November 2015 - syslog-ng - lists.balabit.hu

Remote server not keeping message intact
by Gareth Allen 12 Nov '15

12 Nov '15

Hi all I'm sending Apache logs to a remote syslog-ng server, but the remote server isn't keeping the message intact. Source: My Apache log format: LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined What the log looks like: 172.27.15.149 - - [12/Nov/2015:08:30:59 +0000] "GET / HTTP/1.1" 200 3594 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36" My syslog-ng configuration: source s_apache { file("/var/log/apache2/access.log" follow_freq(1) flags(no-parse)); }; destination d_apache_tcp { tcp("x.x.x.x" port(514)); }; log { source(s_apache); destination(d_apache_tcp); }; Log server: source s_net { udp(port(514)); tcp(port(514)); }; template apache { template("${MESSAGE}\n"); template-escape(no); }; destination apache { file("/var/log/apachetest" template(apache)); }; What I see in /var/log/apachetest: - - [12/Nov/2015:08:30:59 +0000] "GET / HTTP/1.1" 200 3594 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36" As you can see the IP at the beginning of the log entry is being removed. I've tried using $MSG and $MSGONLY. Any ideas would be greatly appreciated. Gareth

5 6

Regex Solaris from Linux hosts in Syslog-ng config file
by vijay amruth 04 Nov '15

04 Nov '15

Hello All, We are drawing logs from several hosts which include solaris(10,11) , linux (centos, ubuntu, rhel) into syslog servers, I want to be able to separate solaris logs, is there any pattern we can match for solaris logs that you may know ? Thanks, Vijay Amrut.

9 20

format-json reverse order?
by Scheidler, Balázs 03 Nov '15

03 Nov '15

Hi, I've encountered a case where format-json orders keys not alphabetically, but rather in the other direction. Can you remember any reason for that? This is the only patch needed to fix the order, but I've figured there may have been some reason behind the ordering. static gint vp_walk_cmp(const gchar *s1, const gchar *s2) { - return strcmp(s2, s1); + return strcmp(s1, s2); } Thanks in advance, -- Bazsi

3 4

Syslog-ng 3.5 , "destination plugin python not found ..."
by Alexander Urcioli 02 Nov '15

02 Nov '15

Trying to use a custom python destination I wrote. I wrote the python class, did the necessary PYTHONPATH stuff and wrote a separate .conf file for syslog-ng. When testing this file with the command "syslog-ng -f seclog.conf -Fevd" I get the following error: Error parsing destination, destination plugin python not found in seclog.conf at line 9, column 31: destination d_SECLOG_SERVER { python( ^^^^^^ Is the python destination not supported in 3.5? Alex

2 1