- syslog-ng - lists.balabit.hu

Insider 2020-06: edge; log management layer; WSL;
by Peter Czanik (pczanik) 11 Jun '20

11 Jun '20

Dear syslog-ng users, This is the 82nd issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Syslog-ng on the edge --------------------- After many years of pushing all computing from on-site to the cloud or huge data centers, there is a new trend: edge computing. There can be many reasons, legal or practical, why data should be processed locally instead of being sent to a central location as soon as it is created. Edge computing was a central theme of the recently held Red Hat Summit. Luckily syslog-ng is well prepared for this use case right from the beginning. While most people only know that syslog-ng can act as a client or a server, it can also collect, process and forward log messages. In syslog-ng terminology it is called a relay, but on the edge you might want to combine server and a relay functionality into one. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-on-the-edge Creating a dedicated log management layer ----------------------------------------- Event logging is a central source of information both for IT security and operations, but different teams use different tools to collect and analyze log messages. The same log message is often collected by multiple applications. Having each team using different tools is complex, inefficient and makes systems less secure. Using a single application to create a dedicated log management layer independent of analytics instead, however, has multiple benefits. Using syslog-ng is a lot more flexible than most log aggregation tools provided by log analytics vendors. This is one of the reasons why my talks and blogs focused on how to make your life easier using its technical advantages. Of course, I am aware of the direct financial benefits as well. If you are interested in that part, talk to my colleagues on the business side. They can help you to calculate how much you can save on your SIEM licenses when syslog-ng collects log messages and ensures that only relevant messages reach your SIEM and only at a predicatively low message rate. You can learn more about this use case on our Optimizing SIEM page. In this blog, I will focus on a third aspect: simplifying complexity. This was the focus of many of my conference discussions before the COVID-19 pandemic. If we think a bit more about it, we can see that this is not really a third aspect, but a combination of the previous two instead. Using the flexibility of syslog-ng, we create a dedicated log management layer in front of different log analytics solutions. By reducing complexity, we can save in many ways: on computing and human resources, and on licensing when using commercial tools for log analysis as well. https://www.syslog-ng.com/community/b/blog/posts/creating-a-dedicated-log-m… I will cover this topic more in depth in my upcoming talk at the Pass the SALT conference: https://pass-the-salt.org/ Using syslog-ng in WSL ---------------------- Windows Subsystem for Linux (WSL) is an optional feature of Windows 10 for developers who want the power of Linux (especially the Linux shell) on their Windows desktops. Of course, it is more than just a shell: you can easily install and run any command line applications (but not GUI). As a Linux desktop user, I do not need WSL to access a Linux shell, but as I am often asked how syslog-ng runs in WSL, I finally gave it a try. The recurring questions are if syslog-ng runs at all in WSL and what the performance compared to syslog-ng installed on Linux is. As I run openSUSE Leap 15.1 as my main operating system on my laptop, I used that in WSL as well. I tested not just WSL 1, which has been generally available for years, but also the upcoming WSL 2, which brings tons of performance improvements. As WSL 2 involves virtualization, I also tested syslog-ng in Vmware Workstation running on Windows. In all cases, I used the latest syslog-ng 3.26 from my unofficial syslog-ng repository for openSUSE and a minimally modified syslog-ng.conf to enable the network source. Benchmarking was done both from localhost and from a small Xeon server on the local network, attached through Gigabit Ethernet. https://www.syslog-ng.com/community/b/blog/posts/using-syslog-ng-in-wsl CONFERENCES * ”Creating a dedicated log management layer” talk at the virtual Pass the SALT conference: https://pass-the-salt.org/ WEBINARS * Learn how to do custom HTTP REST API Authentication with syslog-ng: https://www.syslog-ng.com/event/customize-http-rest-apis-authentication-wit… * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Poll: Do you use any of the Java-based destination drivers of syslog-ng?
by Peter Czanik (pczanik) 10 Jun '20

10 Jun '20

Hi, Just posted a poll on Twitter, but answers are also very welcome here. Do you use any of the Java-based destination drivers of syslog-ng? HDFS, Kafka (not the C implementation) or Elasticsearch (not the elasticsearch-http() version). Or do you use the syslog-ng Java bindings with your own custom Java module? Let as know here or on Twitter at https://twitter.com/PCzanik/status/1270700394059104263 Also, please RT the above tweet to reach more syslog-ng users! Thanks, Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Fwd: Memleak in syslog-ng v3.19.1
by Vidya Balakrishnan 09 Jun '20

