August 2020 - syslog-ng - lists.balabit.hu

iptables and syslog-ng
by Faine, Mark R. (MSFC-IS40)[NICS] 13 Aug '20

13 Aug '20

I'm sure there is probably an existing canonical set of rules to allow syslog-ng traffic through iptables but I can't find it. I'm sorry, since I know this is probably a common question. I've been trying to get it to work but I seem to be missing something. This is what I have: iptables -A INPUT -i em3 -p udp --dport 514 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o em3 -p udp --sport 514 -m state --state ESTABLISHED -j ACCEPT iptables -A INPUT -i em1 -p tcp --dport 514 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i em1 -p tcp --dport 10514 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o em1 -p tcp --sport 514 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -o em1 -p tcp --sport 10514 -m state --state ESTABLISHED -j ACCEPT We receive logs on udp 514 and tcp 10514 and we forward all of these logs to another remote server on the same ports. I've not seen any evidence of it but I've been told that we may also receive logs on tcp 514. I appreciate any assistance. We usually rely on hardware firewalls but new security guidelines are also requiring software firewalls be configured. Thanks, -Mark

1 0

Re: [syslog-ng] syslog-ng multiple VRF
by Terry Slattery 10 Aug '20

10 Aug '20

Alex, The simplest solution is to configure the network to share routes between the two VRFs. Linux now supports VRF, however, my quick read on the subject suggests that its configuration is complex. Applications like syslog-ng are rarely VRF-aware. It would have to bind to two different interfaces, one in each VRF. -tcs On 7/22/20 8:00 AM, syslog-ng-request(a)lists.balabit.hu wrote: > Date: Tue, 21 Jul 2020 15:18:46 +0100 > From: Alexandre Santos <alexandre.rosas.santos(a)gmail.com> > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Subject: [syslog-ng] syslog-ng multiple VRF > Message-ID: > <CAHxG_72hhkfCBu3j9nPxr_MVwKevJtFcpcRhVJLYPPYx4Mys1g(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hi All, > > I have a question regarding syslog-ng and VRF. > I want to read from a syslog source, which interface is in the default VRF, > and send the logs to a syslog/network destination interface which is in a > MGMT VRF. > > Can syslog-ng support this? > If yes, what are the aspects I should be careful about? > > Thanks and regards, > Alex -- Terry Slattery CCIE #1026 NetCraftsmen www.netcraftsmen.com

5 7

Kafka performance
by Ronald Fenner 07 Aug '20

07 Aug '20

I'm trying to figure out why the performance of syslog-ng sending to kafka has tanked considerably. Everything was running fine up until 7/30 and then all of sudden syslog-ng is having problems pushing messages to kafka at a quick pace. I've updated to 3.28.1 and it's still having problems. I was using disk buffering but I removed it an d doesn't seem to be the bottleneck. I feel it's something with syslog ng as I can use the kafka perf test to push messages at a very quick rate to the cluster. I was able to push 1 million 1k test messages in several seconds. Syslog-ng seems to be able to only push a couple of messages a second. Any thoughts on what could be tanking it's performance? It's running on Amazon Linux 2. I've rebuilt our base image with the latest version so we can switch between kafka-c and the java version however since the kafka-c topic can't be templated at the moment until a pull request is released I can't switch to it to see if it fairs better. Ronald Fenner Network Architect Game Circus LLC. rfenner(a)gamecircus.com

2 3

Sylog-ng and F5 Load balancer.
by Peter Griggs 07 Aug '20

07 Aug '20

Hello Does anyone have any experience of syslog-ng behind F5 load balancer and preserving source IP address? The F5 can put the X-Forwarding header or TCP Options value but I don't believe syslog-ng can understand either of these - Am I wrong? If I am then I am assuming I can have a filter that overwrites $HOST with the value of X-Forwarding or TCP Options. Any help appreciated. Thanks Peter.

3 7

EWMM and sudo app-parser
by Fabien Wernli 06 Aug '20

06 Aug '20

Hi, I'm investigating using the EWMM forwarding model. Consider the following setup: Linux hosts collect logs using `system()` send them over using `syslog-ng()` destination to a remote host that collects them using `default-network-drivers()` source. It seems to me that the sudo app parsing is fired up twice: 1. On the sender side because `system()` expands to something including the `sudo-parser()` SCL 2. On the receiver side because `default-network-drivers()` expands to something involving the `app-parser()` This happens also when using `syslog()` source on the sender side, which is why I noticed this behaviour. So my question is, is there something wrong with that model ?

