February 2016 - syslog-ng - lists.balabit.hu

Spock, Is my logic sound ?
by Scot 16 Feb '16

16 Feb '16

I'm still getting stuff on nmsloghost that I think should be filtered out. Do my comments match the conf file ? *# Source UDP/TCP syslog port 514. * source s_net { udp(ip(0.0.0.0) port(514) so_rcvbuf(262142)); tcp(ip(0.0.0.0) port(514) max-connections(250) so_rcvbuf(262142) log_iw_size(25000) ); }; *# Remove messages from 2 network segments * filter f_network {not netmask("192.168.238.0/24") and not netmask(" 192.168.239.0/24") ; }; *# Remove messages matching EITHER expression* filter f_audit { not match("Audit" value("MESSAGE")) and not match("Detailed Tracking" value("MESSAGE")); }; *# Remove messages matching "The scan found detections" expression* filter f_mcafee { not match("The scan found detections." value("MESSAGE")); }; *# Destination rule suppress any duplicates in a 10 second window. *destination d_remote {udp ("nmsloghost" suppress(10)); }; *# Log from s_net and filter out all matches from f_* log udp to nmsloghost. * *# There is no function to "filter( not f_network);" * log { source(s_net); filter(f_network); filter(f_audit); filter(f_mcafee); destination (d_remote);

3 3

running syslog-ng as non root user
by Ryan Koss 15 Feb '16

15 Feb '16

Hello, I’m trying to run syslog-ng as a non-root user. I’ve tried the following command as suggested by the site at the following URL https://www.balabit.com/wiki/syslog-ng-faq-non-root <https://www.balabit.com/wiki/syslog-ng-faq-non-root> Unfortunately I am still encountering permissions issues. ?-> /usr/sbin/syslog-ng --user user --persist-file /code/routeiqSyslog/i95/build/src/lib/util/test/syslog-ng.persist syslog-ng: Error setting capabilities, capability management disabled; error='Operation not permitted' Error binding socket; addr='AF_UNIX(/dev/log)', error='Address already in use (98)' Error initializing message pipeline; ?-> Any ideas, thoughts help will be greatly appreciated. Thanks, -ryan

