- syslog-ng - lists.balabit.hu

Re: [syslog-ng] syslog-ng 3.7.3 with Java enable Can't find class when startup
by Ho, Ming 04 May '16

04 May '16

Hi, I use the following conf file to start syslog-ng 3.7.3 complied with Java supported version and got the following error: # syslog-ng -f /opt/syslog-ng/syslog-ng.conf [2016-05-03T23:13:54.191256] Can't find class; class_name='org/syslog_ng/SyslogNgClassLoader' ** ERROR:modules/java/native/java_machine.c:126:java_machine_get_class_loader: assertion failed: (self->loader) syslog-ng.conf: @version: 3.7 @include "scl.conf" @module mod-java source s_syslog { syslog(); }; destination d_elastic { java( class_path("/usr/lib64/syslog-ng/java-modules/*.jar:/usr/share/elasticsearch/lib/*.jar") class_name("org.syslog_ng.elasticsearch.ElasticSearchDestination") option("index", "syslog-ng_${YEAR}.${MONTH}.${DAY}") option("type", "test") option("client-mode", "transport") option("server", "sl73ovnapd018") option("port", "9200") option("flush-limit", "10") ); }; log { source(s_syslog); destination(d_elastic); flags(flow-control); }; I found previous post from last year with the exact same error: https://github.com/balabit/syslog-ng/issues/620 According to the post the problem was make install fail to copy "syslog-ng-core.jar" and/or "syslog-ng-common.jar" to target directory. Including these two files in the directory referenced by the class_path should solve the problem. I have these two files included in my class_path already but still got the same error: -rw-r--r-- 1 root root 11411 May 2 06:50 /usr/lib64/syslog-ng/java-modules/syslog-ng-core.jar -rw-r--r-- 1 root root 12536 May 2 06:51 /usr/lib64/syslog-ng/java-modules/syslog-ng-common.jar Any help is highly appreciated. Ming Ho

1 0

Compile time error
by Vithulan MV 03 May '16

03 May '16

Hi all, I added required dependencies and tried to build syslog-ng from the source, there was an error saying, ${syslog-ng_HOME}/modules/afmongodb/mongo-c-driver/src/mongoc/mongoc-scram.c: In function '_mongoc_scram_sha1': storage size of 'digest_ctx' isn't known (EVP_MD_CTX digest_ctx) I confirmed OpenSSL [1] headers are included in the file.Can you please point out whats wrong? [1] https://github.com/mongodb/mongo-c-driver/blob/7415d3468de0c500fd6e630f7b52… Thanks. Regards, Vithulan

4 6

filtering vs. keeping all logs
by Czanik, Péter 29 Apr '16

29 Apr '16

Hi, One of the major strengths of syslog-ng is message filtering, which facilitates message routing and discarding useless log messages. OTOH I often read, that we have now all the technologies and storage to keep all logs. What do you think? Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

