March 2025 - syslog-ng - lists.balabit.hu

Ticket Received - syslog-ng Digest, Vol 239, Issue 9
by Example 27 Mar '25

27 Mar '25

Dear Syslog-ng, We would like to acknowledge that we have received your request and a ticket has been created. A support representative will be reviewing your request and will send you a personal response.(usually within 24 hours). To view the status of the ticket or add comments, please visit https://teeraphanaotjantuek-help.freshdesk.com/helpdesk/tickets/3988 Thank you for your patience. Sincerely, Teeraphan Aotjantuek Support Team

2 1

Ticket Received - syslog-ng Digest, Vol 239, Issue 4
by Example 27 Mar '25

27 Mar '25

Dear Syslog-ng, We would like to acknowledge that we have received your request and a ticket has been created. A support representative will be reviewing your request and will send you a personal response.(usually within 24 hours). To view the status of the ticket or add comments, please visit https://teeraphanaotjantuek-help.freshdesk.com/helpdesk/tickets/3668 Thank you for your patience. Sincerely, Teeraphan Aotjantuek Support Team

1 0

Ticket Received - syslog-ng Digest, Vol 239, Issue 8
by Example 27 Mar '25

27 Mar '25

Dear Syslog-ng, We would like to acknowledge that we have received your request and a ticket has been created. A support representative will be reviewing your request and will send you a personal response.(usually within 24 hours). To view the status of the ticket or add comments, please visit https://teeraphanaotjantuek-help.freshdesk.com/helpdesk/tickets/3935 Thank you for your patience. Sincerely, Teeraphan Aotjantuek Support Team

1 0

Ticket Received - syslog-ng Digest, Vol 239, Issue 7
by Example 27 Mar '25

27 Mar '25

Dear Syslog-ng, We would like to acknowledge that we have received your request and a ticket has been created. A support representative will be reviewing your request and will send you a personal response.(usually within 24 hours). To view the status of the ticket or add comments, please visit https://teeraphanaotjantuek-help.freshdesk.com/helpdesk/tickets/3849 Thank you for your patience. Sincerely, Teeraphan Aotjantuek Support Team

1 0

Ticket Received - syslog-ng Digest, Vol 239, Issue 6
by Example 27 Mar '25

27 Mar '25

Dear Syslog-ng, We would like to acknowledge that we have received your request and a ticket has been created. A support representative will be reviewing your request and will send you a personal response.(usually within 24 hours). To view the status of the ticket or add comments, please visit https://teeraphanaotjantuek-help.freshdesk.com/helpdesk/tickets/3787 Thank you for your patience. Sincerely, Teeraphan Aotjantuek Support Team

1 0

Ticket Received - syslog-ng Digest, Vol 239, Issue 5
by Example 27 Mar '25

27 Mar '25

Dear Syslog-ng, We would like to acknowledge that we have received your request and a ticket has been created. A support representative will be reviewing your request and will send you a personal response.(usually within 24 hours). To view the status of the ticket or add comments, please visit https://teeraphanaotjantuek-help.freshdesk.com/helpdesk/tickets/3772 Thank you for your patience. Sincerely, Teeraphan Aotjantuek Support Team

1 0

Re: [syslog-ng] syslog-ng Digest, Vol 239, Issue 4
by Linn, William 27 Mar '25

27 Mar '25

Peter, The error I got was. warning: /tmp/syslog-ng-4.8.1-2.fc40.src.rpm: Header V4 RSA/SHA256 Signature, key ID bb1105ce: NOKEY I had downloaded it from the site, cannot remember exactly as it was done a couple of months ago preparing to upgrade the current version from 4.X. We are on RHEL 7 and upgrading the environment to RHEL 9. I do notice that the older version is.... syslog-ng-3.5.6-3.el7.x86_64.rpm and what I downloaded is syslog-ng-4.8.1-2.fc40.src.rpm maybe I have a source that needs compiled? Thanks William -----Original Message----- From: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: Thursday, March 27, 2025 8:00 AM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 239, Issue 4 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://urldefense.com/v3/__https://lists.balabit.hu/mailman/listinfo/syslo… or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. link (Linn, William) 2. Re: link (Peter Czanik (pczanik)) ---------------------------------------------------------------------- Message: 1 Date: Wed, 26 Mar 2025 12:06:03 +0000 From: "Linn, William" <wlinn(a)bofa.com> To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] link Message-ID: <e79007df7d2a4403b32d9f8b6a0c679a(a)bofa.com> Content-Type: text/plain; charset="us-ascii" I downloaded the RPM for RHEL 9 syslog-ng but getting a weird error. Can someone send the the link so I can make sure I have the right one? Thanks William ---------------------------------------------------------------------- This message, and any attachment(s), is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.bankofamerica.com/electronic-disclaimer. If you are not the intended recipient, please delete this message. For more information about how Bank of America protects your privacy, including specific rights that may apply, please visit the following pages: https://business.bofa.com/en-us/content/global-privacy-notices.html (which includes global privacy notices) and https://www.bankofamerica.com/security-center/privacy-overview/ (which includes US State specific privacy notices such as the http://www.bankofamerica.com/ccpa-notice)

