November 2019 - syslog-ng - lists.balabit.hu

Support for netflow logs
by Raghunath Adhyapak 04 Dec '19

04 Dec '19

Hi, I was trying to receive Netflow logs from firewall devices in syslog-ng and then forward to a central server. Does syslog-ng support netflow such that I can validate and filter out all non-netflow log lines? I also dumped some netflow logs to a file and found it to be binary. Therefore I haven't been able to ascertain the format and filtering mechanism. Any pointers on this topic would be helpful. Thanks Raghu

4 7

Structure data set to "-"
by Debjyoti Mukherjee 03 Dec '19

03 Dec '19

Hello Trying to send logs to remote syslog server in RFC 5424 format. The STRUCTURE_DATA should be set to "-". What is the way to the this value to "-" Currently it is coming as [meta sequenceId="21"]. I am using Openwrt and the syslog version is 3.24 Thank you

2 5

SYSLOGHOST is being replaced with IP
by Raghunath Adhyapak 29 Nov '19

29 Nov '19

Hi, I'm observing that syslog-ng is modifying the SYSLOGHOST in the incoming log line and outputting an IP instead. I would like to retain the incoming hostname in incoming syslog and forward the same information. Here is my incoming log line: <13>Nov 29 04:07:40 BVRM-DC04 AgentDevice=WindowsLog\tAgentLogFile=Security\tPluginVersion=7.2.8.91\tSource=Microsoft-Windows-Security-Auditing\tComputer= BVRM-DC04.xxxxxxxx.com\tOriginatingComputer=172.26.1.60\tUser=\tDomain=\tEventID=4634\tEventIDCode=4634\tEventType=8\tEventCategory=12545\tRecordNumber=166757582\tTimeGenerated=1575029259\tTimeWritten=1575029259\tLevel=Log Always\tKeywords=Audit Success\tTask=SE_ADT_LOGON_LOGOFF\tOpcode=Info\tMessage=An account was logged off. Outgoing log line: <13>Nov 29 04:07:40 172.22.2.55 AgentDevice=WindowsLog\tAgentLogFile=Security\tPluginVersion=7.2.8.91\tSource=Microsoft-Windows-Security-Auditing\tComputer= BVRM-DC04.xxxxxxxx.com\tOriginatingComputer=172.26.1.60\tUser=\tDomain=\tEventID=4634\tEventIDCode=4634\tEventType=8\tEventCategory=12545\tRecordNumber=166757582\tTimeGenerated=1575029259\tTimeWritten=1575029259\tLevel=Log Always\tKeywords=Audit Success\tTask=SE_ADT_LOGON_LOGOFF\tOpcode=Info\tMessage=An account was logged off. FYI, this is log from Windows, but same is happening for syslog from other firewalls as well. My syslog-ng.conf: @version: 3.24 @include "scl.conf" ######################## # Sources ######################## source s_test_net { syslog(transport(udp) port(2514) ); }; ######################## # Destinations ######################## destination d_test { file("/tmp/test.log"); }; ######################## # Log paths ######################## log { source(s_test_net); destination(d_test); }; Thanks Raghu

2 2

syslog-ng packages for RHEL 8 / CentOS 8
by Peter Czanik (pczanik) 27 Nov '19

27 Nov '19

Hi, Today I reached a new milestone with syslog-ng packaging for RHEL 8 / CentOS 8, so here is a quick update: * syslog-ng 3.23 is available in EPEL 8 ( https://fedoraproject.org/wiki/EPEL ). It is missing the C-based Kafka driver (librdkafka in RHEL is too old) and the Java-based destination drivers (Kafka, Elastic, HDFS) due to missing dependencies in RHEL/EPEL. * highly experimental syslog-ng package missing most of the features needing extra dependencies. Core features, Elasticsearch (HTTP) destination are available in the package. You need to first enable the EPEL 8 repository and then add: https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng324el8/ * Today I successfully added RHEL 8 support to my git snapshot repository: https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng-githead/ Some dependencies, like recent version of Kafka are available from this repository, the rest from EPEL. As far as I am aware, all OSE features are now supported, except for tcp-wrapper, which was removed from Fedora & RHEL 8. This repository is regularly updated from git. * Once syslog-ng 3.25 is available, the upcoming syslog-ng325 repo will already support RHEL 8 / CentOS 8 and soon after my syslog-ng-stable repo will also receive RHEL 8 support. As usual, any feedback is very welcome and will be handled with best effort. I'd especially welcome feedback on my syslog-ng-githead repo -- even if that's not intended for production environments -- as that's where I prepare for the next syslog-ng release. Bye, Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syntax error when using syslog-ng.conf from debian packaging
by Alexandre Santos 21 Nov '19

