September 2015 - syslog-ng - lists.balabit.hu

Reg; Syslog-ng does not recognize the audit facility
by Justin Kala 22 Feb '16

22 Feb '16

Hi Syslog-ng is unable to recognize the facility audit. When I put filter as audit and restart syslog-ng it errors out. When I put the facility code as 13 ,it does not error on restarting the service but does not capture the syslog message received through this filter code 13 as well. Please advise. -- Kaladhar

3 10

Create Pattern-DB rules
by Justin Kala 20 Oct '15

20 Oct '15

Hello I am trying to create Pattern-DB for the following Authorization messages coming from O/S. Can you help on creating a matching rule . Note: I do not have PATTERN-DB parser utility.I am going to create the db-parser.xml manually and put this rules inside the file. 2014-09-28T14:12:44-04:00 abcdef01-app/abcdef01-app sshd[11019]: [ID 800047 auth.notice] Failed password for root from 100.200.255.01 port 54438 ssh2 2014-09-28T14:03:46-04:00 abcdef01-app/abcdef01-app sshd[27420]: [ID 800047 auth.notice] Failed publickey for root from 100.200.255.02 port 59219 ssh2 2014-09-28T14:08:28-04:00 abcdef01-app/abcdef01-app sshd[3954]: [ID 800047 auth.notice] Failed keyboard-interactive for root from 100.200.255.03 port 65410 ssh2 2014-09-28T14:10:11-04:00 abcdef01-app/abcdef01-app sshd[5222]: [ID 293258 auth.error] libsldap: Status: 49 Mesg: openConnection: simple bind failed - Invalid credentials Thanks & Regards Kaladhar

4 16

Elasticsearch destination and time-zone info
by Evan Rempel 05 Oct '15

05 Oct '15

We are in the process of integrating our logging infrastructure into elasticsearch with Kibana, but have a slight challenge regarding time zones. Some of our equipment will only log in UTC time. This is not an issue because Kibana does time presentation in localtime. Most of our hosts log with our local timezone. This all works out fine due to the way kibana displays the logs - localtime. The problem is that the elasticsearch indexes roll over based on some template (XXXX-YYYY-MM-DD) or such, and this template will an incorrect set of messages. For example, I live in time zone -7:00. This means that any messages after 17:00 (17:00 + 7:00 = 00:00 the next day) that were logged with UTC will go into the index for the next day. So, is there any way to set the time-zone option for the elasticsearch destination? Alternatively, are there any date templates where I could do something like $(timezone UTC $ISODATE) $(timezone UTC $HOUR) in my template? Any help would be appreciated. -- Evan Rempel erempel(a)uvic.ca Senior Systems Administrator 250.721.7691 Data Centre Services, University Systems, University of Victoria

4 9

Re: [syslog-ng] How to unsubscribe from this mailers
by Mayur Saxena (maysaxen) 02 Oct '15

