September 2025 - syslog-ng - lists.balabit.hu

stats collection sometimes wrong
by Evan Rempel 06 Oct '25

06 Oct '25

We collect stats every 10 minutes via the command syslog-ng-ctl stats --control=$syslogSocket And we log the results back to syslog as well as generate alerts when things start queuing. Sometimes the queued numbers reported are extremely incorrect. 2025-09-16T21:15:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0 2025-09-16T21:25:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0 2025-09-16T21:35:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0 2025-09-16T21:35:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;processed;15568 2025-09-16T21:45:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;18446744073709551608 2025-09-16T21:45:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;processed;15773 2025-09-16T21:55:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;18446744073709551608 2025-09-16T21:55:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;processed;15972 2025-09-16T22:05:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0 2025-09-16T22:15:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0 It is not possible to queue more messages that the difference reported in the processed numbers. -- Evan

2 2

syslog-ng 4.10.0 packages, and spreading the news
by Peter Czanik (pczanik) 23 Sep '25

23 Sep '25

Hi, Let me collect you some more syslog-ng 4.10.0-related information. Release notes with all the new features, bug fixes and various other changes: https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.10.0 RPM packages for openSUSE / SLES, Fedora and RHEL are now available: https://www.syslog-ng.com/community/b/blog/posts/installing-latest-syslog-n… (blog updated, even if it still mentions RHEL 7 and a 2021 date 🙂) DEB packages for Debian and Ubuntu are available: https://www.syslog-ng.com/community/b/blog/posts/installing-the-latest-sysl… Starting with this release, RPM packages for RHEL 8, 9 and 10 on ARM and x86_64 are provided also on syslog-ng.com, just like DEB packages. More on this next week, but you can already test it based on the release notes 🙂 Help us to spread the word about this release. Write something using your own words, or simply share one of my posts about syslog-ng 4.10.0: LinkedIn: https://www.linkedin.com/posts/peterczanik_release-syslog-ng-4100-syslog-ng… Twitter: https://x.com/PCzanik/status/1970479911396589717 Mastodon: https://fosstodon.org/@PCzanik/115253846672000598 BlueSky: https://bsky.app/profile/pczanik.bsky.social/post/3lzizqcctnk22 Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng 4.10.0 released
by Peter Czanik (pczanik) 23 Sep '25

23 Sep '25

Hi, I'm happy to announe hat syslog-ng 4.10.0 is now released. From the release notes: syslog-ng provides RPM<https://github.com/syslog-ng/syslog-ng#rhel> and DEB<https://github.com/syslog-ng/syslog-ng#debianubuntu> package repositories for Ubuntu, Debian, and RHEL, for both amd64 and arm64 architectures. We also provide ready-to-test binaries in Docker containers<https://hub.docker.com/r/balabit/syslog-ng/tags> based on the current stable Debian image. For more details, visit our Documentation Center<https://syslog-ng.github.io/> Highlights * affile: add support for filesize based logrotation Config file example: destination d_file_logrotate { file("/my-logfile.log", logrotate(enable(yes), size(30KB), rotations(5))); }; (#5191<https://github.com/syslog-ng/syslog-ng/pull/5191>) Features * filter: Add a blank filter that test if a value is blank. A value is considered blank if it is not set, is an empty string, is an empty list, is a string with only whitespace, or is boolean false. (#5425<https://github.com/syslog-ng/syslog-ng/pull/5425>) * http-destination: add msg_data_in_header option to be able to turn off sending message content-related data in the HTTP header (#5455<https://github.com/syslog-ng/syslog-ng/pull/5455>) * stats-exporter: Add stats-without-orphaned() and stats-with-legacy() options to further filter the stats output. (#5424<https://github.com/syslog-ng/syslog-ng/pull/5424>) * affile: Add ability to refine the wildcard-file() filename-pattern() option with exclude-pattern(), to exclude some matching files. For example, match all *.log but exclude *.?.log. (#5416<https://github.com/syslog-ng/syslog-ng/pull/5416>) Bugfixes * afprog: Fix invalid access of freed log-writer cfg. (#5445<https://github.com/syslog-ng/syslog-ng/pull/5445>) * s3: Fixed bug where in certain conditions finished object buffers would fail to upload. (#5447<https://github.com/syslog-ng/syslog-ng/pull/5447>) * stats-exporter: Fix leaks caused by missing "virtual destructor" calls. (#5441<https://github.com/syslog-ng/syslog-ng/pull/5441>) * wildcard-file: Fix possible act_tracker crash caused by duplicated file change notification handler invocation. (#5437<https://github.com/syslog-ng/syslog-ng/pull/5437>) Packaging * packaging: New package formats, platforms, and architectures! * the long-awaited RPM repository is here, we have RHEL-8, RHEL-9, and REHL-10 packages available, both for amd64 and arm64 architectures, just download and install the repository definition sudo curl -o /etc/yum.repos.d/syslog-ng-ose-stable.repo https://ose-repo.syslog-ng.com/yum/syslog-ng-ose-stable.repo * we fixed the publishing of our arm64 DEB packages * added new DEB packages for Debian Trixie, both for amd64 and arm64. * new DBLD docker images for Rocky-9, OpenSuse Tumbleweed, Ubuntu Plucky, and Debian Trixie (#5449<https://github.com/syslog-ng/syslog-ng/pull/5449>) Notes to developers * mongo-c: now we can build against both the v1 and v2 versions of the mongo-c driver automatically (#5442<https://github.com/syslog-ng/syslog-ng/pull/5442>) * manpages: Finally, we have added manpage generation to the CMake builds as well. The new single source of truth solution can either use the sometimes more up-to-date version from the documentation<https://syslog-ng.github.io/admin-guide/190_The_syslog-ng_manual_pages/READ…>, or, by default, the locally available ready-to-use instance (which is also synced from the online version, but may lag behind). This can be controlled via the --with-mapages=local|remote, or the -DWITH_MANPAGES=LOCAL|REMOTE configuration options. (#5459<https://github.com/syslog-ng/syslog-ng/pull/5459>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Alexander Zikulnig, Ben Ireland, Bálint Horváth, Gyula Kerekes, Hofi, Romain Tartière, Ross Williams, Tamas Pal Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

The syslog-ng Insider 2025-09: AI; syslog; FreeBSD
by Peter Czanik (pczanik) 11 Sep '25

11 Sep '25

Dear syslog-ng users, This is the 134th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Syslog-ng development and AI ---------------------------- Recently, several people have asked me about the syslog-ng project’s view on AI. In short, there is cautious optimism: we embrace AI, but it does not take over any critical tasks from humans. But what does this mean for syslog-ng? https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-development-and-… Dealing with multiple syslog protocols in syslog-ng made easy ------------------------------------------------------------- There are multiple syslog protocols with multiple variants. The new transport(auto) option of the syslog() source allows you to support all TCP-based variants with a single source driver. https://www.syslog-ng.com/community/b/blog/posts/dealing-with-multiple-sysl… FreeBSD audit source is coming to syslog-ng ------------------------------------------- Last year, I wrote a small configuration snippet for syslog-ng: FreeBSD audit source. I published it in a previous blog, and based on feedback, it is already used in production. And soon, it will be available also as part of a syslog-ng release. https://www.syslog-ng.com/community/b/blog/posts/freebsd-audit-source-is-co… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0