- syslog-ng - lists.balabit.hu

The syslog-ng Insider 2026-04: wildcard-file; fix; UDP
by Peter Czanik (pczanik) 08 Apr '26

08 Apr '26

Dear syslog-ng users, This is the 138th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Automatic configuration of the syslog-ng wildcard-file() source Reading files and monitoring directories became a lot more efficient in recent syslog-ng releases. However, it is also needed manual configuration. Version 4.11 of syslog-ng can automatically configure the optimal setting for both. https://www.syslog-ng.com/community/b/blog/posts/automatic-configuration-of… What to fix next in syslog-ng? Version 4.11 of syslog-ng will feature a brand-new Kafka source. While it is being tested and reviewed, we are working on reducing the number of open issues. What should be fixed next? https://www.syslog-ng.com/community/b/blog/posts/what-to-fix-next-in-syslog… UDP reliability improved in syslog-ng Debian packaging UDP log collection is a legacy feature that does not provide any security or reliability, but is still in wide use. You can improve its reliability using eBPF on Linux in recent syslog-ng versions. Support for eBPF was added to Debian packages while preparing for the 4.11.0 syslog-ng release. https://www.syslog-ng.com/community/b/blog/posts/udp-reliability-improved-i… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> One Identity (Balabit) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Syslogd in pfSense Community Edition Firewall version 2.8.1 Stops Sending Firewall Logs to Kiwi Syslog Server Every 7-8 days
by Turritopsis Dohrnii Teo En Ming 31 Mar '26

31 Mar '26

Subject: Syslogd in pfSense Community Edition Firewall version 2.8.1 Stops Sending Firewall Logs to Kiwi Syslog Server Every 7-8 days Good day from Singapore, I have a pfSense Community Edition Firewall version 2.8.1 at home. It is based on FreeBSD 15.0-CURRENT. My firewall hardware appliance has Intel Celeron J4125 CPU, 8 GB RAM and 64 GB of SSD. Now, every 7-8 days, syslogd in my pfsense firewall will stop sending firewall logs to Kiwi Syslog Server. I have already done my due diligence checks. There is nothing wrong with the Kiwi Syslog Server on my Windows 11 Home edition computer. Syslogd in my pfsense firewall will simply stop sending firewall logs to Kiwi Syslog Server every 7-8 days. I have to manually restart syslogd in pfsense firewall before it will send firewall logs to Kiwi Syslog Server again. How can I troubleshoot the problem in such a situation given there are no logging? Thank you in advance for your advice. Regards, Mr. Turritopsis Dohrnii Teo En Ming Extremely Democratic People's Republic of Singapore 31 Mar 2026 Tuesday 11.30 pm Singapore Time

1 0

The syslog-ng Insider 2026-03: 4.11.0 release; OpenSearch; ElasticSearch
by Peter Czanik (pczanik) 11 Mar '26

11 Mar '26

Dear syslog-ng users, This is the 138th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Version 4.11.0 of syslog-ng is now available Version 4.11.0 of syslog-ng is now available. The main attraction is the brand new Kafka source, but there are many other smaller features and improvements, as well. https://www.syslog-ng.com/community/b/blog/posts/version-4-11-0-of-syslog-n… Using OpenSearch data streams in syslog-ng Recently, one of our power users contributed OpenSearch data streams support to syslog-ng, which reminded me to also do some minimal testing on the latest OpenSearch release with syslog-ng. TL;DR: both worked just fine. https://www.syslog-ng.com/community/b/blog/posts/using-opensearch-data-stre…<https://www.syslog-ng.com/community/b/blog/posts/using-the-blank-filter-of-…> Changes in the syslog-ng Elasticsearch destination While testing the latest Elasticsearch release with syslog-ng, I realized that there was already a not fully documented elasticsearch-datastream() driver. Instead of fixing the docs, I reworked the elasticsearch-http() destination to support data streams. So, what was the problem? The driver follows a different logic in multiple places than the base elasticsearch-http() destination driver. Some of the descriptions were too general, others were missing completely. You had to read the configuration file in the syslog-ng configuration library (SCL) to configure the destination properly. While preparing for syslog-ng 4.11.0, the OpenSearch destination received a change that allows support for data streams. I applied these changes to the elasticsearch-http() destination, and did a small compatibility change along the way, so old configurations and samples from blogs work. https://www.syslog-ng.com/community/b/blog/posts/changes-in-the-syslog-ng-e… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> One Identity (Balabit) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng version 4.11.0 is now available
by Peter Czanik (pczanik) 25 Feb '26