3 4

link
by Linn, William 27 Mar '25

27 Mar '25

I downloaded the RPM for RHEL 9 syslog-ng but getting a weird error. Can someone send the the link so I can make sure I have the right one? Thanks William ---------------------------------------------------------------------- This message, and any attachment(s), is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.bankofamerica.com/electronic-disclaimer. If you are not the intended recipient, please delete this message. For more information about how Bank of America protects your privacy, including specific rights that may apply, please visit the following pages: https://business.bofa.com/en-us/content/global-privacy-notices.html (which includes global privacy notices) and https://www.bankofamerica.com/security-center/privacy-overview/ (which includes US State specific privacy notices such as the http://www.bankofamerica.com/ccpa-notice)

2 1

The syslog-ng Insider 2025-03: EPEL 10; Elasticsearch; Active Roles
by Peter Czanik (pczanik) 12 Mar '25

12 Mar '25

Dear syslog-ng users, This is the 129th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Test syslog-ng on EPEL 10! -------------------------- CentOS Stream 10 and EPEL 10 just became available, and as usual, I tried to build syslog-ng as soon as possible. For now it is available in my git snapshot repository, but I am also planning to make it available in EPEL 10 soon. https://www.syslog-ng.com/community/b/blog/posts/test-syslog-ng-on-epel-10 Collecting Active Roles logs centrally using the syslog-ng Windows Agent -------------------------------- One Identity Active Roles allows you to easily and securely manage Active Directory (AD), Entra ID and M365 Identity objects. While Active Roles stores its log messages into Windows Event Log, most log management and log analytics applications expect to receive log messages over the syslog protocol. This is where syslog-ng Premium Edition (PE) can help you. The syslog-ng Windows Agent can collect and forward Active Roles log messages from Windows Event Log, while the syslog-ng server can collect, process, store and forward Active Roles log messages to multiple destinations. https://www.syslog-ng.com/community/b/blog/posts/collecting-active-roles-lo… syslog-ng OSE 4.8.1 is now in EPEL 10, quick fix for Elasticsearch --------------------------------- This blog is just a quick announcement that syslog-ng 4.8.1 is now available in EPEL 10, so you do not have to use the testing repository anymore. Thanks everyone for the feedback! However, support for Elasticsearch 7+ is broken in this release, as some of you reported. You can fix this problem as described in https://github.com/syslog-ng/syslog-ng/issues/5207 by removing references to “type”. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-ose-4-8-1-is-now… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

TCP orig_log_iw_size='3', why?
by claudio＠witel.it 02 Mar '25

02 Mar '25

Hello syslog-ng community, I get this warning at syslog-ng start (or restart) when running journalctl [...] Feb 27 02:46:57 xxxsplunksyslog1 syslog-ng[2998304]: [2025-02-27T02:46:57.330923] WARNING: window sizing for tcp sources were changed in syslog-ng 3.3, the configuration value was divided by the value of max-connections(). The result was too small, clamping to value of min_iw_size_per_reader. Ensure you have a proper log_fifo_size setting to avoid message loss.; orig_log_iw_size='3', new_log_iw_size='100', min_iw_size_per_reader='100', min_log_fifo_size='30000' Feb 27 02:46:57 xxxsplunksyslog1 systemd[1]: Started System Logger Daemon. I thought the orig_log_iw_size value was coming from the formula log_iw_size/max_connections which should be 100/300=1/3 What is this orig_log_iw_size='3' ? Thanks.

2 4