21 Nov '19

Hi, I am running into the following error when running the syslog-ng with the syslog-ng.conf from debian packaging: *Error parsing affile, syntax error, unexpected ')', expecting LL_IDENTIFIER or LL_STRING in /usr/local/etc/syslog-ng.conf:68:34-68:35:63 #64 destination d_console { usertty("root"); };6566 # Virtual console.67 #68----> destination d_console_all { file(`tty10`); };68----> ^* Do you have any idea about this? Thanks in advance, Alex

3 4

Re: [syslog-ng] Abort message processing - multiple includes
by Matthias Gruber 19 Nov '19

19 Nov '19

Hi! Good Lord, I think I just found the answer to my question in the Documentation :-/ :-) "This default behavior can be changed using the flags() parameter. Flags apply to individual log paths, they are not global options. " Therefore I think the final breaks out of the log-processing of the actual log-directive, but others "matching" will processed Argh... think I have to cat some of my config-files together... Sorry for "spamming" :-) cheers Matthias P.S. If I am wrong, please correct me (hope dies last ;->) ------------------------------------------------------------------------------------ METZLER Informationstechnologie Matthias Gruber IT-Infrastruktur & -Betrieb B. Metzler seel. Sohn & Co. Kommanditgesellschaft auf Aktien Untermainanlage 1 60329 Frankfurt am Main Telefon (0 69) 21 04 - 43 30 Telefax (0 69) 21 04 - 40 40 MGruber(a)metzler.com www.metzler.com Von: Matthias Gruber/METZLER An: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Datum: 19.11.2019 08:54 Betreff: Abort message processing - multiple includes Hi! Perhaps I misunderstood it, or got a bit crossed up, because I dig into syslog-ng-Configs since weeks, but I am unsure about the "flags(final)" statement I have several includes with several log-statements and several sources e.g. (no runnable syntax, only for demonstration-purpose) 0001-A.conf log { source(s_tcp_A); filter(f_filter_A); destination(d_somewhere_A); flags(final); }; 0002-B.conf log { source(s_tcp_A); destination(d_somewhere_BBB); flags(final); }; As I understand it, first of all, its included in "alphabetical order", so in my case first 0001-A.conf, then 0002-B.conf and so on.... But now my "Problem" and question (Yes I would normally do a "if"-Construct to solve that, problem above, but I used that example to understand the flags(final),) If I have a message received by s_tcp_A, filter f_filter_A hits, the rule sends it to d_somewhere_A and do a "Escape" cause of flags(final), does the message still got processes by the include of 0002-B.conf?? Does the flags(final) is only relevant for one "log-rule", or does it ends the whole processing? To be honest, I habe several includes, and a "last" one, which is imported last, with a "hit"-all, in my childish thought, if the flags(final) stopps processing of the message compleetly this hit-all only gets "the junk" where nothing else hists. Why do I do that, and not write it in one file with a large if-elif-else-construct, I do that for the readability since this file would be extremly large. I am thankfull for any help cheers Matthias ------------------------------------------------------------------------------------ METZLER Informationstechnologie Matthias Gruber IT-Infrastruktur & -Betrieb B. Metzler seel. Sohn & Co. Kommanditgesellschaft auf Aktien Untermainanlage 1 60329 Frankfurt am Main Telefon (0 69) 21 04 - 43 30 Telefax (0 69) 21 04 - 40 40 MGruber(a)metzler.com www.metzler.com Persönlich haftende Gesellschafter: Harald Illy, Michael Klaus, Friedrich von Metzler, Emmerich Müller, Gerhard Wiesheu Vorsitzender des Aufsichtsrats: Dr. Christoph Schücking Sitz der Gesellschaft: Frankfurt am Main, Handelsregister-Nr. HRB 27 515 Diese Nachricht ist vertraulich. Sollten Sie nicht der vorgesehene Empfänger sein, so bitten wir Sie höflich, dies unverzüglich dem Absender mitzuteilen und die Nachricht zu löschen. Es ist unzulässig, die Nachricht unbefugt weiterzuleiten oder zu kopieren. Da wir nicht die Echtheit oder Vollständigkeit der in dieser Nachricht enthaltenen Informationen garantieren oder zusichern können, sind die vorstehenden Ausführungen rechtlich nicht bindend. Eine Haftung hierfür wird ausgeschlossen. This message is confidential. If you are not the intended recipient, we kindly ask you to inform the sender and delete the information. Any unauthorised dissemination or copying hereof is prohibited. As we cannot guarantee or assure the genuineness or completeness of the information contained in this message, the statements set forth above are not legally binding. Accordingly we cannot accept any liability for their contents.

