- syslog-ng - lists.balabit.hu

The syslog-ng Insider 2026-10: Java; Ubuntu Resolute; journald
by Peter Czanik (pczanik) 14 Oct '26

14 Oct '26

Dear syslog-ng users, This is the 142nd issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Syslog-ng Java destination disabled For many years, syslog-ng used Java, where C libraries were unavailable. However, over the years native C libraries became available for Elasticsearch and Kafka, and HDFS practically disappeared. As a “scream test”, I am going to disable Java support in all of my syslog-ng packages. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-java-destination… Syslog-ng 4.12.0 available for Ubuntu 26.04 (Resolute) Recently I was asked if syslog-ng supports Ubuntu 26.04 (Ubuntu Resolute). Yes, and with the arrival of the syslog-ng 4.12.0 release we also provide ready-to-use packages for it. The release notes mention it, and info is in the Readme on GitHub. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-4-12-0-available… Syslog-ng journald source: how to avoid log bombs on errors? Up until version 4.12, when syslog-ng ran into an error jumping to a saved systemd journal position, it read the journal from the beginning. With the latest syslog-ng version, you can configure what happens in case of such an error. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-journald-source-… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> One Identity (Balabit) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

The syslog-ng Insider 2026-09: OTEL; Alma Linux container; openssl 4.0; learning
by Peter Czanik (pczanik) 10 Sep '26

10 Sep '26

Dear syslog-ng users, This is the 141st issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS New performance tuning possibilities in syslog-ng On April’s fool’s day, I shared that syslog-ng can reach 7 million EPS. This test lab result was in part possible thanks to a few performance enhancements coming to syslog-ng version 4.12. How 7 million EPS is possible? Before diving deeper, let me repeat it: 7 million EPS is just a lab testing result, not (yet) possible in the real world. However, the technologies enabling this are already available on the development branch of syslog-ng, or have been available for ages, just not tested or promoted enough. https://www.syslog-ng.com/community/b/blog/posts/new-performance-tuning-pos… Nightly syslog-ng containers based on Alma Linux For many years, the syslog-ng project provided container images based on Debian. Most of our users run syslog-ng on RHEL & compatibles, and have asked for an RPM-based container. So, nightly containers based on Alma Linux are now also available. A while ago, I prepared a small test project to run syslog-ng in an Alma Linux container: https://www.syslog-ng.com/community/b/blog/posts/experimental-syslog-ng-con… However, that was only an experiment which I never updated. Fast forward to today: nightly syslog-ng containers based on the latest syslog-ng git snapshot package builds are now available on the Docker Hub! https://www.syslog-ng.com/community/b/blog/posts/nightly-syslog-ng-containe… The status of OpenSSL 4.0 support in syslog-ng OpenSSL 4.0 was released just over a month ago. So, how is its support progressing in syslog-ng? Well, Git master already supports it, and the patch is easy to backport to earlier releases. At the same time, version 4.12 will support OpenSSL 4.0 out of the box. https://www.syslog-ng.com/community/b/blog/posts/the-status-of-openssl-4-0-… Learning syslog-ng How can you learn syslog-ng? There are many possibilities, depending on your time and budget. Possibilities range from tutorial series through reading the documentation to instructor-led training. Find out which one is for you! https://www.syslog-ng.com/community/b/blog/posts/learning-syslog-ng WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> One Identity (Balabit) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Debug connection issue. no "connection accepted" logs
by Evan Rempel 02 Jul '26

02 Jul '26

I'm not sure when this stopped but version 4.11.0 is not logging the lines of Syslog connection accepted; fd='1686', client='AF_INET(1.2.3.4:53538)', local='AF_INET(5.6.7.8:601)' I am unable to find a setting that might enable this. The logs contain many other "internal" log messages. syslog-ng starting up; version='4.11.0' Syslog connection established; fd='29', server='AF_INET(127.0.0.1:1514)', local='AF_INET(5.6.7.8:0)' Accepting connections; listen_fd='13', addr='AF_INET(5.6.7.8:601)' Loading the new configuration; Configuration reload finished; My system running version syslog-ng-4.6.0 logs the "connection accepted" for all new connections. Any help to enable the "connection accepted" log lines would be awesome. -- Evan

