June 2016 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] Web Visualize logs (Ivan Adji - Krstev)
by Szabó, István 07 Sep '16

07 Sep '16

Hi, For using syslog-ng together with elasticsearch and Kibana this is a pretty good description, also giving you a good understanding of what it enables you to do: https://czanik.blogs.balabit.com/2015/10/how-to-parse-data-with-syslog-ng-s… https://czanik.blogs.balabit.com/2015/12/elasticsearch-and-syslog-ng-fast-a… /Istvan

9 24

powered by syslog-ng
by Czanik, Péter 19 Jul '16

19 Jul '16

Hi, We have now a "Powered by syslog-ng" page on our website. It's available at https://syslog-ng.org/powered-by-syslog-ng/ If your project / company / product / etc. uses syslog-ng, we are happy to include you on the list too, just e-mail me directly! Some of the more interesting names from the list are Facebook, Kindle, FreeNAS and of course all the major Linux distributions. Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

2 1

Re: [syslog-ng] Syslog-ng Multiple Instances
by David Campeau 01 Jul '16

01 Jul '16

Hello, I've been using syslog-ng to filter syslog before forwarding on to a log collector. However, I need to spin up a second instance for testing purposes. I've found a little bit of information on-line, but it hasn't completed the entire picture. This is the command used to start up the 2nd instance. I'm pointing to separate .conf .persist .pid and .ctl files -- However, it's still not working. I suspect the issue is due to OS log sources. How do a change log sources? syslog-ng --cfgfile=/usr/local/bin/syslog-ng-Second-Instance/syslog-ng.conf --persist-file=/usr/local/bin/syslog-ng-Second-Instance/syslog-ng.persist --pidfile=/usr/local/bin/syslog-ng-Second-Instance/syslog-ng.pid --control=/usr/local/bin/syslog-ng-Second-Instance/syslog-ng.ctl & This is the upper part of the syslog-ng.conf file for the 2nd instance I wish to run. @version: 3.3.4 @include "scl.conf" options { time-reap(30); mark-freq(10); keep-hostname(yes); chain-hostnames(no); use-dns(no); ## log-fifo-size(500000); ## Tuning Options ## flush_lines(10000); ## Tuning Options ## flush_timeout(10000); ## Tuning Options }; source s_second_instance { syslog(transport("udp") port("518")); #### Will receive test syslog on port 518 }; destination d_syslog_udp { syslog("10.X.X.X" transport("udp") port("514") throttle(4000) ); }; I'm hoping someone has experience or has seen information on how to run a 2nd instance on the same box. Best Regards, David

3 7

getting some information about the sender process
by Attila Szalai 30 Jun '16

30 Jun '16

Hi, Maybe I'm totally wrong, but I have/had the impression that syslog-ng collects some information about the client process if that connects through a unix domain socket. But actually I could not find anything related to this neither in the documentation nor the code. Is this something that only exists in my mind or I just missed something?

2 2

a log message is output in the two line
by Hirose, Shinsaku 30 Jun '16

30 Jun '16

Hello, all, I use syslog-ng-3.2.5-4.el6.x86_64 on Centos6. I got it from eple epel repository. I am troubled in how to use the source file driver. The touble is that a log message is output in the two lines on remote syslog server. How to reproduce is followings. 1. Prepare two hosts running syslog-ng. Host_A configuration is followings. ---------------------------------------- source test { file("/tmp/a.log"); }; destination d_remote { udp("192.168.0.2"); }; log { source(test); destination(d_remote); }; ---------------------------------------- Host_B(192.168.0.2) configuration is defaults. 2.Execute following command on Host_A. $ seq 8193 | (xargs -i echo -n "a";echo "") >> /tmp/a.log 3.Check the log on Host_B. As the result, a log message is output in the two lines on Host_B. One line is following. The num of "a" is 8192. aaaaaaaaaaaaa....... The other line is following. The num of "a" is 1. a I hope a log message is output in the one line on Host_B. Is my hope readily achievable? Please advise me.