5 7

Re: [syslog-ng] [GSoC] Project: Kafka source
by Vithulan MV 27 Apr '16

27 Apr '16

Hi all, First of all, I'd like to thank you Syslog-ng community and my mentor Viktor Juhasz for accepting my proposal to implement Kafka source in Java!. Some of you may already know me but for others, I'll introduce myself again. I'm Vithulan, 3rd year undergraduate at University of Moratuwa, Sri lanka. My areas of interests are, Data analytics, Machine Learning, Networking and Security. As a first step into this GSoC program I already started following the documentation [1], and going through the code base of syslog-ng (I'm curious what IDE you all are using?). What are the other areas that you want me to know to polish my knowledge before we get into the coding period? I guess, this is going to be very interesting 4 months with good new experiences :) Thank you! [1] https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-… Best regards, Vithulan. On 23 April 2016 at 08:42, Vithulan MV <vithulanmv.12(a)cse.mrt.ac.lk> wrote: > Hi Viktor, > > I am very excited and happy after seeing my morning mail from Google > summer of code! Thank you very much for accepting my proposal! :) > How shall we proceed into this project? and any tips before going deep > into the project? :) > > Thank you. > > Best regards, > Vithulan. > > On 26 March 2016 at 10:52, Vithulan MV <vithulanmv.12(a)cse.mrt.ac.lk> > wrote: > >> Hi Viktor, >> >> I have submitted my proposal in GSoC page and Syslog-ng wiki page aswell. >> >> Thanks. >> Best regards, >> Vithulan >> On Mar 10, 2016 8:42 PM, "Vithulan MV" <vithulanmv.12(a)cse.mrt.ac.lk> >> wrote: >> >>> Hi Viktor, >>> >>> Thanks for the link :) I'll check that. >>> >>> Regards, >>> Vithulan. >>> >>> On 10 March 2016 at 20:22, Juhász, Viktor <viktor.juhasz(a)balabit.com> >>> wrote: >>> >>>> Hi, >>>> >>>> Sorry I missed the link :) >>>> https://syslog-ng.org/gsoc-2016/ >>>> >>>> BR, >>>> Viktor >>>> >>>> On Thu, Mar 10, 2016 at 3:46 PM, Vithulan MV < >>>> vithulanmv.12(a)cse.mrt.ac.lk> wrote: >>>> >>>>> Hi Viktor, >>>>> >>>>> Do you mean creating proposals for GSOC 2016 page [1] ? If not please >>>>> kindly share the page link with me? >>>>> >>>>> [1] >>>>> https://github.com/balabit/syslog-ng/wiki/Creating-a-proposal-for-GSoC-2016 >>>>> >>>>> Thanks. >>>>> Regards, >>>>> Vithulan. >>>>> >>>>> On 10 March 2016 at 19:40, Juhász, Viktor <viktor.juhasz(a)balabit.com> >>>>> wrote: >>>>> >>>>>> Hi Vithulan, >>>>>> >>>>>> We've finished our GSoC process description. Please read it >>>>>> carefully, and fill our Student Application Form. >>>>>> >>>>>> BR, >>>>>> Viktor >>>>>> >>>>>> On Thu, Mar 10, 2016 at 3:06 PM, Vithulan MV < >>>>>> vithulanmv.12(a)cse.mrt.ac.lk> wrote: >>>>>> >>>>>>> HI Viktor, >>>>>>> >>>>>>> Thanks for the overview and giving the overall idea. I'm working on >>>>>>> this and report you back on the progress. >>>>>>> >>>>>>> Thanks. >>>>>>> Regards, >>>>>>> Vithulan. >>>>>>> >>>>>>> On 8 March 2016 at 18:05, Juhász, Viktor <viktor.juhasz(a)balabit.com> >>>>>>> wrote: >>>>>>> >>>>>>>> Hi Vithulan, >>>>>>>> >>>>>>>> Yes, this should be plugin (you can find the plugins in the modules >>>>>>>> directory in syslog-ng source). >>>>>>>> >>>>>>>> Just a very briefly overview: >>>>>>>> >>>>>>>> syslog-ng read messages from the sources, process them with >>>>>>>> filters, rewrite rules, parsers, etc, and finally send messages to the >>>>>>>> destinations. >>>>>>>> We have a Kafka destination, it is implemented in java. The kafka >>>>>>>> source also should be implemented in java, but we our java source base is >>>>>>>> under construction, so till I can't give you an exact API, it is comming in >>>>>>>> the next 2-3 weeks. >>>>>>>> >>>>>>>> The