25 Feb '26

Hi, I'm happy to share that syslog-ng version 4.11.0 is now available. 4.11.0 syslog-ng provides RPM<https://github.com/syslog-ng/syslog-ng#rhel> and DEB<https://github.com/syslog-ng/syslog-ng#debianubuntu> package repositories for Ubuntu, Debian, and RHEL, for both amd64 and arm64 architectures. We also provide ready-to-test binaries in Docker containers<https://hub.docker.com/r/balabit/syslog-ng/tags> based on the current stable Debian image. For more details, visit our Documentation Center<https://syslog-ng.github.io/> Highlights * kafka-source(): The new kafka() source can directly fetch log messages from the Apache Kafka message bus using the librdkafka client. It can fetch messages from explicitly named or wildcard-matching Kafka topics, and from a single partition, explicitly listed partitions, or all partitions of the selected topic(s). It supports the two main strategies — assign and subscribe — providing the flexibility to adapt to a wide range of Kafka setups and practical use cases, instead of forcing a single approach that may not fit all scenarios. It can fetch and process messages from the Kafka broker using multiple workers(), which may further improve throughput, especially when the main worker can fetch messages at high speed. For more details<https://syslog-ng.github.io/admin-guide/060_Sources/038_Kafka/README> and for all available options<https://syslog-ng.github.io/admin-guide/060_Sources/038_Kafka/001_Kafka_opt…>, please see our documentation. (#5564<https://github.com/syslog-ng/syslog-ng/pull/5564>) Features * cloud-auth: Add generic OAuth2 authentication module A generic OAuth2 authentication module supporting client credentials flow with configurable authentication methods (HTTP Basic Auth or POST body credentials) has been added. The module is extensible via virtual methods, allowing future authenticators to inherit common OAuth2 token management logic. (#5571<https://github.com/syslog-ng/syslog-ng/pull/5571>) * cloud-auth, grpc: Add OAuth2 support for gRPC destinations The cloud-auth() plugin now supports gRPC destinations in addition to HTTP destinations. This enables OAuth2 token management for any gRPC-based destination driver (such as bigquery(), opentelemetry(), loki(), etc.). The implementation uses the same signal/slot pattern as HTTP. Example configuration: destination d_grpc { opentelemetry( url("example.com:443") cloud-auth( oauth2( client_id("client-id") client_secret("client-secret") token_url("https://auth.example.com/token") scope("api-scope") ) ) ); } (#5584<https://github.com/syslog-ng/syslog-ng/pull/5584>) * darwinosl(): Added (fixed in an alternative way and enabled) the log-fetch-limit() option, which allows batched message forwarding in the log path. The fetch-delay() and fetch-retry-delay() options have both been renamed with the log- prefix; the old keywords are still supported but marked as deprecated. The enhanced internal loop for OSLog message processing now uses fewer resources during both processing and idle time. (#5547<https://github.com/syslog-ng/syslog-ng/pull/5547>) * network-load-balancer: add support for failover The confgen script for network-load-balancer now supports failover, generating the list of failover servers for each destination automatically. (#5562<https://github.com/syslog-ng/syslog-ng/pull/5562>) * file(), wildcard-file() source: Add auto follow-method() option A new follow-method() option, auto, has been added. In this automatic mode, syslog-ng OSE uses the following sequence to decide which method to use: Unfortunately, for backward compatibility reasons, the new auto option could not become the default at this time, but for new configurations, we