- syslog-ng - lists.balabit.hu

(no subject)
by R.Naveen Naidu 08 Sep '18

08 Sep '18

Hi, I need a help to choose the syslog-ng package for Linux. What are the things need to consider when choosing the latest syslog-ng to Linux? Actually, I wanted to cross-compile the syslog-ng and load into the customized Linux version *4.1.35rt41* The current latest syslog-ng version is* 3.17.2* from below site and planning to use this. https://github.com/balabit/syslog-ng/releases -- Thanks & Regards Naveen

3 8

problems compiling 3.17.2 on Ubuntu 16.0.4 with java
by Russell Fulton 04 Sep '18

04 Sep '18

I am trying to build syslog-ng with java and json support on Ubuntu 16.0.4. I can’t use prepackaged version because ubuntu have decided that one must not have both rsyslog (which is our corporate standard) and syslog-ng (which I need for its pattern matching in an application) on the same machine. Installing one package removes the other. As well as the standard build tools I have installed these packages via apt: jsoncpp, jre and gradle. Simply running ./configure ran through but did not find java (i.e. java and java-module were both set to no). I added —enable java and configure terminated complaining that it could not find java. I dug into the configure script and found that it was executing “which javac” and “javah” both of which failed. I changed JAVAC to “java” and the configure script then completed with both java and java module enabled. Running make then failed builder@secgendev02:~/src/syslog-ng-3.17.2$ make mkdir -p modules/java/syslog-ng-core/classes GEN modules/java/syslog-ng-core/classes/org/syslog_ng/LogMessage.class Unrecognized option: -d Error: Could not create the Java Virtual Machine. Error: A fatal exception has occurred. Program will exit. Makefile:20740: recipe for target 'modules/java/syslog-ng-core/classes/org/syslog_ng/LogMessage.class’ failed I am guessing that the version of java the jre package installed is not compatible with the configure script. builder@secgendev02:~/src/syslog-ng-3.17.2$ java -version openjdk version "1.8.0_181" OpenJDK Runtime Environment (build 1.8.0_181-8u181-b13-0ubuntu0.16.04.1-b13) OpenJDK 64-Bit Server VM (build 25.181-b13, mixed mode) I know that configure checks the java version so I am somewhat surprised… Any Ideas on what to try next? Russell

2 1

Running into http module error.
by vijay amruth 30 Aug '18

30 Aug '18

Hello everyone, Running into this error: [root@xxxxxxxx ~]# syslog-ng -e [2018-08-29T10:53:16.602437] Plugin module not found in 'module-path'; module-path='/usr/local/lib/syslog-ng', module='http' Where do I get this module or how do I fix this, any help is apprciated? -- Thanks, Vijay Amrut.

3 2

How to rewrite structured data - XML, Windows Events and format-json
by Jim Hendrick 28 Aug '18

28 Aug '18

I am struggling with a configuration to rewrite specific sections of a Windows Event log message and then send them along to splunk (I think json is probably the easiest for splunk to ingest). Many windows events contain extraneous text (e.g. "This event.....") that I would like to remove. I have been able to rewrite it using a regex "This event.*</Message>" and replacing that with "DEADBEEF</Message>" The problem is that I can only see this in a test file destination and not in one that uses format-json (I set this up from the syslog-ng WEF configuration guide) Has anyone done anything like this? I think my problem is that I don't understand how the message is changed from it's arrival through processing. My test can rewrite it within MSG or MESSAGE - but when I try to use the rewrite() in the log statement using the format-json destination, nothing seems to be changed. Tips? Thanks! Jim

2 1

Connect syslog-ng to HDFS
by Lee Keng Ket 27 Aug '18

27 Aug '18

Hi, I'm trying to connect syslog-ng 3.14.1 to HDFS to store the syslog messages. The syslog-ng can start without error, and it's able to write into local file. However, the log is not written to the HDFS. As there is no single error, I'm not sure how I should troubleshoot on this. I have installed the syslog-ng from this repo, https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng314/repo/epel-7/cza… Installed Packages syslog-ng.x86_64 3.14.1-4.el7.centos @czanik-syslog-ng314 syslog-ng-java.x86_64 3.14.1-4.el7.centos @czanik-syslog-ng314 syslog-ng-java-deps.noarch 1.0-2 @czanik-syslog-ng314 This is the message from /var/log/message: Log statistics; processed='src.internal(s_sys#0)=1', stamp='src.internal(s_sys#0)=1534491834', processed='destination(d_spol)=0', processed='destination(d_mlal)=0', processed='center(received)=2', processed='destination(d_mesg)=1', processed='destination(d_mail)=0', processed='destination(d_auth)=0', processed='destination(d_cron)=0', processed='destination(d_hdfs)=1', processed='center(queued)=3', queued='global(scratch_buffers_count)=0', processed='source(remote_log)=1', dropped='dst.java(d_hdfs#0,java_dst,hdfs,hdfs://x.x.x.x:25000,/user/syslog/$HOST-$DAY-$MONTH-$YEAR.log)=0', processed='dst.java(d_hdfs#0,java_dst,hdfs,hdfs://x.x.x.x:25000,/user/syslog/$HOST-$DAY-$MONTH-$YEAR.log)=1', queued='dst.java(d_hdfs#0,java_dst,hdfs,hdfs://x.x.x.x:25000,/user/syslog/$HOST-$DAY-$MONTH-$YEAR.log)=1', processed='global(payload_reallocs)=0', processed='src.journald(journal)=0', stamp='src.journald(journal)=0', processed='global(sdata_updates)=0', queued='global(scratch_buffers_bytes)=0', processed='destination(d_boot)=0', processed='destination(d_kern)=0', processed='source(s_sys)=1', processed='destination(remote)=1', processed='global(internal_queue_length)=0', processed='global(msg_clones)=0' Anyone has any idea how should I proceed the troubleshooting?

