March 2016 - syslog-ng - lists.balabit.hu

syslog-ng to elasticsearch
by Mike Lewis 04 Mar '16

04 Mar '16

Hi, I’m having some issues trying to setup (syslog-ng v3.7.2) an elastic search destination. ES 2.2.0. In my syslog-ng.conf file, I have the destination defined as: destination d_elasticsearch { elasticsearch( index("syslog-ng_${YEAR}.${MONTH}.${DAY}") type("syslog-ng") class-path("/usr/lib64/syslog-ng/java-modules/*.jar:/usr/lib/syslog-ng-java-module-dependency-jars/jars/*.jar:/usr/share/elasticsearch/lib/*.jar:/usr/share/elasticsearch/modules/*.jar") client_mode("transport") server("172.16.100.137") port("9300") cluster("dev-elasticsearch") template("$(format-json -s all-nv-pairs -p @timestamp=$ISODATE -p @message=$MSG)") ); }; However, in the elastic search logs, I just see an exception through on each connection attempt: [2016-03-04 06:33:00,737][WARN ][transport.netty ] [node-1] exception caught on transport layer [[id: 0xe12086b7, /172.16.100.137:52583 => /172.16.100.137:9300]], closing connection java.lang.IllegalStateException: Message not fully read (request) for requestId [0], action [cluster/state], readerIndex [34] vs expected [49]; resetting at org.elasticsearch.transport.netty.MessageChannelHandler.messageReceived(MessageChannelHandler.java:120) Has anyone come across this issues previously? Regards, Mike Lewis -------------------------------------------------------------------------------------------------------------------------- This email has been sent to you on behalf of Nephila Advisors LLC (“Advisors”). Advisors provides consultancy services to Nephila Capital Ltd. (“Capital”), an investment advisor managed and carrying on business in Bermuda. Advisors and its employees do not act as agents for Capital or the funds it advises and do not have the authority to bind Capital or such funds to any transaction or agreement. The information in this e-mail, and any attachment therein, is confidential and for use by the addressee only. Any use, disclosure, reproduction, modification or distribution of the contents of this e-mail, or any part thereof, other than by the intended recipient, is strictly prohibited. If you are not the intended recipient, please return the e-mail to the sender and delete it from your computer. This email is for information purposes only, nothing contained herein constitutes an offer to sell or buy securities, as such an offer may only be made from a properly authorized offering document. Although Nephila attempts to sweep e-mail and attachments for viruses, it does not guarantee that either are virus-free and accepts no liability for any damage sustained as a result of viruses. -------------------------------------------------------------------------------------------------------------------------- -------------------------------------------------------------------------------------------------------------------------- This email has been sent to you on behalf of Nephila Advisors UK (“Advisors UK”). Advisors UK provides consultancy services to Nephila Capital Ltd. (“Capital”), an investment advisor managed and carrying on business in Bermuda. Advisors UK and its employees do not act as agents for Capital or the funds it advises and do not have the authority to bind Capital or such funds to any transaction or agreement. The information in this e-mail, and any attachment therein, is confidential and for use by the addressee only. Any use, disclosure, reproduction, modification or distribution of the contents of this e-mail, or any part thereof, other than by the intended recipient, is strictly prohibited. If you are not the intended recipient, please return the e-mail to the sender and delete it from your computer. This email is for information purposes only, nothing contained herein constitutes an offer to sell or buy securities, as such an offer may only be made from a properly authorized offering document. Although Nephila attempts to sweep e-mail and attachments for viruses, it does not guarantee that either are virus-free and accepts no liability for any damage sustained as a result of viruses. --------------------------------------------------------------------------------------------------------------------------

3 3

GSOC16. Interested in Automated release generation for syslog-ng
by Yilin Li 04 Mar '16

04 Mar '16

Hi, I am Yilin Li, a second-year postgraduate student at ISCAS(Institute of Software Chinese Academy of Sciences). I'm very familar with python and I have developed a lot project with it. I'm really interested in the idea [Automated release generation for syslog-ng]( https://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-list#proj… ) I plan to draft my schedule in a few days and send you for some opinons. If there is any thing that will make me understand this project better, please notify me. -- Thanks, Yiln Li -- Institute of Software Chinese Academy of Sciences

1 0

GSoC'16 Introduction and Project Idea
by Jaydeep Chauhan 03 Mar '16

03 Mar '16

Hello Everyone, Im Jaydeep Chauhan final year student of computer engineering.I like your proposed idea for GSoC'16 about command line tool and l found it interesting .I also like to propose my own idea for syslog-ng which will be on directory monitoring (like files created,deleted,open,etc). I have developed small implementation of directory monitoring.I come to know your community from GSoC im looking to contribute in it. Thank you!

1 0

GSoC 2016 Project
by amey jain 03 Mar '16

03 Mar '16

Greetings to all. I am Amey Jain. I am second year student of Information Technology in Jabalpur Engineering College,India. I am connected with syslog-ng since last month. I am interested in your project of syslog-ng as command line tool and that of Websocket. But I can't find any further details on that project. Please provide me any further details on the same. Also if possible, recommend me about how to proceed with these projects and what to do further. Thank you. Regards.

1 0

[GSoC] Project: Kafka source
by Vithulan MV 03 Mar '16

03 Mar '16

Hi all, I'm currently a 3rd year undergraduate at University of Moratuwa, Sri lanka. I have attached my Linkedin profile with this mail [1]. I'd like to contribute to a GSoC 2016 project with the open source community of syslog-ng. I have contributed in log analyzing project LogAnalyzer [2] and also worked with logstash, kafka. Therefore, I think I can contribute syslog-ng project kafka source as I'm much interested in that. Please kindly make any suggestions on how I should proceed on this? [1] https://lk.linkedin.com/in/vithulamv [2] https://github.com/VIthulan/product-la Thank you. Regards, Vithulan -- Vithulan MV. Undergraduate, Department of Computer Science & Engineering, University of Moratuwa, Sri lanka.

1 0

GSoC 2016 Introduction
by Tcheutchoua Steve 02 Mar '16

02 Mar '16

Greetings to you all. I am Tcheutchoua Steve, Student at the University of Buea Cameroon. I am very interested in contributing to syslog-ng. The projects that interest me the most are kafka Source <https://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-list#proj…> and JDBC driver implementation <https://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-list#proj…> . I will like to know more about these project ideas ( example , is the description complete ? any recommended document or site ? etc ) Best Regards

1 0

Not able to set source IP in syslog-ng.conf.
by Girish Kumar 01 Mar '16

01 Mar '16

Hi All, I have set the source IP to client address. This is at syslog-ng.conf file at server On spawning the syslog-ng following error is seen . Could you please help me on this [root@localhost cert.d]# /sbin/syslog-ng [2016-03-01T10:27:06.128929] Error binding socket; addr='AF_INET(10.135.83.104:514)', error='Cannot assign requested address (99)' [2016-03-01T10:27:06.128983] Error initializing message pipeline; 10.135.83.104 is reachable from server My conf file ------------------ @version:3.6 @include "scl.conf" source s_local { internal(); }; source d_source { syslog(ip("10.135.83.104") port(514) transport("udp") ); }; destination d_local { file("/var/log/messagesgiri"); }; log { source(s_local); source(d_source); destination(d_local); }; Regards, Girish

2 2