- syslog-ng - lists.balabit.hu

The syslog-ng Insider 2026-03: 4.11.0 release; OpenSearch; ElasticSearch
by Peter Czanik (pczanik) 11 Mar '26

11 Mar '26

Dear syslog-ng users, This is the 138th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Version 4.11.0 of syslog-ng is now available Version 4.11.0 of syslog-ng is now available. The main attraction is the brand new Kafka source, but there are many other smaller features and improvements, as well. https://www.syslog-ng.com/community/b/blog/posts/version-4-11-0-of-syslog-n… Using OpenSearch data streams in syslog-ng Recently, one of our power users contributed OpenSearch data streams support to syslog-ng, which reminded me to also do some minimal testing on the latest OpenSearch release with syslog-ng. TL;DR: both worked just fine. https://www.syslog-ng.com/community/b/blog/posts/using-opensearch-data-stre…<https://www.syslog-ng.com/community/b/blog/posts/using-the-blank-filter-of-…> Changes in the syslog-ng Elasticsearch destination While testing the latest Elasticsearch release with syslog-ng, I realized that there was already a not fully documented elasticsearch-datastream() driver. Instead of fixing the docs, I reworked the elasticsearch-http() destination to support data streams. So, what was the problem? The driver follows a different logic in multiple places than the base elasticsearch-http() destination driver. Some of the descriptions were too general, others were missing completely. You had to read the configuration file in the syslog-ng configuration library (SCL) to configure the destination properly. While preparing for syslog-ng 4.11.0, the OpenSearch destination received a change that allows support for data streams. I applied these changes to the elasticsearch-http() destination, and did a small compatibility change along the way, so old configurations and samples from blogs work. https://www.syslog-ng.com/community/b/blog/posts/changes-in-the-syslog-ng-e… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> One Identity (Balabit) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng version 4.11.0 is now available
by Peter Czanik (pczanik) 25 Feb '26

