- syslog-ng - lists.balabit.hu

syslog-ng-ctl: EOF occurred while reading control socket
by Faine, Mark R. (MSFC-IS40)[NICS] 24 Apr '20

24 Apr '20

I am seeing the message "EOF occurred while reading control socket" intermittently when using the syslog-ng-ctl command. Is there something misconfigured or anything I can do to prevent this? Thanks, -Mark

2 1

mystique with spoof_address
by Edvinas Kairys 16 Apr '20

16 Apr '20

Hello, i installed (yum install) following version on Centos 7 box. syslog-ng 3.5.6 Installer-Version: 3.5.6 Revision: Compile-Date: Dec 30 2015 19:57:24 Available-Modules: affile,afprog,afsocket-notls,afsocket-tls,afsocket,afstomp,afuser,basicfuncs,confgen,cryptofuncs,csvparser,dbparser,linux-kmsg-format,syslogformat,system-source Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: on Enable-Pcre: on My goal is to forward syslog messages 'untouched' but to change the source address to original one. For that case i'm using spoof-address. My conf is like this: options { flush_lines (0); time_reopen (10); log_fifo_size (1000); chain_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (no); mark-freq (0); }; source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); }; destination d_syslog_tcp { network("10.13.33.125" transport("udp") port(5140) spoof-source(yes)); }; log { source(s_network); destination(d_syslog_tcp); }; log { source(s_network); filter(f_default); destination(d_mesg); }; # Source additional configuration files (.conf extension only) @include "/etc/syslog-ng/conf.d/*.conf" Strange thing, that when I enable spoof-source, some packets are not transmitted to the destination. Even TCPDUMP says that it's sent, but i dont see some logs on destination box. Could it be something with spoof_source command ? Also i didn't compiled it because i saw that SPOOF functionality is on in syslog-ng -V output. Any suggestions ? Thanks

2 4

issues with rewrite and subst
by Russell Fulton 14 Apr '20

14 Apr '20

version 3.26.1 I am attempting to use rewrite to copy part of one macro into a new one: rewrite r_user1 { set( "${user}", value("user_name"));}; rewrite r_user2 { subst( "^.+$(.+)$", "${1}", value("user_name")) ;}; The first simply copies user into user_name. The second is intended to extract anything in parentheses and throw away the rest. here is a cleaned up dump of json output including the macros from the regexp: {"user_name":")","user”:”yyyyn@gmail.com(xxx549)","2":")","1":")","0”:”yyyy@gmail.com(xxx549)”} I believe ‘1’ should contain ‘xxx549’ not ‘)’. I have tested the regexpn in ruby’s irb and it works fine there. here is another example this one where the regexp should not have matched at all: {"user_name":"9","user":"ping999","2":"9","1":"9","0":"ping999”} macros 1 and 2 always seem to contain the last character of the original string.

2 1

Regular occurrences of Error writing control channel; error='Broken pipe (32)'
by Ahmed Soyef 09 Apr '20

09 Apr '20

Hi All, We've been running syslog-ng and have recently started to see the above message in our logs. Sometimes running syslog-ng-ctl stats takes very long and results in similar error messages. Does anyone know why this may be the case? Do these errors cause any issues with log flows through the syslog-ng service? Do they cause issues with recording of stats? Kind regards, Soyef ********************************************************************** This email and any files transmitted with it are private and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please return it to the address it came from telling them it is not for you and then delete it from your system. This email message has been swept for computer viruses. **********************************************************************

3 3

Insider 2020-04: syslog-ng RPM; mult-line-timeout; FreeBSD;
by Peter Czanik (pczanik) 09 Apr '20