2 4

Kafka-c topics dynamic
by Ronald Fenner 06 Aug '20

06 Aug '20

When I was using the java implementation I extracted the topic dynamically from the message to route the message to the proper topic. I see in Kafka c implementation that the topic can't use templates so my old method of doing this topic("${topic}.${environment}") No longer works. Is there a way to reproduce this or do I need to go back to the java version for now? Ronald Fenner Network Architect Game Circus LLC. rfenner(a)gamecircus.com

2 2

journald prefix
by Fabien Wernli 05 Aug '20

05 Aug '20

Hi, I'm in the process of simplifying my structured logging config. Most of my systems now have journald shipping local logs to syslog-ng via the `system()` auto-expanding source. While this is convenient, as it makes it possible to use the same config for all my systems (systemd and rest of world), it also makes it impossible to configure the underlying driver's defaults. The task at hand is shipping the journald additional fields, which would be easy to do using the following excerpt from the documentation: source s_journald { systemd-journal(prefix(".SDATA.journald.")); }; This is not possible of course using `system()`. I've got a couple of ideas on how to handle this, but I'd like to hear other (probably less insane than my own) ways first :-) Cheers

2 2

Error trying to use kafka-c
by Ronald Fenner 05 Aug '20

05 Aug '20

I'm trying to switch from the java version of kafka to the c version and have built syslog with the following config: ./configure --prefix=/opt/syslog-ng --enable-json --enable-python --with-python=2.7 --enable-kafka However when I try syntax check the config it's returning this error: Error parsing destination statement, destination plugin kafka-c not found in block destination kafka() at /opt/syslog-ng/share/syslog-ng/include/scl/kafka/kafka.conf:24:4:5-4:12: 1 2 #Start Block block destination kafka() at /opt/syslog-ng/share/syslog-ng/include/scl/kafka/kafka.conf:24 3 4-----> kafka-c(bootstrap_servers("kafka.service.consul:9092") topic("syslog-ng-production") ); 4-----> ^^^^^^^ 5 6 #End Block block destination kafka() at /opt/syslog-ng/share/syslog-ng/include/scl/kafka/kafka.conf:24 7 Included from /opt/syslog-ng/etc/syslog-ng.conf:33:5-36:6: 28 source s_rtl_raw_backup { 29 file("/var/gamecircus/log/rtl-raw-backup.log" flags(no-parse) log_msg_size(1000000)); 30 }; 31 32 destination d_kafka_unstructured { 33----> kafka ( 33----> ^^^^^^^^ 34----> bootstrap-servers("kafka.service.consul:9092") 35----> topic("syslog-ng-`DeployedEnvironment`") 36----> ); 37 }; 38 The top of my config looks like this @version: 3.28 @include "scl.conf" @include "conf.d/gc-parsers.conf" @define kafka-implementation kafka-c Everything looks correct just not sure why it's having a hard time finding it. Ronald Fenner Network Architect Game Circus LLC. rfenner(a)gamecircus.com

2 1

Deadlock with full disk buffer
by Ronald Fenner 03 Aug '20

03 Aug '20

I've run into a problem where we had enabled reliable disk buffering on our Kafka destination and it's disk buffer eventually filled the drive it's stored on party because the drive is sized to the buffer it's holding. When restarting syslog-ng it complains with "Daemon exited due to a deadlock/signal/failure, restarting; exitcode='6'" The version we are using is 3.23.1 I'm not sure why the disk buffer filled up the only thing I can think of is that syslog-ng was unable to send message to the Kafka destination, however our Kafka cluster is up and function fine and I can even consume messages from a topic that we are pushing messages to on one of the instances affected. A question once a reliable message is sent is it removed from the buffer, i assume that's the case. The other question is it possible the java Kafka plugin can't keep up with the amount of mesages we are sending though syslog-ng. We see 12.5 million requests per day to the servers with the disk buffers. Each request generates at least 2 messages, one access log message, one application log so that's roughly 25 million messages a day. I designed the disk buffers to hold roughly 2 days worth of data if for some reason the Kafka cluster went down which in this case doesn't seem to be the case since monitoring tools show it's online and none of our hourly consumers complained about being able to connect. I'll have to build a recovery server for the buffers since they are housed on attached drives the drive are preserved when the instance is terminated this was done to make sure we didn't lose any messages not sent when the autoscaling scaled out a instance. I'm currently manually terminating the affected instances to keep those buffer and restore out logging. Once I have it, if more info is needed I can see what happens with trying to start syslog-ng up when it's also not receiving a bunch of messages as well. Ronald Fenner Network Architect Game Circus LLC. rfenner(a)gamecircus.com

2 3