September 2023 - syslog-ng - lists.balabit.hu

Syslog-ng Not Working properly
by Sumanta Banerjee 15 Jan '24

15 Jan '24

Hi Team, I am trying to configure syslog-ng in one our linux instance to get NGIPS/FMC data via udp connection on its default port (514). I have configured syslog-ng.conf under /etc/syslog-ng and then we have set SE Linux as Permissive. I am using RHEL 8.7 and syslog version 4.0. Apparently all looked good to me however while checking in the destination path that is mentioned I don't see any directory or logfile from for the said udp connection got created. Below is our observation and steps that we executed, can any of you please help me telling where I went wrong or if I am missing something, there is another testing in pipeline that is stalled for this - 1. Define source, destination and log_file in syslog-ng.conf (file attached). 2. Run the below SELinux command - # ausearch -c 'syslog-ng' --raw | audit2allow -M my-syslogng # semodule -X 300 -i my-syslogng.pp 1. Restart syslog-ng service - # systemctl restart syslog-ng.service (no error message received) 1. Check if the service is running - [cid:image002.png@01D99309.5147A9A0] 1. Check if syslog-ng is listening to udp port 514 - [cid:image003.png@01D99309.5147A9A0] 1. Checked and we have incoming data stream from source using the below command - tcpdump -i any -c10 -nn -A port 514 1. I have went through the syslog-ng troubleshooting steps mentioned in the link - https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edi… [cid:image004.png@01D9930B.D0B70940] syslog-ng -Fdev command output is also attached. 1. While running the following command got the below output - # watch '/usr/sbin/syslog-ng-ctl stats | grep "^center"' [cid:image005.png@01D99311.15E497D0] 1. # journaltctl command output (first 500 lines) attached 1. Current SE Linux status : [cid:image006.png@01D9931C.B8765370] 1. Our syslog-ng is logging to /var/log/messages and we are getting this message in /var/log/messages - [cid:image007.png@01D9931E.592725A0] Thanks & Regards, Sumanta Banerjee Splunk Admin | CISO | Aviva Group Tel: +91-8420892593 24x7x365: +44 1603 208 582 sumanta.banerjee(a)aviva.com<mailto:sumanta.banerjee@aviva.com> GlobalCyberSecurityEngineeringTeam(a)aviva.com<mailto:GlobalCyberSecurityEngineeringTeam@aviva.com> www.aviva.com<http://www.aviva.com> Wipro Technologies - SJP2, Bangalore, India [cid:image001.gif@01D99303.20AF3AC0] Aviva: Internal Aviva plc, registered Office: St. Helen's, 1 Undershaft, London EC3P 3DQ. Registered in England No. 02468686. www.aviva.com This message and any attachments may be confidential or legally privileged. If you are not the intended recipient, please telephone or e-mail the sender and delete this message and any attachments from your system. Also, if you are not the intended recipient you must not copy this message or attachments or disclose the contents to any other person. Any views or opinions expressed are solely those of the author and do not necessarily represent those of Aviva.

2 4

Custom script with map-value-pairs(pair(<script>))
by Faisal Chishti 18 Oct '23

18 Oct '23

Hi, I am trying to capture some custom information using a simple shell script. I am trying below but getting an error. Below is my parser, it works fine without the line that has custom_script_output. How do I get this to work? parser p_cr_syslog { # Convert the LEVEL field to uppercase. map-value-pairs(pair("jcnr.header.logLevel", "$(uppercase $LEVEL)")); map-value-pairs(pair("jc.header.custom_script_output", "$(script("/path/to/script.sh"))")); syslog-parser(flags(syslog-protocol) template("${MESSAGE}")); map-value-pairs( pair("jc.header.nodeName", "$HOST") pair("jc.header.eventDateTime", "$R_ISODATE") pair("jc.header.notificationType", "$MSGID") pair("jc.body", "$MSG") pair("jc.header.program", "$PROGRAM") ); # Log the output of the script. action { file { path "/var/log/syslog"; message "$jc.header.custom_script_output"; } } } Thanks in advance. -- Regards, Faisal

2 1

Syslog-ng.com seems to be down
by Balazs Scheidler 18 Sep '23

18 Sep '23

Hi, As it seems syslog-ng.com has been down for a while (2 days at least). If your are looking for the syslog-ng documentation, a good alternative is the AxoSyslog documentation at the Axoflow website. https://axoflow.com/docs/axosyslog-core/

2 1

Insider 2023-09: MongoDB; UDP; sngbench; contribute;
by Peter Czanik (pczanik) 14 Sep '23

14 Sep '23

Dear syslog-ng users, This is the 112th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS The syslog-ng MongoDB destination receives bulk operations support ---------------------------------- The MongoDB destination of syslog-ng will receive another performance update. Starting with the upcoming version 4.3, it will support bulk operations. Depending on the configuration settings, this may result in a more than 300% performance increase. https://www.syslog-ng.com/community/b/blog/posts/the-syslog-ng-mongodb-dest… Syslog-ng 4.2: extra UDP performance ------------------------------------ No matter how awkward you feel when you hear about UDP syslog in the age of encrypted TCP connections, UDP syslog is here to stay in some special cases. The scalability issues of UDP log collection were first addressed in syslog-ng Open Source Edition (OSE) (the so-reuseport() parameter), and later a more advanced solution arrived to syslog-ng Premium Edition (PE) (the udp-balancer() source). The good news is that a new, open-source implementation is now available as part of syslog-ng 4.2.0. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-4-2-extra-udp-pe… What I learned about syslog-ng performance using sngbench --------------------------------------------------------- A few weeks ago, I posted about sngbench, a shell script to measure syslog-ng performance. The performance of syslog-ng is influenced by many factors, including the hardware and OS it runs on, and syslog-ng itself. This blog summarizes some of my findings using the script. https://www.syslog-ng.com/community/b/blog/posts/what-i-learned-about-syslo… WEBINARS * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng stops logging some messages
by Lars Wagner 14 Sep '23

14 Sep '23

Hi everyone We’re having a very odd problem with syslog-ng. After some time syslog-ng just stops logging further messages. A restart is required that syslog-ng starts to log again. I already put some information in a GitHub issue: https://github.com/syslog-ng/syslog-ng/issues/4485 As there was nearly no response there I try it that way. Thanks anyone in advance. Regards, Lars

1 0

syslog-ng 4.2.0 changed the interpretation of regexp
by Evan Rempel 11 Sep '23

11 Sep '23

Prior to syslog-ng 4.2.0 I was able to use a filter specified as match("ABC\|DEF" value("MESSAGE")) to match the exact string ABC|DEF in the MESSAGE After upgrading to 4.2.0 this will match either ABC or DEF in the MESSAGE To match an exact string of ABC|DEF I now need to escape both the backslash and the pipe match("ABC\\\|DEF" value("MESSAGE")) I can't find anything in the release notes. Of course I can easily solve this with single quotes, but more complex examples would not be so straight forward. Can someone confirm that this was intentional, or if this is a bug. -- Evan

3 4

How to stop syslog-ng from generating HOSTID on start up
by Dineth Jayasekera 06 Sep '23

06 Sep '23

Hi everyone, When starting up, I've noticed that syslog-ng hangs on our embedded system when generating the HOSTID. This is because the HOSTID generation uses RAND_bytes (in_create_host_id <https://github.com/syslog-ng/syslog-ng/blob/66123c955b29298ba6e68cdc77b9a0f…>)- which needs entropy (which we don't have enough of, and don't want to generate). The logging is only used locally and there is no need for crypto functionality. Is there a way to avoid generating a cryptographically secure HOSTID on start up? Thank you!

2 2