09 Apr '20

Dear syslog-ng users, This is the 80th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. In these difficult times, when many of us stay at home, we can decide what to do with that bit of extra time that we don’t spend commuting. Some of us turn to entertainment or hobbies, do long-neglected things around the house, or even focus on studying and honing skills. If you ran out of movies to watch and want to spend your time on something more practical, this might be the best time to learn something new about syslog-ng. One starting point for that is the reference documentation, available for each release separately: https://www.syslog-ng.com/technical-documents/list/syslog-ng-open-source-ed… Another possibility is to check out our ever-growing collection of syslog-ng blogs. These describe a large number of different syslog-ng use cases. Blogs are available at https://www.syslog-ng.com/community/b/blog If you want to deep dive into configuring syslog-ng, here are some of the highlights: * The building blocks of syslog-ng: https://www.syslog-ng.com/community/b/blog/posts/building-blocks-of-syslog-… * Calculate PI with syslog-ng: https://www.syslog-ng.com/community/b/blog/posts/calculate-pi-syslog-ng * Creating heat maps using the new syslog-ng geoip2 parser: https://www.syslog-ng.com/community/b/blog/posts/creating-heat-maps-using-n… * Extend syslog-ng in Python: https://www.syslog-ng.com/community/tags/python Even if it is often not real-time, you can also chat with syslog-ng users and developers. The syslog-ng Gitter channel is a place to ask syslog-ng-related questions, but you are also very welcome to share your experiences about syslog-ng here. A success story not just feels good for developers but can also inspire other users. It is available at https://gitter.im/syslog-ng/syslog-ng NEWS Overview of syslog-ng RPM repositories -------------------------------------- This blog provides you an overview of syslog-ng RPM repositories: why to have unofficial packages at all and what are the advantages and disadvantages of the different unofficial repositories. https://www.syslog-ng.com/community/b/blog/posts/overview-of-syslog-ng-rpm-… Multi-line-timeout: making sure your last multi-line message is not lost -------------------------------- When your application has a problem that it cannot handle, then Java, PHP and other environments often write multi-line error messages. These long messages include information that is useful for developers, but it might be difficult to handle for logging systems. A multi-line log message is usually saved when the beginning of the next message is detected, which can make handling the last message problematic. This is where multi-line-timeout can help. After a pre-configured timeout, the last message is saved by syslog-ng. Losing a message when there are thousands of them is probably not a big deal. But if you are lucky, the error messages are rare. Maybe just a single message in a file. In either case, you can lose most or even all messages. If you do not want to lose these messages, configure multi-line-timeout. https://www.syslog-ng.com/community/b/blog/posts/multi-line-timeout-making-… syslog-ng in FreeBSD ports -------------------------- Recently we explored the different syslog-ng packages available for RPM-based Linux distributions, used by the majority of our Linux users. This time we focus on FreeBSD, the platform of choice for most of our non-Linux users. >From this blog, you can learn about the features that are in the binary syslog-ng packages, how to compile syslog-ng for yourself from ports and the current syslog-ng version policy in ports. NEW WHITE PAPERS * Upgrade to State-of-the-Art Log Management: https://www.syslog-ng.com/whitepaper/log-management-essentials8137754/ WEBINARS * Learn how to easily integrate Azure Sentinel into your log-data strategy: https://www.syslog-ng.com/webcast-ondemand/learn-how-to-easily-integrate-az… * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

can not load geoip2 plugin
by Russell Fulton 09 Apr '20

09 Apr '20

HI This is a locally compiled application (version 3.26.1) and I am trying to get the geoip2 stuff working. I had similar problems a week or two back with elasticsearch_http destination plugin. This seems like it might be easier to diagnose since the error says where it is looking for the plugin. rful011@secmgrprd02:~$ /usr/local/syslog-ng-3.26.1/sbin/syslog-ng -s -f /etc/syslog-ng/geoip.conf [2020-04-08T07:30:19.551845] Plugin module not found in 'module-path'; module-path='/usr/local/syslog-ng-3.26.1/lib/syslog-ng', module='geoip2' Error parsing config, syntax error, unexpected LL_ERROR, expecting $end in /etc/syslog-ng/geoip.conf:4:1-5:1: 1 @version: 3.21 2 3 @include "scl.conf" 4-----> @module geoip2 4-----> ^^^^^^^^^^^^^^^ 5-----> # 6 7 options { 8 use_dns (no); 9 use_fqdn (no); rful011@secmgrprd02:~$ ls -l /usr/local/syslog-ng-3.26.1/lib/syslog-ng/libgeoip2-plugin.* -rwxr-xr-x 1 root root 1271 Mar 31 08:57 /usr/local/syslog-ng-3.26.1/lib/syslog-ng/libgeoip2-plugin.la -rwxr-xr-x 1 root root 158912 Mar 31 08:57 /usr/local/syslog-ng-3.26.1/lib/syslog-ng/libgeoip2-plugin.so any ideas why it is not loading the library?