ovarall idea is the following. >>>>>>>> - We should implement a Kafka consumer which uses the high level >>>>>>>> kafka group consuming API ( >>>>>>>> https://cwiki.apache.org/confluence/display/KAFKA/Consumer+Group+Example >>>>>>>> ) >>>>>>>> - We have to process data read from the Kafka (create LogMessage >>>>>>>> from this. LogMessage is an internal struct in syslog-ng representing the >>>>>>>> in the software) >>>>>>>> - After reload or restart syslog-ng have to be able to continue >>>>>>>> reading messages from the last read message. >>>>>>>> - If there are more syslog-ng's reading the same Kafka input >>>>>>>> (these syslog-ng's have the same group name) avoid message loosing or >>>>>>>> message duplication as much as possible >>>>>>>> >>>>>>>> Regards, >>>>>>>> Viktor >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On Mon, Mar 7, 2016 at 6:43 PM, Vithulan MV < >>>>>>>> vithulanmv.12(a)cse.mrt.ac.lk> wrote: >>>>>>>> >>>>>>>>> Hi Viktor, >>>>>>>>> >>>>>>>>> Oh I see! I've sent a mail to the mail list. Can you kindly give >>>>>>>>> me an overall idea of project Kafka source please? (Architecture of >>>>>>>>> syslog-ng/ current APIs) Is this is going to be an extension of syslog-ng? >>>>>>>>> >>>>>>>>> Thank you. >>>>>>>>> >>>>>>>>> Regards, >>>>>>>>> Vithulan. >>>>>>>>> Hi Vithulan, >>>>>>>>> >>>>>>>>> I've never faced with this problem, during compiling syslog-ng. >>>>>>>>> I suggest, that ask about your problem in the mail list of >>>>>>>>> syslog-ng ;) >>>>>>>>> >>>>>>>>> Best Regards, >>>>>>>>> Viktor >>>>>>>>> >>>>>>>>> >>>>>>>>> On Mon, Mar 7, 2016 at 12:46 PM, Vithulan MV < >>>>>>>>> vithulanmv.12(a)cse.mrt.ac.lk> wrote: >>>>>>>>> >>>>>>>>>> Hi, >>>>>>>>>> >>>>>>>>>> I've been going through the git book that you referred. It was >>>>>>>>>> helpful. Can you please explain a bit about the project structure and >>>>>>>>>> deliverables of Kafka-source project? >>>>>>>>>> >>>>>>>>>> I added required dependencies and tried to build syslog-ng from >>>>>>>>>> the source, there was an error saying, >>>>>>>>>> *${syslog-ng_HOME}/modules/afmongodb/mongo-c-driver/src/mongoc/mongoc-scram.c: >>>>>>>>>> In function '_mongoc_scram_sha1':* *storage size of 'digest_ctx' >>>>>>>>>> isn't known** (EVP_MD_CTX digest_ctx)* >>>>>>>>>> I confirmed OpenSSL [1] headers are included in the file.Can you >>>>>>>>>> please point out whats wrong? >>>>>>>>>> >>>>>>>>>> In the meantime I'm going through the syslog-ng documentation >>>>>>>>>> [2]. Can you give me directives on what I can be doing while preparing my >>>>>>>>>> proposals? >>>>>>>>>> >>>>>>>>>> [1] >>>>>>>>>> https://github.com/mongodb/mongo-c-driver/blob/7415d3468de0c500fd6e630f7b52… >>>>>>>>>> [2] >>>>>>>>>> https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-… >>>>>>>>>> >>>>>>>>>> Thank you. >>>>>>>>>> Regards, >>>>>>>>>> Vithulan. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On 4 March 2016 at 18:56, Vithulan MV < >>>>>>>>>> vithulanmv.12(a)cse.mrt.ac.lk> wrote: >>>>>>>>>> >>>>>>>>>>> Hi, >>>>>>>>>>> >>>>>>>>>>> Thanks for the reference, I will go through it and report you >>>>>>>>>>> back on the progress. >>>>>>>>>>> >>>>>>>>>>> Thanks, >>>>>>>>>>> Regards, >>>>>>>>>>> Vithulan. >>>>>>>>>>> >>>>>>>>>>> On 4 March 2016 at 18:45, Juhász, Viktor < >>>>>>>>>>> viktor.juhasz(a)balabit.com> wrote: >>>>>>>>>>> >>>>>>>>>>>> Hello, >>>>>>>>>>>> >>>>>>>>>>>> Sorry for the long response time. We are working on a wiki >>>>>>>>>>>> page, this page will describe all the required information. Till please >>>>>>>>>>>> read our documentation (getting started) >>>>>>>>>>>> https://www.gitbook.com/book/syslog-ng/getting-started/details >>>>>>>>>>>> >>>>>>>>>>>> Best Regards, >>>>>>>>>>>> Viktor