October 2015 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] syslog-ng 3.7.1 OSE compile error
by Ho, Ming 21 Oct '15

21 Oct '15

Hi Tibor, Below is the output. It seems only the last few lines related to eventlog # pkg-config --debug eventlog Option --debug seen Error printing disabled by default, value of --print-errors: 0 Error printing disabled Adding virtual 'pkg-config' package to list of known packages Scanning directory '/usr/lib64/pkgconfig' File 'xpyb.pc' appears to be a .pc file Will find package 'xpyb' in file '/usr/lib64/pkgconfig/xpyb.pc' File 'pangox.pc' appears to be a .pc file Will find package 'pangox' in file '/usr/lib64/pkgconfig/pangox.pc' File 'atk.pc' appears to be a .pc file Will find package 'atk' in file '/usr/lib64/pkgconfig/atk.pc' File 'gdk-pixbuf-xlib-2.0.pc' appears to be a .pc file Will find package 'gdk-pixbuf-xlib-2.0' in file '/usr/lib64/pkgconfig/gdk-pixbuf-xlib-2.0.pc' File 'gtk+-x11-2.0.pc' appears to be a .pc file Will find package 'gtk+-x11-2.0' in file '/usr/lib64/pkgconfig/gtk+-x11-2.0.pc' File 'xcomposite.pc' appears to be a .pc file Will find package 'xcomposite' in file '/usr/lib64/pkgconfig/xcomposite.pc' File 'xcb-shm.pc' appears to be a .pc file Will find package 'xcb-shm' in file '/usr/lib64/pkgconfig/xcb-shm.pc' File 'gail.pc' appears to be a .pc file Will find package 'gail' in file '/usr/lib64/pkgconfig/gail.pc' File 'cairo-ft.pc' appears to be a .pc file Will find package 'cairo-ft' in file '/usr/lib64/pkgconfig/cairo-ft.pc' File 'xcb-xprint.pc' appears to be a .pc file Will find package 'xcb-xprint' in file '/usr/lib64/pkgconfig/xcb-xprint.pc' File 'gmodule-export-2.0.pc' appears to be a .pc file Will find package 'gmodule-export-2.0' in file '/usr/lib64/pkgconfig/gmodule-export-2.0.pc' File 'cairo-xlib-xrender.pc' appears to be a .pc file Will find package 'cairo-xlib-xrender' in file '/usr/lib64/pkgconfig/cairo-xlib-xrender.pc' File 'xcb-xvmc.pc' appears to be a .pc file Will find package 'xcb-xvmc' in file '/usr/lib64/pkgconfig/xcb-xvmc.pc' File 'gio-unix-2.0.pc' appears to be a .pc file Will find package 'gio-unix-2.0' in file '/usr/lib64/pkgconfig/gio-unix-2.0.pc' File 'gmodule-no-export-2.0.pc' appears to be a .pc file Will find package 'gmodule-no-export-2.0' in file '/usr/lib64/pkgconfig/gmodule-no-export-2.0.pc' File 'xcb-xfixes.pc' appears to be a .pc file Will find package 'xcb-xfixes' in file '/usr/lib64/pkgconfig/xcb-xfixes.pc' File 'xft.pc' appears to be a .pc file Will find package 'xft' in file '/usr/lib64/pkgconfig/xft.pc' File 'gtk+-unix-print-2.0.pc' appears to be a .pc file Will find package 'gtk+-unix-print-2.0' in file '/usr/lib64/pkgconfig/gtk+-unix-print-2.0.pc' File 'xau.pc' appears to be a .pc file Will find package 'xau' in file '/usr/lib64/pkgconfig/xau.pc' File 'xcb-screensaver.pc' appears to be a .pc file Will find package 'xcb-screensaver' in file '/usr/lib64/pkgconfig/xcb-screensaver.pc' File 'libpng12.pc' appears to be a .pc file Will find package 'libpng12' in file '/usr/lib64/pkgconfig/libpng12.pc' File 'fontconfig.pc' appears to be a .pc file Will find package 'fontconfig' in file '/usr/lib64/pkgconfig/fontconfig.pc' File 'freetype2.pc' appears to be a .pc file Will find package 'freetype2' in file '/usr/lib64/pkgconfig/freetype2.pc' File 'xcb-damage.pc' appears to be a .pc file Will find package 'xcb-damage' in file '/usr/lib64/pkgconfig/xcb-damage.pc' File 'x11-xcb.pc' appears to be a .pc file Will find package 'x11-xcb' in file '/usr/lib64/pkgconfig/x11-xcb.pc' File 'xrandr.pc' appears to be a .pc file Will find package 'xrandr' in file '/usr/lib64/pkgconfig/xrandr.pc' File 'xcb-xevie.pc' appears to be a .pc file Will find package 'xcb-xevie' in file '/usr/lib64/pkgconfig/xcb-xevie.pc' File 'gtk+-2.0.pc' appears to be a .pc file Will find package 'gtk+-2.0' in file '/usr/lib64/pkgconfig/gtk+-2.0.pc' File 