2 1

Re ./configure not working
by amey jain 12 Feb '16

12 Feb '16

Hi, Sorry for the last mail not being proper. Actually when I run ./configure script for syslog-ng it stops at a point and shows error config.status: error: cannot find input file: `src/Makefile.in' ". It also shows the error "configure: error: ./configure.gnu failed for lib/ivykis". I searched for the ivykis packages through apt-cache search and installed them but the error didn't disappeared. I have copied the ./configure output here. Please see and tell the error. Regards checking whether make supports nested variables... yes checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for a thread-safe mkdir -p... /bin/mkdir -p checking for gawk... no checking for mawk... mawk checking whether make sets $(MAKE)... yes checking whether UID '1000' is supported by ustar format... yes checking whether GID '1000' is supported by ustar format... yes checking how to create a ustar tar archive... gnutar checking for gcc... gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking whether gcc understands -c and -o together... yes checking for style of include used by make... GNU checking dependency style of gcc... gcc3 checking for gcc option to accept ISO C99... -std=gnu99 checking for bison... bison -y checking for flex... flex checking lex output file root... lex.yy checking lex library... -lfl checking whether yytext is a pointer... yes checking whether make sets $(MAKE)... (cached) yes checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking build system type... x86_64-unknown-linux-gnu checking host system type... x86_64-unknown-linux-gnu checking how to print strings... printf checking for a sed that does not truncate output... /bin/sed checking for grep that handles long lines and -e... /bin/grep checking for egrep... /bin/grep -E checking for fgrep... /bin/grep -F checking for ld used by gcc -std=gnu99... /usr/bin/ld checking if the linker (/usr/bin/ld) is GNU ld... yes checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm -B checking the name lister (/usr/bin/nm -B) interface... BSD nm checking whether ln -s works... yes checking the maximum length of command line arguments... 1572864 checking how to convert x86_64-unknown-linux-gnu file names to x86_64-unknown-linux-gnu format... func_convert_file_noop checking how to convert x86_64-unknown-linux-gnu file names to toolchain format... func_convert_file_noop checking for /usr/bin/ld option to reload object files... -r checking for objdump... objdump checking how to recognize dependent libraries... pass_all checking for dlltool... no checking how to associate runtime and link libraries... printf %s\n checking for ar... ar checking for archiver @FILE support... @ checking for strip... strip checking for ranlib... ranlib checking command to parse /usr/bin/nm -B output from gcc -std=gnu99 object... ok checking for sysroot... no checking for a working dd... /bin/dd checking how to truncate binary pipes... /bin/dd bs=4096 count=1 checking for mt... mt checking if mt is a manifest tool... no checking how to run the C preprocessor... gcc -std=gnu99 -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking for dlfcn.h... yes checking for objdir... .libs checking if gcc -std=gnu99 supports -fno-rtti -fno-exceptions... no checking for gcc -std=gnu99 option to produce PIC... -fPIC -DPIC checking if gcc -std=gnu99 PIC flag -fPIC -DPIC works... yes checking if gcc -std=gnu99 static flag -static works... yes checking if gcc -std=gnu99 supports -c -o file.o... yes checking if gcc -std=gnu99 supports -c -o file.o... (cached) yes checking whether the gcc -std=gnu99 linker (/usr/bin/ld -m elf_x86_64) supports shared libraries... yes checking whether -lc should be explicitly linked in... no checking dynamic linker characteristics... GNU/Linux ld.so checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... yes checking for python... /usr/bin/python checking CFLAGS_NOWARN_POINTER_SIGN for gcc -Wno-pointer-sign... -Wno-pointer-sign checking for special C compiler options needed for large files... no checking for _FILE_OFFSET_BITS value needed for large files... no checking how to enable static linking for certain libraries... GNU or Solaris checking for ANSI C header files... (cached) yes checking dmalloc.h usability... no checking dmalloc.h presence... no checking for dmalloc.h... no checking for strings.h... (cached) yes checking getopt.h usability... yes checking getopt.h presence... yes checking for getopt.h... yes checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/strlog.h usability... no checking sys/strlog.h presence... no checking for sys/strlog.h... no checking door.h usability... no checking door.h presence... no checking for door.h... no checking sys/capability.h usability... no checking sys/capability.h presence... no checking for sys/capability.h... no checking sys/prctl.h usability... yes checking sys/prctl.h presence... yes checking for sys/prctl.h... yes checking utmp.h usability... yes checking utmp.h presence... yes checking for utmp.h... yes checking utmpx.h usability... yes checking utmpx.h presence... yes checking for utmpx.h... yes checking tcpd.h usability... no checking tcpd.h presence... no checking for tcpd.h... no checking for struct ucred... yes checking for struct cmsgcred... no checking whether struct tm is in sys/time.h or time.h... time.h checking for SO_ACCEPTCONN... yes checking for struct tm.tm_gmtoff... yes checking for struct msghdr.msg_control... yes checking for I_CONSLOG... yes checking for O_LARGEFILE... yes checking for struct sockaddr_storage... yes checking for struct sockaddr_in6... yes checking for PR_SET_KEEPCAPS... yes checking for modern utmp... yes checking for door_create in -ldoor... no checking for socket in -lsocket... no checking for nanosleep in -lrt... yes checking for gethostbyname in -lnsl... yes checking for regexec in -lregex... no checking for res_init in -lresolv... no checking for strdup... yes checking for strtol... yes checking