6 20

Problem with syslog-ng OpenSource and SELinux
by QUINONERO Paul (AREVA) 24 Aug '18

24 Aug '18

Hello everyone, I have an issue with syslog-ng on a Centos7 server. I configure a destination to use a python script for parsing my message, but, due to SELinux enforced mode the script is not called. Do you know any solution to fix this problem (I need to keep SELinux enforced)? Thanks in advance

3 3

Insider 2018-08: 3.16 & 3.17; Splunk; IoT security; Telegram; Throttling;
by Czanik, Péter 23 Aug '18

23 Aug '18

Dear syslog-ng users, This is the 68th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS syslog-ng 3.16 & 3.17 are released ---------------------------------- Version 3.16 & 3.17 of syslog-ng are now available. Support to send log messages to Telegram was added. You can also use failback mode when you have failover enabled and send your logs to your primary log server as soon as it is available again. For a complete list of changes, check https://github.com/balabit/syslog-ng/releases/. For binary packages, check https://syslog-ng.com/3rd-party-binaries. Using the syslog-ng Store Box (SSB) in front of Splunk ------------------------------------------------------ The syslog-ng application was used for many years as a log collection layer in front of Splunk. But why use a full-blown log management appliance – like SSB – with a graphical user interface instead of a simple command line application? I learned the answers at Red Hat Summit while talking to my fellow Balabit engineers and booth visitors. https://www.syslog-ng.com/community/b/blog/posts/using-syslog-ng-store-box-… IoT security: logging --------------------- Recently SANS published a brand new white paper about the Internet of Things: “Stopping IoT-based Attacks on Enterprise Networks”. IoT devices have been around in the networks of enterprises for many years, just think about network-connected printers. But recently, both the number and variety of these devices skyrocketed and enterprises now have to embrace everything from BYOD phones to smart lamps. In this blog post, I would like to highlight a critical aspect of how you can protect your organization from potential IoT-based attacks: logging. https://www.syslog-ng.com/community/b/blog/posts/iot-security-logging Telegram destination in syslog-ng --------------------------------- Getting started with the Telegram destination of syslog-ng is not an easy and straightforward process, but it is well worth the efforts. If you do not know Telegram yet, Telegram is a cloud-based messaging application known for its security and speed. Best of all, it is a free app without ads. No wonder that Telegram is also used by many system administrators. With the Telegram destination of syslog-ng introduced in version 3.16, we intend to help your work as a sysadmin. As a result, you can now receive critical log messages in real-time on your mobile or desktop Telegram client. https://www.syslog-ng.com/community/b/blog/posts/telegram-destination-syslo… hook-commands: easy driver setup -------------------------------- The hook-commands() option of syslog-ng makes it easy to execute external commands when a driver is started or stopped. For example, you can open a port in the firewall when a network source is started and close it once syslog-ng is shut down. Or you could also run a command each time syslog-ng is reloaded. From this blog, you can learn how to start and stop auditing file system changes using auditctl from syslog-ng, then collect, parse and filter the results, and finally send them to Elasticsearch for storage and further analysis. https://www.syslog-ng.com/community/b/blog/posts/hook-commands-easy-driver-… Throttling log messages ----------------------- One of the main advantages of syslog-ng is that it is high performance and low on resource usage. Why throttle the messages then? There are three main reasons – licensing, performance, and bandwidth – all outside of syslog-ng. From this blog, you can learn how to identify use cases for the throttling of log messages, read about a possible drawback, and finally get a sample configuration. https://www.syslog-ng.com/community/b/blog/posts/throttling-log-messages Your feedback and news, or tips about the next issue are welcome at documentation(a)balabit.com. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng with multiple destinations
by swald.ext＠orange.com 22 Aug '18

22 Aug '18

Hello, We are a syslog-ng configuration with multiple destinations : source s_remote_udp { udp(ip(0.0.0.0) port(514)); }; source s_remote_tcp { tcp(ip(0.0.0.0) port(514) max-connections(1000) so_keepalive(yes)); }; destination d_SIEM_ { udp("10.0.1.145" port(514)); }; destination d_BOX_ { file("/var/log/box/FLOW_$R_MONTH$R_DAY$R_HOUR$R_MIN.log" create_dirs(yes) dir_perm(0755) dir_owner(root) dir_group(root) owner(root) group(root)); }; filter f_SIEM_ { match("FLOW:"); }; log { source(s_remote_udp); source(s_remote_tcp); filter(f_SIEM_); destination(d_BOX_); destination(d_SIEM_);flags(flow-control,final); }; We can see kind of errors : /var/log/syslog-ng.log : Aug 4 23:34:39 host1 syslog-ng[16290]: I/O error occurred while reading; fd='32', error='Connection reset by peer (104)' We lose some logs. We have a syslog-ng version 3.2. Can you help please please ? How can I diagnose the problem? How do I get to the root of the problem? Maybe debugging syslog-ng? Thanks in advance. Best regards. Sebastian. _________________________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

2 3

Hosts before DNS
by Oleg 22 Aug '18

22 Aug '18

I am using the latest version of ose ng, and have an issue I am trying to resolve. We have hosts that resolve to multiple names via round robin dns. So ng is capturing logs from all of those, depending on how it was resolved during during the connection. For those types of hosts, I would like to configure ng to use hosts first, and fall back to dns resolution. Tried different combinations of configs, but it does not work this way. It either uses the hosts, or it does dns lookup. Thanks in advance for any tips on resolving this. Example: 10.0.0.1 resolve to www, app1, ftp I want to call it webserver in /etc/hosts, and if the entry matches, ng would just use that name. right now it creates 3 separate log files for the same host based on the name it's able to resolve at lookup.

4 3

Re: [syslog-ng] multi-line logs and program/facility filters
by Michael Thénault 14 Aug '18

14 Aug '18

Ok, well that cannot be a solution for us because of different reasons: performance (embedded environment), probability to add bugs ... I guess we'll have to go reconsider keeping syslogd which doesn't have this issue. Regards, Michael

4 5

documentation for snmp destination driver
by Armando Mártires 14 Aug '18

14 Aug '18

Hello everyone, I'm trying to forward some log messages through SNMP with syslog-ng 3.16 buy I can't seem to find the documentation for the snmp() driver, can anyone help me with this? Thank you, Armando Mártires

2 1

found a release-critical bug, 3.17.2
by Laszlo Budai 10 Aug '18

10 Aug '18

Hi, we are in the middle of an investigation of a partial-write issue and found a bug that can lead to message loss in some circumstances, even when reliable diskbuffer is used. We marked this bug as release critical. Fortunately we fixed the issue a few minutes ago, so we are going to release 3.17.2 that contains the fix ( https://github.com/balabit/syslog-ng/pull/2224 ). We don't have an automated testcase for this, actually it is in progress(this is why we didn't catch the bug), but sharing the manual reproduction: * listen with netcat (and use pv tool to make partial write happen) nc -l 61002 | pv -L 40 * run syslog-ng with the following config: @version: 3.17 options { time_reopen(3); stats_level(1); }; source s_network { network(ip("127.0.0.1") port(5555)); }; destination d_network { network("127.0.0.1" disk_buffer(mem-buf-size(1000) disk-buf-size(1048576) reliable(yes) dir('/tmp/dq')) ip_protocol(4) port(6666) so-sndbuf(4096)); }; log { source(s_network); destination(d_network); flags(flow-control); }; * send logs loggen -r 100000 -I 200 127.0.0.1 10001 --inet * wait a few seconds then stop netcat * result: syslog-ng will drops all the incoming messages regards, Laszlo Budai

