September 2019 - syslog-ng - lists.balabit.hu

syslog-ng-stable RPM repo
by Peter Czanik (pczanik) 04 Nov '19

04 Nov '19

Hi, Until now I had a single request for a syslog-ng-stable repo, which always contains the latest stable release of syslog-ng. But the discussion about my cleanup plans brought up the topic again, and Bazsi wrote me, that there were more such requests coming from the Splunk Slack channel. So I did it: * fedora/rhel/centos: https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng-stable/ * openSUSE/SLES: https://build.opensuse.org/project/show/home:czanik:syslog-ng-stable In theory it should be the exact copy of my unofficial 3.23.1 packages and some fixes backported for openSUSE Tumbleweed. New syslog-ng versions will first appear in versioned repositories, as usual. I plan to push packages to the stable repo only after a week or two delay, so there is time find major bugs, have a .2 release if necessary. Once we have more experience that it works as expected, I'll update my blogs and the syslog-ng website. Until that I'm waiting for your feedback, especially once 3.24.1 comes out. Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

2 2

syslog-ng 3.22.1 consuming a lot of RAM on amqp or kafka destinations
by joao reis 24 Oct '19

24 Oct '19

Hi, I'm having high RAM consuming problems using both amqp or kafka destinations. I'm using patterndb (without any context definition) some basic filters. Changing the destination to "file" or "program" type, the high RAM problem doesn't happen. I tested these backends only in this version of syslog-ng and I don't know if it is a version specific problem. The backends are up and running and receiving correctly from syslog-ng. Here are my configurations: destination d_amqp { amqp( vhost("/email_log") host("127.0.0.1") port(5672) exchange("maillog") username("maillog") password("maillog") disk-buffer( mem-buf-size(10000) disk-buf-size(2000000) reliable(yes) dir("/tmp/disk-buffer") ) exchange-type("fanout") routing-key("") persistent(yes) value-pairs( scope("nv-pairs") ) ); }; destination d_kafka { kafka( bootstrap-servers("127.0.0.1:9092") topic("MYTOPIC") ); }; I added the disk-buffer option to see if it gets any better, but without any good result; Here the syslog-ng-ctl output, when configured to amqp: [root@logserver3 conf.d]# syslog-ng-ctl stats SourceName;SourceId;SourceInstance;State;Type;Number global;payload_reallocs;;a;processed;3635299 src.journald;s_sys#0;journal;a;processed;542 src.journald;s_sys#0;journal;a;stamp;1566648214 global;sdata_updates;;a;processed;0 global;scratch_buffers_bytes;;a;queued;512 source;s_host;;a;processed;5440633 destination;d_boot;;a;processed;0 destination;d_kern;;a;processed;9 source;s_sys;;a;processed;612 dst.amqp;d_amqp#0;amqp,/email_log,127.0.0.1,5672,maillog,fanout;a;dropped;0 dst.amqp;d_amqp#0;amqp,/email_log,127.0.0.1,5672,maillog,fanout;a;processed;2691676 dst.amqp;d_amqp#0;amqp,/email_log,127.0.0.1,5672,maillog,fanout;a;queued;0 dst.amqp;d_amqp#0;amqp,/email_log,127.0.0.1,5672,maillog,fanout;a;written;2691676 src.internal;s_sys#1;;a;processed;70 src.internal;s_sys#1;;a;stamp;1566648339 global;msg_clones;;a;processed;2691634 global;internal_queue_length;;a;processed;0 destination;d_spol;;a;processed;0 destination;d_mlal;;a;processed;0 center;;received;a;processed;5441245 destination;d_mesg;;a;processed;531 destination;d_mail;;a;processed;0 destination;d_auth;;a;processed;29 destination;d_cron;;a;processed;52 destination;d_amqp;;a;processed;2691676 global;scratch_buffers_count;;a;queued;5970004541496 center;;queued;a;processed;2692297 Thanks in advance.