5 7

CzP in Nuremberg
by Czanik, Péter 21 Jun '16

21 Jun '16

Hi, For the next couple of days I'll be in Nuremberg for the openSUSE conference: https://events.opensuse.org/conference/oSC16 I'll give a presentation on syslog-ng Friday in the afternoon at 13:30 in the Roter Salon. I'll wear my syslog-ng superhero t-shirt, so I'll be easy to spot and ready to answer syslog-ng questions any time. If you are in Nuremberg, but not at the conference, I'm happy to talk to you about syslog-ng also outside of the conference floor. You can reach me by e-mail or on twitter as @pczanik See you soon in Nuremberg, Peter

1 0

Syslog-ng 3.7.3 + Elasticsearch V2.3 - Error init pipeline
by Marco Mignone 16 Jun '16

16 Jun '16

Hi All, I am trying to setup syslog-ng to use elasticsearch as its destination on Ubuntu 14.04. This the version of syslog (the unofficial versions installed from laszlo_budai rep: syslog-ng 3.7.3 Installer-Version: 3.7.3 Revision: 3.7.3-8 Compile-Date: Jun 1 2016 16:33:00 Available-Modules: basicfuncs,linux-kmsg-format,riemann,afuser,afstomp,afprog,json-plugin,afsmtp,affile,csvparser,mod-java,pseudofile,confgen,afsocket,afamqp,redis,sdjournal,kvformat,syslogformat,afsql,system-source,mod-python,graphite,dbparser,geoip-plugin,afmongodb,cryptofuncs Elastic search is: "name" : "Theresa Cassidy", "cluster_name" : "elasticsearch", "version" : { "number" : "2.3.3", "build_hash" : "218bdf10790eef486ff2c41a3df5cfa32dadcfde", "build_timestamp" : "2016-05-17T15:40:04Z", "build_snapshot" : false, "lucene_version" : “5.5.0" And my custom configuration in /etc/syslog-ng/conf.d/test.conf which is: @module mod-java source s_net { udp(); tcp(); }; destination d_elastic { elasticsearch( index("syslog-ng_${YEAR}.${MONTH}.${DAY}") type("test") client_lib_dir("/usr/share/elasticsearch/lib") ); }; log { source(s_net); destination(d_elastic); flags(flow-control); }; When I try to launch syslog in debug mode this is what I get: [2016-06-16T15:54:29.378356] Add path to classpath: /usr/lib/syslog-ng/3.7/java-modules/syslog-ng-core.jar; [2016-06-16T15:54:29.382446] Add path to classpath: /usr/lib/syslog-ng/3.7/java-modules/syslog-ng-core.jar; [2016-06-16T15:54:29.382660] Add path to classpath: /usr/lib/syslog-ng/3.7/java-modules/kafka.jar; [2016-06-16T15:54:29.382862] Add path to classpath: /usr/lib/syslog-ng/3.7/java-modules/http.jar; [2016-06-16T15:54:29.383052] Add path to classpath: /usr/lib/syslog-ng/3.7/java-modules/hdfs.jar; [2016-06-16T15:54:29.383258] Add path to classpath: /usr/lib/syslog-ng/3.7/java-modules/elastic.jar; [2016-06-16T15:54:29.383479] Add path to classpath: /usr/lib/syslog-ng/3.7/java-modules/syslog-ng-common.jar; [2016-06-16T15:54:29.383670] Add path to classpath: /usr/lib/syslog-ng/3.7/java-modules/log4j-1.2.16.jar; [2016-06-16T15:54:29.383917] Add path to classpath: /usr/share/elasticsearch/lib/guava-18.0.jar; [2016-06-16T15:54:29.384098] Add path to classpath: /usr/share/elasticsearch/lib/jna-4.1.0.jar; [2016-06-16T15:54:29.384293] Add path to classpath: /usr/share/elasticsearch/lib/spatial4j-0.5.jar; [2016-06-16T15:54:29.384494] Add path to classpath: /usr/share/elasticsearch/lib/compress-lzf-1.0.2.jar; [2016-06-16T15:54:29.386104] Add path to classpath: /usr/share/elasticsearch/lib/lucene-spatial-5.5.0.jar; [2016-06-16T15:54:29.386342] Add path to classpath: /usr/share/elasticsearch/lib/lucene-backward-codecs-5.5.0.jar; [2016-06-16T15:54:29.386507] Add path to classpath: /usr/share/elasticsearch/lib/t-digest-3.0.jar; [2016-06-16T15:54:29.386677] Add