July 2015 - syslog-ng - lists.balabit.hu

Reg; Syslog-ng does not recognize the audit facility
by Justin Kala 22 Feb '16

22 Feb '16

Hi Syslog-ng is unable to recognize the facility audit. When I put filter as audit and restart syslog-ng it errors out. When I put the facility code as 13 ,it does not error on restarting the service but does not capture the syslog message received through this filter code 13 as well. Please advise. -- Kaladhar

3 10

Create Pattern-DB rules
by Justin Kala 20 Oct '15

20 Oct '15

Hello I am trying to create Pattern-DB for the following Authorization messages coming from O/S. Can you help on creating a matching rule . Note: I do not have PATTERN-DB parser utility.I am going to create the db-parser.xml manually and put this rules inside the file. 2014-09-28T14:12:44-04:00 abcdef01-app/abcdef01-app sshd[11019]: [ID 800047 auth.notice] Failed password for root from 100.200.255.01 port 54438 ssh2 2014-09-28T14:03:46-04:00 abcdef01-app/abcdef01-app sshd[27420]: [ID 800047 auth.notice] Failed publickey for root from 100.200.255.02 port 59219 ssh2 2014-09-28T14:08:28-04:00 abcdef01-app/abcdef01-app sshd[3954]: [ID 800047 auth.notice] Failed keyboard-interactive for root from 100.200.255.03 port 65410 ssh2 2014-09-28T14:10:11-04:00 abcdef01-app/abcdef01-app sshd[5222]: [ID 293258 auth.error] libsldap: Status: 49 Mesg: openConnection: simple bind failed - Invalid credentials Thanks & Regards Kaladhar

4 16

"Error resolving hostname" for UDP Destination
by David Hauck 24 Aug '15

24 Aug '15

Hi, I've experienced problems starting syslog-ng related to hostname lookup on UDP destinations for a while now and am finally getting back to looking into some kind of mitigation for the exceptions. Here's what I see: if I have a destination configured with an endpoint that requires name lookup and the name lookup fails, I see the following error when attempting to start (or reload) syslog-ng: Starting syslog-ng: Error resolving hostname; host='test.nacc.netacquire.dom' Error initializing message pipeline; Unfortunately, this results in the entire process failing to start. If syslog-ng is otherwise running and I attempt to reload the configuration (with the problematic name present) I don't see any errors logged, but I do see that the process is now defunct (and is no longer running): root 18674 1 0 10:03 ? 00:00:00 supervising syslog-ng root 18701 18674 0 10:04 ? 00:00:00 [syslog-ng] <defunct> Here's the simple destination in question: destination d_NAaudit_Prio { file("/var/log/netacquire/audit_log" template(t_NAFormat_Prio)); udp("test.nacc.netacquire.dom" port(514) template(t_NAFormat_Prio)); }; I'm wondering if there might be some way to mitigate this exception. For example: 1. Log the error and allow syslog-ng to otherwise continue to start/function without the destination being configured/used. 2. As above, and suspend the destination but allow it to continue to attempt to probe the name lookup so that if the resolution does eventually succeed the destination can be resumed. Are either of the above options feasible/available? Are there any other ideas for how to mitigate this exception so that syslog-ng can be started/reloaded successfully (other than detecting this event a priori and removing the destination from the configuration before attempts to start/reload)? Thanks in advance! -David PS: Here's my version information: # syslog-ng --version syslog-ng 3.5.4.1 Installer-Version: 3.5.4.1 Revision: ssh+git://algernon@git.balabit/var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.5#master#4090ee62163780ae68a0c83cfdc23998c904fe97 Compile-Date: May 19 2015 17:04:36 Available-Modules: confgen,afstomp,afmongodb,linux-kmsg-format,cryptofuncs,afsocket,csvparser,dbparser,afamqp,afsocket-tls,syslogformat,afsocket-notls,afprog,basicfuncs,afuser,affile,system-source Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: on Enable-Linux-Caps: off Enable-Pcre: on

3 13

Syslog-ng cross compile
by Jacek Drewniak 04 Aug '15

04 Aug '15

Hello, I am trying to cross compile syslog-ng with yocto distro. I have problem with --prefix. I would like to install syslog-ng to some custom folder and than copy all files into my board. But prefix hadrcode files path into syslog-ng. It is very hard to copy compilled files from build directory (without --prefix and make install, to not install into my desktop). It is possible to --prefix installation without hardcode paths to files? In the other hand I configure syslog-ng without json but config still needs it. I have to delete *cim* to go further. *Error parsing config, Error compiling template (Unknown template function "format-json") in /usr/local/share/include/scl/cim/template.conf at line 23, column 32:* * included from /usr/local/etc/scl.conf line 32, column 1* * included from /usr/local/etc/syslog-ng.conf line 8, column 1* *template-function "format-cim" "$(format-json --pair @timestamp='${R_ISODATE}' --pair @message='${MSG}' --key .cim.* --shift 5 --key _* --key .* --replace-prefix .=_ --key *.*)\n";* * ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^* -- *Jacek Drewniak* R&D *email*: jacek.drewniak(a)oort.in *mobile*: *+**48 696 151 670* *website*: www.oort.in AWARDS Bluetooth Breakthrough Award Finalist CES 2015 Envisioneering Innovation & Design Award Winner Tech Trailblazers Awards Winner Most exciting company at Bluetooth Media Event in New York 2014 Polish Agency for Enterprise Development Award Winner

