.balabit.hu wrote: > > Date: Thu, 18 Sep 2014 17:26:33 +0200 > From: Fabien Wernli <wernli(a)in2p3.fr> > Subject: Re: [syslog-ng] Injecting environment variables? > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: <20140918152633.GC6867(a)ccfawe.in2p3.fr> > Content-Type: text/plain; charset=us-ascii > > Hi Jim, > > As of version 3.5 you can use the `env` template function: > > template("<$PRI> $DATE $HOST $MSG $(env <environment-variable>) \n") template_escape(no)); > > Cheers > > >

1 0

Injecting environment variables?
by jetjnkr＠gmail.com 20 Sep '14

20 Sep '14

New to the list, but looking for some pointers: It is possible to get shell variables interpreted and defined in the context of the syslog-ng.conf file? I'm trying to get the value from a shell/environment variable to be added to a logged message. I've tried various forms of templates in the destination without much success. template("<$PRI> $DATE $HOST $MSG $someENVvar \n") template_escape(no)); Static text works find, but the var ends up being blank... For reasons I won't belabor, I can't use tags as added by the source. Apologies if this has been covered previous - I didn't see anything from scanning the archives. Thanks. Jim.

3 2

classify/assign events to tenants/customers
by Lucas, Sascha 19 Sep '14

19 Sep '14

Hi, I'm looking for a way to "classify"/assign events to tenants/customers. A tenant/customer can be all events belonging to host or a combination of host/program. I thought patterndb can help doing this. However it seems there is no way? * classification: pattern is per program and limited to the message * correlation: context is limited to one host not many Do I miss something, or are there even better ways? Thanks, Sascha. Aufsichtsratsvorsitzender: Herbert Vogel Geschäftsführung: Michael Krüger Sitz der Gesellschaft: Halle/Saale Registergericht: Amtsgericht Stendal | Handelsregister-Nr. HRB 208414 UST-ID-Nr. DE 158253683 Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Empfänger sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail oder des Inhalts dieser Mail sind nicht gestattet. Diese Kommunikation per E-Mail ist nicht gegen den Zugriff durch Dritte geschützt. Die GISA GmbH haftet ausdrücklich nicht für den Inhalt und die Vollständigkeit von E-Mails und den gegebenenfalls daraus entstehenden Schaden. Sollte trotz der bestehenden Viren-Schutzprogramme durch diese E-Mail ein Virus in Ihr System gelangen, so haftet die GISA GmbH - soweit gesetzlich zulässig - nicht für die hieraus entstehenden Schäden.

3 3

insider 2014-09: 3.6 beta; eCSI; DevOps; anonymization; GSoC;
by Czanik, Péter 19 Sep '14