2 1

Question re: syslog-ng TLS and monitoring of the certificate
by Chris Moody 05 Jun '26

05 Jun '26

Hello everyone. Wanted to first send a huge thank you to everybody for this kick-@$$ software. I have been evangelizing its use since hell, the earliest releases in the late 90's. Built everything from global anycast aggregators to single-instances and everything betweeen. I do have a question however about TLS handling. I have a client that has a request to have frequent health-checks for the validity of their certificates throughout their infrastructure (OMD/naemon/custom plugins to the rescue). I have this working great for common services that can be checked via some scripts utilizing 'openssl s_client -connect' and parsing the output. Where I am stumbling into some trouble though is in monitoring the TLS certificate being served via their syslog-ng [syslog-ng 4 (4.8.1) on Debian 13] that is aggregating/receiving logs. Via some debugging I found that using 'openssl s_client' can cause some 'hung' TLS communication as it does not cleanly send the expected 'eof' when closing the connection as I am checking via tcp/6514 instead of say, one of the in-built tls handshakes in openssl (smtp, imap, ldap, etc). Not at all syslog-ng's problem, I understand. [reference: https://ithy.com/article/fix-openssl-error0a000126-for-ssl-8w813fv2] I have had some success in instructing the the receiver to more gracefully handle this condition by adding 'Options = SSL_OP_IGNORE_UNEXPECTED_EOF' to openssl.conf as well as including the openssl option '-no_ign_eof' in my socket check. By "some success", I mean the socket responds a little bit longer, but still fails. Again, still openssl's issue, I understand. I am investigating other methods such as gnutls-cli, etc but haven't (yet) found anything that returns the certificate data itself for grokking out the 'notAfter' value of the certificate. The reason I am asking here is to see if anyone else has found and/or solved for similar behavior since it appears thus far that it is syslog-ng and the 'tls' option that seem to be what is ceasing to respond after some time. When I have done these certificate checks against other daemons that lack the in-built tls handshakes in openssl and they continue responding with certificate data whereas syslog-ng starts choking on the "error:0A000126:SSL routines::unexpected eof while reading Unable to establish SSL connection" until the daemon gets restarted, then all responds again appropriately. I've run the following and the syslog-ng tls only responds properly for approx 70 seconds and starts failing. for ((i=1;i>0;i++)); do echo "===[ `date`"; openssl s_client -connect dmz-log.DOMAIN.com:6514 -no_ign_eof < /dev/null 2>&1 | openssl x509 -enddate -noout; sleep 10; done ========== ===[ Thu Jun 4 03:09:08 PM PDT 2026 notAfter=Aug 8 05:37:10 2026 GMT ===[ Thu Jun 4 03:09:18 PM PDT 2026 Could not find certificate from <stdin> 40770E8A267F0000:error:1608010C:STORE routines:ossl_store_handle_load_result:unsupported:../crypto/store/store_result.c:160:provider=default ========== Anybody with any insights or that may have found a way to solve for this, I would greatly appreciate any hints. Thanks so much, -Chris -- Node-Nine, Inc. chris(a)node-nine.com 619.354.6463

1 0

libbasicfuncs.so error
by Robert Koktan 25 May '26

25 May '26

Hello! Using syslog-ng 4.6.0-bp156.1.4 on SUSE Linux Enterprise Server 15SP6 on s390x, via the packageHub repository. I see this error frequently in the logs and when I run # syslog-ng -s... /usr/lib64/syslog-ng/libbasicfuncs.so: error: symbol lookup error: undefined symbol: fmod (fatal) I also have several identical systems with the same version of syslog-ng that do not return this error. Can you tell me if there is an actual problem with this, or is the message moreso cosmetic? Thanks, Rob

1 0

Fedora 44, CentOS 7 and Amazon Linux syslog-ng questions
by Peter Czanik (pczanik) 19 May '26

