June 2023 - syslog-ng - lists.balabit.hu

Syslog-ng Not Working properly
by Sumanta Banerjee 15 Jan '24

15 Jan '24

Hi Team, I am trying to configure syslog-ng in one our linux instance to get NGIPS/FMC data via udp connection on its default port (514). I have configured syslog-ng.conf under /etc/syslog-ng and then we have set SE Linux as Permissive. I am using RHEL 8.7 and syslog version 4.0. Apparently all looked good to me however while checking in the destination path that is mentioned I don't see any directory or logfile from for the said udp connection got created. Below is our observation and steps that we executed, can any of you please help me telling where I went wrong or if I am missing something, there is another testing in pipeline that is stalled for this - 1. Define source, destination and log_file in syslog-ng.conf (file attached). 2. Run the below SELinux command - # ausearch -c 'syslog-ng' --raw | audit2allow -M my-syslogng # semodule -X 300 -i my-syslogng.pp 1. Restart syslog-ng service - # systemctl restart syslog-ng.service (no error message received) 1. Check if the service is running - [cid:image002.png@01D99309.5147A9A0] 1. Check if syslog-ng is listening to udp port 514 - [cid:image003.png@01D99309.5147A9A0] 1. Checked and we have incoming data stream from source using the below command - tcpdump -i any -c10 -nn -A port 514 1. I have went through the syslog-ng troubleshooting steps mentioned in the link - https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edi… [cid:image004.png@01D9930B.D0B70940] syslog-ng -Fdev command output is also attached. 1. While running the following command got the below output - # watch '/usr/sbin/syslog-ng-ctl stats | grep "^center"' [cid:image005.png@01D99311.15E497D0] 1. # journaltctl command output (first 500 lines) attached 1. Current SE Linux status : [cid:image006.png@01D9931C.B8765370] 1. Our syslog-ng is logging to /var/log/messages and we are getting this message in /var/log/messages - [cid:image007.png@01D9931E.592725A0] Thanks & Regards, Sumanta Banerjee Splunk Admin | CISO | Aviva Group Tel: +91-8420892593 24x7x365: +44 1603 208 582 sumanta.banerjee(a)aviva.com<mailto:sumanta.banerjee@aviva.com> GlobalCyberSecurityEngineeringTeam(a)aviva.com<mailto:GlobalCyberSecurityEngineeringTeam@aviva.com> www.aviva.com<http://www.aviva.com> Wipro Technologies - SJP2, Bangalore, India [cid:image001.gif@01D99303.20AF3AC0] Aviva: Internal Aviva plc, registered Office: St. Helen's, 1 Undershaft, London EC3P 3DQ. Registered in England No. 02468686. www.aviva.com This message and any attachments may be confidential or legally privileged. If you are not the intended recipient, please telephone or e-mail the sender and delete this message and any attachments from your system. Also, if you are not the intended recipient you must not copy this message or attachments or disclose the contents to any other person. Any views or opinions expressed are solely those of the author and do not necessarily represent those of Aviva.

2 4

Re: [syslog-ng] syslog-ng EPS
by Wilson, Jonathan L 12 Jun '23

12 Jun '23

We use: syslog-ng-ctl query get source.*.processed --reset In a cron job just before midnight to capture the entire day's stats. They show up in the format: source.s_local.processed=4722471 source.s_BSD_TCP.processed=6299967 source.s_RFC5424_TCP.processed=0 source.s_network_source.processed=27695900 . . . where "s_local", "s_BSD_TCP", etc. are the source names inside the syslog-ng.conf file. Note that the "-reset" on the end does just that, resets the stats to zero. A little scripting to divide the numbers above by 86400 will give you the count of messages per second by source. (We convert ours to JSON and dump it into Splunk for later viewing.) Regards, Jonathan Wilson

1 0

Can't Find Syslog-ng 4.0.0 Administration Guide Link
by Sumanta Banerjee 09 Jun '23

09 Jun '23

Hi All, Can someone please help in sending me the link for Syslog-ng 4.0.0 administration guide (if at all available). Thanks & Regards, Sumanta Banerjee Splunk Admin | CISO | Aviva Group Tel: +91-8420892593 24x7x365: +44 1603 208 582 sumanta.banerjee(a)aviva.com<mailto:sumanta.banerjee@aviva.com> GlobalCyberSecurityEngineeringTeam(a)aviva.com<mailto:GlobalCyberSecurityEngineeringTeam@aviva.com> www.aviva.com<http://www.aviva.com> Wipro Technologies - SJP2, Bangalore, India [cid:image001.gif@01D99AE4.B2631840] Aviva: Public Aviva plc, registered Office: St. Helen's, 1 Undershaft, London EC3P 3DQ. Registered in England No. 02468686. www.aviva.com This message and any attachments may be confidential or legally privileged. If you are not the intended recipient, please telephone or e-mail the sender and delete this message and any attachments from your system. Also, if you are not the intended recipient you must not copy this message or attachments or disclose the contents to any other person. Any views or opinions expressed are solely those of the author and do not necessarily represent those of Aviva.

