- syslog-ng - lists.balabit.hu

What Im missing to enable the wildcard-file module?
by Eric Anderson 12 Apr '18

12 Apr '18

Im trying to use the wildcard-file module, but the syslog-ng Module: wildcard-file is missing # service syslog-ng start Error parsing source, source plugin wildcard-file not found in /etc/syslog-ng/conf.d/export-client.conf at line 4, column 29: included from /etc/syslog-ng/syslog-ng.conf line 71, column 1 source s_export_recursive { wildcard-file( ^^^^^^^^^^^^^ I upgraded to the latest syslog-ng # syslog-ng -V syslog-ng 3.9.1 Installer-Version: 3.9.1 Revision: Module-Directory: //usr/lib64/syslog-ng Module-Path: //usr/lib64/syslog-ng Available-Modules: kvformat,afprog,afsocket,basicfuncs,linux-kmsg-format,graphite,cef,curl,add-contextual-data,date,json-plugin,pseudofile,afstomp,dbparser,confgen,cryptofuncs,syslogformat,disk-buffer,afuser,afamqp,csvparser,affile,system-source Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: on Enable-Linux-Caps: on But I still don’t see where the wildcard-file is. What Im missing to enable the wildcard-file module? The conf file Ive created where I want to use it looks like this: # syslog-ng conf file for central logging CLIENT: export # # export source source s_export_recursive { wildcard-file( base-dir("/var/www/capstan/shared/log/exports/") filename-pattern("*.log") recursive(yes) follow-freq(1) flags(no-parse) log-fetch-limit(100) ); }; # export destination destination d_export_app1 { tcp(10.0.32.97 port(601)); }; # export log log { source(s_export_recursive); destination(d_export_app1); }; Eric Anderson | DevOps Engineer E: eric.anderson(a)stonecroptech.com<mailto:michaelg@stonecroptech.com> | O: 212.500.2017 | M: 650.743.4598 [cid:image001.png@01D3D1B1.4BE3C030]

2 1

in-list for message
by Garbacik, Joe 12 Apr '18

12 Apr '18

Can syslog-ng parse the message field for a partial match using the in-list function? For instance, I am querying DNS logs and want to filter out common domains (i.e. Microsoft.com, Redhat.com) In my list file I just have the domains, one per line and in my config file, if have the following: filter f_dns_noise_oklist { in-list("/etc/syslog-ng/lists.d/dns_noise.list", value("MESSAGE")); }; but it doesn’t seem to be working.

2 1

NG 6.0.9 UDP Forwarding & Spoof Source
by Schoonover, Mark E HHHH 11 Apr '18

11 Apr '18

Hello, I'm using NG to forward via UDP to QRadar platform. We've noticed that long messages get truncated to 1024 bytes. I thought it was because of forwarding using RFC3164 which has a limit of 1024 but forwarding using RFC5424 does not have a message limit. In the manual though for the spoof-source option there's this warning: When using the spoof-source option, syslog-ng PE automatically truncates long messages to 1024 bytes, regardless of the settings of log-msg-size(). Does this mean no matter what, the max UDP forwarded message spoofing the source is 1024 bytes regardless of RFC? Thanks! Regards, Mark Schoonover - KA6WKE Infrastructure Engineering Manager ENE : Tools, Instrumentation and Common Services Team Office: 32.8697° N, 116.9711° W Phone : 770-261-7934 Email : mark.schoonover(a)cigna.com<mailto:mark.schoonover@cigna.com> HPSM Team: ENE NMS Engineering Confidential, unpublished property of Cigna. Do not duplicate or distribute. Use and distribution limited solely to authorized personnel. © Copyright 2018 Cigna. ------------------------------------------------------------------------------ CONFIDENTIALITY NOTICE: If you have received this email in error, please immediately notify the sender by e-mail at the address shown. This email transmission may contain confidential information. This information is intended only for the use of the individual(s) or entity to whom it is intended even if addressed incorrectly. Please delete it from your files if you are not the intended recipient. Thank you for your compliance. Copyright (c) 2018 Cigna ==============================================================================

2 1

Problem activating: Centos7 + Syslog-ng OSE + Elasticsearch + kibana
by André Grehs 09 Apr '18

09 Apr '18

Hi group! I installed a fresh Centos 7 setup to use it in a initial log management Project. I´m made the procedures described at thw wizard https://syslog-ng.com/blog/syslog-ng-and-elasticsearch-6-getting-started-on- rhelcentos/ All is fine, but at the moment of the creation of the es.conf file of this procedure, the syslog-ng service could not start anymore. If i remove the es.conf file, the syslog-ng service start normally. Can you help me with this problem? P.S: Sorry for my english Best Regards! Andre.

5 10

JSON Filter
by Scot 04 Apr '18

04 Apr '18

Sorry if I'm missing this but whats the best way to implement a json filter like these in syslog-ng, Patterndb? This is my logstash filter that sends data to a specific syslog-ng PORT for each condition which may grow and become a management headache when there are 6 logstash hosts that will need to support a filter for each breakout needed. I'd like to just send everything to a single syslog-ng port and have syslog-ng do the logic. which would then become. input { beats { port => 5044 } } output{ tcp { host => "loghost" port => "5140" mode => "client" codec => "json_lines" } } *Logstash bloated output filters. * output{ if [type]=="wineventlog" and "DC" in [tags] { tcp { host => "loghost" port => "5142" mode => "client" codec => "json_lines" } } else if [type]=="wineventlog" and "PCI" in [tags] { tcp { host => "loghost" port => "5141" mode => "client" codec => "json_lines" } } else if [type]=="wineventlog" { tcp { host => "loghost" port => "5140" mode => "client" codec => "json_lines" } } else if [type]=="filebeat" and "apache" in [tags] { tcp { host => "loghost" port => "5145" mode => "client" codec => "json_lines" } } else if [type]=="filebeat" and "PCI" in [tags] { tcp { host => "loghost" port => "5144" mode => "client" codec => "json_lines" } } else if [type]=="filebeat" { tcp { host => "loghost" port => "5143" mode => "client" codec => "json_lines" } } else { file { path => "/opt/syslog-ng/logs/logstash/%{host}-%{+YYYY-MM-dd}.json" codec => "json_lines" } } }

