May 2019 - syslog-ng - lists.balabit.hu

Project of Google Summer Of Code
by Enis Kollugil 07 May '19

07 May '19

Hi everyone, My name is Enis Kollugil. I am one of your Google Summer Of Code students. I'm a final year undergraduate student in Istanbul Technical University, Turkey. I have been working at the IT Head Office for 2 years. I managed both Linux and Windows systems for these years. My main task is writing script Powershell and managing backup process (Tape and File Backup). I will do my best to create a snippet for Vscode. If you have any suggestion or desire on my topic, I would like to hear. Thank you for everything. Best Regards, Enis Kollugil

1 0

Re: [syslog-ng] syslog-ng Digest, Vol 169, Issue 3
by Simon Tyler 02 May '19

02 May '19

Hi Peter, I commented out the network entry and uncommented this tcp entry: source s_net { tcp(ip(10.8.41.60) port(514)); }; I can see syslog-ng start up and process local log messages: [root@ip-10-8-41-60 syslog-ng]# syslog-ng --debug Trying to open module; module='syslogformat', filename='/lib64/syslog-ng/libsyslogformat.so' Trying to open module; module='basicfuncs', filename='/lib64/syslog-ng/libbasicfuncs.so' Trying to open module; module='afsocket', filename='/lib64/syslog-ng/libafsocket.so' Trying to open module; module='affile', filename='/lib64/syslog-ng/libaffile.so' Trying to open module; module='afprog', filename='/lib64/syslog-ng/libafprog.so' Trying to open module; module='afuser', filename='/lib64/syslog-ng/libafuser.so' Trying to open module; module='dbparser', filename='/lib64/syslog-ng/libdbparser.so' Trying to open module; module='csvparser', filename='/lib64/syslog-ng/libcsvparser.so' Trying to open module; module='afsql', filename='/lib64/syslog-ng/libafsql.so' Starting to read include file; filename='/etc/syslog-ng/scl.conf', depth='1' Global value changed; define='scl-root', value='/usr/share/syslog-ng/include/scl' Global value changed; define='include-path', value='/etc/syslog-ng:/usr/share/syslog-ng/include' Starting to read include file; filename='/etc/syslog-ng/modules.conf', depth='2' Global value changed; define='autoload-compiled-modules', value='0' Trying to open module; module='syslogformat', filename='/lib64/syslog-ng/libsyslogformat.so' Attempted to register the same plugin multiple times, ignoring; context='format', name='syslog' Trying to open module; module='basicfuncs', filename='/lib64/syslog-ng/libbasicfuncs.so' Attempted to register the same plugin multiple times, ignoring; context='template-func', name='echo' Attempted to register the same plugin multiple times, ignoring; context='template-func', name='grep' Attempted to register the same plugin multiple times, ignoring; context='template-func', name='if' Trying to open module; module='afsocket', filename='/lib64/syslog-ng/libafsocket.so' Attempted to register the same plugin multiple times, ignoring; context='source', name='unix-stream' Attempted to register the same plugin multiple times, ignoring; context='destination', name='unix-stream' Attempted to register the same plugin multiple times, ignoring; context='source', name='unix-dgram' Attempted to register the same plugin multiple times, ignoring; context='destination', name='unix-dgram' Attempted to register the same plugin multiple times, ignoring; context='source', name='tcp' Attempted to register the same plugin multiple times, ignoring; context='destination', name='tcp' Attempted to register the same plugin multiple times, ignoring; context='source', name='tcp6' Attempted to register the same plugin multiple times, ignoring; context='destination', name='tcp6' Attempted to register the same plugin multiple times, ignoring; context='source', name='udp' Attempted to register the same plugin multiple times, ignoring; context='destination', name='udp' Attempted to register the same plugin multiple times, ignoring; context='source', name='udp6' Attempted to register the same plugin multiple times, ignoring; context='destination', name='udp6' Attempted to register the same plugin multiple times, ignoring; context='source', name='syslog' Attempted to register the same plugin multiple times, ignoring; context='destination', name='syslog' Trying to open module; module='affile', filename='/lib64/syslog-ng/libaffile.so' Attempted to register the same plugin multiple times, ignoring; context='source', name='file' Attempted to register the same plugin multiple times, ignoring; context='source', name='pipe' Attempted to register the same plugin multiple times, ignoring; context='destination', name='file' Attempted to register the same plugin multiple times, ignoring; context='destination', name='pipe' Trying to open module; module='afprog', filename='/lib64/syslog-ng/libafprog.so' Attempted to register the same plugin multiple times, ignoring; context='source', name='program' Attempted to register the same plugin multiple times, ignoring; context='destination', name='program' Trying to open module; module='afuser', filename='/lib64/syslog-ng/libafuser.so' Attempted to register the same plugin multiple times, ignoring; context='destination', name='usertty' Trying to open module; module='dbparser', filename='/lib64/syslog-ng/libdbparser.so' Attempted to register the same plugin multiple times, ignoring; context='parser', name='db-parser' Trying to open module; module='csvparser', filename='/lib64/syslog-ng/libcsvparser.so' Attempted to register the same plugin multiple times, ignoring; context='parser', name='csv-parser' Finishing include; filename='/etc/syslog-ng/modules.conf', depth='2' Starting to read include file; filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', depth='2' Trying to open module; module='confgen', filename='/lib64/syslog-ng/libconfgen.so' Finishing include; filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', depth='2' Starting to read include file; filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', depth='2' Finishing include; filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', depth='2' Starting to read include file; filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf', depth='2' Trying to open module; module='confgen', filename='/lib64/syslog-ng/libconfgen.so' Finishing include; filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf', depth='2' Finishing include; filename='/etc/syslog-ng/scl.conf', depth='1' Running application hooks; hook='1' Running application hooks; hook='3' syslog-ng starting up; version='3.2.5' Incoming log entry; line='<30>May 2 15:20:55 dhclient[1689]: XMT: Solicit