December 2020 - syslog-ng - lists.balabit.hu

Filter matching not working
by Saqib M 09 Dec '20

09 Dec '20

Greetings - I have been trying to create a very basic filter that looks up a string in the incoming log. However, it would not match any filter and would go to the default filter. I have tried both match() and message(), neither worked for me. Please let me know if you think I am missing something. Following are the chunks from the syslog-ng.conf source s_net { # All syslog traffic on port 514 - this is direct from network devices. udp(port (514)); network(transport("tcp") max-connections(20000) log_iw_size(100000000) ); # tags("fortigate", "cisco", "default") ); }; filter f_discreg { message("default send string") }; log { source(s_net); filter(f_dlptracker); destination(d_dlptracker); flags(final); }; Here is the log from the test I ran. [2020-12-02T22:00:36+0000] Incoming log entry; source='s_net#0', line='default send string' [2020-12-02T22:00:46+0000] Filter node evaluation result; filter_result='not-match', filter_type='OR' [2020-12-02T22:00:46+0000] Filter rule evaluation result; filter_result='not-match', filter_rule='f_tanium' [2020-12-02T22:00:46+0000] Filter rule evaluation begins; filter_rule='f_palo_alto' [2020-12-02T22:00:46+0000] Filter node evaluation result; filter_result='not-match' [2020-12-02T22:00:46+0000] Filter node evaluation result; filter_result='not-match' [2020-12-02T22:00:46+0000] Filter node evaluation result; filter_result='not-match' [2020-12-02T22:00:46+0000] Filter node evaluation result; filter_result='not-match', filter_type='OR' [2020-12-02T22:00:46+0000] Filter node evaluation result; filter_result='not-match', filter_type='OR' [2020-12-02T22:00:46+0000] Filter rule evaluation result; filter_result='not-match', filter_rule='f_palo_alto' [2020-12-02T22:00:46+0000] Filter rule evaluation begins; filter_rule='f_dlptracker' [2020-12-02T22:00:46+0000] Filter node evaluation result; filter_result='not-match' [2020-12-02T22:00:46+0000] Filter rule evaluation result; filter_result='not-match', filter_rule='f_dlptracker' [2020-12-02T22:00:46+0000] Outgoing message; destination='d_fallback#0', message='2020-12-02T22:00:46+00:00 172.17.236.3 default send string\x0a' Regards, Saqib M Cybersecurity Co-op Global Cybersecurity Technologies Email: saqib.m(a)cummins.com<mailto:saqib.m@cummins.com> Cummins Inc.

4 5

Syslog-ng Windows Agent
by Nik Ambrosch 08 Dec '20

08 Dec '20

Hi, I was wondering if there is an OSE syslog-ng windows agent or if that's PE only? The "officially supported binaries" link is broken (bottom of the page) - https://www.syslog-ng.com/products/open-source-log-management/3rd-party-bin… We have some windows servers that I'd like to integrate into our log management system and the built-in syslog support is... not great. Thanks.

2 1

Don't change permissions
by Faine, Mark R. (MSFC-IS40)[NICS] 08 Dec '20

08 Dec '20

I'm monitoring the ACL on log files with monit and comparing them to a known good ACL to make sure everything is correct and running a correction script in response to a failure, my problem is that my compare keeps failing because syslog-ng is changing the effective permissions. Is there a way I can disable this? Thanks, -Mark

2 1

Re: [syslog-ng] syslog-ng version 26.1 running in a docker image from docker hub (balabit/syslog-ng)
by Martin, Uwe 01 Dec '20

