June 2015 - syslog-ng - lists.balabit.hu

TOS value updating from afinet_setup_socket
by Dilip Basavaraju 12 Jun '15

12 Jun '15

Dear All, I am facing issue in updating TOS value using setsockopt in the function afinet_setup_socket. //syslog_ng_dscp_val = 40; setsockopt(fd, SOL_IP, IP_TOS, &syslog_ng_dscp_val, sizeof(syslog_ng_dscp_val)); below is the function definition. I am not getting any print messages. I think this function is not being called. Please suggest me how to update the TOS value. I am waiting for your responses please. static gboolean afinet_setup_socket(gint fd, GSockAddr *addr, InetSocketOptions *sock_options, AFSocketDirection dir) { gint off = 0; if (!afsocket_setup_socket(fd, &sock_options->super, dir)) return FALSE; switch (addr->sa.sa_family) { case AF_INET: { struct ip_mreq mreq; if (dir & AFSOCKET_DIR_RECV) { memset(&mreq, 0, sizeof(mreq)); setsockopt(fd, SOL_IP, IP_ADD_MEMBERSHIP, &mreq, sizeof(mreq)); if (dir & AFSOCKET_DIR_SEND) setsockopt(fd, SOL_IP, IP_MULTICAST_TTL, &sock_options->ttl, sizeof(sock_options->ttl)); } else { if (sock_options->ttl && (dir & AFSOCKET_DIR_SEND)) setsockopt(fd, SOL_IP, IP_TTL, &sock_options->ttl, sizeof(sock_options->ttl)); } #if CONFIG_CP_DSCP //setsockopt(fd, SOL_IP, IP_TOS, &syslog_ng_dscp_val, sizeof(syslog_ng_dscp_val)); int tmpSouravVal = 40; //dilipu setsockopt(fd, SOL_IP, IP_TOS, &tmpSouravVal, sizeof(syslog_ng_dscp_val)); #if (CONFIG_CP_IPV6 && CONFIG_CP_DSCP) setsockopt(fd, IPPROTO_IPV6, IPV6_TCLASS, &syslog_ng_dscp_val, sizeof(syslog_ng_dscp_val)); #endif #else if (sock_options->tos && (dir & AFSOCKET_DIR_SEND)) setsockopt(fd, SOL_IP, IP_TOS, &sock_options->tos, sizeof(sock_options->tos)); #endif break; } } return TRUE; } Thanks and regards Dilip Kumar B [https://relayq.larsentoubro.com/DigitalSignature2015.jpg] L&T Technology Services Ltd www.LntTechservices.com<http://www.lnttechservices.com/> This Email may contain confidential or privileged information for the intended recipient (s). If you are not the intended recipient, please do not use or disseminate the information, notify the sender and delete it from your system.

2 3

Integrating with snmp traps
by Fabien Wernli 11 Jun '15

11 Jun '15

Hi, Does anybody on this fine list handle SNMP traps using syslog-ng? We used to just forward logs using syslog and snmptrapd as suggested on an old blog post from Baszi. The problem with this approach is that the messages are flat. We would actually like to parse all the key-values from the original payload, anyone done that before? Thanks!

2 6

organizing logs over network
by westlake 11 Jun '15

11 Jun '15

if i use source-> system(facility(local0)); and use an application that sends to local0, what's the most effective way of categorizing this into a special log file if the destination is over network? I'm using two dns machines and they both send output to one logging machine. So far I'm using the host() directive with filter{} and two log{} entries on the recipient, this way I can create a log depending on the ip. Is there a better way to organize the logs instead of using host() with filter{} ? thanks