1 0

syslog-ng EPS
by Dragan Zecevic 08 Jun '23

08 Jun '23

Hi guys, is it possible to calculate daily events per second for all syslog messages coming to syslog-ng? Or even better separated by sources. I have syslog-ng 3 (3.34.1). Thanks. Br, Dragan

2 1

One destination, multiple TCP connections?
by Steve Bernacki 08 Jun '23

08 Jun '23

Hello, We have a syslog TCP destination that receives logs from many different destinations. During peak log volume times, this destination begins to back up and queue. We've found that if we define multiple destinations for the same IP/port and route logs through these multiple destinations, the destination is able to handle these peak log volume times much better. Our current solution of having a destination for each source is pretty kludgy. Is there a way to define a TCP destination and specify to open, say, 10 connections to the destination and load balance the traffic over those 10 connections? Thanks. Steve

2 1

Fedora / RHEL & Co: Python split -- request for testing
by Peter Czanik (pczanik) 08 Jun '23

08 Jun '23

Hi, Recently I wrote a blog about Python packaging problems and my plans to split the Python-based drivers of syslog-ng from the syslog-ng Python plugin: https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-python-packaging I implemented it for my syslog-ng git snapshot repo for Fedora / RHEL: https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng-githead/ Please test it ASAP, if you got a bit of time. Originally I planned to use it only for the 4.3 release, but if I get positive responses, I'll also backport these changes to my syslog-ng42 repo, and use these changes also for the syslog-ng-stable repo. The blog post explains why is this important, but TL;DR: this way you do not have to install 50+MB of dependencies you will likely never use, and syslog-ng will not crash on start on RHEL 8 & Co. due to lack of dependencies. Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 2

uestion
by Johnson, Linwood 06 Jun '23

06 Jun '23

I get the following when I check [root@server1~]# syslog-ng WARNING: the match() filter without the use of the value() option is deprecated and hinders performance, please update your configuration; The kernel refused to set the receive buffer (SO_RCVBUF) to the requested size, you probably need to adjust buffer related kernel parameters; so_rcvbuf='536870912', so_rcvbuf_set='425984' [root@ server1~]# sysctl -a |grep rmem_max net.core.rmem_max = 212992 sysctl: reading key "net.ipv6.conf.all.stable_secret" sysctl: reading key "net.ipv6.conf.default.stable_secret" sysctl: reading key "net.ipv6.conf.eth0.stable_secret" sysctl: reading key "net.ipv6.conf.lo.stable_secret" [root@ server1 ~]# sysctl -a |grep vbuf net.ipv4.tcp_moderate_rcvbuf = 1 sysctl: reading key "net.ipv6.conf.all.stable_secret" sysctl: reading key "net.ipv6.conf.default.stable_secret" sysctl: reading key "net.ipv6.conf.eth0.stable_secret" sysctl: reading key "net.ipv6.conf.lo.stable_secret" net.sctp.rcvbuf_policy = 0 [root@ server1~ ]# cat /proc/sys/net/ipv4/tcp_rmem 4096 87380 6291456 [root@ server1~ ]# cat /proc/sys/net/core/rmem_default 212992 [root@ server1~ ]# cat /proc/sys/net/core/rmem_max 212992 [root@ server1~ ]# grep . /proc/sys/net/ipv4/tcp*mem /proc/sys/net/ipv4/tcp_mem:173202 230936 346404 /proc/sys/net/ipv4/tcp_rmem:4096 87380 6291456 /proc/sys/net/ipv4/tcp_wmem:4096 16384 4194304 [root@ server1~ hisotry]# I attempted to make the changes on the server. What can I do to resolve this issue? -- Thanks in advance, Linwood Johnson Senior Engineer | Unix Systems Administrator Site Reliability Tools [image: NewsTech] P.O Box 300 | Princeton NJ 08543 *(W)* 609-627-2179 *(C)* 732-740-0694 *Email:* Linwood.Johnson(a)dowjones.com *Team:* sitereliabilitytools(a)dowjones.com

2 1