- syslog-ng - lists.balabit.hu

Need to parse named query log entries and get just the domain portion
by Robert Webb 27 Oct '17

27 Oct '17

So I have a situation where I have a syslog feed coming in that is sending named (BIND9) query logs. On the DNS servers themselves, we are doing sink hole via a local zone file and sending the dns response back as 127.0.0.1. Since there is no way for BIND9 to give me logging of the DNS query response back to the user, I need to be able to take a query log entry, parse it to get just the domain portion, and then match the domain to a list. I am trying to do all this inside syslog-ng. I have been given some guidance to use a pattern database. I worked with this and am successfully matching my incoming query log data. Using the pdbtool, I get a full match and a list of the values I expect. But where I run into an issue after searching through all the documentation is, where can these values be used? I tried building a template against a destination, and none of the values populate. So I am stuck at this point. I have also been told that I may have to do a custom python parser instead. Any help or guidance is appreciated. Here is my rule: <rule provider="balabit" id="b0ca071d-309e-454a-8e31-721b01ef55ee" class="system"> <patterns> <pattern>queries: info: client @IPvANY:named.client.ip@#@NUMBER:named.client.port:@ @ESTRING:named.domain.name::@ query: @HOSTNAME:named.host.name:@ @STRING:@ @STRING:named.record.type:@ @ESTRING:named.record.flags: @(@IPvANY:named.server.ip@)</pattern> </patterns> <examples> <example> <test_message program="named">client 213.46.246.51#1890: query: tumtali.fegade.com IN A - (103.5.198.211)</test_message> <test_values> <test_value name="named.client.ip">213.46.246.51</test_value> <test_value name="named.client.port">1890</test_value> <test_value name="named.domain.name">tumtali.fegade.com</test_value> <test_value name="named.record.type">A</test_value> <test_value name="named.record.flags">-</test_value> <test_value name="named.server.ip">103.5.198.211</test_value> </test_values> </example> <example> <test_message program="named">client 10.187.195.186#40441: query: banister.paars.tld IN A -EDC (10.226.134.25)</test_message> <test_values> <test_value name="named.client.ip">10.187.195.186</test_value> <test_value name="named.client.port">40441</test_value> <test_value name="named.domain.name">banister.paars.tld</test_value> <test_value name="named.record.type">A</test_value> <test_value name="named.record.flags">-EDC</test_value> <test_value name="named.server.ip">10.226.134.25</test_value> </test_values> </example> <example> <test_message program="named">queries: client 192.168.102.189#58454: query: maps.googleapis.com IN A + (192.168.102.2)</test_message> <test_values> <test_value name="named.client.ip">192.168.102.189</test_value> <test_value name="named.client.port">58454</test_value> <test_value name="named.domain.name">maps.googleapis.com</test_value> <test_value name="named.record.type">A</test_value> <test_value name="named.record.flags">+</test_value> <test_value name="named.server.ip">192.168.102.2</test_value> </test_values> </example> </examples> <values> </values> <tags> <tag>named</tag> <tag>queries</tag> </tags> </rule> Here are test results: Pattern matching part: queries: info: client @IP:named.client.ip=137.75.76.138@#@NUMBER:named.client.port=38643@ @ESTRING:named.domain.name=(sr.symcb.com)@ query: @HOSTNAME:named.host.name=sr.symcb.com@ @STRING:None=IN@ @STRING:named.record.type=A@ @ESTRING:named.record.flags=+E@(@IP:named.server.ip=137.75.75.75@) Matching part: queries: info: client 137.75.76.138#38643 (sr.symcb.com) query: sr.symcb.com IN A +E (137.75.75.75) Values: MESSAGE=queries: info: client 137.75.76.138#38643 (sr.symcb.com) query: sr.symcb.com IN A +E (137.75.75.75) PROGRAM=named .classifier.class=system .classifier.rule_id=b0ca071d-309e-454a-8e31-721b01ef55ee named.client.ip=137.75.76.138 named.client.port=38643 named.domain.name=(sr.symcb.com) named.record.type=A named.server.ip=137.75.75.75 named.host.name=sr.symcb.com named.record.flags=+E TAGS=.classifier.system,named,queries

1 0

test email
by Scheidler, Balázs 27 Oct '17

27 Oct '17

Hi, This is just to test if email sending to a new subscriber works as intended. -- Bazsi

1 0

syslog-ng stats to ES ?
by Scot 26 Oct '17

26 Oct '17

Hi, Looked around for a few hours and didn't see anything. Has anyone worked on sending syslog-ng stats to ES ? I see several ways I could but wondering if anyone has already. A push method directly from syslog-ng would be awesome. Scot

4 13

Insider 2017-10: Hadoop; web interfaces; OSE to PE; vDay;
by Czanik, Péter 24 Oct '17

24 Oct '17

Dear syslog-ng users, This is the 62nd issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Hadoop destination ------------------ Petabytes of data are now collected into huge data lakes around the world. Hadoop is the technology enabling this. While syslog-ng was able write logs to Hadoop using some workarounds (mounting HDFS through FUSE) for quite some time, the Java-based HDFS destination driver in syslog-ng provides both better performance and more reliability. Learn about HDFS support in syslog-ng and about features introduced in recent versions: https://www.balabit.com/blog/filling-your-data-lake-with-log-messages-the-s… Web interfaces for syslog-ng ---------------------------- This is the 2017 edition of syslog-ng web-based Graphical User Interfaces (web GUIs) blog. Many things have changed in the past few years. In 2011 only a single Logging as a service (LaaS) solution was available, now we regularly run into yet another one. Also, the number of logging-related GUIs is growing, so we will mostly focus on syslog-ng based solutions. https://www.balabit.com/blog/web-interfaces-for-your-syslog-server-an-overv… Upgrading from syslog-ng OSE to PE ---------------------------------- The syslog-ng application has two different editions. Most of my readers use syslog-ng Open Source Edition (OSE). There is also a commercial version of syslog-ng, called syslog-ng Premium Edition (PE). It comes with a few extra features, as well as commercial support. Upgrading from OSE to PE or the other way around is not automated and not even always possible. This is due to feature set differences, OSE and PE share a common core but have a different focus. Learn about some of the limitations and some tips about upgrading. https://www.balabit.com/blog/upgrading-from-syslog-ng-open-source-to-premiu… EVENTS Virtualization day in Budapest, November 7th: https://vday.hu/2017/ NEW RELEASES: syslog-ng OSE 3.12.1: https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.12.1 syslog-ng PE 7.0.5: https://www.balabit.com/documents/syslog-ng-pe-7.0-guides/en/syslog-ng-pe-g… Your feedback and news, or tips about the next issue are welcome at documentation(a)balabit.com. To read this newsletter online, visit: https://syslog-ng.org/ Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0

collecting SAR data
by Jim Hendrick 17 Oct '17

17 Oct '17

Hi, Does anyone have experience pulling performance data from sysstat (sar) with syslog-ng (or even *cough* rsyslog...) Looking to automate the performance metrics and it seems like it should be straightforward. What I would like is to pull the text output that is generated every ~10 minutes by default without having to run a different cron across all the systems. (that is - I get that I could probably modify the "sa1" script or write another one to dump the data to a socket or something for syslog to pick up. I am hoping to just do something to monitor the data that is automatically generated. - something like using any file in /var/log/sa/sar?? as a source) The end system (for me at the moment) would be splunk so parsing the different format data *could* be pushed to that end or could be done with patterndb or something else on the syslog-ng side. Thoughts? Thanks in advance!! Jim

