- syslog-ng - lists.balabit.hu

New website and official repo coming up, tell us what you think!
by Czanik, Péter 19 Sep '17

19 Sep '17

Hi, We at Balabit are and have always been both very excited and humbled by the community that formed around syslog-ng over the past two decades. Many of you have been a part of this long journey and helped syslog-ng to get to where it is today, and we thank you for that. Throughout the years, we provided a best-in-class documentation not just for our commercial offerings but for syslog-ng Open Source Edition as well. However, for the past half decade official binaries existed only for syslog-ng Premium Edition. Soon, this will change. We will introduce a brand new website for all that is syslog-ng, and with that will come an official syslog-ng OSE repository with binaries for some of the most popular Linux distributions. We expect to launch syslog-ng.com in November, moving content for both OSE and its commercial versions to the site to become a single hub for all syslog-ng users. The official syslog-ng OSE repository will be just a part (although a major one) of a comprehensive overhaul of our OSE related content providing platform. We will provide regular technical webinars and trainings for syslog-ng OSE users, more blogs on practical tips&tricks, common use cases, etc. We plan to channel all syslog-ng related discussion into a forum on the new site, although this will take some more time. And we already started putting in more resources into the development of the Open Source Edition. This is a major commitment on our side to the community, and we know that it is the right move. However, we haven't quite decided on the implementation yet, and we are looking for your feedback on this. This is a serious business decision and ultimately all stakeholders (we as a company and you as a member of the community) have to benefit from this move, otherwise there is no reason to do it. We are listing all these so you can see the bigger picture before we present you the question: Would you register on the upcoming syslog-ng website to get access to the official repository and the aforementioned content? What would you gain if you registered? - Access to a repository containing the latest syslog-ng packages (technically, you would receive a key that you could include in FIXME) - Alerts, announcements and news about the syslog-ng releases - Regular news about syslog-ng related content to help you better solve problems with syslog-ng (blog posts, tutorials, interesting use cases about problems that others solved with syslog-ng, and so on) What would we gain if you registered? - First and foremost, we would get information immensely useful for us to optimize our development resources. How many of you use the repositories, which versions of syslog-ng you use, which platforms are the most important, which ones you do not use anymore, and so on. Unfortunately, we cannot get such data if you use external repositories (like the current unofficial ones), or if you install syslog-ng from your distribution. - Information about in which countries are hubs of syslog-ng users, for example, where could we organize meetups most successfully, or participate in local conferences to strengthen the community. - The ability to send you information about syslog-ng, both to help you learn about the possibilities of syslog-ng, and also to let you know about our commercial offerings. We know that some of you won't be interested in anything commercial, and that's fine. But to keep syslog-ng alive, we also need the support of those who do. We believe that registering on the new website and receiving the occasional email from us is a small favor to ask in return of the convenience of having access to a official repository with up-to-date packages, and we will strive to send you emails with useful content. Please let us know what you think using this short Google Form. <https://goo.gl/forms/TmTJY8CkRAzUwtEA2> Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

3 6

CentOS cant start syslog-ng via systemd but runs fine manually
by Andrew 14 Sep '17

14 Sep '17

I recently updated my CentOS server so there were new versions of Java and syslog-ng and I have been having issues ever since. If I run it from systemd then it fails to load, yet if I run it manually it works fine and pushes the logs into elasticsearch. When trying to run from systemd it complains about Java plugin not being found. systemctl start syslog-ng Error parsing destination, destination plugin java not found in destination block elasticsearch2 at line 2, column 3 If I run it manually by typing syslog-ng then it works just fine.