2 1

Fedora packages for syslog-ng 3.6.3
by Czanik, Péter 10 Jun '15

10 Jun '15

Hi, syslog-ng 3.6.3 was released yesterday with a long list of bugfixes: https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.6.3 As usual, my unofficial Fedora packages follow. This time without Fedora 20 and EPEL7 (due to a systemd problem to be fixed by the next release). Packages are available at https://copr.fedoraproject.org/coprs/czanik/syslog-ng36/ Fedora 22 syslog-ng packages is added, but no incubator yet (one of the dependencies fails to compile). If you have any problems, please let me know! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

openSUSE/SLES packages for syslog-ng 3.6.3
by Czanik, Péter 10 Jun '15

10 Jun '15

Hi, syslog-ng 3.6.3 was released yesterday with a long list of bugfixes: https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.6.3 As usual, my unofficial openSUSE/SLES packages follow. This time without openSUSE 13.1 (due to a systemd problem to be fixed by the next release). Packages are available at https://build.opensuse.org/project/show/home:czanik:syslog-ng36 If you have any problems, please let me know! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Re: [syslog-ng] Integrating with snmp traps
by Jim Hendrick 09 Jun '15

09 Jun '15

Couldn't that be done using patterndb? Sent from my Verizon Wireless 4G LTE smartphone -------- Original message -------- From: Fabien Wernli <wernli(a)in2p3.fr> Date: 06/09/2015 10:29 AM (GMT-05:00) To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] Integrating with snmp traps Hi, On Tue, Jun 09, 2015 at 06:26:40AM -0700, Evan Rempel wrote: > When you say you "would actually like to parse all the key-values from > the original payload" what do you mean? > Do you want to process them with syslog-ng filters etc, or are you > feeding this to another type of structured worker thread? I'd like to basically have the structured SNMP message parsed in syslog-ng, in the same way json-parser() parses JSON payload, and makes the key-values available as macros in syslog-ng. ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

2 1

syslog() issue
by westlake 09 Jun '15

09 Jun '15

I'm not sure why i'm getting this error, output: syslog-ng --syntax-only Error parsing afsocket, syntax error, unexpected KW_IP, expecting LL_IDENTIFIER or LL_STRING in /etc/syslog-ng/syslog-ng.conf at line 31, column 9: syslog( ip(1.1.1.1) port(601) transport("tcp") ); mind me i'm new to syslog but i'm following the example from the online manual, not sure why this isn't working thanks

2 2

Solaris & Linux (RH6) Console and SSH Use Logging
by wiskbroom＠hotmail.com 08 Jun '15

08 Jun '15

Greetings; This is question is slightly OT, but I can't imagine a better place to ask; so please, no flames. I would like to begin logging all attempts (succesful, failed, no password given, etc) to login to Sparc/Solaris machines, as well as RedHat 6 Linux boxes. My clients are using stock syslog, but my server is running syslog-NG; my second goal is to redirect all login type logs to just one file for ALL of my Solaris & Linux servers. Does anyone have a known good syslog config file for both Solaris, and Linux? Also, a good syslog-NG entry to force just the console and ssh data into a separate file? Thank you! .vp

2 2

mongodb not found in /etc/syslog-ng/syslog-ng.conf at line 30, column 23:
by Rick Silacci 08 Jun '15

08 Jun '15

Hi, Can you tell what I'm doing wrong here? I entered destination mongodb { mongodb(); }; log { source(src); destination(mongodb); }; in syslogng.conf as in the directions and this is what happens: user@syslog:~/syslogng-web$ sudo service syslog-ng restart * Stopping system logging syslog-ng [ OK ] * Starting system logging syslog-ng Error parsing destination, destination plugin mongodb not found in /etc/syslog-ng/syslog-ng.conf at line 30, column 23: destination mongodb { mongodb() ; }; ^^^^^^^

2 2

Syslog-ng OSE with Juniper SIEM
by Muhammad Asim 08 Jun '15

08 Jun '15

Dear All I would like to know if there has been any integration done among syslog-ng OSE with Juniper Secure Analytics. Regards, Muhammad Asim | Senior Systems Engineer - ME, Pakistan | Juniper Networks, Inc. | (M) +923018510555 (O) +92518435204, +92518445530

3 3