for strtoll... yes checking for strtoimax... yes checking for inet_aton... yes checking for inet_ntoa... yes checking for getopt_long... yes checking for getaddrinfo... yes checking for getnameinfo... yes checking for getutent... yes checking for getutxent... yes checking for pread... yes checking for pwrite... yes checking for strcasestr... yes checking for memrchr... yes checking for localtime_r... yes checking for gmtime_r... yes checking for strtok_r... yes checking for clock_gettime... yes checking for EVTLOG... yes checking for TCP wrapper library... checking whether to enable TCP wrapper support... no checking for dlsym in -ldl... yes checking for LIBDBI... no checking whether to enable SQL support... no checking for GLIB... yes checking for g_mapped_file_unref... no checking sanity checking Glib headers... yes checking for GEOIP... no checking for PCRE... yes checking for OPENSSL... yes checking for LIBNET... yes checking whether to enable spoof source support... yes checking for JSON... no checking for JSON... yes checking for LIBMONGO... no checking for prop_get in -lsasl2... no checking for libESMTP... no checking for HIREDIS... yes checking for RIEMANN_CLIENT... no checking for PYTHON... no checking for JAVA_VERSION... no checking for GRADLE_VERSION... no checking whether to enable Sun STREAMS support... no checking whether to enable IPv6 support... yes checking whether to enable Linux capability support... no checking whether to enable mongodb destination support... yes checking whether to enable amqp destination support... yes checking for libsystemd... no checking for libsystemd_daemon... no checking for LIBSYSTEMD_JOURNAL... no checking for UUID... no checking whether to enable Valgrind on the unit tests... checking for valgrind... no yes checking that generated files are newer than configure... done configure: creating ./config.status config.status: creating syslog-ng-native-connector.pc config.status: creating dist.conf config.status: creating Makefile config.status: creating syslog-ng.spec config.status: creating syslog-ng.pc config.status: creating libtest/syslog-ng-test.pc config.status: creating scripts/update-patterndb config.status: creating config.h config.status: config.h is unchanged config.status: executing depfiles commands config.status: executing libtool commands config.status: executing syslog-ng-config.h commands config.status: creating syslog-ng-config.h - prefix SYSLOG_NG for config.h defines config.status: syslog-ng-config.h is unchanged === configuring in lib/ivykis (/home/amey/git/syslog-ng/lib/ivykis) configure: running /bin/bash ./configure.gnu --disable-option-checking '--prefix=/usr/local' --cache-file=/dev/null --srcdir=. ./configure.gnu Running: ./configure --disable-option-checking --prefix=/usr/local --cache-file=/dev/null --srcdir=. --disable-shared --enable-static --with-pic --enable-man-pages checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for a thread-safe mkdir -p... /bin/mkdir -p checking for gawk... no checking for mawk... mawk checking whether make sets $(MAKE)... yes checking whether make supports nested variables... yes checking build system type... x86_64-unknown-linux-gnu checking host system type... x86_64-unknown-linux-gnu checking for gcc... gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking whether gcc understands -c and -o together... yes checking for style of include used by make... GNU checking dependency style of gcc... gcc3 checking host operating system type... posix checking for working __thread... yes checking whether gcc accepts -pthread... yes checking whether gcc accepts -pthreads... no checking for library containing pthread_atfork... none required checking for library containing pthread_create... none required checking for __sync_lock_test_and_set()... yes checking how to run the C preprocessor... gcc -E checking for grep that handles long lines and -e... /bin/grep checking for egrep... /bin/grep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking process.h usability... no checking process.h presence... no checking for process.h... no checking sys/devpoll.h usability... no checking sys/devpoll.h presence... no checking for sys/devpoll.h... no checking sys/eventfd.h usability... yes checking sys/eventfd.h presence... yes checking for sys/eventfd.h... yes checking sys/syscall.h usability... yes checking sys/syscall.h presence... yes checking for sys/syscall.h... yes checking for sys/thr.h... no checking thread.h usability... no checking thread.h presence... no checking for thread.h... no checking for linux/netfilter_ipv4.h... yes checking for struct timespec.tv_sec... yes checking for library containing clock_gettime... none required checking for clock_gettime... yes checking for CLOCK_MONOTONIC... yes checking for CLOCK_REALTIME... yes checking for library containing inet_ntop... none required checking for library containing socket... none required checking for library containing thr_self... no checking for epoll_create... yes checking for epoll_create1... yes checking for eventfd... yes checking for gettid... no checking for inotify_init... yes checking for kqueue... no checking for lwp_gettid... no checking for port_create... no checking for pthread_spin_lock... yes checking for thr_self... no checking for splice... yes checking for wait4... yes checking whether supports symbol version scripts... yes checking that generated files are newer than configure... done configure: creating ./config.status config.status: creating Makefile config.status: creating contrib/Makefile config.status: creating contrib/iv_getaddrinfo/Makefile config.status: creating contrib/kojines/Makefile config.status: creating man3/Makefile config.status: creating misc/Makefile config.status: creating misc/ivykis.pc ./configure: line 2930: LT_INIT: command not found ./configure: line 3970: AC_PROG_LIBTOOL: command not found config.status: error: cannot find input file: `src/Makefile.in' configure: error: ./configure.gnu failed for lib/ivykis