4 6

3.11 Multiple elastic destinations.
by Scot 14 Sep '17

14 Sep '17

Has anyone had success/failure using multiple ES destinations in syslog-ng. I am want to direct traffic to different indexes based on syslog-ng filters destination d_es { elasticsearch2( client-mode("http") index("syslog-ng_${YEAR}.${MONTH}.${DAY}") type("syslog") # Description: The type of the index. For example, type("test") template("$(format-json --scope rfc3164 --scope nv-pairs --exclude R_DATE --key ISODATE)\n") cluster-url("http://elasticsearch:9200/") concurrent-requests("5") # Number of concurrrent batches flush_limit("5000") # The number of messages in a single batch skip-cluster-health-check("yes") cluster("clustername") client_lib_dir("/usr/share/elasticsearch/lib") ); }; destination d_es_network { elasticsearch2( client-mode("http") index("network_${YEAR}.${MONTH}.${DAY}") type("syslog") # Description: The type of the index. For example, type("test") template("$(format-json --scope rfc3164 --scope nv-pairs --exclude R_DATE --key ISODATE)\n") cluster-url("http://elasticsearch:9200/") concurrent-requests("5") # Number of concurrrent batches flush_limit("5000") # The number of messages in a single batch skip-cluster-health-check("yes") cluster("clustername") client_lib_dir("/usr/share/elasticsearch/lib") ); };

2 1

Re: [syslog-ng] Syslog-ng on IBM System i
by Balazs Scheidler 13 Sep '17

13 Sep '17

This was a commercial offering from balabit which has been discontinued. The balabit sales team can possibly refer to an alternative, and i can connect you if you want. Just email me in private. On Sep 13, 2017 12:09 AM, "Lucas Ihara Alves" <lucas.alves(a)trtsp.jus.br> wrote: Dear Sir or Madam, I would like to know if Syslog-ng Open Source has a compiled version for IBM System i. If so, please, I would be grateful if anyone could send me the link to download. -- Yours Truly, ---- Lucas Alves ____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

Syslog-ng on IBM System i
by Lucas Ihara Alves 12 Sep '17

12 Sep '17

Dear Sir or Madam, I would like to know if Syslog-ng Open Source has a compiled version for IBM System i. If so, please, I would be grateful if anyone could send me the link to download. -- Yours Truly, ---- Lucas Alves

1 0

URGENT: http://download.opensuse.org/repositories/home:/laszlo_budai:/ site is down
by Clayton Dukes 08 Sep '17

08 Sep '17

Hey Guys, http://download.opensuse.org/repositories/home:/laszlo_budai:/ returns a 404, which means our customers can't install syslog-ng. Can someone look into it? To avoid this in the future, we're happy to host for you if needed. [id:image001.png@01D306E3.0FEBC990] Clayton Dukes Founder & CEO LogZilla Corporation 2900 N. Quinlan Park Rd, B240-341 Austin, TX, 78732 Tel: 936-4NetOps (463-8677) Web: www.logzilla.net<http://www.logzilla.net/> [id:image002.png@01D306E3.0FEBC990]<https://twitter.com/logzilla>[id:image003.png@01D306E3.0FEBC990]<https://youtu.be/drg5wv_mgfA>[id:image004.png@01D306E3.0FEBC990]<https://www.linkedin.com/in/lzcdukes/> For NetOps, By NetOps!

4 7

syslog-ng not writing to specified path
by vijay amruth 01 Sep '17

01 Sep '17

Hello all, hope you are all doing great. I have set up syslog-ng on a host and I am able to see packets on tcpdump but syslog-ng is not wriiting to the specified paths. I have checked firewall rules, filters, write permissions at the path. I have another host on the same VLAN with the same config that is able to receive packets and write to the destination. what I am I missing ? *version used:* syslog-ng 3.9.1 Installer-Version: 3.9.1 Revision: Module-Directory: /usr/local/lib/syslog-ng Module-Path: /usr/local/lib/syslog-ng Available-Modules: syslogformat,afsocket,affile,afprog,afuser,afamqp,afmongodb,csvparser,confgen,system-source,linux-kmsg-format,basicfuncs,cryptofuncs,dbparser,json-plugin,afstomp,pseudofile,graphite,sdjournal,kvformat,date,cef,disk-buffer,add-contextual-data Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-Linux-Caps: off syslog-ng -Fvde shows : [2017-08-03T13:57:20.214552] Module loaded and initialized successfully; module='syslogformat' Any help is appreciated. Thanks, Vijay Amrut.

