May 2015 - syslog-ng - lists.balabit.hu

Create Pattern-DB rules
by Justin Kala 20 Oct '15

20 Oct '15

Hello I am trying to create Pattern-DB for the following Authorization messages coming from O/S. Can you help on creating a matching rule . Note: I do not have PATTERN-DB parser utility.I am going to create the db-parser.xml manually and put this rules inside the file. 2014-09-28T14:12:44-04:00 abcdef01-app/abcdef01-app sshd[11019]: [ID 800047 auth.notice] Failed password for root from 100.200.255.01 port 54438 ssh2 2014-09-28T14:03:46-04:00 abcdef01-app/abcdef01-app sshd[27420]: [ID 800047 auth.notice] Failed publickey for root from 100.200.255.02 port 59219 ssh2 2014-09-28T14:08:28-04:00 abcdef01-app/abcdef01-app sshd[3954]: [ID 800047 auth.notice] Failed keyboard-interactive for root from 100.200.255.03 port 65410 ssh2 2014-09-28T14:10:11-04:00 abcdef01-app/abcdef01-app sshd[5222]: [ID 293258 auth.error] libsldap: Status: 49 Mesg: openConnection: simple bind failed - Invalid credentials Thanks & Regards Kaladhar

4 16

Solaris & Linux (RH6) Console and SSH Use Logging
by wiskbroom＠hotmail.com 08 Jun '15

08 Jun '15

Greetings; This is question is slightly OT, but I can't imagine a better place to ask; so please, no flames. I would like to begin logging all attempts (succesful, failed, no password given, etc) to login to Sparc/Solaris machines, as well as RedHat 6 Linux boxes. My clients are using stock syslog, but my server is running syslog-NG; my second goal is to redirect all login type logs to just one file for ALL of my Solaris & Linux servers. Does anyone have a known good syslog config file for both Solaris, and Linux? Also, a good syslog-NG entry to force just the console and ssh data into a separate file? Thank you! .vp

2 2

odd configuration file
by craig bowser 05 Jun '15

05 Jun '15

Hi, I'm just learning about configuring syslog-ng. I'm using the latest version (info at end of email) and I've run into an error I can't figure out. I made a syntax error in my syslog-ng.conf that caused syslog-ng to fail to start. I corrected the error, but now when I try and start syslog-ng, it still fails. trying to start it with 'service syslog-ng start' or 'service syslog-ng restart' gets me: Job for syslog-ng.service failed. See "systemctl status syslog-ng.service" and "journalctl -xe" for details. But the error is buried in the systemd logs. Using '/usr/sbin/syslog-ng -F' gets me the following error: Error resolving reference; content='source', name='s_name', location='/etc/syslog-ng/syslog-ng.conf:132:7' What is that file? Can I safely delete it? Why can't I make it use the new .conf file? When I try '/usr/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf -F' I get the same error. syslog-ng 3.5.6 Installer-Version: 3.5.6 Revision: 3.5.6-2 [@416d315] (Ubuntu/15.04) Compile-Date: Oct 25 2014 14:14:32 Available-Modules: afuser,afsocket-notls,linux-kmsg-format,afprog,tfgeoip,csvparser,confgen,afamqp,json-plugin,redis,basicfuncs,afsmtp,affile,afsql,afmongodb,cryptofuncs,afsocket-tls,afsocket,syslogformat,afstomp,system-source,dbparser Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: on Enable-Pcre: on Craig L Bowser ____________________________ This email is measured by size. Bits and bytes may have settled during transport.

3 3

GSoC students IRC meeting
by Czanik, Péter 26 May '15

26 May '15

Hi, We organize an IRC meeting, where GSoC students and the broader syslog-ng community can meet. It would be about an hour long event, where students could talk about their projects and ideas with long time syslog-ng users and developers. It will be on the 4th of June, 17:00 CET (Budapest) time. It's 8AM in San Francisco and 20:30 in Delhi, so still day time for most of us. The event will take place on the freenode IRC servers, on channel #syslog-ng. If you don't have an IRC client, you can also use http://webchat.freenode.net/ to participate. I hope, many of you can participate! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Configuring multithreading in syslog-ng need HELP !!
by nagesh mallappa 22 May '15