path to classpath: /usr/share/elasticsearch/lib/jackson-dataformat-cbor-2.6.6.jar; [2016-06-16T15:54:29.386865] Add path to classpath: /usr/share/elasticsearch/lib/lucene-memory-5.5.0.jar; [2016-06-16T15:54:29.387044] Add path to classpath: /usr/share/elasticsearch/lib/jackson-core-2.6.6.jar; [2016-06-16T15:54:29.387216] Add path to classpath: /usr/share/elasticsearch/lib/joda-time-2.8.2.jar; [2016-06-16T15:54:29.387394] Add path to classpath: /usr/share/elasticsearch/lib/lucene-join-5.5.0.jar; [2016-06-16T15:54:29.387673] Add path to classpath: /usr/share/elasticsearch/lib/lucene-grouping-5.5.0.jar; [2016-06-16T15:54:29.388476] Add path to classpath: /usr/share/elasticsearch/lib/HdrHistogram-2.1.6.jar; [2016-06-16T15:54:29.388647] Add path to classpath: /usr/share/elasticsearch/lib/compiler-0.8.13.jar; [2016-06-16T15:54:29.388818] Add path to classpath: /usr/share/elasticsearch/lib/netty-3.10.5.Final.jar; [2016-06-16T15:54:29.388972] Add path to classpath: /usr/share/elasticsearch/lib/lucene-misc-5.5.0.jar; [2016-06-16T15:54:29.389518] Add path to classpath: /usr/share/elasticsearch/lib/lucene-analyzers-common-5.5.0.jar; [2016-06-16T15:54:29.389711] Add path to classpath: /usr/share/elasticsearch/lib/lucene-sandbox-5.5.0.jar; [2016-06-16T15:54:29.390094] Add path to classpath: /usr/share/elasticsearch/lib/elasticsearch-2.3.3.jar; [2016-06-16T15:54:29.390283] Add path to classpath: /usr/share/elasticsearch/lib/commons-cli-1.3.1.jar; [2016-06-16T15:54:29.390488] Add path to classpath: /usr/share/elasticsearch/lib/snakeyaml-1.15.jar; [2016-06-16T15:54:29.390659] Add path to classpath: /usr/share/elasticsearch/lib/jsr166e-1.1.0.jar; [2016-06-16T15:54:29.390935] Add path to classpath: /usr/share/elasticsearch/lib/lucene-core-5.5.0.jar; [2016-06-16T15:54:29.391176] Add path to classpath: /usr/share/elasticsearch/lib/lucene-suggest-5.5.0.jar; [2016-06-16T15:54:29.394616] Add path to classpath: /usr/share/elasticsearch/lib/jackson-dataformat-yaml-2.6.6.jar; [2016-06-16T15:54:29.395279] Add path to classpath: /usr/share/elasticsearch/lib/log4j-1.2.17.jar; [2016-06-16T15:54:29.395458] Add path to classpath: /usr/share/elasticsearch/lib/joda-convert-1.2.jar; [2016-06-16T15:54:29.395970] Add path to classpath: /usr/share/elasticsearch/lib/hppc-0.7.1.jar; [2016-06-16T15:54:29.396734] Add path to classpath: /usr/share/elasticsearch/lib/jackson-dataformat-smile-2.6.6.jar; [2016-06-16T15:54:29.397919] Add path to classpath: /usr/share/elasticsearch/lib/lucene-queryparser-5.5.0.jar; [2016-06-16T15:54:29.398106] Add path to classpath: /usr/share/elasticsearch/lib/lucene-spatial3d-5.5.0.jar; [2016-06-16T15:54:29.398281] Add path to classpath: /usr/share/elasticsearch/lib/lucene-queries-5.5.0.jar; [2016-06-16T15:54:29.398440] Add path to classpath: /usr/share/elasticsearch/lib/apache-log4j-extras-1.2.17.jar; [2016-06-16T15:54:29.398610] Add path to classpath: /usr/share/elasticsearch/lib/lucene-highlighter-5.5.0.jar; [2016-06-16T15:54:29.398784] Add path to classpath: /usr/share/elasticsearch/lib/jts-1.13.jar; [2016-06-16T15:54:29.398925] Add path to classpath: /usr/share/elasticsearch/lib/securesm-1.0.jar; [2016-06-16T15:54:29.501879] Add path to classpath: /usr/lib/syslog-ng/3.7/java-modules/syslog-ng-core.jar; [2016-06-16T15:54:29.519443] Error initializing message pipeline; Was anyone able to make this work or suggest a way to fix this? I hope I am on the right place and if not apologies in advance. Thanks, Marco

