June 2017 - syslog-ng - lists.balabit.hu

testing new features, poll
by Czanik, Péter 13 Jun '17

13 Jun '17

Hi, syslog-ng 3.10 is coming soon. If you would like to test it and use one of the RPM-based distributions, there are some ready to use packages to get you started: https://www.balabit.com/blog/rpm-packages-from-syslog-ng-git-head/ I'd also appreciate if you could answer my quick poll on twitter which is your most waited feature in the upcoming syslog-ng version: https://twitter.com/PCzanik/status/874527761532104704 Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0

pdbtool Segmentation fault
by Evan Rempel 10 Jun '17

10 Jun '17

I am running a relatively recent githead (April 17) of 3.9.1. I have a single pattern that results in a segmentation fault when running pdbtool test --validate patterndb.xml patterndb can be found at http://web.uvic.ca/~erempel/syslog-ng/patterndb.xml As it stands now I realize that the pattern does NOT match the test, but it should not segfault. A single space removed from the pattern makes the test succeed. The working patterndb is at http://web.uvic.ca/~erempel/syslog-ng/patterndb2.xml Any help would be appreciated.

1 0

Multiple dates
by Sandbox 09 Jun '17

09 Jun '17

Hi, I just started to test, learn etc syslog-ng, my server configuration is really basic: Q: Can i filter (and mark them on client) the incoming logs, so i dont have to open multiple ports for different logs? #-----------------------------------Source--------------------------------- source s_network_testweb01_access { tcp(ip(192.168.56.48) port("16601")); }; source s_network_testweb01_error { tcp(ip(192.168.56.48) port("16602")); }; source s_network_testweb01_referer { tcp(ip(192.168.56.48) port("16603")); }; #------------------------------------Destination-------------------------- destination d_apache_access_testweb01 { file("/var/log/syslog-ng/apache2/$FULLHOST.access" owner("root") group("adm") perm(0640) create_dirs(yes) dir_owner("root") dir_group("adm") persist-name("testweb_access")); .... file("/var/log/archive/$R_YEAR/apache/$R_MONTH/$FULLHOST.access.$R_DAY" owner("root") group("adm") perm(0640) create_dirs(yes) dir_owner("root") dir_group("adm") persist-name("testweb_access_archive")); }; destination d_apache_error_testweb01 { file("/var/log/syslog-ng/apache2/$FULLHOST.error" owner("root") group("adm") perm(0640) create_dirs(yes) dir_owner("root") dir_group("adm") persist-name("testweb_error")); .... file("/var/log/archive/$R_YEAR/apache/$R_MONTH/$FULLHOST.error.$R_DAY" owner("root") group("adm") perm(0640) create_dirs(yes) dir_owner("root") dir_group("adm") persist-name("testweb_error_archive")); }; destination d_apache_referer_testweb01 { file("/var/log/syslog-ng/apache2/$FULLHOST.referer" owner("root") group("adm") perm(0640) create_dirs(yes) dir_owner("root") dir_group("adm") persist-name("testweb_referer")); .... file("/var/log/archive/$R_YEAR/apache/$R_MONTH/$FULLHOST.referer.$R_DAY" owner("root") group("adm") perm(0640) create_dirs(yes) dir_owner("root") dir_group("adm") persist-name("testweb_referer_archive")); }; #---------------------Connections-------------------------- log { source(s_network_testweb01_access); destination(d_apache_access_testweb01); }; log { source(s_network_testweb01_error); destination(d_apache_error_testweb01); }; log { source(s_network_testweb01_referer); destination(d_apache_referer_testweb01); }; The stored log: Q: Why does it store the date 3 times in every logs? Jun 8 08:20:11 192.168.7.30 133 <13>1 2017-06-08T08:20:11+02:00 testweb01 - - - [meta sequenceId="24"] :1 - - [08/Jun/2017:08:20:10 +0200] "GET / HTTP/1.1" 200 3004 Also my client configuration: #Log sources source s_apache_error { file("/var/log/apache2/error_testweb_log" follow-freq(1)); }; source s_apache_access { file("/var/log/apache2/access_testweb_log" follow-freq(1)); }; source s_apache_referer { file("/var/log/apache2/www_referer_log" follow-freq(1)); }; #LOG Destination destination d_network_access { syslog("192.168.56.48" transport("tcp") ip-protocol(4) port("16601") persist-name("testweb_access")); }; destination d_network_error { syslog("192.168.56.48" transport("tcp") ip-protocol(4) port("16602") persist-name("testweb_error")); }; destination d_network_referer { syslog("192.168.56.48" transport("tcp") ip-protocol(4) port("16603") persist-name("testweb_referer")); }; #LOG connections log { source(s_apache_access); destination(d_network_access); }; log { source(s_apache_error); destination(d_network_error); }; log { source(s_apache_referer); destination(d_network_referer); }; Thanks, Robert