3 4

perf testing problem
by Czanik, Péter 31 Mar '18

31 Mar '18

Hi, When I try to use loggen with more than ~20 active connections I get the following error: "Send error Connection reset by peer, results may be skewed." The network source has max_connections(128) already configured, so it should be handle that many connections without any trouble. Do you have any suggestions where to look either in syslog-ng or at OS level? It is Ubuntu 17.10 and syslog-ng 3.11 Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://syslog-ng.com/blog/author/peterczanik/ https://twitter.com/PCzanik

2 1

Linux or OS fingerprint filter
by Scot 29 Mar '18

29 Mar '18

Pretty sure I know the answer but just maybe.. Anyone have a solution OS fingerprint type filters ? Solaris, Linux vs Cisco for example. Immediate need is to pluck all Linux host from 514. Thanks ! Scot

3 2

Re: [syslog-ng] Syslog-ng shipping logs through AMQP with huge memory leaks
by Nagy, Gábor 29 Mar '18

29 Mar '18

I'm resending this letter to the mail list as we hit the message size limit. :) Hello Michal! I have some good news. We have found the reason for the increasing memory usage of syslog-ng in amqp() driver. It is due to our internal memory handling method (aka scratch_buffers) which we use in performance critical paths to prevent the overhead of memory allocations/deallocations of GStrings. It is using memory from a pre-allocated pool instead of allocating/freeing. As I have described before, the memory usage only increases if the number of queued messages reaches a new maximum. It is not per message and does not happen every for every queued message. We have several options how to fix this issue and will soon share one. Regards, Gabor

3 6

syslog-ng-java RPM requirements will not use Oracle Java
by Evan Rempel 27 Mar '18

27 Mar '18

Using the copr builds of syslog-ng 3.14 The package syslog-ng-java has RPM requirements that include libjvm.so()(64bit) libjvm.so(SUNWprivate_1.1)(64bit) The Java packages from Oracle do not provide these items. % rpm -q --provides -p jdk-8u162-linux-x64.rpm jdk jaxp_parser_impl xml-commons-apis java java-1.8.0 java-fonts jre jre-1.8.0 jdk1.8 = 2000:1.8.0_162-fcs % rpm -q --provides -p jre-8u162-linux-x64.rpm jaxp_parser_impl xml-commons-apis java java-1.8.0 java-fonts jre jre-1.8.0 jre1.8 = 1.8.0_161-fcs [% rpm -q --provides jdk-9.0.4_linux-x64_bin.rpm jdk jaxp_parser_impl xml-commons-apis java java-9.0.4 java-fonts jre jre-9.0.4 jdk-9.0.4 = 2000:9.0.4-ga jdk-9.0.4(x86-64) = 2000:9.0.4-ga Under Redhat 7 in order to get these I need libjvm.so()(64bit) --> java-1.8.0-ibm libjvm.so(SUNWprivate_1.1)(64bit) --> java-1.8.0-openjdk-headless The Oracle provided java (jdk or jre) do not provide these things. Both of these java packages provides the lib jvm.so % rpm -ql java-1.8.0-ibm | grep libjvm /usr/lib/jvm/java-1.8.0-ibm-1.8.0.5.10-1jpp.1.el7.x86_64/jre/bin/classic/libjvm.so /usr/lib/jvm/java-1.8.0-ibm-1.8.0.5.10-1jpp.1.el7.x86_64/jre/bin/j9vm/libjvm.so /usr/lib/jvm/java-1.8.0-ibm-1.8.0.5.10-1jpp.1.el7.x86_64/jre/lib/amd64/classic/libjvm.so /usr/lib/jvm/java-1.8.0-ibm-1.8.0.5.10-1jpp.1.el7.x86_64/jre/lib/amd64/compressedrefs/libjvm.so /usr/lib/jvm/java-1.8.0-ibm-1.8.0.5.10-1jpp.1.el7.x86_64/jre/lib/amd64/default/libjvm.so /usr/lib/jvm/java-1.8.0-ibm-1.8.0.5.10-1jpp.1.el7.x86_64/jre/lib/amd64/j9vm/libjvm.so % rpm -ql java-1.8.0-openjdk-headless | grep libjvm /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.161-0.b14.el7_4.x86_64/jre/lib/amd64/server/libjvm.so Both of these package provide the following potentials for a dependency jre = 1:1.8.0 java = 1:1.8.0 or if you want to tie to a specific version of java jre-1.8.0 java-1.8.0 If these requirements were used in the RPM build then I could use Oracle Java to satisfy the RPM requirements. Am I missing something obvious here? Comments? -- Evan Rempel erempel(a)uvic.ca Senior Systems Administrator 250.721.7691 Data Centre Services, University Systems, University of Victoria

3 4

syslog-ng is skipping syslog events with no PRI
by Asif Iqbal 26 Mar '18

26 Mar '18

syslog-ng is *NOT* writing syslog like this to a file which has no <*PRI*> 23:49:48.306587 IP 192.168.1.100.39567 > 192.168.100.100.514: [|syslog] E.....@.>..U...g..........T.2018-03-19T23:49:48+0000 alarmLog, applianceName=Branch-UC1, tenantName=DEMO-CORP, alarmType=sla-not-met, alarmKey=INTERNET, generateTime=1521503387, applianceId=1, vsnId=0, tenantId=2, alarmCause=datapathState, alarmClearable=yes, alarmClass=cleared, alarmKind=symptom, alarmEventType=equipmentAlarm, alarmSeverity=cleared, alarmOwner=tenant, alarmSeqNo=1568, alarmText="delay:9 msec", siteName=Branch-UC1 ................ syslog-ng is writing syslog like this to a file *OK * 23:50:26.930023 IP 192.168.1.100.55078 > 192.168.100.100.514: SYSLOG mail.info, length: 76 E..h.B@.>......g.....&...Tt.<22>Mar 19 23:50:26 SVL-remotehost-02 root: this is third test alarmLog................ Here is my syslog-ng config source s_udp { udp(ip(0.0.0.0) port(514)); }; destination d_alarm { file("/var/log/alarms.log"); }; filter f_alarm { match("alarmLog" value("MESSAGE")); }; log { source(s_udp); filter(f_alarm); destination(d_alarm); }; I am using syslog-ng version 3.5.6 on centos 7 Any idea why syslog-ng is writing the first log event into a file? Appreciate any help! -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