'xcb-shape.pc' appears to be a .pc file Will find package 'xcb-shape' in file '/usr/lib64/pkgconfig/xcb-shape.pc' File 'cairo-png.pc' appears to be a .pc file Will find package 'cairo-png' in file '/usr/lib64/pkgconfig/cairo-png.pc' File 'xcb-randr.pc' appears to be a .pc file Will find package 'xcb-randr' in file '/usr/lib64/pkgconfig/xcb-randr.pc' File 'xcb-dri2.pc' appears to be a .pc file Will find package 'xcb-dri2' in file '/usr/lib64/pkgconfig/xcb-dri2.pc' File 'xfixes.pc' appears to be a .pc file Will find package 'xfixes' in file '/usr/lib64/pkgconfig/xfixes.pc' File 'pangocairo.pc' appears to be a .pc file Will find package 'pangocairo' in file '/usr/lib64/pkgconfig/pangocairo.pc' File 'xcb-render.pc' appears to be a .pc file Will find package 'xcb-render' in file '/usr/lib64/pkgconfig/xcb-render.pc' File 'xcb-sync.pc' appears to be a .pc file Will find package 'xcb-sync' in file '/usr/lib64/pkgconfig/xcb-sync.pc' File 'xcb-xtest.pc' appears to be a .pc file Will find package 'xcb-xtest' in file '/usr/lib64/pkgconfig/xcb-xtest.pc' File 'xinerama.pc' appears to be a .pc file Will find package 'xinerama' in file '/usr/lib64/pkgconfig/xinerama.pc' File 'xcb-record.pc' appears to be a .pc file Will find package 'xcb-record' in file '/usr/lib64/pkgconfig/xcb-record.pc' File 'gdk-2.0.pc' appears to be a .pc file Will find package 'gdk-2.0' in file '/usr/lib64/pkgconfig/gdk-2.0.pc' File 'xcb.pc' appears to be a .pc file Will find package 'xcb' in file '/usr/lib64/pkgconfig/xcb.pc' File 'pixman-1.pc' appears to be a .pc file Will find package 'pixman-1' in file '/usr/lib64/pkgconfig/pixman-1.pc' File 'pangoxft.pc' appears to be a .pc file Will find package 'pangoxft' in file '/usr/lib64/pkgconfig/pangoxft.pc' File 'gmodule-2.0.pc' appears to be a .pc file Will find package 'gmodule-2.0' in file '/usr/lib64/pkgconfig/gmodule-2.0.pc' File 'xcursor.pc' appears to be a .pc file Will find package 'xcursor' in file '/usr/lib64/pkgconfig/xcursor.pc' File 'xcb-res.pc' appears to be a .pc file Will find package 'xcb-res' in file '/usr/lib64/pkgconfig/xcb-res.pc' File 'xcb-glx.pc' appears to be a .pc file Will find package 'xcb-glx' in file '/usr/lib64/pkgconfig/xcb-glx.pc' File 'libpng.pc' appears to be a .pc file Will find package 'libpng' in file '/usr/lib64/pkgconfig/libpng.pc' File 'cairo-svg.pc' appears to be a .pc file Will find package 'cairo-svg' in file '/usr/lib64/pkgconfig/cairo-svg.pc' File 'zlib.pc' appears to be a .pc file Will find package 'zlib' in file '/usr/lib64/pkgconfig/zlib.pc' File 'gobject-2.0.pc' appears to be a .pc file Will find package 'gobject-2.0' in file '/usr/lib64/pkgconfig/gobject-2.0.pc' File 'xcb-xv.pc' appears to be a .pc file Will find package 'xcb-xv' in file '/usr/lib64/pkgconfig/xcb-xv.pc' File 'xcb-composite.pc' appears to be a .pc file Will find package 'xcb-composite' in file '/usr/lib64/pkgconfig/xcb-composite.pc' Ignoring file '..' in search directory; not a .pc file File 'xcb-xf86dri.pc' appears to be a .pc file Will find package 'xcb-xf86dri' in file '/usr/lib64/pkgconfig/xcb-xf86dri.pc' File 'cairo-xlib.pc' appears to be a .pc file Will find package 'cairo-xlib' in file '/usr/lib64/pkgconfig/cairo-xlib.pc' File 'glib-2.0.pc' appears to be a .pc file Will find package 'glib-2.0' in file '/usr/lib64/pkgconfig/glib-2.0.pc' Ignoring file '.' in search directory; not a .pc file File 'gdk-x11-2.0.pc' appears to be a .pc file Will find package 'gdk-x11-2.0' in file '/usr/lib64/pkgconfig/gdk-x11-2.0.pc' File 'pthread-stubs.pc' appears to be a .pc file Will find package 'pthread-stubs' in file '/usr/lib64/pkgconfig/pthread-stubs.pc' File 'xcb-dpms.pc' appears to be a .pc file Will find package 'xcb-dpms' in file '/usr/lib64/pkgconfig/xcb-dpms.pc' File 'gio-2.0.pc' appears to be a .pc file Will find package 'gio-2.0' in file '/usr/lib64/pkgconfig/gio-2.0.pc' File 'gdk-pixbuf-2.0.pc' appears