February 2017 - syslog-ng - lists.balabit.hu

Can't get basic syslog to work for my firewall logs?
by Tim Tyler 10 Mar '17

10 Mar '17

Syslog-ng experts. I am very new to syslog-ng. I installed syslog-ng on a fresh Redhat 7.3 server. It defaults working with internal logging. So I configured my firewall to send syslog with facility set to log_user. I turned on Wireshark on the syslog-ng server and observed the firewall sending traffic to the server on udp 514. But the syslog server never created the directory structure and logs. I disabled the redhat firewall just to eliminate it as a possibility. Still no logging. So I don’t know what I am doing wrong at this point. I don’t know if this is a permission problem or some other configuration issue. I found someone that had posted a very basic syslog-ng configuration for firewalls. So I copied It into a firewall.conf I put in conf.d. Can anyone see what might be wrong with it? #################### options { create_dirs(yes); owner(root); group(root); perm(0640); dir_owner(root); dir_group(root); dir_perm(0750); }; ################################################## source s_udp { udp(port(514)); }; #Template for a new firewall in the firewalls.conf file #Entries to be changed: NAMEOFTHEFIREWALL and IPOFTHEFIREWALL ################################################## filter f_NAMEOFTHEFIREWALL { host("192.168.30.1"); }; destination d_NAMEOFTHEFIREWALL { file("/var/log/firewalls/PA/$YEAR/$MONTH/$YEAR-$MONTH-$DAY.PA.log"); }; log { source(s_udp); filter(f_NAMEOFTHEFIREWALL); destination(d_NAMEOFTHEFIREWALL); }; Tim Tyler Network Engineer Beloit College

6 8

"Error checking uniqueness"
by David Hauck 24 Feb '17

24 Feb '17

Hi, I'm in the processing or updating a distribution's v3.6.3 syslog-ng configuration to v3.9.1 and am running into some issues getting syslog-ng started. The first one was: Starting syslog-ng: Error parsing config, Error compiling template (Unknown template function "format-json") in /usr/share/syslog-ng/include/scl/cim/template.conf at line 23, column 32 I found a reference online to fixing this by removing /usr/share/syslog-ng/include/scl/cim and this indeed got me past this error (hopefully this is an otherwise benign modification). I'm now stuck at the following error: Starting syslog-ng: [2017-02-22T08:07:50.101422] Error checking the uniqueness of the persist names, please override it with persist-name option. Shutting down.; persist_name='affile_dd_writers(/var/log/abc/audit_log)', location='/etc/syslog-ng.conf:128:33' Here's snippet from my configuration file that this error message references: ... destination d_abcaudit { file("/var/log/abc/audit_log" template(t_NAFormat)); }; destination d_abcaudit_Prio { file("/var/log/abc/audit_log" template(t_NAFormat_Prio)); }; --> destination d_abcaudit_IPtab { file("/var/log/abc/audit_log" template(t_abcFormat_IPtab)); }; destination d_abcmessage_Prio { file("/dev/null"); }; ... I wasn't able to find any documentation or guidance on the "persist-name" option. Any ideas on how I should go about fixing this error? Thanks, -David

5 11

Parsing failed for ARM cross compile
by Nakarin Kamkheaw 24 Feb '17

24 Feb '17

Hi, I've cross-compiled syslog-ng-3.6.4 for ARM successfully, but syslog-ng is failed to run with a couple errors as shown below. I'm using the default syslog-ng.conf file with only a modification of "scl.conf" to "/etc/scl.conf". # syslog-ng -f /etc/syslog-ng.conf -c /var/run/syslog-ng.ctl syslog-ng: Error changing to directory=/opt/sysroot/var, errcode=2 [2017-02-23T00:50:09.266037] Error opening control socket, bind() failed; socket='/var/run/syslog-ng.ctl', error='Stale NFS file handle (116)' Error parsing source, source plugin system not found in /etc/syslog-ng.conf at line 10, column 2: system(); ^^^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng PS. This is the configuration I use. ./configure --host=arm-linux-gnueabi --prefix=/opt/sysroot/ --exec-prefix=/ --enable-mongodb=no --enable-json=no --enable-stomp=no --enable-amqp=no --enable-spoof-source=no

3 4

Listening on Multiple UDP Source Ports
by hurling69＠yahoo.com 24 Feb '17

24 Feb '17

I'm running version syslog-ng-3.5.6-3.el7.x86_64 I've decided to go with the method of using multiple source ports. source s_syslog-ports { network(transport("udp") ip(10.25.10.52) port(514)); network(transport("tcp") ip(10.25.10.52) port(514) max-connections(100)); network(transport("tcp") ip(10.25.10.52) port(1514) max-connections(100) flags(no-parse));}; However, when I try to add another line with another udp port, it has and issue with the configuration when I try to restart the service: source s_syslog-ports { network(transport("udp") ip(10.25.10.52) port(514)); network(transport("udp") ip(10.25.10.52) port(1514)); network(transport("tcp") ip(10.25.10.52) port(514) max-connections(100)); network(transport("tcp") ip(10.25.10.52) port(1514) max-connections(100) flags(no-parse)); }; Can you not specify multiple udp ports as sources? Thanks.