Juhasz >>>>>>>>>>>> >>>>>>>>>>>> On Fri, Mar 4, 2016 at 2:09 PM, Vithulan MV < >>>>>>>>>>>> vithulanmv.12(a)cse.mrt.ac.lk> wrote: >>>>>>>>>>>> >>>>>>>>>>>>> Hello, >>>>>>>>>>>>> >>>>>>>>>>>>> I sent the following mail to the syslog-ng mailing list, but >>>>>>>>>>>>> didn't get any responses. So I thought it didn't reach to you. I'm highly >>>>>>>>>>>>> motivated on contributing for syslog-ng in GSoC 2016. I also have prior >>>>>>>>>>>>> experience in syslog-ng domain so I feel like this project is going to be >>>>>>>>>>>>> very interesting. Please kindly guide me on how I should start? >>>>>>>>>>>>> >>>>>>>>>>>>> Thank you. >>>>>>>>>>>>> >>>>>>>>>>>>> Regards, >>>>>>>>>>>>> Vithulan. >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> ---------- Forwarded message ---------- >>>>>>>>>>>>> From: Vithulan MV <vithulanmv.12(a)cse.mrt.ac.lk> >>>>>>>>>>>>> Date: 3 March 2016 at 15:33 >>>>>>>>>>>>> Subject: [GSoC] Project: Kafka source >>>>>>>>>>>>> To: syslog-ng(a)lists.balabit.hu >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> Hi all, >>>>>>>>>>>>> >>>>>>>>>>>>> I'm currently a 3rd year undergraduate at University of >>>>>>>>>>>>> Moratuwa, Sri lanka. I have attached my Linkedin profile with this mail >>>>>>>>>>>>> [1]. I'd like to contribute to a GSoC 2016 project with the open source >>>>>>>>>>>>> community of syslog-ng. >>>>>>>>>>>>> >>>>>>>>>>>>> I have contributed in log analyzing project LogAnalyzer [2] >>>>>>>>>>>>> and also worked with logstash, kafka. Therefore, I think I can contribute >>>>>>>>>>>>> syslog-ng project kafka source as I'm much interested in that. >>>>>>>>>>>>> >>>>>>>>>>>>> Please kindly make any suggestions on how I should proceed on >>>>>>>>>>>>> this? >>>>>>>>>>>>> >>>>>>>>>>>>> [1] https://lk.linkedin.com/in/vithulamv >>>>>>>>>>>>> [2] https://github.com/VIthulan/product-la >>>>>>>>>>>>> >>>>>>>>>>>>> Thank you. >>>>>>>>>>>>> Regards, >>>>>>>>>>>>> Vithulan >>>>>>>>>>>>> >>>>>>>>>>>>> -- >>>>>>>>>>>>> Vithulan MV. >>>>>>>>>>>>> >>>>>>>>>>>>> Undergraduate, >>>>>>>>>>>>> Department of Computer Science & Engineering, >>>>>>>>>>>>> University of Moratuwa, >>>>>>>>>>>>> Sri lanka. >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> -- >>>>>>>>>>>>> Vithulan MV. >>>>>>>>>>>>> >>>>>>>>>>>>> Undergraduate, >>>>>>>>>>>>> Department of Computer Science & Engineering, >>>>>>>>>>>>> University of Moratuwa, >>>>>>>>>>>>> Sri lanka. >>>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> -- >>>>>>>>>>> Vithulan MV. >>>>>>>>>>> >>>>>>>>>>> Undergraduate, >>>>>>>>>>> Department of Computer Science & Engineering, >>>>>>>>>>> University of Moratuwa, >>>>>>>>>>> Sri lanka. >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> -- >>>>>>>>>> Vithulan MV. >>>>>>>>>> >>>>>>>>>> Undergraduate, >>>>>>>>>> Department of Computer Science & Engineering, >>>>>>>>>> University of Moratuwa, >>>>>>>>>> Sri lanka. >>>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>> >>>>>>> >>>>>>> -- >>>>>>> Vithulan MV. >>>>>>> >>>>>>> Undergraduate, >>>>>>> Department of Computer Science & Engineering, >>>>>>> University of Moratuwa, >>>>>>> Sri lanka. >>>>>>> >>>>>> >>>>>> >>>>> >>>>> >>>>> -- >>>>> Vithulan MV. >>>>> >>>>> Undergraduate, >>>>> Department of Computer Science & Engineering, >>>>> University of Moratuwa, >>>>> Sri lanka. >>>>> >>>> >>>> >>> >>> >>> -- >>> Vithulan MV. >>> >>> Undergraduate, >>> Department of Computer Science & Engineering, >>> University of Moratuwa, >>> Sri lanka. >>> >> > > > -- > Vithulan MV. > > Undergraduate, > Department of Computer Science & Engineering, > University of Moratuwa, > Sri lanka. > -- Vithulan MV. Undergraduate, Department of Computer Science & Engineering, University of Moratuwa, Sri lanka.