2 1

Creating time lapse videos from log messages
by Czanik, Péter 31 Aug '17

31 Aug '17

Hi, A couple of you asked how I created the time lapse videos visualizing connection attempts to my router. I used the new geoip2 parser of syslog-ng 3.11, Elasticsearch for storage, Kibana for showing the map and OpenShot to convert screenshots into a movie. Read the details from my blog at https://www.balabit.com/blog/creating-time-lapse-videos-log-messages-using-… I'm not really sure if it has any practical use, but definitely a nice eye candy which can raise attention towards security of your network. Do you have any other suggestions for log data to be visualized in a similar way? Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0

host related macros
by Fabien Wernli 28 Aug '17

28 Aug '17

Hi, I have a hard time understanding the behaviour of the multiple host based macros with respect to the value of the use-fqdn(), and keep-hostname() params. First of all, when setting use-fqdn(yes), isn't the network destination supposed to send the fqdn? In our case, tcpdump shows that the short hostname is sent instead. Additionally, what does the following paragraph from the documentation mean? The hostname-related macros (${FULLHOST}, ${FULLHOST_FROM}, ${HOST}, and ${HOST_FROM}) do not have any effect if the keep-hostname() option is disabled Does that mean they are empty if keep-hostname(no) ? Cheers

2 2

laszlo_budai Key expired
by Clayton Dukes 25 Aug '17

25 Aug '17

Are you guys aware of this? W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/xUb… ./ Release: The following signatures were invalid: KEYEXPIRED 1503496621 W: Failed to fetch http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/xUb… The following signatures were invalid: KEYEXPIRED 1503496621 W: Some index files failed to download. They have been ignored, or old ones used instead. [id:image001.png@01D306E3.0FEBC990] Clayton Dukes Founder & CEO LogZilla Corporation 2900 N. Quinlan Park Rd, B240-341 Austin, TX, 78732 Tel: 936-4NetOps (463-8677) Web: www.logzilla.net<http://www.logzilla.net/> [id:image002.png@01D306E3.0FEBC990]<https://twitter.com/logzilla>[id:image003.png@01D306E3.0FEBC990]<https://youtu.be/drg5wv_mgfA>[id:image004.png@01D306E3.0FEBC990]<https://www.linkedin.com/in/lzcdukes/> For NetOps, By NetOps!

2 4

anyone know of a decent but easy to use syslog visualizer
by Smith, Paul (Sr. Admin-InfoSec) 23 Aug '17

23 Aug '17

Does anyone have a simple, easy to use, visualizer for syslogs that allows me to make new graphs quickly? I am in need of getting dashboards from syslog events to our executive teams. They don't know what information they want from these dashboards so I am trying to come up with some pretty graphs they can look at, and create new ones if they don't want that ones I do create. This way I can sketch things up quickly so they can see what can be graphed. We are a small team in a really big shop and I have many other responsibilities. I don't have the time to spend mucking about with this stuff all day. I'm trying to find a simple, easy to use visualizer that does not take me days to set up and configure. I've tried so many articles about setting up things like ELK and others, and have had a problem getting most of them to work. I spend half a day on each one and something is just not quite right because the build instructions are a month or more out of date and there is something that has changed in a dependency. Also, when trying to deal with creating logstash config files, I don't want to have to learn yet another config file syntax that I only need to touch 2-3 times per year. If I touch it at this frequency, I have to spend a day trying to remember what is what in the config file so I can make a new graph. Paul Smith InfoSec Those who don't study history are doomed to repeat it. Those who do study history are doomed to stand by helplessly while everyone else repeats it. Tom Toro

2 1

UDP devices stop logging after network services restart.
by Vincenti Francesco 23 Aug '17