09 Jun '20

Greetings, This mail is regarding Memory leak in Syslog-ng v3.19.1. The process gets launched at 26MB and then grows to 37MB or even upto 45MB. Pasting the configurations used below: @version: 3.19 @include "scl.conf" source s_local { #system(); #internal(); syslog(port(514) transport("udp")); }; rewrite tag_SN { set("ABC-XXXXXXX", value("HOST")); }; destination d_Log_Server { network("abcd.com" port(514) transport(tls) tls( ca-dir("/etc/ssl") peer-verify("required-trusted") ) time-zone("+00:00") template("${R_YEAR}-${R_MONTH}-${R_DAY}T${R_HOUR}:${R_MIN}:${R_SEC}.${R_MSEC}${TZOFFSET} ${HOST} ${MSGHDR}${MESSAGE}\n") ); }; log { source(s_local); rewrite(tag_SN); destination(d_Log_Server); }; Also, tried debugging using valgrind but did not resolve the issue. ==19671== Memcheck, a memory error detector ==19671== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al. ==19671== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info ==19671== Command: /sbin/syslog-ng --cfgfile=/var/syslog-ng.conf ==19671== Parent PID: 2190 ==19671== ==19671== Conditional jump or move depends on uninitialised value(s) ==19671== at 0x401A8D4: index (in /lib/ld-linux.so.3) ==19671== by 0x4007F33: expand_dynamic_string_token (in /lib/ld-linux.so.3) ==19671== ==19671== Conditional jump or move depends on uninitialised value(s) ==19671== at 0x401A8D8: index (in /lib/ld-linux.so.3) ==19671== by 0x4007F33: expand_dynamic_string_token (in /lib/ld-linux.so.3) ==19671== ==19671== Conditional jump or move depends on uninitialised value(s) ==19671== at 0x4007F38: expand_dynamic_string_token (in /lib/ld-linux.so.3) ==19671== disInstr(arm): unhandled instruction: 0xEC510F1E cond=14(0xE) 27:20=197(0xC5) 4:4=1 3:0=14(0xE) ==19671== valgrind: Unrecognised instruction at address 0x4cd6e68. ==19671== at 0x4CD6E68: _armv7_tick (in /lib/libcrypto.so.1.1) ==19671== Your program just tried to execute an instruction that Valgrind ==19671== did not recognise. There are two possible reasons for this. ==19671== 1. Your program has a bug and erroneously jumped to a non-code ==19671== location. If you are running Memcheck and you just saw a ==19671== warning about a bad jump, it's probably your program's fault. ==19671== 2. The instruction is legitimate but Valgrind doesn't handle it, ==19671== i.e. it's Valgrind's fault. If you think this is the case or ==19671== you are not sure, please let us know and we'll try to fix it. ==19671== Either way, Valgrind will now raise a SIGILL signal which will ==19671== probably kill your program. ==19700== Invalid read of size 4 ==19700== at 0x401A8D4: index (in /lib/ld-linux.so.3) ==19700== by 0x40145BB: dl_open_worker (in /lib/ld-linux.so.3) ==19700== Address 0x4f86bb4 is 3 bytes after a block of size 41 alloc'd ==19700== at 0x4847654: malloc (vg_replace_malloc.c:299) ==19700== by 0x49B3BC3: g_malloc (gmem.c:94) ==19700== by 0x49CEA17: g_strdup (gstrfuncs.c:363) ==19700== by 0x49417BF: g_module_open (gmodule.c:543) ==19700== by 0x489AFDB: plugin_dlopen_module_as_filename (plugin.c:252) ==19700== by 0x489B8B3: plugin_dlopen_module_as_dir_and_filename (plugin.c:271) ==19700== by 0x489B8B3: plugin_load_candidate_modules (plugin.c:457) ==19700== by 0x4887017: cfg_lexer_preprocess (cfg-lexer.c:1068) ==19700== by 0x4887017: cfg_lexer_lex (cfg-lexer.c:1110) ==19700== by 0x48A876F: main_parse (cfg-grammar.c:3143) ==19700== by 0x4887D8F: cfg_parser_parse (cfg-parser.c:369) ==19700== by 0x48845BF: cfg_run_parser (cfg.c:504) ==19700== by 0x48846B3: cfg_read_config (cfg.c:556) ==19700== by 0x489766B: main_loop_read_and_init_config (mainloop.c:552) ==19700== ==19700== Conditional jump or move depends on uninitialised value(s) ==19700== at 0x401A8D4: index (in /lib/ld-linux.so.3) ==19700== by 0x40145BB: dl_open_worker (in /lib/ld-linux.so.3) ==19700== ==19700== Conditional jump or move depends on uninitialised value(s) ==19700== at 0x401A8D8: index (in /lib/ld-linux.so.3) ==19700== by 0x40145BB: dl_open_worker (in /lib/ld-linux.so.3) ==19700== ==19700== Conditional jump or move depends on uninitialised value(s) ==19700== at 0x40145C0: dl_open_worker (in /lib/ld-linux.so.3) ==19700== ==19700== Conditional jump or move depends on uninitialised value(s) ==19700== at 0x401AD9C: strcpy (in /lib/ld-linux.so.3) ==19700== by 0x400A8D3: _dl_lookup_symbol_x (in /lib/ld-linux.so.3) ==19700== ==19700== Invalid read of size 4 ==19700== at 0x401AC60: strcpy (in /lib/ld-linux.so.3) ==19700== by 0x400A8D3: _dl_lookup_symbol_x (in /lib/ld-linux.so.3) ==19700== Address 0x5185254 is 0 bytes after a block of size 20 alloc'd ==19700== at 0x4849EB4: realloc (vg_replace_malloc.c:785) ==19700== by 0x49B3C9B: g_realloc (gmem.c:159) ==19700== by 0x49FCAF3: _g_gnulib_vasnprintf (vasnprintf.c:5533) ==19700== by 0x49FD263: _g_gnulib_vasprintf (printf.c:142) ==19700== by 0x49F6B0B: g_vasprintf (gprintf.c:310) ==19700== by 0x49CEB7F: g_strdup_vprintf (gstrfuncs.c:514) ==19700== by 0x49CEBAB: g_strdup_printf (gstrfuncs.c:540) ==19700== by 0x489AF7F: plugin_get_module_init_name (plugin.c:234) ==19700== by 0x489B363: plugin_load_module (plugin.c:364) ==19700== by 0x48ABCAB: pragma_parse (pragma-grammar.y:443) ==19700== by 0x4887D8F: cfg_parser_parse (cfg-parser.c:369) ==19700== by 0x4886E9B: cfg_lexer_parse_pragma (cfg-lexer.c:996) ==19700== by 0x4886E9B: cfg_lexer_preprocess (cfg-lexer.c:1040) ==19700== by 0x4886E9B: cfg_lexer_lex (cfg-lexer.c:1110) ==19700== ==19700== Conditional jump or move depends on uninitialised value(s) ==19700== at 0x401AD80: strcpy (in /lib/ld-linux.so.3) ==19700== by 0x400A8D3: _dl_lookup_symbol_x (in /lib/ld-linux.so.3) ==19700== ==19700== Use of uninitialised value of size 4 ==19700== at 0x401ACB8: strcpy (in /lib/ld-linux.so.3) ==19700== by 0x400A8D3: _dl_lookup_symbol_x (in /lib/ld-linux.so.3) ==19700== ==19700== Invalid read of size 4 ==19700== at 0x401ADAC: strcpy (in /lib/ld-linux.so.3) ==19700== by 0x400A8D3: _dl_lookup_symbol_x (in /lib/ld-linux.so.3) ==19700== Address 0x533bdac is 3 bytes after a block of size 25 alloc'd ==19700== at 0x4849EB4: realloc (vg_replace_malloc.c:785) ==19700== by 0x49B3C9B: g_realloc (gmem.c:159) ==19700== by 0x49FCAF3: _g_gnulib_vasnprintf (vasnprintf.c:5533) ==19700== by 0x49FD263: _g_gnulib_vasprintf (printf.c:142) ==19700== by 0x49F6B0B: g_vasprintf (gprintf.c:310) ==19700== by 0x49CEB7F: g_strdup_vprintf (gstrfuncs.c:514) ==19700== by 0x49CEBAB: g_strdup_printf (gstrfuncs.c:540) ==19700== by 0x489AF7F: plugin_get_module_init_name (plugin.c:234) ==19700== by 0x489B363: plugin_load_module (plugin.c:364) ==19700== by 0x489B6BB: plugin_find (plugin.c:199) ==19700== by 0x489921B: msg_format_options_init (msg-format.c:81) ==19700== by 0x4891A9B: log_reader_options_init (logreader.c:728) ==19700== ==19700== Conditional jump or move depends on uninitialised value(s) ==19700== at 0x401ADC4: strcpy (in /lib/ld-linux.so.3) ==19700== by 0x400A8D3: _dl_lookup_symbol_x (in /lib/ld-linux.so.3) ==19700== ==19700== Conditional jump or move depends on uninitialised value(s) ==19700== at 0x401A8D4: index (in /lib/ld-linux.so.3) ==19700== by 0x4008BFB: _dl_map_object (in /lib/ld-linux.so.3) ==19700== ==19700== Conditional jump or move depends on uninitialised value(s) ==19700== at 0x401A8D8: index (in /lib/ld-linux.so.3) ==19700== by 0x4008BFB: _dl_map_object (in /lib/ld-linux.so.3) ==19700== ==19700== Conditional jump or move depends on uninitialised value(s) ==19700== at 0x4008C00: _dl_map_object (in /lib/ld-linux.so.3) ==19700== ==19700== Syscall param epoll_pwait(sigmask) points to unaddressable byte(s) ==19700== at 0x4BCC73C: epoll_pwait (in /lib/libc.so.6) ==19700== Address 0x0 is not stack'd, malloc'd or (recently) free'd ==19700== ==19671== ==19671== HEAP SUMMARY: ==19671== in use at exit: 11,980 bytes in 55 blocks ==19671== total heap usage: 179 allocs, 124 frees, 49,157 bytes allocated ==19671== ==19671== 419 (44 direct, 375 indirect) bytes in 1 blocks are definitely lost in loss record 44 of 46 ==19671== at 0x4847654: malloc (vg_replace_malloc.c:299) ==19671== by 0x49B3BC3: g_malloc (gmem.c:94) ==19671== by 0x488BD07: g_process_set_argv_space (gprocess.c:569) ==19671== by 0x1127B: main (main.c:216) ==19671== ==19671== LEAK SUMMARY: ==19671== definitely lost: 44 bytes in 1 blocks ==19671== indirectly lost: 375 bytes in 10 blocks ==19671== possibly lost: 0 bytes in 0 blocks ==19671== still reachable: 11,561 bytes in 44 blocks ==19671== suppressed: 0 bytes in 0 blocks ==19671== Reachable blocks (those to which a pointer was found) are not shown. ==19671== To see them, rerun with: --leak-check=full --show-leak-kinds=all The memory usage keeps increasing. There are no local disks used to store the logs messages. It is directly sent to the Graylog server. Could you please take a look at this issue and help resolving the same. Regards, Vidya Balakrishnan

2 4

my syslog-ng-stable repos updated to 3.27
by Peter Czanik (pczanik) 08 Jun '20

08 Jun '20

Hi, My unofficial syslog-ng-stable repos for openSUSE/SLES and Fedora/RHEL/CentOS are now updated to syslog-ng 3.27. As you might recall, version 3.26 was skipped, as it arrived at a time when nobody was touching systems (beginning of WFH). 3.27 was relesaed a while ago. It seems to run fine everywhere, so I found it as a safe choice for the stable repo. (side note: thanks to those who reminded me to update the repos. The one drawback that I don't update immediately after release, that sometimes I forget it completely... 🙂 ). As usual: let me know, if you run into any problems with the packages. Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Re: [syslog-ng] Message and Header are being split incorrectly
by Sass, Fabian 05 Jun '20