4 12

GSoC project proposal: Queue Interface
by Mehul Prajapati 26 Mar '18

26 Mar '18

Dear Kókai Péter, I have developed a proposal for the GSoC syslog-ng Queue interface project I have shared it for a review. I would highly appreciate it if you could find the time to take a look at my proposal and let me know what you think I would be honored to get the chance to work on this project under your supervision. -- Regards, Mehul Prajapati Embedded Software Developer Website: https://mehul-m-prajapati.github.io/ Email: mehulprajapati2802(a)gmail.com

2 1

Re: [syslog-ng] Fwd: GSoC syslog-ng project proposal
by Balazs Scheidler 25 Mar '18

25 Mar '18

Where can I have a look on the proposal? On Mar 24, 2018 04:06, "Marwa Desouky" <marwadesouky96(a)gmail.com> wrote: Dear Mr. Peter, I hope this email finds you well. I have constructed a proposal for the GSoC syslog-ng Crypto Parser project and shared it for reviewing. I would greatly appreciate it if you could find the time to take a look at my proposal and let me know what you think, if anything is missing or needs improvement. I would be greatly honored to get the chance to work on this project under your supervision. Sincerely, Marwa Desouky ____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

2 1

Fwd: GSoC syslog-ng project proposal
by Marwa Desouky 24 Mar '18

24 Mar '18

Dear Mr. Peter, I hope this email finds you well. I have constructed a proposal for the GSoC syslog-ng Crypto Parser project and shared it for reviewing. I would greatly appreciate it if you could find the time to take a look at my proposal and let me know what you think, if anything is missing or needs improvement. I would be greatly honored to get the chance to work on this project under your supervision. Sincerely, Marwa Desouky

1 0

Syslog-ng shipping logs through AMQP with huge memory leaks
by Michal Purzynski 23 Mar '18