on eth0, interval 129080ms.' But, there is no syslog process listening on port 514 or any other port. I did try upgrading to a more recent version 3.19 from here: https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng319/repo/epel-7/cza… however this is an Amazon linux instance and it appears to conflict with some of the operating system packages. I thought I would check in with you one more time to see if you have any other suggestions; otherwise, I can try Centos and a more recent version of syslog-ng. Thanks again for your help, Simon Tyler | Senior Systems Administrator - PathWise Solutions Group Aon 225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.979.7724 simon.tyler(a)aon.com PLEASE NOTE that my email address has changed to simon.tyler(a)aon.com -----Original Message----- From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: Thursday, May 02, 2019 1:23 AM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 169, Issue 3 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: syslog-ng Digest, Vol 169, Issue 1 (Péter) ---------------------------------------------------------------------- Message: 1 Date: Thu, 2 May 2019 07:22:28 +0200 From: Péter, Kókai <peter.kokai(a)oneidentity.com> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] syslog-ng Digest, Vol 169, Issue 1 Message-ID: <CABxQCphefFz0VVvGYVkGzMr6GzUPbeHVp3b8Gq_fbgcRazKJaQ(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Hello, Okay I see it now. You are using a version (3.2) which as far as I can see did not have *network* keyword at all. Instead of *network*, you could use tcp, udp, tls, ... Or even better upgrade to something much newer if possible :) The "Avaiable-Modules" is also a later feature, so that was a reason not to show up the list of modules, not the lack of them. -- Kokan On Wed, May 1, 2019 at 9:41 PM Simon Tyler <simon.tyler(a)aon.com> wrote: > Hi Kohan, > > It appears that modules are not loading? > > [root@ip-10-8-41-60 syslog-ng]# syslog-ng -V > syslog-ng 3.2.5 > Installer-Version: 3.2.5 > Revision: ssh+git://bazsi@git.balabit > //var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#9d4bea28198bd731df1a61e980a2af5b88d81116 > Compile-Date: Jul 25 2014 15:20:50 > Enable-Threads: on > Enable-Debug: off > Enable-GProf: off > Enable-Memtrace: off > Enable-Sun-STREAMS: off > Enable-IPv6: on > Enable-Spoof-Source: on > Enable-TCP-Wrapper: on > Enable-SSL: off > Enable-SQL: on > Enable-Linux-Caps: off > Enable-Pcre: on > Enable-Pacct: off > > ------------------------------------------------------------- > I tried putting full path to modules.conf in scl.conf: > > [root@ip-10-8-41-60 syslog-ng]# cat scl.conf > > ############################################################################# > # Copyright (c) 2010 BalaBit IT Ltd, Budapest, Hungary > # > # This program is free software; you can redistribute it and/or modify it > # under the terms of the GNU General Public License version 2 as published > # by the Free Software Foundation, or (at your option) any later version. > # > # As an additional exemption you are allowed to compile & link against the > # OpenSSL libraries as published by the OpenSSL project. See the file > # COPYING for details. > # > # This program is distributed in the hope that it will be useful, > # but WITHOUT ANY WARRANTY; without even the implied warranty of > # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the > # GNU General Public License for more details. > # > # You should have received a copy of the GNU General Public License > # along with this program; if not, write to the Free Software > # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 > USA > # > > ############################################################################# > # > # This file is placed into /etc/syslog-ng in order to make it trivial to > # include in user written syslog-ng.conf files. It sets up 'scl-root' and > # `include-path`, then includes all SCL supplied plugins. > # > > @define scl-root "`syslog-ng-data`/include/scl" > @define include-path "`include-path`:`syslog-ng-data`/include" > > #@include 'modules.conf' > @include '/etc/syslog-ng/modules.conf' > @include 'scl/system/plugin.conf' > @include 'scl/pacct/plugin.conf' > @include 'scl/syslogconf/plugin.conf' > > --------------------------------------------------- > Debug it seems to be trying to open modules, and it knows where they live: > [root@ip-10-8-41-60 syslog-ng]# syslog-ng --debug > Trying to open module; module='syslogformat', > filename='/lib64/syslog-ng/libsyslogformat.so' > Trying to open module; module='basicfuncs', > filename='/lib64/syslog-ng/libbasicfuncs.so' > Trying to open module; module='afsocket', > filename='/lib64/syslog-ng/libafsocket.so' > Trying to open module; module='affile', > filename='/lib64/syslog-ng/libaffile.so' > Trying to open module; module='afprog', > filename='/lib64/syslog-ng/libafprog.so' > Trying to open module; module='afuser', > filename='/lib64/syslog-ng/libafuser.so' > Trying to open module; module='dbparser', > filename='/lib64/syslog-ng/libdbparser.so' > Trying to open module; module='csvparser', > filename='/lib64/syslog-ng/libcsvparser.so' > Trying to open module; module='afsql', > filename='/lib64/syslog-ng/libafsql.so' > Starting to read include file; filename='/etc/syslog-ng/scl.conf', > depth='1' > Global value changed; define='scl-root', > value='/usr/share/syslog-ng/include/scl' > Global value changed; define='include-path', > value='/etc/syslog-ng:/usr/share/syslog-ng/include' > Starting to read include file; filename='/etc/syslog-ng/modules.conf', > depth='2' > Global value changed; define='autoload-compiled-modules', value='0' > Trying to open module; module='syslogformat', > filename='/lib64/syslog-ng/libsyslogformat.so' > Attempted to register the same plugin multiple times, ignoring; > context='format', name='syslog' > Trying to open module; module='basicfuncs', > filename='/lib64/syslog-ng/libbasicfuncs.so' > Attempted to register the same plugin multiple times, ignoring; > context='template-func', name='echo' > Attempted to register the same plugin multiple times, ignoring; > context='template-func', name='grep' > Attempted to register the same plugin multiple times, ignoring; > context='template-func', name='if' > Trying to open module; module='afsocket', > filename='/lib64/syslog-ng/libafsocket.so' > Attempted to register the same plugin multiple times, ignoring; > context='source', name='unix-stream' > Attempted to register the same plugin multiple