April 2020 - syslog-ng - lists.balabit.hu

Syslogs not writing to disk
by Rose, Ed 05 May '20

05 May '20

Hello All, I have syslog-ng setup currently setup to write to disk and forward events on to a different syslog server. Syslog isn't writing to disk it seems. I do not see any errors either, unless I am not looking in the right place for the errors. Tcpdump -v host x.x.x.x shows data coming in from the host but a tail -f ${HOST}/log_${HOST} shows no logs going to disk. Thanks Ed syslog-ng 3 (3.14.1) Config version: 3.14 Installer-Version: 3.14.1 Revision: Module-Directory: /usr/lib64/syslog-ng Module-Path: /usr/lib64/syslog-ng Available-Modules: afmongodb,sdjournal,linux-kmsg-format,appmodel,date,pseudofile,afamqp,syslogformat,csvparser,cef,tags-parser,affile,afsocket,afstomp,tfgetent,json-plugin,confgen,system-source,stardate,graphite,dbparser,afprog,xml,add-contextual-data,snmptrapd-parser,cryptofuncs,kvformat,disk-buffer,basicfuncs,afuser,map-value-pairs Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: on Enable-Systemd: on filter f_awanra1 { host("x.x.x.x"); }; filter f_bwanra1 { host("x.x.x.x"); }; filter f_cwanra1 { host("x.x.x.x"); }; destination d_ciscoasa { file("/var/log2/gns/cisco_asa/${HOST}/log_${HOST}" create-dirs(yes) dir-perm(0755) dir-group(splunk) perm(0640) group(splunk)); }; destination d_uid1 { tcp("x.x.x.x" port(514) ); }; destination d_uid2 { tcp("x.x.x.x" port(514) ); }; destination d_uid3 { tcp("x.x.x.x" port(514) ); }; destination d_uid4 { tcp("x.x.x.x" port(514) ); }; log { source(s_net); filter(f_amywanra1); destination(d_ciscoasa); destination(d_uid1); destination(d_uid2); destination(d_uid3); destination(d_uid4); flags(final); }; log { source(s_net); filter(f_cnswanra1); destination(d_ciscoasa); destination(d_uid1); destination(d_uid2); destination(d_uid3); destination(d_uid4); flags(final); }; log { source(s_net); filter(f_demwanra1); destination(d_ciscoasa); destination(d_uid1); destination(d_uid2); destination(d_uid3); destination(d_uid4); flags(final); };

2 8

syslog-ng 3.27 Debian/Ubuntu packages (OBS)
by Laszlo Budai 30 Apr '20

30 Apr '20

Hi, syslog-ng 3.27.1[1] packages are available in OBS repositories[2, 3]. List of supported OSs: * Debian 9.0 * Debian 10.0 * Raspbian 9.0 * Raspbian 10.0 * Ubuntu 16.04 * Ubuntu 18.04 * Ubuntu 18.10 * Ubuntu 19.04 * Ubuntu 19.10 * Ubuntu 20.04 Install ------- example: Debian 9.0 1. get release key wget -qO - http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… | sudo apt-key add - 2. add repo to APT sources eg.: /etc/apt/sources.list.d/syslog-ng-obs.list deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… ./ Then `apt-get update` and `apt-get install syslog-ng-core` Links -------- [1] https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.27.1 [2] https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-… [3] https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-… regards, Laszlo Budai