23 Aug '17

Dear Janos I already sent an email with the data you requested that is under analysis from your moderators because it is too big. Anyway, every NIC has a number of dropped RX packages but either their number and their daily growth is not big enough to explain the amount of data lost. Further, netstat -su shows, under UDP, 1 packet receive errors only. I'm going to switch UDP devices again to log on not-working NIC (ens35 according data I've sent to you) to verify how many packages are lost in this case and I'll inform you about the results. Cheers Francesco Vincenti RHCSA Area Data Center Open Source, Quality and Security Aspasiel Divisione della Società Acciai Speciali Terni S.p.A. con Unico Socio Strada di Pentima, 3 - 05100 Terni francesco.vincenti(a)acciaiterni.it<mailto:francesco.vincenti@acciaiterni.it> www.aspasiel.it<http://www.aspasiel.it/> Ufficio: +39 0744 203224 Fax: +39 0744 203444 This e-mail and any attachments is a confidential correspondence intended only for use of the individual or entity named above. If you are not the intended recipient or the agent responsible for delivering the message to the intended recipient, you are hereby notified that any disclosure, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the error at the following email address: helpdesk(a)aspasiel.it<mailto:helpdesk@aspasiel.it> or at Aspasiel Helpdesk Team by phone (phone number +390744203555), and then delete this message from your system. P Please consider our environment and think before you print. Thank you! q

2 2

poll: which operating system do you use?
by Czanik, Péter 22 Aug '17

22 Aug '17

Hi, Here is my next poll: asking for which operating system you use to run syslog-ng. Cast your vote on Twitter at: https://twitter.com/PCzanik/status/899973381549895680 As the number of possible answers is limited by Twitter, if your choice of OS is missing, add it as a comment. The poll is anonymous, but of course comments are not. If you don't want to share your answer with the rest of the world but don't mind sharing with me, answer this e-mail and make sure that the address is set to my address instead of the list... Thanks for your help, Peter Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0

Syslog-NG and UTF-8 problem.
by Jason Long 22 Aug '17

22 Aug '17

Hello. I forward my Windows event logs to my Linux Box. I guess the Syslog-NG that I installed it on my Linux box can't support UFT-8 because when the file or folder names are English then I can't see them. In my Windows Box, I'm using "nxlog" that it support UTF-8. How can I add UTF-8 feature to my Syslog-NG on Linux? Thank you.

1 0

RFC: incubator is to be discontinued
by Scheidler, Balázs 14 Aug '17

14 Aug '17

Hi, We had a discussion with our Debian maintainer about the fate of syslog-ng-incubator. For those of you who don't know, it is a set of syslog-ng modules not integrated to syslog-ng master for one reason or another. It is available from here: https://github.com/balabit/syslog-ng-incubator The problem with this repository is that it is not really maintained, causing compilation and functionality issues down the line. So our opinion is to go ahead and integrate stuff that can be brough up to speed. Once we've done what we could, we would discontinue the incubator altogether. Please speak up now, if you disagree, but please also be ready to help us out in maintenance in that case. If there are no disagreements in the following week, we would start to phasing out the incubator. We welcome volunteers to: 1) migrate code, OR 2) help with testing If you are the user of any of those plugins, letting us know at this point also helps making sure that no functionality is lost. Thanks. -- Bazsi

4 4

syslog parser modified in git head
by Scheidler, Balázs 10 Aug '17

10 Aug '17

Hi, The pull request #1617 has just been merged, which adds a slight modification to the way we parse RFC3164 syslog messages, by adding support for IPV6 addresses in the host field. Since changing that parser always makes me nervous (lot's of heuristics to support a number of different logging formats), it would be great if any of you having "strange" logging formats (appliances in general, Cisco, F5, Juniper, Huawei, etc) devices could validate that we didn't break anything major. The change is pretty focused, e.g. we accept an IPV6 address as a hostname if it matches the general format of IPv6 addresses. But the interpretation of the ':' character has slightly changed. This could cause hostnames and program names to be parsed incorrectly. Any feedback would be appreciated. -- Bazsi