2 1

./configure not working
by amey jain 11 Feb '16

11 Feb '16

Hi, I started building syslog-ng 3.8.0alpha0 on Ubuntu 14.04 LTS. I am having a problem while running ./configure for it. I have installed the dependencies all and it is showing an error now. Please see to attachment file and tell me whats the problem. Regards

3 2

Insider 2016-02: syslog-ng 3.8; Hadoop; Rust; Scale
by Czanik, Péter 11 Feb '16

11 Feb '16

Dear syslog-ng users, This is the 47th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS 3.8 news: disk buffer, performance and more ------------------------------------------- While syslog-ng 3.8 is still in alpha phase, it already has a nice list of new features merged or waiting to be merged. It will feature disk based buffering, performance improvements, MongoDB support rewritten, and many more. Packages from git HEAD are planned to become available in the coming weeks and will be announced on the mailing list. For details, browse commit history or download sources from https://github.com/balabit/syslog-ng The Hadoop (HDFS) destination ----------------------------- Petabytes of data are now collected into huge data lakes around the world. Hadoop is the technology enabling this. While syslog-ng was able write logs to Hadoop using some workarounds for quite some time, the new Java-based HDFS destination driver provides both better performance and more reliability. The syslog-ng HDFS driver is Hortonworks HDP certified. https://czanik.blogs.balabit.com/2016/02/filling-your-data-lake-with-log-me… Rust: simple and efficient parsers ---------------------------------- If you want to create high quality, efficient parsers easily, writing them in Rust is worth considering. This post explaines the steps to use the experimental Rust language bindings for syslog-ng. There is even some sample code to help you get started on github. Read more at https://syslog-ng.org/syslog-ng-and-rust/ Scale 14x --------- Balabit, and thus syslog-ng participated the Southern California Linux Expo this year again. The most frequent topic at the booth was ESK (Elasticsearch syslog-ng Kibana). We had some very good discussions at the syslog-ng BoF and after my presentation about syslog-ng and Big Data: https://czanik.blogs.balabit.com/2016/02/czp-scale-14x-esk-bof-drm/ Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com . To read this newsletter on-line, visit: http://insider.blogs.balabit.com/ Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

syslog-ng and dependency libraries for sending log messages for remote log server with TLS support
by Girish Kumar 09 Feb '16

09 Feb '16

Hi All, My requirement is to send the log messages to remote log server securely (with TLS). The project which I am implementing is on embedded systems. So the space is very important. Please let me know the latest stable version of syslog-ng which can be used for this. Also please let me know the mandatory dependency libraries required. Thanks in advance. Regards, Girish _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