1 0

Abort message processing - multiple includes
by Matthias Gruber 19 Nov '19

19 Nov '19

Hi! Perhaps I misunderstood it, or got a bit crossed up, because I dig into syslog-ng-Configs since weeks, but I am unsure about the "flags(final)" statement I have several includes with several log-statements and several sources e.g. (no runnable syntax, only for demonstration-purpose) 0001-A.conf log { source(s_tcp_A); filter(f_filter_A); destination(d_somewhere_A); flags(final); }; 0002-B.conf log { source(s_tcp_A); destination(d_somewhere_BBB); flags(final); }; As I understand it, first of all, its included in "alphabetical order", so in my case first 0001-A.conf, then 0002-B.conf and so on.... But now my "Problem" and question (Yes I would normally do a "if"-Construct to solve that, problem above, but I used that example to understand the flags(final),) If I have a message received by s_tcp_A, filter f_filter_A hits, the rule sends it to d_somewhere_A and do a "Escape" cause of flags(final), does the message still got processes by the include of 0002-B.conf?? Does the flags(final) is only relevant for one "log-rule", or does it ends the whole processing? To be honest, I habe several includes, and a "last" one, which is imported last, with a "hit"-all, in my childish thought, if the flags(final) stopps processing of the message compleetly this hit-all only gets "the junk" where nothing else hists. Why do I do that, and not write it in one file with a large if-elif-else-construct, I do that for the readability since this file would be extremly large. I am thankfull for any help cheers Matthias ------------------------------------------------------------------------------------ METZLER Informationstechnologie Matthias Gruber IT-Infrastruktur & -Betrieb B. Metzler seel. Sohn & Co. Kommanditgesellschaft auf Aktien Untermainanlage 1 60329 Frankfurt am Main Telefon (0 69) 21 04 - 43 30 Telefax (0 69) 21 04 - 40 40 MGruber(a)metzler.com www.metzler.com Persönlich haftende Gesellschafter: Harald Illy, Michael Klaus, Friedrich von Metzler, Emmerich Müller, Gerhard Wiesheu Vorsitzender des Aufsichtsrats: Dr. Christoph Schücking Sitz der Gesellschaft: Frankfurt am Main, Handelsregister-Nr. HRB 27 515 Diese Nachricht ist vertraulich. Sollten Sie nicht der vorgesehene Empfänger sein, so bitten wir Sie höflich, dies unverzüglich dem Absender mitzuteilen und die Nachricht zu löschen. Es ist unzulässig, die Nachricht unbefugt weiterzuleiten oder zu kopieren. Da wir nicht die Echtheit oder Vollständigkeit der in dieser Nachricht enthaltenen Informationen garantieren oder zusichern können, sind die vorstehenden Ausführungen rechtlich nicht bindend. Eine Haftung hierfür wird ausgeschlossen. This message is confidential. If you are not the intended recipient, we kindly ask you to inform the sender and delete the information. Any unauthorised dissemination or copying hereof is prohibited. As we cannot guarantee or assure the genuineness or completeness of the information contained in this message, the statements set forth above are not legally binding. Accordingly we cannot accept any liability for their contents.

1 0

log server duplication
by freebsd＠tango.lu 15 Nov '19

15 Nov '19

Hello, I have a syslogNG based siem setup with customized rules like: options { use_dns(no); use_fqdn(no); check_hostname(no); owner(root); group(root); perm(0640); dir_owner(root); dir_group(root); dir_perm(0750); create_dirs(yes); normalize_hostnames(yes); keep_hostname(yes); # disable stats stats_freq(0); }; destination d_net_auth { file("/var/log/corporate/$HOST_FROM/auth.log"); }; ... These settings will not do dns resolution will result that when hosts sending their logs into this SIEM directories will be created by their IP addresses where the logs go. I would like to replicate this server on a second location without using brute methods like rsyncing the whole directory structure daily. I have configured syslogng to keep forwarding the logs to a remote destination which works fine however I can't select the messages based on the same criteria on the new log server because if I use the same config everything will originate from the IP for logserver 1. I need IP based directories on the second loghost as well, everything to be identical. I'm using syslogng 3.12. Is there a workaround for this? Thanks

3 4

Re: [syslog-ng] periodic disconnect of TCP sessions
by Wilson, Jonathan 15 Nov '19