2 1

Re: [syslog-ng] Switching the syslog-ng central server - client messages go missing
by jrhendri 27 Apr '16

27 Apr '16

Can you test manually using logger? That way you can see if it behaves differently with different combinations of facility and priority. Also capture those with tcpdump or whatever. I seem to recall that Solaris uses different mappings than other operating systems. You might look at the sending and receiving system header files. I forget the exact name or location but something like /usr/include/sys/syslog.h I think... Good luck Jim Sent from my Verizon, Samsung Galaxy smartphone -------- Original message --------From: "Cottington-Bray, Ian" <ian.cottington-bray(a)mclaren.com> Date: 4/27/16 7:06 AM (GMT-05:00) To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] Switching the syslog-ng central server - client messages go missing Thanks for the feedback – had to wait for a period to test again. Comments below Ian Cottington-Bray | Senior Infrastructure Engineer – Linux/Unix | McLaren Technology Group Limited McLaren Technology Centre, Chertsey Road, Woking, Surrey GU21 4YH, UK T: +44 (0) 1483 261 900 D: +44 (0) 1483 262 357 E: ian.cottington-bray(a)mclaren.com W: www.mclaren.com From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Scheidler, Balázs Sent: 21 April 2016 10:33 To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] Switching the syslog-ng central server - client messages go missing hmm... couple of things come to mind, not all syslog-ng related: 1) are those messages actually arriving on the host (check with tcpdump) Sometimes – I see network packets being sent some of the time (by the client) but not always 2) is the local firewall letting them through? There is no firewall on this network 3) is syslog-ng bound to a specific ip/port or it is bound to 0.0.0.0? (check that with netstat) Specific IP/port (514) – several IPs in fact 4) you should be able to use telnet/netcat on the client host to check if the port on the solaris11 box is open The port is open 5) if all else fails, check the syslog-ng config, but that shouldn't be a problem It looks OK to me .. It almost looks like the client systems don’t send all the time – which is VERY strange and I’m struggling to understand why. The client systems seem to send a few messages immediately after syslog-ng starts on the central server and then stop sending … If I shutdown the new server and bring up the old one the messages start appearing in the logs as I would expect. Any suggestions ? Bazsi -- Bazsi On Wed, Apr 20, 2016 at 4:51 PM, Cottington-Bray, Ian <ian.cottington-bray(a)mclaren.com> wrote: Hi I have a Solaris 10 server running version 3.0 of syslog-ng. I have built a new server running Solaris 11 with version 3.6 of syslog-ng installed. I have tested the new server by pointing another client at it and messages appear in the configured files as expected. I then shut down the Solaris 10 server – change the Solaris 11 server IP configuration to match the details for the Solaris 10 server – restart syslog-ng on the Solaris 11 server. Things seem to be working ok – except for the (Solaris and Linux) clients using syslog-ng (and referencing the central syslog-ng server by IP) their messages do not arrive at the expected files. Any suggestions ? Ian Ian Cottington-Bray | Senior Infrastructure Engineer – Linux/Unix | McLaren Technology Group Limited McLaren Technology Centre, Chertsey Road, Woking, Surrey GU21 4YH, UK T: +44 (0) 1483 261 900 D: +44 (0) 1483 262 357 E: ian.cottington-bray(a)mclaren.com W: www.mclaren.com The contents of this e-mail are confidential and for the exclusive use of the intended recipient. If you are not the intended recipient you should not read, copy, retransmit or disclose its contents. If you have received this email in error please delete it from your system immediately and notify us either by email or telephone. The views expressed in this communication may not necessarily be the views held by McLaren Technology Group Limited. McLaren Technology Group Limited | McLaren Technology Centre | Chertsey Road | Woking | Surrey | GU21 4YH | UK | Company Number: 01967715 ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq The contents of this e-mail are confidential and for the exclusive use of the intended recipient. If you are not the intended recipient you should not read, copy, retransmit or disclose its contents. If you have received this email in error please delete it from your system immediately and notify us either by email or telephone. The views expressed in this communication may not necessarily be the views held by McLaren Technology Group Limited. McLaren Technology Group Limited | McLaren Technology Centre | Chertsey Road | Woking | Surrey | GU21 4YH | UK | Company Number: 01967715

1 0

Switching the syslog-ng central server - client messages go missing
by Cottington-Bray, Ian 27 Apr '16