05 Jun '20

Hi Peter, thanks a lot, this resolved the issue without having to use hacky templates. Still it bugs me out that rewriting $PROGRAM didn't work. Any idea why? According to the other list posting it should've. Cheers, Fabian Von: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> Im Auftrag von Peter Czanik (pczanik) Gesendet: Freitag, 5. Juni 2020 08:36 An: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Betreff: Re: [syslog-ng] Message and Header are being split incorrectly Hi, FreeBSD 12.1 changed from the legacy syslog protocol to RFC 5424 format. When you use the system() source for local logs, this is handled automagically. But you can also fix it by hand: https://github.com/syslog-ng/syslog-ng/issues/2428 Bye, Peter Czanik (CzP) <peter.czanik(a)oneidentity.com<mailto:peter.czanik@oneidentity.com>> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik ________________________________ From: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu<mailto:syslog-ng-bounces@lists.balabit.hu>> on behalf of Sass, Fabian <Fabian.Sass(a)f-i-ts.de<mailto:Fabian.Sass@f-i-ts.de>> Sent: Friday, June 5, 2020 08:28 To: syslog-ng(a)lists.balabit.hu<mailto:syslog-ng@lists.balabit.hu> <syslog-ng(a)lists.balabit.hu<mailto:syslog-ng@lists.balabit.hu>> Subject: [syslog-ng] Message and Header are being split incorrectly CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe. Hi, since updating the Base OS to FreeBSD 12.1 syslog-ng 3.27.1 fails splitting a message and its headers. Jun 5 08:12:00 myhostname 1 2020-06-05T08:12:00.042109+02:00 myhostname /usr/sbin/cron 71149 - - (root) RELOAD (tabs/root) Jun 5 08:12:01 myhostname 1 2020-06-05T08:12:01.546089+02:00 myhostname named 54403 - - client @0xfffffff 0.0.0.0: update 'some.domain/IN' denied Using templates for the destination reveals that the $MSGHDR Macro only holds the value "1", which is the wrongly extracted $PROGRAM macro. $MESSAGE itself contains almost all information of the lines above, to be precise everything from (including) the $ISODATE to the end of the line. However using templates and rewrite rules is in this case sufficient to restore the logformat that was used before the update. The bigger issue is that changing the value of $PROGRAM has no effect when sending it to antoher syslog-ng loghost. The behavior seems to be analog to this bug: https://lists.balabit.hu/pipermail/syslog-ng/2011-August/017132.html<https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.bal…> As you can see in my syslog-ng.conf the $PROGRAM macro is overwritten to "named" if named was logging to the local syslog-ng. The successful overwriting is verified using a separate logfile (destination d_test): @version: 3.5 # # options # options { mark_freq(3600); flush_lines(0); dir_perm(0640); chain_hostnames(off); keep_hostname(yes); create_dirs(yes); use_dns(yes); dns_cache(yes); dns_cache_expire(3600); }; source s_all { unix-dgram("/var/run/log"); unix-dgram("/var/run/logpriv" perm(0600)); internal(); }; # # rewrite since syslog message splitting is broken since update to freebsd12... # rewrite r_msg { set( "named", value("PROGRAM") condition(message(".* named [0-9]+ - -.*")) ); subst(".* ([a-zA-Z/\._]+) ([0-9]+) - - (.*)", "$1[$2]: $3", value("MESSAGE")); }; # # destinations # destination d_test { file("/var/log/fabian_messages" template("$DATE $PROGRAM $HOST $MESSAGE\n")); }; destination d_test2 { file("/var/log/fabian_messages2"); }; destination d_messages { file("/var/log/messages" template("$DATE $HOST $MESSAGE\n")); }; destination d_loghost { tcp("someiphere" port(514) template("$DATE $HOST $MESSAGE\n")); udp("anotheriphere" port(10525) template("$DATE $HOST $MESSAGE\n")); }; # # # logging # log { source(s_all); rewrite(r_msg); destination(d_messages); }; log { source(s_all); rewrite(r_msg); destination(d_loghost); }; log { source(s_all); rewrite(r_msg); destination(d_test); }; log { source(s_all); destination(d_test2); }; Am I missing something here, or is syslog-ng somehow behaving unintended? Fabian

1 0

Message and Header are being split incorrectly
by Sass, Fabian 05 Jun '20

05 Jun '20

Hi, since updating the Base OS to FreeBSD 12.1 syslog-ng 3.27.1 fails splitting a message and its headers. Jun 5 08:12:00 myhostname 1 2020-06-05T08:12:00.042109+02:00 myhostname /usr/sbin/cron 71149 - - (root) RELOAD (tabs/root) Jun 5 08:12:01 myhostname 1 2020-06-05T08:12:01.546089+02:00 myhostname named 54403 - - client @0xfffffff 0.0.0.0: update 'some.domain/IN' denied Using templates for the destination reveals that the $MSGHDR Macro only holds the value "1", which is the wrongly extracted $PROGRAM macro. $MESSAGE itself contains almost all information of the lines above, to be precise everything from (including) the $ISODATE to the end of the line. However using templates and rewrite rules is in this case sufficient to restore the logformat that was used before the update. The bigger issue is that changing the value of $PROGRAM has no effect when sending it to antoher syslog-ng loghost. The behavior seems to be analog to this bug: https://lists.balabit.hu/pipermail/syslog-ng/2011-August/017132.html As you can see in my syslog-ng.conf the $PROGRAM macro is overwritten to "named" if named was logging to the local syslog-ng. The successful overwriting is verified using a separate logfile (destination d_test): @version: 3.5 # # options # options { mark_freq(3600); flush_lines(0); dir_perm(0640); chain_hostnames(off); keep_hostname(yes); create_dirs(yes); use_dns(yes); dns_cache(yes); dns_cache_expire(3600); }; source s_all { unix-dgram("/var/run/log"); unix-dgram("/var/run/logpriv" perm(0600)); internal(); }; # # rewrite since syslog message splitting is broken since update to freebsd12... # rewrite r_msg { set( "named", value("PROGRAM") condition(message(".* named [0-9]+ - -.*")) ); subst(".* ([a-zA-Z/\._]+) ([0-9]+) - - (.*)", "$1[$2]: $3", value("MESSAGE")); }; # # destinations # destination d_test { file("/var/log/fabian_messages" template("$DATE $PROGRAM $HOST $MESSAGE\n")); }; destination d_test2 { file("/var/log/fabian_messages2"); }; destination d_messages { file("/var/log/messages" template("$DATE $HOST $MESSAGE\n")); }; destination d_loghost { tcp("someiphere" port(514) template("$DATE $HOST $MESSAGE\n")); udp("anotheriphere" port(10525) template("$DATE $HOST $MESSAGE\n")); }; # # # logging # log { source(s_all); rewrite(r_msg); destination(d_messages); }; log { source(s_all); rewrite(r_msg); destination(d_loghost); }; log { source(s_all); rewrite(r_msg); destination(d_test); }; log { source(s_all); destination(d_test2); }; Am I missing something here, or is syslog-ng somehow behaving unintended? Fabian

2 1

build on MacOS
by Pal, Laszlo 01 Jun '20

01 Jun '20

Hi, For quite some time I'm trying to build syslog-ng on my MacBook and I'm always getting the following error. Is there any Mac user who can help me with this? Is there a plan to make syslog-ng available again in homebrew? ld: warning: ignoring file > ./modules/dbparser/.libs/libsyslog-ng-patterndb.a, building for > macOS-x86_64 but attempting to link with file built for unknown-unsupported > file format ( 0x21 0x3C 0x61 0x72 0x63 0x68 0x3E 0x0A 0x2F 0x20 0x20 0x20 > 0x20 0x20 0x20 0x20 ) > Undefined symbols for architecture x86_64: > "_pattern_db_debug_ruleset", referenced from: > _pdbtool_match in pdbtool-pdbtool.o > "_pattern_db_expire_state", referenced from: > _pdbtool_match in pdbtool-pdbtool.o > "_pattern_db_free", referenced from: > _pdbtool_match in pdbtool-pdbtool.o > _pdbtool_dump in pdbtool-pdbtool.o > _pdbtool_test in pdbtool-pdbtool.o > "_pattern_db_get_ruleset", referenced from: > _pdbtool_dump in pdbtool-pdbtool.o > _pdbtool_test in pdbtool-pdbtool.o > "_pattern_db_global_init", referenced from: > _main in pdbtool-pdbtool.o > "_pattern_db_new", referenced from: > _pdbtool_match in pdbtool-pdbtool.o > _pdbtool_dump in pdbtool-pdbtool.o > _pdbtool_test in pdbtool-pdbtool.o > "_pattern_db_process", referenced from: > _pdbtool_match in pdbtool-pdbtool.o > _pdbtool_test in pdbtool-pdbtool.o > "_pattern_db_reload_ruleset", referenced from: > _pdbtool_match in pdbtool-pdbtool.o > _pdbtool_dump in pdbtool-pdbtool.o > "_pattern_db_set_emit_func", referenced from: > _pdbtool_match in pdbtool-pdbtool.o > "_pdb_example_free", referenced from: > _pdbtool_test in pdbtool-pdbtool.o > "_pdb_file_validate", referenced from: > _pdbtool_test in pdbtool-pdbtool.o > "_pdb_get_filenames", referenced from: > _pdbtool_merge in pdbtool-pdbtool.o > "_pdb_rule_get_name", referenced from: > _pdbtool_test in pdbtool-pdbtool.o > "_pdb_rule_set_load", referenced from: > _pdbtool_test in pdbtool-pdbtool.o > _pdbtool_dictionary in pdbtool-pdbtool.o > "_pdb_sort_filenames", referenced from: > _pdbtool_merge in pdbtool-pdbtool.o > "_ptz_find_clusters", referenced from: > _pdbtool_patternize in pdbtool-pdbtool.o > "_ptz_free", referenced from: > _pdbtool_patternize in pdbtool-pdbtool.o > "_ptz_load_file", referenced from: > _pdbtool_patternize in pdbtool-pdbtool.o > "_ptz_new", referenced from: > _pdbtool_patternize in pdbtool-pdbtool.o > "_ptz_print_patterndb", referenced from: > _pdbtool_patternize in pdbtool-pdbtool.o > "_r_find_all_applicable_nodes", referenced from: > _pdbtool_test in pdbtool-pdbtool.o > "_r_find_node", referenced from: > _pdbtool_dump in pdbtool-pdbtool.o > _pdbtool_test in pdbtool-pdbtool.o > _pdbtool_dictionary in pdbtool-pdbtool.o > ld: symbol(s) not found for architecture x86_64 > clang: error: linker command failed with exit code 1 (use -v to see > invocation) > make[2]: *** [modules/dbparser/pdbtool/pdbtool] Error 1 > make[2]: *** Waiting for unfinished jobs.... > ld: warning: ignoring file > ./modules/diskq/.libs/libsyslog-ng-disk-buffer.a, building for macOS-x86_64 > but attempting to link with file built for macOS-x86_64 > Undefined symbols for architecture x86_64: > "_log_queue_disk_load_queue", referenced from: > _open_queue in dqtool.o > "_log_queue_disk_non_reliable_new", referenced from: > _open_queue in dqtool.o > "_log_queue_disk_reliable_new", referenced from: > _open_queue in dqtool.o > ld: symbol(s) not found for architecture x86_64 > clang: error: linker command failed with exit code 1 (use -v to see > invocation) Thanks L