2 2

3.26 RHEL/CentOS 6 packages
by Peter Czanik (pczanik) 02 Apr '20

02 Apr '20

Hi, syslog-ng 3.26 packages are now also available for RHEL/CentOS 6: https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng326epel6/ And if you use syslog-ng on RHEL/CentOS I'd appreciate if you could answer a quick poll on Twitter: https://twitter.com/PCzanik/status/1245692669889777667 Bye, Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

errors with elasticsearch_http on 2.21 & 3.22
by Russell Fulton 02 Apr '20

02 Apr '20

I have had this config running happily for several months and today I tried to add the geoip2 plugin and managed to break everything. I first realised that I needed to recompile syslog-ng to get the geoip2 plugin but forgot I was running a locally compiled version . I tried apt install syslog-ng-mod-geoip and this broke things badly and I have been trying to recover for the last few hours :( The issue is that any attempt to start syslog-ng with the original config that includes a destination of elasticsearch_http get an error: Error parsing destination statement, destination plugin elasticsearch_http not found in /usr/local/syslog-ng-3.22/etc/syslog-ng.conf:33:3-33:21 Judging from what I found on th ’Net this is what one would expect if the syslog-ng version was prior to 3.21 and did not support the http dest. I first tried recompiling and installing 3.21 (in a different dir) with geoip2 enabled. That went with out errors but still would not process my config. Aside: At this point I found that in spite of having the geoip2 module included, syslog-ng failed to find it when I copied the setup from the manual. long story short the manual says the module is ‘geoip2’ when in fact it is ‘geoip2-plugin’ and that is the name you have to use in the @module. Weird! I then compiled 3.22 since I had the tar file and this behaved the same. rful011@secmgrprd02:~$ cat short.conf @version: 3.21 @include "scl.conf" @module geoip2-plugin source s_loghost { network( transport("tcp") flags(no-multi-line) port(1514) keep-alive(yes)); }; destination d_elastic { elasticsearch_http( index("auth_${YEAR}.${MONTH}.${DAY}") type("auth") persist-name("auth") template( "$(format-json --scope rfc3164 --scope nv-pairs --exclude R_DATE --key ISODATE)\n") url("http://secesprd01.its.auckland.ac.nz:9200/_bulk") ); }; log { source(s_loghost); destination(d_elastic ); flags(flow-control); }; rful011@secmgrprd02:~$ /usr/local/syslog-ng-3.21/sbin/syslog-ng -s -c ~/short.conf Error parsing destination statement, destination plugin elasticsearch_http not found in /usr/local/syslog-ng-3.21/etc/syslog-ng.conf:33:3-33:21: 28 file( "/home/rful011/test.log" template(t_db_parsed_test)); 29 }; 30 31 32 destination d_elastic { 33----> elasticsearch_http( 33----> ^^^^^^^^^^^^^^^^^^ 34 index("auth_${YEAR}.${MONTH}.${DAY}") 35 type("auth") 36 persist-name("auth") 37 template( "$(format-json --scope rfc3164 --scope nv-pairs --exclude R_DATE --key ISODATE)\n") 38 url("http://secesprd01.its.auckland.ac.nz:9200/_bulk”) rful011@secmgrprd02:~$ /usr/local/syslog-ng-3.21/sbin/syslog-ng --version syslog-ng 3 (3.21.1) Config version: 3.21 Installer-Version: 3.21.1 Revision: Compile-Date: Mar 29 2020 11:57:39 Module-Directory: /usr/local/syslog-ng-3.21/lib/syslog-ng Module-Path: /usr/local/syslog-ng-3.21/lib/syslog-ng Include-Path: /usr/local/syslog-ng-3.21/share/syslog-ng/include Available-Modules: add-contextual-data,affile,afprog,afsocket,afstomp,afuser,appmodel,basicfuncs,cef,confgen,cryptofuncs,csvparser,date,dbparser,disk-buffer,examples,geoip2-plugin,tfgetent,graphite,hook-commands,http,json-plugin,kvformat,linux-kmsg-format,map-value-pairs,pseudofile,mod-python,snmptrapd-parser,stardate,syslogformat,system-source,tags-parser,xml Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-Linux-Caps: off Enable-Systemd: off