1 1

multi-line logs and program/facility filters
by Michael Thénault 10 Aug '18

10 Aug '18

Hello, I have an Issue with syslog-ng 3.16.1 and multi-line logs. I try to configure per-application filters using either the program name or a facility. The applications use the traditional syslog() from syslog.h. When an application logs multiple lines, only the first line is filtered. Indeed, the program name or facility is only applied to the first line. Example : $ logger -t testprog "line1 line2 line3" $ cat /var/log/messages 2018-08-10T16:26:14.000000+02:00 testprog: line1 2018-08-10T16:26:14.899505+02:00 line2 2018-08-10T16:26:14.899505+02:00 line3 The log source is unix-stream("/dev/log" ); What can I do to fix this ? Thanks in advance for your help. Thanks & Regards, Michael

2 1

unofficial packages for syslog-ng (Debian/Ubuntu)
by Laszlo Budai 10 Aug '18

10 Aug '18

Hi, syslog-ng 3.17.1[1] packages are available in OBS repo[2]. List of supported OSs: * Debian 8.0 * Debian 9.0 * Ubuntu 14.04 * Ubuntu 16.04 * Ubuntu 16.10 * Ubuntu 17.04 * Ubuntu 17.10 * Ubuntu 18.04 In case of Debian 9.0, armv7l architecture also supported, so you can install it to your Raspberry Pi. Install ------- example: Debian 9.0 1. get release key wget -qO - http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… | sudo apt-key add - 2. add repo to APT sources eg.: /etc/apt/sources.list.d/syslog-ng-obs.list deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… ./ Then `apt-get update` and `apt-get install syslog-ng-core` Links -------- [1] https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.17.1 [2] https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-… regards, Laszlo Budai