4 13

Re: [syslog-ng] Module development guide
by Scheidler, Balázs 06 Feb '16

06 Feb '16

Hi, Let me try to describe what is needed to parse options from the configuration file: - curl-grammar.ym: is a yacc/bison source file that parses the curl specific portion of the configuration. It is able to generate parsers for LALR(1) languages. - curl-parser.c: contains the set of keywords that curl understands. This maps keywords found in the configuration into tokens that the grammar is able to process. A token is basically a numeric identifier. So for instance to add a "header" option, you will need this stuff: 1) define a token in the grammar, so it becomes available as a macro diff --git a/modules/curl/curl-grammar.ym b/modules/curl/curl-grammar.ym index c3aaf00..eab317c 100644 --- a/modules/curl/curl-grammar.ym +++ b/modules/curl/curl-grammar.ym @@ -47,6 +47,7 @@ %parse-param {gpointer arg} %token KW_CURL +%token KW_HEADER %type <ptr> driver %type <ptr> curl_destination If you recompile the curl module, this will make KW_HEADER to become available in curl-grammar.h 2) add a keyword to curl-parser.c This will tell the syslog-ng lexer (a component that reads the configuration file and breaks them into tokens) to map the string "header" into a symbolic token named KW_HEADER. diff --git a/modules/curl/curl-parser.c b/modules/curl/curl-parser.c index 6958a8d..b60ef0b 100644 --- a/modules/curl/curl-parser.c +++ b/modules/curl/curl-parser.c @@ -30,6 +30,7 @@ int curl_parse(CfgLexer *lexer, LogDriver **instance, gpointer arg); static CfgLexerKeyword curl_keywords[] = { { "curl", KW_CURL }, + { "header", KW_HEADER }, { NULL } }; 3) add rules to the grammar to parse this option First we need a small refactor in the curl-grammar file to save the just instantiated CurlDestinationDriver (I hand edited this hunk for clarity, so it will not apply automatically): @@ -71,7 +72,15 @@ driver ; curl_destination - : KW_CURL '(' ')' { $$ = curl_dd_new(configuration); } + : KW_CURL + { + last_driver = curl_dd_new(configuration); + } + '(' ')' { $$ = last_driver; } + ; This basically just stores the driver instance in a variable named "last_driver" (defined by the core cfg-grammar.y file). So we can later use this to call setters on. And now let's add option parsing (this time the entire hunk): @@ -71,7 +72,20 @@ driver ; curl_destination - : KW_CURL '(' ')' { $$ = curl_dd_new(configuration); } + : KW_CURL + { + last_driver = curl_dd_new(configuration); + } + '(' curl_options ')' { $$ = last_driver; } + ; + +curl_options + : curl_option curl_options + | + ; + +curl_option + : KW_HEADER '(' string string ')' { curl_dd_set_header(last_driver, $3, $4); } ; /* INCLUDE_RULES */ What this does is that we added a rule "curl_options" within the parentheses of our original "curl" rule, which is the rule that must match the configuration as we parse it. (think of it as a recursive tree). curl_options is satisfied with either an empty rule (e.g. no options) or recursing itself with a curl_option rule. Note the plural and singular names, curl_options is responsible to match a list of "curl_option"s. curl_option is responsible for parsing individual options, for now only a single rule is there, KW_HEADER, which when parsed will call curl_dd_set_header(). You can add further options like this: +curl_option + : KW_HEADER '(' string string ')' { curl_dd_set_header(last_driver, $3, $4); } + | KW_URL '(' string ')' { curl_dd_set_url(last_driver, $3); } Variables like $1, $2 and so on represent the Nth token in the rule, e.g. $3 in the KW_HEADER branch is the first string value. $4, is the 2nd. Hope this helps. You will definitely be able to find tutorials that describe both yacc/lex, however there are a number of quirks how syslog-ng applies them, primarily to make it possible to extend the base grammar with plugins. Cheers, Bazsi -- Bazsi On Mon, Feb 1, 2016 at 10:01 PM, Marc Falzon <m(a)baha.mu> wrote: > Hi Bazsi > > Sorry to bother you again, but now that I'm done prototyping the "curl" > part of my module using hardcoded values for testing I'm now facing the > "grammar/parser" problem: could you please drive me though the basics of > how this works? I tried to understand looking at other modules but I don't > understand at all. > > Basically, I'd like to be able to specify some configuration settings in > the syslog-ng configuration, such as url, some HTTP headers... It would > look like this: > > destination d_curl { > curl(url("http://logs.example.net:5140/" header("Content-Type: > application/json") header("X-Custom-Header: blah"))); > }; > > > My code is still available at > https://github.com/falzm/syslog-ng/tree/f/curl-module/modules/curl > > Thank you in advance, > > m. > > > On Saturday 30 January 2016 at 10:17, m(a)baha.mu wrote: > > > Hi > > > > Great! I should be able to get going from here, thank you for your help. > > > > Cheers, > > > > m. > > > > > On Jan 30, 2016, at 08:56, Scheidler, Balázs < > balazs.scheidler(a)balabit.com (mailto:balazs.scheidler@balabit.com)> wrote: > > > > > > Hi, > > > > > > I have added code to your module, it compiles and is able to accept > messages to be sent, and prints a debug message whenever that happens. > > > > > > I didn't have too much time to clean it up, but I hope this helps to > start the ball rolling. > > > > > > https://github.com/balabit/syslog-ng/compare/f/curl-module < > https://github.com/balabit/syslog-ng/compare/f/curl-module> > > > > > > > > > Bazsi > > > > > > -- > > > Bazsi > > > > > > On Sat, Jan 23, 2016 at 9:27 PM, <m(a)baha.mu <mailto:m@baha.mu>> wrote: > > > > > > > On Jan 23, 2016, at 21:23, Scheidler, Balázs < > balazs.scheidler(a)balabit.com <mailto:balazs.scheidler@balabit.com>> wrote: > > > > > > > > If you commit your code to a branch I can help with the basic > skeleton of the parser/grammar > > > > > > > > > Thank you Balázs, my code is available here: > https://github.com/falzm/syslog-ng/tree/f/curl-module/modules/curl < > https://github.com/falzm/syslog-ng/tree/f/curl-module/modules/curl> > > > > > > m. > > > > > > > > > > > > > > On Jan 23, 2016 5:54 PM, "Marc Falzon" <m(a)baha.mu <mailto:m@baha.mu>> > wrote: > > > > I successfully generated a module template using the > `create_plugin.sh (http://create_plugin.sh)` script, however