3 8

Syslog-NG Mysql Parsing to separate column
by Sync IT 01 Apr '20

01 Apr '20

Hi I am new to syslog-ng. I am receiving my logs perfectly to mysql. now i want to separate the message log into different column in mqsql. Currently i am receiving messages like this R2_DST_RTR forward: in:<pppoe-user1> out:vlan100-Default-Internet, src-mac 11:22:33:44:55:66, proto TCP (ACK,FIN), 172.16.41.159:42670->23.46.16.231:80, NAT (172.16.41.159:42670->9.9.9.9:42670)->23.46.16.231:80, len 52 This is my syslog-ng config source s_net{ udp( ); }; destination d_mtksql { sql(type(mysql) host("localhost") username("dbuser") password("dbpasss") database("syslog") table("${R_YEAR}_${R_MONTH}_${R_DAY}") columns( "id int(11) unsigned not null auto_increment primary key", "host varchar(40) not null", "date datetime", "message text not null") values("0", "$FULLHOST", "$R_YEAR-$R_MONTH-$R_DAY $R_HOUR:$R_MIN:$R_SEC", "$MSG") indexes("id")); }; log { source(s_net); destination(d_mtksql); }; i want to separate the message data in different column like- time,username,src mac,src ip,dst ip, nat ip. Any idea how can i achieve that? I am not a pro so if possible kindly write in details how to parse them. Many thanks

2 1

Change Position Information inside Messasge
by William Luiz Ribeiro Vasconcelos Da Silva 27 Mar '20

27 Mar '20

Hello everyone, Is it possible to change a position of an information within the message? From: 2020-03-26; 17: 55: 22; RTCGNMGA0101: RT_SRC_NAT_PBA_ALLOC :; 100.64.1.114:38784-38847; 177.51.112.218; TO: 2020-03-26; 17: 55: 22; RTCGNMGA0101: RT_SRC_NAT_PBA_ALLOC:; 100.64.1.114; 177.51.112.218:38784-38847; Basically, I would like to change the position of the connection port within the message. How to do this? TKS Atenciosamente, WILLIAM LUIZ R V SILVA Mediation Ericsson Mobile +55 11 97979-9886 www.ericsson.com<http://www.ericsson.com/> [Descri??o: Descri??o: Ericsson]<http://www.ericsson.com/> Esta mensagem, incluindo seus anexos, pode conter informa??es privilegiadas e/ou de car?ter confidencial, n?o podendo ser retransmitida sem autoriza??o do remetente. Se voc? n?o ? o destinat?rio ou pessoa autorizada para receb?-la, informamos que o seu uso, divulga??o, c?pia ou arquivamento s?o proibidos. Portanto, se voc? recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conte?do. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto

2 3

variable host filter in events
by Syslogng 25 Mar '20

25 Mar '20

Hi, We receive aggregated syslog from a server (all logs are send from 1 IP). Also all the events are mixed. The name of the host sending the initial traffic is in each event. ex: 2020/03/23 [notice] [user] New original_source=SERV1.example.com Task=0 .... How to recover SER1 which is always preceded by "original_source=" and followed by "example.com" to save it in a file for example /data/serv1.log I don't want a static filter (I know how to do it) but a dynamic one. If a new event arrives at original_source=SERV2.example.com I would like it to automatically create a /data/serv2.log Could you help me please ? thank you in advance Pit

2 3

Problem to Get UDP Packets - Syslog-ng
by William Luiz Ribeiro Vasconcelos Da Silva 25 Mar '20