to be a .pc file Will find package 'gdk-pixbuf-2.0' in file '/usr/lib64/pkgconfig/gdk-pixbuf-2.0.pc' File 'xext.pc' appears to be a .pc file Will find package 'xext' in file '/usr/lib64/pkgconfig/xext.pc' File 'xrender.pc' appears to be a .pc file Will find package 'xrender' in file '/usr/lib64/pkgconfig/xrender.pc' File 'xcb-xselinux.pc' appears to be a .pc file Will find package 'xcb-xselinux' in file '/usr/lib64/pkgconfig/xcb-xselinux.pc' File 'pangoft2.pc' appears to be a .pc file Will find package 'pangoft2' in file '/usr/lib64/pkgconfig/pangoft2.pc' File 'pango.pc' appears to be a .pc file Will find package 'pango' in file '/usr/lib64/pkgconfig/pango.pc' File 'cairo-pdf.pc' appears to be a .pc file Will find package 'cairo-pdf' in file '/usr/lib64/pkgconfig/cairo-pdf.pc' File 'cairo-ps.pc' appears to be a .pc file Will find package 'cairo-ps' in file '/usr/lib64/pkgconfig/cairo-ps.pc' File 'xcb-xinerama.pc' appears to be a .pc file Will find package 'xcb-xinerama' in file '/usr/lib64/pkgconfig/xcb-xinerama.pc' File 'gthread-2.0.pc' appears to be a .pc file Will find package 'gthread-2.0' in file '/usr/lib64/pkgconfig/gthread-2.0.pc' File 'x11.pc' appears to be a .pc file Will find package 'x11' in file '/usr/lib64/pkgconfig/x11.pc' File 'cairo.pc' appears to be a .pc file Will find package 'cairo' in file '/usr/lib64/pkgconfig/cairo.pc' File 'xi.pc' appears to be a .pc file Will find package 'xi' in file '/usr/lib64/pkgconfig/xi.pc' Scanning directory '/usr/share/pkgconfig' File 'fontsproto.pc' appears to be a .pc file Will find package 'fontsproto' in file '/usr/share/pkgconfig/fontsproto.pc' File 'bigreqsproto.pc' appears to be a .pc file Will find package 'bigreqsproto' in file '/usr/share/pkgconfig/bigreqsproto.pc' File 'xcmiscproto.pc' appears to be a .pc file Will find package 'xcmiscproto' in file '/usr/share/pkgconfig/xcmiscproto.pc' File 'compositeproto.pc' appears to be a .pc file Will find package 'compositeproto' in file '/usr/share/pkgconfig/compositeproto.pc' File 'xf86vidmodeproto.pc' appears to be a .pc file Will find package 'xf86vidmodeproto' in file '/usr/share/pkgconfig/xf86vidmodeproto.pc' File 'glproto.pc' appears to be a .pc file Will find package 'glproto' in file '/usr/share/pkgconfig/glproto.pc' File 'xf86miscproto.pc' appears to be a .pc file Will find package 'xf86miscproto' in file '/usr/share/pkgconfig/xf86miscproto.pc' File 'randrproto.pc' appears to be a .pc file Will find package 'randrproto' in file '/usr/share/pkgconfig/randrproto.pc' File 'resourceproto.pc' appears to be a .pc file Will find package 'resourceproto' in file '/usr/share/pkgconfig/resourceproto.pc' File 'dri3proto.pc' appears to be a .pc file Will find package 'dri3proto' in file '/usr/share/pkgconfig/dri3proto.pc' File 'kbproto.pc' appears to be a .pc file Will find package 'kbproto' in file '/usr/share/pkgconfig/kbproto.pc' File 'renderproto.pc' appears to be a .pc file Will find package 'renderproto' in file '/usr/share/pkgconfig/renderproto.pc' File 'dmxproto.pc' appears to be a .pc file Will find package 'dmxproto' in file '/usr/share/pkgconfig/dmxproto.pc' File 'xextproto.pc' appears to be a .pc file Will find package 'xextproto' in file '/usr/share/pkgconfig/xextproto.pc' File 'xf86driproto.pc' appears to be a .pc file Will find package 'xf86driproto' in file '/usr/share/pkgconfig/xf86driproto.pc' File 'inputproto.pc' appears to be a .pc file Will find package 'inputproto' in file '/usr/share/pkgconfig/inputproto.pc' File 'xineramaproto.pc' appears to be a .pc file Will find package 'xineramaproto' in file '/usr/share/pkgconfig/xineramaproto.pc' File 'recordproto.pc' appears to be a .pc file Will find package 'recordproto' in file '/usr/share/pkgconfig/recordproto.pc' File 'xf86bigfontproto.pc' appears to be a .pc file Will find package 'xf86bigfontproto' in file '/usr/share/pkgconfig/xf86bigfontproto.pc' Ignoring