September 2014 - syslog-ng - lists.balabit.hu

Syslog proxy/relay encapsulates
by Michael Yacc 07 Sep '14

07 Sep '14

Dear all, I'm trying to configure syslog-ng as relay/proxy server. Seems to be simple, but syslog server recieves encapsulated original syslog messages within outgoing "syslog-relay" messages. Is there any way to configure syslog-ng (relay) to just forward orignal messages to syslog server? Syslog-ng version used: 3.3.9 *syslog-client$* logger "hello from syslog client" on syslog-relay I added the following configuration: ######## sources ############### source s_relay_port { udp(ip(0.0.0.0) port(514)); }; ######## destinations ############### destination d_syslog_server { syslog("syslog-server" transport("udp") port(514)); }; ######## logging ############### log { source(s_relay_port); destination(d_syslog_server); }; *syslog-server$* tail -F /var/log/syslog Sep 6 23:53:28 syslog-relay-ip 1 2014-09-06T23:53:28+03:00 syslog-client-ip 1 - - - 2014-09-06T23:53:28+03:00 syslog-client-hostname root - - [meta sequenceId="38"] hello from syslog client With best regards, Michael Yacc

2 1

Individual Logs Files to each Forward to Different server/port?
by wiskbroom＠hotmail.com 05 Sep '14

05 Sep '14

Greetings! Is is possible to configure a syslog-ng client to forward logs to a syslog-ng server based on file? I am thinking of the following as an example: destination named-LOGS { udp(ip(192.168.1.100) port(555)); }; source named { file("/var/log/named/bind.log" log_prefix("BIND-LOGS")); }; log { source(named); destination(named-LOGS); }; destination dhcpd-LOGS { udp(ip(192.168.1.100) port(556)); }; source dhcpd { file("/var/log/dhcpd/dhcp.log" log_prefix("DHCPD-LOGS")); }; log { source(dhcpd); destination(dhcpd-LOGS); }; In this example, I am sending each to the same destination IP address, although that is configurable, but each log file to a different port, and with a different log_prefix as well. Does this OK,or is their a simpler way? Many thanks, .vp Vadim Anatoly Pushkin -- The Ukranian Stallion --

1 0

syslog-ng 3.6.0beta1 has been released
by devel＠balabit.hu 05 Sep '14

05 Sep '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.6.0beta1 SUMMARY : new beta release DATE : Sep 5, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.6.0beta1) has been released. Being the first beta release, we would be very grateful for any feedback, to stabilize the release further. CHANGES: 3.6.0beta1 Wed, 3 Sep 2014 14:40:14 +0200 This is the first beta release of the upcoming syslog-ng OSE 3.6 branch. Compared to the alphas, this release contains a moderate amount of new functionality and bugfixes. Further releases will focus on stability and bugfixes. Features -------- * One can now use multiple elements in the `key()` and `exclude()` options of any value-pairs declaration. * A new source driver was added to the syslog-ng: `systemd-journal()`, which reads from the Journal directly, not via the syslog forwarding socket. The `system()` source defaults to using this source when systemd is detected. Bugfixes -------- * All the various crypto-related template functions now check that the desired length of the digest is not larger than the digest itself. If a larger value is requested, they will truncate it to the digest length. * The `$(geoip)` template function now works with `threaded(yes)` too. * The unix domain socket credentials code was changed to only build on Linux and FreeBSD. With this change, syslog-ng should compile again on platforms where the OS does not support this, with the feature disabled. Credits ------- syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessary to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Fabien Wernli, Gergely Nagy, Laszlo Budai, Michael Hocke, Tibor Benke, Viktor Juhasz, Viktor Tusa. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.6.0b… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

3.6beta1 packages for openSUSE
by Czanik, Péter 04 Sep '14

04 Sep '14

Hi, My initial 3.6beta1 pacages for openSUSE and SLES 11 are ready. There was a change in systemd packaging in Factory, that I still need to figure out. I tested the new package on openSUSE 13.1 and even tested it by disabling syslog compatibility in /etc/systemd/journald.conf, and the brand new journal source seems to work fine. If you run (open)SUSE, please give these packages a try, and let us know, if you run into any trouble! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

2 1

3.6beta1 packages for Fedora/EPEL
by Czanik, Péter 04 Sep '14

04 Sep '14

Hi, http://copr.fedoraproject.org/coprs/czanik/syslog-ng36/ I prepared packages from 3.6beta1 for all recent Fedora releases and for EPEL7. I only tested on rawhide, as there syslog compatibility is disabled in journal by default and beta1 already has a journal source. I did some basic tests, and it worked fine. Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0