1 0

Re: [syslog-ng] [syslog
by james.r.hendrick 17 Oct '17

17 Oct '17

Do you mean the internal stats facility?I would look into the elasticsearch native destination if you are not already. Jim Sent from my Verizon, Samsung Galaxy smartphone -------- Original message --------From: Evan Rempel <erempel(a)uvic.ca> Date: 10/16/17 11:01 AM (GMT-05:00) To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog I have a perl script that collects some stats and logs them to syslog again. The syslog stream gets sent to ES, so they end up there, but as a syslog line, not a specific statistic item for things like grafana. On 10/15/2017 05:57 PM, Scot wrote: > Hi, > > Looked around for a few hours and didn't see anything. > > Has anyone worked on sending syslog-ng stats to ES ? > I see several ways I could but wondering if anyone has already. A push method directly from syslog-ng would be awesome. > > Scot > ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

3 2

Re: [syslog-ng] [syslog
by james.r.hendrick 17 Oct '17

17 Oct '17

Yeah, probably separate source / dest and maybe parsed for better formatting.Send it in json perhaps. Sent from my Verizon, Samsung Galaxy smartphone -------- Original message --------From: Scot <scotrn(a)gmail.com> Date: 10/16/17 6:24 PM (GMT-05:00) To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] [syslog Yep but how do you get that to a d_es destination without adding an external tool ? My understanding of the purpose is that stats may stop getting updated if the pipeline fails so It needs to be a separate "thread" but seems like that would be handled in separate src and destination definitions ? i.e. Keep your stats/monitoring separate from the data stream. On Mon, Oct 16, 2017 at 11:43 AM, james.r.hendrick <james.r.hendrick(a)gmail.com> wrote: Do you mean the internal stats facility?I would look into the elasticsearch native destination if you are not already. Jim Sent from my Verizon, Samsung Galaxy smartphone -------- Original message --------From: Evan Rempel <erempel(a)uvic.ca> Date: 10/16/17 11:01 AM (GMT-05:00) To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog I have a perl script that collects some stats and logs them to syslog again. The syslog stream gets sent to ES, so they end up there, but as a syslog line, not a specific statistic item for things like grafana. On 10/15/2017 05:57 PM, Scot wrote: > Hi, > > Looked around for a few hours and didn't see anything. > > Has anyone worked on sending syslog-ng stats to ES ? > I see several ways I could but wondering if anyone has already. A push method directly from syslog-ng would be awesome. > > Scot > ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

$FULLHOST doesn't work
by Thomas Haupt 16 Oct '17

16 Oct '17

Hi, I'm trying to use the hostname from inside the syslog message as filename but it doesn't work for me: https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-… my config: @version: 3.9 options { keep_hostname(yes); use-dns(no); }; source s_system { udp(ip("0.0.0.0") port(514)); }; destination d_all { file("/tmp/${FULLHOST}.log"); }; log { source(s_system); destination(d_all); }; The result is my ip address instead of "my-hostname", but I expect "my-hostname": syslog-ng -Fevd .... [2017-10-16T10:32:15.188058] Incoming log entry; line='<14>1 2017-10-16T10:32:15.151157+02:00 my-hostname lampelogtest 54321 111111 - Test syslog message' [2017-10-16T10:32:15.188327] Initializing destination file writer; template='/tmp/${FULLHOST}.log', filename='/tmp/10.3.25.4.log' Some more information: syslog-ng --version syslog-ng 3.9.1 Installer-Version: 3.9.1 Revision: Module-Directory: /usr/lib64/syslog-ng Module-Path: /usr/lib64/syslog-ng Available-Modules: add-contextual-data,afamqp,affile,afprog,afsocket,afstomp,afuser,basicfuncs,cef,confgen,cryptofuncs,csvparser,date,dbparser,disk-buffer,graphite,json-plugin,kvformat,linux-kmsg-format,pseudofile,syslogformat,system-source,tfgetent Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: off The system is a SLES11SP4 Regards, Thomas

4 4

in-list filter with MESSAGE
by Gopi Joshi 15 Oct '17

15 Oct '17

I am trying to filter messages matching text stored in a txt file (plain txt , exact match , one word each line). but its not working filter f_userlist { in-list("/etc/syslog-ng/userlist.list", value("MESSAGE")); }; ---> NOT WORKING however it works with value(“PROGRAM”) filter f_whitelist { in-list("/etc/syslog-ng/programlist.list", value("PROGRAM")); }; --->WORKING List ( userlist.list ) is not long and has less than 10 words to match. anything missing ? or in-list filter doenot work with message contents . any troubleshooting tips will e helpful.

4 4

unofficial syslog-ng packages: OBS status
by Laszlo Budai 14 Oct '17

14 Oct '17

Hi, if you get 'connection failed' error while you are trying to access the OBS repository, please check status of OBS : https://status.opensuse.org/ openSUSE status page<https://status.opensuse.org/> Stay up to date with the latest service updates from openSUSE status page. status.opensuse.org regards, Laszlo Budai

1 0

Questions regarding support for syslog-ng
by Diana Wiener 12 Oct '17

12 Oct '17

Hi I'm collecting information on various dependencies within infrastructure for internal tracking. I looked on the website and through your documentation and cannot locate the answers needed, so I am reaching out to the mailing list. I was wondering if you can give me any sense of what your cadence for releasing updates for syslog-ng. - Do you have a routine release cadence for updates? If so, what is it (e.g. monthly, every third Tuesday, etc.) If there is no set cadence, can you give me a rough sense of how often you release updates? - How do you deal with potential security vulnerabilities? What does your patching procedure look like? Is it typically visible to users? I am sure you can't give me a ton of detail, but we'd like to be able to document what our dependencies look like and how often we might be falling behind so we can adjust our own roadmaps accordingly. Thanks in advance for any information you can offer! Diana -- Diana Wiener Customer Life Cycle Manager, Support diana.wiener(a)acquia.com