file '..' in search directory; not a .pc file File 'fixesproto.pc' appears to be a .pc file Will find package 'fixesproto' in file '/usr/share/pkgconfig/fixesproto.pc' File 'videoproto.pc' appears to be a .pc file Will find package 'videoproto' in file '/usr/share/pkgconfig/videoproto.pc' Ignoring file '.' in search directory; not a .pc file File 'xproxymngproto.pc' appears to be a .pc file Will find package 'xproxymngproto' in file '/usr/share/pkgconfig/xproxymngproto.pc' File 'presentproto.pc' appears to be a .pc file Will find package 'presentproto' in file '/usr/share/pkgconfig/presentproto.pc' File 'shared-mime-info.pc' appears to be a .pc file Will find package 'shared-mime-info' in file '/usr/share/pkgconfig/shared-mime-info.pc' File 'scrnsaverproto.pc' appears to be a .pc file Will find package 'scrnsaverproto' in file '/usr/share/pkgconfig/scrnsaverproto.pc' File 'xf86dgaproto.pc' appears to be a .pc file Will find package 'xf86dgaproto' in file '/usr/share/pkgconfig/xf86dgaproto.pc' File 'evieproto.pc' appears to be a .pc file Will find package 'evieproto' in file '/usr/share/pkgconfig/evieproto.pc' File 'xproto.pc' appears to be a .pc file Will find package 'xproto' in file '/usr/share/pkgconfig/xproto.pc' File 'usbutils.pc' appears to be a .pc file Will find package 'usbutils' in file '/usr/share/pkgconfig/usbutils.pc' File 'damageproto.pc' appears to be a .pc file Will find package 'damageproto' in file '/usr/share/pkgconfig/damageproto.pc' File 'dri2proto.pc' appears to be a .pc file Will find package 'dri2proto' in file '/usr/share/pkgconfig/dri2proto.pc' Looking for package 'eventlog' Looking for package 'eventlog-uninstalled' Looking for 'eventlog' using legacy -config scripts Calling gnome-config Thanks. Ming From: Benke, Tibor [mailto:tibor.benke@balabit.com] Sent: Wednesday, October 21, 2015 7:19 AM To: Syslog-ng users' and developers' mailing list; Ho, Ming Subject: Re: [syslog-ng] syslog-ng 3.7.1 OSE compile error Hi, What's the output of the following command? pkg-config --debug eventlog Once I saw that autotools didn't find a package but the command line pkg-config did. Tibor On Tue, Oct 20, 2015 at 11:48 PM, Ho, Ming <Mingho(a)visa.com<mailto:Mingho@visa.com>> wrote: Hello, I followed syslog-ng 3.7 admin guide to compile eventlog-0.2.12+20120504+1700 on a Redhat 6.5 server and it created the following directory: # pwd /usr/local/lib # ll total 152 -rw-r–r– 1 root root 91250 Oct 16 21:55 libevtlog.a -rwxr-xr-x 1 root root 957 Oct 16 21:55 libevtlog.la<http://libevtlog.la> lrwxrwxrwx 1 root root 18 Oct 16 21:55 libevtlog.so -> libevtlog.so.0.0.0 lrwxrwxrwx 1 root root 18 Oct 16 21:55 libevtlog.so.0 -> libevtlog.so.0.0.0 -rwxr-xr-x 1 root root 51128 Oct 16 21:55 libevtlog.so.0.0.0 drwxr-x— 2 root root 4096 Oct 16 21:55 pkgconfig I also set PKG_CONFIG_PATH # echo $PKG_CONFIG_PATH /usr/local/lib/pkgconfig But when I ran “./configure” in the syslog-ng-3.7.1 directory, I got the following error: checking for clock_gettime… yes checking for EVTLOG… no configure: error: Package requirements (eventlog >= 0.2.12) were not met: No package ‘eventlog’ found Consider adjusting the PKG_CONFIG_PATH environment variable if you installed software in a non-standard prefix. Alternatively, you may set the environment variables EVTLOG_CFLAGS and EVTLOG_LIBS to avoid the need to call pkg-config. See the pkg-config man page for more details. # pwd /usr/local/lib/pkgconfig # ll total 4 -rw-r–r– 1 root root 238 Oct 16 21:55 eventlog.pc # cat eventlog.pc prefix=/usr/local exec_prefix=${prefix} libdir=${exec_prefix}/lib includedir=${prefix}/include/eventlog Name: EventLog Description: General system logging format library Version: 0.2.12 Cflags: -I${includedir} Libs: -L${libdir} -levtlog Appreciate anyone who can tell me what’s wrong Ming ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

