March 2015 - syslog-ng - lists.balabit.hu

Create Pattern-DB rules
by Justin Kala 20 Oct '15

20 Oct '15

Hello I am trying to create Pattern-DB for the following Authorization messages coming from O/S. Can you help on creating a matching rule . Note: I do not have PATTERN-DB parser utility.I am going to create the db-parser.xml manually and put this rules inside the file. 2014-09-28T14:12:44-04:00 abcdef01-app/abcdef01-app sshd[11019]: [ID 800047 auth.notice] Failed password for root from 100.200.255.01 port 54438 ssh2 2014-09-28T14:03:46-04:00 abcdef01-app/abcdef01-app sshd[27420]: [ID 800047 auth.notice] Failed publickey for root from 100.200.255.02 port 59219 ssh2 2014-09-28T14:08:28-04:00 abcdef01-app/abcdef01-app sshd[3954]: [ID 800047 auth.notice] Failed keyboard-interactive for root from 100.200.255.03 port 65410 ssh2 2014-09-28T14:10:11-04:00 abcdef01-app/abcdef01-app sshd[5222]: [ID 293258 auth.error] libsldap: Status: 49 Mesg: openConnection: simple bind failed - Invalid credentials Thanks & Regards Kaladhar

4 16

so_rcvbuf default value of 0
by Matt Zagrabelny 07 Apr '15

07 Apr '15

Greetings, Just looking for confirmation about the so_rcvbuf parameter for the udp() source driver. The default is 0. Does that mean that syslog-ng uses the default value from the kernel? ie. cat /proc/sys/net/core/rmem_default 124928 If that is true, then perhaps the syslog-ng admin docs could mention that. I've scanned "man 7 socket" and don't seen anything that suggests that a value of 0 for so_rcvbuf means that the socket will inherit the value. Thanks for the help! -m

2 2

Stats missing from remote sources in syslog-ng 3.5?
by Pradeep Sanders 31 Mar '15

31 Mar '15

Hello, I'm seeing a similar problem to what was reported here: http://communities.balabit.com/balabit/topics/stats-from-syslog-remote-sour… <http://communities.balabit.com/balabit/topics/stats-from-syslog-remote-sour…> I'm trying to upgrade from the RHEL 6 default 3.2 version to 3.5 or 3.6, in order to enable threaded support. I've tried a 3.6 build from the following location: https://copr-be.cloud.fedoraproject.org/results/czanik/syslog-ng36epel6/epe… <https://copr-be.cloud.fedoraproject.org/results/czanik/syslog-ng36epel6/epe…> However, this build consumes all my host memory (48GB) in a matter of hours before starting on swap space. I've tried a 3.5.4 and a 3.5.6 package but both of them exhibit the same issue, with remote sources not reported in "syslog-ng-ctl stats". Does anyone have any advice on how I might fix the stats for remote sources in 3.5? Thanks, -Pradeep

2 1

interrogate daemon for parameter values?
by Matt Zagrabelny 30 Mar '15

30 Mar '15

Greetings, Is there a way to interrogate the running daemon to find out what the *effective* value is for things? For instance, I'd like to know what the effective value of so_rcvbuf is for a udp source. cat /proc/sys/net/core/rmem_default 1024 syslog-ng.conf: udp(); # uses default value of 0 service syslog-ng start echo 512 > /proc/sys/net/core/rmem_default Here is where I'd like to interrogate the running daemon and find that the udp driver is using a value of 1024 for so_rcvbuf. Any chance of doing that? Thanks! -m

2 1

[filter] unable to squelch annoying spam
by Robin Blanchard 28 Mar '15

28 Mar '15

Hi List, I've got some Solaris machines emitting some particularly annoying spam that I cannot seem to squelch. I've tried filtering on just about every MACRO that I can think might catch it, all to no avail. Here's the snippet from running syslog-ng in debug/foreground: # syslog-ng -Fdve 2>&1 |grep alloc_extra_sgl_frame Incoming log entry; line='<4>Mar 27 19:00:55 alloc_extra_sgl_frame failed' And here's the relevant filter bit (the other strings are doing their job). filter solaris_alloc { not ( match('alloc_extra_sgl_frame' value("MESSAGE")) or match('alloc_extra_sgl_frame' value("MSGHDR")) or match('alloc_extra_sgl_frame' value("FACILITY")) or match('alloc_extra_sgl_frame' value("PRIORITY")) or match('alloc_extra_sgl_frame' value("MSGID")) or match('ext-arq alloc fail.' value("MESSAGE")) or match('ext-arq alloc fail.' value("MSGHDR")) or match('/pci@0,0/pci8086,3c06@2,2/pci1000,3080@0' value("MESSAGE")) or match('/pci@0,0/pci8086,3c06@2,2/pci1000,3080@0' value("MSGHDR")) ); }; # syslog-ng --version syslog-ng 3.5.6 Installer-Version: 3.5.6 Revision: Compile-Date: Aug 13 2014 13:54:36 Available-Modules: affile,afprog,afsocket-notls,afsocket-tls,afsocket,afstomp,afuser,basicfuncs,confgen,cryptofuncs,csvparser,dbparser,linux-kmsg-format,syslogformat,system-source Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: on Enable-Pcre: on What else should I try? -- Robin P. Blanchard Nephila Advisors Infrastructure Administrator +1 615.823.8516 ext 4516 ---------------------------------------------------------------------------------- The information in this e-mail, and any attachment therein, is confidential and for use by the addressee only. Any use, disclosure, reproduction, modification or distribution of the contents of this e-mail, or any part thereof, other than by the intended recipient, is strictly prohibited. If you are not the intended recipient, please return the e-mail to the sender and delete it from your computer. This email is for information purposes only, nothing contained herein constitutes an offer to sell or buy securities, as such an offer may only be made from a properly authorized offering document. Although Nephila attempts to sweep e-mail and attachments for viruses, it does not guarantee that either are virus-free and accepts no liability for any damage sustained as a result of viruses. -----------------------------------------------------------------------------------

