November 2016 - syslog-ng - lists.balabit.hu

Enable TLS encryption
by Sathish Sundaravel 09 Jan '17

09 Jan '17

Hi Team I have a Syslog Ng server running on Solaris and receiving events from native Solaris syslog clients. How do I enable UDP traffic pass through via TLS and how to configure client certificate for native Solaris syslog agent. We don't have rsyslog.

6 10

heat map from firewall logs: syslog-ng GeoIP + Kibana
by Czanik, Péter 28 Nov '16

28 Nov '16

Hi, This was part of my talk last week at a conference, but I also made a blog from it: https://www.balabit.com/blog/how-to-create-heat-maps-to-show-whos-trying-to… You can parse iptables logs (or other firewalls using key=value format) using in syslog-ng using the key=value and GeoIP parsers, store it to Elasticsearch and display the results in Kibana. Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0

Elasticsearch 5 and syslog-ng
by Czanik, Péter 28 Nov '16

28 Nov '16

Hi, For the last six months, Elastic’s communication centered around the upcoming Elastic Stack 5.0. And finally it is here: tons of new features, improved performance and a single version number for all Elastic products. Compatibility with syslog-ng was checked already during the alpha phase of development, as syslog-ng is becoming popular among Elasticsearch users: it can greatly simplify logging to Elasticsearch <https://www.balabit.com/blog/logging-to-elasticsearch-made-simple-with-sysl…> . As Elastic Stack 5.0.0 is now generally available, here is a quick how-to guide to get you started with syslog-ng 3.8.1 and Elasticsearch 5.0.0 on RHEL/CentOS 7: https://www.balabit.com/blog/syslog-ng-and-elasticsearch-5-getting-started-… Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

5 8

Syslog destination time/folder issues
by Marco Mignone 24 Nov '16

24 Nov '16

Hi All, I am experiencing a weird problem with Syslog-NG 3.8.1 on Ubuntu 14.04 When syslog receives syslog messages from couple of specific nodes it saves it on a destination folder as per the config below: source s_rohnet { network( transport("udp") ); }; destination d_rohnet_switches { file("/var/log/ROHNetwork/${YEAR}.${WEEK}/${HOST}.log" create-dirs(yes) dir-owner("rohadmin")); }; The devices are NTP synchronised and the date output is correct on the Ubuntu server: >date Tue Nov 22 11:21:14 GMT 2016 Beside these the log folders created where the files gets stored are: /2015.51/192.168.33.8.log (it should be /2016.47/). This is happening only for two nodes while all the rest seems to work fine. I have captured some network traffic and the message received by syslog-ng on the network card seems also correct as per Wireshark output: Syslog message: LOCAL6.NOTICE: NOV 22 10:31:23 192.168.33.8-1 CMDLOGGER[165319912]: cmd_logger_api.c(83) 13518 %% CLI:192.168.32.100:root:User logged in This is a Dell switch and I am opening a case with them but I would like to know where else I should check for configuration errors. Syslog config is exactly the one reported above. Any idea of what I could check for further troubleshooting on the Syslog side? Thanks, Marco

3 3

Re: [syslog-ng] Syslog destination time/folder issues
by Scheidler, Balázs 23 Nov '16

