January 2023 - syslog-ng - lists.balabit.hu

Syslog messages not stored in separate lines
by Dragan Zecevic 10 Feb '23

10 Feb '23

Hi, I am collecting logs from a network device. They configured syslog format on their source side to be RFC3164. On syslog-ng side I am using source and destination like this: source s_xxx { network( ip(0.0.0.0) transport(tcp) port(xxx) flags(store-raw-message) ); }; destination folder_xxx { file( "/xxx/${R_YEAR}${R_MONTH}${R_DAY}/${SOURCEIP}_${HOST}_${R_HOUR}.log" template("${RAWMSG}\n") ); }; syslog-ng version 3.34 CentOS Linux release 7.9.2009 The problem is that syslog messages are stored in raw format but not separated in different line. Parity bit of new message starts imidiatelly after previous line -without space or enter. I have the same config for some other hosts and there log files are created with separate lines. Vendor says they can't change anything on source side. Do you have any idea what is the cause of this? Thank you. Br, Dragan

3 8

Both formats (RFC3164 and 5424) via one Port
by Matthias Gruber 24 Jan '23

24 Jan '23

Hi! We have Appliances which are generating syslog-messages in both formats, one in 3164 the other in 5424. Would it be possible to put them into one source? Something like source s_remote_appl_tcp { syslog( ip("99.99.99.99") port("5152") transport("tcp") flags(no-parse) ); }; and.... (just excepts) parser p_0140_A_parser { syslog-parser(); }; parser p_0140_B_parser { syslog-parser(flags(syslog-protocol); }; log { source(s_remote_appl_tcp); parser(p_0140_A_parser); destination(d_0140_all); flags(final); }; log { source(s_remote_appl_tcp); parser(p_0140_B_parser); destination(d_0140_all); flags(final); }; Any hints are welcome... Cheers Matthias P.S. Its an OSE 3.38.1 running ------------------------------------------------------------------------------------ METZLER Informationstechnologie Matthias Gruber IT-Infrastruktur & -Betrieb B. Metzler seel. Sohn & Co. Aktiengesellschaft Untermainanlage 1 60329 Frankfurt am Main Telefon 069 21 04 - 43 30 Telefax 069 21 04 - 40 40 MGruber(a)metzler.com www.metzler.com Vorstand: Stefanie Buchmann, Kim Comperl, Mario Mattera, Franz von Metzler, Emmerich Müller, Dr. Marco Schulmerich, Gerhard Wiesheu Vorsitzender des Aufsichtsrats: Wolfgang Kirsch Sitz der Gesellschaft: Frankfurt am Main, Handelsregister-Nr. HRB 123 365 Diese Nachricht ist vertraulich. Sollten Sie nicht der vorgesehene Empfänger sein, so bitten wir Sie höflich, dies unverzüglich dem Absender mitzuteilen und die Nachricht zu löschen. Es ist unzulässig, die Nachricht unbefugt weiterzuleiten oder zu kopieren. Da wir nicht die Echtheit oder Vollständigkeit der in dieser Nachricht enthaltenen Informationen garantieren oder zusichern können, sind die vorstehenden Ausführungen rechtlich nicht bindend. Eine Haftung hierfür wird ausgeschlossen. This message is confidential. If you are not the intended recipient, we kindly ask you to inform the sender and delete the information. Any unauthorised dissemination or copying hereof is prohibited. As we cannot guarantee or assure the genuineness or completeness of the information contained in this message, the statements set forth above are not legally binding. Accordingly we cannot accept any liability for their contents.

3 2

Re: [syslog-ng] Local sources seem not to be working
by Szilard Parrag (sparrag) 11 Jan '23

11 Jan '23

Hi Alex, We've checked it too and syslog-ng does not release the file descriptor of journald even with flow-control enabled. Also, your internal logs seem rather terse, maybe there is a filter which filters out the important parts. Could you please check it? Szilard

4 12