27 Apr '16

Hi I have a Solaris 10 server running version 3.0 of syslog-ng. I have built a new server running Solaris 11 with version 3.6 of syslog-ng installed. I have tested the new server by pointing another client at it and messages appear in the configured files as expected. I then shut down the Solaris 10 server - change the Solaris 11 server IP configuration to match the details for the Solaris 10 server - restart syslog-ng on the Solaris 11 server. Things seem to be working ok - except for the (Solaris and Linux) clients using syslog-ng (and referencing the central syslog-ng server by IP) their messages do not arrive at the expected files. Any suggestions ? Ian Ian Cottington-Bray | Senior Infrastructure Engineer - Linux/Unix | McLaren Technology Group Limited McLaren Technology Centre, Chertsey Road, Woking, Surrey GU21 4YH, UK T: +44 (0) 1483 261 900 D: +44 (0) 1483 262 357 E: ian.cottington-bray(a)mclaren.com W: www.mclaren.com<http://www.mclaren.com/> The contents of this e-mail are confidential and for the exclusive use of the intended recipient. If you are not the intended recipient you should not read, copy, retransmit or disclose its contents. If you have received this email in error please delete it from your system immediately and notify us either by email or telephone. The views expressed in this communication may not necessarily be the views held by McLaren Technology Group Limited. McLaren Technology Group Limited | McLaren Technology Centre | Chertsey Road | Woking | Surrey | GU21 4YH | UK | Company Number: 01967715

3 5

Re: [syslog-ng] GSoC 2016: we are looking for Featuer Owners.
by Laszlo Budai 26 Apr '16

26 Apr '16

Hi, in the past we did not have feature owners, so we don't have any experiences. This is actually a new role that I want to initiate to our GSoC projects (and later I want to share the experiences with Google). Feature owners are those community members who are highly interested in a specific feature so they can represents the users. Of course they can also check the code :) I think FOs will also keep an eye on the GSoC release timeline. >From the blogpost I posted few months ago: Feature owners:Feature owners represent the community during the development phase.Feature owners send feedback to the students.Feature owners write blogpost(s) about the feature.L. Sent from my HTC ----- Reply message ----- From: "Scheidler, Balázs" <balazs.scheidler(a)balabit.com> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] GSoC 2016: we are looking for Featuer Owners. Date: Tue, Apr 26, 2016 14:27 What kind of commitment do you need from these feature owners? I know it can be difficult to judge, but what are your past experiences? On Apr 26, 2016 1:18 PM, "Laszlo Budai" <laszlo.budai(a)outlook.com> wrote: > > Hi, > > > Students have sent proposals to the following five projects (other project > ideas, such as wildcard file source, were not so popular :-) ) : > > > - Automated release generation for syslog-ng > > > https://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-list#proj… > > The selected proposal: > https://drive.google.com/open?id=0B5rOtg14cnD0UDJFcnFBLWhXMVUby Ankush > Sharma. > > > - Websocket for syslog-ng > https://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-list#proj… > > > The selected proposal: > https://drive.google.com/open?id=0B5rOtg14cnD0MG1yX3NPNmFoMTAby Yilin Li. > > > - Kafka source > https://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-list#proj… > > > The selected proposal: > https://drive.google.com/open?id=0B5rOtg14cnD0VXQyYncxaTliaXM by Vithulan > MV. > > > - syslog-ng as a command line tool > https://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-list#proj… > > > The selected proposal : > https://drive.google.com/open?id=0B5rOtg14cnD0ek9TSklPSnZ4YWM by Noemi > Vanyi. > > > - Web based syslog-ng configuration editor > > > https://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-list#proj… > > The selected proposal: > https://drive.google.com/open?id=0B5rOtg14cnD0cm9DaEtUVmZGT1U by Raymund > Acs. > > > > As we have already mentioned https://syslog-ng.org/gsoc-2016/ , we will > ask you to join us and help students in their work. > > Our goal is to build a syslog-ng-GSoC release after the program is > finished. > > > Join us! We need Feature Owners who are members of our community. > > If you are interested in one of the projects and want to be a Feature > Owner, just contact to us at ( gitter https://gitter.im/balabit/syslog-ng , > this mailing list ). > > > Regards, > Laszlo Budai > > Sent from my HTC > > > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