23 Mar '18

Hello!! Could you help us troubleshoot a memory leak or a misconfiguration that makes the syslog-ng process memory usage grow? Like, a lot. We use syslog-ng to read some JSON files and ship them to a RabbitMQ server via AMQP. As you can see, this is just a client, it does not accept connections from other systems, it works mostly with Bro logs (plus it handles a local syslog because that's convenient). We have around 6000 events per second on this server. What's interesting, syslog-ng's memory grows quickly without flow control (and slower, but it still continues to grow with it). I'll switch that to TLS soon, a more secure configuration is ready to be deployed. Things look pretty good on the RabbitMQ side. That server is not under pressure and handles the load just fine, the queue is consumed, there's nothing building up that would make me believe we have RabbitMQ server overloaded. How much does syslog-ng grow? I'd say - if I disable flow-control it will eat 55GB of RAM in less than 24h, if not faster. With flow-control enabled on the most 'busy' files things are way better, but the memory usage still keep growing - syslog-ng.conf looks like below - BTW that's Ubuntu 14.04 LTS, 3.14.1-3 of syslog-ng Let me know what other data you might need. @version: 3.14 @include "scl.conf" # Syslog-ng configuration file, compatible with default Debian syslogd # installation. # First, set some global options. options { threaded (yes); flush_lines (50000); flush_timeout (1000); time_reopen (10); log_fetch_limit (50000); log_fifo_size (500000); use_dns (yes); dns_cache (5000); dns_cache_expire(87600); use_fqdn (yes); owner("root"); group("adm"); perm(0640); keep_hostname (yes); chain_hostnames (off); }; ######################## # Sources ######################## # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # source s_src { system(); internal(); }; # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. # #source s_net { tcp(ip(127.0.0.1) port(1000)); }; ######################## # Destinations ######################## # First some standard logfile # destination d_auth { file("/var/log/auth.log"); }; destination d_cron { file("/var/log/cron.log"); }; destination d_daemon { file("/var/log/daemon.log"); }; destination d_kern { file("/var/log/kern.log"); }; destination d_mail { file("/var/log/mail.log"); }; destination d_syslog { file("/var/log/syslog"); }; # This files are the log come from the mail subsystem. # #destination d_mailinfo { file("/var/log/mail.info"); }; #destination d_mailwarn { file("/var/log/mail.warn"); }; #destination d_mailerr { file("/var/log/mail.err"); }; # Logging for INN news system # #destination d_newscrit { file("/var/log/news/news.crit"); }; #destination d_newserr { file("/var/log/news/news.err"); }; #destination d_newsnotice { file("/var/log/news/news.notice"); }; # Some 'catch-all' logfiles. # destination d_debug { file("/var/log/debug"); }; destination d_error { file("/var/log/error"); }; # Syslog1 in SCL3 destination d_scl3 { udp("syslog1.private.scl3.mozilla.com" port(514)); }; ######################## # Filters ######################## # Here's come the filter options. With this rules, we can set which # message go where. filter f_dbg { level(debug); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_err { level(err); }; filter f_crit { level(crit .. emerg); }; filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); }; filter f_error { level(err .. emerg) ; }; filter f_auth { facility(auth, authpriv) and not filter(f_debug); }; filter f_cron { facility(cron) and not filter(f_debug); }; filter f_daemon { facility(daemon) and not filter(f_debug); }; filter f_kern { facility(kern) and not filter(f_debug); }; filter f_local { facility(local0, local1, local3, local4, local5, local6, local7) and not filter(f_debug); }; filter f_mail { facility(mail) and not filter(f_debug); }; filter f_syslog3 { not facility(auth, authpriv, mail) and not filter(f_debug); }; ######################## # Log paths ######################## log { source(s_src); filter(f_auth); destination(d_auth); }; log { source(s_src); filter(f_cron); destination(d_cron); }; log { source(s_src); filter(f_daemon); destination(d_daemon); }; log { source(s_src); filter(f_kern); destination(d_kern); }; log { source(s_src); filter(f_syslog3); destination(d_syslog); }; log { source(s_src); filter(f_mail); destination(d_mail); }; log { source(s_src); filter(f_debug); destination(d_debug); }; log { source(s_src); filter(f_error); destination(d_error); }; # All messages send to a remote site # log { source(s_src); destination(d_scl3); }; ### # Include all config files in /etc/syslog-ng/conf.d/ ### @include "/etc/syslog-ng/conf.d/*.conf" There's another file, amqp.conf where we actually read and ship those Bro logs. source bro_conn { file( "/nsm/bro/logs/current/conn.log" flags(no-parse)); }; source bro_ssl { file( "/nsm/bro/logs/current/ssl.log" flags(no-parse)); }; source bro_dns { file( "/nsm/bro/logs/current/dns.log" flags(no-parse)); }; source bro_smtp { file( "/nsm/bro/logs/current/smtp.log" flags(no-parse)); }; source bro_ssh { file( "/nsm/bro/logs/current/ssh.log" flags(no-parse)); }; source bro_notice { file( "/nsm/bro/logs/current/notice.log" flags(no-parse)); }; source bro_intel { file( "/nsm/bro/logs/current/intel.log" flags(no-parse)); }; source bro_dce_rpc { file( "/nsm/bro/logs/current/dce_rpc.log" flags(no-parse)); }; source bro_dhcp { file( "/nsm/bro/logs/current/dhcp.log" flags(no-parse)); }; source bro_files { file( "/nsm/bro/logs/current/files.log" flags(no-parse)); }; source bro_kerberos { file( "/nsm/bro/logs/current/kerberos.log" flags(no-parse)); }; source bro_http { file( "/nsm/bro/logs/current/http.log" flags(no-parse)); }; source bro_software { file( "/nsm/bro/logs/current/software.log" flags(no-parse)); }; source bro_snmp { file( "/nsm/bro/logs/current/snmp.log" flags(no-parse)); }; source bro_socks { file( "/nsm/bro/logs/current/socks.log" flags(no-parse)); }; source bro_tunnel { file( "/nsm/bro/logs/current/tunnel.log" flags(no-parse)); }; source bro_ntlm { file( "/nsm/bro/logs/current/ntlm.log" flags(no-parse)); }; source bro_pe { file( "/nsm/bro/logs/current/pe.log" flags(no-parse)); }; source bro_sip { file( "/nsm/bro/logs/current/sip.log" flags(no-parse)); }; source bro_smb_files { file( "/nsm/bro/logs/current/smb_files.log" flags(no-parse)); }; source bro_smb_mapping { file( "/nsm/bro/logs/current/smb_mapping.log" flags(no-parse)); }; source bro_x509 { file( "/nsm/bro/logs/current/x509.log" flags(no-parse)); }; source bro_known_certs { file( "/nsm/bro/logs/current/known_certs.log" flags(no-parse)); }; source bro_known_devices { file( "/nsm/bro/logs/current/known_devices.log" flags(no-parse)); }; source bro_known_hosts { file( "/nsm/bro/logs/current/known_hosts.log" flags(no-parse)); }; source bro_known_services { file( "/nsm/bro/logs/current/known_services.log" flags(no-parse)); }; destination d_amqp { amqp( vhost("nsm") host("<our happy rabbit> <http://syslog-proxy1.dmz.mdc1.mozilla.com> ") port(5672) exchange("eventtask") exchange-type("direct") routing-key("eventtask") body("$(format-json --scope nv_pairs --pair category=\"bro\" --pair source=$source --pair customendpoint=\" \" --pair tags=\"bro\")") persistent(yes) username("USERNAME") password("PASSWORD") ); }; parser p_json { json-parser(); }; log { source(bro_conn); parser(p_json); destination(d_amqp); }; log { source(bro_http); parser(p_json); destination(d_amqp); }; log { source(bro_ssl); parser(p_json); destination(d_amqp); }; log { source(bro_dns); parser(p_json); destination(d_amqp); }; log { source(bro_smtp); parser(p_json); destination(d_amqp); }; log { source(bro_ssh); parser(p_json); destination(d_amqp); }; log { source(bro_intel); parser(p_json); destination(d_amqp); }; log { source(bro_notice); parser(p_json); destination(d_amqp); }; log { source(bro_dce_rpc); parser(p_json); destination(d_amqp); flags(flow-control); }; log { source(bro_dhcp); parser(p_json); destination(d_amqp); }; log { source(bro_files); parser(p_json); destination(d_amqp); flags(flow-control); }; log { source(bro_kerberos); parser(p_json); destination(d_amqp); flags(flow-control); }; log { source(bro_software); parser(p_json); destination(d_amqp); flags(flow-control); }; log { source(bro_snmp); parser(p_json); destination(d_amqp); flags(flow-control); }; log { source(bro_socks); parser(p_json); destination(d_amqp); flags(flow-control); }; log { source(bro_tunnel); parser(p_json); destination(d_amqp); flags(flow-control); }; log { source(bro_ntlm); parser(p_json); destination(d_amqp); flags(flow-control); }; log { source(bro_pe); parser(p_json); destination(d_amqp); flags(flow-control); }; log { source(bro_sip); parser(p_json); destination(d_amqp); flags(flow-control); }; log { source(bro_smb_files); parser(p_json); destination(d_amqp); flags(flow-control); }; log { source(bro_smb_mapping); parser(p_json); destination(d_amqp); flags(flow-control); }; log { source(bro_x509); parser(p_json); destination(d_amqp); flags(flow-control); }; log { source(bro_known_certs); parser(p_json); destination(d_amqp); flags(flow-control); }; log { source(bro_known_devices); parser(p_json); destination(d_amqp); flags(flow-control); }; log { source(bro_known_hosts); parser(p_json); destination(d_amqp); flags(flow-control); }; log { source(bro_known_services); parser(p_json); destination(d_amqp); flags(flow-control); }; *Statistics* Mar 15 *00:17:30* nsmserver syslog-ng[11278]: Log statistics; processed='source(bro_conn)=112360513', processed='source(s_src)=227349', processed='source(bro_known_devices)=3791', processed='global(sdata_updates)=0', processed='center(received)=310790955', processed='source(bro_ssh)=622441', processed='source(bro_smb_files)=5815964', processed='source(bro_socks)=0', processed='destination(d_daemon)=21', dropped='dst.amqp(d_amqp#0,amq p,nsm,happyrabbit,5672,eventtask,direct)=2', processed='dst.amqp(d_amqp#0,a mqp,nsm,happyrabbit,5672,eventtask,direct)=310563565', queued='dst.amqp(d_amqp#0,amqp,nsm,happyrabbit,5672,eventtask,direct)=0', processed='destination(d_error)=189386', processed='destination(d_syslog)=207595', processed='source(bro_ssl)=49788364', processed='source(bro_kerberos)=133177', processed='source(bro_dhcp)=69970', processed='destination(d_mail)=0', processed='source(bro_http)=60085539', processed='global(msg_clones)=1576', processed='destination(d_amqp)=310563565', processed='destination(d_kern)=146', processed='source(bro_tunnel)=520921', processed='source(bro_software)=18851236', processed='source(bro_known_services)=13403', processed='source(bro_known_certs)=2070', processed='source(bro_dce_rpc)=501875', processed='destination(d_scl3)=227349', processed='source(bro_known_hosts)=14604', processed='source(bro_smb_mapping)=116412', processed='source(bro_files)=15152100', processed='center(queued)=311210449', processed='destination(d_debug)=10280', processed='src.internal(s_src#2)=26785', stamp='src.internal(s_src#2)=1521073048', processed='source(bro_ntlm)=16823', processed='destination(d_auth)=9474', processed='global(internal_queue_length)=0', processed='source(bro_smtp)=1067448', dropped='dst.udp(d_scl3#0,udp, syslog1.private.scl3.mozilla.com:514)=0', processed='dst.udp(d_scl3#0,ud p,syslog1.private.scl3.mozilla.com:514)=227349', queued='dst.udp(d_scl3#0,udp,syslog1.private.scl3.mozilla.com:514)=221705', written='dst.udp(d_scl3#0,udp,syslog1.private.scl3.mozilla.com:514)=5644', processed='global(payload_reallocs)=310467149', queued='global(scratch_buffers_count)=17875655781170', processed='destination(d_cron)=2633', processed='source(bro_snmp)=9854568', processed='source(bro_notice)=119415', processed='source(bro_dns)=19303431', processed='source(bro_sip)=97822', processed='source(bro_intel)=26969', processed='source(bro_pe)=531103', processed='source(bro_x509)=15493647', queued='global(scratch_buffers_bytes)=2304' Mar 15 *00:27:30* nsmserver <http://nsmserver1.private.scl3.mozilla.com> syslog-ng[11278]: Log statistics; processed='source(bro_conn)=112988941', processed='source(s_src)=228651', processed='source(bro_known_devices)=3791', processed='global(sdata_updates)=0', processed='center(received)=312659144', processed='source(bro_ssh)=627013', processed='source(bro_smb_files)=5863697', processed='source(bro_socks)=0', processed='destination(d_daemon)=21', dropped='dst.amqp(d_amqp#0,amqp,nsm,happyrabbit <http://syslog-proxy1.dmz.mdc1.mozilla.com>,5672,eventtask,direct)=2', processed='dst.amqp(d_amqp#0,amqp,nsm,happyrabbit <http://syslog-proxy1.dmz.mdc1.mozilla.com>,5672,eventtask,direct)=312430452', queued='dst.amqp(d_amqp#0,amqp,nsm,happyrabbit <http://syslog-proxy1.dmz.mdc1.mozilla.com>,5672,eventtask,direct)=0', processed='destination(d_error)=190429', processed='destination(d_syslog)=208759', processed='source(bro_ssl)=50077572', processed='source(bro_kerberos)=134215', processed='source(bro_dhcp)=70487', processed='destination(d_mail)=0', processed='source(bro_http)=60446166', processed='global(msg_clones)=1594', processed='destination(d_amqp)=312430452', processed='destination(d_kern)=146', processed='source(bro_tunnel)=524450', processed='source(bro_software)=18938552', processed='source(bro_known_services)=13532', processed='source(bro_known_certs)=2073', processed='source(bro_dce_rpc)=505206', processed='destination(d_scl3)=228651', processed='source(bro_known_hosts)=14630', processed='source(bro_smb_mapping)=117177', processed='source(bro_files)=15252368', processed='center(queued)=313080999', processed='destination(d_debug)=10352', processed='src.internal(s_src#2)=26966', stamp='src.internal(s_src#2)=1521073648', processed='source(bro_ntlm)=16848', processed='destination(d_auth)=9540', processed='global(internal_queue_length)=0', processed='source(bro_smtp)=1074012', dropped='dst.udp(d_scl3#0,udp, syslog1.private.scl3.mozilla.com:514)=0', processed='dst.udp(d_scl3#0,ud p,syslog1.private.scl3.mozilla.com:514)=228651', queued='dst.udp(d_scl3#0,udp,syslog1.private.scl3.mozilla.com:514)=223007', written='dst.udp(d_scl3#0,udp,syslog1.private.scl3.mozilla.com:514)=5644', processed='global(payload_reallocs)=312333723', queued='global(scratch_buffers_count)=17970145061685', processed='destination(d_cron)=2649', processed='source(bro_snmp)=9917302', processed='source(bro_notice)=120140', processed='source(bro_dns)=19462256', processed='source(bro_sip)=98565', processed='source(bro_intel)=27061', processed='source(bro_pe)=535753', processed='source(bro_x509)=15598686', queued='global(scratch_buffers_bytes)=2304'