I don't have > the slightest idea on how to get started from here (I mean for the 'plugin > glue', I can manage the cURL part)... The most problematic step for me is > the whole parser/grammar thing, to which I believe to involve YACC/Bison > parsing but I don't know how it works and it's too big of a learning curve > for what I want to achieve at this point... Since the Gitbook doesn't > provide any useful information on module development at the moment, is > there any way to get me started on this topic? I'm not a developer > (sysadmin), and trying to learn from existing module doesn't quite cut it. > > > > > > > > Thank you, > > > > > > > > m. > > > > > > > > > > > > On Friday 22 January 2016 at 11:35, Tibor Benke wrote: > > > > > > > > > There is also a shell script which generates a basic destination > skeleton. You can find its source on this brach: > https://github.com/juhaszviktor/syslog-ng/tree/f/plugin-creator < > https://github.com/juhaszviktor/syslog-ng/tree/f/plugin-creator> . Check > the dev-utils/plugin_skeleton_creator directory and this commit for the > usage: > https://github.com/juhaszviktor/syslog-ng/commit/89361d4d1817560ce8c9062093… > < > https://github.com/juhaszviktor/syslog-ng/commit/89361d4d1817560ce8c9062093… > > > > > > > > > > > > 2016-01-22 11:33 GMT+01:00 Marc Falzon <m(a)baha.mu <mailto: > m(a)baha.mu> (mailto:m@baha.mu <mailto:m@baha.mu>)>: > > > > > > Hi Bazsi, > > > > > > > > > > > > > > > > > > On Friday 22 January 2016 at 11:28, Scheidler, Balázs wrote: > > > > > > > > > > > > > not really, but maybe I would read the "official" modules > source code instead. and of course you can ask questions on the mailing > list. :) > > > > > > > > > > > > > > > > > > Yes that's what I've started to do, but a proper documentation > is preferable, saves time and avoid confusion ;) > > > > > > > > > > > > > if you want to create a destination, the easiest is to create > a threaded destination, where the output is an independent thread, that can > use a synchronous API. Of course this is going to be slower than using an > asynchronous implementation, but that usually is good enough, > > > > > > > > > > > > Thank you for the hint. Given my use case (HTTP destination) I > think I'm safe to go with an asynchronous implementation since each request > is stateless, no connections/locks involved. > > > > > > > > > > > > m. > > > > > > > > > > > > > > > > > > > > On Fri, Jan 22, 2016 at 11:03 AM, Marc Falzon <m(a)baha.mu > <mailto:m@baha.mu> (mailto:m@baha.mu <mailto:m@baha.mu>) (mailto:m@baha.mu > <mailto:m@baha.mu>)> wrote: > > > > > > > > Hi > > > > > > > > > > > > > > > > Is there any documentation on how to develop new syslog-ng > module using the native C API, besides reading the incubator modules source > code? > > > > > > > > > > > > > > > > Cheers, > > > > > > > > > > > > > > > > m. > > > > > > > > > > > > > > > > > > > > > > > > > ______________________________________________________________________________ > > > > > > > > Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng < > https://lists.balabit.hu/mailman/listinfo/syslog-ng> > > > > > > > > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng < > http://www.balabit.com/support/documentation/?product=syslog-ng> > > > > > > > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq < > http://www.balabit.com/wiki/syslog-ng-faq> > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > ______________________________________________________________________________ > > > > > > > Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng < > https://lists.balabit.hu/mailman/listinfo/syslog-ng> > > > > > > > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng < > http://www.balabit.com/support/documentation/?product=syslog-ng> > > > > > > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq < > http://www.balabit.com/wiki/syslog-ng-faq> > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > ______________________________________________________________________________ > > > > > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > <https://lists.balabit.hu/mailman/listinfo/syslog-ng> > > > > > > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng < > http://www.balabit.com/support/documentation/?product=syslog-ng> > > > > > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq < > http://www.balabit.com/wiki/syslog-ng-faq> > > > > > > > > > > > > > > > > > > > > > > > > > > ______________________________________________________________________________ > > > > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng < > https://lists.balabit.hu/mailman/listinfo/syslog-ng> > > > > > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng < > http://www.balabit.com/support/documentation/?product=syslog-ng> > > > > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq < > http://www.balabit.com/wiki/syslog-ng-faq> > > > > > > > > > > > > > > > > > > > > > > > > > ______________________________________________________________________________ > > > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng < > https://lists.balabit.hu/mailman/listinfo/syslog-ng> > > > > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng < > http://www.balabit.com/support/documentation/?product=syslog-ng> > > > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq < > http://www.balabit.com/wiki/syslog-ng-faq> > > > > > > > > > ______________________________________________________________________________ > > > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng < > https://lists.balabit.hu/mailman/listinfo/syslog-ng> > > > > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng < > http://www.balabit.com/support/documentation/?product=syslog-ng> > > > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq < > http://www.balabit.com/wiki/syslog-ng-faq> > > > > > > > > > > > > > ______________________________________________________________________________ > > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng < > https://lists.balabit.hu/mailman/listinfo/syslog-ng> > > > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng < > http://www.balabit.com/support/documentation/?product=syslog-ng> > > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq < > http://www.balabit.com/wiki/syslog-ng-faq> > > > > > >