2 1

Trouble installing latest syslog-ng from Laszlo
by Clayton Dukes 06 Oct '17

06 Oct '17

Hi Guys, I'm wondering if I'm doing something wrong or if there's a package issue in the latest deb release. root@estreamer:~# cat /etc/apt/sources.list.d/syslog-ng.list deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/xUb… ./<http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/xUb…> root@estreamer:~# apt-get install syslog-ng Reading package lists... Done Building dependency tree Reading state information... Done Some packages could not be installed. This may mean that you have requested an impossible situation or if you are using the unstable distribution that some required packages have not yet been created or been moved out of Incoming. The following information may help to resolve the situation: The following packages have unmet dependencies: syslog-ng : Depends: syslog-ng-mod-sql but it is not going to be installed Depends: syslog-ng-mod-mongodb but it is not going to be installed Depends: syslog-ng-mod-json but it is not going to be installed Recommends: syslog-ng-mod-mysql but it is not going to be installed Recommends: syslog-ng-mod-pgsql but it is not going to be installed Recommends: syslog-ng-mod-sqlite3 but it is not going to be installed Recommends: syslog-ng-mod-freetds but it is not going to be installed Recommends: syslog-ng-mod-smtp but it is not going to be installed Recommends: syslog-ng-mod-amqp but it is not going to be installed Recommends: syslog-ng-mod-geoip but it is not going to be installed Recommends: syslog-ng-mod-redis but it is not going to be installed Recommends: syslog-ng-mod-stomp but it is not going to be installed Recommends: syslog-ng-mod-riemann but it is not going to be installed Recommends: syslog-ng-mod-graphite but it is not going to be installed Recommends: syslog-ng-mod-python but it is not going to be installed Recommends: syslog-ng-mod-add-contextual-data but it is not going to be installed Recommends: syslog-ng-mod-getent but it is not going to be installed Recommends: syslog-ng-mod-stardate but it is not going to be installed Recommends: syslog-ng-mod-map-value-pairs but it is not going to be installed Recommends: syslog-ng-mod-snmptrapd-parser but it is not going to be installed Recommends: syslog-ng-mod-geoip2 but it is not going to be installed Recommends: syslog-ng-mod-pacctformat but it is not going to be installed Recommends: syslog-ng-mod-elastic but it is not going to be installed Recommends: syslog-ng-mod-http but it is not going to be installed E: Unable to correct problems, you have held broken packages. [id:image001.png@01D306E3.0FEBC990] Clayton Dukes Founder & CEO LogZilla Corporation 2900 N. Quinlan Park Rd, B240-341 Austin, TX, 78732 Tel: 936-4NetOps (463-8677) Web: www.logzilla.net<http://www.logzilla.net/> [id:image002.png@01D306E3.0FEBC990]<https://twitter.com/logzilla>[id:image003.png@01D306E3.0FEBC990]<https://youtu.be/drg5wv_mgfA>[id:image004.png@01D306E3.0FEBC990]<https://www.linkedin.com/in/lzcdukes/> For NetOps, By NetOps!

3 5

cross compiling syslog-ng
by Scheidler, Balázs 05 Oct '17

05 Oct '17

hi, I've figured I would give syslog-ng cross compilation a spin to check if everything is all right with our sources. Here's a description on how I've cross-compiled syslog-ng to arm64. *1) toolchain* I've used the docker based cross-compile toolchain from here: https://github.com/dockcross/dockcross You'll need docker on your build machine, see docker.com for intallation instructions. To use that, you'll only need to launch a docker command line and it would automatically fetch the image from the docker registry. I've used linux-arm64 as an example, but I guess the others would also work. *2) sources* You will need the release tarball. Please note that you can download both the release tarball and a git snaphot from github, but you'll definitely need the release tarball if you don't have all the build requirements installed (automake, libtool and friends). I've used https://github.com/balabit/syslog-ng/releases/download/syslog-ng-3.12.1/sys… 3) get the dockcross helper ``` $ docker run --rm dockcross/linux-arm64 > dockcross $ chmod +x dockcross ``` *4) launch the cross-compile environment* Extract the sources (e.g. tar xvfz syslog-ng-3.12.1.tar.gz) into a directory, cd into it and launch the environment: ``` $ dockcross bash ``` This will give you a shell within the container, with a /work directory containing the sources. *5) install dependencies* ``` # this one fixes an issue within the container, "cpp" is unfortunately only available # with a versioned binary, which the configure script does not find. $ sudo ln -s /usr/bin/aarch64-linux-gnu-cpp-4.9 /usr/bin/aarch64-linux-gnu-cpp # this is the minimal set of dependencies to compile syslog-ng, you might need others # the bundled sources should however give you a pretty ok feature set $ sudo apt-get install libglib2.0-dev:arm64 pkg-config:arm64 ``` *6) build* ``` $ mkdir build $ cd build $ /work/configure --host aarch64-linux-gnu <long configure output> $ make ``` *7) install* ``` $ make install DESTDIR=/work/build/install ``` The resulting set of binaries you will find in /work/build/install, as if it was installed in the root system (e.g. /usr/local/bin/syslog-ng would become /work/build/install/usr/local/bin/syslog-ng) *8) collect binaries* Exit the docker container, your build products will be in the "build" subdirectory of your source tree, with build/install containing the final binaries. bazsi@bzorp:~/src/syslog-ng-3.12.1/build/install$ file usr/local/sbin/syslog-ng usr/local/sbin/syslog-ng: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, for GNU/Linux 3.7.0, BuildID[sha1]=424c7a32112262725b267e6043c25bd40d039568, not stripped I hope this helps. -- Bazsi On Thu, Oct 5, 2017 at 10:37 AM, Scheidler, Balázs < balazs.scheidler(a)balabit.com> wrote: > Hi, > > This might actually be a libtool issue, trying to locate the file in an > invalid location. Do you have libtool in your toolchain? In order to use > the one in your toolchain, you will need the complete set of autotools and > rerun autogen.sh to regenerate all build files. > > BTW: the AX_PREFIX_CONFIG_H macro is also part of autoconf-archive ( > https://www.gnu.org/software/autoconf-archive/ax_prefix_config_h.html) > but probably a later version than what you have. > > But you can always add these macros by downloading them explicitly and > adding them to the m4 subdirectory. > > -- > Bazsi > > On Wed, Oct 4, 2017 at 4:35 PM, Benoit Duffez <notifications(a)github.com> > wrote: > >> I have not solved it. It accepts to compile but the linker seems to fail: >> >> CCLD lib/libsyslog-ng.la >> libtool: link: warning: library `/opt/toolchains/sysroots/cortexa9hf-neon-poky-linux-gnueabi/usr/lib/libgmodule-2.0.la' was moved. >> libtool: link: warning: library `/opt/toolchains/sysroots/cortexa9hf-neon-poky-linux-gnueabi/usr/lib/libgthread-2.0.la' was moved. >> libtool: link: warning: library `/opt/toolchains/sysroots/cortexa9hf-neon-poky-linux-gnueabi/usr/lib/libglib-2.0.la' was moved. >> libtool: link: warning: library `/opt/toolchains/sysroots/cortexa9hf-neon-poky-linux-gnueabi/usr/lib/libpcre.la' was moved. >> libtool: link: warning: library `/opt/toolchains/sysroots/cortexa9hf-neon-poky-linux-gnueabi/usr/lib/libuuid.la' was moved. >> sed: can't read /usr/lib/libglib-2.0.la: No such file or directory >> libtool: link: `=/usr/lib/libglib-2.0.la' is not a valid libtool archive >> Makefile:7092: recipe for target 'lib/libsyslog-ng.la' failed >> make[2]: *** [lib/libsyslog-ng.la] Error 1 >> Makefile:16376: recipe for target 'all-recursive' failed >> make[1]: *** [all-recursive] Error 1 >> Makefile:6285: recipe for target 'all' failed >> make: *** [all] Error 2 >> >> I think it's a PATH issue because I do have this libglib-2.0.la file, >> just not at /usr/bin (but in a subfolder of /opt/toolchains) >> >> — >> You are receiving this because you are subscribed to this thread. >> Reply to this email directly, view it on GitHub >> <https://github.com/balabit/syslog-ng/issues/1705#issuecomment-334176270>, >> or mute the thread >> <https://github.com/notifications/unsubscribe-auth/AArldnMjDwe5Mfaj6m3FPTfid…> >> . >> > >