3 3

Re: [syslog-ng] Syslog-ng 3.7.3 + Elasticsearch V2.3 - Error init pipeline
by Laszlo Budai 16 Jun '16

16 Jun '16

Hi, it should work with the latest 1.x. I'm working on my 3.8 OBS repo, but having some problems. When I have the alpha packages, I'll send a mail. Regards, Laszlo Budai Sent from my HTC ----- Reply message ----- From: "Marco Mignone" <info(a)marcomignone.com> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] Syslog-ng 3.7.3 + Elasticsearch V2.3 - Error init pipeline Date: Thu, Jun 16, 2016 17:34 Hi Peter, Thanks for the quick reply. I thought there was some hack or way around it. I will then try with ElasticSearch1.X. Will the latest version of 1.x work or is there a specific version? Thanks again for your time. Marco > On 16 Jun 2016, at 16:26, Czanik, Péter <peter.czanik(a)balabit.com> wrote: > > Hi, > > syslog-ng 3.7 only works with Elasticsearch 1.X. For Elasticsearch 2.X > you need syslog-ng 3.8, which is still under development (alpha). > > Bye, > Peter Czanik (CzP) <peter.czanik(a)balabit.com> > Balabit / syslog-ng upstream > http://czanik.blogs.balabit.com/ > https://twitter.com/PCzanik > > > On Thu, Jun 16, 2016 at 5:11 PM, Marco Mignone <info(a)marcomignone.com> wrote: >> Hi All, >> I am trying to setup syslog-ng to use elasticsearch as its destination on >> Ubuntu 14.04. >> This the version of syslog (the unofficial versions installed from >> laszlo_budai rep: >> >> syslog-ng 3.7.3 >> Installer-Version: 3.7.3 >> Revision: 3.7.3-8 >> Compile-Date: Jun 1 2016 16:33:00 >> Available-Modules: >> basicfuncs,linux-kmsg-format,riemann,afuser,afstomp,afprog,json-plugin,afsmtp,affile,csvparser,mod-java,pseudofile,confgen,afsocket,afamqp,redis,sdjournal,kvformat,syslogformat,afsql,system-source,mod-python,graphite,dbparser,geoip-plugin,afmongodb,cryptofuncs >> >> Elastic search is: >> >> "name" : "Theresa Cassidy", >> "cluster_name" : "elasticsearch", >> "version" : { >> "number" : "2.3.3", >> "build_hash" : "218bdf10790eef486ff2c41a3df5cfa32dadcfde", >> "build_timestamp" : "2016-05-17T15:40:04Z", >> "build_snapshot" : false, >> "lucene_version" : “5.5.0" >> >> >> And my custom configuration in /etc/syslog-ng/conf.d/test.conf which is: >> >> @module mod-java >> >> source s_net { >> udp(); >> tcp(); >> }; >> >> destination d_elastic { >> elasticsearch( >> index("syslog-ng_${YEAR}.${MONTH}.