25 Mar '20

Hello Everyone, I installed syslog-ng on a new machine, however in initial tests, there was no collection of UDP packages by syslog-ng. Here are some points I checked: sudo netstat -plunt | grep -e PID -e syslog Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:601 0.0.0.0:* LISTEN 16169/syslog-ng udp 0 0 10.96.145.42:514 0.0.0.0:* 16169/syslog-ng netstat -anu | grep 514 udp 0 0 10.96.145.42:514 0.0.0.0:* [cgnat@mgalnxa01 etc]$ sudo systemctl status syslog-ng -l ● syslog-ng.service - System Logger Daemon Loaded: loaded (/usr/lib/systemd/system/syslog-ng.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2020-03-25 12:38:08 -03; 5min ago Process: 114207 ExecReload=/bin/kill -HUP $MAINPID (code=exited, status=0/SUCCESS) Main PID: 16169 (syslog-ng) CGroup: /system.slice/syslog-ng.service └─16169 /opt/syslog-ng/libexec/syslog-ng -F --enable-core Mar 25 12:38:08 mgalnxa01 systemd[1]: Starting System Logger Daemon... Here is an example of the package received via tcpdump, but it was not captured by syslog-ng: 10:46:13.529331 IP (tos 0x20, ttl 251, id 33055, offset 0, flags [none], proto UDP (17), length 243) 10.96.145.98.syslog > mgalnxa01.9514: [udp sum ok] SYSLOG, length: 215 Facility user (1), Severity info (6) Msg: Mar 24 13:46:13 2020 RTCGNMGA0103 RT_NAT: RT_SRC_NAT_PBA_ALLOC: Subscriber 100.64.1.6 used/maximum [2/2] blocks, allocates port block [47104-47167] from 177.51.116.146 in source pool PUBLIC-NAT-POOL-1 lsys_id: 0 0x0000: 3c31 343e 4d61 7220 3234 2031 333a 3436 0x0010: 3a31 3320 3230 3230 2052 5443 474e 4d47 0x0020: 4130 3130 3320 5254 5f4e 4154 3a20 5254 0x0030: 5f53 5243 5f4e 4154 5f50 4241 5f41 4c4c 0x0040: 4f43 3a20 5375 6273 6372 6962 6572 2031 0x0050: 3030 2e36 342e 312e 3620 7573 6564 2f6d 0x0060: 6178 696d 756d 205b 322f 325d 2062 6c6f 0x0070: 636b 732c 2061 6c6c 6f63 6174 6573 2070 0x0080: 6f72 7420 626c 6f63 6b20 5b34 3731 3034 0x0090: 2d34 3731 3637 5d20 6672 6f6d 2031 3737 0x00a0: 2e35 312e 3131 362e 3134 3620 696e 2073 0x00b0: 6f75 7263 6520 706f 6f6c 2050 5542 4c49 0x00c0: 432d 4e41 542d 504f 4f4c 2d31 206c 7379 0x00d0: 735f 6964 3a20 30 What I need to analyze / verify, for syslog-ng will capture this type of package and convert it to a file. Atenciosamente, WILLIAM LUIZ R V SILVA Mediation Ericsson Rua Maria Preste Maia, 300 02879-130, Brazil Phone +55 11 2760-3785 Mobile +55 11 97979-9886 wsilva_ericsson(a)timbrasil.com.br<mailto:wsilva_ericsson@timbrasil.com.br> www.ericsson.com<http://www.ericsson.com/> [Descricao: Descricao: Ericsson]<http://www.ericsson.com/> Esta mensagem, incluindo seus anexos, pode conter informacoes privilegiadas e/ou de carater confidencial, nao podendo ser retransmitida sem autorizacao do remetente. Se voce nao e o destinatario ou pessoa autorizada para recebe-la, informamos que o seu uso, divulgacao, copia ou arquivamento sao proibidos. Portanto, se voce recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteudo. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto

3 8

Remove String from Message + syslog
by William Luiz Ribeiro Vasconcelos Da Silva 25 Mar '20

25 Mar '20

Hello eveyone, We are receiving two strings in the message in UDP packets: "used / maximum [1/2]" or "used / maximum [2/2]". How to configure the subst function, to be able to remove these strings? Atenciosamente, WILLIAM LUIZ R V SILVA Mediation Ericsson Mobile +55 11 97979-9886 wsilva_ericsson(a)timbrasil.com.br<mailto:wsilva_ericsson@timbrasil.com.br> www.ericsson.com<http://www.ericsson.com/> [Descri??o: Descri??o: Ericsson]<http://www.ericsson.com/> Esta mensagem, incluindo seus anexos, pode conter informa??es privilegiadas e/ou de car?ter confidencial, n?o podendo ser retransmitida sem autoriza??o do remetente. Se voc? n?o ? o destinat?rio ou pessoa autorizada para receb?-la, informamos que o seu uso, divulga??o, c?pia ou arquivamento s?o proibidos. Portanto, se voc? recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conte?do. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto

2 3

Disk Buffering
by Ronald Fenner 24 Mar '20

24 Mar '20

I'm going to enable disk buffer but I'd like to place the files on an EBS volume that persists when a server is shutdown. The idea being we'd have a recovery server that would stream out and items left in the buffer. Besides the buffer itself what other files should be on there so that a different instance with the same config file can load the buffer and send the rest of it. Ronald Fenner Network Architect Game Circus LLC. rfenner(a)gamecircus.com

2 1

Mysql is missing log on my Ubuntu 18.04.4LTS
by Sync IT 23 Mar '20

23 Mar '20

Hi I have installed syslog-ng on a ubuntu machine. Mysql has been used to store the logs. But i keep seeing the logs are missed. that means logs are not storing properly. any idea what is wrong with it. it normally happened at the end of the day close to 12am. Kindly help. Thanks