2 1

Repository key issue
by Sandbox 05 Oct '17

05 Oct '17

Hai, Are you know your key has some error since ~13:00: GPG error: http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/xUb… ./ BADSIG 3B92A8D27CFDAEDD home:laszlo_budai:syslog-ng OBS Project < home:laszlo_budai:syslog-ng@build.opensuse.org> Regards, Robert

1 0

UDP devices stop logging after network services restart.
by Vincenti Francesco 05 Oct '17

05 Oct '17

Hello I have syslog-ng 3.7 installed on a CentOS7 Server with 4G RAM and 4 CPU. The server is receiving logs from almost 300 devices, either network devices (UDP) and servers (TCP). The problem I have is the following: to reduce incoming traffic on initial two NICs I added two more NICs to the server, where I sent some UDP devices and it worked immediately, without any issue. But when I restarted network services (systemctl restart network) the devices stopped to log, they restarted only after I resent them to the initial NIC, without any other action on syslog-ng server. When I started syslog-ng in debug mode to verify this behavior I saw that these devices ARE NOT considered by syslog-ng at all, they are not present in logs generated by debug, but they REACH the server (tcpdump shows them entering). I'm getting mad about this issue, any suggestion will be welcome. Following my configuration files: - /etc/syslog-ng/syslog-ng.conf # Note: it also sources additional configuration files (*.conf) # located in /etc/syslog-ng/conf.d/ options { flush_lines (0); time_reopen (10); log_fifo_size (1000); chain_hostnames (off); use_dns (persist_only); dns-cache-hosts(/etc/hosts); use_fqdn (no); create_dirs (yes); keep_hostname (yes); owner ("1007"); group ("1007"); dir_owner ("1007"); dir_group ("1007"); dir_perm (0750); }; source s_sys { system(); internal(); # udp(ip(0.0.0.0) port(514)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" flush_lines(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_kern { file("/var/log/kern"); }; destination d_mlal { usertty("*"); }; destination d_auth_loc { network ("127.0.0.1" port (601) ); }; filter f_kernel { facility(kern); }; filter f_default { level(info..emerg) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_auth { facility(authpriv); }; filter f_mail { facility(mail); }; filter f_emergency { level(emerg); }; filter f_news { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_boot { facility(local7); }; filter f_cron { facility(cron); }; #log { source(s_sys); filter(f_kernel); destination(d_cons); }; log { source(s_sys); filter(f_kernel); destination(d_kern); }; log { source(s_sys); filter(f_default); destination(d_mesg); }; log { source(s_sys); filter(f_auth); destination(d_auth); destination(d_auth_loc); }; log { source(s_sys); filter(f_mail); destination(d_mail); }; log { source(s_sys); filter(f_emergency); destination(d_mlal); }; log { source(s_sys); filter(f_news); destination(d_spol); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; log { source(s_sys); filter(f_cron); destination(d_cron); }; # Source additional configuration files (.conf extension only) @include "/etc/syslog-ng/conf.d/*.conf" # vim:ft=syslog-ng:ai:si:ts=4:sw=4:et: - /etc/syslog-ng/conf.d/network_dev.conf source s_network_appa { network ( ip(0.0.0.0) port (514) transport ("udp") so-rcvbuf (4096000) ); }; # Destinazioni destination d_network_udp { file("/var/log/syslog-ng/APPARATI/${YEAR}${MONTH}${DAY}/${HOST}/${YEAR}${MONTH}${DAY}_hh${HOUR}_${HOST}" create_dirs(yes) dir_perm(0755) perm(0755) ) ; }; filter f_appa_rete { not host ("SymantecServer") and not host ("part8") and not host ("parti") and not host ("partd") and not host ("part1") and not host ("parte") and not host ("part10") and not host ("part11") and not host ("part12") and not host ("part3") and not host ("part6") and not host ("part8") and not host ("part9") and not host ("parta") and not host ("partc") and not host ("partd") and not host ("partf") and not host ("partg") and not host ("parth") and not host ("partn") and not host ("parto") and not host ("SLITES8736.sercom.aspasiel.it<http://SLITES8736.sercom.aspasiel.it>") and not host ("172.23.112.47") and not host ("SLITES4557.sercom.aspasiel.it<http://SLITES4557.sercom.aspasiel.it>") and not host ("172.23.X.Y") and not host ("SLITES4558.sercom.aspasiel.it<http://SLITES4558.sercom.aspasiel.it>") and not host ("172.23.X.Y") and not host ("SLITES4559.sercom.aspasiel.it<http://SLITES4559.sercom.aspasiel.it>") and not host ("172.23.X.Y") and not host ("SLITES4560.sercom.aspasiel.it<http://SLITES4560.sercom.aspasiel.it>") and not host ("172.23.X.Y") and not host ("SLITES8731.sercom.aspasiel.it<http://SLITES8731.sercom.aspasiel.it>") and not host ("172.23.X.Y") and not host ("SLITES8732.sercom.aspasiel.it<http://SLITES8732.sercom.aspasiel.it>") and not host ("172.23.X.Y") and not host ("SLITES8733.sercom.aspasiel.it<http://SLITES8733.sercom.aspasiel.it>") and not host ("172.23.X.Y") and not host ("SLITES8734.sercom.aspasiel.it<http://SLITES8734.sercom.aspasiel.it>") and not host ("172.23.X.Y") and not host ("SLITES8735.sercom.aspasiel.it<http://SLITES8735.sercom.aspasiel.it>") and not host ("172.23.X.Y") and not host ("slitdd2727"); }; log { source(s_network_appa); filter(f_appa_rete); destination(d_network_udp); }; - /etc/syslog-ng/conf.d/server_TCP.conf source s_server_sop { network ( ip(0.0.0.0) port(601) transport("tcp") max-connections(200) log_fetch_limit(100) log_iw_size(20000) ); }; destination d_server_sop { file("/var/log/syslog-ng/SERVER/${YEAR}${MONTH}${DAY}/${HOST}/${YEAR}${MONTH}${DAY}_hh${HOUR}_${HOST}" create_dirs(yes) dir_perm(0755) perm(0755) flush_lines(100) ); }; # Indirizzo le destinazioni. log { source(s_server_sop); destination(d_server_sop); flags(flow-control); }; I changed the following kernel parameters as follow: net.core.rmem_max = 4096000 net.core.wmem_max = 4096000 Thanks in advance Francesco Vincenti RHCSA Area Data Center Open Source, Quality and Security Aspasiel Divisione della Società Acciai Speciali Terni S.p.A. con Unico Socio Strada di Pentima, 3 - 05100 Terni francesco.vincenti(a)acciaiterni.it<mailto:francesco.vincenti@acciaiterni.it> www.aspasiel.it<http://www.aspasiel.it/> Ufficio: +39 0744 203224 Fax: +39 0744 203444 This e-mail and any attachments is a confidential correspondence intended only for use of the individual or entity named above. If you are not the intended recipient or the agent responsible for delivering the message to the intended recipient, you are hereby notified that any disclosure, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the error at the following email address: helpdesk(a)aspasiel.it<mailto:helpdesk@aspasiel.it> or at Aspasiel Helpdesk Team by phone (phone number +390744203555), and then delete this message from your system. P Please consider our environment and think before you print. Thank you! q