1 0

syslog-ng 3.27
by Laszlo Budai 30 Apr '20

30 Apr '20

3.27.1 Highlights * DESTIP/DESTPORT/PROTO: new macros. (#2899<https://github.com/syslog-ng/syslog-ng/pull/2899>) * set-facility(): add new rewrite operation to change the syslog facility associated with the message. (#3136<https://github.com/syslog-ng/syslog-ng/pull/3136>) * network tls: Added ca-file() option. With this option the user can set a bundled CA-file to verify the peer. (#3145<https://github.com/syslog-ng/syslog-ng/pull/3145>) * Forward integrity and confidentiality of logs (#3121<https://github.com/syslog-ng/syslog-ng/pull/3121>): It is an experimental feature currently, we are still working on the final form with the authors. Features * DESTIP/DESTPORT/PROTO: new macros These new macros express the destination ip, destination port and used protocol on a source. The use-case behind the PR is as follows: * someone has an appliance which sends out log messages via both UDP and TCP * the format of the two are different, and he wants to capture either with the simplest possible filter * netmask() doesn't work because the IP addresses are the same * host() doesn't work because the hostnames are the same Example: log { source { network(localip(10.12.15.215) port(5555) transport(udp)); }; destination { file("/dev/stdout" template("destip=$DESTIP destport=$DESTPORT proto=$PROTO\n")); }; }; Output: destip=10.12.15.215 destport=5555 proto=17 (#2899<https://github.com/syslog-ng/syslog-ng/pull/2899>) * set-facility(): add new rewrite operation to change the syslog facility associated with the message. log { source { system(); }; if (program("postfix")) { rewrite { set-facility("mail"); }; }; destination { file("/var/log/mail.log"); }; flags(flow-control); }; (#3136<https://github.com/syslog-ng/syslog-ng/pull/3136>) * network tls: Added ca-file() option. With this option the user can set a bundled CA-file to verify the peer. (#3145<https://github.com/syslog-ng/syslog-ng/pull/3145>) * http: When a HTTP response is received, emit a signal with the HTTP response code. (Later it can be extended to read the response and parse it in a slot...). This PR also extends the Python HTTP header module with the possibility of writing custom HTTP response code handlers. When someone implements an auth header plugin in Python, it could be useful (for example invalidating a cache). Example config, click to expand! (#3159<https://github.com/syslog-ng/syslog-ng/pull/3159>) * java/python: add support for the "arrow" syntax. options("key" => "value") (#3161<https://github.com/syslog-ng/syslog-ng/pull/3161>) (#3247<https://github.com/syslog-ng/syslog-ng/pull/3247>) * python: persist support for python This feature enables users to persist data between reloads or restarts. The intended usage is to support bookmarking and acknowledgement in the future. It is not suitable for local database use cases. (#3171<https://github.com/syslog-ng/syslog-ng/pull/3171>) * rewrite: Added conditional set-tag() option. With this option the user can put condition statement inside set-tag option. rewrite { set-tag("tag" condition(match("test" value("MSG")))); }; (#3190<https://github.com/syslog-ng/syslog-ng/pull/3190>) * scl: add sumologic destinations: sumologic-syslog() and sumologic-http() (#3194<https://github.com/syslog-ng/syslog-ng/pull/3194>) * iterate: new template function The iterate template function generates a series from an initial number and a next function. For example you can generate a sequence of nonnegative numbers with source { example-msg-generator( num(3) template("$(iterate $(+ 1 $_) 0)") ); }; (#3205<https://github.com/syslog-ng/syslog-ng/pull/3205>) * telegram: new max-size option Telegram message will be truncated for max-size size. Telegram does not accept message larger than 4096 utf8 characters. The default value is 4096. (#3206<https://github.com/syslog-ng/syslog-ng/pull/3206>) * example-message-generator : add support for values(name1 => value1, name2 => value2,..) syntax. Example @version: 3.27 log { source { example-msg-generator(template("message parameter") num(10) values("PROGRAM" => "program-name" "current-second" => "$C_SEC" )); }; destination { file(/dev/stdout template("$(format-json --scope all-nv-pairs)\n")); }; }; (#3237<https://github.com/syslog-ng/syslog-ng/pull/3237>) * example-msg-generator: support freq(0) for fast message generation log { source { example-msg-generator(freq(0) num(100)); }; destination { file("/dev/stdout"); }; }; (#3245<https://github.com/syslog-ng/syslog-ng/pull/3245>) Bugfixes * file: changed time-reap() timer's schedule to respect the documentation (expires after last message) (#3133<https://github.com/syslog-ng/syslog-ng/pull/3133>) * dbld: fix building