5 5

OSE 3.17.1
by Laszlo Budai 09 Aug '18

09 Aug '18

3.17.1 Features * Client side failback mode (#2183<https://github.com/balabit/syslog-ng/pull/2183>) * New linux-audit() source as SCL (#2186<https://github.com/balabit/syslog-ng/pull/2186>) * Decorating generated configuration (#2218<https://github.com/balabit/syslog-ng/pull/2218>) * Introduce ewmm() source (#2199<https://github.com/balabit/syslog-ng/pull/2199>, #2209<https://github.com/balabit/syslog-ng/pull/2209>) * Add parsing of Cisco unified call manager (#2134<https://github.com/balabit/syslog-ng/pull/2134>) * Mandatory parameters for cfg-block (SCL) (#2088<https://github.com/balabit/syslog-ng/pull/2088>) Bugfixes * dqtool cat print backlog items (#2213<https://github.com/balabit/syslog-ng/pull/2213>) * Rewind backlog in case of stateless LogProtoClient (#2214<https://github.com/balabit/syslog-ng/pull/2214>) * Filter out incorrectly parsed sudo logs (#2208<https://github.com/balabit/syslog-ng/pull/2208>) * Minor fixes related to client-lib-dir, loggen and eventlog (#2204<https://github.com/balabit/syslog-ng/pull/2204>) * Minor stats-query fixes and refactor (#2193<https://github.com/balabit/syslog-ng/pull/2193>) * Reliable disk buffer non-empty backlog (#2192<https://github.com/balabit/syslog-ng/pull/2192>) * Fix pip package versions on older distro releases (dbld) (#2188<https://github.com/balabit/syslog-ng/pull/2188>) * Fix a groupset/groupunset and map-value-pairs() crash (#2184<https://github.com/balabit/syslog-ng/pull/2184>) * Make g_atomic_counter_set() atomic and update minimum glib version to 2.26 (#2182<https://github.com/balabit/syslog-ng/pull/2182>) * Aligning java related SCLs with mandatory parameters (#2160<https://github.com/balabit/syslog-ng/pull/2160>) * Loggen minor fixes (#2150<https://github.com/balabit/syslog-ng/pull/2150>) * grab-logging should be installed as a header (#2151<https://github.com/balabit/syslog-ng/pull/2151>) * Fix possible underflow of memory_usage (afsql, logqueue-fifo) (#2140<https://github.com/balabit/syslog-ng/pull/2140>) * Fix SELinux module version inconsistency (#2133<https://github.com/balabit/syslog-ng/pull/2133>) * Fix CMake unit test compilation (no-pie) (#2137<https://github.com/balabit/syslog-ng/pull/2137>) * Fix possible crash in syslog-parser() (#2128<https://github.com/balabit/syslog-ng/pull/2128>) * Disable ack for mark mode (#2129<https://github.com/balabit/syslog-ng/pull/2129>) * Fixing a Telegram destination bug with bot id (#2142<https://github.com/balabit/syslog-ng/pull/2142>) * All drivers should support inner destination or source plugins (#2143<https://github.com/balabit/syslog-ng/pull/2143>) * Fix default file and directory creation ownership (#2119<https://github.com/balabit/syslog-ng/pull/2119>) * Fix global "center;;received" counter when systemd-journal() is used (#2121<https://github.com/balabit/syslog-ng/pull/2121>) * Link everything to libsecret-storage (#2100<https://github.com/balabit/syslog-ng/pull/2100>) * Inform about the right dns-cache() configuration (warning message typo) (#2145<https://github.com/balabit/syslog-ng/pull/2145>) * Adjusting window size for internal mark mode (#2146<https://github.com/balabit/syslog-ng/pull/2146>) * Fix memory leaks in disk-buffer() (#2153<https://github.com/balabit/syslog-ng/pull/2153>) * Fix undefined behavior in log multiplexer (#2154<https://github.com/balabit/syslog-ng/pull/2154>) * Fix static linking mode (autotools) (#2155<https://github.com/balabit/syslog-ng/pull/2155>) * Fix internal mark mode infinite loop with old ivykis (#2157<https://github.com/balabit/syslog-ng/pull/2157>) * Fix missing normalize flags (#2162<https://github.com/balabit/syslog-ng/pull/2162>) * Keep JVM running on reload if once configured (#2164<https://github.com/balabit/syslog-ng/pull/2164>, #2211<https://github.com/balabit/syslog-ng/pull/2211>) * Fix a race condition (suspend) in LogSource (#2167<https://github.com/balabit/syslog-ng/pull/2167>) * Add @requires json-plugin to the cim() parser (#2181<https://github.com/balabit/syslog-ng/pull/2181>) * Added exclude_kmsg option to system source (#2166<https://github.com/balabit/syslog-ng/pull/2166>) * Fix padding template function (#2174<https://github.com/balabit/syslog-ng/pull/2174>) * Leak & invalid memory access (#2173<https://github.com/balabit/syslog-ng/pull/2173>) * FreeBSD 11.2 builderror SOCK_STREAM (#2170<https://github.com/balabit/syslog-ng/pull/2170>) * Add ref-counted TLSVerifier struct (use after free fix) (#2168<https://github.com/balabit/syslog-ng/pull/2168>) Other changes * Improve loggen's file message parser (#2205<https://github.com/balabit/syslog-ng/pull/2205>) * syslog-ng-debun improvements (#2201<https://github.com/balabit/syslog-ng/pull/2201>) * Goodbye "goto relex" (refactor) (#2198<https://github.com/balabit/syslog-ng/pull/2198>) * Refactor the callback registration mechanism of WildcardFileReader (#2185<https://github.com/balabit/syslog-ng/pull/2185>) * Extended Linux capabilities detection (pkg-config) (#2169<https://github.com/balabit/syslog-ng/pull/2169>) * Add atomic gssize (#2159<https://github.com/balabit/syslog-ng/pull/2159>) * Lower the message level of @requires to debug (#2147<https://github.com/balabit/syslog-ng/pull/2147>) * macOS warning elimination (#2139<https://github.com/balabit/syslog-ng/pull/2139>) * Remove a misleading rewrite-related debug message (#2132<https://github.com/balabit/syslog-ng/pull/2132>) * Minor updates to SELinux policy installer script (#2127<https://github.com/balabit/syslog-ng/pull/2127>) * More robust GLib detection (CMake) (#2125<https://github.com/balabit/syslog-ng/pull/2125>) * Logthreaded nonfunctional changes (#2123<https://github.com/balabit/syslog-ng/pull/2123>) * Confgen and pragma improvements (#2122<https://github.com/balabit/syslog-ng/pull/2122>) * Flush before stopping syslog-ng (functional tests) (#2216<https://github.com/balabit/syslog-ng/pull/2216>) * Port unit tests into criterion (test_filters_netmask6, test_findeom, csv_parser, patternDB) (#2217<https://github.com/balabit/syslog-ng/pull/2217>, #2175<https://github.com/balabit/syslog-ng/pull/2175>, #2118<https://github.com/balabit/syslog-ng/pull/2118>) * Libtest refactors (#2149<https://github.com/balabit/syslog-ng/pull/2149>) * Add missing files to the source tarball (#2114<https://github.com/balabit/syslog-ng/pull/2114>) * Better python binary detection (#2092<https://github.com/balabit/syslog-ng/pull/2092>) Notes to the developers * LogThreadedDestDriver batching (#2063<https://github.com/balabit/syslog-ng/pull/2063>) * Add sqlite3 and riemann to dbld devshell (#2210<https://github.com/balabit/syslog-ng/pull/2210>) * Make mock-transport inheritable (#2120<https://github.com/balabit/syslog-ng/pull/2120>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Antal Nemes, Balazs Scheidler, Bernie Harris, Bertrand Jacquin, Gabor Nagy, Gergely Nagy, German Service Network, Janos SZIGETVARI, Laszlo Budai, Laszlo Szemere, László Várady, Norbert Takacs, Peter Czanik, Peter Kokai, Szigetvari Janos, Terez Nemes, Viktor Juhasz. https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.17.1 [https://avatars1.githubusercontent.com/u/986981?s=400&v=4]<https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.17.1> balabit/syslog-ng<https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.17.1> syslog-ng is an enhanced log daemon, supporting a wide range of input and output methods: syslog, unstructured text, queueing, SQL & NoSQL. github.com regards, Laszlo Budai

1 0

syslog-ng-3.13.2 compilation issue
by R.Naveen Naidu 07 Aug '18

07 Aug '18

Hi, I am trying to cross compile "syslog-ng-3.13.2" with my Linux and getting below message. Do I need to include the PCRE libs to my syslog-ng Makefile where I am including the syslog-ng. Please suggest me how to avoid this error. *Logs:* checking for inotify_init... yes checking for TCP wrapper library... -lwrap checking whether to enable TCP wrapper support... yes checking for dlsym in -ldl... yes checking for LIBDBI... no checking for dbi_initialize_r in -ldbi... no checking whether to enable SQL support... no checking for GLIB... yes checking for g_mapped_file_unref... yes checking for g_list_copy_deep... no checking sanity checking Glib headers... yes checking for GEOIP... no checking for MAXMINDDB... checking for MMDB_open in -lmaxminddb... no checking for PCRE... no configure: error: Cannot find pcre version >= 6.1 it is a hard dependency from syslog-ng 3.6 onwards make[11]: *** [syslog-ng-3.13.2/config.status] Error 1 -- Thanks & Regards Naveen

3 2

Syslog-ng and RSA Archer
by Carter, Jed 31 Jul '18

31 Jul '18

Hi, We are trying to configure RSA Archer to send its logs to our syslog-ng server. When the engineers push data to syslog-ng we see it in the logs but the Archer engineers say they are the three-way handshake occur so Archer stops sending data. They seem to think it's our config but I have RSA Netwitness sending logs to syslog-ng without any issues. Has anyone seen this problem before or know of a solution that I can try? Thanks, Jed The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Partners Compliance HelpLine at http://www.partners.org/complianceline . If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail.

2 1

Forcing remote syslog request from 1 IP into 1 log file
by freebsd＠tango.lu 27 Jul '18

27 Jul '18

Hello, I have a syslog server setup which works quite well for most of the hosts: destination d_net_debug { file("/var/log/$HOST/debug"); }; destination d_net_error { file("/var/log/$HOST/error"); }; This way I dont have to define every host which logs there but they will be autocreated. I have a quite misbehaving Asus router device however which keep sending strings like: FTP WAN(11) WAN(8) WAN(3) as host therefore syslog-ng interpret these messages like it would be coming from different $HOSTs and keep creating directories for them. 2018-07-22T20:45:59+02:00 WAN Connection: Wan link down. 2018-07-24T16:12:20+02:00 WAN Connection: Wan link down. 2018-07-22T20:45:59+02:00 WAN Connection: Wan link down. 2018-07-24T16:12:20+02:00 WAN Connection: Wan link down. How do I force all the logs into one logfile for this one specific host? If possible I don't want to change my current rules just extend them. Thank you.

