August 2015 - syslog-ng - lists.balabit.hu

Reg; Syslog-ng does not recognize the audit facility
by Justin Kala 22 Feb '16

22 Feb '16

Hi Syslog-ng is unable to recognize the facility audit. When I put filter as audit and restart syslog-ng it errors out. When I put the facility code as 13 ,it does not error on restarting the service but does not capture the syslog message received through this filter code 13 as well. Please advise. -- Kaladhar

3 10

Create Pattern-DB rules
by Justin Kala 20 Oct '15

20 Oct '15

Hello I am trying to create Pattern-DB for the following Authorization messages coming from O/S. Can you help on creating a matching rule . Note: I do not have PATTERN-DB parser utility.I am going to create the db-parser.xml manually and put this rules inside the file. 2014-09-28T14:12:44-04:00 abcdef01-app/abcdef01-app sshd[11019]: [ID 800047 auth.notice] Failed password for root from 100.200.255.01 port 54438 ssh2 2014-09-28T14:03:46-04:00 abcdef01-app/abcdef01-app sshd[27420]: [ID 800047 auth.notice] Failed publickey for root from 100.200.255.02 port 59219 ssh2 2014-09-28T14:08:28-04:00 abcdef01-app/abcdef01-app sshd[3954]: [ID 800047 auth.notice] Failed keyboard-interactive for root from 100.200.255.03 port 65410 ssh2 2014-09-28T14:10:11-04:00 abcdef01-app/abcdef01-app sshd[5222]: [ID 293258 auth.error] libsldap: Status: 49 Mesg: openConnection: simple bind failed - Invalid credentials Thanks & Regards Kaladhar

4 16

Advice on the right destination
by Giovanni Mancuso 31 Aug '15

31 Aug '15

Hi, I am writing to ask your advice on a solution I'm thinking. I have 12 servers with postfix, amavisd-new and other custom software that manage the e-mail system and I was working in a web interface to analysis the logs and correlation with the ability to search for certain fields (from, to, message-id , date). All applications send the logs to a centralized syslog-ng, and I was trying to understand which type of "destination" is better to use to ensure the rapid search. I was analyzing the possibility of using elasticsearch, but I don't know neither it or its performances. The quantity of data is very high, about 3TB of data monthly or each machine, with 2 years of retention. What do you think about? Have you any suggestions? Thanks -- *Giovanni Mancuso* System Architect *T* 06.9826.9600 *M* +39.340.65.80.739 *F* 06.9826.9680 P.zza S.Benedetto da Norcia, 33 - 00071 Pomezia (RM) Par-Tec S.p.A. <http://www.par-tec.it> Web Site <http://www.par-tec.it> info(a)par-tec.it <mailto:info@par-tec.it> Pagina Facebook <https://www.facebook.com/ParTecSpA> Profilo Twitter <https://twitter.com/partecspa> Pagina LinkedIn <https://www.linkedin.com/company/par-tec/> Canale YouTube <https://www.youtube.com/user/ParTecSpA> CONFIDENZIALE: Questo messaggio ed i suoi allegati sono di carattere confidenziale per i destinatari in indirizzo. È vietato l'inoltro non autorizzato a destinatari diversi da quelli indicati nel messaggio originale. Se ricevuto per errore, l'uso del contenuto è proibito; si prega di comunicarlo al mittente e cancellarlo immediatamente.

2 1

Can't get syslog-ng to start...
by Mason, Tron 31 Aug '15

31 Aug '15

All, I keep getting the following when attempting to start syslog-ng: /usr/local/etc/syslog-ng/syslog-ng.conf: line 10: @version:: command not found /usr/local/etc/syslog-ng/syslog-ng.conf: line 12: syntax error near unexpected token `(' /usr/local/etc/syslog-ng/syslog-ng.conf: line 12: `options { use_dns(yes);' Not sure why I'm getting these messages when I'm running a later version: bash-3.2# /usr/local/sbin/syslog-ng -V syslog-ng 3.2.4 Installer-Version: 3.2.4 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#ef7b91e4a1b1f9628c66138b4ae83de7e4c697c6 Compile-Date: Jun 9 2011 05:24:53 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: on Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: on Enable-Pacct: off bash-3.2# more /usr/local/etc/syslog-ng/syslog-ng.conf # Syslog-ng example configuration file for Solaris # # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.solaris,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # Current syslog-ng binary version 1.5.16 # # Solaris 2.5.1 and below uses the STREAMS driver, above extends it # with doors. For 2.5.1 remove the door() option from the source declaration. # @version: 3.2.4 options { use_dns(yes); # use_time_recvd(yes); chain_hostnames(off); log_fifo_size(1000); }; #source local { sun-streams("/dev/log" door("/var/run/syslog_door")); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; #source s_tcp { tcp(port(5014) max-connections(100); }; #source s_tcp { tcp(ip(0.0.0.0) port(5014)); }; source s_udp { udp(); }; # source s_udp { udp(ip(0.0.0.0) port(514)); }; ..........

3 3

Some development notes on 3.7
by Budai, László 26 Aug '15

26 Aug '15

Hi, after the 3.7 is out we would had to create a new 3.7/master branch, but I would postpone this step at a later point. Why? Because I know that there are some fixes in the queue what we would have to forward port to 3.8 and some of them to 3.6. This branching will be a lazy one: we will branch it when we have to, but not earlier. L.