Parse client IP out of Proxy Protocol Line in TCP syslog->ELB->syslog-ng
by Nadine Miller 21 Oct '15

21 Oct '15

I've searched through the archives and spent some time trying to find possible answers on the web, but haven't found a definitive answer. I'm in a situation where I need to parse syslog streams being forwarded through an AWS ELB. The normal configuration of the ELB resets the source IP to be the ELB's IP address. Logs are coming from multiple AWS VPCs, and we've already discovered duplicate hostnames across different VPCs, which has mingled logs from different hosts into one receiving log file. The ELB has another mode, referred to as "Proxy Protocol" which adds a single line to the TCP stream in the form: PROXY_STRING + single space + INET_PROTOCOL + single space + CLIENT_IP + single space + PROXY_IP + single space + CLIENT_PORT + single space + PROXY_PORT + "\r\n" Example: PROXY TCP4 198.51.100.22 203.0.113.7 35646 80\r\n Is it possible to use this proxy line in syslog-ng to properly segregate the log messages? If so, what would be the best method to use? I've done a lot of filtering/templating with normal UDP syslog and syslog-ng, but this is the first time I've had to consider something crazy like this. Currently there is no option at this time to change configurations at endpoints sending the syslog messages, nor can we remove the ELB. For reference: http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/enabl… Thanks in advance-- =N=