${DAY}") >> type("test") >> client_lib_dir("/usr/share/elasticsearch/lib") >> ); >> }; >> >> log { >> source(s_net); >> destination(d_elastic); >> flags(flow-control); >> }; >> >> >> When I try to launch syslog in debug mode this is what I get: >> >> [2016-06-16T15:54:29.378356] Add path to classpath: >> /usr/lib/syslog-ng/3.7/java-modules/syslog-ng-core.jar; >> [2016-06-16T15:54:29.382446] Add path to classpath: >> /usr/lib/syslog-ng/3.7/java-modules/syslog-ng-core.jar; >> [2016-06-16T15:54:29.382660] Add path to classpath: >> /usr/lib/syslog-ng/3.7/java-modules/kafka.jar; >> [2016-06-16T15:54:29.382862] Add path to classpath: >> /usr/lib/syslog-ng/3.7/java-modules/http.jar; >> [2016-06-16T15:54:29.383052] Add path to classpath: >> /usr/lib/syslog-ng/3.7/java-modules/hdfs.jar; >> [2016-06-16T15:54:29.383258] Add path to classpath: >> /usr/lib/syslog-ng/3.7/java-modules/elastic.jar; >> [2016-06-16T15:54:29.383479] Add path to classpath: >> /usr/lib/syslog-ng/3.7/java-modules/syslog-ng-common.jar; >> [2016-06-16T15:54:29.383670] Add path to classpath: >> /usr/lib/syslog-ng/3.7/java-modules/log4j-1.2.16.jar; >> [2016-06-16T15:54:29.383917] Add path to classpath: >> /usr/share/elasticsearch/lib/guava-18.0.jar; >> [2016-06-16T15:54:29.384098] Add path to classpath: >> /usr/share/elasticsearch/lib/jna-4.1.0.jar; >> [2016-06-16T15:54:29.384293] Add path to classpath: >> /usr/share/elasticsearch/lib/spatial4j-0.5.jar; >> [2016-06-16T15:54:29.384494] Add path to classpath: >> /usr/share/elasticsearch/lib/compress-lzf-1.0.2.jar; >> [2016-06-16T15:54:29.386104] Add path to classpath: >> /usr/share/elasticsearch/lib/lucene-spatial-5.5.0.jar; >> [2016-06-16T15:54:29.386342] Add path to classpath: >> /usr/share/elasticsearch/lib/lucene-backward-codecs-5.5.0.jar; >> [2016-06-16T15:54:29.386507] Add path to classpath: >> /usr/share/elasticsearch/lib/t-digest-3.0.jar; >> [2016-06-16T15:54:29.386677] Add path to classpath: >> /usr/share/elasticsearch/lib/jackson-dataformat-cbor-2.6.6.jar; >> [2016-06-16T15:54:29.386865] Add path to classpath: >> /usr/share/elasticsearch/lib/lucene-memory-5.5.0.jar; >> [2016-06-16T15:54:29.387044] Add path to classpath: >> /usr/share/elasticsearch/lib/jackson-core-2.6.6.jar; >> [2016-06-16T15:54:29.387216] Add path to classpath: >> /usr/share/elasticsearch/lib/joda-time-2.8.2.jar; >> [2016-06-16T15:54:29.387394] Add path to classpath: >> /usr/share/elasticsearch/lib/lucene-join-5.5.0.jar; >> [2016-06-16T15:54:29.387673] Add path to classpath: >> /usr/share/elasticsearch/lib/lucene-grouping-5.5.0.jar; >> [2016-06-16T15:54:29.388476] Add path to classpath: >> /usr/share/elasticsearch/lib/HdrHistogram-2.1.6.jar; >> [2016-06-16T15:54:29.388647] Add path to classpath: >> /usr/share/elasticsearch/lib/compiler-0.8.13.jar; >> [2016-06-16T15:54:29.388818] Add path to classpath: >> /usr/share/elasticsearch/lib/netty-3.10.5.Final.jar; >> [2016-06-16T15:54:29.388972] Add path to classpath: >> /usr/share/elasticsearch/lib/lucene-misc-5.5.0.jar; >> [2016-06-16T15:54:29.389518] Add path to classpath: >> /usr/share/elasticsearch/lib/lucene-analyzers-common-5.5.0.jar; >> [2016-06-16T15:54:29.389711] Add