02 Oct '15

2 1

TCP Resets
by Michael Starks 02 Oct '15

02 Oct '15

I am running syslog-ng 3.4.7 as distributed by ELSA. I have a problem whereby nxlog agents (v2.9.1347) making a new TCP connection to the syslog-ng server repeatedly show lines like this in nxlog.log: 2015-09-28 14:28:25 INFO reconnecting in 1 seconds Many connections are working, but it especially has a problem with new agents coming online. Sometimes when I restart syslog-ng it helps, but not always. Other than the standard ELSA config, I am simply also writing to a filesystem destination. If I remove the elsa.pl destination, I still have problems. The problem isn't necessarily related to just nxlog agents. I also have a Cisco proxy that is using TCP to send logs, and that is also getting RSTs sent to it. I tried v3.6.3 and that didn't seem to help. A packet capture shows the SYN from the agent, a SYN ACK, another SYN, then a FIN *prior* to the data packet being received. Immediately after the data packet, the log server sends a RST. As a result, I have a bunch of TIME_WAITs open. No host firewall is running. I am currently only bursting to about 350 EPS and I have syslog-ng running in the foreground looking for dropped packets like so (there haven't been any): /usr/local/syslog-ng-3.4.7/sbin/syslog-ng -Ftvd 2>&1 | grep "dropping messages" Any assistance would be greatly appreciated! Currently loaded syslog-ng.conf: # cat /usr/local/syslog-ng/etc/syslog-ng.conf @version: 3.2 options { log_fifo_size(30000); #threaded(yes); # enable if using Syslog-NG 3.3.x use_dns (no); # IMPORTANT! A busy syslog server can become unresponsive if DNS lookups fail, so we disable them. use_fqdn (no); keep_hostname (yes); }; source s_network { # no-multi-line means parse message as-is, newlines included, to allow for multi-line messages tcp(flags(no-multi-line)); udp(flags(no-multi-line)); }; source s_internal { internal(); }; source s_realtime { pipe("/data/elsa/tmp/realtime" flags(expect-hostname)); }; source s_import { pipe("/data/elsa/tmp/import" flags(expect-hostname syslog-protocol)); }; source s_ops { unix-dgram("/data/elsa/tmp/ops" flags(expect-hostname syslog-protocol no-multi-line)); }; parser p_db { db-parser(file("/usr/local/elsa/node/conf/merged.xml")); }; filter f_rewrite_cisco_program { match('^(%[A-Z\_]+\-\d\-[0-9A-Z\_]+): ([^\n]+)' value("MSGONLY") type("pcre") flags("store-matches" "nobackref")); }; filter f_rewrite_cisco_program_2 { match('^[\*\.]?(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+\d{1,2}\s\d{1,2}:\d{1,2}:\d{1,2}(?:\.\d+)?(?: [A-Z]{3})?: (%[^:]+): ([^\n]+)' value("MSGONLY") type("pcre") flags("store-matches" "nobackref")); }; filter f_rewrite_cisco_program_3 { match('^\d+[ywdh]\d+[ywdh]: (%[^:]+): ([^\n]+)' value("MSGONLY") type("pcre") flags("store-matches" "nobackref")); }; filter f_rewrite_cisco_program_4 { match('^\d{6}: [\*\.]?(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+\d{1,2}\s\d{1,2}:\d{1,2}:\d{1,2}(?:\.\d+)?(?: [A-Z]{3})?: (%[^:]+): ([^\n]+)' value("MSGONLY") type("pcre") flags("store-matches" "nobackref")); }; filter f_unclassified { "${.classifier.class}" eq "unknown" }; rewrite r_unparsed { set("98", value("MSGID")); }; rewrite r_cisco_program { set("$1", value("PROGRAM") condition(filter(f_rewrite_cisco_program) or filter(f_rewrite_cisco_program_2) or filter(f_rewrite_cisco_program_3) or filter(f_rewrite_cisco_program_4))); set("$2", value("MESSAGE") condition(filter(f_rewrite_cisco_program) or filter(f_rewrite_cisco_program_2) or filter(f_rewrite_cisco_program_3) or filter(f_rewrite_cisco_program_4))); }; rewrite r_snare { subst("MSWinEventLog.+(Security|Application|System).