problems * fix rpm package build on centos-7 * fix devshell image build * fix ubuntu-trusty image build * fix deb package build on ubuntu-trusty * fix rpm package build on fedora-30 (#3143<https://github.com/syslog-ng/syslog-ng/pull/3143>) * tls (network): Properly log an error message, when key-file() or cert-file() is missing. (#3145<https://github.com/syslog-ng/syslog-ng/pull/3145>) * loggen: fix crash with invalid parameterization (#3146<https://github.com/syslog-ng/syslog-ng/pull/3146>) * format-json: fix printing of embedded zeros Prior to 2.64.1, g_utf8_get_char_validated() in glib falsely identified embedded zeros as valid utf8 characters. As a result, format json printed the embedded zeroes as \u0000 instead of \x00. This change fixes this problem. (#3175<https://github.com/syslog-ng/syslog-ng/pull/3175>) * configure: fix --with-net-snmp configure option (#3180<https://github.com/syslog-ng/syslog-ng/pull/3180>) * python: fix Py_None reference counting in logger methods (trace, debug, info, warning, error) (#3187<https://github.com/syslog-ng/syslog-ng/pull/3187>) * afmongodb: do not build module when ENABLE_MONGODB=OFF (#3188<https://github.com/syslog-ng/syslog-ng/pull/3188>) * telegram: automatically truncate messages larger than 4096 utf8 characters to avoid telegram destination to get stuck (#3206<https://github.com/syslog-ng/syslog-ng/pull/3206>) * compat/glib: fix recursive call issue on CentOS-6/RHEL-6/platforms (#3212<https://github.com/syslog-ng/syslog-ng/pull/3212>) * timeutils: fix crash in %f conversion when non-numeric character is in usec field (e.g. ".asd123") (#3270<https://github.com/syslog-ng/syslog-ng/pull/3270>) Packaging * macOS: add example startup configuration. (#3172<https://github.com/syslog-ng/syslog-ng/pull/3172>) * rpm: fix --without maxminddb option If maxminddb development package was installed on the build system: rpmbuild fails if --without maxminddb was used. (#3208<https://github.com/syslog-ng/syslog-ng/pull/3208>) Notes to developers * light: Support to relocate reports dir other than current base dir For example python -m pytest -lvs functional_tests/source_drivers/file_source/test_acceptance.py --installdir=/install --reports /tmp/ (#3157<https://github.com/syslog-ng/syslog-ng/pull/3157>) * CONTRIBUTING.md: contribution guide updated (#3174<https://github.com/syslog-ng/syslog-ng/pull/3174>) * libtest: Now we install config_parse_lib.h, fake-time.h, mock-cfg-parser.h and queue_utils_lib.h which help unit testing outside of core. (#3179<https://github.com/syslog-ng/syslog-ng/pull/3179>) * tests: Wait until snmptrapd process able to write traps into output file (#3185<https://github.com/syslog-ng/syslog-ng/pull/3185>) * mongodb: Replaced the deprecated get_server_status() API with command_simple(). This means, that syslog-ng can now be built with -Werror on systems with 1.15 libmongoc. (#3199<https://github.com/syslog-ng/syslog-ng/pull/3199>) * stats: add external stats counters There are situations when someone wants to expose internal variables through stats-api. Without this changeset, we need two distinct variables: one is for the internal state, other is for the stats registration (internal state cannot depends on the life cycle of the StatsCounterGroup). (#3225<https://github.com/syslog-ng/syslog-ng/pull/3225>) Other changes * afsnmp: merge two existing SNMP modules (trapd-parser and destination) into one. Motivation: keep closely related modules together and decrease the number of small packages. Packaging related changes: libsnmptrapd-parser.so has been removed, both the snmp destination and the trapd parser are part of afsnmp.so . * deb: we already had mod-snmp which shipped snmp-dest. From now, this packages installs the snmptrapd-parser syslog-ng module. The syslog-ng-mod-snmptrapd-parser package has been removed. * rpm: snmpdest renamed to afsnmp and the snmptrapd-parser is installed by this package from now (#3142<https://github.com/syslog-ng/syslog-ng/pull/3142>) * dbld: remove ubuntu-cosmic as it has reached EOL (#3143<https://github.com/syslog-ng/syslog-ng/pull/3143>) * afsocket-source: present the number of connections in stats It helps in the debug process if we can see the number of source connections counted by syslog-ng internally. (#3193<https://github.com/syslog-ng/syslog-ng/pull/3193>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Airbus Commercial Aircraft, Andras Mitzki, Antal Nemes, Attila Szakacs, Balazs Scheidler, Gabor Nagy, Kokan, Laszlo Budai, Laszlo Szemere, László Várady, Mehul Prajapati, Roberto Meléndez, Stephan Marwedel, Steven Haigh, Peter Czanik, Thomas De Schampheleire, Vatsal Sisodiya, Vivin Peris https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-3.27.1