19 May '26

Hi, This is a repost of my blog from last week, here on the mailing list. I need your feedback on CentOS 7 and Amazon Linux 2023 packages. You can respond here, or even better: at the URL at the end of my e-mail. Peter Fedora 44 was announced last week: syslog-ng 4.11 is part of it. While checking the Fedora Copr build service for Fedora 44, I realized that CentOS 7 and Amazon Linux 2023 packages are also there. I have a few questions about those for you! Fedora 44 The availability of the Fedora 44 release was announced last week. Vesion 4.11 of syslog-ng, the current latest release, is part of it. As usual, I did a quick test: everything works as expected. RHEL 6 The removal of RHEL 6 packages from Copr was announced many years ago. Then, the countdown was silently canceled. I have just checked: RHEL 6 packages are no longer available, so I deleted all my related repositories. Also, I deleted a couple of temporary test repos along the way. CentOS 7 When talking to product manager friends around the world, I realized that syslog-ng is not an “enterprise” application. “Enterprise” developers are still actively maintaining packages for RHEL 6, when even RHEL 7 has reached end of life a long time ago. Of course, this is just a satirical definition of “enterprise”, at least in my view… Support for RHEL 7 / CentOS 7 was dropped in syslog-ng a month before the distro became end-of-life. Copr announced the deletion of CentOS 7 packages, but after a while, the countdown suddenly disappeared. Packages built 10+ years ago are still here, and CentOS 7 is still a valid build target. Question: is there anyone still using my syslog-ng packages on RHEL 7 / CentOS 7? Otherwise, I would be happy to delete anything related from my Copr repositories. I could delete many repositories, save storage, and I would not have to deselect them as a build target during package builds. Amazon Linux 2023 Another question mark in my mind is Amazon Linux 2023 support. If we can believe the download statistics provided by Copr, then this is one of the most popular syslog-ng repos on Copr. However, over the years, I only received a single feedback about it, which was on Twitter years ago: “Thanks, I use it.” That is all. While there were regular requests to create these packages, nobody asked for features, updates, whatever. The repo is still stuck at syslog-ng version 4.8. Question: should I update syslog-ng to a more recent version, as time permits? What is next? Share your thoughts with us in this syslog-ng GitHub discussion: https://github.com/syslog-ng/syslog-ng/discussions/5691 or reach out to me on Twitter / Mastodon / LinkedIn. Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> One Identity (Balabit) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

The syslog-ng Insider 2026-05: OTEL; central log collection; old Mac
by Peter Czanik (pczanik) 14 May '26

14 May '26

Dear syslog-ng users, This is the 140th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Streaming syslog-ng data to your lakehouse using OTEL Version 4.11.0 of syslog-ng contains contributions from Databricks related to OAuth2 authentication. Recently, they published a blog about how this enables their customers to send logs to their data lake using syslog-ng and the OpenTelemetry protocol. https://www.syslog-ng.com/community/b/blog/posts/streaming-syslog-ng-data-t… Central log collection - more than just compliance I often hear, even at security conferences that “no central log collection here” or “we have something due to compliance”. Central logging is more than just compliance. It makes logs easier to use, available and secure, thus making your life easier in operations, security, development, but also in marketing, sales, and so on. https://www.syslog-ng.com/community/b/blog/posts/central-log-collection---m… Compiling syslog-ng on an old Mac I have an aging, but fully functional MacBook. I bought it for syslog-ng testing, but I also use for watching movies. Homebrew no more fully supports old, Intel-based Macs. This blog helps to compile the latest syslog-ng release on these old, but otherwise functional machines. https://www.syslog-ng.com/community/b/blog/posts/compiling-syslog-ng-on-an-… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> One Identity (Balabit) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

The syslog-ng Insider 2026-04: wildcard-file; fix; UDP
by Peter Czanik (pczanik) 08 Apr '26