1 0

How to ensure that only my hosts log to my syslog server?
by Evan Rempel 29 May '20

29 May '20

We are starting to explore laptop logging which means that I have to open up firewalls to public networks as the laptops are moved around. Is there a way to ensure that only computers configured by my organization are able to connect to or send logs to my log server? I looked at "Mutual authentication using TLS" but if I understand that correctly the client is required to have a IP/hostname that matches the CN of the certificate. I couldn't find other information but perhaps I am searching for the wrong terms. -- Evan

2 2

Logs not making it to Splunk, high scratch buffers count
by Faine, Mark R. (MSFC-IS40)[NICS] 28 May '20

28 May '20

We've recently been seeing interruptions or delays to logs going into Splunk. I have noticed that global;scratch_buffers_count queued increases substantially and doesn't every seem to stop climbing. Here are the stats: SourceName;SourceId;SourceInstance;State;Type;Number destination;d_spol;;a;processed;0 src.internal;s_sys#2;;a;processed;384 src.internal;s_sys#2;;a;stamp;1590690126 center;;received;a;processed;1925133 destination;d_mesg;;a;processed;384 destination;d_mail;;a;processed;2 destination;d_auth;;a;processed;3 destination;d_mlal;;a;processed;0 center;;queued;a;processed;1962257 source;pan_splunk;;a;processed;1924743 destination;d_file;;a;processed;1561759 destination;d_cron;;a;processed;1 global;scratch_buffers_count;;a;queued;150323855375 destination;#anon-destination0;;a;processed;362983 global;payload_reallocs;;a;processed;5 global;sdata_updates;;a;processed;24 global;scratch_buffers_bytes;;a;queued;1536 destination;d_boot;;a;processed;0 destination;d_kern;;a;processed;0 source;s_sys;;a;processed;390 global;msg_clones;;a;processed;4662233 destination;d_file_no_location;;a;processed;37125 global;internal_queue_length;;a;processed;0 Here is the source configuration: source pan_splunk { network(port(514) transport("tcp") max-connections(100) flags(syslog-protocol) log-fetch-limit(100) log-iw-size(100000) log-msg-size(10485760) ); network(port(514) transport("udp") max-connections(100) flags(syslog-protocol) log-fetch-limit(100) log-iw-size(100000) log-msg-size(10485760) ); network(transport("tls") port(10514) max-connections(100) flags(syslog-protocol) log-iw-size(100000) log-fetch-limit(100) log-msg-size(10485760) tls(peer-verify(optional-untrusted) key_file("/etc/syslog-ng/cert.d/serverkey.pem") cert_file("/etc/syslog-ng/cert.d/servercert.pem") ca_dir("/etc/syslog-ng/ca.d")) ); }; Here is the destination configuration destination d_file { file("`BASEPATH`/$location/$HOST/$app/${HOST}_$app.log" create_dirs(yes) dir-owner("splunk") dir-group("splunk") dir-perm(0750) owner("splunk") group("splunk") perm(0640) log-fifo-size(1000) disk-buffer( mem-buf-size(10000) disk-buf-size(2000000000) reliable(yes) dir("/var/log/remote/disk-buffer_dfile") ) flags("threaded", "no-multi-line") ); }; This includes some recent modifications to try and resolve the issue but nothing we have tried so far has made a difference. I would welcome any help you could provide. Thanks, -Mark

1 0

[SOLVED] Strange issue when forwarding using LEEF template
by Pal, Laszlo 28 May '20

28 May '20

Hi, I have a strange issue with templates... Maybe some stupid issue on my side, maybe a bug I don't know *<spoiler> Solutions at the end of this </spoiler>* Here is the scenario Logs coming from Windows using Syslog-ng Agent (syslog destination) Logs received using latest OSE (but same issues at the customer with PE6) Logs must be forwarded to Qradar using a special LEEF template like this (there are also tabs in the template). I've tried both network and syslog destination template t_leefwin { template("<${PRI}>${BSDDATE} ${HOST} LEEF:1.0|Microsoft|Windows|2k8r2|${EVENT_ID}| devTime=${R_YEAR}-${R_MONTH}-${R_DAY}T${R_HOUR}:${R_MIN}:${R_SEC}GMT${TZOFFSET} devTimeFormat=yyyy-MM-dd'T'HH:mm:ssz cat=${EVENT_TYPE} sev=${EVENT_LEVEL} resource=${HOST} usrName=${EVENT_USERNAME} application=${EVENT_SOURCE} message=${EVENT_MSG}\n"); }; The forwarded results like this <46> IP-address LEEF:1.0|Microsoft|Windows|2k8r2||devTime=2020-05-28T09:10:02GMT+02:00 devTimeFormat=yyyy-MM-dd'T'HH:mm:ssz cat= sev= resource=172.17.24.174 usrName= application= message= So, the $macro-s are empty except the one which is not from .sdata (resource) I've created a local json and welf destination and I can see the macros there SDATA="[win(a)18372.4 EVENT_CATEGORY=\"None\" EVENT_FACILITY=\"16\" EVENT_ID=\"4098\" EVENT_LEVEL=\"3\" EVENT_NAME=\"Application\" EVENT_REC_NUM=\"73006\" EVENT_SID=\"S-1-5-18\" EVENT_SID_TYPE=\"User\" EVENT_SOURCE=\"Group Policy Services\" EVENT_TYPE=\"Figyelmeztetés\" EVENT_HOST=\"hostname\" EVENT_USERNAME=\"NT AUTHORITY\\\\SYSTEM\" I remember I used this method years ago to forward logs from syslog-ng agent to Qradar with proper LEEF format and it was ok... but now, some small thing is missing Versions syslog-ng 3 (3.25.1) Config version: 3.25 Installer-Version: 3.25.1 But, we have a similar issue with PE6 at the customer Any idea? --- so after playing with the welf output a bit, I figured out the short version of the macro names are not longer working somehow, but the long ones are ok like this template t_leefwin { template("<${PRI}>${BSDDATE} ${HOST} LEEF:1.0|Microsoft|Windows|2k8r2|${.SDATA.win@18372.4.EVENT_ID }|devTime=${R_YEAR}-${R_MONTH}-${R_DAY}T${R_HOUR}:${R_MIN}:${R_SEC}GMT${TZOFFSET} devTimeFormat=yyyy-MM-dd'T'HH:mm:ssz cat=${.SDATA.win(a)18372.4.EVENT_TYPE} sev=${.SDATA.win(a)18372.4.EVENT_LEVEL} resource=${SDATA.win(a)18372.4.EVENT_HOST} usrName=${.SDATA.win(a)18372.4.EVENT_USERNAME} application=${.SDATA.win(a)18372.4.EVENT_SOURCE} message=${MESSAGE}\n"); }; Thanks L:

