May 2017 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] Syslog-ng input for beats ?
by Scot 17 May '17

17 May '17

I tried reading the mapping documentation in the Balabit Latest docs but I'm not connecting these dots, sorry. Can I use the templates for creating the ES index as a reference for json mapping in syslog-ng ? For example the attached winlogbeat.template.json which created the ES index.

2 3

Running into Error: Could not find Java SE Runtime Environment
by vijay amruth 17 May '17

17 May '17

Hello Peter/team/everyone, Post configure syslog-ng 3.9.1 on redhat 7.3, I am running to this error when running make, please look into this, any help is appreciated. GEN modules/java/syslog-ng-core/classes/org/syslog_ng/LogMessage.class Error: could not find libjava.so Error: Could not find Java SE Runtime Environment. make: *** [modules/java/syslog-ng-core/classes/org/syslog_ng/LogMessage.class] Error 2 Tried fixing path, didn't help...... [root@sml-collector02 syslog-ng-3.9.1]# export JRE_HOME=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.102-4.b14.el7.x86_64/jre [root@sml-collector02 syslog-ng-3.9.1]# export PATH=$PATH:$JRE_HOME/bin [root@sml-collector02 syslog-ng-3.9.1]# export JAVA_HOME=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.102-4.b14.el7.x86_64 [root@sml-collector02 syslog-ng-3.9.1]# export JAVA_PATH=$JAVA_HOME [root@sml-collector02 syslog-ng-3.9.1]# export PATH=$PATH:$JAVA_HOME/bin Please look into it. Thank you. -- Thanks, Vijay Amrut.

1 0

in-list filter for substrings
by Clayton Dukes 16 May '17

16 May '17

Question: Is there are way to read in a file to match for substrings? Example: filter f_malware { in-list("/etc/syslog-ng/conf.d/malware.list", value("MSG")); }; rewrite rw_malware { set("Malware", value("PROGRAM") condition(filter(f_malware))); }; Then, given a string like: Dec 15 17:57:02 230.16.190.121 %ASA-5-304001: 67.16.126.205 Accessed URL 114.4.201.244:http://wvqwdhimen.jaqwejggvwxyangoqepw.tk/storageframe.html It would look at malware.list and see a line containing: wvqwdhimen.jaqwejggvwxyangoqepw.tk and set the Program name as "Malware" I see in the docs, it says ' Only exact matches are supported, partial and substring matches are not' so I don't think this will work. Is there a way to do anything like this? - Clayton

1 0

How to get list of IPs
by Sathish Sundaravel 13 May '17

13 May '17

Hi All I have syslog Ng server running on Solaris platform and configured to receive or accept events from all unix servers in one single log file. If I want to collect list of servers reporting to the log server , I have to manually extract list from a single log file which is too much time consuming . What would the best way ? Regards Sathish

5 6

PLEASE REMOVE MY EMAIL FROM THIS LIST...
by Alex Norton 13 May '17

13 May '17

THANKS ALEX

2 1

Re: [syslog-ng] How to get list of IPs
by james.r.hendrick 12 May '17

12 May '17

If you don't need all logs in a single file you could use $HOST or $HOST_FROM as part of the file name Sent from my Verizon, Samsung Galaxy smartphone -------- Original message --------From: Sathish Sundaravel <sathish.sundaravel(a)gmail.com> Date: 5/12/17 1:11 PM (GMT-05:00) To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] How to get list of IPs Hi All I have syslog Ng server running on Solaris platform and configured to receive or accept events from all unix servers in one single log file. If I want to collect list of servers reporting to the log server , I have to manually extract list from a single log file which is too much time consuming . What would the best way ? RegardsSathish

1 0

Syslog-ng input for beats ?
by Scot 12 May '17

12 May '17

Hi Has anyone tried using syslog-ng inputs for logstash or beats data ? I'm trying to find a solution that will let me mirror my beats data like syslog-ng lets me do with syslog traffic. my syslog data goes to file, es and splunk. Need the same split for winlogbeat Winlogbeat goes to logstash then ES. Thanks for reading.

4 21

Unable to track root activity in syslog-ng
by vijay amruth 11 May '17

11 May '17

Hello everyone, here is is my configuration file, I am unable to track root activity, I am able to track user activity like the commands ran etc. For example: If I run a command as sudo, I see it in the log however the same command when switched to root is not being tracked. Any help is appreciated. Thank you. @version:3.9 @include "scl.conf" options { threaded(yes); }; source s_sys { unix-stream("/dev/log"); system(); internal(); }; # Destinations ############## destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" flush_lines(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_kern { file("/var/log/kern" ); }; destination d_mlal { usertty("*"); }; # Filters ########## filter f_kernel { facility(kern); }; filter f_default { level(info..emerg) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_auth { facility(authpriv); }; filter f_mail { facility(mail); }; filter f_emergency { level(emerg); }; filter f_news { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_boot { facility(local7); }; filter f_cron { facility(cron); }; # Log Bindings ############## #log { source(s_sys); filter(f_kernel); destination(d_cons); }; log { source(s_sys); filter(f_kernel); destination(d_kern); }; log { source(s_sys); filter(f_default); destination(d_mesg); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_mail); destination(d_mail); }; log { source(s_sys); filter(f_emergency); destination(d_mlal); }; log { source(s_sys); filter(f_news); destination(d_spol); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; log { source(s_sys); filter(f_cron); destination(d_cron); }; -- Thanks, Vijay.

4 4

Documentation error
by Evan Rempel 11 May '17

11 May '17

The documentation defines the macro WEEK_ABBREV, C_WEEK_ABBREV, R_WEEK_ABBREV, S_WEEK_ABBREV Description: The 3-letter English abbreviation of the name of the day the message was sent, for example Thu. but syslog-ng (3.9) actually populates the macros WEEK_DAY_ABBREV, C_WEEK_DAY_ABBREV, R_WEEK_DAY_ABBREV, S_WEEK_DAY_ABBREV -- Evan

2 1

unidirectional unix-stream
by Fabien Wernli 11 May '17

11 May '17

Hi, I'm trying to use the unix-stream destination to send data to another application which opens the socket in line mode. The problem is that both ends complain about the connection breaking all the time: syslog-ng[31002]: Syslog connection broken; fd='24', server='AF_UNIX(/var/run/otherapp.sock)', time_reopen='60' otherapp[123445]: failed to read from socket #10: Connection reset by peer I tracked down the problem to the fact that otherapp sends some data after receiving a line from syslog-ng: "data ok", and syslog-ng doesn't seem to like that. If I set up a unidirectional proxy (that filters out upstream "data ok") between syslog-ng and otherapp everything works fine: socat -u UNIX-LISTEN:/tmp/proxy.sock,fork UNIX-CONNECT:/var/run/otherapp.sock Am I doing something wrong here, or is this a known limitation of syslog-ng?

3 9