1 0

Issue with processing syslog event
by Raghunath Adhyapak 29 Apr '20

29 Apr '20

Hello all, I am receiving the following syslog line from one of devices. <134>1 1588062776.725141502 C0493 flows allow src=10.0.31.145 dst=9.9.9.9 Mac=F1:37:59:38:BA:F8 protocol=udp sport=50307 dport=53 This line contains a version filed immediately following the priority, and then timestamp is in epoch format as against ISO8601 or other standard format. I see the following error in syslog-ng log: [2020-04-28T10:46:15.340911] Outgoing message; message='Apr 28 10:46:15 ip-172-31-240-95 syslog-ng[27873]: Error processing log message: <134>1>@< 1588062776.725141502 C0493 flows allow src=10.0.31.145 dst=9.9.9.9 mac=F1:37:59:38:BA:F8 protocol=udp sport=50307 dport=53' What could be the possible issue here? My config is as follows: ##======================================== ######################## # Global options ######################## options {keep_hostname (yes); use_dns (no); mark-freq(30);}; ######################## # Sources ######################## source s_syslog { syslog( transport(udp) port(514) max-connections(500) ); }; ######################## # Destinations ######################## destination d_file { file("/var/log/dump.log"); }; ######################## # Log paths ######################## log { source(s_syslog); destination(d_file); flags(flow-control); }; ##======================================== If I check my file /var/log/dump.log, I see that the error line is getting written to it too. root@ip-172-31-240-95:~# tail -f /var/log/dump.log | grep "Error processing" Apr 28 10:44:46 ip-172-31-240-95 syslog-ng[27873]: Error processing log message: <134>1>@< 1588062776.725141502 C0493 flows allow src=10.0.31.145 dst=9.9.9.9 mac=F1:37:59:38:BA:F8 protocol=udp sport=50307 dport=53 Apr 28 10:46:15 ip-172-31-240-95 syslog-ng[27873]: Error processing log message: <134>1>@< 1588062776.725141502 C0493 flows allow src=10.0.31.145 dst=9.9.9.9 mac=F1:37:59:38:BA:F8 protocol=udp sport=50307 dport=53 Thanks Raghu

3 5

Syslog-ng network namespace support
by Monitto Pitchaimani sebastin (mopitcha) 28 Apr '20

28 Apr '20

Hi All, Does syslog-ng supports log forwarding to remote host in different network namespaces? Regards, Monitto

3 5

Re: [syslog-ng] syslog-ng, json and handle escaping properly
by Arthur Lambert 27 Apr '20