4 3

Asynchronous address resolution using getaddrinfo_a()
by Naveen Revanna 26 Jul '18

26 Jul '18

Hi Developers, When DNS server is unreachable, getaddrinfo() function will block (until it times out after few tens of seconds). If syslog-ng application is configured with a remote syslog server using its hostname, afsocket_dd_try_connect() will try to resolve this address in a loop (using a timer). Since getaddrinfo() is blocking, execution of this task will take few seconds thereby delaying the execution of other tasks. Eventually this will reach a state in which there will be lot of backlogs of tasks and syslog() appears to hang, delaying the execution of all shell commands (by upto a minute). Resolving the remote syslog server's address by having an entry in /etc/host could be a possible workaround (as indicated in a previous thread). However, this is not a desirable solution for our use case. Here is my thought on a possible fix that I am thinking to work on for which I am looking for feedback. 1. I am thinking of using getaddrinfo_a() ( http://man7.org/linux/man-pages/man3/getaddrinfo_a.3.html) in the afsocket_dd_try_connect() loop function. We can have this async call only in case it starts looping and not for the first attempt. The first attempt can continue to do the current sync way. 2. If I were to take the above approach, there are two ways in which we can know the status of address resolution. Which one do you folks think would be better: 1. SIGEV_SIGNAL: We can receive a signal when a look-up completes. We can take further action in the handler function. 2. SIGEV_THREAD: A notification function will be called. This results in creation of a new thread (pthread?). What I am not sure of is the impact of this thread creation on the existing thread infrastructure in syslog-ng through ivykis. Repro: It is fairly easy to reproduce this issue 1. Configure a remote syslog server using it's hostname. 2. Make the dns unreachable (Edit resolve.conf and put wrong IP(s) for 'nameserver' entries) 3. $ syslog-ng-ctl reload 4. Observe that any command executed on the shell takes unusually long time. I can elaborate on any of the items here if something is not clear. Appreciate any pointers. Thanks, Naveen

4 4

Help With filtering
by Rose, Ed 20 Jul '18

20 Jul '18

Hello All I have syslog-ng 3.14 and I am trying to filter DNS logs. I have this working in a very old 2.0.9 version of syslog-ng. But it does not seem to want to work in the 3.14 environment. Can anyone help me out as I am pretty new to administering syslog-ng. Thanks ed Below is my code: ##New BlueCat config that doesn't work filter f_dhcpd { host(".*ddi-edns.*" flags(ignore-case)); and program("dhcpd"); }; destination d_dhcpd { file("/var/log2/gns-dmz/bluecat/${HOST}/dhcpd/log_${HOST}_dhcpd" perm(0640) group(splunk)); }; log { source(s_net); filter(f_dhcpd); destination(d_dhcpd); }; filter f_named { host(".*ddi-edns.*" flags(ignore-case)); and program("named"); }; destination d_named { file("/var/log2/gns-dmz/bluecat/${HOST}/named/log_${HOST}_named" perm(0640) group(splunk)); }; log { source(s_net); filter(f_named); destination(d_named); }; filter f_other { level(info, notice, warn, err, crit) and host(".*ddi-edns.*" flags(ignore-case)); and not program("dhcpd") and not program("named"); }; destination d_other { file("/var/log2/gns-dmz/bluecat/${HOST}/messages/log_${HOST}_messages" perm(0640) group(splunk)); }; log { source(s_net); filter(f_other); destination(d_other); }; ##Old BlueCat config that works #filter f_hsi-ddi-edns-1 { host("hsi-ddi-edns-1"); }; #filter f_ies-ddi-edns-1 { host("ies-ddi-edns-1"); }; #filter f_wv-ddi-edns-1 { host("wv-ddi-edns-1"); }; #destination d_hsi-ddi-edns-1 { file("/var/log2/gns-dmz/bluecat/hsi-ddi-edns-1/log_${HOST}"); }; #destination d_ies-ddi-edns-1 { file("/var/log2/gns-dmz/bluecat/ies-ddi-edns-1/log_${HOST}"); }; #destination d_wv-ddi-edns-1 { file("/var/log2/gns-dmz/bluecat/wv-ddi-edns-1/log_${HOST}"); }; #log { source(s_net); filter(f_hsi-ddi-edns-1); destination(d_hsi-ddi-edns-1); }; #log { source(s_net); filter(f_ies-ddi-edns-1); destination(d_ies-ddi-edns-1); }; #log { source(s_net); filter(f_wv-ddi-edns-1); destination(d_wv-ddi-edns-1); };