2 1

GSoC proposal: Python connector (maxvt)
by Max Timchenko 27 Mar '15

27 Mar '15

Dear all, I’ve posted a proposal for the Python connector at: https://github.com/balabit/syslog-ng/wiki/GSoC-2015-Proposal:-syslog-ng-for… Any comments are welcome. There are a few questions at the bottom; repeating them here for convenience: 1. Python 3, Python 2, or both? Supporting only 3 allows using nifty idioms and language features, but there are still users who prefer to speak 2. Constrained platforms may not have enough resources to run both. 2. Are there any priorities among the different components in the project? A total of 5 components are specified. 3. Viability of one-component-at-a-time approach — whether you would prefer to see each part as it is done to completion, or proceed in parallel for all components (eg., wrapper APIs for all, then Python APIs for all, then completed documentation and examples for all). Yours, — Max

2 1

GSoC 2015: Java Language Binding
by Garmine 42 25 Mar '15

25 Mar '15

Hi! I started coding coding around 6 years ago, first using Java and later extending my knowledge to many other languages including C, Python, FORTH, Active Oberon and Bash just to name a few of many. Right now I'm a student at Budapest University of Technology and looking for a challenge for the summer. Recently a friend of mine drew my attention to syslog-ng and so I started exploring the project. Not only because it's an important Unix application but also because I developed some logging utilities of my own and as a OSS user I would love to start paying back to the community using the knowledge I learnt from them. I am working on issue 257 at the moment and I study the code and infrastructure above all to truly understand what I'm doing rather than just copying functionality. (And sometimes figuring out configuration issues as Arch Linux doesn't seem to be the most popular development platform for syslog-ng :)) As I have significant experience in C and Java* I believe I could do the most if I worked to enable Java-Syslog interoperability. * I wrote OpenGL&CL experiments, an overly complicated BrainF#@k interpreter and contributed to a game called ScrumbleShip in C. I also developed a primitive web browser resembling the Line Mode Browser from scratch using an own HTML parser, a JSON parser, contributed to a Minecraft server's code and wrote many other smaller and larger programs in Java. Due to my interest in OpenGL I also gathered knowledge about JNI. (And I like to talk a lot!) Kind regards, Miklos Kozak

1 0

GSoC Syslog-ng WebSocket question
by Mohammadi, Mahmoud 25 Mar '15

25 Mar '15

Dear WebSocket Mentors, This is Mahmoud Mohammadi, a graduate student in UNC Charlotte, USA. Currently I am researching on GSoC syslog-ng ideas. In the WebSocket protocol, as you know there are different tasks and issues to consider such as initial handshaking, data exchange, data formats and ping/pong communication commands. So is it required to write a library for implementing the WebSocket protocol in C or C++ or just use an existing library( recommended by you or the programmer) to integrating it with syslog-ng for the required functionalities? And also can you please is there a rough estimation( if possible) about the variety of different data formats or commands exchanging between the server and client or they would be determined during the project? Sincerely, Mahmoud

1 0

[GSoC - 2015 Proposal] - Project: syslog-ng server monitoring with mobile app
by krish k 22 Mar '15

22 Mar '15

Hi all, I would like to propose a project. Mobile applications for server monitoring starting with Android and extending it to windows and iOS.I would like to discuss about the project with the mentor and would like to take this forward. Can someone kindly guide me in a correct direction to take this project forward. I am graduate student doing my Master of Computing at National University of Singapore - School of Computing. I have experience in Java, C, C#, Python. I have developed many android applications and published it in Google Play Store. Currently published apps can be found here https://play.google.com/store/apps/developer?id=Spaghetti%20Stack&hl=en I have worked with Verizon Inc before joining my masters, there I was working on a tablet application. I am very much thrilled about the idea of working with Syslog-ng community and be an active member. Looking forward to work on this project. Regards,Krishna.

1 0

GSoC 2015 WebSocket for syslog-ng
by Roland Lukács 22 Mar '15

22 Mar '15

Hello, My name is Roland Lukács and I am a third-year Computer Engineering student at Budapest University of Technology and Economics. I have experience in C, C++, Python programming languages. I'm system administrator in Schönherz dorm so I use often syslog-ng. I heard about GSoC from my friend who was part of it last year. I am interested in Websocket for syslog-ng project. I have already talked to László Mészáros, who told me about the project. Best regards, Roland Lukács

1 0