May 2020 - syslog-ng - lists.balabit.hu

How to get the number of logged message count
by Monitto Pitchaimani sebastin (mopitcha) 18 May '20

18 May '20

Hi All, Is there a way to get the logged messages to the particular destination? We wanted to get the count of number of logs delivered to the particular destination I.e., network() etc Regards, Monitto

2 1

Insider 2020-05: syslog-ng 3.27; Python HTTP header; DBLD; Sumologic;
by Peter Czanik (pczanik) 14 May '20

14 May '20

Dear syslog-ng users, This is the 81st issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Version 3.27 of syslog-ng released ---------------------------------- Version 3.27.1 of syslog-ng is now available, adding many smaller features to syslog-ng. These include new macros to check where a given log message arrived, a new rewrite to easily change the syslog facility of a message, a Sumologic destination and an experimental feature to check log integrity. For source code and full details, check https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-3.27.1 For ready-to-use packages check https://syslog-ng.com/3rd-party-binaries Introduction to the Python HTTP header -------------------------------------- You can create your own custom headers for the HTTP destination using syslog-ng’s Python HTTP header plugin and Python scripts. The included example configuration only adds a simple counter to the headers, but with a bit of coding, you can resolve authentication problems or fine-tune how data is handled at cloud-based logging and SIEM platforms, like Sumologic. https://www.syslog-ng.com/community/b/blog/posts/introduction-to-the-python… DBLD: a syslog-ng developer tool not just for developers -------------------------------------------------------- DBLD is a central tool when it comes to syslog-ng development, but even after multiple blogs about the tool, it is still not much used outside of the developers’ team. So, what is DBLD and how could it be used even by you? The abbreviation stands for Docker BuiLD. Using containers ensures both that you have an easily reproducible build environment, and also that you do not have to “pollute” your base system with development-related software packages. You can use DBLD to build the release tarball or ready-to-use packages for a number of Linux distributions. It can even be used as a development environment with all necessary tools installed. Still not convinced? Yes, the listed possibilities are mostly interesting for syslog-ng developers and 3rd party packagers. If you are lucky, you will never need DBLD. On the other hand, it can come handy if you reported a problem and the syslog-ng team fixed it. Even if you are not a developer, only a junior sysadmin, you can still easily build fixed syslog-ng packages for testing (and even for production use) until an official release with the fix arrives. https://www.syslog-ng.com/community/b/blog/posts/dbld-a-syslog-ng-developer… Getting your logs into Sumo Logic with syslog-ng made easy ---------------------------------------------------------- Sumo Logic is one of the most popular cloud-based log management and security analytics services. They provide their own log shippers, but also work with others, including syslog-ng. The use of syslog-ng is well documented on their support website, but the actual configuration part can easily be simplified. A new, dedicated Sumo Logic destination is already available as part of syslog-ng 3.27. It is based either on the network() or the http() destination of syslog-ng and implemented as an SCL, hiding away most of the configuration details from the users. https://www.syslog-ng.com/community/b/blog/posts/getting-your-logs-into-sum… syslog-ng PE 7.0.20 available ----------------------------- Version 7.0.20 of syslog-ng Premium Edition was released. It adds Red Hat Enterprise Linux 8 to the supported platforms: https://support.oneidentity.com/technical-documents/syslog-ng-premium-editi… Using RHEL 8 instead of RHEL 7 you can use udp-balancer() source for high performance UDP log collection: https://support.oneidentity.com/technical-documents/syslog-ng-premium-editi… NEW WHITE PAPERS * Upgrade to State-of-the-Art Log Management: https://www.syslog-ng.com/whitepaper/log-management-essentials8137754/ WEBINARS * Learn how to easily integrate Azure Sentinel into your log-data strategy: https://www.syslog-ng.com/webcast-ondemand/learn-how-to-easily-integrate-az… * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Missing one log message when destination unavailable for short period of time.
by Ali Shirvani 08 May '20

08 May '20

Hi all, I tried to setup simple relay with syslog-ng, it receives log on one port and forward to the destination. It works fine when destination is available, but when destination unavailable for a short period of time and then became available I miss one log entry. For example assume that I send simple numbers with logger command to syslog-ng, from 0 to 100, when I receive 50 on destination I stop its listener and start it again, in this case the first log entry that I receive is 52 instead of 51. Here is my syslog-ng.conf: @version: 3.26 options { time_reopen(5); }; source s_network { network( ip("127.0.0.1") port(514) transport("udp") ); }; destination d_network { network( "127.0.0.1" port(5514) transport("udp") ); }; log { source(s_network); destination(d_network); }; Would you please help me to resolve this issue? Regards, Ali

3 6

Syslogs not writing to disk
by Rose, Ed 05 May '20

05 May '20

Hello All, I have syslog-ng setup currently setup to write to disk and forward events on to a different syslog server. Syslog isn't writing to disk it seems. I do not see any errors either, unless I am not looking in the right place for the errors. Tcpdump -v host x.x.x.x shows data coming in from the host but a tail -f ${HOST}/log_${HOST} shows no logs going to disk. Thanks Ed syslog-ng 3 (3.14.1) Config version: 3.14 Installer-Version: 3.14.1 Revision: Module-Directory: /usr/lib64/syslog-ng Module-Path: /usr/lib64/syslog-ng Available-Modules: afmongodb,sdjournal,linux-kmsg-format,appmodel,date,pseudofile,afamqp,syslogformat,csvparser,cef,tags-parser,affile,afsocket,afstomp,tfgetent,json-plugin,confgen,system-source,stardate,graphite,dbparser,afprog,xml,add-contextual-data,snmptrapd-parser,cryptofuncs,kvformat,disk-buffer,basicfuncs,afuser,map-value-pairs Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: on Enable-Systemd: on filter f_awanra1 { host("x.x.x.x"); }; filter f_bwanra1 { host("x.x.x.x"); }; filter f_cwanra1 { host("x.x.x.x"); }; destination d_ciscoasa { file("/var/log2/gns/cisco_asa/${HOST}/log_${HOST}" create-dirs(yes) dir-perm(0755) dir-group(splunk) perm(0640) group(splunk)); }; destination d_uid1 { tcp("x.x.x.x" port(514) ); }; destination d_uid2 { tcp("x.x.x.x" port(514) ); }; destination d_uid3 { tcp("x.x.x.x" port(514) ); }; destination d_uid4 { tcp("x.x.x.x" port(514) ); }; log { source(s_net); filter(f_amywanra1); destination(d_ciscoasa); destination(d_uid1); destination(d_uid2); destination(d_uid3); destination(d_uid4); flags(final); }; log { source(s_net); filter(f_cnswanra1); destination(d_ciscoasa); destination(d_uid1); destination(d_uid2); destination(d_uid3); destination(d_uid4); flags(final); }; log { source(s_net); filter(f_demwanra1); destination(d_ciscoasa); destination(d_uid1); destination(d_uid2); destination(d_uid3); destination(d_uid4); flags(final); };

2 8