July 2020 - syslog-ng - lists.balabit.hu

disk buffer files permissions
by Pal, Laszlo 13 Jul '20

13 Jul '20

Hi, We want to monitor disk-buffer files, so we can detect if there is are some issues with the destinations. syslog-ng creates these files with permissions like this otal 360 -rw-------. 1 root root 4096 Oct 10 2019 syslog-ng-00000.qf -rw-------. 1 root root 4096 Jul 12 03:49 syslog-ng-00001.qf So, our monitor script (for zabbix) cannot stat files because it is running under user zabbix. I'm not sure how to submit a feature request nowadays, but it would be great of perm() option added to disk-buffer() Any chance? Thx L:

3 4

Insider 2020-07: TLS; capabilities; 3.27;
by Peter Czanik (pczanik) 09 Jul '20

09 Jul '20

Dear syslog-ng users, This is the 83rd issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Simplifying CA handling in syslog-ng TLS connections ---------------------------------------------------- When talking to users about the TLS-encrypted message transfer, almost everyone immediately complains about configuring a certificate authority (CA) in syslog-ng. You needed to create a hash and create a symbolic link to the CA file based on the hash. Not anymore. While this old method is still available, there is now a much easier way: the new ca-file() option. https://www.syslog-ng.com/community/b/blog/posts/simplifying-ca-handling-in… Working around Linux capabilities problems for syslog-ng -------------------------------------------------------- No, SELinux is not the cause of all permission troubles on Linux. For example, syslog-ng makes use of the capabilities system on Linux to drop as many privileges as possible, as early as possible. But it might cause problems in some corner cases, as even when running as root, syslog-ng cannot read files owned by a different user. Learn from this blog how you can figure out if you have a SELinux or capabilities problem and how to fix it if you do. https://www.syslog-ng.com/community/b/blog/posts/working-around-linux-capab… Figuring out where a message arrived, and other syslog-ng 3.27 tricks ---------------------- Version 3.27 of syslog-ng has brought many smaller, but useful features to us. The new Sumo Logic destination was already covered in an earlier blog. You can now also check exactly where a message arrived on a network source (IP address, port and protocol). Rewriting the facility of a syslog message was also made easy. For a complete list of new features and changes, check the release notes at https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-3.27.1 You can learn more about these features at https://www.syslog-ng.com/community/b/blog/posts/figuring-out-where-a-messa… NEW RELEASES * Version 3.28.1 released: https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-3.28.1 * syslog-ng PE version 7.0.21 is coming soon with MSSQL and Oracle SQL sources, and you can send logs to Google Pub/Sub. For details, check the documentation at https://support.oneidentity.com/syslog-ng-premium-edition/7.0.21 WEBINARS * Learn how to do custom HTTP REST API Authentication with syslog-ng: https://www.syslog-ng.com/event/customize-http-rest-apis-authentication-wit… * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Convert logs back into syslog-ng logs
by Faine, Mark R. (MSFC-IS40)[NICS] 07 Jul '20

07 Jul '20

I would like to read lines from a file back into log data that syslog-ng can parse. What would be involved in doing this? Thanks, -Mark

2 3