times, ignoring; > context='destination', name='unix-stream' > Attempted to register the same plugin multiple times, ignoring; > context='source', name='unix-dgram' > Attempted to register the same plugin multiple times, ignoring; > context='destination', name='unix-dgram' > Attempted to register the same plugin multiple times, ignoring; > context='source', name='tcp' > Attempted to register the same plugin multiple times, ignoring; > context='destination', name='tcp' > Attempted to register the same plugin multiple times, ignoring; > context='source', name='tcp6' > Attempted to register the same plugin multiple times, ignoring; > context='destination', name='tcp6' > Attempted to register the same plugin multiple times, ignoring; > context='source', name='udp' > Attempted to register the same plugin multiple times, ignoring; > context='destination', name='udp' > Attempted to register the same plugin multiple times, ignoring; > context='source', name='udp6' > Attempted to register the same plugin multiple times, ignoring; > context='destination', name='udp6' > Attempted to register the same plugin multiple times, ignoring; > context='source', name='syslog' > Attempted to register the same plugin multiple times, ignoring; > context='destination', name='syslog' > Trying to open module; module='affile', > filename='/lib64/syslog-ng/libaffile.so' > Attempted to register the same plugin multiple times, ignoring; > context='source', name='file' > Attempted to register the same plugin multiple times, ignoring; > context='source', name='pipe' > Attempted to register the same plugin multiple times, ignoring; > context='destination', name='file' > Attempted to register the same plugin multiple times, ignoring; > context='destination', name='pipe' > Trying to open module; module='afprog', > filename='/lib64/syslog-ng/libafprog.so' > Attempted to register the same plugin multiple times, ignoring; > context='source', name='program' > Attempted to register the same plugin multiple times, ignoring; > context='destination', name='program' > Trying to open module; module='afuser', > filename='/lib64/syslog-ng/libafuser.so' > Attempted to register the same plugin multiple times, ignoring; > context='destination', name='usertty' > Trying to open module; module='dbparser', > filename='/lib64/syslog-ng/libdbparser.so' > Attempted to register the same plugin multiple times, ignoring; > context='parser', name='db-parser' > Trying to open module; module='csvparser', > filename='/lib64/syslog-ng/libcsvparser.so' > Attempted to register the same plugin multiple times, ignoring; > context='parser', name='csv-parser' > Finishing include; filename='/etc/syslog-ng/modules.conf', depth='2' > Starting to read include file; > filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', depth='2' > Trying to open module; module='confgen', > filename='/lib64/syslog-ng/libconfgen.so' > Finishing include; > filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', depth='2' > Starting to read include file; > filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', depth='2' > Finishing include; > filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', depth='2' > Starting to read include file; > filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf', > depth='2' > Trying to open module; module='confgen', > filename='/lib64/syslog-ng/libconfgen.so' > Finishing include; > filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf', > depth='2' > Finishing include; filename='/etc/syslog-ng/scl.conf', depth='1' > Error parsing source, source plugin network not found in > /etc/syslog-ng/syslog-ng.conf at line 85, column 2: > > network( > ^^^^^^^ > --------------------------------------------------------------- > It is not clear to me what the name is for network module; here are the > modules in the file system: > [root@ip-10-8-41-60 syslog-ng]# ls /lib64/syslog-ng/ > libaffile.so libafsocket-notls.so libafsql.so libbasicfuncs.so > libconvertfuncs.so libdbparser.so libsyslogformat.so > libafprog.so libafsocket.so libafuser.so libconfgen.so > libcsvparser.so libdummy.so > > Thank you for your advice, > > > > > Simon Tyler | Senior Systems Administrator - PathWise Solutions Group > Aon > 225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada > t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.979.7724 > simon.tyler(a)aon.com > PLEASE NOTE that my email address has changed to simon.tyler(a)aon.com > > > > -----Original Message----- > From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of > syslog-ng-request(a)lists.balabit.hu > Sent: Wednesday, May 01, 2019 12:47 PM > To: syslog-ng(a)lists.balabit.hu > Subject: syslog-ng Digest, Vol 169, Issue 1 > > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. source plugin network not found/problems getting syslog-ng > to listen on tcp port (Simon Tyler) > 2. Re: source plugin network not found/problems getting > syslog-ng to listen on tcp port (Péter) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 1 May 2019 15:22:26 +0000 > From: Simon Tyler <simon.tyler(a)aon.com> > To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> > Subject: [syslog-ng] source plugin network not found/problems getting > syslog-ng to listen on tcp port > Message-ID: > < > DM5P170MB0015DD8BF273A79D22817BAAFB3B0(a)DM5P170MB0015.NAMP170.PROD.OUTLOOK.COM > > > > Content-Type: text/plain; charset="utf-8" > > Hello, > > I'm new to syslog-ng, and I'm having some trouble just getting it to > listen on a tcp port. I've tried several different configurations. Some of > the start up with no error, but a netstat or lsof command shows that there > is no open /listening tcp port associated with the process. I'm pretty sure > my mistake is basic or fundamental, but I haven't had much luck finding > specific details to resolve this issue; there is a fair amount of material > to comb through. I've tried several different tutorials. > > I want a central log server that accepts logs from multiple sources, so I > started by trying to configure it to listen on a tcp port, I'm thinking 514 > because we don't use rshell anywhere, but it doesn't really matter what > port. > > The current error I'm getting is: > > [root@ip-10-8-41-60 syslog-ng]# service syslog-ng start > Error parsing source, source plugin network not found in > /etc/syslog-ng/syslog-ng.conf at line 85, column 2: > > network( > ^^^^^^^ > > The section of the config file related to networking is below; I've > commented out several attempts. > > # s_net = Network listener. This is listening on TCP port 514, no UDP > #source