February 2025 - syslog-ng - lists.balabit.hu

The syslog-ng Insider 2025-02: Prometheus; RHEL UBI; WSL
by Peter Czanik (pczanik) 19 Feb '25

19 Feb '25

Dear syslog-ng users, This is the 128th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Syslog-ng Prometheus exporter added to RPM syslog-ng container image ------------------------------------------------- Recently I introduced you to my latest project: a syslog-ng container based on Alma Linux. Now I also added a syslog-ng Prometheus exporter to the container, so you can monitor syslog-ng, if you enable it. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-prometheus-expor… Running syslog-ng PE in RHEL UBI -------------------------------- Recently I have posted a Dockerfile to run syslog-ng in an Alma Linux container. I got some encouraging feedback, so this week I experimented with syslog-ng Premium Edition (PE) in a RHEL UBI (Universal Base Image) container. While this is not officially supported by One Identity, we are really interested in your feedback. https://www.syslog-ng.com/community/b/blog/posts/running-syslog-ng-pe-in-rh… Running a syslog-ng server in WSL --------------------------------- Windows Subsystem for Linux (WSL) allows you to run Linux applications on a Windows host. While you can install and run syslog-ng on a default WSL installation, it is not really practical: there is no systemd and WSL is behind NAT. This blog gives you some pointers for working around these problems. https://www.syslog-ng.com/community/b/blog/posts/running-a-syslog-ng-server… WEBINARS * New webinar: “High Availability for syslog-ng Store Box”. You can register for it at https://www.syslog-ng.com/event/high-availability-for-syslog-ng-store-box-/ * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

CRL handling in syslog
by Shankar Pramanik 18 Feb '25

18 Feb '25

I've configured syslog-ng 3.35.1 to use CRLs but things aren't working as expected. This is what I've done : 1. Create a self-signed CA and use it to sign a server certificate. The server certificate has a CRL distribution point in it. 2. Revoke the server certificate. Generate the revoked CRL and put it on the syslog client under /etc/syslog-ng/crl in PEM format. There's a <issuer hash>.r0 link to the CRL in this directory. 3. Configure ca-dir and crl-dir in the client's syslog config. Configure the client to connect to the remote syslog server. With this setup, I' d expect the syslog client to reject the server certificate since it's revoked, but that doesn't happen. The TLS handshake and subsequent communication is successful. Is there anything that I'm missing ? Any pointers will be appreciated. I can provide additional details of my setup if needed. Thanks! Shankar.

3 3

syslog-ng 3.38 UDP errors and missing messages
by Taavi Ansper 11 Feb '25

11 Feb '25

Hi I am running a syslog server that is having problems getting all of the data via UDP. I have gone through most of the tips for making the performance better, but something is still amiss. 1. The syslog-ng server is running in an VM. 8vcpu and 8gb RAM. Debian 12. 2. After restarting or starting the server the UDP errors are tamed. nstat -asz | grep Error UdpInErrors 0 0.0 UdpRcvbufErrors 0 0.0 After 15 minutes or so the errors start to appear. (This amount of errors is after some time.) UdpInErrors 6734175 0.0 UdpRcvbufErrors 6734175 0.0 After some time it starts to receive the packets again. I can see all of this clearly in my graylog graphics that sucks that log data in. (added picture) https://imgur.com/a/eeRpovh It goes like a sinewave up and down every 15 minutes or so. My config looks like this. options { ts-format(iso); frac-digits(6); keep-timestamp(no); chain-hostnames(no); keep-hostname(no); use-dns(yes); use-fqdn(yes); create-dirs(yes); dir-owner(root); dir-group(adm); dir-perm(0750); owner(root); group(adm); perm(0640); log-fifo-size(100000); }; source clients { network( transport(udp) so-rcvbuf(32MiB) log-iw-size(250k) log-fetch-limit(10k) ); network( transport(tcp) max-connections(100) so-rcvbuf(32MiB) log-iw-size(250k) log-fetch-limit(10k) ); }; source forward { network( port(6514) transport(tcp) keep-timestamp(yes) keep-hostname(yes) ); }; destination file { file("/srv/log/${HOST}/${FACILITY}.log"); }; destination forward { network( "192.168.X.X" port(6514) transport(tcp) so-keepalive(yes) disk-buffer( mem-buf-size(512M) disk-buf-size(2048M) reliable(yes) ) ); }; destination graylog { network( "192.168.X.X" port(5140) flags(syslog-protocol) transport(tcp) so-keepalive(yes) disk-buffer( mem-buf-size(512M) disk-buf-size(2048M) reliable(yes) ) ); }; filter graylog { host("^gw-example-") }; log { source(clients); destination(file); destination(forward); flags(flow-control); }; log { source(forward); destination(file); flags(flow-control); }; log { source(clients); filter(graylog); destination(graylog); flags(flow-control); }; My rmem_max is set like so: sysctl net.core.rmem_max net.core.rmem_max = 33445532 Any suggestions? Best regards -- Taavi Ansper taavi.ansper(a)cyber.ee

2 1