3 2

Interested in contributing to syslog-ng
by Vivin Peris 20 Mar '20

20 Mar '20

I want to start contributing to syslog-ng organization and need a mentor for the same. I have worked extensively with apache kafka and would be interested in the project entailing the addition of support for template feature Please help me out with the same Thanks Sincerely Vivin [image: Mailtrack] <https://mailtrack.io?utm_source=gmail&utm_medium=signature&utm_campaign=sig…> Sender notified by Mailtrack <https://mailtrack.io?utm_source=gmail&utm_medium=signature&utm_campaign=sig…> 03/20/20, 03:14:47 PM

2 1

MARK messages and filtering
by Alexandre Santos 19 Mar '20

19 Mar '20

Hi, I have the following part of syslog configuration: destination d_localfile_kernel { file("/var/log/kernel.log" flags(syslog-protocol) ); }; filter f_localfile_kernel_kern { facility(kern) and level(info .. emerg); }; filter f_localfile_kernel { filter(f_localfile_kernel_kern); }; log { source(s_src); filter(f_localfile_kernel); destination(d_localfile_kernel); flags(flow-control); }; And I see in my kernel.log file: <46>1 2020-03-18T18:35:28+00:00 localhost - - - [meta sequenceId="1"] -- MARK -- <46>1 2020-03-18T18:55:28+00:00 localhost - - - [meta sequenceId="2"] -- MARK -- <46>1 2020-03-18T19:15:28+00:00 localhost - - - [meta sequenceId="3"] -- MARK -- <46>1 2020-03-18T19:35:28+00:00 localhost - - - [meta sequenceId="4"] -- MARK -- <46>1 2020-03-18T19:55:28+00:00 localhost - - - [meta sequenceId="5"] -- MARK -- <46>1 2020-03-18T20:15:28+00:00 localhost - - - [meta sequenceId="6"] -- MARK -- <46>1 2020-03-18T20:35:28+00:00 localhost - - - [meta sequenceId="7"] -- MARK -- <46>1 2020-03-18T20:55:28+00:00 localhost - - - [meta sequenceId="8"] -- MARK -- <46>1 2020-03-18T21:15:28+00:00 localhost - - - [meta sequenceId="9"] -- MARK -- I was not expecting to see syslog facility messages coming out, since I am filtering by kernel facility. Is this expected behavior? Thanks & regards, Alex

2 1

Insider 2020-03: syslog-ng-stable; macOS; BastilleBSD;
by Peter Czanik (pczanik) 19 Mar '20

19 Mar '20

Dear syslog-ng users, This is the 79th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Introducing the syslog-ng-stable RPM repositories ------------------------------------------------- For many years – especially after syslog-ng changed to a rolling release model – users I talked to asked for up-to-date RPM packages. They also asked for a separate repository for each new release to avoid surprises (a new release might accidentally or even intentionally break old features) and to be able to use a given release if they want to (“if it works, do not fix it”). That is how my unofficial RPM repositories were born. Recently some long-time syslog-ng users and members of the Splunk community started to ask for a repository, which always has the latest syslog-ng version available. Most users still prefer to use separate repositories. That is how I came up with the idea for the syslog-ng-stable repository: I push a new release to this new rolling repo only after at least a week of delay. This is enough to spot most major problems. Once the delay is over and everything seems to be OK, I can push the latest release to the syslog-ng-stable repo. If there is a bigger problem, I can skip the release in the stable repo or wait for a fix. https://www.syslog-ng.com/community/b/blog/posts/introducing-the-syslog-ng-… How to install syslog-ng on macOS --------------------------------- A member of the syslog-ng community wrote a guide on how to enable syslog-ng on macOS: “My goal was to send any kind of Mac logs to a big data platform (Devo). Mac already comes with syslogd, which is the Apple System Log server. It is basically a daemon that processes syslog messages but to be honest, it’s pretty old and basic. As a result, I decided to try syslog-ng.” https://medium.com/macoclock/how-to-install-syslog-ng-on-macos-965127f1c05c Running syslog-ng in BastilleBSD -------------------------------- Bastille is a container management system for FreeBSD. If you are coming from a Linux world, it is a bit like Docker or Podman / Buildah from Red Hat, at least some of its functionality. I learned about BastilleBSD right before my Christmas holidays. Currently my primary work platform is Linux and I am just preparing to learn about Kubernetes and OpenShift. I planned not to do anything work-related during my holidays – which is quite difficult, if your hobby heavily overlaps with your work. Having some strong FreeBSD roots (started to use FreeBSD in 1994), BastilleBSD arrived just on time to be a good excuse to do something IT-related :-) https://www.syslog-ng.com/community/b/blog/posts/running-syslog-ng-in-basti… NEW WHITE PAPERS * Upgrade to State-of-the-Art Log Management: https://www.syslog-ng.com/whitepaper/log-management-essentials8137754/ WEBINARS * Learn how to easily integrate Azure Sentinel into your log-data strategy: https://www.brighttalk.com/webcast/16207/390780 * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