1 0

Syslog-ng Questions
by Miah Lang 22 Feb '17

22 Feb '17

> Is it possible to configure multiple sources, one with flags(no-parse) and one without? > > e.g. > > source s_syslog-ports { > udp(port(514)); > tcp(port(1514) max-connections(100)); > tcp(port(514) max-connections(100)); > }; > > source s_syslog_np-ports { > udp(port(514) flags(no-parse)); > tcp(port(1514) max-connections(100) flags(no-parse)); > tcp(port(514) max-connections(100) flags(no-parse)); > }; > > filter f_Cisco-router { in-list("/etc/syslog-ng/filter/Cisco-router.txt", value("SOURCEIP")); }; > destination d_Cisco-router {file("/var/log/IT/network/router/cisco/${SOURCEIP}/${SOURCEIP}-${YEAR}${MONTH}${DAY}.log" template(t_message-only));}; > log {source(s_syslog-ports); filter(f_Cisco-router); destination(d_Cisco-router);}; > > filter f_Cisco-switch { in-list("/etc/syslog-ng/filter/Cisco-switch.txt", value("SOURCEIP")); }; > destination d_Cisco-switch {file("/var/log/IT/network/switch/cisco/${SOURCEIP}/${SOURCEIP}-${YEAR}${MONTH}${DAY}.log" template(t_message-only));}; > log {source(s_syslog_np-ports); filter(f_Cisco-switch); destination(d_Cisco-switch);}; > > Whenever I do this, I get an error message when restarting the service. > “Job for syslog-ng.service failed because the control process exited with error code. See "systemctl status syslog-ng.service" and "journalctl -xe" for details.” > “Cannot add dependency job for unit microcode.service, ignoring: Unit is not loaded properly: Invalid argument.” >

4 3

Syslog-no Question
by Miah Lang 22 Feb '17

22 Feb '17

> I’m having trouble determining when you would use the network() source vs the syslog() source? > > We have logs coming in on TCP port 514 from network devices, would it be best to use the network() source for this? Can you setup both the network() and syslog() sources to listen on TCP port 514 or would that cause issues? >

2 1

Have queries related to syslog-ng
by SivaRamaPrasad Ravipati 21 Feb '17

21 Feb '17

Hi, I have some queries. Please clarify me. 1) What are the different filter combinations used by syslog-ng and their unique usecases? 2)What languages are used to write filters? 3)How do we provide security while filtering logs? Thanks, Sivaram.

2 2

Syslog-ng, centos7 and systemd seem to hate each other
by Clayton Dukes 19 Feb '17

19 Feb '17

…or at the very least, say bad things when the other is not looking :) I did a bit of googling for this and found other people with similar issues, but could not find the fix. This is on a cos7.0 box (not 7.2) running syslog-ng v3.9 (user did have v3.5 but I tried upgrading him to resolve this). If I run syslog-ng -Fdve it works fine and sends everything to our python program destination However, if I use the systemd script provided with syslog-ng, then I get nothing. If I tell sng to just log to a file (no filters, etc.), then it works. If I tell sng to just use the program dest (no filters, etc.) it does NOT work. If I do a 'systemctl stop syslog-ng' and then just simply type 'syslog-ng' (no foreground, debug, etc. switches) from the command line, it works fine. Rather confusing, but I can't see why the systemctl file is not working as it should. Any ideas? Other references: https://wiki.archlinux.org/index.php/syslog-ng https://bbs.archlinux.org/viewtopic.php?id=187057 http://serverfault.com/questions/760383/syslog-ng-working-as-foreground-pro… -Clayton

6 9

syslog-ng with sqlite 100% cpu
by work ran 19 Feb '17

19 Feb '17

hi i am running syslog-ng with sqlite i am sending 50 logs per second and i am getting 80% cpu usage. could someone tell me how i can fix this or is it normal thanks Ran syslog-ng 3.2.5 Installer-Version: 3.2.5 Revision: ssh+git://bazsi@git.balabit //var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#9d4bea28198bd731df1a61e980a2af5b88d81116 Compile-Date: Jul 25 2014 15:20:50 Enable-Threads: on Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-SSL: off Enable-SQL: on Enable-Linux-Caps: off Enable-Pcre: on Enable-Pacct: off

4 5

Re: [syslog-ng] can syslog-ng process email attachments?
by james.r.hendrick 12 Feb '17

12 Feb '17

Thanks, I'll take a look Jim Sent from my Verizon, Samsung Galaxy smartphone -------- Original message --------From: "Fekete, Róbert" <robert.fekete(a)balabit.com> Date: 2/11/17 10:41 AM (GMT-05:00) To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] can syslog-ng process email attachments? Hi, Fabien created an mbox source a while back, maybe you can use it: https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-… Regards, Robert On Fri, Feb 10, 2017 at 9:03 PM, Jim Hendrick <james.r.hendrick(a)gmail.com> wrote: We have security appliances that generate CSV files and automatically send them (nightly) I am looking for a way to get them into a log stream and trying to make it as simple as possible. I suppose I could do something with procmail or even openssl and an IMAP connection, but I wanted to ask this esteemed company if any of you have solved this already. even something radical like "source s_mail ( smtp() );" and have config options to tweak what it does with different recipients / mail formats Any (appropriate) suggestions? Thanks!Jim ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0