2 2

High throughput UDP logging configuration.
by Evan Rempel 28 May '20

28 May '20

I know. There is a ton of information online about this. It shouldn't be that difficult, but I'm still having problems. I have one device with a very high logging rate. Approaching 15K msg/sec (7.5MB/sec). I am running on a 2 socket 8 core/CPU system (Intel(R) Xeon(R) CPU E5-2670 0 @ 2.60GHz). Not the latest and greatest, but still fairly quick. All of the storage is on SSD. What I have configured 1. OS net.core.rmem_max = 536870912 2. so-reuseport(1) - and 8 sources on the UDP port 3. so_rcvbuf(67108864) - all 9 udp sources. 4. log_iw_size(2M) 5. log_fetch_limit(20k) 6. log_fifo_size(4M) Flow control is NOT enabled. Monitoring the queued messages inside syslog-ng and they remain near zero. Monitoring udp buffer queues in the OS shows that one stream is still overwhelming syslog-ng's ability to read messages. [~]$ sudo netstat -unlp|egrep -e 'PID|syslog' Proto Recv-Q Send-Q Local Address Foreign Addr State PID/Program name udp 0 0 11.22.33.44:514 0.0.0.0:* 15591/syslog-ng udp 0 0 11.22.33.44:514 0.0.0.0:* 15591/syslog-ng udp 0 0 11.22.33.44:514 0.0.0.0:* 15591/syslog-ng udp 0 0 11.22.33.44:514 0.0.0.0:* 15591/syslog-ng udp 0 0 11.22.33.44:514 0.0.0.0:* 15591/syslog-ng udp 134216320 0 11.22.33.44:514 0.0.0.0:* 15591/syslog-ng udp 0 0 11.22.33.44:514 0.0.0.0:* 15591/syslog-ng udp 0 0 11.22.33.44:514 0.0.0.0:* 15591/syslog-ng A few things of note. 1. The OS UDP buffer seems to be 128MB in size and the so_rcvbuf configured ins 64M in size. Is that because the syslog-ng configuration of so_rcvbuf is in characters but the OS buffer is in bytes? 2. In a 1 second interval "cat /proc/net/udp" shows that one UDP stream dropped 6283 packets. So I'm continually dropping approx 50% of the UDP stream. 3. Increasing the log_iw_size or the log_iw_size actually seems to make things worse. All suggestions that help me understand this and help to minimize the drops are welcome. -- Evan Rempel

2 3

Forwarding to Elastic
by Shawn Taylor 28 May '20

28 May '20

I am running ES/Kibana 6.8.9-1 and am struggling with this issue. https://discuss.elastic.co/t/message-failed-to-find-message-in-kibana-logs/… I have added my index to the *Logs Indices* field in the Logs configuration. When I look at the fields in a document I see a field called MESSAGE, but not message. I do not see a way to add this field in the configuration. Is it possible to have this document display in the Logs UI? Can I convert the fields in syslog-ng to lowercase before forwarding them to elastic? Thanks, Shawn

3 4

Extract SNI on incoming connections
by Raghunath Adhyapak 23 May '20

23 May '20

Hi, I would like to run a syslog-ng server that accepts TLS connections. I want to identify clients based on the server name they use to connect and do specific processing for each client. I see the following macros being available to be used in filter, but I don't see .TLS.SN (or something like that to indicate server name used by client to connect) .TLS.X509 *Description:* When using a transport that uses TLS, these macros contain information about the peer's certificate. That way, you can use information from the client certificate in filenames, database values, or as other metadata. If you clients have their own certificates, then these values are unique per client, but unchangeable by the client. The following macros are available in syslog-ng OSE version 3.9 and later. - .TLS.X509_CN: The Common Name of the certificate. - .TLS.X509_O: The value of the Organization field. - .TLS.X509_OU: The value of the Organization Unit field. Thanks Raghu

2 2

Convert json format to syslog rfc5424
by Carlos Lopez 22 May '20

22 May '20

Hi all, Due to some issues with our logs collector server, I need to read some logs in json format and convert them to syslog rfc5424 and forward to our central syslog server. Acctually, all information regarding this type of configuration located in syslog-ng’s web site is related to send json format as a destination. But, is it possible to do the opposite: read a json file and forward to a third server in syslog rfc5424 format? Yes, I will try to catch up only some specific fields, not all fields contained in the json soure file. Any tips? Regards, C. L. Martinez

2 1

getting "Error processing log message" for checkpoint logs
by Russell Fulton 20 May '20

20 May '20

I am trying to ingest logs from a checkpoint firewall over a tcp connection: source s_checkpoint { network( transport("tcp") flags(no-multi-line) port(2514) keep-alive(yes) flags(syslog-protocol) ); }; # added flags(syslog-protocol) on suggest of checkpoint docs for syslog-ng destination d_debug { file( "/data/russell//test.log" ); }; log { source( s_checkpoint ); destination( d_debug ); }; This is what turns up in the output: May 18 12:10:42 secmgrprd02 syslog-ng[1555]: Error processing log message: <134>1 2020-05-17T23:33:27Z smartlog01 CheckPoint 25651 -….. Any ideas on what is going on or how to find out? Russell

2 5

How to get the number of logged message count
by Monitto Pitchaimani sebastin (mopitcha) 18 May '20

18 May '20

Hi All, Is there a way to get the logged messages to the particular destination? We wanted to get the count of number of logs delivered to the particular destination I.e., network() etc Regards, Monitto

2 1

Insider 2020-05: syslog-ng 3.27; Python HTTP header; DBLD; Sumologic;
by Peter Czanik (pczanik) 14 May '20

14 May '20

Dear syslog-ng users, This is the 81st issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Version 3.27 of syslog-ng released ---------------------------------- Version 3.27.1 of syslog-ng is now available, adding many smaller features to syslog-ng. These include new macros to check where a given log message arrived, a new rewrite to easily change the syslog facility of a message, a Sumologic destination and an experimental feature to check log integrity. For source code and full details, check https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-3.27.1 For ready-to-use packages check https://syslog-ng.com/3rd-party-binaries Introduction to the Python HTTP header -------------------------------------- You can create your own custom headers for the HTTP destination using syslog-ng’s Python HTTP header plugin and Python scripts. The included example configuration only adds a simple counter to the headers, but with a bit of coding, you can resolve authentication problems or fine-tune how data is handled at cloud-based logging and SIEM platforms, like Sumologic. https://www.syslog-ng.com/community/b/blog/posts/introduction-to-the-python… DBLD: a syslog-ng developer tool not just for developers -------------------------------------------------------- DBLD is a central tool when it comes to syslog-ng development, but even after multiple blogs about the tool, it is still not much used outside of the developers’ team. So, what is DBLD and how could it be used even by you? The abbreviation stands for Docker BuiLD. Using containers ensures both that you have an easily reproducible build environment, and also that you do not have to “pollute” your base system with development-related software packages. You can use DBLD to build the release tarball or ready-to-use packages for a number of Linux distributions. It can even be used as a development environment with all necessary tools installed. Still not convinced? Yes, the listed possibilities are mostly interesting for syslog-ng developers and 3rd party packagers. If you are lucky, you will never need DBLD. On the other hand, it can come handy if you reported a problem and the syslog-ng team fixed it. Even if you are not a developer, only a junior sysadmin, you can still easily build fixed syslog-ng packages for testing (and even for production use) until an official release with the fix arrives. https://www.syslog-ng.com/community/b/blog/posts/dbld-a-syslog-ng-developer… Getting your logs into Sumo Logic with syslog-ng made easy ---------------------------------------------------------- Sumo Logic is one of the most popular cloud-based log management and security analytics services. They provide their own log shippers, but also work with others, including syslog-ng. The use of syslog-ng is well documented on their support website, but the actual configuration part can easily be simplified. A new, dedicated Sumo Logic destination is already available as part of syslog-ng 3.27. It is based either on the network() or the http() destination of syslog-ng and implemented as an SCL, hiding away most of the configuration details from the users. https://www.syslog-ng.com/community/b/blog/posts/getting-your-logs-into-sum… syslog-ng PE 7.0.20 available ----------------------------- Version 7.0.20 of syslog-ng Premium Edition was released. It adds Red Hat Enterprise Linux 8 to the supported platforms: https://support.oneidentity.com/technical-documents/syslog-ng-premium-editi… Using RHEL 8 instead of RHEL 7 you can use udp-balancer() source for high performance UDP log collection: https://support.oneidentity.com/technical-documents/syslog-ng-premium-editi… NEW WHITE PAPERS * Upgrade to State-of-the-Art Log Management: https://www.syslog-ng.com/whitepaper/log-management-essentials8137754/ WEBINARS * Learn how to easily integrate Azure Sentinel into your log-data strategy: https://www.syslog-ng.com/webcast-ondemand/learn-how-to-easily-integrate-az… * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Missing one log message when destination unavailable for short period of time.
by Ali Shirvani 08 May '20