path to classpath: >> /usr/share/elasticsearch/lib/lucene-sandbox-5.5.0.jar; >> [2016-06-16T15:54:29.390094] Add path to classpath: >> /usr/share/elasticsearch/lib/elasticsearch-2.3.3.jar; >> [2016-06-16T15:54:29.390283] Add path to classpath: >> /usr/share/elasticsearch/lib/commons-cli-1.3.1.jar; >> [2016-06-16T15:54:29.390488] Add path to classpath: >> /usr/share/elasticsearch/lib/snakeyaml-1.15.jar; >> [2016-06-16T15:54:29.390659] Add path to classpath: >> /usr/share/elasticsearch/lib/jsr166e-1.1.0.jar; >> [2016-06-16T15:54:29.390935] Add path to classpath: >> /usr/share/elasticsearch/lib/lucene-core-5.5.0.jar; >> [2016-06-16T15:54:29.391176] Add path to classpath: >> /usr/share/elasticsearch/lib/lucene-suggest-5.5.0.jar; >> [2016-06-16T15:54:29.394616] Add path to classpath: >> /usr/share/elasticsearch/lib/jackson-dataformat-yaml-2.6.6.jar; >> [2016-06-16T15:54:29.395279] Add path to classpath: >> /usr/share/elasticsearch/lib/log4j-1.2.17.jar; >> [2016-06-16T15:54:29.395458] Add path to classpath: >> /usr/share/elasticsearch/lib/joda-convert-1.2.jar; >> [2016-06-16T15:54:29.395970] Add path to classpath: >> /usr/share/elasticsearch/lib/hppc-0.7.1.jar; >> [2016-06-16T15:54:29.396734] Add path to classpath: >> /usr/share/elasticsearch/lib/jackson-dataformat-smile-2.6.6.jar; >> [2016-06-16T15:54:29.397919] Add path to classpath: >> /usr/share/elasticsearch/lib/lucene-queryparser-5.5.0.jar; >> [2016-06-16T15:54:29.398106] Add path to classpath: >> /usr/share/elasticsearch/lib/lucene-spatial3d-5.5.0.jar; >> [2016-06-16T15:54:29.398281] Add path to classpath: >> /usr/share/elasticsearch/lib/lucene-queries-5.5.0.jar; >> [2016-06-16T15:54:29.398440] Add path to classpath: >> /usr/share/elasticsearch/lib/apache-log4j-extras-1.2.17.jar; >> [2016-06-16T15:54:29.398610] Add path to classpath: >> /usr/share/elasticsearch/lib/lucene-highlighter-5.5.0.jar; >> [2016-06-16T15:54:29.398784] Add path to classpath: >> /usr/share/elasticsearch/lib/jts-1.13.jar; >> [2016-06-16T15:54:29.398925] Add path to classpath: >> /usr/share/elasticsearch/lib/securesm-1.0.jar; >> [2016-06-16T15:54:29.501879] Add path to classpath: >> /usr/lib/syslog-ng/3.7/java-modules/syslog-ng-core.jar; >> [2016-06-16T15:54:29.519443] Error initializing message pipeline; >> >> >> Was anyone able to make this work or suggest a way to fix this? >> I hope I am on the right place and if not apologies in advance. >> >> Thanks, >> Marco >> >> >> ______________________________________________________________________________ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: >> http://www.balabit.com/support/documentation/?product=syslog-ng >> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >> >> > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