s_net { tcp(port(514) max-connections(5000)); udp();}; > > #source s_net { > # tcp(ip(10.8.41.60) port(514)); > #}; > > #source s_net { > # network(ip(10.8.41.60) port(514)); > #}; > > #source s_network { > # default-network-drivers(); > #}; > > #source s_syslog { syslog( > # ip(10.8.41.60) port(514) transport("tcp")); }; > > source s_network { > network( > ip("10.8.41.60") > transport("tcp") > listen-backlog(2048) > ); > }; > > There is a line at the top of the file: > @include "scl.conf" > > I've attached the entire file. > > Any guidance would be very much appreciated, > > Simon Tyler | Senior Systems Administrator - PathWise Solutions Group > Aon > 225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada > t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.979.7724 > simon.tyler(a)aon.com<mailto:simon.tyler@aon.com> > PLEASE NOTE that my email address has changed to simon.tyler(a)aon.com > > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: < > http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190501/4cfbf496/a… > > > -------------- next part -------------- > A non-text attachment was scrubbed... > Name: syslog-ng.conf > Type: application/octet-stream > Size: 4159 bytes > Desc: syslog-ng.conf > URL: < > http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190501/4cfbf496/a… > > > > ------------------------------ > > Message: 2 > Date: Wed, 1 May 2019 18:46:41 +0200 > From: Péter, Kókai <peter.kokai(a)oneidentity.com> > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Subject: Re: [syslog-ng] source plugin network not found/problems > getting syslog-ng to listen on tcp port > Message-ID: > <CABxQCphBGgTm47G= > KVSB67Ri6BRKUZYgX-HvAj1SrS9ofMoaoQ(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hello, > > It either looks for a wrong place for the network module or that actually > really not installed. > > You could run the following: syslog-ng -V > That should provide something like this: > > syslog-ng 3.20.1.317.g98479aa > Config version: 3.20 > Installer-Version: 3.20.1.317.g98479aa > Revision: 3.20.1.317.g98479aa > Module-Directory: /tmp/install/lib/syslog-ng > Module-Path: /tmp/install/lib/syslog-ng > Include-Path: /tmp/install/share/syslog-ng/include > Available-Modules: > > xml,tags-parser,system-source,sdjournal,syslogformat,stardate,snmptrapd_parser,riemann,mod-python,pseudofile,pacctformat,map_value_pairs,linux-kmsg-format,kvformat,json-plugin,http,hook-commands,graphite,tfgetent,geoip2-plugin,geoip-plugin,examples,disk-buffer,dbparser,date,csvparser,cryptofuncs,confgen,cef,basicfuncs,appmodel,afuser,afstomp,afsql,afsocket,afprog,affile,afamqp,add_contextual_data > Enable-Debug: on > Enable-GProf: off > Enable-Memtrace: off > Enable-IPv6: on > Enable-Spoof-Source: off > Enable-TCP-Wrapper: off > Enable-Linux-Caps: on > Enable-Systemd: on > > Check if the "Available-Modules" line has the *afsocket*, if the *afsocket* > is not listed there, try to look in the "Module-Path:" directory for > *libafsocket.so", if it is missing maybe it is actually in a different > package, you may need to install something like syslog-ng-mod-afsocket. > > If you find the *libafsocket.so* in the directory I would run > syslog-ng --module-registry -dvt (possibly past its result here) or look > for error message as why it cannot load *libafsocket.so*. > > > -- > Kokan > > On Wed, May 1, 2019 at 5:22 PM Simon Tyler <simon.tyler(a)aon.com> wrote: > > > Hello, > > > > > > > > I’m new to syslog-ng, and I’m having some trouble just getting it to > > listen on a tcp port. I’ve tried several different configurations. Some > of > > the start up with no error, but a netstat or lsof command shows that > there > > is no open /listening tcp port associated with the process. I’m pretty > sure > > my mistake is basic or fundamental, but I haven’t had much luck finding > > specific details to resolve this issue; there is a fair amount of > material > > to comb through. I’ve tried several different tutorials. > > > > > > > > I want a central log server that accepts logs from multiple sources, so I > > started by trying to configure it to listen on a tcp port, I’m thinking > 514 > > because we don’t use rshell anywhere, but it doesn’t really matter what > > port. > > > > > > > > The current error I’m getting is: > > > > > > > > [root@ip-10-8-41-60 syslog-ng]# service syslog-ng start > > > > Error parsing source, source plugin network not found in > > /etc/syslog-ng/syslog-ng.conf at line 85, column 2: > > > > > > > > network( > > > > ^^^^^^^ > > > > > > > > The section of the config file related to networking is below; I’ve > > commented out several attempts. > > > > > > > > # s_net = Network listener. This is listening on TCP port 514, no UDP > > > > #source s_net { tcp(port(514) max-connections(5000)); udp();}; > > > > > > > > #source s_net { > > > > # tcp(ip(10.8.41.60) port(514)); > > > > #}; > > > > > > > > #source s_net { > > > > # network(ip(10.8.41.60) port(514)); > > > > #}; > > > > > > > > #source s_network { > > > > # default-network-drivers(); > > > > #}; > > > > > > > > #source s_syslog { syslog( > > > > # ip(10.8.41.60) port(514) transport("tcp")); }; > > > > > > > > source s_network { > > > > network( > > > > ip("10.8.41.60") > > > > transport("tcp") > > > > listen-backlog(2048) > > > > ); > > > > }; > > > > > > > > There is a line at the top of the file: > > > > @include "scl.conf" > > > > > > > > I’ve attached the entire file. > > > > > > > > Any guidance would be very much appreciated, > > > > > > > > *Simon Tyler *| Senior Systems Administrator - PathWise Solutions Group > > Aon > > 225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada > > t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.979.7724 > > *simon.tyler(a)aon.com <simon.tyler(a)aon.com>* > > > > *PLEASE NOTE that my email address has changed to simon.tyler(a)aon.com > > <http://simon.tyler@aon.com>* > > > > > > > > > ______________________________________________________________________________ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: < > http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190501/715578b1/a… > > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > ------------------------------ > > End of syslog-ng Digest, Vol 169, Issue 1 > ***************************************** > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190502/b6b91ca5/a…> ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng ------------------------------ End of syslog-ng Digest, Vol 169, Issue 3 *****************************************