3.26 question
by Peter Czanik (pczanik) 18 Mar '20

18 Mar '20

Hi, Do you use syslog-ng 3.26? Before I add a new release to my syslog-ng-stable repo normally I check for feedback on the release. But here I have a problem. There are no bug reports about syslog-ng 3.26, which is good. On the other hand I could not find any reports that someone is already using 3.26. Do you have any feedback on 3.26? Either positive or negative? Thanks, Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

use /dev/log on systemd machines
by Matus UHLAR - fantomas 18 Mar '20

18 Mar '20

Hello, if I understand properly, the system() source opens /dev/log socket when machine does not run systemd, am I right? Can I force syslog-ng to open /dev/log socket in this case or have I to configure it explicitly? -- Matus UHLAR - fantomas, uhlar(a)fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. I intend to live forever - so far so good.

2 1

cmake vs autotools
by Chris Packham 18 Mar '20

18 Mar '20

Hi, Question from the buildroot mailing list [1]. Is syslog-ng transitioning to cmake or will both cmake an autotools be supported for the foreseeable future. It's not an issue either way buildroot supports building with either cmake or autotools. But if autotools will be retired we may as well switch now to avoid hassles with future updates. Thanks, Chris -- [1] - http://lists.busybox.net/pipermail/buildroot/2020-March/277459.html

3 2

syslog-ng 3.26 RPM packages
by Peter Czanik (pczanik) 10 Mar '20

10 Mar '20

Hi, A bit slower than usual, but my unofficial syslog-ng 2.26 RPM packages are now available. I'm still traveling, so I did not have a chance for much testing. Any feedback is very welcome! * openSUSE/SLES: https://build.opensuse.org/project/show/home:czanik:syslog-ng326 * fedora/RHEL/CentOS: https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng326/ Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Fwd: facility override
by Alexandre Santos 09 Mar '20

