March 2015 - syslog-ng - lists.balabit.hu

make error in syslog-ng version 3.6.1 with FC20
by Sivadas.M.P 11 Mar '15

11 Mar '15

Hi! I have tried the version syslog-ng-3.4.7-1.fc20.x86_64 and succeeded to log the messages to MySQL DB. Later found from web that there are some bugs which are solved in 3.6.1. When trying out the syslog-ng version 3.6.1 with FC20 (source code) I am getting the following error during make. ------------------------------------------------------------------------------------------------------ In file included from modules/afsql/afsql.c:24:0: modules/afsql/afsql.h:28:21: fatal error: dbi/dbi.h: No such file or directory #include <dbi/dbi.h> ^ compilation terminated. make[2]: *** [modules/afsql/modules_afsql_libafsql_la-afsql.lo] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 ----------------------------------------------------------------------------------------------------- Kindly suggest any remedy for this issue. regards -- SIVADAS.M.P VAL&FS2, C-DOT, Electronics City Phase - I Bangalore - 560100 Karnataka Phone : 080-25119001 Ext: 9143 ===================================================================================== Disclaimer: ---------- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. The sender does not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission.

2 1

GSoC Introduction, syslog-ng as a command line tool
by Bagossy Attila 10 Mar '15

10 Mar '15

Hi, I'd like to introduce myself to the community. I am Attila Bagossy, undergraduate student at the University of Debrecen, Faculty of Informatics. I've been writing programs since I was a child and when I read the letter of Mr László Budai (received through the Neptun system, forwarded by Mr Norbert Bátfai), I couldn't resist to take a chance. I've been coding in C for nearly four years, but I also have experience with OO languages such as C++ or C#. I'm interested in the following project: syslog-ng as a command line tool. I found this project the most interesting and I'm really excited about developing a new tool and making syslog-ng more powerful. Currently, I'm examining the code and getting familiar with it. This is a great opportunity and I want to give my best. Regards, Attila Bagossy University of Debrecen

1 0

Introduction. Interested in Android App to monitor syslog-ng servers for GSoC 2015
by karan grover 10 Mar '15

10 Mar '15

Hello there, I am Karan Grover. I am currently pursuing BTech in Computer Science at IIIT Delhi. I am an android developer, and I wish to contribute to syslog-ng by developing an android app to monitor syslog-ng server. I will be working on a project involving SNMP with my professor in the future, and I plan to use syslog-ng to manage the logs then. I think the android app, would come handy. I want to work on this project, as I want it to be solved for myself too. I will be learning about syslog-ng in the coming week. Except this, I have all the skills desirable for the project. A little bit about me: I have been an android developer at 2 startups - Backpack Labs <https://www.usebackpack.com/> and LEAF Wearables <http://www.leafwearables.com/>. I also keep working on a couple of side projects. A big one is near release. I look forward to start my open source journey by contributing to syslog-ng, and learn how to write beautiful, readable and well documented code. I have already mailed my introduction to Zoltan Pallagi. I am posting here to introduce myself to the community. Thank you.

1 0

syslog-ng server monitoring with mobile app
by Prerit Garg 10 Mar '15

10 Mar '15

Hey, I am Prerit Garg. I would like to take up this project for Gsoc this year. I have a pretty good experience in android application development. I recently developed an android app for an organisation and published it on playstore. Please Help me get started with this project.

2 1

Mutual Authentication and Encryption With Rsyslog
by Michael Starks 09 Mar '15

09 Mar '15

I am trying to get mutual authentication working between a syslog-ng server and an Rsyslog client, using startssl.com issued certificates. The client does properly authenticate the server, but syslog-ng does not recognize the client as trusted. Server info: ------------ # cat /etc/redhat-release CentOS release 6.6 (Final) # /usr/local/syslog-ng/sbin/syslog-ng --version syslog-ng 3.2.4 Installer-Version: 3.2.4 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#ef7b91e4a1b1f9628c66138b4ae83de7e4c697c6 Compile-Date: Aug 18 2013 22:16:35 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: on Enable-Pcre: on Enable-Pacct: off source s_network_secure { tcp(flags(no-multi-line) ip(0.0.0.0) port(6514) tls( key-file("/usr/local/syslog-ng/etc/cert.d/cert.key") cert-file("/usr/local/syslog-ng/etc/cert.d/cert.pem") ca_dir("/usr/local/syslog-ng/etc/cert.d") peer_verify(required-untrusted)) ); }; And of course this is defined in a log statement. Here is the directory. Note that the symbolic link of the hash has been created. # ll /usr/local/syslog-ng/etc/cert.d/ total 204 lrwxrwxrwx. 1 root root 13 Mar 3 13:51 876f1e28.0 -> ca-bundle.pem -rw-r--r--. 1 root root 195587 Mar 3 13:08 ca-bundle.pem -r--------. 1 root root 1679 Feb 28 11:21 cert.key -r--------. 1 root root 2260 Feb 28 11:50 cert.pem -rw-r--r--. 1 root root 2281 Mar 3 13:58 client.key required-untrusted works, but required-trusted doesn't. So I figured maybe it was an SSL issue with the authority, but it seems to validate OK. # openssl verify -CAfile 876f1e28.0 -verbose client.key client.key: OK Client info: ------------ # cat /etc/lsb-release DISTRIB_ID=Ubuntu DISTRIB_RELEASE=14.04 DISTRIB_CODENAME=trusty DISTRIB_DESCRIPTION="Ubuntu 14.04.1 LTS" # rsyslogd -v rsyslogd 7.4.4, compiled with: FEATURE_REGEXP: Yes FEATURE_LARGEFILE: No GSSAPI Kerberos 5 support: Yes FEATURE_DEBUG (debug build, slow code): No 32bit Atomic operations supported: Yes 64bit Atomic operations supported: Yes Runtime Instrumentation (slow code): No uuid support: Yes See http://www.rsyslog.com for more information. I suppose there's no additional client info needed since I know it is presenting the certificate--the issue seems to be that the syslog-ng server simply doesn't trust it. All suggestions appreciated.