19 Sep '14

Dear syslog-ng users, This is the 37th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. FEATURED NEWS Beta testing of syslog-ng 3.6 started ------------------------------------- Beta testing period of syslog-ng 3.6 started two weeks ago with a beta1 release. It was quickly followed by a beta2 release, fixing mostly portability. Some of the new features are coming from the syslog-ng incubator, like Riemann support or the graphite template function. The journal source and many enhancements to existing features are coming from the syslog-ng PE team. Also, the @cim prefix can be used as a local "rich" log transport on /dev/log, and messages will be parsed by the JSON parser if available. Beta2 is already available in the FreeBSD ports in sysutils/syslog-ng-devel. For RPM distributions, check https://czanik.blogs.balabit.com/2014/09/journal-source-in-syslog-ng-3-6-be… BalaBit syslog-ng team takes over the syslog-ng OSE development --------------------------------------------------------------- algernon, the full-time syslog-ng OSE developer at BalaBit decided to look for new challenges. First of all, thank you very much for all your hard work, bugfixes nifty new features, and everything else you did for syslog-ng OSE! We all wish you the best, and hope you'll have a great time outside BalaBit as well :) To keep the development, maintenance, and releases of syslog-ng OSE on track, the developer team of syslog-ng Premium Edition will take over the tasks related to syslog-ng OSE: they will manage bugfixes, patches, pull requests, and also the general development of syslog-ng OSE. Naturally, this does not affect the current or future openness of syslog-ng OSE in any way: Your contribution is as welcome as ever. For more details about this change, see algernon's blog post at http://asylum.madhouse-project.org/blog/2014/09/15/looking-ahead/ eCSI training ------------- BalaBit provides now a free training, which provides a fresh insight on logmanagement. The first level introduces the listener to compliance, planning an infrastructure and logs in forensics situations. Once your knowledge is tested, you can go to the next level and learn about IT security and eCSI: http://www.balabit.com/lp/ecsi-training-camp syslog-ng, riemann, collectd-notifications, elasticsearch --------------------------------------------------------- How to build an event-based infrastructure to push structured messages to different subsystems for alerting, reporting and storage. Using syslog-ng, each message is normalized into a structured event, optionally correlated with other messages, and conditionally routed to systems. Read more at: http://devops.com/features/guide-modern-monitoring-alerting/ Data Privacy, Anonymization and Log Data ---------------------------------------- Strong data privacy laws are arriving slowly but surely in Europe, which also affects logging. Raw data contains too much information, on the other hand anonymized data does not have enough information to handle a security incident. Read about a possible solution and how syslog-ng can help at https://jluby.blogs.balabit.com/2014/09/10/data-privacy-anonymization-and-l… Google Summer of Code: success ------------------------------ Google Summer of Code ended a few weeks ago. All of our students successfully completed their projects. We would like to thank for the hard work of students and their mentors, and Google for the opportunity! You can read more about the completed projects at https://www.google-melange.com/gsoc/org2/google/gsoc2014/syslog_ng NEW RELEASES syslog-ng OSE 3.6 beta2: https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-September/000197… syslog-ng PE 5LTS (5.0.6a): https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-September/000196… Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com To read this newsletter on-line, visit: http://insider.blogs.balabit.com/ Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Re: [syslog-ng] classify/assign events to tenants/customers
by Jim Hendrick 18 Sep '14

18 Sep '14

I would try basic filters on host (or netmask) plus facility, priority and if necessary program or "match". Jim Sent from my Verizon Wireless 4G LTE smartphone -------- Original message -------- From: "Lucas, Sascha" <Sascha.Lucas(a)gisa.de> Date:09/18/2014 2:53 AM (GMT-05:00) To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Cc: Subject: [syslog-ng] classify/assign events to tenants/customers Hi, I'm looking for a way to "classify"/assign events to tenants/customers. A tenant/customer can be all events belonging to host or a combination of host/program. I thought patterndb can help doing this. However it seems there is no way? * classification: pattern is per program and limited to the message * correlation: context is limited to one host not many Do I miss something, or are there even better ways? Thanks, Sascha. Aufsichtsratsvorsitzender: Herbert Vogel Geschäftsführung: Michael Krüger Sitz der Gesellschaft: Halle/Saale Registergericht: Amtsgericht Stendal | Handelsregister-Nr. HRB 208414 UST-ID-Nr. DE 158253683 Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Empfänger sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail oder des Inhalts dieser Mail sind nicht gestattet. Diese Kommunikation per E-Mail ist nicht gegen den Zugriff durch Dritte geschützt. Die GISA GmbH haftet ausdrücklich nicht für den Inhalt und die Vollständigkeit von E-Mails und den gegebenenfalls daraus entstehenden Schaden. Sollte trotz der bestehenden Viren-Schutzprogramme durch diese E-Mail ein Virus in Ihr System gelangen, so haftet die GISA GmbH - soweit gesetzlich zulässig - nicht für die hieraus entstehenden Schäden. ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