+", "$1", value("PROGRAM") flags(global)); }; # URL encode any literal pipes so the tab rewriter doesn't introduce ambiguity rewrite r_from_pipes { subst('\|', "%7C", value("MESSAGE") flags(global) condition(program("bro_*" type(glob)))); }; #rewrite r_from_pipes { subst('\|', "%7C", value("MESSAGE") flags(global)); }; rewrite r_pipes { subst("\t", "|", value("MESSAGE") flags(global)); }; rewrite r_host { set("$SOURCEIP", value("HOST")); }; rewrite r_extracted_host { set("$pdb_extracted_sourceip", value("HOST") condition("$pdb_extracted_sourceip" != "")); }; rewrite r_extracted_timestamp { set("$S_UNIXTIME", value("SOURCE")); set("$pdb_extracted_timestamp", value("SOURCE") condition("$pdb_extracted_timestamp" != "")); }; template t_db_parsed { template("$R_UNIXTIME\t$HOST\t$PROGRAM\t${.classifier.class}\t$MSGONLY\t${i0}\t${i1}\t${i2}\t${i3}\t${i4}\t${i5}\t${s0}\t${s1}\t${s2}\t${s3}\t${s4}\t${s5}\n"); }; template t_db_parsed_import { template("$MSGID\t$SOURCE\t$HOST\t$PROGRAM\t${.classifier.class}\t$MSGONLY\t${i0}\t${i1}\t${i2}\t${i3}\t${i4}\t${i5}\t${s0}\t${s1}\t${s2}\t${s3}\t${s4}\t${s5}\n"); }; template t_ops { template("$S_UNIXTIME\t$HOST\t$PROGRAM\t$MSGID\t$MSGONLY\t${.SDATA.elsa@32473.line_number}\t${.SDATA.elsa@32473.pid}\t${.SDATA.elsa@32473.client}\t${.SDATA.elsa@32473.qid}\t\t\t${.SDATA.elsa@32473.priority}\t${.SDATA.elsa@32473.file}\t${.SDATA.elsa@32473.method}\t${.SDATA.elsa@32473.hostname}\t\t\n"); }; template t_unparsed { template("Unparsed host=$HOST program=$PROGRAM msg=$MSGONLY\n"); }; destination d_elsa { program("perl /usr/local/elsa/node/elsa.pl -c /etc/elsa_node.conf" template(t_db_parsed)); }; destination d_elsa_import { program("perl /usr/local/elsa/node/elsa.pl -c /etc/elsa_node.conf -f __IMPORT__" template(t_db_parsed_import)); }; destination d_elsa_ops { program("perl /usr/local/elsa/node/elsa.pl -c /etc/elsa_node.conf -f __OPS__" template(t_ops)); }; destination d_unclassified { unix-dgram("/data/elsa/tmp/ops" flags(syslog-protocol) template(t_unparsed)); }; destination d_debug { unix-dgram("/data/elsa/tmp/debug" template(t_db_parsed)); }; # Custom destination -Mike destination d_hosts { file("/data/logs/$HOST/$HOST.log"); }; include /etc/elsa_syslog-ng.conf; #log { # source(s_ops); # destination(d_elsa_ops); # flags(final); #}; #log { # source(s_network); # source(s_realtime); # rewrite(r_host); # rewrite(r_cisco_program); # rewrite(r_snare); # rewrite(r_from_pipes); # rewrite(r_pipes); # parser(p_db); # rewrite(r_extracted_host); # ###FILTER_UNPARSED###log { filter(f_unclassified); rewrite(r_unparsed); destination(d_unclassified); flags(final); }; # log { destination(d_elsa); }; # log { destination(d_debug); }; #}; #log { # source(s_import); # rewrite(r_cisco_program); # rewrite(r_snare); # rewrite(r_from_pipes); # rewrite(r_pipes); # parser(p_db); # rewrite(r_extracted_host); # rewrite(r_extracted_timestamp); # destination(d_elsa_import); #}; # cat /etc/elsa_syslog-ng.conf ################################## #### Global Options ######### ################################## options { check_hostname(yes); create_dirs(yes); dir_group(log_analyst); dir_owner(root); dir_perm(0550); group(log_analyst); owner(root); perm(0640); # Let's not be vulnerable to DNS attacks and general problems dns_cache(no); use_dns(no); # Keep the original hostname (good for relay servers) keep_hostname(yes); # Keep original timestamp (not received time) - this could be forged, so use caution during forensincs examinations keep_timestamp(yes); }; ################################## ########### Sources ######### ################################## # Source for local system logs source s_local { # message generated by Syslog-NG internal(); # standard Linux log source (this is the default place for the syslog() # function to send logs to) unix-stream("/dev/log"); # messages from the kernel file("/proc/kmsg" program_override("kernel: ")); }; ################################## ######### Destinations ########## ################################## # This is the directory structure that will be automatically created as logs come in destination d_hosts { file("/data/logs/$HOST/$HOST.log"); };