2 1

Re: [syslog-ng] syslog-ng Digest, Vol 169, Issue 1
by Simon Tyler 02 May '19

02 May '19

Hi Kohan, It appears that modules are not loading? [root@ip-10-8-41-60 syslog-ng]# syslog-ng -V syslog-ng 3.2.5 Installer-Version: 3.2.5 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#9d4bea28198bd731df1a61e980a2af5b88d81116 Compile-Date: Jul 25 2014 15:20:50 Enable-Threads: on Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-SSL: off Enable-SQL: on Enable-Linux-Caps: off Enable-Pcre: on Enable-Pacct: off ------------------------------------------------------------- I tried putting full path to modules.conf in scl.conf: [root@ip-10-8-41-60 syslog-ng]# cat scl.conf ############################################################################# # Copyright (c) 2010 BalaBit IT Ltd, Budapest, Hungary # # This program is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License version 2 as published # by the Free Software Foundation, or (at your option) any later version. # # As an additional exemption you are allowed to compile & link against the # OpenSSL libraries as published by the OpenSSL project. See the file # COPYING for details. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA # ############################################################################# # # This file is placed into /etc/syslog-ng in order to make it trivial to # include in user written syslog-ng.conf files. It sets up 'scl-root' and # `include-path`, then includes all SCL supplied plugins. # @define scl-root "`syslog-ng-data`/include/scl" @define include-path "`include-path`:`syslog-ng-data`/include" #@include 'modules.conf' @include '/etc/syslog-ng/modules.conf' @include 'scl/system/plugin.conf' @include 'scl/pacct/plugin.conf' @include 'scl/syslogconf/plugin.conf' --------------------------------------------------- Debug it seems to be trying to open modules, and it knows where they live: [root@ip-10-8-41-60 syslog-ng]# syslog-ng --debug Trying to open module; module='syslogformat', filename='/lib64/syslog-ng/libsyslogformat.so' Trying to open module; module='basicfuncs', filename='/lib64/syslog-ng/libbasicfuncs.so' Trying to open module; module='afsocket', filename='/lib64/syslog-ng/libafsocket.so' Trying to open module; module='affile', filename='/lib64/syslog-ng/libaffile.so' Trying to open module; module='afprog', filename='/lib64/syslog-ng/libafprog.so' Trying to open module; module='afuser', filename='/lib64/syslog-ng/libafuser.so' Trying to open module; module='dbparser', filename='/lib64/syslog-ng/libdbparser.so' Trying to open module; module='csvparser', filename='/lib64/syslog-ng/libcsvparser.so' Trying to open module; module='afsql', filename='/lib64/syslog-ng/libafsql.so' Starting to read include file; filename='/etc/syslog-ng/scl.conf', depth='1' Global value changed; define='scl-root', value='/usr/share/syslog-ng/include/scl' Global value changed; define='include-path', value='/etc/syslog-ng:/usr/share/syslog-ng/include' Starting to read include file; filename='/etc/syslog-ng/modules.conf', depth='2' Global value changed; define='autoload-compiled-modules', value='0' Trying to open module; module='syslogformat', filename='/lib64/syslog-ng/libsyslogformat.so' Attempted to register the same plugin multiple times, ignoring; context='format', name='syslog' Trying to open module; module='basicfuncs', filename='/lib64/syslog-ng/libbasicfuncs.so' Attempted to register the same plugin multiple times, ignoring; context='template-func', name='echo' Attempted to register the same plugin multiple times, ignoring; context='template-func', name='grep' Attempted to register the same plugin multiple times, ignoring; context='template-func', name='if' Trying to open module; module='afsocket', filename='/lib64/syslog-ng/libafsocket.so' Attempted to register the same plugin multiple times, ignoring; context='source', name='unix-stream' Attempted to register the same plugin multiple times, ignoring; context='destination', name='unix-stream' Attempted to register the same plugin multiple times, ignoring; context='source', name='unix-dgram' Attempted to register the same plugin multiple times, ignoring; context='destination', name='unix-dgram' Attempted to register the same plugin multiple times, ignoring; context='source', name='tcp' Attempted to register the same plugin multiple times, ignoring; context='destination', name='tcp' Attempted to register the same plugin multiple times, ignoring; context='source', name='tcp6' Attempted to register the same plugin multiple times, ignoring; context='destination', name='tcp6' Attempted to register the same plugin multiple times, ignoring; context='source', name='udp' Attempted to register the same plugin multiple times, ignoring; context='destination', name='udp' Attempted to register the same plugin multiple times, ignoring; context='source', name='udp6' Attempted to register the same plugin multiple times, ignoring; context='destination', name='udp6' Attempted to register the same plugin multiple times, ignoring; context='source', name='syslog' Attempted to register the same plugin multiple times, ignoring; context='destination', name='syslog' Trying to open