6 12

syslog-ng 3.7.1 OSE compile error
by Ho, Ming 21 Oct '15

21 Oct '15

Hello, I followed syslog-ng 3.7 admin guide to compile eventlog-0.2.12+20120504+1700 on a Redhat 6.5 server and it created the following directory: # pwd /usr/local/lib # ll total 152 -rw-r-r- 1 root root 91250 Oct 16 21:55 libevtlog.a -rwxr-xr-x 1 root root 957 Oct 16 21:55 libevtlog.la lrwxrwxrwx 1 root root 18 Oct 16 21:55 libevtlog.so -> libevtlog.so.0.0.0 lrwxrwxrwx 1 root root 18 Oct 16 21:55 libevtlog.so.0 -> libevtlog.so.0.0.0 -rwxr-xr-x 1 root root 51128 Oct 16 21:55 libevtlog.so.0.0.0 drwxr-x- 2 root root 4096 Oct 16 21:55 pkgconfig I also set PKG_CONFIG_PATH # echo $PKG_CONFIG_PATH /usr/local/lib/pkgconfig But when I ran "./configure" in the syslog-ng-3.7.1 directory, I got the following error: checking for clock_gettime... yes checking for EVTLOG... no configure: error: Package requirements (eventlog >= 0.2.12) were not met: No package 'eventlog' found Consider adjusting the PKG_CONFIG_PATH environment variable if you installed software in a non-standard prefix. Alternatively, you may set the environment variables EVTLOG_CFLAGS and EVTLOG_LIBS to avoid the need to call pkg-config. See the pkg-config man page for more details. # pwd /usr/local/lib/pkgconfig # ll total 4 -rw-r-r- 1 root root 238 Oct 16 21:55 eventlog.pc # cat eventlog.pc prefix=/usr/local exec_prefix=${prefix} libdir=${exec_prefix}/lib includedir=${prefix}/include/eventlog Name: EventLog Description: General system logging format library Version: 0.2.12 Cflags: -I${includedir} Libs: -L${libdir} -levtlog Appreciate anyone who can tell me what's wrong Ming

2 1

Create Pattern-DB rules
by Justin Kala 20 Oct '15

20 Oct '15

Hello I am trying to create Pattern-DB for the following Authorization messages coming from O/S. Can you help on creating a matching rule . Note: I do not have PATTERN-DB parser utility.I am going to create the db-parser.xml manually and put this rules inside the file. 2014-09-28T14:12:44-04:00 abcdef01-app/abcdef01-app sshd[11019]: [ID 800047 auth.notice] Failed password for root from 100.200.255.01 port 54438 ssh2 2014-09-28T14:03:46-04:00 abcdef01-app/abcdef01-app sshd[27420]: [ID 800047 auth.notice] Failed publickey for root from 100.200.255.02 port 59219 ssh2 2014-09-28T14:08:28-04:00 abcdef01-app/abcdef01-app sshd[3954]: [ID 800047 auth.notice] Failed keyboard-interactive for root from 100.200.255.03 port 65410 ssh2 2014-09-28T14:10:11-04:00 abcdef01-app/abcdef01-app sshd[5222]: [ID 293258 auth.error] libsldap: Status: 49 Mesg: openConnection: simple bind failed - Invalid credentials Thanks & Regards Kaladhar

4 16

Parsing multifield lines
by Giovanni Mancuso 20 Oct '15

20 Oct '15

Hi, i'm writing a parser for lines having a repeated field on the same line eg(Recipient is repeated 3 times): ID: 123AABB456 Sender: user1(a)example.com Recipient: user2(a)example.com Recipient: user3(a)example.com Recipient: user3(a)example.com Status: Sent I would like to have a CUSTOM MACRO with all recipients. Is there a way to do this? Thanks --

3 5

Is the option flush_lines valid now?
by 伊藤宏平 16 Oct '15

16 Oct '15

I tried to use syslog-ng. At first I used a syslog-ng 3.5.3 on ubuntu14.04.But I can not use flush_line option. I asked question in stack overflow.Mr.argus said that " There is a lack of condition"linux - syslog-ng の flush_lines　オプションが効かない - スタック・オーバーフロー Specifically function "log_writer_flush" should be like that. Before: gboolean log_writer_flush(LogWriter *self, LogWriterFlushMode flush_mode) { : if (flush_mode >= LW_FLUSH_BUFFER || count == 0) { if (log_proto_client_flush(proto) == LPS_ERROR) return FALSE; }After: LogProtoFileWriter *w = (LogProtoFileWriter *)proto; if ( (w->buf_count >= w->buf_size) && (flush_mode >= LW_FLUSH_BUFFER || count == 0) ) { if (log_proto_client_flush(proto) == LPS_ERROR) return FALSE; } And now I use a latest syslog-ng ose 3.7.1, hoping the bug has been fixed.But I can not use flush_line option either. Is the option flush_lines valid now? try (動) 試みる、努める、努力する、試す、挑む、見る、審理する tried (形) 検査済みの、証明済みの、試験済みの Powered by iKnow!