08 May '20

Hi all, I tried to setup simple relay with syslog-ng, it receives log on one port and forward to the destination. It works fine when destination is available, but when destination unavailable for a short period of time and then became available I miss one log entry. For example assume that I send simple numbers with logger command to syslog-ng, from 0 to 100, when I receive 50 on destination I stop its listener and start it again, in this case the first log entry that I receive is 52 instead of 51. Here is my syslog-ng.conf: @version: 3.26 options { time_reopen(5); }; source s_network { network( ip("127.0.0.1") port(514) transport("udp") ); }; destination d_network { network( "127.0.0.1" port(5514) transport("udp") ); }; log { source(s_network); destination(d_network); }; Would you please help me to resolve this issue? Regards, Ali

3 6

Syslogs not writing to disk
by Rose, Ed 05 May '20

05 May '20

Hello All, I have syslog-ng setup currently setup to write to disk and forward events on to a different syslog server. Syslog isn't writing to disk it seems. I do not see any errors either, unless I am not looking in the right place for the errors. Tcpdump -v host x.x.x.x shows data coming in from the host but a tail -f ${HOST}/log_${HOST} shows no logs going to disk. Thanks Ed syslog-ng 3 (3.14.1) Config version: 3.14 Installer-Version: 3.14.1 Revision: Module-Directory: /usr/lib64/syslog-ng Module-Path: /usr/lib64/syslog-ng Available-Modules: afmongodb,sdjournal,linux-kmsg-format,appmodel,date,pseudofile,afamqp,syslogformat,csvparser,cef,tags-parser,affile,afsocket,afstomp,tfgetent,json-plugin,confgen,system-source,stardate,graphite,dbparser,afprog,xml,add-contextual-data,snmptrapd-parser,cryptofuncs,kvformat,disk-buffer,basicfuncs,afuser,map-value-pairs Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: on Enable-Systemd: on filter f_awanra1 { host("x.x.x.x"); }; filter f_bwanra1 { host("x.x.x.x"); }; filter f_cwanra1 { host("x.x.x.x"); }; destination d_ciscoasa { file("/var/log2/gns/cisco_asa/${HOST}/log_${HOST}" create-dirs(yes) dir-perm(0755) dir-group(splunk) perm(0640) group(splunk)); }; destination d_uid1 { tcp("x.x.x.x" port(514) ); }; destination d_uid2 { tcp("x.x.x.x" port(514) ); }; destination d_uid3 { tcp("x.x.x.x" port(514) ); }; destination d_uid4 { tcp("x.x.x.x" port(514) ); }; log { source(s_net); filter(f_amywanra1); destination(d_ciscoasa); destination(d_uid1); destination(d_uid2); destination(d_uid3); destination(d_uid4); flags(final); }; log { source(s_net); filter(f_cnswanra1); destination(d_ciscoasa); destination(d_uid1); destination(d_uid2); destination(d_uid3); destination(d_uid4); flags(final); }; log { source(s_net); filter(f_demwanra1); destination(d_ciscoasa); destination(d_uid1); destination(d_uid2); destination(d_uid3); destination(d_uid4); flags(final); };

2 8

syslog-ng 3.27 Debian/Ubuntu packages (OBS)
by Laszlo Budai 30 Apr '20

30 Apr '20

Hi, syslog-ng 3.27.1[1] packages are available in OBS repositories[2, 3]. List of supported OSs: * Debian 9.0 * Debian 10.0 * Raspbian 9.0 * Raspbian 10.0 * Ubuntu 16.04 * Ubuntu 18.04 * Ubuntu 18.10 * Ubuntu 19.04 * Ubuntu 19.10 * Ubuntu 20.04 Install ------- example: Debian 9.0 1. get release key wget -qO - http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… | sudo apt-key add - 2. add repo to APT sources eg.: /etc/apt/sources.list.d/syslog-ng-obs.list deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… ./ Then `apt-get update` and `apt-get install syslog-ng-core` Links -------- [1] https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.27.1 [2] https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-… [3] https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-… regards, Laszlo Budai