08 Apr '26

Dear syslog-ng users, This is the 138th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Automatic configuration of the syslog-ng wildcard-file() source Reading files and monitoring directories became a lot more efficient in recent syslog-ng releases. However, it is also needed manual configuration. Version 4.11 of syslog-ng can automatically configure the optimal setting for both. https://www.syslog-ng.com/community/b/blog/posts/automatic-configuration-of… What to fix next in syslog-ng? Version 4.11 of syslog-ng will feature a brand-new Kafka source. While it is being tested and reviewed, we are working on reducing the number of open issues. What should be fixed next? https://www.syslog-ng.com/community/b/blog/posts/what-to-fix-next-in-syslog… UDP reliability improved in syslog-ng Debian packaging UDP log collection is a legacy feature that does not provide any security or reliability, but is still in wide use. You can improve its reliability using eBPF on Linux in recent syslog-ng versions. Support for eBPF was added to Debian packages while preparing for the 4.11.0 syslog-ng release. https://www.syslog-ng.com/community/b/blog/posts/udp-reliability-improved-i… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> One Identity (Balabit) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Syslogd in pfSense Community Edition Firewall version 2.8.1 Stops Sending Firewall Logs to Kiwi Syslog Server Every 7-8 days
by Turritopsis Dohrnii Teo En Ming 31 Mar '26

31 Mar '26

Subject: Syslogd in pfSense Community Edition Firewall version 2.8.1 Stops Sending Firewall Logs to Kiwi Syslog Server Every 7-8 days Good day from Singapore, I have a pfSense Community Edition Firewall version 2.8.1 at home. It is based on FreeBSD 15.0-CURRENT. My firewall hardware appliance has Intel Celeron J4125 CPU, 8 GB RAM and 64 GB of SSD. Now, every 7-8 days, syslogd in my pfsense firewall will stop sending firewall logs to Kiwi Syslog Server. I have already done my due diligence checks. There is nothing wrong with the Kiwi Syslog Server on my Windows 11 Home edition computer. Syslogd in my pfsense firewall will simply stop sending firewall logs to Kiwi Syslog Server every 7-8 days. I have to manually restart syslogd in pfsense firewall before it will send firewall logs to Kiwi Syslog Server again. How can I troubleshoot the problem in such a situation given there are no logging? Thank you in advance for your advice. Regards, Mr. Turritopsis Dohrnii Teo En Ming Extremely Democratic People's Republic of Singapore 31 Mar 2026 Tuesday 11.30 pm Singapore Time

1 0

The syslog-ng Insider 2026-03: 4.11.0 release; OpenSearch; ElasticSearch
by Peter Czanik (pczanik) 11 Mar '26

11 Mar '26

Dear syslog-ng users, This is the 138th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Version 4.11.0 of syslog-ng is now available Version 4.11.0 of syslog-ng is now available. The main attraction is the brand new Kafka source, but there are many other smaller features and improvements, as well. https://www.syslog-ng.com/community/b/blog/posts/version-4-11-0-of-syslog-n… Using OpenSearch data streams in syslog-ng Recently, one of our power users contributed OpenSearch data streams support to syslog-ng, which reminded me to also do some minimal testing on the latest OpenSearch release with syslog-ng. TL;DR: both worked just fine. https://www.syslog-ng.com/community/b/blog/posts/using-opensearch-data-stre…<https://www.syslog-ng.com/community/b/blog/posts/using-the-blank-filter-of-…> Changes in the syslog-ng Elasticsearch destination While testing the latest Elasticsearch release with syslog-ng, I realized that there was already a not fully documented elasticsearch-datastream() driver. Instead of fixing the docs, I reworked the elasticsearch-http() destination to support data streams. So, what was the problem? The driver follows a different logic in multiple places than the base elasticsearch-http() destination driver. Some of the descriptions were too general, others were missing completely. You had to read the configuration file in the syslog-ng configuration library (SCL) to configure the destination properly. While preparing for syslog-ng 4.11.0, the OpenSearch destination received a change that allows support for data streams. I applied these changes to the elasticsearch-http() destination, and did a small compatibility change along the way, so old configurations and samples from blogs work. https://www.syslog-ng.com/community/b/blog/posts/changes-in-the-syslog-ng-e… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> One Identity (Balabit) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0