module; module='affile', filename='/lib64/syslog-ng/libaffile.so' Attempted to register the same plugin multiple times, ignoring; context='source', name='file' Attempted to register the same plugin multiple times, ignoring; context='source', name='pipe' Attempted to register the same plugin multiple times, ignoring; context='destination', name='file' Attempted to register the same plugin multiple times, ignoring; context='destination', name='pipe' Trying to open module; module='afprog', filename='/lib64/syslog-ng/libafprog.so' Attempted to register the same plugin multiple times, ignoring; context='source', name='program' Attempted to register the same plugin multiple times, ignoring; context='destination', name='program' Trying to open module; module='afuser', filename='/lib64/syslog-ng/libafuser.so' Attempted to register the same plugin multiple times, ignoring; context='destination', name='usertty' Trying to open module; module='dbparser', filename='/lib64/syslog-ng/libdbparser.so' Attempted to register the same plugin multiple times, ignoring; context='parser', name='db-parser' Trying to open module; module='csvparser', filename='/lib64/syslog-ng/libcsvparser.so' Attempted to register the same plugin multiple times, ignoring; context='parser', name='csv-parser' Finishing include; filename='/etc/syslog-ng/modules.conf', depth='2' Starting to read include file; filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', depth='2' Trying to open module; module='confgen', filename='/lib64/syslog-ng/libconfgen.so' Finishing include; filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', depth='2' Starting to read include file; filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', depth='2' Finishing include; filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', depth='2' Starting to read include file; filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf', depth='2' Trying to open module; module='confgen', filename='/lib64/syslog-ng/libconfgen.so' Finishing include; filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf', depth='2' Finishing include; filename='/etc/syslog-ng/scl.conf', depth='1' Error parsing source, source plugin network not found in /etc/syslog-ng/syslog-ng.conf at line 85, column 2: network( ^^^^^^^ --------------------------------------------------------------- It is not clear to me what the name is for network module; here are the modules in the file system: [root@ip-10-8-41-60 syslog-ng]# ls /lib64/syslog-ng/ libaffile.so libafsocket-notls.so libafsql.so libbasicfuncs.so libconvertfuncs.so libdbparser.so libsyslogformat.so libafprog.so libafsocket.so libafuser.so libconfgen.so libcsvparser.so libdummy.so Thank you for your advice, Simon Tyler | Senior Systems Administrator - PathWise Solutions Group Aon 225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.979.7724 simon.tyler(a)aon.com PLEASE NOTE that my email address has changed to simon.tyler(a)aon.com -----Original Message----- From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: Wednesday, May 01, 2019 12:47 PM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 169, Issue 1 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. source plugin network not found/problems getting syslog-ng to listen on tcp port (Simon Tyler) 2. Re: source plugin network not found/problems getting syslog-ng to listen on tcp port (Péter) ---------------------------------------------------------------------- Message: 1 Date: Wed, 1 May 2019 15:22:26 +0000 From: Simon Tyler <simon.tyler(a)aon.com> To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] source plugin network not found/problems getting syslog-ng to listen on tcp port Message-ID: <DM5P170MB0015DD8BF273A79D22817BAAFB3B0(a)DM5P170MB0015.NAMP170.PROD.OUTLOOK.COM> Content-Type: text/plain; charset="utf-8" Hello, I'm new to syslog-ng, and I'm having some trouble just getting it to listen on a tcp port. I've tried several different configurations. Some of the start up with no error, but a netstat or lsof command shows that there is no open /listening tcp port associated with the process. I'm pretty sure my mistake is basic or fundamental, but I haven't had much luck finding specific details to resolve this issue; there is a fair amount of material to comb through. I've tried several different tutorials. I want a central log server that accepts logs from multiple sources, so I started by trying to configure it to listen on a tcp port, I'm thinking 514 because we don't use rshell anywhere, but it doesn't really matter what port. The current error I'm getting is: [root@ip-10-8-41-60 syslog-ng]# service syslog-ng start Error parsing source, source plugin network not found in /etc/syslog-ng/syslog-ng.conf at line 85, column 2: network( ^^^^^^^ The section of the config file related to networking is below; I've commented out several attempts. # s_net = Network listener. This is listening on TCP port 514, no UDP #source s_net { tcp(port(514) max-connections(5000)); udp();}; #source s_net { # tcp(ip(10.8.41.60) port(514)); #}; #source s_net { # network(ip(10.8.41.60) port(514)); #}; #source s_network { # default-network-drivers(); #}; #source s_syslog { syslog( # ip(10.8.41.60) port(514) transport("tcp")); }; source