1 0

syslog-ng 3.27
by Laszlo Budai 30 Apr '20

30 Apr '20

3.27.1 Highlights * DESTIP/DESTPORT/PROTO: new macros. (#2899<https://github.com/syslog-ng/syslog-ng/pull/2899>) * set-facility(): add new rewrite operation to change the syslog facility associated with the message. (#3136<https://github.com/syslog-ng/syslog-ng/pull/3136>) * network tls: Added ca-file() option. With this option the user can set a bundled CA-file to verify the peer. (#3145<https://github.com/syslog-ng/syslog-ng/pull/3145>) * Forward integrity and confidentiality of logs (#3121<https://github.com/syslog-ng/syslog-ng/pull/3121>): It is an experimental feature currently, we are still working on the final form with the authors. Features * DESTIP/DESTPORT/PROTO: new macros These new macros express the destination ip, destination port and used protocol on a source. The use-case behind the PR is as follows: * someone has an appliance which sends out log messages via both UDP and TCP * the format of the two are different, and he wants to capture either with the simplest possible filter * netmask() doesn't work because the IP addresses are the same * host() doesn't work because the hostnames are the same Example: log { source { network(localip(10.12.15.215) port(5555) transport(udp)); }; destination { file("/dev/stdout" template("destip=$DESTIP destport=$DESTPORT proto=$PROTO\n")); }; }; Output: destip=10.12.15.215 destport=5555 proto=17 (#2899<https://github.com/syslog-ng/syslog-ng/pull/2899>) * set-facility(): add new rewrite operation to change the syslog facility associated with the message. log { source { system(); }; if (program("postfix")) { rewrite { set-facility("mail"); }; }; destination { file("/var/log/mail.log"); }; flags(flow-control); }; (#3136<https://github.com/syslog-ng/syslog-ng/pull/3136>) * network tls: Added ca-file() option. With this option the user can set a bundled CA-file to verify the peer. (#3145<https://github.com/syslog-ng/syslog-ng/pull/3145>) * http: When a HTTP response is received, emit a signal with the HTTP response code. (Later it can be extended to read the response and parse it in a slot...). This PR also extends the Python HTTP header module with the possibility of writing custom HTTP response code handlers. When someone implements an auth header plugin in Python, it could be useful (for example invalidating a cache). Example config, click to expand! (#3159<https://github.com/syslog-ng/syslog-ng/pull/3159>) * java/python: add support for the "arrow" syntax. options("key" => "value") (#3161<https://github.com/syslog-ng/syslog-ng/pull/3161>) (#3247<https://github.com/syslog-ng/syslog-ng/pull/3247>) * python: persist support for python This feature enables users to persist data between reloads or restarts. The intended usage is to support bookmarking and acknowledgement in the future. It is not suitable for local database use cases. (#3171<https://github.com/syslog-ng/syslog-ng/pull/3171>) * rewrite: Added conditional set-tag() option. With this option the user can put condition statement inside set-tag option. rewrite { set-tag("tag" condition(match("test" value("MSG")))); }; (#3190<https://github.com/syslog-ng/syslog-ng/pull/3190>) * scl: add sumologic destinations: sumologic-syslog() and sumologic-http() (#3194<https://github.com/syslog-ng/syslog-ng/pull/3194>) * iterate: new template function The iterate template function generates a series from an initial number and a next function. For example you can generate a sequence of nonnegative numbers with source { example-msg-generator( num(3) template("$(iterate $(+ 1 $_) 0)") ); }; (#3205<https://github.com/syslog-ng/syslog-ng/pull/3205>) * telegram: new max-size option Telegram message will be truncated for max-size size. Telegram does not accept message larger than 4096 utf8 characters. The default value is 4096. (#3206<https://github.com/syslog-ng/syslog-ng/pull/3206>) * example-message-generator : add support for values(name1 => value1, name2 => value2,..) syntax. Example @version: 3.27 log { source { example-msg-generator(template("message parameter") num(10) values("PROGRAM" => "program-name" "current-second" => "$C_SEC" )); }; destination { file(/dev/stdout template("$(format-json --scope all-nv-pairs)\n")); }; }; (#3237<https://github.com/syslog-ng/syslog-ng/pull/3237>) * example-msg-generator: support freq(0) for fast message generation log { source { example-msg-generator(freq(0) num(100)); }; destination { file("/dev/stdout"); }; }; (#3245<https://github.com/syslog-ng/syslog-ng/pull/3245>) Bugfixes * file: changed time-reap() timer's schedule to respect the documentation (expires after last message) (#3133<https://github.com/syslog-ng/syslog-ng/pull/3133>) * dbld: fix building problems * fix rpm package build on centos-7 * fix devshell image build * fix ubuntu-trusty image build * fix deb package build on ubuntu-trusty * fix rpm package build on fedora-30 (#3143<https://github.com/syslog-ng/syslog-ng/pull/3143>) * tls (network): Properly log an error message, when key-file() or cert-file() is missing. (#3145<https://github.com/syslog-ng/syslog-ng/pull/3145>) * loggen: fix crash with invalid parameterization (#3146<https://github.com/syslog-ng/syslog-ng/pull/3146>) * format-json: fix printing of embedded zeros Prior to 2.64.1, g_utf8_get_char_validated() in glib falsely identified embedded zeros as valid utf8 characters. As a result, format json printed the embedded zeroes as \u0000 instead of \x00. This change fixes this problem. (#3175<https://github.com/syslog-ng/syslog-ng/pull/3175>) * configure: fix --with-net-snmp configure option (#3180<https://github.com/syslog-ng/syslog-ng/pull/3180>) * python: fix Py_None reference counting in logger methods (trace, debug, info, warning, error) (#3187<https://github.com/syslog-ng/syslog-ng/pull/3187>) * afmongodb: do not build module when ENABLE_MONGODB=OFF (#3188<https://github.com/syslog-ng/syslog-ng/pull/3188>) * telegram: automatically truncate messages larger than 4096 utf8 characters to avoid telegram destination to get stuck (#3206<https://github.com/syslog-ng/syslog-ng/pull/3206>) * compat/glib: fix recursive call issue on CentOS-6/RHEL-6/platforms (#3212<https://github.com/syslog-ng/syslog-ng/pull/3212>) * timeutils: fix crash in %f conversion when non-numeric character is in usec field (e.g. ".asd123") (#3270<https://github.com/syslog-ng/syslog-ng/pull/3270>) Packaging * macOS: add example startup configuration. (#3172<https://github.com/syslog-ng/syslog-ng/pull/3172>) * rpm: fix --without maxminddb option If maxminddb development package was installed on the build system: rpmbuild fails if --without maxminddb was used. (#3208<https://github.com/syslog-ng/syslog-ng/pull/3208>) Notes to developers * light: Support to relocate reports dir other than current base dir For example python -m pytest -lvs functional_tests/source_drivers/file_source/test_acceptance.py --installdir=/install --reports /tmp/ (#3157<https://github.com/syslog-ng/syslog-ng/pull/3157>) * CONTRIBUTING.md: contribution guide updated (#3174<https://github.com/syslog-ng/syslog-ng/pull/3174>) * libtest: Now we install config_parse_lib.h, fake-time.h, mock-cfg-parser.h and queue_utils_lib.h which help unit testing outside of core. (#3179<https://github.com/syslog-ng/syslog-ng/pull/3179>) * tests: Wait until snmptrapd process able to write traps into output file (#3185<https://github.com/syslog-ng/syslog-ng/pull/3185>) * mongodb: Replaced the deprecated get_server_status() API with command_simple(). This means, that syslog-ng can now be built with -Werror on systems with 1.15 libmongoc. (#3199<https://github.com/syslog-ng/syslog-ng/pull/3199>) * stats: add external stats counters There are situations when someone wants to expose internal variables through stats-api. Without this changeset, we need two distinct variables: one is for the internal state, other is for the stats registration (internal state cannot depends on the life cycle of the StatsCounterGroup). (#3225<https://github.com/syslog-ng/syslog-ng/pull/3225>) Other changes * afsnmp: merge two existing SNMP modules (trapd-parser and destination) into one. Motivation: keep closely related modules together and decrease the number of small packages. Packaging related changes: libsnmptrapd-parser.so has been removed, both the snmp destination and the trapd parser are part of afsnmp.so . * deb: we already had mod-snmp which shipped snmp-dest. From now, this packages installs the snmptrapd-parser syslog-ng module. The syslog-ng-mod-snmptrapd-parser package has been removed. * rpm: snmpdest renamed to afsnmp and the snmptrapd-parser is installed by this package from now (#3142<https://github.com/syslog-ng/syslog-ng/pull/3142>) * dbld: remove ubuntu-cosmic as it has reached EOL (#3143<https://github.com/syslog-ng/syslog-ng/pull/3143>) * afsocket-source: present the number of connections in stats It helps in the debug process if we can see the number of source connections counted by syslog-ng internally. (#3193<https://github.com/syslog-ng/syslog-ng/pull/3193>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Airbus Commercial Aircraft, Andras Mitzki, Antal Nemes, Attila Szakacs, Balazs Scheidler, Gabor Nagy, Kokan, Laszlo Budai, Laszlo Szemere, László Várady, Mehul Prajapati, Roberto Meléndez, Stephan Marwedel, Steven Haigh, Peter Czanik, Thomas De Schampheleire, Vatsal Sisodiya, Vivin Peris https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-3.27.1

1 0

Issue with processing syslog event
by Raghunath Adhyapak 29 Apr '20

29 Apr '20

Hello all, I am receiving the following syslog line from one of devices. <134>1 1588062776.725141502 C0493 flows allow src=10.0.31.145 dst=9.9.9.9 Mac=F1:37:59:38:BA:F8 protocol=udp sport=50307 dport=53 This line contains a version filed immediately following the priority, and then timestamp is in epoch format as against ISO8601 or other standard format. I see the following error in syslog-ng log: [2020-04-28T10:46:15.340911] Outgoing message; message='Apr 28 10:46:15 ip-172-31-240-95 syslog-ng[27873]: Error processing log message: <134>1>@< 1588062776.725141502 C0493 flows allow src=10.0.31.145 dst=9.9.9.9 mac=F1:37:59:38:BA:F8 protocol=udp sport=50307 dport=53' What could be the possible issue here? My config is as follows: ##======================================== ######################## # Global options ######################## options {keep_hostname (yes); use_dns (no); mark-freq(30);}; ######################## # Sources ######################## source s_syslog { syslog( transport(udp) port(514) max-connections(500) ); }; ######################## # Destinations ######################## destination d_file { file("/var/log/dump.log"); }; ######################## # Log paths ######################## log { source(s_syslog); destination(d_file); flags(flow-control); }; ##======================================== If I check my file /var/log/dump.log, I see that the error line is getting written to it too. root@ip-172-31-240-95:~# tail -f /var/log/dump.log | grep "Error processing" Apr 28 10:44:46 ip-172-31-240-95 syslog-ng[27873]: Error processing log message: <134>1>@< 1588062776.725141502 C0493 flows allow src=10.0.31.145 dst=9.9.9.9 mac=F1:37:59:38:BA:F8 protocol=udp sport=50307 dport=53 Apr 28 10:46:15 ip-172-31-240-95 syslog-ng[27873]: Error processing log message: <134>1>@< 1588062776.725141502 C0493 flows allow src=10.0.31.145 dst=9.9.9.9 mac=F1:37:59:38:BA:F8 protocol=udp sport=50307 dport=53 Thanks Raghu

3 5

Syslog-ng network namespace support
by Monitto Pitchaimani sebastin (mopitcha) 28 Apr '20

28 Apr '20

Hi All, Does syslog-ng supports log forwarding to remote host in different network namespaces? Regards, Monitto

3 5

Re: [syslog-ng] syslog-ng, json and handle escaping properly
by Arthur Lambert 27 Apr '20