3 5

syslog-ng in Google Summer of Code 2015 (GSoC)
by Czanik, Péter 09 Mar '15

09 Mar '15

Hi, As you might have already noticed from the increased traffic: the syslog-ng project is participating again in GSoC! Our page at Google is available at https://www.google-melange.com/gsoc/org2/google/gsoc2015/syslog_ng We have many interesting project ideas to choose from. This years focus is on Java and Python language bindings and making configuration easier using a QT or web based GUI. If you are a student please check our ideas page at https://github.com/balabit/syslog-ng/wiki/GSoC2015-idea-&-project-list which of the projects suits you best. You can also help, if you are already not a student: please follow us on Twitter and re-tweet our GSoC tweets, so students among your followers have a chance to learn about the syslog-ng GSoC possibilities. We are @sngose on twitter: https://twitter.com/sngose Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Use receiving file name / path as a macro on the server
by Thanuje Ashwin Nallaperuma 09 Mar '15

09 Mar '15

Hi all, I have multiple files with the same content on the syslog-ng client These files are stored on different locations with the same file name and same content After receiving I want to store these files with different names on sysog-ng server Is there any way I could use the filepath or filename of the receiving file as a macro or any way to achieve this..?

4 6

Can I use a string as a delimiter on csv-parser
by Thanuje Ashwin Nallaperuma 09 Mar '15

09 Mar '15

Hi everyone, I need to split a macro using a string as a delimiter, Is there any way I can do it ? -Ashwin

2 2

Incompatible Version Warnings
by Dan Mahoney 09 Mar '15

09 Mar '15

Hey there, We have a number of systems that we're trying to deploy syslog-ng on, with puppet, which means we're dealing with multiple versions out there -- so we're trying to stay compatible with 3.4. On a newer version (3.6), we get the following errors on startup: (snip) [2015-03-06T20:47:33.065077] WARNING: Configuration file format is too old, syslog-ng is running in compatibility mode Please update it to use the syslog-ng 3.6 format at your time of convinience, compatibility mode can operate less efficiently in some cases. To upgrade the configuration, please review the warnings about incompatible changes printed by syslog-ng, and once completed change the @version header at the top of the configuration file.; [2015-03-06T20:47:33.096433] WARNING: Starting with syslog-ng 3.6, the system() source performs JSON parsing of messages starting with the '@cim:' prefix. No additional action is needed; [2015-03-06T20:47:33.096495] WARNING: Your configuration uses a newly introduced reserved word as identifier, please use a different name or enclose it in quotes before upgrading; keyword='channel', config-version='3.3', version='3.4', filename='source confgen system', line='1:1' Error parsing source, source plugin channel not found in source confgen system at line 1, column 1: included from /usr/local/etc/syslog-ng.conf line 27, column 9 channel ^^^^^^^ (snip) I've found if I comment out the "system()" source it makes this error go away, but the requisiste lines are exactly what are referenced in the manual: source s_local { system(); internal(); }; I suppose what's most confusing here, is syslog-ng is trying to tell me exactly where it finds the error, in the word "channel" saying "here, change this, this is the bad word I'm tripping over", but I don't find that word anywhere -- nor does it say *which* included file it's tripping over. Maybe it's telling me that's the word it *needs* to find, but that's less clear. I'm not finding anything in the mailing lists for this. Finally, I should probably ask -- since syslog-ng has the ability to tag your config files with a given version, is there a way to say "use this config if you're on 3.4 and this version if you're on 3.6", so I can stay compatible with the various versions I've got deployed. One other little nit: "Convenience" -Dan Mahoney

4 4

syslog-ng for Python regarding
by Nishaanth Gunasekeran 08 Mar '15

08 Mar '15

Hey, This is Nishaanth. I have been searching for a project to work on for SoC. I found syslog-ng for Python interesting. I am familiar with Python and also C. Anyone can help me?

1 0