recommend using monitor-method("auto") and follow-method("auto") to achieve the best available performance on the given platform. (#5602<https://github.com/syslog-ng/syslog-ng/pull/5602>) * the inotify method is used automatically if the system supports it (and none of the IV_SELECT_POLL_METHOD or IV_EXCLUDE_POLL_METHOD environment variables are set); otherwise * the best available (or the IV_SELECT_POLL_METHOD or IV_EXCLUDE_POLL_METHOD forced) system (ivykis) poll method of the platform is used; if none is available, * the old poll method is used * network()/syslog(): Add extended-key-usage-verify() option to TLS sources and destinations (#5588<https://github.com/syslog-ng/syslog-ng/pull/5588>) * Number parsing: Improve @NUMBER@ / @DOUBLE@ support for signed numbers When parsing numbers using the @NUMBER@ or @DOUBLE@ pattern parsers, certain signs were not allowed, causing PatternDB to reject properly formatted numbers. Explicit + signs at the beginning of a number or in the exponent part were rejected, and a - sign before a hexadecimal value was also not accepted. (#5620<https://github.com/syslog-ng/syslog-ng/pull/5620>) * elasticsearch, opensearch: Update SCL to support data streams (#5586<https://github.com/syslog-ng/syslog-ng/pull/5586>) * elasticsearch-http() and opensearch() now support data streams when using the op_type("create") parameter * the type("") parameter can now be omitted, and its value is silently ignored Bugfixes * json-parser: Fixed quoting of JSON array elements containing commas. (#5604<https://github.com/syslog-ng/syslog-ng/pull/5604>) * transport(proxied-tcp): Fixed an internal assertion–caused crash when a Proxy Protocol v2 message was received with a LOCAL command that was not handled previously. LOCAL commands are now treated as health check messages for both v1 and v2 proxy messages — accepted but dropped — as the protocol definition<https://github.com/syslog-ng/syslog-ng/blob/syslog-ng-4.11.0/www.haproxy.or…> specifies. (#5608<https://github.com/syslog-ng/syslog-ng/pull/5608>) * afsocket-source: Fixed two keep-alive() configuration reload–related issues. First, when a reload switched from keep-alive(yes) to keep-alive(no) with so-reuseport(no), the newly loaded configuration’s socket instance could fail to open. Second, in case of an error in the new configuration, the reload could fail to properly restore the previous connection state. (#5552<https://github.com/syslog-ng/syslog-ng/pull/5552>) * log-transport-tls: TLS-related macros, such as ${tls.x509_cn}, were not set in the first log message. (#5603<https://github.com/syslog-ng/syslog-ng/pull/5603>) * stats: Fixed stats reset memory counter underflow. (#5563<https://github.com/syslog-ng/syslog-ng/pull/5563>) * afsocket-source: Added a workaround for an issue where a reload switches from keep-alive(yes) to keep-alive(no) with so-reuseport(no), causing the newly loaded configuration’s socket instance to fail to open. (#5552<https://github.com/syslog-ng/syslog-ng/pull/5552>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: AshFungor, Bálint Horváth, Peter Czanik (CzP), davidtosovic-db, egglessness, Daniele Ferla, Hofi, Tamas Pal, Romain Tartière, Fᴀʙɪᴇɴ Wᴇʀɴʟɪ — This release has 3 assets: * syslog-ng-4.11.0.tar.gz * Source code (zip) * Source code (tar.gz) Visit the release page<https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.11.0> to download them. Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Plans for next release?
by David Tosovic 24 Feb '26

24 Feb '26

Hi all, I'm currently building syslog-ng from source as I'm utilizing some recent changes that are not in 4.10.2. I'm wondering if the next release is scheduled soon? Thanks, David