27 Apr '20

> log { > source { example-msg-generator(num(1) template("{\"category\":\"BOOT\",\"level\":\"INFO\",\"message\":\"Check pstore partition..\"}")); }; > parser { json-parser(); }; > destination { file(/dev/stdout template("$(format-json --key category,level,message timestamp=${ISODATE})\n")); }; >}; Ok so first I update the syslog-ng config file with your modification diff --git a/board/xxx/xxx/rootfs/etc/syslog-ng.conf b/board/xxx/xxx/rootfs/etc/syslog-ng.conf index c28ea5e59d..6b93ce24b8 100644 --- a/board/xxx/xxx/rootfs/etc/syslog-ng.conf +++ b/board/xxxx/xxx/rootfs/etc/syslog-ng.conf @@ -4,10 +4,6 @@ filter f_middleware { facility("local1"); }; -template t_json_filetemplate { - template("{\"timestamp\":\"${ISODATE}\",${MESSAGE}\n"); -}; source s_kernel { file("/proc/kmsg" program_override("kernel")); }; @@ -21,7 +17,8 @@ destination d_kernel { }; destination d_middleware { - file("/data/logs/middleware.log", template(t_json_filetemplate)); + file(/data/logs/middleware.log template("$(format-json --key category,level,message timestamp=${ISODATE})\n"));; + }; log { @@ -31,6 +28,7 @@ log { log { source(s_middleware); + parser { json-parser(); }; filter(f_middleware); destination(d_middleware); }; I also add the '{' in my macro log diff --git a/log/log_private.h b/log/log_private.h index b1e2dd31..09e875e1 100644 --- a/log/log_private.h +++ b/log/log_private.h @@ -18,7 +18,7 @@ #define _PRINT_DEBUG(M, ...) \ do { \ - syslog(LOG_DEBUG, "\"category\":\"%s\",\"level\":\"DEBUG\",\"message\":\"" M "%s\"}\n", __DIR__, __VA_ARGS__); \ + syslog(LOG_DEBUG, "{\"category\":\"%s\",\"level\":\"DEBUG\",\"message\":\"" M "%s\"}\n", __DIR__, __VA_ARGS__); \ } while (0) #else @@ -28,32 +28,32 @@ #define _PRINT_INF_GOTO(M, ...) \ do { \ - syslog(LOG_DEBUG, "\"category\":\"%s\",\"level\":\"INFO\",\"message\":\"" M "%s\"}\n", __DIR__, __VA_ARGS__); \ + syslog(LOG_DEBUG, "{\"category\":\"%s\",\"level\":\"INFO\",\"message\":\"" M "%s\"}\n", __DIR__, __VA_ARGS__); \ errno = 0; \ goto error; \ (...) #endif /* !LOG_PRIVATE_H_ */ So basically I suppose that your modification allows to syslog-ng to understand by itself that there is an extra pair key/value in my format and that I am using JSON format. So let's do some test now... int main (void) { PRINT_DEBUG ("Test simple."); PRINT_DEBUG ("\nTest with return line\n."); PRINT_DEBUG ("Test with json inside message : {\"key\" : \"%d\", \"key2\" : \"%d\"} ", 42, 21); PRINT_DEBUG ("Test simple2."); PRINT_DEBUG ("Begin. Program name : %s", argv[0]); (...) } Result : # cat /data/logs/middleware.log {"timestamp":"2020-04-24T15:36:28+02:00","message":"Test simple.","level":"DEBUG","category":"MPU_CORE"} {"timestamp":"2020-04-24T15:36:28+02:00","message":"Test simple2.","level":"DEBUG","category":"MPU_CORE"} {"timestamp":"2020-04-24T15:36:28+02:00","message":"Begin. Program name : nano_core","level":"DEBUG","category":"MPU_CORE"} {"timestamp":"2020-04-24T15:36:28+02:00","message":"Board config : nano_proto1","level":"DEBUG","category":"MPU_CORE"} {"timestamp":"2020-04-24T15:36:28+02:00","message":"Initialize GPIO..","level":"INFO","category":"GPIO_MANAGER"} {"timestamp":"2020-04-24T15:36:28+02:00","message":"Synchronize dictionnary with current rootfs content","level":"INFO","category":"AUDIO_MANAGER"} As you can see, the line with \n and the JSON debug output is not in the final log. It was not in a good format for the JSON syslog-ng parser. How can I fix that? Now that syslog-ng is able to understand that there is a category, a level, a message in my JSON. I cannot just ask for syslog-ng to use the escape template only on the column with message key before sending the message to the parser? I am able to fix the \n issue by using unix-dgram instead of unix-stream but without really understand why. New result after using unix-dgram : {"timestamp":"2020-04-24T15:58:09+02:00","message":"Test simple.","level":"DEBUG","category":"MPU_CORE"} {"timestamp":"2020-04-24T15:58:09+02:00","message":"\nTest with return line\n.","level":"DEBUG","category":"MPU_CORE"} {"timestamp":"2020-04-24T15:58:09+02:00","message":"Test simple2.","level":"DEBUG","category":"MPU_CORE"} {"timestamp":"2020-04-24T15:58:09+02:00","message":"Begin. Program name : nano_core","level":"DEBUG","category":"MPU_CORE"}

