April 2019 - syslog-ng - lists.balabit.hu

tcpdump shows device sending syslog from UDP 514 but not write to local log file
by Lin, Victor 08 Apr '19

08 Apr '19

Dear all, When use: tcpdump src host 1.3.4.5 and port 514 , I can see host 1.3.4.5 is sending the syslog to my syslog-ng But when I search my local log special for port 514, I didn't see any syslog from 1.3.4.5 Is there another location to config the syslog-ng, except /app/syslog-ng/custom/conf/syslog-ng.conf ? Below is from my syslog-ng.conf # Syslog collection for all devices source s_network { network( transport("udp") port(514) flags(syslog_protocol) keep_hostname(yes) keep_timestamp(yes) use_dns(no) use_fqdn(no) ); }; destination d_all_logs { file("/app/syslog-ng/custom/output/all_devices.log"); network("102.45.2.86" port(514) transport(udp) spoof_source(yes)); }; log { source(s_network); source(s_arista_network); destination(d_all_logs); }; Thank you very much for reply in advance!!!!! VL _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future.

2 1

WebGUI for Syslog-ng storing logs in HDFS
by Lee Keng Ket 08 Apr '19

08 Apr '19

Hi, I'm looking for a WebGUI application for users to search for syslog, which the logs are stored by syslog-ng into HDFS. Can you please share what WebGUI you're using? I realize ElasticSearch with Kibana are the famous solution for this, however, I wish to store my syslog in HDFS. Thank you. Regards, KK

4 5

Dropping specific messages from Syslog-NG
by Bell, Christopher E. 05 Apr '19

05 Apr '19

Disclaimer: I'm not an expert in either Linux or syslog-ng. I'm also not a programmer :). That being said, I've built a syslog-ng --> Splunk deployment and I'm trying to drop unwanted log messages before they make their way to Splunk... so drop them at syslog-ng. There are going to be approx. 700 devices logging to this deployment (routers, switches, firewalls, IPAM, AAA, etc..) so I need to make sure whatever I do can scale easily and my teammates can help me manage it. I'm trying to drop messages that are similar to the below: Apr 5 06:02:17 x.x.x.x 2019 Apr 5 06:02:17 EDT: %USER-3-SYSTEM_MSG: NTP Receive dropping message: Received NTP control mode packet. Drop count:4200 - ntpd As well as: Apr 5 08:03:49 x.x.x.x Apr 5 2019 12:03:48.895 UTC: %SNMP-3-RESPONSE_DELAYED: processing GetNext of entPhysicalEntry.2.1065 (5739 msecs) Two different devices. I've tried literally dozens of methods, my latest is below and I can't figure out why we're still logging these messages: filter f_trash { match(SNMP-3-RESPONSE_DELAYED value(MSGHDR)); and match(NTP Receive dropping message value(MSG))}; log { source(s_sys); filter(f_trash); flags (final);}; Any help / constructive criticism would be greatly appreciated.

2 3

Interest in GSoC 2019
by Kushal K S V S 03 Apr '19

03 Apr '19

Hi, I am Kushal. I am a Final Year Undergrad in Computer Science IIT Guwahati, India. I am very much interested in working on Syslog-ng and with the community on the project "Analyze and improve JSON performance". I have installed from the source code and am currently going through the code. I have already participated in GSoC in 2017 as a part of The FreeType Org. Many of my projects including the previous GSoC project are in C. I am well-versed in C, C++, Bash, makefile, etc. which will be the technologies to be used for this project. Hope I am not too late. I am thinking of analyzing the JSON parsers available to get an idea on how to proceed. Any help regarding this would be highly appreciated. Yours sincerely, Kushal K S V S

1 0

syslog-ng moving to its own organization on github
by Scheidler, Balázs 01 Apr '19

01 Apr '19

Hi, syslog-ng as an open source project has long been supported and sponsored by a company called Balabit (which I personally was the founder of), hence syslog-ng related online resources like the github project was published under github.com/balabit. Since Balabit was acquired last January by One Identity (www.oneidentity.com) going forward, the Balabit branding is not the right one for the syslog-ng project. Since the acquisition, all on-line syslog-ng presence was concentrated under the "syslog-ng" brand. An example for this is the website, which is now at www.syslog-ng.com. In a similar way, developer and open source related resources should follow suit. Our plan is to use "syslog-ng" everywhere where we were using "balabit". This includes github, dockerhub, gitter, slack, mailing list etc. We expect that the transition will take time, and that old links, chat rooms, docker images will work for a time yet, redirects will be there for those of us still using the old links. However it is a good idea to update bookmarks & git remotes that this will work on the long run. Over time, the name "Balabit" will fade a bit, at least within the syslog-ng community, but that's good. That's progress. Cheers, Bazsi founder of syslog-ng founder of Balabit

1 0

Redhat repo
by Faine, Mark R. (MSFC-IS40)[NICS] 01 Apr '19

01 Apr '19

I have a question about the Redhat repo for the unofficial OSE builds. It seems as though they are tied to a specific version. For example, I'm currently using czanik-syslog-ng318epel6, however, I see that 3.19 has a different repo specifically for that version. This seems to be counter to the point of yum repositories and it imposes an additional maintenance burden. Am I maybe not properly understanding how it works, and if not, is there a repo that tracks with the latest stable version? -Mark

6 9