3.6 beta2 rpm packages, FreeBSD ports
by Czanik, Péter 16 Sep '14

16 Sep '14

Hi, A bit later than usual (I was on sick leave), but my 3.6 beta2 packages are ready for openSUSE/SLES and Fedora/EPEL7. They are available at the usual locations: openSUSE/SLES: https://build.opensuse.org/project/show/home:czanik:syslog-ng36 Fedora/EPEL7: http://copr.fedoraproject.org/coprs/czanik/syslog-ng36/ Thanks to Cy, the sysutils/syslog-ng-devel port in FreeBSD was also updated to the latest beta, while I was unavailable. And this version also works on earlier releases, including FreeBSD 8.4. As usual, these packages are not yet recommended for production use, but any testing and feedback are very welcome! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Help settings regarding Syslog NG
by Simon OBOUNOU 15 Sep '14

15 Sep '14

Hi I need helps regarding setting between syslog ng server and security solutions like checkpoint firewall, stormshield IDS and so one. -- Bien cordialement, Kind Regards HIFA, Chairman 32 rue de la République 92190 MEUDON - FRANCE Phone: +33 1 46 31 44 25 Mobile: +33 6 11 30 36 57 email: simon.obounou(a)hifa.biz

2 1

syslog-ng 3.6.0beta2 has been released
by devel＠balabit.hu 11 Sep '14

11 Sep '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.6.0beta2 SUMMARY : new beta release DATE : Sep 11, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new beta version of syslog-ng Open Source Edition (3.6.0beta2) has been released. Being the - hopefully - last beta release, we would be very grateful for any feedback, to stabilize the release further. CHANGES: 3.6.0beta2 ========== Thu, 11 Sep 2014 13:09:57 +0200 This is the second beta release of the upcoming syslog-ng OSE 3.6 branch. Compared to the previous beta, this release contains a few minor features and bugfixes. We expect the next release to be a release candidate, focusing on stability and bugfixes. Testing is most appreciated! Features -------- * It is now possible to load not only a single certificate when using TLS, but a certificate chain. * The `system()` source will not include `/dev/kmsg` (or `/proc/kmsg`) when running inside a Linux container. Bugfixes -------- * The `in-list()` filter was fixed to look at all elements of the list, instead of only the last one. * Fixed an assertion when using the `match()` filter under certain circumstances. * The `system()` source will not add `/dev/kmsg` (or `/proc/kmsg` on older kernels) to the default sources if using the systemd journal, because kernel logs are included in the journal. Credits ------- syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessary to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Balazs Scheidler, Gergely Nagy, Gyorgy Pasztor, Peter Czanik, Tibor Benke. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.6.0b… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

Re: [syslog-ng] Individual Logs Files to each Forward to Different server/port?
by Jim Hendrick 08 Sep '14

08 Sep '14

Quick thought. Look at filters on the receiving end. Might be easier. Jim Sent from my Verizon Wireless 4G LTE smartphone -------- Original message -------- From: wiskbroom(a)hotmail.com Date:09/05/2014 5:42 PM (GMT-05:00) To: syslog-ng(a)lists.balabit.hu Cc: Subject: [syslog-ng] Individual Logs Files to each Forward to Different server/port? Greetings! Is is possible to configure a syslog-ng client to forward logs to a syslog-ng server based on file? I am thinking of the following as an example: destination named-LOGS { udp(ip(192.168.1.100) port(555)); }; source named { file("/var/log/named/bind.log" log_prefix("BIND-LOGS")); }; log { source(named); destination(named-LOGS); }; destination dhcpd-LOGS { udp(ip(192.168.1.100) port(556)); }; source dhcpd { file("/var/log/dhcpd/dhcp.log" log_prefix("DHCPD-LOGS")); }; log { source(dhcpd); destination(dhcpd-LOGS); }; In this example, I am sending each to the same destination IP address, although that is configurable, but each log file to a different port, and with a different log_prefix as well. Does this OK,or is their a simpler way? Many thanks, .vp Vadim Anatoly Pushkin -- The Ukranian Stallion --

2 2