2 4

The syslog-ng Insider 2026-02: stats-exporter; blank filter; Kafka source
by Peter Czanik (pczanik) 12 Feb '26

12 Feb '26

Dear syslog-ng users, This is the 137th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS The syslog-ng stats-exporter() now has all functionality of syslog-ng-ctl The syslog-ng stats-exporter() allows you to collect syslog-ng statistics using Prometheus. Version 4.10 of syslog-ng added options to ensure that all related options of syslog-ng-ctl are now available in stats-exporter() too. https://www.syslog-ng.com/community/b/blog/posts/the-syslog-ng-stats-export… Using the blank() filter of syslog-ng The blank() filter is a filter function with a descriptive name: it selects empty or undefined name-value pairs. While most of the functionalities that blank filter provides are available long time ago, using this new filter makes configurations easier to understand. https://www.syslog-ng.com/community/b/blog/posts/using-the-blank-filter-of-… How to test the syslog-ng Kafka source by building the package yourself? A long-waited feature for syslog-ng, the Kafka source, is getting ready soon. The development is still in progress, but you can already try it, and it is worth the effort. How? Using the very same tool the syslog-ng testing and release process relies on. https://www.syslog-ng.com/community/b/blog/posts/how-to-test-the-syslog-ng-… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

iptables.log
by A 28 Dec '25

28 Dec '25

How to exclude such lines from logging? IN=net0 OUT= SRC=xxx.xxx.xxx.xxx DST=xxx.xxx.xxx.xxx LEN=xx TOS=0xxx PREC=0xxx TTL=xx ID=xxxx DF PROTO=xxx SPT=xxxx DPT=137 WINDOW=xxxxx RES=0xxx XXX URGP=X --

3 6

The syslog-ng Insider 2025-12: logrotation; release RPM; nightly RPM
by Peter Czanik (pczanik) 11 Dec '25

11 Dec '25

Dear syslog-ng users, This is the 136th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS File size-based log rotation in syslog-ng ----------------------------------------- Version 4.10 of syslog-ng introduced file size-based log rotation. Thanks to this, storage space is no longer filled with logs with the risk that you might not see older logs if the message rate is higher than expected. https://www.syslog-ng.com/community/b/blog/posts/file-size-based-log-rotati… Syslog-ng release packages for RHEL & Co. ----------------------------------------- I’ve been providing syslog-ng users release RPM packages for almost a decade now. However, from now on, RHEL & Co users can use packages provided directly by the syslog-ng team from a lot less obscure location. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-release-packages… Nightly syslog-ng RPM packages for RHEL & Co. --------------------------------------------- I have been providing syslog-ng users with weekly git snapshot RPM packages for almost a decade. From now on, RHEL & Co users can use nightly packages provided by the syslog-ng team, and from a lot less obscure location. As usual, these packages are for testing, not for production. https://www.syslog-ng.com/community/b/blog/posts/nightly-syslog-ng-rpm-pack… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Version 4.10.2 of syslog-ng is now available
by Peter Czanik (pczanik) 26 Nov '25