2 2

Syslog ng and Mysql
by Arash Shams 01 Oct '15

01 Oct '15

Hello ELK solution is not suitable for us to collect all logs in one server . i prefer to use syslog-ng to collect all logs in Mysql database. is there possible to send all servers log to one syslog-ng server and that collect them to database ? anyone can give me a good configuration file or some examples in this case ? thank you

7 20

Issues with lowercase hostname on 3.2.5
by Kay N. Avila 25 Sep '15

25 Sep '15

Hello, I'm running syslog-ng 3.2.5 from EPEL on RHEL and having an issue with the $HOST variable. My destination is destination device_log { file("/<snipped>/$HOST.log"); }; and that is working, except the file is created with an uppercase name if the host reports it that way. I'd like them to all be consistently lowercase. I can't use a DNS look up instead since not all of the hosts have reverse DNS set for their IPs. I've tried normalize-hostnames(yes); in the global options but it doesn't seem to make a difference. Also I don't believe $(lowercase ...) is available to me in 3.2.5. I've read through the documentation and have come up empty. What am I missing? Apologies if this has been asked before; I searched the list but couldn't find anything. Thanks for any pointers, Kay Avila

3 4

kafka destination of syslog-ng 3.7.1
by Szabó, István 22 Sep '15

22 Sep '15

Hi, kafka destination using the official apache kafka java libraries have been release in syslog-ng 3.7.1. May I ask if anyone is already using it and can share any experience with using it? Thanks and best regards, Istvan

1 0

Re: [syslog-ng] unofficial syslog-ng 3.7.1 Debian packages
by Budai, László 22 Sep '15

22 Sep '15

Hi, I think this is fixed by https://github.com/balabit/syslog-ng/pull/684 . Debian packages will be updated soon. L. On Tue, Sep 22, 2015 at 11:27 AM, Németh, Balázs <balazs.nemeth(a)balabit.com> wrote: > Hello, > > Which package should provide the following file? > /usr/share/syslog-ng/xsd/patterndb-4.xsd > > dpkg -S /usr/share/syslog-ng/xsd/patterndb-4.xsd > Returns nothing. > > Without that I cannot validate my patterndb sets. > > warning: failed to load external entity > "/usr/share/syslog-ng/xsd/patterndb-4.xsd" > Schemas parser error : Failed to locate the main schema resource at > '/usr/share/syslog-ng/xsd/patterndb-4.xsd'. > WXS schema /usr/share/syslog-ng/xsd/patterndb-4.xsd failed to compile > /tmp/O1tb4DMkvj.xml: xmllint returned an error, the executed command was: > xmllint --noout --nonet --schema /usr/share/syslog-ng/xsd/patterndb-4.xsd > /tmp/O1tb4DMkvj.xml > > dpkg -l | grep syslog-ng >> ii syslog-ng-core 3.7.1-1 >> amd64 Enhanced system logging daemon (core) >> ii syslog-ng-mod-journal 3.7.1-1 >> >> lsb_release -a >> No LSB modules are available. >> Distributor ID: Debian >> Description: Debian GNU/Linux 8.2 (jessie) >> Release: 8.2 >> Codename: jessie >> > > Thanks in advance, > > 2015-08-17 16:46 GMT+02:00 Budai, László <laszlo.budai(a)balabit.com>: > >> Hi, >> >> I've just created my unofficial OBS repo[1] for syslog-ng 3.7.1 series >> (current version: 3.7.1-1 ). >> >> List of supported OSs (i386/amd64): >> * Debian 7.0 >> * Debian 8.0 >> * Ubuntu 12.04 >> * Ubuntu 14.04 >> * Ubuntu 14.10 >> * Ubuntu 15.04 >> >> >> Install >> ------- >> >> example: Debian 8.0 >> >> 1. get release key >> wget -qO - >> http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… >> | sudo apt-key add - >> >> 2. add repo to APT sources >> eg.: /etc/apt/sources.list.d/syslog-ng-obs.list >> deb >> http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… >> ./ >> >> Then `apt-get update` and `apt-get install syslog-ng-core=3.7.1-1` >> >> You can replace Debian_8.0 to >> * Debian_7.0 >> * xUbuntu_12.04, >> * xUbuntu_14.04 >> * xUbuntu_14.10 >> * xUbuntu_15.04 >> >> (`x` before Ubuntu is not a typo ;-) ) >> >> Available packages: >> * syslog-ng-core >> * syslog-ng-dbg >> * syslog-ng-dev >> * syslog-ng-mod-stomp >> * syslog-ng-mod-amqp >> * syslog-ng-mod-elastic >> * syslog-ng-mod-geoip >> * syslog-ng-mod-graphite >> * syslog-ng-mod-hdfs >> * syslog-ng-mod-http >> * syslog-ng-mod-java >> * syslog-ng-mod-java-common-lib >> * syslog-ng-mod-journal >> * syslog-ng-mod-json >> * syslog-ng-mod-kafka >> * syslog-ng-mod-mongodb >> * syslog-ng-mod-python >> * syslog-ng-mod-redis >> * syslog-ng-mod-riemann >> * syslog-ng-mod-smtp >> * syslog-ng-mod-sql >> * syslog-ng-mod-stomp >> >> >> Notes to the java destinations >> ------------------------------ >> >> About the >> >> ``` >> Error opening plugin module; module='mod-java', error='libjvm.so: cannot >> open shared object file: No such file or directory' >> ``` >> >> problem. >> >> libmod-java.so is linked to the libjvm.so library. >> If your java installation doesn't create a symlink in /usr/lib directory >> to libjvm.so then >> you have to modify your ld.so.conf or expand your LD_LIBRARY_PATH with >> the containing library >> before starting syslog-ng. >> >> eg.: >> >> LD_LIBRARY_PATH=/usr/lib/jvm/java-7-openjdk-amd64/jre/lib/amd64/server:$LD_LIBRARY_PATH >> >> >> Links >> -------- >> [1] https://build.opensuse.org/project/show/home:laszlo_budai:syslog-ng >> [2] https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.7.1 >> >> regards, >> Laszlo Budai >> >> > > > -- > > Balázs NÉMETH > System Engineer > > e-mail: balazs.nemeth(a)balabit.com > phone: +36-1-880-6740 > > BalaBit-Europe Kft.www.balabit.com > H-1117 Alíz str. 2. Budapest > > This Communication is Confidential. We only send and receive email on > the basis of the term set out at http://www.balabit.com/disclaimer/. > >