3 5

Upon syslog-ng reload /restart a flood of logs is received at a tcp port (destination)
by Shruthi Rao 14 Oct '15

14 Oct '15

I have configured a destination in syslog to a tcp port on localhost options { long_hostnames(off); sync(0); perm(0640); stats(3600); }; source src { internal(); unix-dgram("/dev/log"); udp(); }; destination mgagent{ tcp("127.0.0.1" port(5009) template("$TAG $HOST $PROGRAM $MSGONLY\n")); }; I have a tcp server n the localhost ,receiving logs on this port and it does further processing . Whenever syslog-ng is reloaded or restarted and te tcp server is running , a flood of the logs is sent on this tcp port ( which is handled by the tcp server) , but this is not wanted. The logs which were already sent before restart is sent repeatedly . Is there any way to stop or prevent this . syslog version is syslog-ng 2.0.9 on SLES 11 SP3 -Thanks

2 1

AMQP supported RPM for el5
by Pankaj Sain 09 Oct '15

09 Oct '15

Hi, Please could you help to know, if syslog-ng-2.1.4-9.el5 supports AMQP. If not, could you suggest me the AMQP supported version(*RPM*) for *el5 linux* variants. Regards, *Pankaj Sain** | Netprophets Cyberworks Pvt. Ltd.* Please do not print this mail unless it is necessary.

2 5

insider 2015-10: monitor syslog-ng with Android app; documentation; docker; big data; SUSECon;
by Czanik, Péter 08 Oct '15

08 Oct '15

Dear syslog-ng users, This is the 43th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Monitor syslog-ng with Android app ---------------------------------- During the last Google Summer of Code a new Android application was developed by Krishna Kannan, a student at National University of Singapore, which can monitor syslog-ng. It can check, if syslog-ng is alive and show its configuration and statistics on the screen of your Android device. For details, check https://pzolee.blogs.balabit.com/2015/09/monitor-syslog-ng-with-android-app/ Documentation on github ----------------------- We are pleased to announce that the source code of the syslog-ng Open Source Edition Administrator Guide (https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-… now publicly available on GitHub. This means that if you find an annoying typo, an error in a configuration example, or a bug in the documentation, you can help us correct it by submitting a pull request. Also, if you have a better example to illustrate a feature, or a clearer description about how an option works, let us know. For details about accessing the source XML files and on contributing, see our GitHub page at https://github.com/balabit/syslog-ng-ose-guides/ Docker images for syslog-ng --------------------------- There are three docker images available for syslog-ng OSE at https://hub.docker.com/u/balabit/ The “syslog-ng” image targets end users, the other two are for developers, who would like to set up an isolated development environment for syslog-ng quickly. If you would like to modify the images, the sources are available at https://github.com/balabit/syslog-ng-docker Big data -------- syslog-ng delivers log data directly to Hadoop, Elasticsearch, MongoDB and Kafka, so supports practically all major “big data” systems as a destination. Learn how this simplifies your data pipeline and makes your data routing more flexible and efficient: https://jluby.blogs.balabit.com/2015/09/17/got-big-data-ingestion-problems-… syslog-ng @ SUSECon ------------------- SUSE was one of the first major Linux distributions to include syslog-ng. For a long time syslog-ng was the default syslog implementation in both SLES (SUSE Linux Enterprise Server) and openSUSE, and many SLES and openSUSE users are still enthusiastic about syslog-ng. This year, BalaBit (the company behind syslog-ng) participates at the annual SUSE conference, SUSECon, in Amsterdam, during the first week of November. https://czanik.blogs.balabit.com/2015/09/balabits-syslog-ng-at-the-annual-s… Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com To read this newsletter on-line, visit: http://insider.blogs.balabit.com/ Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Question about compiling 3.7.1 on CentOS 7
by Tech Support 05 Oct '15

05 Oct '15

All; I'm trying to compile 3.7.1 on CentOS 7 with Elasticsearch support which I'm *assuming* requires Java support. However, when I run 'configure', it doesn't enable the Java support. I must be missing a Java dependency somewhere. Does anyone know what dependencies I need for this? Any insight at all would be greatly appreciated. Thanks; John

2 1