22 May '15

Hi All, I have added this line in my syslog-ng.conf file, *options {threaded(yes) ; };* I have 4 core system , root@nageshm-HVM-domU:/etc/syslog-ng# lscpu Architecture: i686 CPU op-mode(s): 32-bit, 64-bit Byte Order: Little Endian *CPU(s): 4* On Enabling mutithreading also, I do not the main syslog-ng thread spawning multiple threads, This is ps output, root@nageshm-HVM-domU:~# ps -elf | grep syslog-ng 1 S root 24871 1 0 80 0 - 1091 wait 08:22 ? 00:00:00 supervising syslog-ng 5 S root 24872 24871 0 80 0 - 4156 ep_pol 08:22 ? 00:00:00 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid 0 S root 24882 24255 0 80 0 - 1170 pipe_w 08:22 pts/13 00:00:00 grep --color=auto syslog-ng As we can only 2 processes are running, but I expect four threads to run, since I have 4 core system. Please Let me know, any configuration I am missing. Hoping for urgent help !!. Thanks, Nagesh

3 2

threading question
by Jim Hendrick 21 May '15

21 May '15

Hi, Could someone help clarify something for me? I am running with threading enabled, and I have separate redis destinations (three currently) all pointing to the same server. My thought was that each destination would use a separate connection and thread. I then filter log sources and send (roughly) 1/3 to each destination. My question is this. Does each destination get a separate thread? (reading the documentation it left room for doubt). Also - more generally is this a reasonable way to get better throughput to a redis data store? (note: both syslog-ng and redis are running locally, so the connections use 'localhost') Thanks! Jim

4 3

NEWS: syslog-ng docker images
by Budai, László 21 May '15

21 May '15

Hi, syslog-ng has a new github repo[1] where we provide some Dockerfiles which can help for developers and users. This repo serves as a basis for autobuilt docker images available at our docker.io repo[2]. Any feedback are welcomed :-) Bugreports, requests are handled in the github repo. [1] https://github.com/balabit/syslog-ng-docker [2] https://registry.hub.docker.com/repos/balabit/ regards, syslog-ng-team