3 4

csv-parser deactivate default_flags strip_whitespaces
by mona 30 Jul '15

30 Jul '15

Dear all, How do I deactivate in the csv-parsers that the default flag setting includes stripping whitespace in Line 37? https://github.com/balabit/syslog-ng/blob/syslog-ng-3.7.0beta2/modules/csvp… <https://github.com/balabit/syslog-ng/blob/syslog-ng-3.7.0beta2/modules/csvp…> Kind regards, Mona

1 1

Errors compiling syslog-ng 3.6.4 in CentOS 7.1
by C. L. Martinez 29 Jul '15

29 Jul '15

Hi all, I am trying to update my syslog-ng 3.5.x release to syslog-ng 3.6.4. When I run autogen.sh, the following error appears: [root@c071pubwww syslog-ng-syslog-ng-3.6.4]# ./autogen.sh Running autogen in 'lib/ivykis'... Don't know how to bootstrap submodule 'lib/ivykis' Any idea??

3 5

Syslog-ng v3.5.3 - Core dump from a certain incoming message?
by Clayton Dukes 28 Jul '15

28 Jul '15

Has anyone seen this or know what may be causing it? When I run a stack trace, I can see that this host causes syslog-ng to crash every time it sends a message I've run a couple of tcpdumps and it *seems* to be caused by an ARP request from a Cyclades box. This seems very odd to me of course. 10 130.085308 Cyclades_01:be:4b SuperMic_9a:58:be ARP 60 Who has x.x.188.52? Tell x.x.188.11 The *only* other packets from that host are repeated so they don't seem to be the cause: 4 1.000259 x.x.188.11 x.x.188.52 Syslog 257 LOCAL0.NOTICE: Jul 23 11:04:05 src_dev_log@ACS-01 Buffering: S12.Server-Farm-6509-01 [Jul 23 11:04:03.267 EDT: %MCAST-SP-3-QUERY_INT_MISMATCH: Snooping Querier received a non-matching query interval (125000 msec),]\n [pid 28379] recvfrom(9, "<133>Jul 23 10:19:58 src_dev_log"..., 8192, 0, {sa_family=AF_INET, sin_port=htons(3284), sin_addr=inet_addr("x.x.188.11")}, [16]) = 181 [pid 28379] stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 [pid 28379] mprotect(0x7f956c346000, 12288, PROT_READ|PROT_WRITE) = 0 [pid 28379] write(2, "**\nERROR:../../lib/logmsg.c:535:"..., 114) = 114 [pid 28379] rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0 [pid 28379] tgkill(28374, 28379, SIGABRT) = 0 [pid 28379] --- SIGABRT {si_signo=SIGABRT, si_code=SI_TKILL, si_pid=28374, si_uid=0} --- [pid 28379] +++ killed by SIGABRT (core dumped) +++ [pid 28434] +++ killed by SIGABRT (core dumped) +++ [pid 28428] +++ killed by SIGABRT (core dumped) +++ +++ killed by SIGABRT (core dumped) +++ ______________________________________________________________ Clayton Dukes ______________________________________________________________

3 2

syslog-ng GSoC IRC event
by Budai, László 20 Jul '15

20 Jul '15

Hi, after midterm, we will have an IRC meeting. Participants: mainly students and mentors, and of course anyone else who are interested in :-) Topics: * Where are we now? Status updates on projects. * Talking about on how to share your results with community. (online demos, blogs, whatever...) DATE: Tue 7/21/15 4:00 PM – 5:00 PM Time zone: Budapest regards, Laszlo Budai

1 0

Behaviour with unavailable TCP destination
by ZeroUno 20 Jul '15

20 Jul '15

Hello, I was wondering what happens when you define a tcp() destination in syslog-ng.conf and then the destination is temporarily not available. I was not able to find the answer in the docs. Are any messages lost? Or are they kept somewhere and sent again when the destination becomes available again? Thank you. -- 01

3 2

Re: [syslog-ng] Using FIPS complaint OpenSSL with syslog-ng OSE
by Laszlo Budai 17 Jul '15

17 Jul '15

Hi, FIPS compliant OpenSSL is an openssl compiled and linked with FIPS object module. If syslog-ng not using disabled crypto functions (eg. md5) then it should work. Give it a try and if you will have some problems, just open an issue on our github page. regards, Laszlo Budai Sent from my HTC ----- Reply message ----- From: "Saurabh Shukla" <saurabh(a)purestorage.com> To: <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] Using FIPS complaint OpenSSL with syslog-ng OSE Date: Thu, Jul 16, 2015 22:43 Hi, I see that syslog-ng OSE uses OpenSSL libraries for TLS support. If my system has FIPS complaint OpenSSL installed, will syslog-ng OSE use those FIPS compliant libraries for TLS support? Do I need any change in the syslog-ng OSE's configuration for this? Thanks, -- Saurabh Shukla ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0