January 2017 - syslog-ng - lists.balabit.hu

udp tuning - where to look.
by Jim Hendrick 11 Jan '17

11 Jan '17

Hi, I am working an issue with UDP drops in a high EPS rate environment (several thousand steady) and struggling with making any changes in the loss rate. (according to netstat -su | grep error). This is happening on two nodes, (one running an older syslog-ng 3.2 OSE, the other running a splunk forwarder) but I don't actually think it is making it out of the kernel to either application. On the syslog-ng side syslog-ng-ctl stats shows *no* drops at all. Increasing net.core.rmem_max and so_rcvbuf together all the way to 64 MB did not seem to make any significant difference. This is a RHEL 6 box with 16 GB and 4 cores (virtual - running in an ESX environment) Are there other parameters, things I should be looking at? Thanks, Jim

4 4

CentOS 7.2 // Syslog-ng (syslog-ng_3.6.4)
by vijay amruth 10 Jan '17

10 Jan '17

Hello guys, Happy new year!! Hope you are doing great. I've installed (compiled ) syslog-ng on CentOS Linux 7 (Core) but after I got through the install which is all good, I cant get it to start, all it says is : systemctl status syslog-ng ● syslog-ng.service Loaded: not-found (Reason: No such file or directory) Active: inactive (dead) [vch@slc ~]$ sudo systemctl enable syslog-ng Failed to execute operation: No such file or directory [vch@slc ~]$ sudo systemctl start syslog-ng Failed to start syslog-ng.service: Unit syslog-ng.service failed to load: No such file or directory. Rsyslog is not running, I can't think of any, I am I missing some simple ?????? Any help is appreciated. -- Thanks, Vijay Amrut.

5 6

Enable TLS encryption
by Sathish Sundaravel 09 Jan '17

09 Jan '17

Hi Team I have a Syslog Ng server running on Solaris and receiving events from native Solaris syslog clients. How do I enable UDP traffic pass through via TLS and how to configure client certificate for native Solaris syslog agent. We don't have rsyslog.

6 10

Adding specific information from Syslog-ng to Redis
by johnsc301＠gmail.com 07 Jan '17

07 Jan '17

I am trying to send information from Syslog-ng to Redis. In /etc/syslog-ng/syslog-ng.conf I added this: destination d_redis { redis( host("127.0.0.1") port(6379) command("RPUSH", "sensor_name", "${sensor_name}")); }; I am trying to create a list of variables, hopefully one being timestamp. Here is an example of my syslog that I am trying to pull: http://pastebin.com/Hx5vW4VA Here's is syslog-ng.conf, for reference: http://pastebin.com/2VQFBNmK Those are logs being sent from Snort to Syslog-ng through Snort. I want to connect to Redis. I saw that the command parameters are: comma-separated list of strings ("<redis-command>", "<first-command-parameter>", "<second-command-parameter>", "<third-command-parameter>") from: https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-… I'm assuming I'd say RPUSH <something>... However, I am unsure of how to find the correct parameters. Specifically, for now, I want to create a list (RPUSH) of timestamps, IP addresses (to and from), and event type (ICMP, for example). I did find this list of parameters: https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-… A good first try, I'd like to make a list of timestamps. How can I set the d_redis(command()) within syslog-ng.conf to do this? Sent from Mail for Windows 10

4 3

v3.9: Core dump on python module
by Clayton Dukes 04 Jan '17

04 Jan '17

Hey guys, just want you to know Ubuntu16 is dumping core on loading the python module. Ubuntu14 does not do this. [2017-01-01T19:54:52.576749] Module loaded and initialized successfully; module='mod-python' Segmentation fault (core dumped) -Clayton Dukes

4 16

Re: [syslog-ng] Host variable substitution in syslog-ng.conf include statement
by Broome, John P - OASAM OCIO CTR 03 Jan '17

03 Jan '17

Robert, Thanks for your reply, but we are constrained to version 3.2 for now (has to be in the RHEL EPEL). I did not see this feature discussed in the 3.2 admin guide. Is it an undocumented feature of version 3.2, or did support for system environment variables come in a later version? Thank you, JB

2 1

Host variable substitution in syslog-ng.conf include statement
by Broome, John P - OASAM OCIO CTR 03 Jan '17

03 Jan '17

I am supporting a large number of syslog-ng hosts and we manage the configuration files with gitlab. I have been trying to figure out how to reference a variable based on hostname in the syslog-ng.conf file on each machine. For example, I would like to be able to have an include statement based on hostname - this would allow our common repository to have an exception set of filters/rules for each host but to use the exact same syslog-ng.conf file everywhere: ################################## syslog-ng.conf ########################################### @version: 3.2 Include "`hostname`.conf" ... Is there a way to accomplish this in version 3.2 (if not, does it appear in a later version)? We are restricted to EPEL6 included versions of syslog-ng, so that's why we're at version 3.2 - JB

2 1