2 1

Fwd: Trouble configuring elasticsearch2 destination
by T4iga 13 Jul '18

13 Jul '18

I mistakenly sent this to Szemere, László only. Hi, it seems I am almost there. if I run syslog-ng -Fdv (in the foreground) it executes without issue. If I try to run it by doing systemctl start syslog-ng or systemctl restart syslog-ng It crashes immediately: # systemctl start syslog-ng # systemctl status syslog-ng ● syslog-ng.service - System Logging Service Loaded: loaded (/usr/lib/systemd/system/syslog-ng.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Mon 2018-07-09 11:05:04 CEST; 6s ago Process: 3991 ExecStart=/usr/sbin/syslog-ng -F $SYSLOG_NG_PARAMS (code=exited, status=1/FAILURE) Process: 3987 ExecStartPre=/usr/sbin/syslog-ng-service-prepare (code=exited, status=0/SUCCESS) Main PID: 3991 (code=exited, status=1/FAILURE) Jul 09 11:05:04 syslog-test systemd[1]: Starting System Logging Service... Jul 09 11:05:04 syslog-test systemd[1]: Started System Logging Service. Jul 09 11:05:04 syslog-test systemd[1]: syslog-ng.service: Main process exited, code=exited, status=1/FAILURE Jul 09 11:05:04 syslog-test systemd[1]: syslog-ng.service: Unit entered failed state. Jul 09 11:05:04 syslog-test systemd[1]: syslog-ng.service: Failed with result 'exit-code'. Other info: # syslog-ng --version syslog-ng 3 (3.16.1) Config version: 3.16 Installer-Version: 3.16.1 Revision: Module-Directory: /usr/lib64/syslog-ng Module-Path: /usr/lib64/syslog-ng Available-Modules: add-contextual-data,affile,afmongodb,afprog,afsocket, afstomp,afuser,appmodel,basicfuncs,cef,confgen,cryptofuncs,csvparser,date, dbparser,disk-buffer,graphite,hook-commands,json-plugin, kvformat,linux-kmsg-format,map-value-pairs,pseudofile, sdjournal,snmptrapd-parser,stardate,syslogformat,system- source,tags-parser,tfgetent,xml,mod-java Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: on Enable-Systemd: on OpenSuse 42.3 Configuration: ############### Globale Optionen ############### @version:3.16.1 @module mod-java # Elasticsearch .jar-libraries are located in /opt/syslog-ng/lib/syslog-ng/java-modules/ @include "scl.conf" options { chain_hostnames(off); # Standard flush_lines(0); # Standard perm(0640); # Standard stats_freq(3600); # Standard threaded(yes); # Standard create-dirs(yes); # erlaubt Syslog-NG, falls noetig, neue Verzeichnisse anzulegen dir-owner(root); # die neuen Verzeichnisse gehoeren root dir-perm(0640); # entspricht -rw-r-----, Besitzer: Lesen, Schreiben; Gruppe: Lesen; Alle: Nichts file-template(t_myLoggingFormat); # legt Standart-Template fuer file Destinations fest # threaded(yes); # Example config Elasticsearch2 # use-uniqid(yes); # Example config Elasticsearch2 }; ############### Sources - Quellen ############### # Fuer interne Nachrichten source s_myInternalSource { system(); # von Betriebssystem und aehnlichem internal(); # Syslog-interne Nachrichten }; # Fuer Netzwerk-Nachrichten source s_myNetworkSource { }; ############### Templates - Vorlagen ############### # Aufbau des Nachrichteninhalts fuer Dateiziele template t_myLoggingFormat { template("$(padding ${FULLHOST} 15 ' ')|${ISODATE}|PRI:$(padding ${PRI} 3 ' ')|${MSGHDR} ${MSG}\n"); }; # Legacy-Nachrichten werden anders geparst # Mit Standardtempalte wir die Originalnachricht vollständig in MSG eingefügt # Fuer Nachrichtenpfad # Dateiname ist Tag(Nummer innerhalb des Monats)-Kuerzel(Mon, Tue, Wen, Thu, Fri, Sat, Sun) # zum Beispiel "127.0.0.1/2018/Jan/17-Sat" template t_destination { template("${FULLHOST}/${YEAR}/${YEAR}-${MONTH_ABBREV}-${DAY}.log"); }; ############### Filter ############### # Ein Filter je Quelle # Filter kann man so machen: # filter <filter-id> # {"<macro-or-template>" operator "<value-or-macro-or-template>"}; # oder mit Functions filter f_noDebug { level(emerg..info); # Schließt Debug-Nachrichten aus }; filter f_networkfilter { }; filter f_checkpoints { }; ############### Rewrite Rules ###################### rewrite r_checkpoint_remove_irrelevant { subst( '\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2} - ', '', type("pcre"), value("MESSAGE") flags("utf8" "store-matches") ); }; ############### Parser ############################# parser p_pattern_db { db-parser( file("/opt/syslog-ng/etc/patterndb.xml") ); }; ############### Ziele - Destinations ############### # Ein Ziel fuer jede IP-Adresse, Jahr, Monat, Tag, etc destination d_myDestination { file("/var/log/syslog-ng/$FULLHOST/$YEAR/$YEAR-$MONTH-$DAY.log" create_dirs(yes) ); }; destination d_testination { file("/var/log/syslog-ng/test/$FULLHOST/$YEAR/$YEAR-$MONTH-$DAY.log" create_dirs(yes) ); }; destination d_elasticsearch { elasticsearch2( cluster("syslog-ng") cluster-url("http://127.0.0.1:9200") client-mode("http") # https-auth-type(basic) # http-auth-type-basic-password() # http-auth-type-basic-username() index("syslog-ng") type("test") # default template($(format-json --scope rfc5424 --exclude DATE --key ISODATE @timestamp=${ISODATE})) # template("$(format-json --scope rfc5424 --scope nv-pairs --exclude DATE --key ISODATE)") ) }; ############### Log-Pfade ############### # log { source(s_myNetworkSource); # Fuer TCP und UDP Nachrichten von allen Clients source(s_myInternalSource); # interne Nachrichten filter(f_networkfilter); filter(f_noDebug); # alle außer debug destination(d_myDestination); # universal Ziel; siehe Template }; # log { ###### Checkpoints ####### source(s_myNetworkSource); filter(f_checkpoints); # Nur Checkpoint-Non-Standard filter(f_noDebug); rewrite(r_checkpoint_remove_irrelevant); destination(d_myDestination); }; # log { ###### Elasticsearch ###### source(s_myNetworkSource); source(s_myInternalSource); parser(p_pattern_db); destination(d_elasticsearch); flags(flow-control); }; # #log { # for testing purposes # source(s_myNetworkSource); # source { syslog( ip( 0.0.0.0) transport("udp") flags(syslog-protocol); }; # destination(d_testination); #}; ############################## ENDE ############################## If ran in the foreground this config logs message to disk and the elastic cluster receives the messages too. I would also happily read what the difference is between starting the service and starting syslog-ng directly. It (syslog-ng) appears to not be starting the service itself as systemctl status syslog-ng indicates. Thank you for all the help so far. I am very greatful and could not have come anywhere near this point without your help. %%%%%%%%%%%%%%%%% NEW: %%%%%%%%%%%%%%%%%%% I am also working on the patterndb configuration. Starting syslog-ng no longer yields any configuration errors but it still rejects the file: # syslog-ng log4j:ERROR Could not read configuration file [null]. java.lang.NullPointerException at java.io.FileInputStream.