3 6

Re: [syslog-ng] Cross-compiling syslog-ng 3.11.1 for an embedded application.
by Chris_Johnson＠trendmicro.com 04 Oct '17

04 Oct '17

I had similar issues when I first started using syslog-ng (I think we started with v2.8) in our embedded system. Specifically we were using SVN for source code control and the automated ‘build’ would do a fresh checkout every time. This screwed up the timestamps on the source files and syslog-ng was trying to rebuild files that really didn’t need it. My solution was to add a section to my Makefile that would ‘touch’ the relevant files to avoid this problem (also, the utilities syslog-ng uses were a newer version of the same utilities used elsewhere in our build, and each would break the other; so we couldn’t just let them be rebuild every time). Definitions for vars used in the Makefile: # define ROOTDIR if undefined (RELPATH is where we *know* this Makefile is located under ROOTDIR) RELPATH := /ports/syslogd/syslog-ng ROOTDIR ?= $(subst $(RELPATH),,$(CURDIR)) STAGEDIR = $(CURDIR)/stage SOURCEDIR = syslog-ng-3.5.6 The relevant portion of the Makefile that resets the timestamps is: # We never need to rebuild 'Makefile.in' or 'configure' in production # commenting out rules for: # $(SOURCEDIR)/Makefile.in # $(SOURCEDIR)/configure.in # # commenting out pre-requisites for: # $(SOURCEDIR)/Makefile # config # # NOTE: syslog-ng 3.5.x needs to use autoconf v2.69 # automake v1.14 # # WARNING: Currently (as of 11/11/13) the rest of the build needs version(s): # autoconf v2.63 # automake v1.11 # and will fail when using the v2.69 (v1.14) versions! # # If 'configure' and/or any 'Makefile.in' file(s) need to be updated, # you will have 'switch' between the two versions of autoconf/automake; # using 2.69/1.14 for syslog-ng and 2.63/1.11 for the rest of the build. # # force 'foreign' strictness (this is how Makefiles from syslog-ng were made) # see www.gnu.org/software/automake/manual for more info #$(SOURCEDIR)/Makefile.in: $(SOURCEDIR)/Makefile.am # cd $(SOURCEDIR); \ # automake --foreign # 3.3.x uses 'older' nomenclature of 'configure.in' (instead of 'configure.ac') # 3.5.x now uses 'configure.ac' nomenclature # see www.gnu.org/software/autoconf/manual for more info #$(SOURCEDIR)/configure: $(SOURCEDIR)/configure.in # cd $(SOURCEDIR); \ # autoconf # build a new 'Makefile' if 'Makefile.in' or 'configure' is newer # or this Makefile is newer (assume a change to configure parameter list) #$(SOURCEDIR)/Makefile: $(SOURCEDIR)/Makefile.in $(SOURCEDIR)/configure Makefile # # Force 'recipe' to NOT run in parallel (.NOTPARALLEL:). # This allows the 'kludge' for timestamps to work correctly! # Without this, the two sets of touches occur virtually simultaneously since # each command in the 'recipe' runs in its own shell AND the shells run in # parallel, the 'sleep' command isn't causing the second set of touches # to generate a different timestamp from the first set of touches. # # This seems to be causing random build errors on the EC build box as each # command is run in a different parallel order # .NOTPARALLEL: $(SOURCEDIR)/Makefile: make config ######################################################################## # kludge to fix 'svn checkout' timestamps messing up Makefile rules # - touch files to restore proper relative timestamps # # cfg-grammar.y needs to be older that the other -grammar.y files touch $(SOURCEDIR)/lib/cfg-grammar.y sleep 1 find $(SOURCEDIR) -name .svn -prune -o -name cfg-grammar.y -prune -o -name "*-grammar.y" -exec touch {} \; # # touch 'configure' dependent files for d in \ . \ lib/ivykis \ modules/afamqp/rabbitmq-c \ modules/afmongodb/libmongo-client \ ;do for f in \ configure.ac \ aclocal.m4 \ Makefile.in \ config.h.in \ configure \ ;do touch $(SOURCEDIR)/$$d/$$f ; \ done ; \ done # # force '-grammar.y' files to be older than '-grammar.[ch]' files sleep 1 find $(SOURCEDIR) -name .svn -prune -o -name "*-grammar.[ch]" -exec touch {} \; # # force '.n' files to be younger than '.n.xml' files for f in \ loggen.1 \ pdbtool.1 \ syslog-ng.8 \ syslog-ng.conf.5 \ syslog-ng-ctl.1 \ ;do touch $(SOURCEDIR)/doc/man/$$f ; \ done # # touch any other files as needed touch $(SOURCEDIR)/lib/cfg-lex.h touch $(SOURCEDIR)/lib/cfg-lex.c ######################################################################## Also, related to this was the ‘clean’ feature that was removing too much: clean distclean: @# syslog-ng 3.5.x build system's clean is too clean and is deleting '-grammar' files @# requiring them to be rebuild... BUT the utilities needed are either missing or the @# wrong version to successfully be rebuild in the BUILD system(s)! @# @# So, manually clean! @# @#make -C $(SOURCEDIR) $@ || true @rm -rf $(STAGEDIR) @# @# walk through a list of dirs deleting them @for d in \ autom4te.cache \ .deps \ .libs \ ;do find $(SOURCEDIR) -depth -name .svn -prune -o -name $$d -exec rm -rf {} \; ; \ done @# @# walk through a list of file patterns deleting them @for fpat in \ config.h \ config.log \ config.status \ stamp-h1 \ libtool \ "*.pc" \ .dirstamp \ "*.l[ao]" \ "*.