2 3

filter not working
by Lin, Victor 30 Sep '19

30 Sep '19

Dear all, I don't want forwarding the syslog messages which contain the following to my local syslog, so I setup the filter like below ISDN-6-CONNECT ISDN-6-DISCONNECT changed by user However the messages contain the above are still show up in my local syslog file ForMe.log Below is from my syslog-ng.conf source s_network { network( transport("udp") port(514) flags(syslog_protocol) keep_hostname(yes) keep_timestamp(yes) use_dns(yes) use_fqdn(yes) ); }; destination d_ForMe_logs { file("/app/syslog-ng/custom/output/ForMe.log"); }; filter f_DoNotSendtoMe { not match("ISDN-6-CONNECT" value("MESSAGE")); or not match("ISDN-6-DISCONNECT" value("MESSAGE")); or not match("changed by user" value("MESSAGE")); }; log { source(s_network); filter(f_DoNotSendtoMe); destination(d_ForMe_logs); }; Do I missing any confing ? Thank you so much for your expertize! VL -----Original Message----- From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: 2019, September, 27 12:52 PM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 173, Issue 33 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: Enable SNI (Server Name Identification) in TLS connection (Raghunath Adhyapak) ---------------------------------------------------------------------- Message: 1 Date: Fri, 27 Sep 2019 22:22:14 +0530 From: Raghunath Adhyapak <funduraghu(a)gmail.com> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] Enable SNI (Server Name Identification) in TLS connection Message-ID: <CAEiok=Qrmw-s5r-ttRrQyQ+8CSq0BzdXgfzw+L0GhvR0_w-gUg(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" I built from source and tested and it worked fine I need Deb package to ease install on my machines. I can wait for some more time. Raghu On Fri, Sep 27, 2019, 12:35 Gabor Nagy (gnagy) <Gabor.Nagy(a)oneidentity.com> wrote: > If you would like to test before the upcoming release, you can create > a deb package with our docker based package scripts: > https://github.com/syslog-ng/syslog-ng/tree/master/dbld > > depending on your platform, it would be "dbld/rules deb" or > "dbld/rules deb-ubuntu-xenial" > > > Regards, > Gabor > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Thursday, September 26, 2019 15:30 > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Thanks. Now waiting for Debian package > > Raghu > > On Thu, Sep 26, 2019, 18:26 Attila Szakacs (aszakacs) < > Attila.Szakacs(a)oneidentity.com> wrote: > > Hi Raghu, > > It got merged to master! 🙂 > https://github.com/syslog-ng/syslog-ng/pull/2930 > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit > hub.com%2Fsyslog-ng%2Fsyslog-ng%2Fpull%2F2930&data=02%7C01%7Cgabor.nag > y%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e4 > 39c989c1867ec606603%7C0%7C0%7C637051014645449880&sdata=CYEi5latvJWnPQo > 7xYHa3klvdXiNVyXai5PhV51yVeI%3D&reserved=0> > > Best regards, > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Wednesday, September 18, 2019 5:35 PM > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > That's awesome. > > Thanks > Raghu > > On Wed, Sep 18, 2019, 17:05 Attila Szakacs (aszakacs) < > Attila.Szakacs(a)oneidentity.com> wrote: > > To the other question: It will be merged on the master branch probably > in a week. > > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Attila Szakacs (aszakacs) <Attila.Szakacs(a)oneidentity.com> > *Sent:* Wednesday, September 18, 2019 1:28 PM > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Hi Raghu, > > You are welcome! Thanks for the good idea. > If everything goes well, this feature will be released in version > 3.24, in > 3-4 weeks. > The packaging happens at the same time, you will find the 3.24 > installer at > https://download.opensuse.org/repositories/home:/laszlo_budai:/syslog- > ng/ > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdow > nload.opensuse.org%2Frepositories%2Fhome%3A%2Flaszlo_budai%3A%2Fsyslog > -ng%2F&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b0 > 7d408d74285c639%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014 > 645459869&sdata=krct3nD%2BVSMEQG00R0VJO2D1CeLqITAi8ZNTI7mV1a8%3D&reser > ved=0> > > Best regards, > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Wednesday, September 18, 2019 12:50 PM > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Hi Atilla, > > I updated the code, compiled it and tested the changes. > The changes works as expected. > Thanks for the addressing the issue in such a short time. > > Follow-up question: > When will this change get merged into the master branch? > Also, when will this get packaged in Debian package? > > Thanks > Raghu > > On Tue, Sep 17, 2019 at 4:27 PM Attila Szakacs (aszakacs) < > Attila.Szakacs(a)oneidentity.com> wrote: > > Hi Raghu, > > Currently we are not sending SNI extension in the Client Hello message. > However, I made a PR to implement this: > https://github.com/balabit/syslog-ng/pull/2930 > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit > hub.com%2Fbalabit%2Fsyslog-ng%2Fpull%2F2930&data=02%7C01%7Cgabor.nagy% > 40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439 > c989c1867ec606603%7C0%7C0%7C637051014645459869&sdata=IlcWEnngIqkJFPjWv > S7hrar4Tli4Kqgad5IdN7X5WVc%3D&reserved=0> > > Can you build syslog-ng from source? It would be great, if you tested > the PR. > > Best regards, > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Tuesday, September 17, 2019 9:05 AM > *To:* syslog-ng(a)lists.balabit.hu <syslog-ng(a)lists.balabit.hu> > *Subject:* [syslog-ng] Enable SNI (Server Name Identification) in TLS > connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Hi, > > I am using TLS over TCP connection to forward my syslog events to a > remote server. > My remote server uses SNI (Server Name Identification) to route > connections/events to one of the available backend servers. > > I observe that syslog-ng doesn't send SNI during TLS handshake. > > How can I enable it? > > My configuration is as follows: > > =================================== > source s_net { syslog(transport(udp) port(1514)); }; destination d_tcp > { > tcp( > "XX.example.net > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2FXX.e > xample.net&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf4 > 30b07d408d74285c639%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C63705 > 1014645469860&sdata=RTiMaNycpB56zTGx2gmqeFESNI2QO3JvOvSXUyC2MRk%3D&res > erved=0> > " > port(96) > tls( > peer-verify(required-untrusted) > ca_dir("/etc/syslog-ng/ssl") > > key-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.key.pem") > > cert-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.cert.pem") > ) > ); > }; > log { > source(s_net); > destination(d_tcp); > }; > =================================== > > I want syslog-ng to send XX.example.net > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2FXX.e > xample.net&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf4 > 30b07d408d74285c639%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C63705 > 1014645469860&sdata=RTiMaNycpB56zTGx2gmqeFESNI2QO3JvOvSXUyC2MRk%3D&res > erved=0> > as SNI to my remote server > > Please advise > > Thanks > Raghu > > ______________________________________________________________________ > ________ Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flis > ts.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cgabor.na > gy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e > 439c989c1867ec606603%7C0%7C0%7C637051014645479861&sdata=gHBU5J5tU99NDH > J4PwjtxlnS0jVp2Vxh%2BgAuiTsVKaE%3D&reserved=0> > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02 > %7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c63 > 9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014645479861&sdat > a=NmD0lHSiQw0DbM8voUKjVOFX2fSnDwhyqaZvA7%2BBmnA%3D&reserved=0> > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cgabor.nagy%40oneiden > tity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439c989c1867 > ec606603%7C0%7C0%7C637051014645489858&sdata=9VaEY4yqC3Y8y0gQZbVY6M0g%2 > F2rhXsfXRlw2%2Fwbik2s%3D&reserved=0> > > > ______________________________________________________________________ > ________ Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flis > ts.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cgabor.na > gy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e > 439c989c1867ec606603%7C0%7C0%7C637051014645489858&sdata=EWEYbbHYLIenlm > GBceeB%2B0pLauNIABFmT0dt6%2F77TUs%3D&reserved=0> > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02 > %7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c63 > 9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014645499850&sdat > a=mVlgDpNt3RVoHdr7ESi2Im89VnA0W7NOjkQbB11V3LM%3D&reserved=0> > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cgabor.nagy%40oneiden > tity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439c989c1867 > ec606603%7C0%7C0%7C637051014645499850&sdata=mNe53MBvTKfpkm1a%2FS6rEvCt > YPwO3Pfjca0jLyPNeqw%3D&reserved=0> > > > ______________________________________________________________________ > ________ Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flis > ts.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cgabor.na > gy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e > 439c989c1867ec606603%7C0%7C0%7C637051014645509849&sdata=YUrhyXSF6MkgRf > RsxlOWqsSBsedoNo8UPb292Y0vTps%3D&reserved=0> > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02 > %7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c63 > 9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014645509849&sdat > a=I2zhc1DPDcvLEShMr4v2V2MgtEZf72oDOvqx%2F607r%2BA%3D&reserved=0> > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cgabor.nagy%40oneiden > tity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439c989c1867 > ec606603%7C0%7C0%7C637051014645519834&sdata=eicWBDsPB4aguw98EKqegLs0ZB > NcHmbifbm8lEFeKF0%3D&reserved=0> > > > ______________________________________________________________________ > ________ Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190927/04aa6f04/a…> ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng ------------------------------ End of syslog-ng Digest, Vol 173, Issue 33 ****************************************** _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future.