2 1

syslog-ng, json and handle escaping properly
by Arthur Lambert 24 Apr '20

24 Apr '20

Hello, I tried to migrate from syslog to Syslog-ng. I am trying to deploy it on an embedded target with buildroot. At the same time, I also tried to switch log format to JSON. In my c code, I use Syslog function and init with the openlog function: openlog("middleware", 0, LOG_LOCAL1); I have some macro to generate the json logs: #define _PRINT_DEBUG(M, ...) \ do { \ syslog(LOG_DEBUG, "\"category\":\"%s\",\"level\":\"DEBUG\",\"message\":\"" M "%s\"}\n", __DIR__, __VA_ARGS__); \ } while (0) I define a syslog-ng conf file: @version: 3.2X filter f_middleware { facility("local1"); }; template t_json_filetemplate { template("{\"timestamp\":\"${ISODATE}\",${MESSAGE}\n"); }; source s_kernel { file("/proc/kmsg" program_override("kernel")); }; source s_middleware { unix-stream("/dev/log"); }; destination d_kernel { file("/data/logs/kern.log"); }; destination d_middleware { file("/data/logs/middleware.log", template(t_json_filetemplate)); }; log { source(s_kernel); destination(d_kernel); }; log { source(s_middleware); filter(f_middleware); destination(d_middleware); }; So basically I want to redirect all my log from my code in /data/logs/middleware.log. I also want to redirect all kernel logs in /data/logs/kern.log I have two issues. The first one is escaping. If I want to print a JSON file the double quote will be not escaped. My first solution was to use escape feature from Syslog-ng: destination d_middleware { file("/data/logs/middleware.log", template("{\"timestamp\":\"${ISODATE}\",${MESSAGE}\n") template-escape(yes)); }; Problem is that now everything is escaped and not only the message, some example: {"timestamp":"2020-04-21T09:24:02+02:00",\"category\":\"BOOT\",\"level\":\"INFO\",\"message\":\"Check pstore partition..\"} {"timestamp":"2020-04-21T09:24:02+02:00",\"category\":\"BOOT\",\"level\":\"INFO\",\"message\":\"Start hardware watchdog daemon...\"} {"timestamp":"2020-04-21T09:24:02+02:00",\"category\":\"BOOT\",\"level\":\"INFO\",\"message\":\"Prepare asound configuration...\"} {"timestamp":"2020-04-21T09:24:02+02:00",\"category\":\"BOOT\",\"level\":\"INFO\",\"message\":\"Middleware is about to start...\"} {"timestamp":"2020-04-21T09:24:03+02:00",\"category\":\"BOOT\",\"level\":\"INFO\",\"message\":\"Load sdma firmware..\"} {"timestamp":"2020-04-21T09:24:03+02:00",\"category\":\"BOOT\",\"level\":\"INFO\",\"message\":\"Watchdog is about to start...\"} {"timestamp":"2020-04-21T09:24:03+02:00",\"category\":\"BOOT\",\"level\":\"INFO\",\"message\":\"Start mpu watchdog..\"} As you can see, everything is escaped because for Syslog-ng, everything is the message and not only the final part. I feel like I am completely using Syslog-ng in the wrong way right? How can I fix that? Do I have to handle escaping by myself manually in my middleware? Do I have to pre-process all logs manually by myself? It seems quite awful. I have a second issue which is probably related? When I tried to print the content of a file, the last '}' is truncated. The reason seems to be related to the presence of \n. I can reproduce the issue by just calling my PRINT_DEBUG macro as follow: PRINT_DEBUG ("YO YO YO KO\n"); PRINT_DEBUG ("YO YO YO OK"); The result: {"timestamp":"2020-04-21T09:24:03+02:00",\"category\":\"MPU_CORE\",\"level\":\"DEBUG\",\"message\":\"YO YO YO KO {"timestamp":"2020-04-21T09:24:03+02:00",\"category\":\"MPU_CORE\",\"level\":\"DEBUG\",\"message\":\"YO YO YO OK\"} My syslog version/module information : # syslog-ng -V -s syslog-ng 3 (3.26.1) Config version: 3.22 Installer-Version: 3.26.1 Revision: Compile-Date: Apr 10 2020 16:41:46 Module-Directory: /usr/lib/syslog-ng Module-Path: /usr/lib/syslog-ng Include-Path: /usr/share/syslog-ng/include Available-Modules: add-contextual-data,affile,afprog,afsocket,afstomp,afuser,appmodel,azure-auth-header,basicfuncs,cef,confgen,cryptofuncs,csvparser,dbparser,disk-buffer,examples,graphite,hook-commands,ht tp,kvformat,linux-kmsg-format,map-value-pairs,mod-python,pseudofile,snmptrapd-parser,stardate,syslogformat,system-source,tags-parser,tfgetent,timestamp,xml Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-Linux-Caps: off Enable-Systemd: off -- - Arthur LAMBERT