25 Feb '26

Hi, I'm happy to share that syslog-ng version 4.11.0 is now available. 4.11.0 syslog-ng provides RPM<https://github.com/syslog-ng/syslog-ng#rhel> and DEB<https://github.com/syslog-ng/syslog-ng#debianubuntu> package repositories for Ubuntu, Debian, and RHEL, for both amd64 and arm64 architectures. We also provide ready-to-test binaries in Docker containers<https://hub.docker.com/r/balabit/syslog-ng/tags> based on the current stable Debian image. For more details, visit our Documentation Center<https://syslog-ng.github.io/> Highlights * kafka-source(): The new kafka() source can directly fetch log messages from the Apache Kafka message bus using the librdkafka client. It can fetch messages from explicitly named or wildcard-matching Kafka topics, and from a single partition, explicitly listed partitions, or all partitions of the selected topic(s). It supports the two main strategies — assign and subscribe — providing the flexibility to adapt to a wide range of Kafka setups and practical use cases, instead of forcing a single approach that may not fit all scenarios. It can fetch and process messages from the Kafka broker using multiple workers(), which may further improve throughput, especially when the main worker can fetch messages at high speed. For more details<https://syslog-ng.github.io/admin-guide/060_Sources/038_Kafka/README> and for all available options<https://syslog-ng.github.io/admin-guide/060_Sources/038_Kafka/001_Kafka_opt…>, please see our documentation. (#5564<https://github.com/syslog-ng/syslog-ng/pull/5564>) Features * cloud-auth: Add generic OAuth2 authentication module A generic OAuth2 authentication module supporting client credentials flow with configurable authentication methods (HTTP Basic Auth or POST body credentials) has been added. The module is extensible via virtual methods, allowing future authenticators to inherit common OAuth2 token management logic. (#5571<https://github.com/syslog-ng/syslog-ng/pull/5571>) * cloud-auth, grpc: Add OAuth2 support for gRPC destinations The cloud-auth() plugin now supports gRPC destinations in addition to HTTP destinations. This enables OAuth2 token management for any gRPC-based destination driver (such as bigquery(), opentelemetry(), loki(), etc.). The implementation uses the same signal/slot pattern as HTTP. Example configuration: destination d_grpc { opentelemetry( url("example.com:443") cloud-auth( oauth2( client_id("client-id") client_secret("client-secret") token_url("https://auth.example.com/token") scope("api-scope") ) ) ); } (#5584<https://github.com/syslog-ng/syslog-ng/pull/5584>) * darwinosl(): Added (fixed in an alternative way and enabled) the log-fetch-limit() option, which allows batched message forwarding in the log path. The fetch-delay() and fetch-retry-delay() options have both been renamed with the log- prefix; the old keywords are still supported but marked as deprecated. The enhanced internal loop for OSLog message processing now uses fewer resources during both processing and idle time. (#5547<https://github.com/syslog-ng/syslog-ng/pull/5547>) * network-load-balancer: add support for failover The confgen script for network-load-balancer now supports failover, generating the list of failover servers for each destination automatically. (#5562<https://github.com/syslog-ng/syslog-ng/pull/5562>) * file(), wildcard-file() source: Add auto follow-method() option A new follow-method() option, auto, has been added. In this automatic mode, syslog-ng OSE uses the following sequence to decide which method to use: Unfortunately, for backward compatibility reasons, the new auto option could not become the default at this time, but for new configurations, we recommend using monitor-method("auto") and follow-method("auto") to achieve the best available performance on the given platform. (#5602<https://github.com/syslog-ng/syslog-ng/pull/5602>) * the inotify method is used automatically if the system supports it (and none of the IV_SELECT_POLL_METHOD or IV_EXCLUDE_POLL_METHOD environment variables are set); otherwise * the best available (or the IV_SELECT_POLL_METHOD or IV_EXCLUDE_POLL_METHOD forced) system (ivykis) poll method of the platform is used; if none is available, * the old poll method is used * network()/syslog(): Add extended-key-usage-verify() option to TLS sources and destinations (#5588<https://github.com/syslog-ng/syslog-ng/pull/5588>) * Number parsing: Improve @NUMBER@ / @DOUBLE@ support for signed numbers When parsing numbers using the @NUMBER@ or @DOUBLE@ pattern parsers, certain signs were not allowed, causing PatternDB to reject properly formatted numbers. Explicit + signs at the beginning of a number or in the exponent part were rejected, and a - sign before a hexadecimal value was also not accepted. (#5620<https://github.com/syslog-ng/syslog-ng/pull/5620>) * elasticsearch, opensearch: Update SCL to support data streams (#5586<https://github.com/syslog-ng/syslog-ng/pull/5586>) * elasticsearch-http() and opensearch() now support data streams when using the op_type("create") parameter * the type("") parameter can now be omitted, and its value is silently ignored Bugfixes * json-parser: Fixed quoting of JSON array elements containing commas. (#5604<https://github.com/syslog-ng/syslog-ng/pull/5604>) * transport(proxied-tcp): Fixed an internal assertion–caused crash when a Proxy Protocol v2 message was received with a LOCAL command that was not handled previously. LOCAL commands are now treated as health check messages for both v1 and v2 proxy messages — accepted but dropped — as the protocol definition<https://github.com/syslog-ng/syslog-ng/blob/syslog-ng-4.11.0/www.haproxy.or…> specifies. (#5608<https://github.com/syslog-ng/syslog-ng/pull/5608>) * afsocket-source: Fixed two keep-alive() configuration reload–related issues. First, when a reload switched from keep-alive(yes) to keep-alive(no) with so-reuseport(no), the newly loaded configuration’s socket instance could fail to open. Second, in case of an error in the new configuration, the reload could fail to properly restore the previous connection state. (#5552<https://github.com/syslog-ng/syslog-ng/pull/5552>) * log-transport-tls: TLS-related macros, such as ${tls.x509_cn}, were not set in the first log message. (#5603<https://github.com/syslog-ng/syslog-ng/pull/5603>) * stats: Fixed stats reset memory counter underflow. (#5563<https://github.com/syslog-ng/syslog-ng/pull/5563>) * afsocket-source: Added a workaround for an issue where a reload switches from keep-alive(yes) to keep-alive(no) with so-reuseport(no), causing the newly loaded configuration’s socket instance to fail to open. (#5552<https://github.com/syslog-ng/syslog-ng/pull/5552>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: AshFungor, Bálint Horváth, Peter Czanik (CzP), davidtosovic-db, egglessness, Daniele Ferla, Hofi, Tamas Pal, Romain Tartière, Fᴀʙɪᴇɴ Wᴇʀɴʟɪ — This release has 3 assets: * syslog-ng-4.11.0.tar.gz * Source code (zip) * Source code (tar.gz) Visit the release page<https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.11.0> to download them. Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Plans for next release?
by David Tosovic 24 Feb '26

24 Feb '26

Hi all, I'm currently building syslog-ng from source as I'm utilizing some recent changes that are not in 4.10.2. I'm wondering if the next release is scheduled soon? Thanks, David