3 9

How to send syslog via specific Ethernet port
by craig bowser 22 Mar '18

22 Mar '18

I've been looking through the documentation, but I don't readily see a method to do this. I have two ethernet ports, eth0 and eth1 and I'd like to make syslog-ng only send logs via eth1 (both eth ports are on the same subnet). Is there a network() setting to do this? Thanks (This is in my home lab, not production) Craig L Bowser ____________________________ This email is measured by size. Bits and bytes may have settled during transport.

2 2

PCRE in patterndb with back substitution
by Evan Rempel 20 Mar '18

20 Mar '18

I have a case where an application logs something like {date} {host} {program}: my first line... ...my second line... ...and my third line. I want to make a correlation and unwrap these lines into {date} {host} {program}: my first line my second line and my third line. I started writing the patterndb to do this, but matching the ... at the end of the line is difficult, so I used @PCRE:line:(.*)\.\.\.$@ but I then need to only use the $1 to set a value <values> <value name="mymessage">$1</value> </values> Would this be the correct syntax to do this? Is there an easier way that would perform well? Thanks,

4 9

Re: [syslog-ng] Compression on input and output ?
by Nagy, Gábor 14 Mar '18

14 Mar '18

Hi Scot, I don't know about native compression abilities in syslog-ng. You could use TLS compression, but I don't know if that suits you. Other options would require that you write your compressing programs and include them in program source/destination or using unix sockets. Can you explain what is your use case, please? Maybe compression is not the goal, just the tool to achieve it and we can propose something else. Gabor On 13 Mar 2018 3:05 pm, "Scot" <scotrn(a)gmail.com> wrote: Hi, Has anyone looked at enabling compression between sources and destinations? Looks like Kafka is the only destination that supports compression by documentation. No inputs. Would be great to also compress between a syslog-ng relay and a syslog-ng target. Scot ____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product= syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

3 3

Compression on input and output ?
by Scot 13 Mar '18

13 Mar '18

Hi, Has anyone looked at enabling compression between sources and destinations? Looks like Kafka is the only destination that supports compression by documentation. No inputs. Would be great to also compress between a syslog-ng relay and a syslog-ng target. Scot