3 2

syslog-ng-ctl: EOF occurred while reading control socket
by Faine, Mark R. (MSFC-IS40)[NICS] 24 Apr '20

24 Apr '20

I am seeing the message "EOF occurred while reading control socket" intermittently when using the syslog-ng-ctl command. Is there something misconfigured or anything I can do to prevent this? Thanks, -Mark

2 1

mystique with spoof_address
by Edvinas Kairys 16 Apr '20

16 Apr '20

Hello, i installed (yum install) following version on Centos 7 box. syslog-ng 3.5.6 Installer-Version: 3.5.6 Revision: Compile-Date: Dec 30 2015 19:57:24 Available-Modules: affile,afprog,afsocket-notls,afsocket-tls,afsocket,afstomp,afuser,basicfuncs,confgen,cryptofuncs,csvparser,dbparser,linux-kmsg-format,syslogformat,system-source Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: on Enable-Pcre: on My goal is to forward syslog messages 'untouched' but to change the source address to original one. For that case i'm using spoof-address. My conf is like this: options { flush_lines (0); time_reopen (10); log_fifo_size (1000); chain_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (no); mark-freq (0); }; source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); }; destination d_syslog_tcp { network("10.13.33.125" transport("udp") port(5140) spoof-source(yes)); }; log { source(s_network); destination(d_syslog_tcp); }; log { source(s_network); filter(f_default); destination(d_mesg); }; # Source additional configuration files (.conf extension only) @include "/etc/syslog-ng/conf.d/*.conf" Strange thing, that when I enable spoof-source, some packets are not transmitted to the destination. Even TCPDUMP says that it's sent, but i dont see some logs on destination box. Could it be something with spoof_source command ? Also i didn't compiled it because i saw that SPOOF functionality is on in syslog-ng -V output. Any suggestions ? Thanks

2 4

issues with rewrite and subst
by Russell Fulton 14 Apr '20

14 Apr '20

version 3.26.1 I am attempting to use rewrite to copy part of one macro into a new one: rewrite r_user1 { set( "${user}", value("user_name"));}; rewrite r_user2 { subst( "^.+$(.+)$", "${1}", value("user_name")) ;}; The first simply copies user into user_name. The second is intended to extract anything in parentheses and throw away the rest. here is a cleaned up dump of json output including the macros from the regexp: {"user_name":")","user”:”yyyyn@gmail.com(xxx549)","2":")","1":")","0”:”yyyy@gmail.com(xxx549)”} I believe ‘1’ should contain ‘xxx549’ not ‘)’. I have tested the regexpn in ruby’s irb and it works fine there. here is another example this one where the regexp should not have matched at all: {"user_name":"9","user":"ping999","2":"9","1":"9","0":"ping999”} macros 1 and 2 always seem to contain the last character of the original string.

2 1