2 4

very basic router
by Thufir Hawat 09 Jun '17

09 Jun '17

for this router: http://www.netgear.com/support/product/WNR1000v2 I don't see any option in the configuration for using syslog. Is there a work-around? The only way to grab logs is to either copy/paste or e-mail -- but the e-mail uses port 25, which is blocked. thanks, Thufir

2 4

admin guide in PDF
by Thufir Hawat 09 Jun '17

09 Jun '17

I can't seem to find the admin guide as a PDF. It's just html? thanks, Thufir

2 2

Re: [syslog-ng] Filter Not Working (too many or's?)
by james.r.hendrick 09 Jun '17

09 Jun '17

Not exactly what you asked but I have used netmask to simplify some filters. Although it probably won't be able to solve your problem. Sent from my Verizon, Samsung Galaxy smartphone -------- Original message --------From: "Szalai, Attila" <Attila.Szalai(a)morganstanley.com> Date: 6/6/17 8:07 AM (GMT-05:00) To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] Filter Not Working (too many or's?) Hi, First of all, the content of the host() is a regular expression, so adding .* to the beginning and/or to the end of the expression adds nothing, just pain/slowness. Second, it would help a lot if we can see the actual error message. I found no obvious mistake, but because this is not the original line, maybe something lost in the translation. From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of wiskbroom(a)hotmail.com Sent: Tuesday, June 06, 2017 12:59 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Filter Not Working (too many or's?) Here is an example of what I am trying to do, these hostnames are not real; the real ones have no common pattern. filter f_xyz { host("*.abca.*") or host(".*abcb.*") or host(".*abcc.*") or host(".*abcd.*") or host(".*abce.*") or host(".*abcf.*") or host(".*abcg.*") or host(".*abch.*"); }; The filter above is for any host containing a hostname with what is contained within the .* and *.; i.e. hostabca01 will be matched by host("*.abca.*") When I have this filter in my config, syslog fails to restart. Eyes hurt, obvious mistake? NOTICE: Morgan Stanley is not acting as a municipal advisor and the opinions or views contained herein are not intended to be, and do not constitute, advice within the meaning of Section 975 of the Dodd-Frank Wall Street Reform and Consumer Protection Act. If you have received this communication in error, please destroy all electronic and paper copies and notify the sender immediately. Mistransmission is not intended to waive confidentiality or privilege. Morgan Stanley reserves the right, to the extent permitted under applicable law, to monitor electronic communications. This message is subject to terms available at the following link: http://www.morganstanley.com/disclaimers If you cannot access these links, please notify us by reply message and we will send the contents to you. By communicating with Morgan Stanley you consent to the foregoing and to the voice recording of conversations with personnel of Morgan Stanley.

5 4

Duplicate header ?
by Scot 08 Jun '17

08 Jun '17

I seem to be getting a duplicate host header in my udp syslog input where the IP is printed twice. IP/IP any ideas where it comes from ? Same result for either of these. #source s_net_udp {udp(ip(0.0.0.0) port(514) keep_hostname(yes) so_rcvbuf(262142));}; #source s_net_udp {syslog(ip(10.189.252.62) port(514) transport("udp") flags(no-hostname) so_rcvbuf(262142));}; Jun 8 13:55:21 *192.168.10.10/192.168.10.10 <http://192.168.10.10/192.168.10.10> * fw-aplha %ASA-4-106 ..............

3 3

Filter Not Working (too many or's?)
by wiskbroom＠hotmail.com 06 Jun '17

06 Jun '17

Here is an example of what I am trying to do, these hostnames are not real; the real ones have no common pattern. filter f_xyz { host("*.abca.*") or host(".*abcb.*") or host(".*abcc.*") or host(".*abcd.*") or host(".*abce.*") or host(".*abcf.*") or host(".*abcg.*") or host(".*abch.*"); }; The filter above is for any host containing a hostname with what is contained within the .* and *.; i.e. hostabca01 will be matched by host("*.abca.*") When I have this filter in my config, syslog fails to restart. Eyes hurt, obvious mistake?

3 3

RPM packages from syslog-ng git head
by Czanik, Péter 06 Jun '17

06 Jun '17

Hi, Test the latest syslog-ng features and bug fixes! They are available for RPM platforms for easy installation. I build packages from git head snapshots regularly for the following Linux distribution versions: openSUSE SLES 12 Fedora RHEL/CentOS 7 You can read how to get started with these packages at: https://www.balabit.com/blog/rpm-packages-from-syslog-ng-git-head/ Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0

Do stats cause memory leak
by Evan Rempel 06 Jun '17

06 Jun '17

We are running git head download post 3.9.1 and the memory footprint seems to continually grow. Looking at the statistics for queued messages I found none, but discovered that we have nearly 22,000 statistic sets for a total of 68195 tracked statistics. % /usr/local/sbin/syslog-ng-ctl stats | wc -l 68195 It it possible that all of these statistics take up a non-trivial amount of RAM? USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1489 79.2 61.5 12134140 10139760 ? Ssl Apr24 41581:22 /usr/local/sbin/syslog-ng That is a 12GB footprint after 1 month of uptime. Evan.

4 8