1 0

One source multiple destinations ?
by Scot 10 Mar '18

10 Mar '18

I'm having a problem where I am trying to take input source(s) and write them out to multiple destinations. Before I go barking up the wrong tree I just wanted to make sure I wasn't missing something. We should be able to take a source and send it to file, elastic-search and SPLUNK and sumologic all at the same time right ? Troubleshooting an odd behavior where only one network destination will work but then I switch the order the other starts working. I know it's vague but has anyone seen this behavior? Thanks Scot

4 10

Rewrite syslog priority
by Kaleemulla Sharief (kasharie) 08 Mar '18

08 Mar '18

Hi, Is there support to change the syslog *priority* using rewrite? While I read it was not supported earlier but was planned for syslog-ng 3.2 (apologies if this is a wrong source), can someone help me with an example if it was added in any of the releases later ? Below did not work for me with syslog-ng 3.5.6 to change debug syslog to alert. filter f_syslogd1 { match("%OS-PCE-7-CSPF_FALLBACK") and priority(debug); }; rewrite r_rewrite_set{set("1", value("PRIORITY") condition(filter(f_syslogd1)));}; #Neither 1 without quotes log { source(s_syslog_514); rewrite (r_rewrite_set); destination(d_syslog); }; I am able to achieve this using the template hack something like below (changing to local7.alert=185) but the problem is while I can use the template inside destination definition, rewrite can be used under log section so that I can re-use same destination with different filters with or without rewrite, below will get applied to all syslogs to destination d_syslog which is not my requirement. How can I combine filters with template on same destination if rewrite is not supported. Appreciate any suggestions. template t_asm { template("<185> $DATE $HOST $MSGHDR$MSG\n"); template_escape(no); }; destination d_syslog {udp("server-001" port(514) spoof_source(yes) template(t_asm)); }; Regards ~ Kaleem

2 3

Re: [syslog-ng] Directory/file create ownership
by Dwijadas Dey 07 Mar '18

07 Mar '18

Add create_dirs (yes) in the options section. On 27-Feb-2018 2:24 PM, "Machiel Richards" <machiel.richards(a)gmail.com> wrote: Good day guys I am having an issue that I seem not be able to resolve thus far. I am fairly new to syslog-ng and have setup a new syslog server. We have managed to get most of our servers sending logs to the server without issues, however I am having trouble to get syslog-ng to create the directories and files with the correct ownership. We have a seperate user and group which it needs to create directories with, however it keeps on creating directories and files as root user. below is my current config : # First, set some global options. options { chain_hostnames(off); flush_lines(0); use_dns(yes); use_fqdn(yes); owner("syslog"); group("syslog"); perm(0640); stats_freq(0); bad_hostname("^gconfd$"); log_fifo_size(10000); }; source inputs { system(); internal(); unix-stream("/dev/log"); tcp(max_connections(50)); udp(); }; destination logpile { file("/var/log/HOSTS/$HOST/$YEAR/$MONTH/$FACILITY.$YEAR$ MONTH$DAY" owner("syslog") group("syslog") perm(0660) create_dirs(yes) dir_perm(0770)); }; log { source(inputs); destination(logpile); }; Can someone please assist me as any help would be appreciated. Regard -- I am a bomb technician...If you see me running, TRY TO KEEP UP! ____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

5 8

Re: [syslog-ng] Cisco ASA parsing with patterndb/elasticsearch
by Scheidler, Balázs 05 Mar '18