2 4

The syslog-ng Insider 2026-02: stats-exporter; blank filter; Kafka source
by Peter Czanik (pczanik) 12 Feb '26

12 Feb '26

Dear syslog-ng users, This is the 137th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS The syslog-ng stats-exporter() now has all functionality of syslog-ng-ctl The syslog-ng stats-exporter() allows you to collect syslog-ng statistics using Prometheus. Version 4.10 of syslog-ng added options to ensure that all related options of syslog-ng-ctl are now available in stats-exporter() too. https://www.syslog-ng.com/community/b/blog/posts/the-syslog-ng-stats-export… Using the blank() filter of syslog-ng The blank() filter is a filter function with a descriptive name: it selects empty or undefined name-value pairs. While most of the functionalities that blank filter provides are available long time ago, using this new filter makes configurations easier to understand. https://www.syslog-ng.com/community/b/blog/posts/using-the-blank-filter-of-… How to test the syslog-ng Kafka source by building the package yourself? A long-waited feature for syslog-ng, the Kafka source, is getting ready soon. The development is still in progress, but you can already try it, and it is worth the effort. How? Using the very same tool the syslog-ng testing and release process relies on. https://www.syslog-ng.com/community/b/blog/posts/how-to-test-the-syslog-ng-… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

iptables.log
by A 28 Dec '25

28 Dec '25

How to exclude such lines from logging? IN=net0 OUT= SRC=xxx.xxx.xxx.xxx DST=xxx.xxx.xxx.xxx LEN=xx TOS=0xxx PREC=0xxx TTL=xx ID=xxxx DF PROTO=xxx SPT=xxxx DPT=137 WINDOW=xxxxx RES=0xxx XXX URGP=X --

3 6

The syslog-ng Insider 2025-12: logrotation; release RPM; nightly RPM
by Peter Czanik (pczanik) 11 Dec '25

11 Dec '25

Dear syslog-ng users, This is the 136th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS File size-based log rotation in syslog-ng ----------------------------------------- Version 4.10 of syslog-ng introduced file size-based log rotation. Thanks to this, storage space is no longer filled with logs with the risk that you might not see older logs if the message rate is higher than expected. https://www.syslog-ng.com/community/b/blog/posts/file-size-based-log-rotati… Syslog-ng release packages for RHEL & Co. ----------------------------------------- I’ve been providing syslog-ng users release RPM packages for almost a decade now. However, from now on, RHEL & Co users can use packages provided directly by the syslog-ng team from a lot less obscure location. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-release-packages… Nightly syslog-ng RPM packages for RHEL & Co. --------------------------------------------- I have been providing syslog-ng users with weekly git snapshot RPM packages for almost a decade. From now on, RHEL & Co users can use nightly packages provided by the syslog-ng team, and from a lot less obscure location. As usual, these packages are for testing, not for production. https://www.syslog-ng.com/community/b/blog/posts/nightly-syslog-ng-rpm-pack… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Version 4.10.2 of syslog-ng is now available
by Peter Czanik (pczanik) 26 Nov '25

26 Nov '25

Hi, Version 4.10.2 of syslog-ng is now available. It's yet another bug fix release for 4.10 and fixes a number of problems reported after the release. If you use the webhook source, start syslog-ng directly from scripts or check stats values on a system with disk buffer, you should upgrade to 4.10.2. Otherwise, your current version should be OK. Peter 4.10.2 syslog-ng provides RPM<https://github.com/syslog-ng/syslog-ng#rhel> and DEB<https://github.com/syslog-ng/syslog-ng#debianubuntu> package repositories for Ubuntu, Debian, and RHEL, for both amd64 and arm64 architectures. We also provide ready-to-test binaries in Docker containers<https://hub.docker.com/r/balabit/syslog-ng/tags> based on the current stable Debian image. For more details, visit our Documentation Center<https://syslog-ng.github.io/> Version 4.10.2 is a bugfix release, and resolves the following issues. Bugfixes * Queued stats values of destinations could still contain weird values. (#5527<https://github.com/syslog-ng/syslog-ng/pull/5527>) * Unclosed standard file handlers could cause a hang when syslog-ng was started as a daemon. (#5532<https://github.com/syslog-ng/syslog-ng/pull/5532>) * The WebHook Python module could hang syslog-ng when started by systemd and systemctl stop syslog-ng was requested. (#5522<https://github.com/syslog-ng/syslog-ng/pull/5522>) * Our installer packages now include static index web pages and are browsable via RPM<https://ose-repo.syslog-ng.com/yum/> and DEB<https://ose-repo.syslog-ng.com/apt/>. (#5517<https://github.com/syslog-ng/syslog-ng/pull/5517>, #5518<https://github.com/syslog-ng/syslog-ng/pull/5518>, #5520<https://github.com/syslog-ng/syslog-ng/pull/5520>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Vivek Anand, Hofi, gotyaoi, Kovacs Gergo Ferenc, Tamas Pal, Tinkiter — This release has 3 assets: * syslog-ng-4.10.2.tar.gz * Source code (zip) * Source code (tar.gz) Visit the release page<https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.10.2> to download them. Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