1 0

Re: [syslog-ng] RFC: incubator is to be discontinued
by Balazs Scheidler 03 Aug '17

03 Aug '17

Thanks for the feedback. On Aug 2, 2017 21:42, "Czanik, Péter" <peter.czanik(a)balabit.com> wrote: Hi, As far as I can see, the kafka-c module is definitely in active use. I added Pyr -- the original author of the kafka module -- on CC. In addition I see once in a while that people are asking about grok and zmq. On the other hand I'm not sure how much functional these modules are (AFAIR the the source part of the ZMQ module was never really finished) and the grok module builds on a C library which is not actively maintained for many years. I don't recall people mentioning any of the other modules recently. Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik On Sun, Jul 30, 2017 at 7:40 PM, Scheidler, Balázs < balazs.scheidler(a)balabit.com> wrote: > Hi, > > We had a discussion with our Debian maintainer about the fate of > syslog-ng-incubator. For those of you who don't know, it is a set of > syslog-ng modules not integrated to syslog-ng master for one reason or > another. > > It is available from here: > > https://github.com/balabit/syslog-ng-incubator > > The problem with this repository is that it is not really maintained, > causing compilation and functionality issues down the line. > > So our opinion is to go ahead and integrate stuff that can be brough up to > speed. Once we've done what we could, we would discontinue the incubator > altogether. > > Please speak up now, if you disagree, but please also be ready to help us > out in maintenance in that case. > > If there are no disagreements in the following week, we would start to > phasing out the incubator. > > We welcome volunteers to: > > 1) migrate code, OR > 2) help with testing > > If you are the user of any of those plugins, letting us know at this point > also helps making sure that no functionality is lost. > > Thanks. > > -- > Bazsi > > ____________________________________________________________ > __________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product= > syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > ____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

syslog-ng 3.11 on twitter
by Czanik, Péter 02 Aug '17

02 Aug '17

Hi, Please help spreading the word about the syslog-ng 3.11 also on Twitter. The syslog-ng OSE twitter account is available at https://twitter.com/sngose Please re-tweet one ore more of the following tweets: - 3.11 announcement: https://twitter.com/PCzanik/status/892315446325776386 - 3.11 documentation: https://twitter.com/PCzanik/status/892742991080763392 Depending on your Linux distribution preferences, there are also tweets about unofficial 3.11 packages: - fedora/RHEL7: https://twitter.com/PCzanik/status/892666279437271040 - openSUSE/SLES12: https://twitter.com/PCzanik/status/892648387400609793 - Debian/Ubuntu: https://twitter.com/PCzanik/status/892763031666556929 Tweets are from my own account, but you should follow @sngOSE account: https://twitter.com/sngose Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0

syslog-ng 3.11.1 resources
by Czanik, Péter 02 Aug '17

02 Aug '17

Hi, Version 3.11.1 of syslog-ng OSE was released yesterday. Here I try to compile a list of useful resources in a hope that it does not end up in your spam folder due to the excess amount of URLs :) - List of new features and bugfixes: https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.11.1 - source tgz: https://github.com/balabit/syslog-ng/releases/download/syslog-ng-3.11.1/sys… - unofficial Debian / Ubuntu packages: https://www.balabit.com/blog/installing-the-latest-syslog-ng-on-ubuntu-and-… - unofficial openSUSE / fedora / SLES / RHEL packages: https://www.balabit.com/blog/installing-latest-syslog-ng-on-rhel-and-other-… - documentation as single page HTML: https://www.balabit.com/documents/syslog-ng-ose-3.11-guides/en/syslog-ng-os… - for other formats go to https://www.balabit.com/support/documentation Choose “syslog-ng Open Source Edition” as product, select your version and your preferred format (single or multi-page HTML or PDF) For generic syslog-ng information go to https://syslog-ng.org/ Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0

Insider 2017-08: 3.11 released; wildcard-file; docker; SCL; RMLL/LSM;
by Czanik, Péter 02 Aug '17