27 Apr '20

> log { > source { example-msg-generator(num(1) template("{\"category\":\"BOOT\",\"level\":\"INFO\",\"message\":\"Check pstore partition..\"}")); }; > parser { json-parser(); }; > destination { file(/dev/stdout template("$(format-json --key category,level,message timestamp=${ISODATE})\n")); }; >}; Ok so first I update the syslog-ng config file with your modification diff --git a/board/xxx/xxx/rootfs/etc/syslog-ng.conf b/board/xxx/xxx/rootfs/etc/syslog-ng.conf index c28ea5e59d..6b93ce24b8 100644 --- a/board/xxx/xxx/rootfs/etc/syslog-ng.conf +++ b/board/xxxx/xxx/rootfs/etc/syslog-ng.conf @@ -4,10 +4,6 @@ filter f_middleware { facility("local1"); }; -template t_json_filetemplate { - template("{\"timestamp\":\"${ISODATE}\",${MESSAGE}\n"); -}; source s_kernel { file("/proc/kmsg" program_override("kernel")); }; @@ -21,7 +17,8 @@ destination d_kernel { }; destination d_middleware { - file("/data/logs/middleware.log", template(t_json_filetemplate)); + file(/data/logs/middleware.log template("$(format-json --key category,level,message timestamp=${ISODATE})\n"));; + }; log { @@ -31,6 +28,7 @@ log { log { source(s_middleware); + parser { json-parser(); }; filter(f_middleware); destination(d_middleware); }; I also add the '{' in my macro log diff --git a/log/log_private.h b/log/log_private.h index b1e2dd31..09e875e1 100644 --- a/log/log_private.h +++ b/log/log_private.h @@ -18,7 +18,7 @@ #define _PRINT_DEBUG(M, ...) \ do { \ - syslog(LOG_DEBUG, "\"category\":\"%s\",\"level\":\"DEBUG\",\"message\":\"" M "%s\"}\n", __DIR__, __VA_ARGS__); \ + syslog(LOG_DEBUG, "{\"category\":\"%s\",\"level\":\"DEBUG\",\"message\":\"" M "%s\"}\n", __DIR__, __VA_ARGS__); \ } while (0) #else @@ -28,32 +28,32 @@ #define _PRINT_INF_GOTO(M, ...) \ do { \ - syslog(LOG_DEBUG, "\"category\":\"%s\",\"level\":\"INFO\",\"message\":\"" M "%s\"}\n", __DIR__, __VA_ARGS__); \ + syslog(LOG_DEBUG, "{\"category\":\"%s\",\"level\":\"INFO\",\"message\":\"" M "%s\"}\n", __DIR__, __VA_ARGS__); \ errno = 0; \ goto error; \ (...) #endif /* !LOG_PRIVATE_H_ */ So basically I suppose that your modification allows to syslog-ng to understand by itself that there is an extra pair key/value in my format and that I am using JSON format. So let's do some test now... int main (void) { PRINT_DEBUG ("Test simple."); PRINT_DEBUG ("\nTest with return line\n."); PRINT_DEBUG ("Test with json inside message : {\"key\" : \"%d\", \"key2\" : \"%d\"} ", 42, 21); PRINT_DEBUG ("Test simple2."); PRINT_DEBUG ("Begin. Program name : %s", argv[0]); (...) } Result : # cat /data/logs/middleware.log {"timestamp":"2020-04-24T15:36:28+02:00","message":"Test simple.","level":"DEBUG","category":"MPU_CORE"} {"timestamp":"2020-04-24T15:36:28+02:00","message":"Test simple2.","level":"DEBUG","category":"MPU_CORE"} {"timestamp":"2020-04-24T15:36:28+02:00","message":"Begin. Program name : nano_core","level":"DEBUG","category":"MPU_CORE"} {"timestamp":"2020-04-24T15:36:28+02:00","message":"Board config : nano_proto1","level":"DEBUG","category":"MPU_CORE"} {"timestamp":"2020-04-24T15:36:28+02:00","message":"Initialize GPIO..","level":"INFO","category":"GPIO_MANAGER"} {"timestamp":"2020-04-24T15:36:28+02:00","message":"Synchronize dictionnary with current rootfs content","level":"INFO","category":"AUDIO_MANAGER"} As you can see, the line with \n and the JSON debug output is not in the final log. It was not in a good format for the JSON syslog-ng parser. How can I fix that? Now that syslog-ng is able to understand that there is a category, a level, a message in my JSON. I cannot just ask for syslog-ng to use the escape template only on the column with message key before sending the message to the parser? I am able to fix the \n issue by using unix-dgram instead of unix-stream but without really understand why. New result after using unix-dgram : {"timestamp":"2020-04-24T15:58:09+02:00","message":"Test simple.","level":"DEBUG","category":"MPU_CORE"} {"timestamp":"2020-04-24T15:58:09+02:00","message":"\nTest with return line\n.","level":"DEBUG","category":"MPU_CORE"} {"timestamp":"2020-04-24T15:58:09+02:00","message":"Test simple2.","level":"DEBUG","category":"MPU_CORE"} {"timestamp":"2020-04-24T15:58:09+02:00","message":"Begin. Program name : nano_core","level":"DEBUG","category":"MPU_CORE"}

2 1

syslog-ng, json and handle escaping properly
by Arthur Lambert 24 Apr '20

24 Apr '20

Hello, I tried to migrate from syslog to Syslog-ng. I am trying to deploy it on an embedded target with buildroot. At the same time, I also tried to switch log format to JSON. In my c code, I use Syslog function and init with the openlog function: openlog("middleware", 0, LOG_LOCAL1); I have some macro to generate the json logs: #define _PRINT_DEBUG(M, ...) \ do { \ syslog(LOG_DEBUG, "\"category\":\"%s\",\"level\":\"DEBUG\",\"message\":\"" M "%s\"}\n", __DIR__, __VA_ARGS__); \ } while (0) I define a syslog-ng conf file: @version: 3.2X filter f_middleware { facility("local1"); }; template t_json_filetemplate { template("{\"timestamp\":\"${ISODATE}\",${MESSAGE}\n"); }; source s_kernel { file("/proc/kmsg" program_override("kernel")); }; source s_middleware { unix-stream("/dev/log"); }; destination d_kernel { file("/data/logs/kern.log"); }; destination d_middleware { file("/data/logs/middleware.log", template(t_json_filetemplate)); }; log { source(s_kernel); destination(d_kernel); }; log { source(s_middleware); filter(f_middleware); destination(d_middleware); }; So basically I want to redirect all my log from my code in /data/logs/middleware.log. I also want to redirect all kernel logs in /data/logs/kern.log I have two issues. The first one is escaping. If I want to print a JSON file the double quote will be not escaped. My first solution was to use escape feature from Syslog-ng: destination d_middleware { file("/data/logs/middleware.log", template("{\"timestamp\":\"${ISODATE}\",${MESSAGE}\n") template-escape(yes)); }; Problem is that now everything is escaped and not only the message, some example: {"timestamp":"2020-04-21T09:24:02+02:00",\"category\":\"BOOT\",\"level\":\"INFO\",\"message\":\"Check pstore partition..\"} {"timestamp":"2020-04-21T09:24:02+02:00",\"category\":\"BOOT\",\"level\":\"INFO\",\"message\":\"Start hardware watchdog daemon...\"} {"timestamp":"2020-04-21T09:24:02+02:00",\"category\":\"BOOT\",\"level\":\"INFO\",\"message\":\"Prepare asound configuration...\"} {"timestamp":"2020-04-21T09:24:02+02:00",\"category\":\"BOOT\",\"level\":\"INFO\",\"message\":\"Middleware is about to start...\"} {"timestamp":"2020-04-21T09:24:03+02:00",\"category\":\"BOOT\",\"level\":\"INFO\",\"message\":\"Load sdma firmware..\"} {"timestamp":"2020-04-21T09:24:03+02:00",\"category\":\"BOOT\",\"level\":\"INFO\",\"message\":\"Watchdog is about to start...\"} {"timestamp":"2020-04-21T09:24:03+02:00",\"category\":\"BOOT\",\"level\":\"INFO\",\"message\":\"Start mpu watchdog..\"} As you can see, everything is escaped because for Syslog-ng, everything is the message and not only the final part. I feel like I am completely using Syslog-ng in the wrong way right? How can I fix that? Do I have to handle escaping by myself manually in my middleware? Do I have to pre-process all logs manually by myself? It seems quite awful. I have a second issue which is probably related? When I tried to print the content of a file, the last '}' is truncated. The reason seems to be related to the presence of \n. I can reproduce the issue by just calling my PRINT_DEBUG macro as follow: PRINT_DEBUG ("YO YO YO KO\n"); PRINT_DEBUG ("YO YO YO OK"); The result: {"timestamp":"2020-04-21T09:24:03+02:00",\"category\":\"MPU_CORE\",\"level\":\"DEBUG\",\"message\":\"YO YO YO KO {"timestamp":"2020-04-21T09:24:03+02:00",\"category\":\"MPU_CORE\",\"level\":\"DEBUG\",\"message\":\"YO YO YO OK\"} My syslog version/module information : # syslog-ng -V -s syslog-ng 3 (3.26.1) Config version: 3.22 Installer-Version: 3.26.1 Revision: Compile-Date: Apr 10 2020 16:41:46 Module-Directory: /usr/lib/syslog-ng Module-Path: /usr/lib/syslog-ng Include-Path: /usr/share/syslog-ng/include Available-Modules: add-contextual-data,affile,afprog,afsocket,afstomp,afuser,appmodel,azure-auth-header,basicfuncs,cef,confgen,cryptofuncs,csvparser,dbparser,disk-buffer,examples,graphite,hook-commands,ht tp,kvformat,linux-kmsg-format,map-value-pairs,mod-python,pseudofile,snmptrapd-parser,stardate,syslogformat,system-source,tags-parser,tfgetent,timestamp,xml Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-Linux-Caps: off Enable-Systemd: off -- - Arthur LAMBERT

3 2