23 Nov '16

Yes, an incorrectly parsed month is considered -1, thus it underflows back into the last year. Wrt testing, if you can just deploy syslog-ng, that'd be great. On Nov 23, 2016 08:54, "Marco Mignone" <info(a)marcomignone.com> wrote: Hi Bazsi, Thanks for the info. Do you think that can affect also the ‘year’ behaviour? I would love to provide some help testing this... but I am not good at it :( Thanks for the explanation and for pointing at the mod. Regards, Marco On 22 Nov 2016, at 23:41, Balazs Scheidler <bazsi77(a)gmail.com> wrote: The issue is that syslog-ng only processes mixed case month names, e.g. "Nov" instead of "NOV" This pull request contains the as-of-now unmerged fix: https://github.com/balabit/syslog-ng/pull/1263 Any testing is absolutely welcome. On Tue, Nov 22, 2016 at 12:30 PM, Marco Mignone <info(a)marcomignone.com> wrote: > Hi All, > I am experiencing a weird problem with Syslog-NG 3.8.1 on Ubuntu 14.04 > > When syslog receives syslog messages from couple of specific nodes it > saves it on a destination folder as per the config below: > > source s_rohnet { > network( > transport("udp") > ); > }; > > destination d_rohnet_switches { > file("/var/log/ROHNetwork/${YEAR}.${WEEK}/${HOST}.log" create-dirs(yes) > dir-owner("rohadmin")); > }; > > > The devices are NTP synchronised and the date output is correct on the > Ubuntu server: > > >date > > Tue Nov 22 11:21:14 GMT 2016 > > Beside these the log folders created where the files gets stored are: > */2015.51*/192.168.33.8.log (it should be /*2016.47*/). > > This is happening only for two nodes while all the rest seems to work fine. > > I have captured some network traffic and the message received by syslog-ng > on the network card seems also correct as per Wireshark output: > > Syslog message: LOCAL6.NOTICE: NOV 22 10:31:23 192.168.33.8-1 > CMDLOGGER[165319912]: cmd_logger_api.c(83) 13518 %% CLI:192.168.32.100:root:User > logged in > > This is a Dell switch and I am opening a case with them but I would like > to know where else I should check for configuration errors. > > Syslog config is exactly the one reported above. > > Any idea of what I could check for further troubleshooting on the Syslog > side? > > Thanks, > Marco > > ____________________________________________________________ > __________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product= > syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > -- Bazsi ____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq ____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

Debian Wheezy, Ubuntu Precise support
by Laszlo Budai 23 Nov '16

23 Nov '16

Hi, I've built syslog-ng 3.8.1 on Debian Wheezy and Ubuntu Precise in my OBS repo (some of you requested for Ubuntu Precise support, so here it is). so from now my syslog-ng packages are available on the following distribs: * Debian 7.0 * Debian 8.0 * Ubuntu 12.04 * Ubuntu 14.04 * Ubuntu 14.10 * Ubuntu 15.04 * Ubuntu 15.10 * Ubuntu 16.04 * Ubuntu 16.10 https://build.opensuse.org/project/show/home:laszlo_budai:syslog-ng regards, Laszlo Budai

3 2

Syslog-ng 3.8.1 supported on aix6.1?
by Sumana Veni 23 Nov '16

23 Nov '16

Hi, Can you please help me understand if syslog-ng 3.8.1 OSE is compatible with AIX 6.1. Couldn't locate the binary anywhere. Or is it only available in the PE. Thanks in advance. Regards, Veni

2 1

Unofficial Debian/Ubuntu syslog-ng 3.7 and 3.8 packages: updated
by Laszlo Budai 19 Nov '16

19 Nov '16

Hi, I've updated the syslog-ng-3.7 and syslog-ng-3.8 packages in my OBS repository. On my test environment I was able to install the packages without any issues. Please, test and feedback. regards, Laszlo Budai

2 2

mysql destination on el6, with syslog-ng 3.8
by Glen Johnson 17 Nov '16

17 Nov '16

It appears the syslog-ng38epel6 on COPR uses libdbi 0.9.0 from el7. When attempting to install syslog-ng from here, on an CentOS 6 instance, and then install libdbi-dbd-mysql, yum is unable to find appropriate version of libdbi-dbd-mysql to install. On el6, only libdbi 0.8.3 appears to be available, which yum does not think is compatible with libdbi 0.9.0. Not sure how to use syslog-ng's mysql destination on CentOS/RHEL 6 due to this. Any insight how to solve this, without creating a separate copr/obs build, would be appreciated ! czanik.blogs.balabit.com/2016/08/syslog-ng-3-8-what-changed/ copr.fedorainfracloud.org/coprs/czanik/syslog-ng38epel6/ Glen