[ao]" \ ;do find $(SOURCEDIR) -name .svn -prune -o -name $$fpat -exec rm -f {} \; ; \ done @# @# delete Makefile(s) @for d in \ . \ lib/ivykis \ lib/ivykis/test \ lib/ivykis/src \ lib/ivykis/misc \ lib/ivykis/man3 \ lib/ivykis/contrib \ lib/ivykis/contrib/kojines \ lib/ivykis/contrib/iv_getaddrinfo \ modules/afamqp/rabbitmq-c \ ;do rm -f $(SOURCEDIR)/$$d/Makefile;\ done @# @# delete specific files not already covered @for f in \ scripts/update-patterndb \ tests/loggen/loggen \ lib/ivykis/src/include/iv.h \ modules/dbparser/pdbtool/pdbtool \ modules/afamqp/rabbitmq-c/examples/amqp_exchange_declare \ modules/afamqp/rabbitmq-c/examples/amqp_bind \ modules/afamqp/rabbitmq-c/examples/amqp_listenq \ modules/afamqp/rabbitmq-c/examples/amqp_unbind \ modules/afamqp/rabbitmq-c/examples/amqp_sendstring \ modules/afamqp/rabbitmq-c/examples/amqp_rpc_sendstring_client \ modules/afamqp/rabbitmq-c/examples/amqp_producer \ modules/afamqp/rabbitmq-c/examples/amqp_consumer \ modules/afamqp/rabbitmq-c/examples/amqp_listen \ syslog-ng/syslog-ng-ctl \ syslog-ng/syslog-ng \ ;do rm -f $(SOURCEDIR)/$$f; \ done Hope these snippets are useful starting points. Chris ------------------------------------- Christopher Johnson chris_johnson(a)trendmicro.com<mailto:chris_johnson@trendmicro.com> Trend Micro Inc. - Tippingpoint ------------------------------------- From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Robert King Sent: Wednesday, October 4, 2017 8:09 AM To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] Cross-compiling syslog-ng 3.11.1 for an embedded application. Not easily, and not without getting permission from the director of development. Let’s start with an easy question. …/syslog-ng/syslog-ng is a script. Is this part of the *final* distribution to be installed on the target system? There is also …/syslog-ng/.libs/syslog-ng with is an ELF binary executable. Is this part of the *final* distribution to be installed on the target system? Why are there two executable files with the same name? …/syslog-ng/.libs/syslog-ng is being natively built on a generic Linux Mint system, but not on my cross-development system. How do you suggest troubleshooting this? Going through the generated Makefile in the project root directory is a nightmare. There is no makefile in …/syslog-ng, so I can’t try to build just that. Sorry that I was irritated earlier, but I’ve been fighting this for three weeks and my boss is getting angry. From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Budai, László Sent: Wednesday, October 04, 2017 10:00 AM To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu<mailto:syslog-ng@lists.balabit.hu>> Subject: Re: [syslog-ng] Cross-compiling syslog-ng 3.11.1 for an embedded application. Hi, could you share a build environment where we can easily reproduce the issue(eg.: a docker file, or, image )? Laszlo Budai On Wednesday, October 4, 2017, Robert King <robert.king(a)tellabs.com<mailto:robert.king@tellabs.com>> wrote: From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu<javascript:_e(%7B%7D,'cvml','syslog-ng-bounces(a)lists.balabit.hu');>] On Behalf Of Scheidler, Balázs Sent: Tuesday, October 03, 2017 11:32 PM To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu<javascript:_e(%7B%7D,'cvml','syslog-ng(a)lists.balabit.hu');>> Subject: Re: [syslog-ng] Cross-compiling syslog-ng 3.11.1 for an embedded application. Hi, Again, so without your help and a civilized exchange of emails this can't be troubleshot, as I never saw your environment, and can't check various details that would affect compilation. What information would you like from me to progress? We are using gmake to build the targets. We are calling the configure script with the following arguments: PKG_CONFIG_PATH=$PCRERELEASE/lib/pkgconfig:$EVENTLOGRELEASE/lib/pkgconfig:$GLIBRELEASE/lib/pkgconfig \ SED=/bin/sed \ ./configure \ --host=$HOST \ PKG_CONFIG_PATH=$PCRERELEASE/lib/pkgconfig:$EVENTLOGRELEASE/lib/pkgconfig:$GLIBRELEASE/lib/pkgconfig \ --build=$BUILD \ --prefix=$INSTALLDIR \ --bindir=$INSTALLDIR/bin \ --sbindir=$INSTALLDIR/sbin \ --includedir=$INSTALLDIR/include \ --libdir=$INSTALLDIR/lib \ --sharedstatedir=$INSTALLDIR/share \ --exec-prefix=$EXECDIR \ --libexecdir=$EXECDIR/lib \ --localstatedir=$EXECDIR/etc/syslog-ng/var \ --sysconfdir=$EXECDIR/etc/syslog-ng/etc \ --enable-shared=yes \ --enable-ssl \ --enable-static=yes \ --enable-dynamic-linking=yes \ --disable-json \ --enable-pcre=no \ --with-libmongo-client=no \ --with-librabbitmq-client=no \ CC=$MVL/bin/ppc_440-gcc \ CFLAGS="-g -O2" \ CPP=$MVL/bin/ppc_440-cpp \ CPPFLAGS="-I$EVENTLOGRELEASE/include -I$GLIBRELEASE/include -I$TARGET/usr/include -I$TARGET/usr/local/include" \ LDFLAGS="-L/vobs/tools/openssl/openssl/release/$OS/lib -L$EVENTLOGRELEASE/lib -L$GLIBRELEASE/lib -L$TARGET/lib -L$TARGET/usr/lib" \ OPENSSL_CFLAGS="${OPENSSL_CC_INC_PATH} ${OPENSSL_CC_FIPS_INC_PATH} -DBUILD_WITH_SSL" \ OPENSSL_LIBS="-lssl -lcrypto" \ LIBS="-lssl -lcrypto" <table class="TM_EMAIL_NOTICE"><tr><td><pre> TREND MICRO EMAIL NOTICE The information contained in this email and any attachments is confidential and may be subject to copyright or other intellectual property protection. If you are not the intended recipient, you are not authorized to use or disclose this information, and we request that you notify us by reply mail or telephone and delete the original message from your mail system. </pre></td></tr></table>