1 0

Flag "no-multiline" not working on Syslog-ng
by Alan Sam 20 May '15

20 May '15

Hello community, I have the following diagram between some PE and Syslog-ng: Cisco devices -> Syslog-ng (running on Solaris) Syslog-ng version: o NTPSYSLOG# syslog-ng -V o syslog-ng 3.0.4 o Revision: ssh+git://bazsi@git.balabit //var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.0#master#1b5d618e301ad94aa20e692ffba16469dece8d10 o Compile-Date: Sep 2 2009 06:15:53 o Enable-Threads: off o Enable-Debug: off o Enable-GProf: off o Enable-Memtrace: off o Enable-Sun-STREAMS: on o Enable-Sun-Door: on o Enable-IPv6: on o Enable-Spoof-Source: on o Enable-TCP-Wrapper: off o Enable-SSL: on o Enable-SQL: off o Enable-Linux-Caps: off o Enable-Pcre: on One of the cisco devices sends a particular log line that is splited in two lines (there is a line-break in between): *Mar 13 10:33:13: %BGP-3-INVALID_MPLS: Invalid MPLS label (1)* * received in update for prefix XXXX:XXXX:XXX.XXX.XXX.X/XXX from X.X.X.X* When the log reaches the Syslog-ng on Solaris server, it is logged like this: *Mar 13 10:33:14 PE06PVAL01 1182434: Mar 13 10:33:13: %BGP-3-INVALID_MPLS: Invalid MPLS label (1)* *Mar 13 10:33:14 PE06PVAL01 1182435: received in update for prefix XXXX:XXXX:XXX.XXX.XXX.X/XXX from X.X.X.X* The log is transfered by UDP from the cisco device to the Solaris server (where the syslog-ng runs). This is the configuration used in syslog-ng: *ntpsyslog> more /etc/syslog-ng/syslog-ng.conf* *@version: 3.0* *#* *# syslog-ng configuration file.* *#* *# See syslog-ng(8) and syslog-ng.conf(5) for more information.* *#* *options {* * stats_freq (0);* * flush_lines (0);* * time_reopen (10);* * log_fifo_size (1000);* * long_hostnames(off);* * use_dns (yes);* * use_fqdn (no);* * create_dirs (no);* * keep_hostname (yes);* * perm(0640);* *};* *source s_sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); udp(flags("no-multi-line")); };* *destination d_cons { file("/dev/console"); };* *destination d_mesg { file("/var/adm/messages"); };* *destination d_mail { file("/var/log/syslog"); };* *destination d_auth { file("/var/log/authlog"); };* *destination d_mlop { usertty("operator"); };* *destination d_mlrt { usertty("root"); };* *destination d_mlal { usertty("*"); };* *destination cisco { file("/respaldo/syslog/cisco/cisco.log"); };* *#----------------------------------------------------------------------* *# Forward to a nisip server* *#* *destination cnc-cisco { udp("X.X.X.X" port(X)); };* *#----------------------------------------------------------------------* *filter f_filter1 { level(err) or* * (level(notice) and facility (auth, kern)); };* *filter f_filter2 { level(err) or* * (facility(kern) and level(notice)) or* * (facility(daemon) and level(notice)) or* * (facility(mail) and level(crit)); };* *filter f_filter3 { level(alert) or* * (facility(kern) and level(err)) or* * (facility(daemon) and level(err)); };* *filter f_filter4 { level(alert); };* *filter f_filter5 { level(emerg); };* *filter f_filter6 { facility(kern) and level(notice); };* *filter f_filter7 { facility(mail) and level(debug); };* *#filter f_filter10 { level(alert); };* *filter f_filter9 { facility(user) and level(alert); };* *filter f_cisco { facility(local2); };* *# Alternativa* *log { source(s_sys_cisco); filter(f_cisco); destination(cisco); };* *# Alternativa* *source s_juniper { file("/respaldo/syslog/juniper/juniper.log"); };* *destination d_juniper_tcp { tcp("X.X.X.X" port(X)); };* *filter f_juniper_tcp {not match("TOPO|/kernel:|snmpd|trace_*|PING_*|BGP_*|bgp_*|repeated|task|task_connect|EVENT|received iff message|rshd|cron" value("MESSAGE* *")); };* *log { source(s_juniper); filter(f_juniper_tcp); destination(d_juniper_tcp); };* *source s_cisco { file("/respaldo/syslog/cisco/cisco.log"); };* *destination d_cisco_tcp { tcp("X.X.X.X" port(X)); };* *log { source(s_cisco); destination(d_cisco_tcp); };* *##################################* *# FWD from Syslog to CNC Cisco* *##################################* *source s_cisco { file("/respaldo/syslog/cisco/cisco.log"); };* *log {source(s_cisco); destination(cnc-cisco); };* *ntpsyslog>* I have tried different configurations in order to make the "no-multi-line" flag work. However, none of them have worked: destination cisco { file("/respaldo/syslog/cisco/cisco.log" flags(no-multi-line)); }; source s_sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); udp(flags("no-multi-line")); }; If more information is required, please do not hesitate to ask for it. Thank you beforehand for your help. Alan Sam

5 10

plugin options for Riak destination
by Parth Oberoi 20 May '15

20 May '15

Hello everyone, In order to build a riak destination , the first task is to figure out the options syslog-ng plugin would need to understand, For this we have considered the following two use cases 1) Inserting each log message into its own unique key.A templatable bucket would store keys(time-stamps) and its respective values(log messages) 2) Inserting each log message into a Set contained under a key. In order to use a set we need to have a bucket type as "set".Rest is similar to the first case. To switch between the two cases an option mode() is used with parameters "set" for using a set (2nd case) and "store" for the first case. Here is a config snippet for the destination: destination d_riak { riak( server("localhost") port(8087) bucket-type("message") bucket("logs_${YEAR}${MONTH}${DAY}") key("${UNIXTIME}-$(uuid)") value("$(format-json --scope selected-macros)") mode("set") ); }; I would really like to know if the users would prefer to set the mode and bucket type as separate options or as sub-options under bucket() as below: destination d_riak { riak( server("localhost") port(8087) bucket("logs_${YEAR}${MONTH}${DAY}" type("message") mode("store")) key("${UNIXTIME}-$(uuid)") value("$(format-json --scope selected-macros)") ); }; Any other feedback on the topic is also welcome. Thanks, Parth

3 2

Webmail Bildirimi
by balazs.scheidler＠balabit.com 19 May '15

19 May '15

1 0