2 1

Is there a standard for naming tag/value pairs when parsing
by Evan Rempel 16 Jun '16

16 Jun '16

There was a project by Mitre (https://www.mitre.org/) called the Common Event Expression (https://cee.mitre.org/) that was going to be the official standard for metadata names for events, but that project has been stopped. Other than the two references that the CEE project has for logging standardization efforts, does anyone know of any major efforts by any group to define a standard for metadata naming? Evan.

3 6

Insider 2016-06: Red Hat; 3.8 RPMs; BMW; MongoDB; FLARE; Java;
by Czanik, Péter 16 Jun '16

16 Jun '16

Dear syslog-ng users, This is the 50th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Meet syslog-ng at Red Hat Summit -------------------------------- This year Balabit is sponsoring the Red Hat Summit again. The event will be held in Moscone Center North in San Francisco, June 27-29. Visit Balabit’s booth (booth #918) and meet Balázs Scheidler, the author of syslog-ng. You can request an appointment at http://pages2.balabit.com/red-hat-summit-appointment-request/ If you want to meet him outside of the conference floor, there will also be a meetup in Café Prague on the 30th of June: https://www.eventbrite.com/e/techie-happy-hour-optimize-your-log-data-in-th… Preview syslog-ng 3.8 RPM packages and send us your feedback ------------------------------------------------------------ While syslog-ng 3.8 does not yet have an alpha release, it already has many interesting features. As it is still under heavy development, we can't recommend it for production use. On the other hand, any feedback is very welcome. New features include disk buffer, Elasticsearch 2 support, grouping-by, Rust-based parsers, and so on: https://czanik.blogs.balabit.com/2016/05/state-of-syslog-ng-3-8-rpm-packagi… syslog-ng in the BMW i3 ----------------------- While most people know syslog-ng as a central syslog server, there is another use, which is less known but most likely has a lot larger installed base. It is syslog-ng embedded. Read how BMW is utilizing syslog-ng at https://czanik.blogs.balabit.com/2016/06/embedded-syslog-ng-bmw-i3-all-elec… and let us know how you use syslog-ng! MongoDB changes in 3.8 ---------------------- Under the hood, the driver to access MongoDB databases was replaced in syslog-ng 3.8. Read about the advantages of the new driver and how it affects configuration at: https://syslog-ng.org/mongodb-destination-receives-face-lift/ FLARE: Filtered Log Alert and Reporting Engine ---------------------------------------------- FLARE staplies together syslog-ng, ELK, Alerting and Incident Response with metadata. The aim was to develop a solution that is able to provide a unified view of log events and incidents, helping the work of operations admins with actionable insight. It is an internal software developed at the University of Victoria by long-time members of the syslog-ng community. You can read the complete presentation about this syslog-ng & PatternDB-based solution at https://www.bc.net/flare-stapling-together-syslog-ng-elk-alerting-and-incid… Writing syslog-ng Java destination drivers ------------------------------------------ If a destination is not supported by syslog-ng out of the box, you can develop a new driver in C or one of the language bindings. Here are the first steps for creating a Java-based destination driver: https://vithulanmv.wordpress.com/2016/06/07/the-syslog-ng-java-destinations/ Your feedback and news, or tips about the next issue are welcome at documentation(a)balabit.com . To read this newsletter online, visit: http://insider.blogs.balabit.com/ Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0