2 1

Enable SNI (Server Name Identification) in TLS connection
by Raghunath Adhyapak 27 Sep '19

27 Sep '19

Hi, I am using TLS over TCP connection to forward my syslog events to a remote server. My remote server uses SNI (Server Name Identification) to route connections/events to one of the available backend servers. I observe that syslog-ng doesn't send SNI during TLS handshake. How can I enable it? My configuration is as follows: =================================== source s_net { syslog(transport(udp) port(1514)); }; destination d_tcp { tcp( "XX.example.net" port(96) tls( peer-verify(required-untrusted) ca_dir("/etc/syslog-ng/ssl") key-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.key.pem") cert-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.cert.pem") ) ); }; log { source(s_net); destination(d_tcp); }; =================================== I want syslog-ng to send XX.example.net as SNI to my remote server Please advise Thanks Raghu

3 9

Generate filename with part of message.
by William Luiz Ribeiro Vasconcelos Da Silva 26 Sep '19

26 Sep '19

Hello every one!, It's possible get part of the message obtained by syslog-ng to compose the file name. For example: The message: 2019-09-05;18:11:47;BLM0102-SP2[FWNAT]:ASP_NAT_PORT_BLOCK_ALLOC:;100.86.147.89;189.40.100.001:12800-12815 Expected filename: BLM0102-SP2_2019-09-05_18:11:47.syslog-ng How can I do to generate this nomenclature? Tks! Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada para recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteúdo. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto

2 1

OS Support Version for syslog-ng
by William Luiz Ribeiro Vasconcelos Da Silva 26 Sep '19

26 Sep '19

Hello Every one, Does SYSLOG-NG PE support RHEL version 7.7? Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada para recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteúdo. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto

1 0

Help needed in configuration file upgrade (from syslog-ng-3.11.1 to syslog-ng-3.23.1)
by Debananda Pal 26 Sep '19

26 Sep '19

Hi All, Sorry to send the mail to all as I am not aware about individual email id. I am trying to upgrade syslog-ng from 3.11.1 to 3.23.1 on Linux and finding some issues as below. I have changed few parameters like version, include, but at present getting error with file() configuration. ------------------------------------------------------------------------------------- ~ # /sbin/syslog-ng -f /tandberg/persistent/syslog-ng.conf -p /var/run/syslog-ng.pid [2019-09-25T13:40:11.707232] WARNING: Your configuration file uses an obsoleted keyword, please update your configuration; key word='flush_timeout', change='Some drivers support batch-timeout() instead that you can specify at the destination level.', lo cation='#buffer:15:5' *Error parsing source statement, source plugin file not found in /tandberg/persistent/syslog-ng.conf:31:5-31:9:* 26 27 # Sources 28 29 source s_everything { 30 internal(); 31----> file("/proc/kmsg" log_fetch_limit(100) log_iw_size(100)); 31----> ^^^^ 32 unix_dgram("/var/log/log" log_fetch_limit(100) log_iw_size(100)); 33 udp(ip(127.0.0.1) port(514) log_fetch_limit(100) log_iw_size(100)); 34 }; 35 36 # Destinations syslog-ng documentation: https://www.balabit.com/support/documentation?product=syslog-ng-ose contact: https://lists.balabit.hu/mailman/listinfo/syslog-ng ~ # ------------------------------------------------------------------------------------- I have attached the syslog-ng.conf file for your kind perusal. Please give your suggestion on the modified config file. Regards, D Pal

2 4

Disregard source if it fails
by Faine, Mark R. (MSFC-IS40)[NICS] 23 Sep '19

23 Sep '19

We have a requirement to send all our logs to two other servers so we have those configured as destinations in our configuration. However, sometimes their servers go down and the result is that we stop logging anything at all. Is there a way to disable those servers, either temporarily or until restarted if we can't connect? Thanks, -Mark Mark Faine System Administrator SAIC/NICS 215 Wynn Dr. 5065 Huntsville, AL 35805 256-961-1295 (Desk) 256-617-4861 (Work Cell)

2 2

Use jemalloc
by Jean-Baptiste Fuzier 19 Sep '19

19 Sep '19

Hi, I am having high memory usage with v3.23, as suggested in some tickets, I am trying to switch to jemalloc to see if there is any improvement. However I cannot use LD_PRELOAD as I am running syslogng as a standard user (setuid + setcap to bind to a port <1024). I can easily get rid of the setuid part, however I do not see how to get rid of the setcap beside using an ugly iptables trick. Or any solution for those : 1/ Syslogng runned as root (for port binding) then dropping to standard user ? 2/ Get LD_PRELOAD to work with setcap binaries ? 3/ build syslogng (link?) against jemalloc ? 4/ Manage to have ld.preload limited to an user or binary ? Thanks for your help -- Jean-Baptiste Fuzier

1 1

Error binding socket UDP
by William Luiz Ribeiro Vasconcelos Da Silva 18 Sep '19

18 Sep '19

Good Mornig Every one, How should I to corret the problema presented in the log below: Error binding socket; addr='AF_INET(10.178.40.247:514)', error='Cannot assign requested address (99)' Set 18 10:32:14 centosServerVirtual syslog-ng[1809]: [2019-09-18T10:32:14.855778] Error initializing message pipeline; plugin_name='udp', location='/etc/syslog-ng/syslog-ng.conf:33:4' My configuration on syslog-ng.conf is that: source s_net { udp(ip(10.178.40.247) port(514)); }; Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada para recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteúdo. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto

2 1