05 Mar '18

Hi, Could you pls send a couple of messages? I would really like to make sure this works out of the box. Thanks On Mar 1, 2018 16:08, "Scheidler, Balázs" <balazs.scheidler(a)balabit.com> wrote: Can you give me a few inbound logs as received by syslog-ng? I would try to fix up cisco parser that it works for your use-case, as it should. Thanks On Feb 28, 2018 21:48, "Tim Ghetti" <tghetti(a)targetedsupport.com> wrote: I tried using the cisco-parser and not having any luck with that either. When I enable the parser, I actually stop seeing outbound traffic to elasticsearch. My config is below log { source { udp(flags(no-parse)); }; parser { cisco-parser(); }; destination { elasticsearch2( client-mode("http") cluster("ITESCL001") index("logstash-syslogng_${YEAR}.${MONTH}.${DAY}") cluster-url("http://192.168.101.199:9200 http://192.168.101.198:9200") type("syslog") flush-limit("1")); }; } [root@ITLOG001 conf.d]# tcpdump -nnSXi ens192 port 9200 -vv tcpdump: listening on ens192, link-type EN10MB (Ethernet), capture size 262144 bytes ^C 0 packets captured 0 packets received by filter 0 packets dropped by kernel *From:* syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] *On Behalf Of *Scheidler, Balázs *Sent:* Tuesday, February 27, 2018 11:06 PM *To:* Syslog-ng users' and developers' mailing list < syslog-ng(a)lists.balabit.hu> *Subject:* Re: [syslog-ng] Cisco ASA parsing with patterndb/elasticsearch One additional feature you might be interested in is our cisco-parser() feature. It basically expects a flags(no-parse) input and then puts things in the right buckets, while recognising the various formats that cisco uses. It would be appreciated if you could check if it works with your setup and I can help fixing it up if it doesn't. The parser got added to recent syslog-ng versions, so you might need to upgrade to a new version. Bazsi On Feb 27, 2018 22:29, "Tim Ghetti" <tghetti(a)targetedsupport.com> wrote: Thanks!! It sounds like this is part of my problem. If you would be so kind as to send an example (or point me in the right direction) of how you are changing the program name and message body for the cisco logs that would be extremely helpful. I also suspect that there may be another issue. I’m almost certain that my parser should be picking up at least some of the logs but I am not seeing any of the fields in ES showing up based on parsed logs. Assuming that patterndb is working, would the below config be correct for getting patterndb parsed variables to show as fields in ES? destination d_elastic { elasticsearch2( client-mode("http") cluster("ITESCL001") index("logstash-syslogng_${YEAR}.${MONTH}.${DAY}") cluster-url("http://X.X.X.X:9200") type("syslog") flush-limit("1") ); }; *From:* syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] *On Behalf Of *Evan Rempel *Sent:* Tuesday, February 27, 2018 9:06 PM *To:* syslog-ng(a)lists.balabit.hu *Subject:* Re: [syslog-ng] Cisco ASA parsing with patterndb/elasticsearch The program name will have an implied @ANYSTRING@ on the end, so if the syslog payload could be parsed to detect the program name of %ASA..... then your patterndb.xml would work. The problem is that they syslog payload can not be parsed. What we do is use a hand crafted patterndb to detect all of the different problem formats that Cisco logs (in our environment) and change a) the PROGRAM to be cisco_ASA or generally cisco_XXX where the XXX is the leading characters of the %XXX-#-##### of the syslog body. b) the MESSAGE to be %XXX-#-####... for the rest of the line. All of the poor hosts, sequence numbers, timestamps etc are all thrown away. After that, the internal buffers of syslog-ng contain a usable PROGRAM and MESSAGE such that we can use a patterndb to match the message part of the log line. This does mean that we have two patterndb parsers for every log line but it seems to work well for us. What would work better is if Cisco would fix their logging, but that isn't going to happen in my lifetime :-( I hope that makes sense. Evan. On 02/27/2018 05:37 PM, Tim Ghetti wrote: Ok, that makes sense. I sort of suspected that this was due to the program name not matching, since pdbtool works when specifying the program name. Do you know if there is a way to configure patterndb so that it matches the program name, regardless of the full program name with event code? Is it possible to regex the program or use the patterndb format i.e. <pattern>%ASA@ANYSTRING::@</pattern> or something similar? Tim *From:* syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu <syslog-ng-bounces(a)lists.balabit.hu>] *On Behalf Of *Evan Rempel *Sent:* Tuesday, February 27, 2018 8:26 PM *To:* syslog-ng(a)lists.balabit.hu *Subject:* Re: [syslog-ng] Cisco ASA parsing with patterndb/elasticsearch Welcome to the horrible world of Cisco logging :-( The issue you are bumping into is that when these log lines are parsed by syslog-ng (or any syslog daemon that does not specifically understand Cisco logs) there is no program name, or the program name is the full %ASA-4-106023 part of the log line. There are so many ways that Cisco can log incorrectly it is not possible to say without seeing your exact log lines. Cisco can add a * to the date/time stamp to indicate that there is no time server configured on the device. That makes the date/time invalid as far as parsing is concerned. Cisco can add a period (.) to the date/time stamp to indicate that there is a time server configured on the device, but the time server can not be reached. Again, this makes the date/time invalid as far as parsing is concerned. Cisco can add a sequence number at the start of the log line rather than starting the line with a date/6time stamp. Invalid parsing again. Cisco can leave out the sequence number but still include the trailing colon from the sequence number. You get the idea. So many ways to get it wrong, and they never get it right :-( Evan. On 02/27/2018 04:46 PM, Tim Ghetti wrote: Hi – having some trouble getting paterndb functional and looking for some help. I would like to use patterndb to parse my cisco ass firewall logs before sending it to elasticsearch. However when the messages get to elasticsearch, I don’t see the messages being parsed. Running pdbtool against the logs seems to work. # pdbtool match -p /etc/syslog-ng/patterndb.d/ciscoasa.pdb -P %ASA -f /var/log/asatest.log |more HOST=X.X.X.X MESSAGE=Built dynamic TCP translation from INSIDE:X.X.X.X/X to OUTSIDE:X.X.X.X/X PROGRAM=%ASA-6-305011 LEGACY_MSGHDR=%ASA-6-305011: .classifier.class=system .classifier.rule_id=e075efdc-c25f-5e49-a208-7661e3b5a29b Protocol=TCP GlobalIP=X.X.X.X GlobalPort=X LocalIP=X.X.X.X LocalPort=X TAGS=.classifier.system ********************** SYSLOG-NG CONF FILE @version: 3.11 source s_network { tcp(); udp(); }; destination d_elastic { elasticsearch2( client-mode("http") cluster("ITESCL001") index("logstash-syslogng_${YEAR}.${MONTH}.${DAY}") cluster-url("http://X.X.X.X:9200") type("syslog") flush-limit("1") ); }; destination d_catchall { file("/var/log/catchall.log"); }; filter f_ciscoasa { host("X.X.X.X"); }; parser p_ciscoasa {db-parser(file("/etc/syslog-n g/patterndb.d/ciscoasa.pdb"));}; log { source(s_network); filter(f_ciscoasa); parser(p_ciscoasa); destination(d_elastic); flags(final, flow-control); }; log { source(s_network); destination(d_catchall); }; ********************** PATTERNDB FILE <?xml version='1.0' encoding='UTF-8'?> <patterndb version='4' pub_date='2018-02-19'> <ruleset name='%ASA' id='a300d776-8bd7-834d-a4a9-23eb81a4b3ba'> <pattern>%ASA</pattern> <description> This ruleset covers the Cisco ASA firewalls </description> <rules> <rule provider="%ASA" id="b3de7699-8213-c744-944e-9413298afe86" class="system">  <patterns> <pattern>Teardown @ESTRING:Protocol: @connection for faddr @IPv4:SrcIP:/@@ESTRING:SrcPort: @gaddr @IPv4:GlobalIP:/@@ESTRING:GlobalPort: @laddr @IPv4:LocalIP:/@@ESTRING:LocalPort:@</pattern> </patterns> <examples> <example> <test_message program='%ASA'>Teardown ICMP connection for faddr X.X.X.X/X gaddr X.X.X.X/X laddr X.X.X.X/X</test_message> </example> </examples> </rule> <rule id='90d0f8c9-7591-d44e-b886-2f7e5cb17ce6' class='system' provider='%ASA'>  <patterns> <pattern>Teardown dynamic @ESTRING:Protocol: @translation from @ESTRING:::@@IPv4:LocalIP:/@@ESTRING:LocalPort: @to @ESTRING:::@ @IPv4:GlobalIP:/@@ESTRING:GlobalPort: @duration@ANYSTRING::@</pattern> </patterns> <examples> <example> <test_message program='%ASA'>Teardown dynamic UDP translation from any:X.X.X.X/X to outside:X.X.X.X/X duration 0:00:00</test_message> </example> </examples> </rule> <rule id='8f0a8d57-80c6-4745-8a8a-5ce018bb0d87' class='system' provider='%ASA'>  <patterns> <pattern>Teardown @ESTRING:Protocol: @connection @ESTRING:: @for @ESTRING:::@@IPv4:DstIP:/@@ESTRING:DstPort: @to @ESTRING:::@ @IPv4:SrcIP:/@@ESTRING:SrcPort: @@ESTRING::@</pattern> </patterns> <examples> <example> <test_message program='%ASA'>Teardown UDP connection 55101037 <(55)%20101%20037> for outside:X.X.X.X/X to inside:X.X.X.X/X duration 0:00:00 bytes 132</test_message> </example> </examples> </rule> <rule id='00c0732d-1e34-7340-a75f-21198bf71137' class='system' provider='%ASA'>  <patterns> <pattern>Built outbound @ESTRING:Protocol: @connection @ESTRING:: @for @ESTRING:::@@IPv4:DstIP:/@@ESTRING:DstPort: @(@ESTRING::)@ to @ESTRING:::@@IPv4:SrcIP:/@@ESTRING:SrcPort: @(@ESTRING::)@</pattern> </patterns> <examples> <example> <test_message program='%ASA'>Built outbound UDP connection 55101037 <(55)%20101%20037> for outside:X.X.X.X/X (X.X.X.X/X) to inside:X.X.X.X/X (X.X.X.X/X)</test_message> </example> </examples> </rule> <rule id='4a586711-ebe2-dc4d-bf6e-e512666d8c5d' class='system' provider='%ASA'>  <patterns> <pattern>Built inbound @ESTRING:Protocol: @connection for faddr @IPv4:SrcIP:/@@ESTRING:SrcPort: @gaddr @IPv4:GlobalIP:/@@ESTRING:GlobalPort: @laddr @IPv4:LocalIP:/@@ESTRING:LocalPort:@</pattern> </patterns> <examples> <example> <test_message program='%ASA'>Built inbound ICMP connection for faddr X.X.X.X/X gaddr X.X.X.X/X laddr X.X.X.X/X</test_message> </example> </examples> </rule> <rule id='8be7928d-66e7-7042-abd5-869d6b49c56e' class='system' provider='%ASA'>  <patterns> <pattern>Built inbound @ESTRING:Protocol: @connection @ESTRING:: @for @ESTRING::@@IPv4:SrcIP:/@@ESTRING:SrcPort: @(@ESTRING::)@ to identity:@IPv4:DstIP:/@@ESTRING:DstPort: @(@ESTRING::)@</pattern> </patterns> <examples> <example> <test_message program='%ASA'>Built inbound UDP connection 55101078 <(55)%20101%20078> for inside:X.X.X.X/X (X.X.X.X/X) to identity:X.X.X.X/X (X.X.X.X/X)</test_message> </example> </examples> </rule> <rule id='20aee256-b4f0-8b4d-93cb-263d5338fd21' class='system' provider='%ASA'>  <patterns> <pattern>Teardown @ESTRING:Protocol: @connection @ESTRING:: @for @ESTRING:::@@IPv4:SrcIP:/@@ESTRING:SrcPort: @to identity:@IPv4 :DstIP:/@@ESTRING:DstPort: @duration@ANYSTRING::@</pattern> </patterns> <examples> <example> <test_message program='%ASA'>Teardown UDP connection 55101084 <(55)%20101%20084> for inside:X.X.X.X/X to identity:X.X.X.X/X duration 0:02:01 bytes 88</test_message> </example> </examples> </rule> <rule id='e075efdc-c25f-5e49-a208-7661e3b5a29b' class='system' provider='%ASA'>  <patterns> <pattern>Built dynamic @ESTRING:Protocol: @translation from @ESTRING:::@@IPv4:LocalIP:/@@ESTRING:LocalPort: @to @ESTRING:::@ @IPv4:GlobalIP:/@@ESTRING:GlobalPort:@</pattern> </patterns> <examples> <example> <test_message program='%ASA'>Built dynamic TCP translation from any:X.X.X.X/X to outside:X.X.X.X/X</test_message> </example> </examples> </rule> <rule provider='%ASA' class='system' id='39'> <patterns> <pattern>Cleared @ESTRING:: @urgent flag from @ESTRING:::@ @ESTRING::/@@NUMBER::@ to @ESTRING: ::@@ESTRING::/@@NUMBER::@</pattern> <pattern>regular translation creation failed for @ESTRING:: @src @ESTRING:::@@ESTRING:: @dst @ESTRING: ::@@ESTRING:: @(type @NUMBER::@, code @NUMBER::@</pattern> </patterns> </rule> </rules> </ruleset> </patterndb> N�n�r��)em�h�yhiם�w^�� ____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product= syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq ____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product= syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