s_network { network( ip("10.8.41.60") transport("tcp") listen-backlog(2048) ); }; There is a line at the top of the file: @include "scl.conf" I've attached the entire file. Any guidance would be very much appreciated, Simon Tyler | Senior Systems Administrator - PathWise Solutions Group Aon 225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.979.7724 simon.tyler(a)aon.com<mailto:simon.tyler@aon.com> PLEASE NOTE that my email address has changed to simon.tyler(a)aon.com -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190501/4cfbf496/a…> -------------- next part -------------- A non-text attachment was scrubbed... Name: syslog-ng.conf Type: application/octet-stream Size: 4159 bytes Desc: syslog-ng.conf URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190501/4cfbf496/a…> ------------------------------ Message: 2 Date: Wed, 1 May 2019 18:46:41 +0200 From: Péter, Kókai <peter.kokai(a)oneidentity.com> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] source plugin network not found/problems getting syslog-ng to listen on tcp port Message-ID: <CABxQCphBGgTm47G=KVSB67Ri6BRKUZYgX-HvAj1SrS9ofMoaoQ(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Hello, It either looks for a wrong place for the network module or that actually really not installed. You could run the following: syslog-ng -V That should provide something like this: syslog-ng 3.20.1.317.g98479aa Config version: 3.20 Installer-Version: 3.20.1.317.g98479aa Revision: 3.20.1.317.g98479aa Module-Directory: /tmp/install/lib/syslog-ng Module-Path: /tmp/install/lib/syslog-ng Include-Path: /tmp/install/share/syslog-ng/include Available-Modules: xml,tags-parser,system-source,sdjournal,syslogformat,stardate,snmptrapd_parser,riemann,mod-python,pseudofile,pacctformat,map_value_pairs,linux-kmsg-format,kvformat,json-plugin,http,hook-commands,graphite,tfgetent,geoip2-plugin,geoip-plugin,examples,disk-buffer,dbparser,date,csvparser,cryptofuncs,confgen,cef,basicfuncs,appmodel,afuser,afstomp,afsql,afsocket,afprog,affile,afamqp,add_contextual_data Enable-Debug: on Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-Linux-Caps: on Enable-Systemd: on Check if the "Available-Modules" line has the *afsocket*, if the *afsocket* is not listed there, try to look in the "Module-Path:" directory for *libafsocket.so", if it is missing maybe it is actually in a different package, you may need to install something like syslog-ng-mod-afsocket. If you find the *libafsocket.so* in the directory I would run syslog-ng --module-registry -dvt (possibly past its result here) or look for error message as why it cannot load *libafsocket.so*. -- Kokan On Wed, May 1, 2019 at 5:22 PM Simon Tyler <simon.tyler(a)aon.com> wrote: > Hello, > > > > I’m new to syslog-ng, and I’m having some trouble just getting it to > listen on a tcp port. I’ve tried several different configurations. Some of > the start up with no error, but a netstat or lsof command shows that there > is no open /listening tcp port associated with the process. I’m pretty sure > my mistake is basic or fundamental, but I haven’t had much luck finding > specific details to resolve this issue; there is a fair amount of material > to comb through. I’ve tried several different tutorials. > > > > I want a central log server that accepts logs from multiple sources, so I > started by trying to configure it to listen on a tcp port, I’m thinking 514 > because we don’t use rshell anywhere, but it doesn’t really matter what > port. > > > > The current error I’m getting is: > > > > [root@ip-10-8-41-60 syslog-ng]# service syslog-ng start > > Error parsing source, source plugin network not found in > /etc/syslog-ng/syslog-ng.conf at line 85, column 2: > > > > network( > > ^^^^^^^ > > > > The section of the config file related to networking is below; I’ve > commented out several attempts. > > > > # s_net = Network listener. This is listening on TCP port 514, no UDP > > #source s_net { tcp(port(514) max-connections(5000)); udp();}; > > > > #source s_net { > > # tcp(ip(10.8.41.60) port(514)); > > #}; > > > > #source s_net { > > # network(ip(10.8.41.60) port(514)); > > #}; > > > > #source s_network { > > # default-network-drivers(); > > #}; > > > > #source s_syslog { syslog( > > # ip(10.8.41.60) port(514) transport("tcp")); }; > > > > source s_network { > > network( > > ip("10.8.41.60") > > transport("tcp") > > listen-backlog(2048) > > ); > > }; > > > > There is a line at the top of the file: > > @include "scl.conf" > > > > I’ve attached the entire file. > > > > Any guidance would be very much appreciated, > > > > *Simon Tyler *| Senior Systems Administrator - PathWise Solutions Group > Aon > 225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada > t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.979.7724 > *simon.tyler(a)aon.com <simon.tyler(a)aon.com>* > > *PLEASE NOTE that my email address has changed to simon.tyler(a)aon.com > <http://simon.tyler@aon.com>* > > > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190501/715578b1/a…> ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng ------------------------------ End of syslog-ng Digest, Vol 169, Issue 1 *****************************************