3 4

unable to install syslog-ng ubuntu 16.04
by Simon Smith 14 Nov '16

14 Nov '16

Hi All has anyone been able to install syslog-ng 3.8 successfully on ubuntu 16.04 ? I’m using the link from the mailing list a few months ago but again no luck - http://lists.balabit.hu/pipermail/syslog-ng/2016-August/023150.html <http://lists.balabit.hu/pipermail/syslog-ng/2016-August/023150.html> no matter what packages i try to install it just won’t work any ideas? root@syslog:~# apt-get install syslog-ng Reading package lists... Done Building dependency tree Reading state information... Done Some packages could not be installed. This may mean that you have requested an impossible situation or if you are using the unstable distribution that some required packages have not yet been created or been moved out of Incoming. The following information may help to resolve the situation: The following packages have unmet dependencies: syslog-ng : Depends: syslog-ng-core (>= 3.8.1) but it is not going to be installed Depends: syslog-ng-mod-sql but it is not going to be installed Depends: syslog-ng-mod-mongodb but it is not going to be installed Depends: syslog-ng-mod-json but it is not going to be installed Recommends: syslog-ng-mod-journal but it is not going to be installed Recommends: syslog-ng-mod-smtp but it is not going to be installed Recommends: syslog-ng-mod-amqp but it is not going to be installed Recommends: syslog-ng-mod-geoip but it is not going to be installed Recommends: syslog-ng-mod-redis but it is not going to be installed Recommends: syslog-ng-mod-stomp but it is not going to be installed Recommends: syslog-ng-mod-riemann but it is not going to be installed Recommends: syslog-ng-mod-graphite but it is not going to be installed Recommends: syslog-ng-mod-python but it is not going to be installed Recommends: syslog-ng-mod-java but it is not going to be installed Recommends: syslog-ng-mod-java-common-lib but it is not going to be installed Recommends: syslog-ng-mod-elastic but it is not going to be installed Recommends: syslog-ng-mod-hdfs but it is not going to be installed Recommends: syslog-ng-mod-kafka but it is not going to be installed Recommends: syslog-ng-mod-http but it is not going to be installed Recommends: syslog-ng-mod-curl but it is not going to be installed Recommends: syslog-ng-mod-kvformat but it is not going to be installed Recommends: syslog-ng-mod-add-contextual-data but it is not going to be installed E: Unable to correct problems, you have held broken packages. root@syslog:~# apt-get install syslog-ng-core Reading package lists... Done Building dependency tree Reading state information... Done Some packages could not be installed. This may mean that you have requested an impossible situation or if you are using the unstable distribution that some required packages have not yet been created or been moved out of Incoming. The following information may help to resolve the situation: The following packages have unmet dependencies: syslog-ng-core : Depends: syslog-ng-mod-journal but it is not going to be installed E: Unable to correct problems, you have held broken packages. root@syslog:~# apt-get install syslog-ng-mod-journal Reading package lists... Done Building dependency tree Reading state information... Done Some packages could not be installed. This may mean that you have requested an impossible situation or if you are using the unstable distribution that some required packages have not yet been created or been moved out of Incoming. The following information may help to resolve the situation: The following packages have unmet dependencies: syslog-ng-mod-journal : Depends: syslog-ng-abi-3.8-0 but it is not installable E: Unable to correct problems, you have held broken packages. root@syslog:~# apt-get install syslog-ng syslog-ng-core syslog-ng-mod-sql syslog-ng-mod-mongodb syslog-ng-mod-json syslog-ng-mod-journal Reading package lists... Done Building dependency tree Reading state information... Done Some packages could not be installed. This may mean that you have requested an impossible situation or if you are using the unstable distribution that some required packages have not yet been created or been moved out of Incoming. The following information may help to resolve the situation: The following packages have unmet dependencies: syslog-ng-mod-journal : Depends: syslog-ng-abi-3.8-0 but it is not installable syslog-ng-mod-json : Depends: syslog-ng-abi-3.8-0 but it is not installable syslog-ng-mod-mongodb : Depends: syslog-ng-abi-3.8-0 but it is not installable syslog-ng-mod-sql : Depends: syslog-ng-abi-3.8-0 but it is not installable E: Unable to correct problems, you have held broken packages. root@syslog:~# regards Simon - Hestor Ltd

9 31