November 2022 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] Local sources seem not to be working
by Szilard Parrag (sparrag) 11 Jan '23

11 Jan '23

Hi Alex, We've checked it too and syslog-ng does not release the file descriptor of journald even with flow-control enabled. Also, your internal logs seem rather terse, maybe there is a filter which filters out the important parts. Could you please check it? Szilard

4 12

syslog-ng-3.38.1 causing type hint errors in patterndb - bug?
by Evan Rempel 22 Nov '22

22 Nov '22

We have a patterndb file that contains both patterns and values with fixed text that include a strings of the form "xxxx (yyy)" which now can not be loaded by the patterndb. Syslog-ng throws the error Error parsing pattern database file; ... Error compiling value template, rule=FLARE-3543, name=AUTHPROGRAM, value=su(pam_unix), error=Unknown type specified in type hinting: su' I have not enabled the version 4.0 testing of type hinting. The version configuration is @version: 3.36 I am unable to find documentation for the full syntax of the patterndb file (seems to have been lost from the docs since perhaps 3.16?) Is there a patterndb syntax specification document? I would expect that even when type hinting is enabled in the patterndb file, given that it is an XML document, that the type hinting would be part of the XML tag metadata, rather than part of the XML static data. -- Evan

2 6

https://www.syslog-ng.com/community/b/blog/posts/installing-the-latest-syslog-ng-on-ubuntu-and-other-deb-distributions
by Burgett, Michael 18 Nov '22

18 Nov '22

Hello, I am attempting to follow the instructions at this blog link, but get an error trying to download the public key: # wget -qO - https://ose-repo.syslog-ng.com/apt/syslog-ng-ose-pub.asc | sudo apt-key add - gpg: no valid OpenPGP data found. I've tried searching later blog post, without success. I'd like to try a later version (3.25.1-3 from ubuntu-20.04 packages) since we seem to randomly have this version hang, which eventually seems to block journald as well. Thanks, Mike Burgett

2 2

Insider 2022-11: 4.0; OIDC; nightly; sudo;
by Peter Czanik (pczanik) 17 Nov '22

17 Nov '22

Dear syslog-ng users, This is the 106th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Testing syslog-ng 4.0 --------------------- This syslog-ng blog does not demonstrate any new syslog-ng features or integrations. Instead of those, it is a request for testing syslog-ng 4.0 and points you at a few related blogs and resources. https://www.syslog-ng.com/community/b/blog/posts/testing-syslog-ng-4-0 syslog-ng Store Box federated single sign-on support via OpenID Connect -------------------------------------------------------- The syslog-ng Store Box (SSB) appliance is built upon syslog-ng Premium Edition (PE). SSB inherits most of syslog-ng PE’s features and makes them available with an easy-to-use graphical user interface. There are multiple ways how users can authenticate when using SSB. Recent versions also introduced federated single sign-on (SSO) via OpenID Connect (OIDC). https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-store-box-federa… Nightly syslog-ng container images ---------------------------------- The syslog-ng team started publishing container images many years ago. For quite a while, it was a manual process, however, a few releases ago, publishing a container image became part of the release process. Recently, nightly container images have also become available, so you can test the latest features and bug fixes easily. https://www.syslog-ng.com/community/b/blog/posts/nightly-syslog-ng-containe… Type support: working with sudo logs in syslog-ng 4.0 ----------------------------------------------------- Last week I gave you a quick introduction to a major syslog-ng 4.0 feature: type support. I mentioned that it also works nicely for JSON-formatted sudo logs. I have been asked to share a working syslog-ng configuration. From this blog, you can learn how to turn on JSON-formatted logging in sudo, and how to work with those logs in syslog-ng. https://www.syslog-ng.com/community/b/blog/posts/type-support-working-with-… WEBINARS * Register for our latest webinars at https://www.syslog-ng.com/event/syslogng-webcast-series-2022/ * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Syslog-ng Message Format
by Maurya, Shivani 07 Nov '22

07 Nov '22

Hi All, With the older Syslog-ng RFC format (rfc 3164), the devices used to send the syslog messages in the below format - %TAG TIMESTAMP FULLHOSTFROM SEVERITY MSG Example - %SYSMGR-2-NON_VOLATILE_DB_INODE_FULL:2022 Nov 7 03:54:30 MST: SYSMGR-2-NON_VOLATILE_DB_INODE_FULL: System non-volatile inode storage usage is unexpectedly high at 96 But with the new syslog-ng RFC format (rfc 5425), the devices send the syslog messages in below format - TIMESTAMP FULLHOSTFROM SEVERITY MSG Is there a way to update/format the messages (rfc 5424) to be pre-fixed with %TAG ? Regards, Shivani Maurya

2 3