15 Nov '19

Laci, thank you for your thoughts and questions. Some answers: My organization controls all the clients, but there are a _lot_ of them. Most are network devices or applications. Yes, the reason for multiple instances is HA. We have one in each of our data centers. A hardware load balancer provides the DNS entry and resolution (a "wide IP"), and it IS aware of the states of the servers - it checks both every few seconds to ensure that it can establish a TCP connection. If it cannot, the DNS name will not be switched to that server's IP. System load is not high. Both are VMs with multiple (virtual) CPUs, and syslog-ng rarely uses more than 10% of CPU. We get about 10k UDP messages per minute and about 1000 over TCP. None of the usual stress indicators - no UDP Rcvbuf errors, no bottlenecks that I can see. When initially set up, having two copies of every syslog was not a problem - it's just disk space. But when we starting indexing them in Splunk, it became a concern since Splunk is licensed by the volume of data indexed. Concurrent connections - less than 20 TCP connections at a time. I suppose what I'm looking for is a more granular load balancing, if that makes sense. With UDP, it's very granular, since each packet is sent statelessly to wherever the "wide IP" points at that second. But with TCP, long-lived connections are the rule - great for throughput, but they kind of defeat the purpose. If syslog-ng kept a count of messages received over each TCP connection and did an orderly shutdown after "n" had been received, the client would reconnect seamlessly and all would be well. Alternatively, shut down a TCP connection after it had been open for "n" seconds. Thanks, Jon Message: 1 Date: Fri, 15 Nov 2019 10:16:18 +0000 From: "Laszlo Szemere (lszemere)" <Laszlo.Szemere(a)oneidentity.com> To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] periodic disconnect of TCP sessions Message-ID: <BL0PR1901MB20170F90FB51A130781F3F429D700(a)BL0PR1901MB2017.namprd19.prod.outlook.com> Content-Type: text/plain; charset="Windows-1252" Hello Jon, There is currently no way to deliberately terminate an active TCP session. What I was thinking about, that there might be a better approach to the original problem, and terminating the TCP session is just a fragile workaround. I have a couple of questions about your setup, so I can get a better understanding of the problem: - Is all of the clients controlled by you? (Maybe they are syslog-ng instances in the first place?) - Is there a particular reason to have multiple syslog-ng instances? At a first glance (with the parallel sending) it looked like a HA(ish) setup, but the later round-robin solution ruled it out. Also it looks like the DNS server is not aware of the states of the servers. - What is the current load on the system? Have you experienced any throttling or bottle neck. (Why do I ask? If the reason behind using multiple syslog-ng instances, is to load balance the traffic for the Splunk servers, than it can be achieved in a different way. - How many concurrent connections do you expect at the peak load? Best regards, Laci ________________________________________ From: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of Wilson, Jonathan <jonathan.wilson(a)vumc.org> Sent: Wednesday, November 13, 2019 23:03 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] periodic disconnect of TCP sessions CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe. Hello all, I am using a pair of syslog-ng OSE 3.22.1 servers that write logfiles which are then scanned by a Splunk Universal Forwarder. They receive messages over TCP, TCP with TLS, and UDP. We have always had devices and systems that send us syslog messages simply send to both syslog-ng servers; however, this resulted in double indexing of the log data in Splunk. To deal with this we set up a DNS name that round-robins across the two syslog-ng servers’ IPs every 30 seconds. The devices and systems that send to us now send to that DNS name. That neatly prevents the double indexing. If the messages are coming in over stateless UDP, the messages are load balanced in that they all go to one server for 30 seconds, then the other. However, TCP sessions are much longer lived, and some senders send many messages every second – they will latch onto one of our syslog servers and stay connected to it all day. What I am looking for is a way to limit the lifetime of a TCP connection into syslog-ng, either by time or by number of messages received; after the connection is dropped, the sender will reconnect to whichever server is indicated by the round-robin DNS name, and over time about half of the messages will go to each server. Is there already a way to do this? Failing that, can you suggest a place to start in patching the source? Thanks, Jon

1 0

periodic disconnect of TCP sessions
by Wilson, Jonathan 15 Nov '19

15 Nov '19

Hello all, I am using a pair of syslog-ng OSE 3.22.1 servers that write logfiles which are then scanned by a Splunk Universal Forwarder. They receive messages over TCP, TCP with TLS, and UDP. We have always had devices and systems that send us syslog messages simply send to both syslog-ng servers; however, this resulted in double indexing of the log data in Splunk. To deal with this we set up a DNS name that round-robins across the two syslog-ng servers' IPs every 30 seconds. The devices and systems that send to us now send to that DNS name. That neatly prevents the double indexing. If the messages are coming in over stateless UDP, the messages are load balanced in that they all go to one server for 30 seconds, then the other. However, TCP sessions are much longer lived, and some senders send many messages every second - they will latch onto one of our syslog servers and stay connected to it all day. What I am looking for is a way to limit the lifetime of a TCP connection into syslog-ng, either by time or by number of messages received; after the connection is dropped, the sender will reconnect to whichever server is indicated by the round-robin DNS name, and over time about half of the messages will go to each server. Is there already a way to do this? Failing that, can you suggest a place to start in patching the source? Thanks, Jon

2 1