March 2016 - syslog-ng - lists.balabit.hu

powered by syslog-ng
by Czanik, Péter 19 Jul '16

19 Jul '16

Hi, We have now a "Powered by syslog-ng" page on our website. It's available at https://syslog-ng.org/powered-by-syslog-ng/ If your project / company / product / etc. uses syslog-ng, we are happy to include you on the list too, just e-mail me directly! Some of the more interesting names from the list are Facebook, Kindle, FreeNAS and of course all the major Linux distributions. Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

2 1

message loss using multi-line-mode
by Patrick Hemmer 18 May '16

18 May '16

I raised issue on an existing bug on the github tracker, but it seems to have gone unnoticed, so I'm repeating it here to try and get some attention on the issue. Using multi-line-mode without the multi-line-suffix option WILL result in message loss. When syslog-ng is running in multi-line-mode, it buffers multi-line messages until it sees the start of a new message. When it sees the start of a new message, it flushes the buffered message, and puts the first line of the new message in the buffer. However if syslog-ng shuts down, or receives a SIGHUP (reload), any lines currently buffered are discarded. Given that syslog-ng can't stay running forever, and it will get shut down or SIGHUPd eventually, using this feature will result in messages getting lost. The message on the github issue where I brought this up is: https://github.com/balabit/syslog-ng/issues/140#issuecomment-197673887 -Patrick

4 4

Compile time error
by Vithulan MV 03 May '16

03 May '16

Hi all, I added required dependencies and tried to build syslog-ng from the source, there was an error saying, ${syslog-ng_HOME}/modules/afmongodb/mongo-c-driver/src/mongoc/mongoc-scram.c: In function '_mongoc_scram_sha1': storage size of 'digest_ctx' isn't known (EVP_MD_CTX digest_ctx) I confirmed OpenSSL [1] headers are included in the file.Can you please point out whats wrong? [1] https://github.com/mongodb/mongo-c-driver/blob/7415d3468de0c500fd6e630f7b52… Thanks. Regards, Vithulan

4 6

Weird issue with remote syslog-ng setup
by Dave Florek 29 Mar '16

29 Mar '16

Hi, I'm running into a weird issue where I have syslog-ng running on a client and server. Both are correctly configured to push log files from the client to the server and they're both Linux boxes. A netstat command on the client shows an established connection from the client to the server, however on the server, a netstat command does not show a connection from the server to the client or client to server. I checked firewall settings in iptables, however nothing seems to be working. Any ideas on how I can troubleshoot this? Sincerely,

3 2

Collecting messages from text files
by Girish Kumar 24 Mar '16

24 Mar '16

Hi All, I am using file(filename) option for source of log. The filename is the log generated by my application. The scenario is explained below. Writes to Reads from Application --- ---- >filename-----------> syslog-ng Since the application is continuously writing to file and syslog-ng is reading from the file, is there any chance syslog-ng missing some logs from the file. I am telling in reader writer context I referred following link to understand and implement file(filename) option https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-… Regards, Girish

1 1

3.7.3 unofficial Fedora / RHEL7 packages
by Czanik, Péter 23 Mar '16

23 Mar '16

Hi, My unofficial syslog-ng 3.7.3 Fedora / RHEL7 packages are available at https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng37/ Packages for RHEL6 will follow later this week. If you have any questions or run into any problems, let me know! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 1