26 Nov '25

Hi, Version 4.10.2 of syslog-ng is now available. It's yet another bug fix release for 4.10 and fixes a number of problems reported after the release. If you use the webhook source, start syslog-ng directly from scripts or check stats values on a system with disk buffer, you should upgrade to 4.10.2. Otherwise, your current version should be OK. Peter 4.10.2 syslog-ng provides RPM<https://github.com/syslog-ng/syslog-ng#rhel> and DEB<https://github.com/syslog-ng/syslog-ng#debianubuntu> package repositories for Ubuntu, Debian, and RHEL, for both amd64 and arm64 architectures. We also provide ready-to-test binaries in Docker containers<https://hub.docker.com/r/balabit/syslog-ng/tags> based on the current stable Debian image. For more details, visit our Documentation Center<https://syslog-ng.github.io/> Version 4.10.2 is a bugfix release, and resolves the following issues. Bugfixes * Queued stats values of destinations could still contain weird values. (#5527<https://github.com/syslog-ng/syslog-ng/pull/5527>) * Unclosed standard file handlers could cause a hang when syslog-ng was started as a daemon. (#5532<https://github.com/syslog-ng/syslog-ng/pull/5532>) * The WebHook Python module could hang syslog-ng when started by systemd and systemctl stop syslog-ng was requested. (#5522<https://github.com/syslog-ng/syslog-ng/pull/5522>) * Our installer packages now include static index web pages and are browsable via RPM<https://ose-repo.syslog-ng.com/yum/> and DEB<https://ose-repo.syslog-ng.com/apt/>. (#5517<https://github.com/syslog-ng/syslog-ng/pull/5517>, #5518<https://github.com/syslog-ng/syslog-ng/pull/5518>, #5520<https://github.com/syslog-ng/syslog-ng/pull/5520>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Vivek Anand, Hofi, gotyaoi, Kovacs Gergo Ferenc, Tamas Pal, Tinkiter — This release has 3 assets: * syslog-ng-4.10.2.tar.gz * Source code (zip) * Source code (tar.gz) Visit the release page<https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.10.2> to download them. Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

4 9

issues with syslog facility "overflowing" to user facility?
by Ian Veach 19 Nov '25

19 Nov '25

Hi all - We're seeing some weird behavior on our central loghosts. Could be config, I suppose, but it seems unusual and I don't see config issue causing it. The summary is that we are using stats and dumping them into syslog.log, and that's fine. But we see weird "remnants" in user.log. It seems to contain syslog facility messages and is malformed as well. Bug? Or us? 🙂 This is a snip of the expected syslog.log: 2025-11-19T00:00:03.392632-08:00 redacted [syslog.info] syslog-ng[758325]: Log statistics; msg_size_avg='dst.file(d_log#0,/var/log/other/20251110/daemon.log)=111', truncated_bytes='dst.file(d_log#0,/var/log/other/20251006/daemon.log)=0', truncated_bytes='dst.file(d_log_systems#0,/var/log/other/20251002/syste..... This is a snip of user.log (same event/time looks like): 2025-11-19T00:00:03.392632-08:00 redacted [user.notice] var/log/other/20251022/daemon.log)=111',[]: eps_last_24h='dst.file(d_log#0,/var/log/other/20251022/daemon.log)=0', eps_last_1h='dst.file(d_log#0,/var/log/other/20250922/daemon.log)=0', eps_last_24h='dst.file(d_log#0,/var/log/other/20250922/daemon.log)=0',...... Here you can see for user.log that the format is actually messed up. $PROGRAM[$PID]: is missing/truncated (although look at the []: at the end of the first line), and the first part of the $MESSAGE is also missing/truncated. Some notes: * We're running syslog-ng as provided by Red Hat (syslog-ng-3.35.1-7.el9.x86_64) * endpoint is logging correctly (nothing in user.log). This is only centralized loghosts that we see this. * Stats level 1, freq 21600 Relevant configuration snips: log { source(s_local); source(s_net_unix_tcp); source(s_net_unix_udp); filter(f_catchall); destination(d_arc); }; filter f_catchall { not facility(local0, local1, local2, local3, local4, local5, local6, local7); }; destination d_arc { file("`LPTH`/$HOST_FROM/$YEAR/$MONTH/$DAY/$FACILITY.log" template(t_std) ); }; t_std: template("${ISODATE} $HOST_FROM [$FACILITY.$LEVEL] $PROGRAM[$PID]: $MESSAGE\n"); Thanks for any guidance! PUBLIC RECORDS NOTICE: In accordance with NRS Chapter 239, this email and responses, unless otherwise made confidential by law, may be subject to the Nevada Public Records laws and may be disclosed to the public upon request.

1 0