<init>(FileInputStream.java:130) at java.io.FileInputStream.<init>(FileInputStream.java:93) at org.apache.log4j.PropertyConfigurator.doConfigure(PropertyConfigurator.java:372) at org.apache.log4j.PropertyConfigurator.configure(PropertyConfigurator.java:403) at org.syslog_ng.elasticsearch_v2.client.http.ESHttpClient.<clinit>(ESHttpClient.java:67) at org.syslog_ng.elasticsearch_v2.client.ESClientFactory.getESClient(ESClientFactory.java:43) at org.syslog_ng.elasticsearch_v2.ElasticSearchDestination.init(ElasticSearchDestination.java:57) at org.syslog_ng.LogPipe.initProxy(LogPipe.java:64) log4j:ERROR Ignoring configuration file [null]. [main] INFO io.searchbox.client.AbstractJestClient - Setting server pool to a list of 1 servers: [http://127.0.0.1:9200] [main] INFO io.searchbox.client.JestClientFactory - Using multi thread/connection supporting pooling connection manager [main] INFO io.searchbox.client.JestClientFactory - Using default GSON instance [main] INFO io.searchbox.client.JestClientFactory - Node Discovery disabled... [main] INFO io.searchbox.client.JestClientFactory - Idle connection reaping disabled... My full configuration is the following. I have excluded the examples because the feature realtively sensitive information. If one is absolutely necessary I can provide it in modified form. I fixed all the remarks the of syntax errors syslog-ng threw on startup until nom remained but it still fails to load the config as of the message above. <?xml version='1.0' encoding='UTF-8'?> <patterndb version='3' pub_date='2018-07-10'> <ruleset name='juniper'> <description> This ruleset covers the Messages sent by Juniper - PulseSecure. </description> <url>https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB40143 </url> <pattern>PulseSecure</pattern> <rules> <rule provider="Niklas Deffner" id="1" class="Firewall"> <patterns> <pattern>psa@NUMBER:fw.id@ - [@IPv4:client.ip@] @ESTRING:client.hostname:()@@QSTRING:exchange.name:[:]@ - WebRequest ok : Host: @ESTRING:exchange.hostname:,@ Request: /Microsoft-Server-ActiveSync?User=@ESTRING:client.hostname:&@DeviceId =@ESTRING:client.id:&@DeviceType=@ESTRING:client.type:&@Cmd=@STRING@ @ANYSTRING@</pattern> </patterns> <examples> <example> </example> </examples> <values> </values> <tags> <tag>WebRequest ok</tag> </tags> </rule> <rule provider="Niklas Deffner" id="2" class="Firewall"> <patterns> <pattern>psa@NUMBER:fw.id@ - [@IPv4:client.ip@] @ESTRING:client.hostname:()@@QSTRING:exchange.name:[:]@ - WebRequest completed, POST to https://@ESTRING:exchange.hostname::@443 //Microsoft-Server-ActiveSync?User=@ESTRING:client.hostname.url:&@DeviceId =@ESTRING:client.id:&@DeviceType=@ESTRING:client.type:&@Cmd =@STRING:client.command@ from @IPv4:exchange.ip@ result=@NUMBER:result@ sent=@NUMBER:sent@ received=@NUMBER:received@ in @NUMBER:time@ seconds@ANYSTRING@</pattern> </patterns> <examples> <example> </example> </examples> <values> </values> <tags> <tag>WebRequest completed</tag> </tags> </rule> <rule provider="Niklas Deffner" id="3" class="Firewall"> <patterns> <pattern>psa@NUMBER:fw.id@ - [@IPv4:client.ip@] @ESTRING:client.name:()@@QSTRING:exchange.name:[:]@ - WebRequest ok : Host: @ESTRING:exchange.hostname:,@ Request: /Microsoft-Server-ActiveSync?Cmd=@ESTRING:client.command:&@User =@ESTRING:client.hostname.url:&@DeviceId=@ESTRING:client.id: &@DeviceType=@STRING:client.type@@ANYSTRING@</pattern> </patterns> <examples> <example> </example> </examples> <values> </values> <tags> <tag>WebRequest ok</tag> <tag> </tag> </tags> </rule> <rule provider="Niklas Deffner" id="4" class="Firewall"> <patterns> <pattern>psa@NUMBER:fw.id@ - [@IPv4:client.ip@] @ESTRING:client.name:()@@QSTRING:exchange.name:[:]@ - WebRequest completed, POST to https://@ESTRING:exchange.hostname::@443 //Microsoft-Server-ActiveSync?Cmd=@ESTRING:client.command:&@User =@ESTRING:client.hostname.url:&@DeviceId=@ESTRING:client.id: &@DeviceType=@STRING:client.type@ from @IPv4:exchange.ip@ result=@NUMBER:result@ received=@NUMBER:received@ sent=@NUMBER:sent@ in @STRING:time@ @ANYSTRING@</pattern> </patterns> <examples> <example> </example> </examples> <values> </values> <tags> <tag>WebRequest completed</tag> <tag> </tag> </tags> </rule> </rules> </ruleset> </patterndb> Sincerely, Niklas Deffner 2018-07-06 8:42 GMT+02:00 T4iga <niklastai97(a)gmail.com>: > Hi, > > Thank you for finding that bug and creating the pull request. > Will that be integrated into https://build.opensuse.org/pro > ject/show/home:czanik:syslog-ng316 too? > I have edited the aforementioned passage and removed the third argument > and it is working again > > Sincerely > Niklas Deffner > > > 2018-07-05 15:20 GMT+02:00 Szemere, László <laszlo.szemere(a)balabit.com>: > >> Hello, >> I successfully reproduced the crash with your configuration. The problem >> was in the *padding* template function, and has nothing to do with the >> earlier java problems. >> If you intended to use the default (space) character for padding, you >> don't have to provide the third argument to the function. (Or provide the >> space character explicitly: *'' -> ' '*) >> >> The problem exist, because in the padding function we divide with the >> length of the provided padding string >> >> https://github.com/balabit/syslog-ng/blob/aa88bba2a9158fb6401bc260e0a58d778… >> >> >> I will create a pull request to correct it. >> >> Br, >> Laci >> >> >> >> On Thu, Jul 5, 2018 at 11:16 AM, Fabien Wernli <wernli(a)in2p3.fr> wrote: >> >>> On Thu, Jul 05, 2018 at 11:05:21AM +0200, T4iga wrote: >>> > Hi Fabien Wernli, >>> > >>> > it says >>> > sysctl kernel.core_pattern >>> > kernel.core_pattern = |/usr/lib/systemd/systemd-coredump %P %u %g %s >>> %t %c >>> > %e >>> >>> Oh my... >>> >>> At least we now know who takes care of your core file! >>> Reading >>> https://www.freedesktop.org/software/systemd/man/systemd-coredump.html >>> will >>> probably help >>> >>> ____________________________________________________________ >>> __________________ >>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>> Documentation: http://www.balabit.com/support >>> /documentation/?product=syslog-ng >>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>> >>> >> >