1 0

Forwarding system startup messages
by Saurabh Shukla 25 Aug '15

25 Aug '15

I am running syslog-ng 3.6.4 and I have the following destination and log path configured that forwards all messages to the destination: destination remote { network("remote.example.com" port(514) transport(tcp) log_fifo_size(2048)); }; log { source(s_all); destination(remote); flags(flow-control);}; When the system reboots, I see that startup messages from the kernel are logged into /var/log/syslog. syslog-ng establishes a connection to the remote destination around 10 sec after the first message was logged into /var/log/syslog. However, it fails to forward any message that was logged into /var/log/syslog during the first 10 seconds even though I have the output buffer and flow control configured. Is this a bug in syslog-ng or am I missing some configuration steps? Thanks, -- Saurabh

2 8

"Error resolving hostname" for UDP Destination
by David Hauck 24 Aug '15

24 Aug '15

Hi, I've experienced problems starting syslog-ng related to hostname lookup on UDP destinations for a while now and am finally getting back to looking into some kind of mitigation for the exceptions. Here's what I see: if I have a destination configured with an endpoint that requires name lookup and the name lookup fails, I see the following error when attempting to start (or reload) syslog-ng: Starting syslog-ng: Error resolving hostname; host='test.nacc.netacquire.dom' Error initializing message pipeline; Unfortunately, this results in the entire process failing to start. If syslog-ng is otherwise running and I attempt to reload the configuration (with the problematic name present) I don't see any errors logged, but I do see that the process is now defunct (and is no longer running): root 18674 1 0 10:03 ? 00:00:00 supervising syslog-ng root 18701 18674 0 10:04 ? 00:00:00 [syslog-ng] <defunct> Here's the simple destination in question: destination d_NAaudit_Prio { file("/var/log/netacquire/audit_log" template(t_NAFormat_Prio)); udp("test.nacc.netacquire.dom" port(514) template(t_NAFormat_Prio)); }; I'm wondering if there might be some way to mitigate this exception. For example: 1. Log the error and allow syslog-ng to otherwise continue to start/function without the destination being configured/used. 2. As above, and suspend the destination but allow it to continue to attempt to probe the name lookup so that if the resolution does eventually succeed the destination can be resumed. Are either of the above options feasible/available? Are there any other ideas for how to mitigate this exception so that syslog-ng can be started/reloaded successfully (other than detecting this event a priori and removing the destination from the configuration before attempts to start/reload)? Thanks in advance! -David PS: Here's my version information: # syslog-ng --version syslog-ng 3.5.4.1 Installer-Version: 3.5.4.1 Revision: ssh+git://algernon@git.balabit/var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.5#master#4090ee62163780ae68a0c83cfdc23998c904fe97 Compile-Date: May 19 2015 17:04:36 Available-Modules: confgen,afstomp,afmongodb,linux-kmsg-format,cryptofuncs,afsocket,csvparser,dbparser,afamqp,afsocket-tls,syslogformat,afsocket-notls,afprog,basicfuncs,afuser,affile,system-source Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: on Enable-Linux-Caps: off Enable-Pcre: on

3 13

How to disable DNS resolution in syslog-ng?
by Peter Volkov 24 Aug '15

24 Aug '15

Hi guys. Whenever syslog-ng start without networking it hangs trying to resolve hostname it runs on (checked with tcpdump). Now I've tried to add use_dns(no); into configuration file but delay still in place: options { use_dns(no); use_fqdn(no); } I've tried to google, but still failed to find answer: Is there any way to disable this hostname resolution delay? Thank in advance, -- Peter.

2 1

syslog-ng split long rows
by Giovanni Mancuso 18 Aug '15

18 Aug '15

Hi, i try to do a simple configuration of syslog-ng: Konsole output source mailet_log { file("/opt/myApp/mylog.log"log_msg_size(81920)); }; destination mailet_test { file("/tmp/mylog_syslog.log"); }; log { source(mailet_log); destination(mailet_test); }; It works, but if i have in a source file a row that has Konsole output70410 70410 char (for example), in the destionation file i have two different row (first: 65024 char, second: 5433 char). Is it normal? can i configure syslog-ng to not split the lines? Thanks --

4 7

Multiple failures while inserting this record to the java destination, message dropped
by Jacek Drewniak 18 Aug '15

18 Aug '15

Hello, from yesterday passing logs to elasticsearch is strange. It works some times, for example by 1 hour, and then nothings happens. I had changed parsing logs to syslog-protocol, but I tried with the default file parsing too. No errors, warnings, nothing. I left my station for 24h and I can see that log appears in the night, but this time ends with this errors: PROGRAM:syslog-ng PRIORITY:err PID:21417 MESSAGE:Failed to send message: failed to parse; ISODATE:August 17th 2015, 23:34:07.000 PROGRAM:syslog-ng PRIORITY:err PID:21417 MESSAGE:Multiple failures while inserting this record to the java destination, message dropped; number_of_retries='3' ISODATE:August 17th 2015, 23:34:07.000 -- *Jacek Drewniak* R&D *email*: jacek.drewniak(a)oort.in *mobile*: *+**48 696 151 670* *website*: www.oort.in AWARDS Bluetooth Breakthrough Award Finalist CES 2015 Envisioneering Innovation & Design Award Winner Tech Trailblazers Awards Winner Most exciting company at Bluetooth Media Event in New York 2014 Polish Agency for Enterprise Development Award Winner

1 0