2 1

source plugin network not found/problems getting syslog-ng to listen on tcp port
by Simon Tyler 01 May '19

01 May '19

Hello, I'm new to syslog-ng, and I'm having some trouble just getting it to listen on a tcp port. I've tried several different configurations. Some of the start up with no error, but a netstat or lsof command shows that there is no open /listening tcp port associated with the process. I'm pretty sure my mistake is basic or fundamental, but I haven't had much luck finding specific details to resolve this issue; there is a fair amount of material to comb through. I've tried several different tutorials. I want a central log server that accepts logs from multiple sources, so I started by trying to configure it to listen on a tcp port, I'm thinking 514 because we don't use rshell anywhere, but it doesn't really matter what port. The current error I'm getting is: [root@ip-10-8-41-60 syslog-ng]# service syslog-ng start Error parsing source, source plugin network not found in /etc/syslog-ng/syslog-ng.conf at line 85, column 2: network( ^^^^^^^ The section of the config file related to networking is below; I've commented out several attempts. # s_net = Network listener. This is listening on TCP port 514, no UDP #source s_net { tcp(port(514) max-connections(5000)); udp();}; #source s_net { # tcp(ip(10.8.41.60) port(514)); #}; #source s_net { # network(ip(10.8.41.60) port(514)); #}; #source s_network { # default-network-drivers(); #}; #source s_syslog { syslog( # ip(10.8.41.60) port(514) transport("tcp")); }; source s_network { network( ip("10.8.41.60") transport("tcp") listen-backlog(2048) ); }; There is a line at the top of the file: @include "scl.conf" I've attached the entire file. Any guidance would be very much appreciated, Simon Tyler | Senior Systems Administrator - PathWise Solutions Group Aon 225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.979.7724 simon.tyler(a)aon.com<mailto:simon.tyler@aon.com> PLEASE NOTE that my email address has changed to simon.tyler(a)aon.com

2 1