02 Aug '17

Dear syslog-ng users, This is the 60th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS syslog-ng 3.11 released ----------------------- The latest version of syslog-ng, 3.11 is now available. The most important new feature is the GeoIP2 parser which builds on libmaxminddb providing both better performance and more detailed geographical information about IP addresses. AMQP destination now supports SSL. There are many more smaller features and bug fixes. For a complete list check the release announcement: https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.11.1 Reading multiple files: wildcard file source ------------------------------- Starting with version 3.10, syslog-ng can collect messages from multiple text files. You do not have to specify file names one by one, just use a wildcard to select which files to read. This is especially useful when you do not know the file names by the time syslog-ng is started. This is often the case with web servers with multiple virtual hosts. https://www.balabit.com/blog/reading-multiple-files-wildcard-file-source-sy… Collecting Docker infrastructure logs ------------------------------------- Why use syslog-ng for collecting Docker logs? Docker already provides many drivers for logging, even for central log collection. On the other hand remote logging drivers arrive with a minimalist feature set and you are not able to use the “docker logs” command any more. To have the best of both worlds, you can use journald logging driver in Docker and use syslog-ng to read Docker logs from journald and forward log messages to your central log server or other destinations. You can even run syslog-ng itself in a Docker container, so you can use it on dedicated Docker host environments as well where it is not possible to install additional applications. https://www.balabit.com/blog/collecting-docker-infrastructure-logs-using-sy… The power of SCL ---------------- The syslog-ng configuration library (SCL) can help you to configure syslog-ng a lot more easily. These configuration snippets can hide away the complexity of collecting, parsing or storing log messages. >From this blog you can learn how to parse web server logs and store the results at a Logging as a Service (LaaS) provider in a structured form. You will use SCL both for message parsing and the LaaS destination, and also utilize the wildcard-file() source introduced in syslog-ng 3.10. https://www.balabit.com/blog/parsed-web-server-logs-cloud-syslog-ng-scl/ RMLL / Libre Software Meeting 2017 ---------------------------------- This year I participated again in the security track of the largest French open source conference, Libre Software Meeting (RMLL). “Participated” as I did not only give a talk on syslog-ng there, but also sat in to most of the presentations and had very good discussions both with visitors and fellow speakers. The organizers brought together talks from diverse IT security related fields, a very good opportunity for cross-pollination of ideas. https://www.balabit.com/blog/czp-rmll-libre-software-meeting-2017/ NEW RELEASES syslog-ng OSE 3.11.1: https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.11.1 Your feedback and news, or tips about the next issue are welcome at documentation(a)balabit.com. To read this newsletter online, visit: https://syslog-ng.org/ Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0

OSE 3.11
by Laszlo Budai 01 Aug '17

01 Aug '17

3.11.1 Features * Add geoip2 parser and template function. It is based on the libmaxminddb(MaxMindDB). It will replace the old geoip parser and template function, so they are deprecated from 3.11 (but still available). * Add SSL support to AMQP. * Add template option to apache-accesslog-parser. * Add configurable event time to Riemann destination. * Add drop-unmatched() option to dbparser. * Add Ubuntu Xenial to the bundled docker images. * Support multi-instance support for Solaris 10 and 11. * Support multi-instance for systemd. * Add configurable timeout to HTTP destination. * Add prefix() option to cisco-parser. Bugfixes * Fix a memory usage counter underflow for threaded destination drivers and writers. * Fix a potential crash in AMQP. * Fix a potential crash during reload. * Fix a reload/shutdown issue. Under heavy load, worker might never exit from the fetch loop from the queue. * Fix a potential crash in afsocket destination during reload. * Fix a counter registration bug. In some cases not all the required counters are registered. * Fix a build issue on FreeBSD. * Fix a memory leak in diskq plugin. * Fix systemd-journal error codes validation. * Fix a potential crash in diskq when it is used with file destination and the file is reaped. * Fix a memory leak in HTTP destination * Fix ENABLE_DEBUG in dbparser. * Fix a unit tests that caused build issue on 32 bit platforms. Other changes * The eventlog library is part of syslog-ng from now. * Improve error messages when the config cannot be initialized. * Improve source suspended/resumed debug messages. * Rename syslog-debun to syslog-ng-debun. * Update manpages to v3.11 * Remove tgz2build directory. Notes to the Developers * Rewrite merge-grammar script from Perl to Python. Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Antal Nemes, Attila Szalay, Balazs Scheidler, Fabien Wernli, Gabor Nagy, Giuseppe D'Anna, Janos Szigetvari, Laszlo Budai, Laszlo Varady, Lorand Muzamel, Mate Farkas, Noemi Vanyi, Peter Czanik, Tamas Nagy, Tibor Bodnar, Tomasz Kazimierczak, Zoltan Pallagi