Re: [syslog-ng] syslog-ng Digest, Vol 131, Issue 27
by amey jain 23 Mar '16

23 Mar '16

Hi, Girish can you tell why you think that messages are being dropped. Can you tell exact configuration of your syslog-ng. I didn't understand what exactly is the problem is. Can you be more detailed in it. Regards On Tue, Mar 22, 2016 at 4:30 PM, <syslog-ng-request(a)lists.balabit.hu> wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Re: Compile time error (Nagy) > 2. Re: syslog-ng 3.8 how to get configure script (Czanik) > 3. Collecting messages from text files (Girish Kumar) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 21 Mar 2016 16:45:51 +0100 > From: Nagy, Tam?s <tamas.nagy(a)balabit.com> > Subject: Re: [syslog-ng] Compile time error > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <CAJ3S0CmF75i=xWUxP=E_nr= > repNrHNrVA4tYqrZasi9W0vkaZQ(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > 1. Could you try with a newer mongo-c-driver version? You can edit the > respective section in .gitmodules and try branch=master (or some other > tag). You need to do this right after a clean checkout, although > running autogen.sh again before configure might also be enough. > > 2. Could you try after configuring with --disable-mongodb? > > On Thu, Mar 10, 2016 at 3:03 PM, Vithulan MV > <vithulanmv.12(a)cse.mrt.ac.lk> wrote: > > Hi, > > > > Yes it seems so, as per > > https://www.openssl.org/docs/manmaster/crypto/EVP_DigestInit.html > > > > Thanks for pointing that out. > > I tried installing openssl 1.0.1 but still the openssl version command > shows > > the version 1.1, How do I compile syslog-ng with OpenSSL 1.0.1? > > > > Thanks. > > > > Best regards, > > Vithulan > > > > On 7 March 2016 at 23:15, Tibor Benke <ihrwein(a)gmail.com> wrote: > >> > >> Hi, > >> > >> You probably use OpenSSL 1.1 (scroll down to the bottom of the page to > >> "History"): > >> https://www.openssl.org/docs/manmaster/crypto/EVP_DigestInit.html > >> > >> Please verify this. > >> > >> Could you try to compile syslog-ng with OpenSSL 1.0.1? > >> > >> Regards, > >> Tibor > >> > >> 2016-03-07 18:32 GMT+01:00 Vithulan MV <vithulanmv.12(a)cse.mrt.ac.lk>: > >>> > >>> Hi all, > >>> > >>> I added required dependencies and tried to build syslog-ng from the > >>> source, there was an error saying, > >>> > >>> > ${syslog-ng_HOME}/modules/afmongodb/mongo-c-driver/src/mongoc/mongoc-scram.c: > >>> In function '_mongoc_scram_sha1': storage size of 'digest_ctx' isn't > known > >>> (EVP_MD_CTX digest_ctx) > >>> I confirmed OpenSSL [1] headers are included in the file.Can you please > >>> point out whats wrong? > >>> > >>> [1] > >>> > https://github.com/mongodb/mongo-c-driver/blob/7415d3468de0c500fd6e630f7b52… > >>> > >>> Thanks. > >>> Regards, > >>> Vithulan > >>> > >>> > >>> > >>> > ______________________________________________________________________________ > >>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > >>> Documentation: > >>> http://www.balabit.com/support/documentation/?product=syslog-ng > >>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >>> > >>> > >> > >> > >> > >> > ______________________________________________________________________________ > >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > >> Documentation: > >> http://www.balabit.com/support/documentation/?product=syslog-ng > >> FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >> > >> > > > > > > > > -- > > Vithulan MV. > > > > Undergraduate, > > Department of Computer Science & Engineering, > > University of Moratuwa, > > Sri lanka. > > > > > ______________________________________________________________________________ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > ------------------------------ > > Message: 2 > Date: Tue, 22 Mar 2016 11:22:21 +0100 > From: Czanik, P?ter <peter.czanik(a)balabit.com> > Subject: Re: [syslog-ng] syslog-ng 3.8 how to get configure script > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <CANcUavt4iOerSVbJdSnJM= > Zg-fw1eSjwDwydLdz+MFM3jjdj0Q(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hi, > > I have now a completely untested rhel7 package available at > https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng38/ I'll try to > build also for rhel6 later this week. It includes Java modules, but not the > JAR dependencies. > > Bye, > > Peter Czanik (CzP) <peter.czanik(a)balabit.com> > Balabit / syslog-ng upstream > http://czanik.blogs.balabit.com/ > https://twitter.com/PCzanik > > On Sun, Mar 20, 2016 at 7:06 PM, Tibor Benke <ihrwein(a)gmail.com> wrote: > > > Hi Evan, > > > > I think you need to install the autoconf-archive package, then run > > ./autogen.sh. Everything else should be the same. > > > > Tibor > > > > 2016-03-20 17:52 GMT+01:00 Evan Rempel <erempel(a)uvic.ca>: > > > >> I wanted to start using elasticsearch 2.2 so need to start using > >> syslog-ng 3.8 but there is no > >> configure script in the master branch. > >> > >> autoconf returns a bunch of "possibly undefined macro" errors and leaves > >> a non-working configure script. > >> autoreconf does similar things. > >> > >> Can anyone give me some help on getting a working configure/make setup > >> for syslog-ng 3.8 > >> > >> I am attempting this on Redhat 6. > >> > >> Evan. > >> > >> > >> > ______________________________________________________________________________ > >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > >> Documentation: > >> http://www.balabit.com/support/documentation/?product=syslog-ng > >> FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >> > >> > > > > > > > ______________________________________________________________________________ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > > > >

2 1

Gsoc 2016 Introduction: Radcliffe
by Radcliffe Robinson 22 Mar '16

22 Mar '16

Hi there. My name is Radcliffe Robinson. I am a second year computer science student at the University of the West Indies, Jamaica. I actually first became interested interested in syslog-ng as a potential user while searching for a more palatable logging and log processing solution (something for sophisticated than ctrl+f) for a billing system a partner and I built in C to accompany the Asterisk pbx system at our internship. I had some time ago read about a company that logged all messages and controlled all their systems through a web server (localhost/product/restart to restart a service, localhost/product/logs?query=query to view logsm etc) and was searching for a similar way to send log messages from the billing software directly to the web-server i built to interfaces with customer database, where i would then do filtering and grouping etc of the log messages. It is for this reason that i am particularly interested in your project idea to create a websocket destination for syslog-ng. Syslog-ng already possess the filtering and grouping functionality, leaving only the act of implementing the websocket source. This something i could directly apply to an existing product of mine. However my passion for user interface design and extensive experience with web development draws my interest towards your idea for a drag and drop web interface for creating syslog-ng configuration files, purely because of the novelty of the idea and the opportunity to supersize some creative and aesthetic competency, a relatively rare experience in my short professional life as a developer. The more consideration i give to this idea, and the further i read through the admin guide, the more difficult a task it reveals itself to be but i have already devised a few possible solutions and began designing the database schema to facilitate it, and am confident that it is within the scope of my competency to create a useful and well designed web solution. I will be running these ideas by the project's mentor to seek feedback. I expect to end up sending in applications for multiple of the gsoc ideas the syslog-ng team has posted as they are the most interesting set of ideas which align well with my skill set that i have found. Thus, if given the opportunity, i look forward to working with the team this summer. Best regards, Radcliffe.

1 0

3.7.3 unofficial openSUSE / SLES packages
by Czanik, Péter 22 Mar '16

22 Mar '16

Hi, My unofficial syslog-ng 3.7.3 openSUSE / SLES packages are available at https://build.opensuse.org/project/show/home:czanik:syslog-ng37 I'll fix the Tumbleweed build later this week. If you have any questions or run into any problems, let me know! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

syslog-ng-3.7.3 unofficial Debian/Ubuntu packages
by Budai, László 22 Mar '16

22 Mar '16

Hi, I've just created my unofficial OBS repo[1] for syslog-ng 3.7.3 (latest revision: 3.7.3-2). List of supported OSs (i386/amd64): * Debian 7.0 * Debian 8.0 * Ubuntu 12.04 * Ubuntu 14.04 * Ubuntu 14.10 * Ubuntu 15.04 * Ubuntu 15.10 [newly added] Install ------- example: Debian 8.0 1. get release key wget -qO - http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… | sudo apt-key add - 2. add repo to APT sources eg.: /etc/apt/sources.list.d/syslog-ng-obs.list deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… ./ Then `apt-get update` and `apt-get install syslog-ng-core` You can replace Debian_8.0 to * Debian_7.0 * xUbuntu_12.04, * xUbuntu_14.04 * xUbuntu_14.10 * xUbuntu_15.04 * xUbuntu_15.10 Available packages: * syslog-ng-core * syslog-ng-dbg * syslog-ng-dev * syslog-ng-mod-stomp * syslog-ng-mod-amqp * syslog-ng-mod-elastic * syslog-ng-mod-geoip * syslog-ng-mod-graphite * syslog-ng-mod-hdfs * syslog-ng-mod-http * syslog-ng-mod-java * syslog-ng-mod-java-common-lib * syslog-ng-mod-journal * syslog-ng-mod-json * syslog-ng-mod-kafka * syslog-ng-mod-mongodb * syslog-ng-mod-python * syslog-ng-mod-redis * syslog-ng-mod-riemann * syslog-ng-mod-smtp * syslog-ng-mod-sql * syslog-ng-mod-stomp Notes to the java destinations ------------------------------ About the ``` Error opening plugin module; module='mod-java', error='libjvm.so: cannot open shared object file: No such file or directory' ``` problem. libmod-java.so is linked to the libjvm.so library. If your java installation doesn't create a symlink in /usr/lib directory to libjvm.so then you have to modify your ld.so.conf or expand your LD_LIBRARY_PATH with the containing library before starting syslog-ng. eg.: LD_LIBRARY_PATH=/usr/lib/jvm/java-7-openjdk-amd64/jre/lib/amd64/server:$LD_LIBRARY_PATH Links -------- [1] https://build.opensuse.org/project/show/home:laszlo_budai:syslog-ng [2] https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.7.3 regards, Laszlo Budai

1 0