4 9

issues with syslog facility "overflowing" to user facility?
by Ian Veach 19 Nov '25

19 Nov '25

Hi all - We're seeing some weird behavior on our central loghosts. Could be config, I suppose, but it seems unusual and I don't see config issue causing it. The summary is that we are using stats and dumping them into syslog.log, and that's fine. But we see weird "remnants" in user.log. It seems to contain syslog facility messages and is malformed as well. Bug? Or us? 🙂 This is a snip of the expected syslog.log: 2025-11-19T00:00:03.392632-08:00 redacted [syslog.info] syslog-ng[758325]: Log statistics; msg_size_avg='dst.file(d_log#0,/var/log/other/20251110/daemon.log)=111', truncated_bytes='dst.file(d_log#0,/var/log/other/20251006/daemon.log)=0', truncated_bytes='dst.file(d_log_systems#0,/var/log/other/20251002/syste..... This is a snip of user.log (same event/time looks like): 2025-11-19T00:00:03.392632-08:00 redacted [user.notice] var/log/other/20251022/daemon.log)=111',[]: eps_last_24h='dst.file(d_log#0,/var/log/other/20251022/daemon.log)=0', eps_last_1h='dst.file(d_log#0,/var/log/other/20250922/daemon.log)=0', eps_last_24h='dst.file(d_log#0,/var/log/other/20250922/daemon.log)=0',...... Here you can see for user.log that the format is actually messed up. $PROGRAM[$PID]: is missing/truncated (although look at the []: at the end of the first line), and the first part of the $MESSAGE is also missing/truncated. Some notes: * We're running syslog-ng as provided by Red Hat (syslog-ng-3.35.1-7.el9.x86_64) * endpoint is logging correctly (nothing in user.log). This is only centralized loghosts that we see this. * Stats level 1, freq 21600 Relevant configuration snips: log { source(s_local); source(s_net_unix_tcp); source(s_net_unix_udp); filter(f_catchall); destination(d_arc); }; filter f_catchall { not facility(local0, local1, local2, local3, local4, local5, local6, local7); }; destination d_arc { file("`LPTH`/$HOST_FROM/$YEAR/$MONTH/$DAY/$FACILITY.log" template(t_std) ); }; t_std: template("${ISODATE} $HOST_FROM [$FACILITY.$LEVEL] $PROGRAM[$PID]: $MESSAGE\n"); Thanks for any guidance! PUBLIC RECORDS NOTICE: In accordance with NRS Chapter 239, this email and responses, unless otherwise made confidential by law, may be subject to the Nevada Public Records laws and may be disclosed to the public upon request.

1 0

yum repository not browsable
by Evan Rempel 31 Oct '25

31 Oct '25

From time to time we have some challenge with the installation of packages from a repository. To troubleshoot the issue we usually use a web browser to brows the repository to "see what is there" and to download and inspect individual packages to determine signing and dependencies. The repository at ose-repo.syslog-ng.com is not browsable. https://ose-repo.syslog-ng.com/yum/stable/ results in a 404 error. Can the repository be changed to allow it to be browsed? Is there some reason to disallow browsing that escapes me? -- Evan

4 4

Beware Debian 13 syslog-ng stats setting
by John Kristoff 28 Oct '25

28 Oct '25

If you use Debian's packaged syslog-ng beware that you may have this set in your Debian 13 /etc/syslog-ng/syslog-ng.conf: stats(freq(1)); This was briefly introduced and then removed. You probably don't want it if you have it - daemon stats would be logged every second. Debian does not install syslog-ng by default and many may be installing packages from elsewhere or from source, so hopefully this does not have a wide impact. Where it was added: <https://github.com/gcsideal/syslog-ng-debian/commit/319fd669944def7dbb1bc50…> Where it was removed: <https://github.com/gcsideal/syslog-ng-debian/commit/f7ee172d62009cc6b5e6a62…> John

1 0