3 5

Mutual certification
by Ivan Adji - Krstev 04 Feb '16

04 Feb '16

Hi all, I have follow the link <https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-…> for providing mutual authentication. I have create CA on a server and certificates for the server and client. On the server site have put: =========================================== source s_sys { system(); #unix-stream("/dev/log"); internal(); network( port(6514) # tcp(port(5140)); # file("/proc/kmsg" log_prefix("kernel: ")); transport("tls") tls( key_file("/etc/syslog-ng/cert.d/serverkey.pem") cert_file("/etc/syslog-ng/cert.d/servercert.pem") ca_dir("/etc/syslog-ng/ca.d")) ); }; i have define d_mysql etc. log { source(s_sys); destination(d_mysql); }; ============================================================= on the client site i have: destination tls_destination { network("x.x.x.x" port(6514)); transport("tls") tls( ca_dir("/etc/syslog-ng/ca.d") key_file("/etc/syslog-ng/cert.d/clientkey.pem") cert_file("/etc/syslog-ng/cert.d/clientcert.pem") ) }; log { source(s_sys); destination(tls_destination); }; ================================================================== And when i restart the syslog-ng on a client site i have the following error: /etc/init.d/syslog-ng restart Stopping syslog-ng: [FAILED] Error parsing destination, destination plugin network not found in /etc/syslog-ng/syslog-ng.conf at line 45, column 5: network("x.x.x.x" port(6514)); ^^^^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng syslog-ng --version syslog-ng 3.2.5 Installer-Version: 3.2.5 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#9d4bea28198bd731df1a61e980a2af5b88d81116 Compile-Date: Jul 25 2014 15:20:50 Enable-Threads: on Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-SSL: off Enable-SQL: on Enable-Linux-Caps: off Enable-Pcre: on Enable-Pacct: off So can someone tell me what i'm doing wrong ? Kind regards Ivan

2 2

syslog-ng and dependency libraries for sending log messages for remote log server with TLS support
by Girish Kumar 04 Feb '16

04 Feb '16

Hi All, My requirement is to send the log messages to remote log server securely (with TLS). The project which I am implementing is on embedded systems. So the space is very important. Please let me know the latest stable version of syslog-ng which can be used for this. Also please let me know the mandatory dependency libraries required. Whether I can use openssl library for TLS support Thanks in advance. Regards, Girish

1 0