3 6

RE syslog-ng OSE parsing
by Daniel Ehrlich 10 Jul '18

10 Jul '18

Hi, Hoping you can assist me, I haven't really come across anything that makes full sense to me in my searching of various sites/forums. This is an example log. Jun 14 11:57:27 PM.685 UTC : %UC_LOGIN-4-AuthenticationFailed: %[Login Date/Time=06/15/2018 at 09:57:27][Login IP Address/Hostname=10.25.1.16][Login Interface=cucm-uds][Login UserID=POBAR][App ID=Cisco Tomcat][Cluster ID=][Node ID=cucmsub-prd-t2]: Login Authentication failed. Syslog-ng reads the $HOST as PM.685 ; can I get it to rewrite host as cucmsub-prd-t2 ? i.e. Node ID= Thanks you Kind Regards, Daniel Ehrlich MastInfoSysSec, DipBA, SSCP, F5-CA, Splunk CA ICT Security Officer ICT Client Services|Infrastructure Services Phone: +61 7 4687 5600 Email: <mailto:Daniel.Ehrlich@usq.edu.au> Daniel.Ehrlich(a)usq.edu.au Toowoomba | Queensland | 4350 | Australia _____________________________________________________________ This email (including any attached files) is confidential and is for the intended recipient(s) only. If you received this email by mistake, please, as a courtesy, tell the sender, then delete this email. The views and opinions are the originator's and do not necessarily reflect those of the University of Southern Queensland. Although all reasonable precautions were taken to ensure that this email contained no viruses at the time it was sent we accept no liability for any losses arising from its receipt. The University of Southern Queensland is a registered provider of education with the Australian Government. (CRICOS Institution Code QLD 00244B / NSW 02225M, TEQSA PRV12081 )

3 8

Re: [syslog-ng] Trouble configuring elasticsearch2 destination
by Fabien Wernli 05 Jul '18

05 Jul '18

In order to put aside any systemd complexities, let's try to run syslog-ng in the foreground: export LD_LIBRARY_PATH=/usr/lib64/jvm/java-1.8.0-openjdk-1.8.0/jre/lib/amd64/server syslog-ng -Fdv What happens then?

5 15

syslog-ng.com upgrade
by Gergely Bodnár 04 Jul '18

04 Jul '18

Dear syslog-ng users, As you are likely aware, Balabit is now part of One Identity, and on July 1, we reached a major milestone in our integration schedule: we successfully closed the migration for most of our business systems and applications. While many of these are back office related and thus invisible to our open source users and customers, the syslog-ng.com website also received a major infrastructure upgrade. While the product pages look roughly the same as the old ones, you will notice a big difference when navigating to the technical documentation. - A new look and feel, in accordance with the broader Quest support portal. - The older syslog-ng Open Source Edition documentation (prior 3.16) is available only in PDF format. - Going forward, only multi-page HTML and PDF versions will be available of the Administrator' Guide. Single page guides are no longer offered. - The Debian Jessie repository of Open Source Edition is currently down. The past couple months showed us that there is real interest from the community for official repositories, and in the future, we would like to expand on our previous offer with more operating systems supported. However, we currently do not have an exact timeline to share with you. As with all migrations of this scale, there ought to be bugs surfacing in the coming days and weeks. We kindly ask you to report them by replying to this email, and we will do our best to fix them as our time permits. I would also take the opportunity and reassure you that syslog-ng Open Source Edition is here to stay, with the level of enthusiasm from our developers and technical writers that has been the hallmark of syslog-ng OSE for more than a decade. Regards, Gergely Bodnar -- *Gergely Bodnar* | syslog-ng Product Owner gergely.bodnar(a)balabit.com follow Balabit on: web <http://go.balabit.com/F9ZZ500bh0U013LX000VAE5> | blog <http://go.balabit.com/VZZi000AL90V300U55X1cE0> | linkedin <http://go.balabit.com/CZ100j0d50LU0EAZ3X09V05>| facebook <http://go.balabit.com/I090eUZ0551kEA3X0L0ZV00> | twitter <http://go.balabit.com/c0503X1U05EZ09AVl0ZfL00> *© BalaBit Corp.* Weiser Mazars 135 West 50th Street New York, NY 10020 USA

3 4

Trouble configuring elasticsearch2 destination
by T4iga 03 Jul '18

03 Jul '18

Hello Syslog-NG community, I am trying to configure syslog-ng to send messages to Elasticsearch for me to process them in Kibana. I get an error for the @module mod-java and the elasticsearch2 destination. I am running OpenSuse 42.3. syslog-ng --version: syslog-ng 3.8.1 Installer-Version: 3.8.1 Revision: Module-Directory: /usr/lib64/syslog-ng Module-Path: /usr/lib64/syslog-ng Available-Modules: add-contextual-data,afamqp,affile,afmongodb,afprog,afsocket,afstomp,afuser,basicfuncs,cef,confgen,cryptofuncs,csvparser,date,dbparser,disk-buffer,graphite,json-plugin,kvformat,linux-kmsg-format,pseudofile,sdjournal,syslogformat,system-source Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: off I have downloaded and extracted Elasticsearch 6.3.0 and placed it in /usr/local/bin/elasticsearch-6.3.0/. In accordance to this: "Extract the Elasticsearch libraries into a temporary directory, then collect the various .jar files into a single directory (for example, /opt/elasticsearch/lib/ ) where syslog-ng OSE can access them. You must specify this directory in the syslog-ng OSE configuration file. The files are located in the lib directory and its subdirectories of the Elasticsearch release package." (quoted from Syslog-NG OSE 3.15 Admin Guide, 7.3.1. Procedure – Prerequisites, Step 3, page 175) I copied all JAR libraries inside elasticsearch-6.3.0/lib/ to the default path for syslog-ng plug-ins which is /usr/lib64/syslog-ng as stated below. Is this not what the step tells me to do? I get the following error: #[2018-07-03T11:20:39.403329] Plugin module not found in 'module-path'; module-path='/usr/lib64/syslog-ng', module='mod-java' Error parsing destination, destination plugin elasticsearch2 not found in /etc/syslog-ng/syslog-ng.conf at line 141, column 2: elasticsearch2( ^^^^^^^^^^^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng I seemt o be missing to necessary plug-ins: mod-java elasticsearch2 Where can I get these? Feel free to request any additional info I might have missed out on. Sincerely Niklas Deffner

3 5