1 0

question on elasticsearch & indexint structured data fields
by jrhendri＠roadrunner.com 11 Sep '15

11 Sep '15

Hi, I am testing elasticsearch with the 3.7.1 ose build on ubuntu 14.04 and have some questions regarding how to get elasticsearch & kibana to "see" the individual fields within a structured syslog message. I have tried a few different formats but all the >key>=<value> pairs appear within the MESSAGE part. For example: MESSAGE 2015-09-09T17:00:06.775 0055-inet-fw-node0 RT_FLOW - RT_FLOW_SESSION_CREATE_LS [junos(a)2636.1.1.1.2.35 logical-system-name="internetVR" source-address="143.115.190.50" source-port="42241" destination-address="70.39.233.137" destination-port="53" service-name="junos-dns-udp" nat-source-address="143.115.190.50" nat-source-port="42241" nat-destination-address="70.39.233.137" nat-destination-port="53" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="17" policy-name="Device-Zone-903" source-zone-name="dns-b2b" destination-zone-name="internet" session-id-32="80968105" username="N/A" roles="N/A" packet-incoming-interface="reth3.120" application="UNKNOWN" nested-application="UNKNOWN" encrypted="UNKNOWN"] The "Available Fields" I see in kibana are: @timestamp tDATE tFACILITY tHOST tMESSAGE tPRIORITY tPROGRAM t_id t_index t_type I would like to be able to have each field recognized separately so that kibana could search for specific things like "source-address", etc. I thought these would be available under the .SDATA. set, but apparently I missed something. Is this possible (and I am just lacking understanding) or am I expecting too much? These are the last three tests I have used within the elasticsearch destination and they all essentially result in the same thing. #!# option( "message_template", "$(format-json --scope nv_pairs)\n") #!# option( "message_template", "$(format-json --scope rfc5424 --exclude DATE --key ISODATE @timestamp=${ISODATE})\n") option( "message_template", "$(format-json --scope rfc5424 @timestamp=${ISODATE} --key .SDATA.* ) \n" ) Thanks for any help or guidance! Jim

3 3