01 Dec '20

Hello Laci, thanks for your support and sorry for the delay. After some debugs and installing the old version 3.5.6 on the host again, which was also not working I found the problem in the secondary ip address we used on the host. After removing the secondary address syslog-ng is working again without a problem. At the moment we will use this old version, but I will try to use the docker version on a test system to check if it works again and we can use the new features of the 3.29 version. Thanks again and kind regards Kind regards Uwe Von: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> Im Auftrag von Laszlo Szemere (lszemere) Gesendet: Freitag, 13. November 2020 12:04 An: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Betreff: Re: [syslog-ng] syslog-ng version 26.1 running in a docker image from docker hub (balabit/syslog-ng) CAUTION: This e-mail is from an external sender. Do not click links or open attachments unless you recognize the sender and know the content is safe. Never provide your password! Hello Uwe, first of all: thank you for sharing your config and exact Syslog-ng versions. It helps a lot. At first look I cannot see any problem with your config. However, there were a lot of changes between version 3.5.6 and 3.26.1 (You might want to take a look at "cisco-parser()") If you suspect this is a filter problem, may I suggest starting Syslog-ng in a debug mode? example: https://github.com/balabit/syslog-ng-docker/issues/58#issuecomment-680674916 In this case you should see messages like: >>>>>> filter rule evaluation begin; rule='foobar', location='/conf/syslog-ng.conf:15:16', msg='0x7efd38015c40' <<<<<< filter rule evaluation result; result='UNMATCHED - Dropping message from LogPipe', rule='foobar', location='/conf/syslog-ng.conf:15:16', msg='0x7efd38015c40' If this does not help finding the problematic filter, I might need some example logs to trace down any parsing issues. Best regards, Laci ________________________________ From: syslog-ng on behalf of Martin, Uwe Sent: Friday, November 13, 2020 11:15 To: syslog-ng(a)lists.balabit.hu<mailto:syslog-ng@lists.balabit.hu> Subject: [syslog-ng] syslog-ng version 26.1 running in a docker image from docker hub (balabit/syslog-ng) CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe. Hello, We have a problem after an upgrade form syslog-ng version 3.5.6 to version 26.1 in a docker container. CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES d8c8c3380a71 balabit/syslog-ng:3.26.1 "/usr/sbin/syslog-..." About an hour ago Up About an hour Now not all logs from the devices are seen and forwarding to another log gateway is also not working. With tcpdump I see the packets on the interface. I seems some filter will not work. I add our config. Anybody an idea how to troubleshoot or fix this problem? Kind regards Uwe Festo SE & Co. KG Uwe Martin Abteilung IM-IHN IT Communication Networks Gottlieb-Stoll-Straße 29 66386 St. Ingbert Deutschland Telefon +49(6894)591-6323 Telefax +49(711)34754-6323 http://www.festo.com Der Inhalt dieser E-Mail und moeglicher Anhaenge sind ausschliesslich fuer den bezeichneten Adressaten bestimmt. Jede Form der Kenntnisnahme, Veroeffentlichung, Vervielfaeltigung oder Weitergabe des Inhalts dieser E-Mail und moeglicher Anhaenge durch unberechtigte Dritte ist unzulaessig. Wir bitten Sie, sich mit dem Absender der E-Mail in Verbindung zu setzen, falls Sie nicht der Adressat dieser E-Mail sind sowie das Material von Ihrem Computer zu loeschen. This e-mail and any attachments are confidential and intended solely for the addressee. The perusal, publication, copying or dissemination of the contents of this e-mail by unauthorised third parties is prohibited. If you are not the intended recipient of this e-mail, please delete it and immediately notify the sender. Rechtsform: Kommanditgesellschaft, Sitz: Esslingen a.N., Registergericht Stuttgart HRA 211583, Umsatzsteuerident-Nummer: DE 145339206 Persoenlich haftende Gesellschafterin: Festo Management SE, Sitz: Frankfurt a.M., Registergericht Frankfurt a.M., HRB 115998 Vorstand: Dipl.-Ing. Gerhard Borho, Dipl.-Ing. Dr. h.c. Oliver D. Jung (Vorsitzender), Dr. Ansgar Kriwet, Dr. Frank Melzer, Dipl.-Ing. (FH) Frank Notz, Dr. Jaroslav Patka Aufsichtsratsvorsitzender: Dr. Friedrich Eichiner Bitte beachten Sie: die Festo AG & Co. KG firmiert seit 31.01.2020 unter Festo SE & Co. KG. Please note, on 2020-01-31 Festo AG & Co. KG changed its company name to Festo SE & Co. KG.

1 0