1 0

Cross-compiling syslog-ng 3.11.1 for an embedded application.
by Robert King 04 Oct '17

04 Oct '17

Greetings! We are currently running syslog-ng v3.8.1 in an embedded Linux system. However, we want to upgrade to 3.11.1 in order to eliminate some memory leaks. Unfortunately we've run into a bit of a snag getting 3.11.1 to run on our target system. Under 3.8.1, syslogND is an ELF binary installed in the sbin directory. Under 3.11.1, it is a *script* installed in sbin. This script is trying to do some bad things including linking an executable (lt-syslog-ng, I believe.) We do not have a linker that will run on the target system. We cannot link anything. What is the reason behind this and how can it be circumvented? -- Robert King, Tellabs

5 11

syslog-ng 3.11 to elasticsearch 2.4.6
by Blake Pomeroy 29 Sep '17

29 Sep '17

Hello, I am trying to set up syslog-ng to elasticsearch, not using as the middleware. According to https://www.balabit.com/blog/elasticsearch-and-syslog-ng-fast-and-simple/ it is doable. However, I am not finding an example that works for my config. I have syslog-ng version 3.11 Elasticsearch 2.4.6 All running on one machine with Ubuntu 16.04. My syslog-ng is standard with the @include for the conf.d directory. In which I had hoped to create a working elsasticsearch.conf to define the how to send the logs. Likewise I have syslog-ng-mod-elasticsearch installed. Any help or pointing me to some examples would be great. Thanks Blake Pomeroy Security Engineer Cloud Engineering/InfoSec EBSCO Desk 978-356-6500 x3693 www.ebsco.com<http://www.ebsco.com> [cid:image001.png@01D3393C.98252AF0]

2 1

Bugfix releases?
by Fabien Wernli 29 Sep '17

29 Sep '17

Hi, While I'm very happy with the current rapid development cycle of syslog-ng, I can't stop wondering: what happened to bugfix releases? The quality of the releases is very high indeed, but regressions still appear now and then, and some users (not us) prefer the safe approach of sticking to one major release, and applying only bug fix releases. I think these people may have a hard time nowadays. What's the mailing-list reader's opinion on that? Cheers

2 1

syslog-ng web interfaces
by Czanik, Péter 28 Sep '17

28 Sep '17

Hi, Two years are almost like an eternity in IT, so I'm planning to update my blog about syslog-ng web interfaces: https://www.balabit.com/blog/web-interfaces-for-your-syslog-server-an-overv… End of life software will be removed, I will update information on others and if there are any new apps, I'm more than happy to add those. I need your help with the latest category. Are you aware of any software which you use as web GUI for syslog-ng but not listed in my blog? If yes, please let me know either here on the list or in a direct e-mail. Thanks, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0

unofficial syslog-ng 3.12 RPM packages
by Czanik, Péter 25 Sep '17

25 Sep '17

Hi, Syslog-ng 3.12 was released this morning. I have now my unofficial RPM packages available for openSUSE / SLES 12 / EPEL 7 (RHEL, CentOS, etc.). Fedora is missing from the list due to https://github.com/balabit/syslog-ng/issues/1669 You can read my updated installation instructions at https://www.balabit.com/blog/installing-latest-syslog-ng-on-rhel-and-other-… Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0