1 0

eStreamer src Integration
by Scot 01 Aug '17

01 Aug '17

Has anyone looked at sending Cisco eStreamer events to syslog-ng ? We have a couple Cisco Firepower management centers and I would rather use syslog-ng over sending directly to splunk so that we may use other integrations like elastic and our NMS. I have the eStreamer SDK on my syslog-ng server and wondered if anyone else has worked on this. Search of the user archive says no. Thanks Scot

3 3

syslog-ng poll: geographical information
by Czanik, Péter 01 Aug '17

01 Aug '17

Hi, One of the major features of the upcoming syslog-ng 3.11 will be a complete rewrite of GeoIP support. So this time I ask you in the poll if you use syslog-ng to look up geographical information for IP addresses: https://twitter.com/PCzanik/status/891985964788330497 If you use GeoIP, please include your use case in the comments or answer this e-mail. You can e-mail me directly, if for some reason you don't want to share it with the rest of the world. Please re-tweet the above tweet to reach as many syslog-ng users as possible! Thanks, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0

Upgrade from 3.10.1-1 to 3.11.1-1 fails on Ubuntu
by Clayton Dukes 31 Jul '17

31 Jul '17

I got this today on one of our Customer's systems, anyone else had this happen? Unpacking syslog-ng (3.11.1-1) over (3.10.1-1) ... dpkg: error processing archive /var/cache/apt/archives/syslog-ng_3.11.1-1_all.deb (--unpack): trying to overwrite '/lib/systemd/system/syslog-ng.service', which is also in package syslog-ng-core 3.11.1-1 Errors were encountered while processing: /var/cache/apt/archives/syslog-ng_3.11.1-1_all.deb E: Sub-process /usr/bin/dpkg returned an error code (1) [cid:image001.png@01D3078B.AD39C7D0] Clayton Dukes Founder & CEO LogZilla Corporation 2900 N. Quinlan Park Rd, B240-341 Austin, TX, 78732 Tel: 936-4NetOps (463-8677) Web: www.logzilla.net<http://www.logzilla.net/> [cid:image002.png@01D3078B.AD39C7D0]<https://twitter.com/logzilla>[cid:image003.png@01D3078B.AD39C7D0]<https://youtu.be/drg5wv_mgfA>[cid:image004.png@01D3078B.AD39C7D0]<https://www.linkedin.com/in/lzcdukes/> For NetOps, By NetOps!

4 8

Few messages are not getting forwarded to destination
by Harish Shetty 28 Jul '17

28 Jul '17

Hi I am using "syslog-ng-3.9.1-1.el6.x86_64" . Few messages are not getting forwarded to destination (Monitoring hosts). But messages are receiving in syslog-ng server from the client. As a tuning parameter I am using log_fifo_size (20000); flush_lines (0); time_reopen (10); For source s_tcp , source s_udp and source s_net so_rcvbuf(8388608) max-connections(200) log-iw-size(20000) Could you please let me know , how we can avoid the messages are not getting forwarded ti destination. Regards Harish Shetty

2 1