09 Mar '20

Hi, I tried to rewrite PRI but the macro is not writable: Mar 09 11:27:31 localhost syslog-ng[31986]: Error parsing rewrite expression, PRI is read-only, it cannot be changed in rewrite rules in /etc/syslog-ng/syslog-ng.conf: Mar 09 11:27:31 localhost syslog-ng[31986]: 359 }; Mar 09 11:27:31 localhost syslog-ng[31986]: 360 # end of localFile: netconf-commands Mar 09 11:27:31 localhost syslog-ng[31986]: 361 Mar 09 11:27:31 localhost syslog-ng[31986]: 362 Mar 09 11:27:31 localhost syslog-ng[31986]: 363 # remote: test Mar 09 11:27:31 localhost syslog-ng[31986]: 364---> rewrite r_pri{set("189", value("PRI"));}; Mar 09 11:27:31 localhost syslog-ng[31986]: 364---> ^ Mar 09 11:27:31 localhost syslog-ng[31986]: 365 destination d_test_udp { Mar 09 11:27:31 localhost syslog-ng[31986]: 366 syslog("192.168.122.1" transport("udp") ip-protocol(4) port(514) Mar 09 11:27:31 localhost syslog-ng[31986]: 367 suppress(5) Mar 09 11:27:31 localhost syslog-ng[31986]: 368 disk-buffer( Mar 09 11:27:31 localhost syslog-ng[31986]: 369 mem-buf-size(2097152) I tried to use the following configuration to make a facility override local0 -> local7: # remote: test template t_test { template("$(if ('${LEVEL_NUM}' == '0') '<184>1' $(if ('${LEVEL_NUM}' == '1') '<185>1' $(if ('${LEVEL_NUM}' == '2') '<186>1' $(if ('${LEVEL_NUM}' == '3') '<187>1' $(if ('${LEVEL_NUM}' == '4') '<188>1' $(if ('${LEVEL_NUM}' == '5') '<189>1' $(if ('${LEVEL_NUM}' == '6') '<190>1' '<191>1' ))))))) ${ISODATE} ${HOST} ${PROGRAM} ${PID} $(if ('${MSGID}' == '') '-' '${MSGID}') $(if ('${SDATA}' == '') '-' '${SDATA}') ${MESSAGE}"); }; destination d_test_udp { network("192.168.122.1" transport("udp") ip-protocol(4) port(514) template ("t_test") ); }; filter f_remote_test_udp_local0 { facility(local0) and level(debug .. emerg); }; log { source(s_src); filter(f_remote_test_udp_local0); destination(d_test_udp); flags(flow-control); }; # end of remote server: test The problem is that I get a double header in the syslog server: Mar 9 11:41:52 127.0.0.1 root[31353] <190>1 2020-03-09T11:41:52+00:00 127.0.0.1 root 31353 - - This is a Test 6 Mar 9 11:41:53 127.0.0.1 root[31404] <190>1 2020-03-09T11:41:53+00:00 127.0.0.1 root 31404 - - This is a Test 7 Mar 9 11:41:53 127.0.0.1 root[31448] <190>1 2020-03-09T11:41:53+00:00 127.0.0.1 root 31448 - - This is a Test 8 Mar 9 11:41:54 127.0.0.1 root[31449] <190>1 2020-03-09T11:41:54+00:00 127.0.0.1 root 31449 - - This is a Test 9 Mar 9 11:41:54 127.0.0.1 root[31468] <190>1 2020-03-09T11:41:54+00:00 127.0.0.1 root 31468 - - This is a Test 10 Mar 9 11:41:55 127.0.0.1 root[31485] <190>1 2020-03-09T11:41:55+00:00 127.0.0.1 root 31485 - - This is a Test 11 Mar 9 11:41:55 127.0.0.1 root[31526] <190>1 2020-03-09T11:41:55+00:00 127.0.0.1 root 31526 - - This is a Test 12 Mar 9 11:41:55 127.0.0.1 root[31567] <190>1 2020-03-09T11:41:55+00:00 127.0.0.1 root 31567 - - This is a Test 13 Can you help me? Thanks and regards, Alex On Mon, Jan 20, 2020 at 07:49 AM Attila Szakacs (aszakacs) < Attila.Szakacs(a)oneidentity.com> wrote: > Hi Alex, > > I think ${PRI} does exactly that. > > PRI > Description: The priority and facility encoded as a 2 or 3 digit decimal number as it is present in syslog messages. > > Regards, > Attila > ________________________________ > From: syslog-ng <syslog-ng-bounces at lists.balabit.hu <https://lists.balabit.hu/mailman/listinfo/syslog-ng>> on behalf of Alexandre Santos <alexandre.rosas.santos at gmail.com <https://lists.balabit.hu/mailman/listinfo/syslog-ng>> > Sent: Friday, January 17, 2020 7:56 PM > To: Syslog-ng users' and developers' mailing list <syslog-ng at lists.balabit.hu <https://lists.balabit.hu/mailman/listinfo/syslog-ng>> > Subject: [syslog-ng] facility override > > CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe. > > Hi, > > Is there a way of overriding the facility of the messages on the destination, besides using a template like: > { template("$(if ('${LEVEL_NUM}' == '2') '<186>1' $(if ('${LEVEL_NUM}' == '3') '<187>1' $(if ('${LEVEL_NUM}' == '4') '<188>1' ${HOST}\\@`HOSTIPV4` ${PROGRAM} ${PID} ${SDATA} ${MESSAGE}\n"); }; > > Thanks in advance, > Alex >

2 2

restart vs reload
by Alexandre Santos 09 Mar '20

09 Mar '20

Hi, I am trying to dynamically change the output message format between RFC3164 and RFC5424. root@localhost:~# diff /etc/syslog-ng/syslog-ng.conf /root/syslog-ng.conf.bak 365c365 < network("192.168.122.1" transport("udp") ip-protocol(4) port(514) --- > syslog("192.168.122.1" transport("udp") ip-protocol(4) port(514) If I use: "/usr/sbin/service syslog-ng restart" it works fine, but if I use "/usr/sbin/syslog-ng-ctl reload", the message format does not change. I am using syslog-ng version 3.19 Any thoughts? Thanks & Regards, Alex

2 1

my unofficial 3.26 RPM packages delayed
by Peter Czanik (pczanik) 05 Mar '20

05 Mar '20

Hi, Just a heads up. I'm traveling and at my current location wifi is too slow and unstable to do package building. Once I have a stable wifi I'll first build them in my syslog-ng-githead repositories and once everything builds (I have to disable Python support on SLES 12 as Python 3.4 is too old) I'll create the usual versioned repositories. So lets hope, that wifi will work better at my next hotel / conference and then I can prepare my usual openSUSE/SLES & Fedora/RHEL/CentOS packages. Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0