2 1

syslog-ng 3.14 unofficial fedora / RHEL packages
by Czanik, Péter 05 Mar '18

05 Mar '18

Hi, My unofficial syslog-ng packages for Fedora & RHEL/CentOS 7 are now available. syslog-ng now compiles and works fine on Fedora 27, 28, Rawhide and RHEL 7. Note that as the bundled amqp and mongodb libraries do not compile with openssl 1.1, these features are disabled on all Fedora releases. TCP wrapper support was removed from Fedora and thus also from my packages. All of these are still enabled on RHEL. I hope to spare some time for RHEL 6 packages and make those available later this week. Packages are available at https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng314/ Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://syslog-ng.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0

syslog-ng 3.14 unofficial openSUSE / SLES packages
by Czanik, Péter 05 Mar '18

05 Mar '18

Hi, My unofficial syslog-ng packages for openSUSE & SLES are now available. I changed tons of things in packaging (got rid of SLES 11 / sysvinit support) and thus simplified it greatly. It works perfectly for me, but that's a single environment, so any feedback is greatly appreciated. syslog-ng now compiles and works fine on openSUSE Leap, Tumbleweed and SLES 12. Note that as the bundled amqp and mongodb libraries do not compile with openssl 1.1, these features are disabled for Tumbleweed (and will be disabled also for SLES/Leap 15). I started to work on SLES 15 support, but due to some dependency problems that's not yet available. Packages are available at https://build.opensuse.org/project/show/home:czanik:syslog-ng314 Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://syslog-ng.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0

syslog-ng 3.14 on FreeBSD
by Czanik, Péter 05 Mar '18

05 Mar '18

Hi, As you can see on Freshports ( https://www.freshports.org/sysutils/syslog-ng314/ ) syslog-ng 3.14 is available now in the FreeBSD ports. Please test it and let us know if you run into any problems with it. We plan to update the syslog-ng metaport to version 3.14 later this week if no blocking problems are found. Thanks for your feedback! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://syslog-ng.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0