OSE 3.12
by Laszlo Budai 25 Sep '17

25 Sep '17

3.12.1 Features * HDFS: support macro in filename (#1638<https://github.com/balabit/syslog-ng/pull/1638>) * HDFS: add append support (#1675<https://github.com/balabit/syslog-ng/pull/1675>) * Java: allow to use sequence numbers in templates (#1628<https://github.com/balabit/syslog-ng/pull/1628>) * TLS improvements (#1603<https://github.com/balabit/syslog-ng/pull/1603>, #1636<https://github.com/balabit/syslog-ng/pull/1636>) * Add PKCS 12 support with the new pkcs12-file() TLS option * startup time ssl-options() and peer-verify() check * startup time key_file, cert_file, ca_dir, crl_dir and cipher_suite check * ECDH cipher support (OpenSSL 1.0.1, 1.0.2, 1.1.0) with the ecdh-curve-list() option (only available >= 1.0.2) * for < 1.0.2, a hard-coded curve is used * for >= 1.0.2, automatic curve selection is used (the ecdh-curve-list() option can restrict this list) * DH cipher support with the dhparam-file() option * if the option is not specified, fallback RFC 3526 parameters are used * minor fixes * stdin() source driver (#1605<https://github.com/balabit/syslog-ng/pull/1605>) * Implement read_old_records option for systemd-journal source (#1642<https://github.com/balabit/syslog-ng/pull/1642>) * Add tags-parser: a new module to parse $TAGS values (#1658<https://github.com/balabit/syslog-ng/pull/1658>) * Add a Windows eventlog parser scl module (#1572<https://github.com/balabit/syslog-ng/pull/1572>) * Add XML parser module (#1659<https://github.com/balabit/syslog-ng/pull/1659>, #1684<https://github.com/balabit/syslog-ng/pull/1684>) Bugfixes * Fix cannot parse ipv6 into hostname (#1617<https://github.com/balabit/syslog-ng/pull/1617>) * Speedup add-contextual-data by making ordering optional (#1645<https://github.com/balabit/syslog-ng/pull/1645>) * Fix monitor-method() option not working for wildcard-file() source (#1651<https://github.com/balabit/syslog-ng/pull/1651>) * Sanitize SDATA keys in syslog-protocol messages to avoid generating non-valid messages (#1650<https://github.com/balabit/syslog-ng/pull/1650>, #1654<https://github.com/balabit/syslog-ng/pull/1654>) * Fix memory leaks reported using Valgrind (#1649<https://github.com/balabit/syslog-ng/pull/1649>) * Fix memory leak related to cloning pipes and reload (#1647<https://github.com/balabit/syslog-ng/pull/1647>) * Fix getent protocol number returns incorrect value (#1665<https://github.com/balabit/syslog-ng/pull/1665>) * Fix elasticsearch2 destination flush mechanism (#1668<https://github.com/balabit/syslog-ng/pull/1668>) * Fix file destination related memory leak (#1685<https://github.com/balabit/syslog-ng/pull/1685>) * Fix a possible memory leak around affile destination (#1685<https://github.com/balabit/syslog-ng/pull/1685>) Other changes * Improve syslog-ng debun functionality (#1633<https://github.com/balabit/syslog-ng/pull/1633>, #1641<https://github.com/balabit/syslog-ng/pull/1641>, #1663<https://github.com/balabit/syslog-ng/pull/1663>) * Java: allow to set JVM options form global syslog-ng options (#1639<https://github.com/balabit/syslog-ng/pull/1639>) * Do steps towards Python 3 support: * Fix string compatibility for Python 3 (#1632<https://github.com/balabit/syslog-ng/pull/1632>) * Improve Python version auto detection (#1660<https://github.com/balabit/syslog-ng/pull/1660>) * HTTP destination: display verbose logs on debug level (#1526<https://github.com/balabit/syslog-ng/pull/1526>) * Improvements for Solaris packing (#1664<https://github.com/balabit/syslog-ng/pull/1664>) Notes to the Developers * Update internal RabbitMQ (#1662<https://github.com/balabit/syslog-ng/pull/1662>) * Update internal ivykis to v0.42 (#1566<https://github.com/balabit/syslog-ng/pull/1566>) * Fix Travis and test related issues (#1566<https://github.com/balabit/syslog-ng/pull/1566>, #1644<https://github.com/balabit/syslog-ng/pull/1644>, #1674<https://github.com/balabit/syslog-ng/pull/1674>) * Update docker images (#1637<https://github.com/balabit/syslog-ng/pull/1637>) * Fix some clang compile errors (#1662<https://github.com/balabit/syslog-ng/pull/1662>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Antal Nemes, Attila Szalay, Balazs Scheidler, Gabor Nagy, Gergely Orosz, Janos Szigetvari, Laszlo Budai, Laszlo Varady, Mate Farkas, Marton Suranyi, Peter Kokai, Szilard Pfeiffer, Tamas Nagy, Zoltan Pallagi. https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.12.1 [https://avatars1.githubusercontent.com/u/986981?v=4&s=400]<https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.12.1> balabit/syslog-ng<https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.12.1> syslog-ng is an enhanced log daemon, supporting a wide range of input and output methods: syslog, unstructured text, queueing, SQL & NoSQL. github.com

1 0

upgrading syslog-ng on Debian/Ubuntu packages from unofficial OBS repository
by Laszlo Budai 22 Sep '17

22 Sep '17

Hi, if you got the following error: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY xxxxxx just update the APT key: curl -4 http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/xUb… | sudo apt-key add - (if you are using other version of Debian/Ubuntu, set the correct version) and then apt-get update && apt-get upgrade regards, Laszlo Budai

1 0

unofficial OSE 3.12 packages for Debian/Ubuntu
by Laszlo Budai 22 Sep '17

22 Sep '17

Hi, I'm starting to work on upgrading my packages in OBS. Please test the packages before upgrading your servers. If you find any issues, just drop me a mail and I'll try to fix them. regards, Laszlo Budai

1 0

Insider 2017-09: 3.12; survey; geoip2; docker; AWS;
by Czanik, Péter 21 Sep '17

21 Sep '17

Dear syslog-ng users, This is the 61th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS syslog-ng 3.12 is coming ------------------------ The latest version of syslog-ng, 3.12 is expected to arrive soon. The most important new feature is the XML parser, which creates name-value pairs from XML-based log messages. You will also be able to configure JVM options for Java destinations, use PKCS-12, and utilize macros in HDFS file names. There are many more smaller features and bug fixes. For a complete list, check the git commits: https://github.com/balabit/syslog-ng/commits/master Test RPM packages from git head: https://www.balabit.com/blog/rpm-packages-from-syslog-ng-git-head/ New syslog-ng website --------------------- We will introduce a brand new website for all that is syslog-ng, and with that will come an official syslog-ng OSE repository with binaries for some of the most popular Linux distributions. We expect to launch syslog-ng.com in November, moving content for both OSE and its commercial versions to this new site so that it can serve as a single hub for all syslog-ng users. Learn more about it and help our work by answering a brief survey: https://www.balabit.com/blog/new-website-and-official-repo-coming-up-tell-u… Collecting logs from containers ------------------------------- There are many software products that log to files or pipes instead of their stdout, the place where Docker expects them. Fortunately by using Docker volumes, you can share data among containers, and syslog-ng can collect these logs as well. Learn how: https://www.balabit.com/blog/collecting-logs-containers-using-docker-volume… Heat maps using the new geoip2 parser ------------------------------------- The new geoip2 parser of syslog-ng 3.11 is not only faster than its predecessor, but can also provide a lot more detailed geographical information about IP addresses. Next to the usual country name and longitude/latitude information, it also provides the continent, time zone, postal code and even county name. Some of these are available in multiple languages. Learn how you can utilize all this information by parsing logs from iptables using syslog-ng, storing them to Elasticsearch, and displaying the results in Kibana! https://www.balabit.com/blog/creating-heat-maps-using-new-syslog-ng-geoip2-… Learn how you can impress your C-level leader(s) even more by animating these heat maps: https://www.balabit.com/blog/creating-time-lapse-videos-log-messages-using-… Installing syslog-ng on AWS Linux AMI ------------------------------------- You do not have to live without your favorite syslog implementation even in Amazon Web Services (AWS) Linux AMI. This Linux distribution is based on Red Hat Enterprise Linux version 6 and it takes minimal extra work to install syslog-ng on it. https://www.balabit.com/blog/installing-syslog-ng-aws-linux-ami/ EVENTS Virtualization day in Budapest, November 7th: https://vday.hu/2017/ Your feedback and news, or tips about the next issue are welcome at documentation(a)balabit.com. To read this newsletter online, visit: https://syslog-ng.org/ Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0