GSoC 2016: we are looking for Featuer Owners.
by Laszlo Budai 26 Apr '16

26 Apr '16

Hi, Students have sent proposals to the following five projects (other project ideas, such as wildcard file source, were not so popular :-) ) : Automated release generation for syslog-nghttps://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-… The selected proposal: https://drive.google.com/open?id=0B5rOtg14cnD0UDJFcnFBLWhXMVUby Ankush Sharma. Websocket for syslog-nghttps://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-… The selected proposal: https://drive.google.com/open?id=0B5rOtg14cnD0MG1yX3NPNmFoMTAby Yilin Li. Kafka sourcehttps://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-lis… The selected proposal: https://drive.google.com/open?id=0B5rOtg14cnD0VXQyYncxaTliaXM by Vithulan MV. syslog-ng as a command line toolhttps://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-list#… The selected proposal : https://drive.google.com/open?id=0B5rOtg14cnD0ek9TSklPSnZ4YWM by Noemi Vanyi. Web based syslog-ng configuration editor https://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-list#proj… The selected proposal: https://drive.google.com/open?id=0B5rOtg14cnD0cm9DaEtUVmZGT1U by Raymund Acs. As we have already mentioned https://syslog-ng.org/gsoc-2016/ , we will ask you to join us and help students in their work. Our goal is to build a syslog-ng-GSoC release after the program is finished. Join us! We need Feature Owners who are members of our community. If you are interested in one of the projects and want to be a Feature Owner, just contact to us at ( gitter https://gitter.im/balabit/syslog-ng , this mailing list ). Regards, Laszlo Budai Sent from my HTC

2 1

ELK herd to scale
by Scot Needy 25 Apr '16

25 Apr '16

Hi, Does anyone have links or care to share notes on making a syslog-ng -> ELK scale for enterprise ? I have some ideas and will gladly share my solution but also don’t want to spend days figuring these things out that have already been built. There are many ELK specific references but I also want to make sure the model fits the syslog workload. Thanks

8 18

Greeting from Yilin
by Yilin Li 23 Apr '16

23 Apr '16

Hi, I recieved the email that told me my proposal is accepted today. I'm very exited about that. I'm greatly grateful that the community and especially my mentors Laszlo Meszaros and Viktor Juhasz decide to give me the opportunity. I'll try my best to accomplish the project. I'll start the following tasks as my proposal described. * Getting familiar with syslog-ng's code base. Especially, I should understand the architecture of the destination and source modules. * Post my questions in the mailing list and IRC if I get some problems understanding the code. @my mentors Laszlo Meszaros and Viktor Juhasz Please guide me if there is anything that could help me to accomplish the project better :) -- Best wishes, Yilin Li Institute of Software Chinese Academy of Sciences

1 0

forward syslog-ng -> syslog-ng central.
by Scot Needy 22 Apr '16

22 Apr '16

What’s the best way to forward all syslog data to another syslog-ng ? simple think like this with some options? log { source(s_net); destination (d_sysmaster); };

2 1

Re: [syslog-ng] SSL Problem after update
by Ivan Adji - Krstev 22 Apr '16

22 Apr '16

Minimal conf .. i try changing the port and give me the same error on that port. And i sont know how to include them using full path. Also i have read this same problem on google and there is some syslog-ng.ctl file that seems to make this kind of problem. Also i have done without tls and agine the same error. Kind regards On 22 Apr 2016 16:27, "Scot Needy" <scotrn(a)gmail.com> wrote: As a test try to load a minimal conf with no includes and add them manually using a full path. I had to do that to troubleshoot java module. On Apr 21, 2016, at 6:39 PM, Ivan Adji - Krstev <akivanradix(a)gmail.com> wrote: in scl.conf file there is nothing except this line *@include 'scl/*/*.conf'* So i don't think so.? I get your point that tls on port 6514 may be used twice but can't find anything like that ... it is the same config file that i have used before removing the old version and putting the new one. From 3.5 to 3.8. On 04/21/2016 08:58 PM, Scot Needy wrote: All of my conf files are included in scl.conf is scl.conf and @include "/etc/syslog-ng/conf.d/*.conf loading the same module twice ? On Apr 21, 2016, at 1:58 PM, Ivan Adji - Krstev <akivanradix(a)gmail.com> wrote: Hi yes i start to put the file but i have some other problems... anyway here it's the config file ( syslog-ng.conf ) @version:3.8 @include "scl.conf" # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # Note: it also sources additional configuration files (*.conf) # located in /etc/syslog-ng/conf.d/ options { flush_lines (0); time_reopen (10); log_fifo_size (1000); # log_iw_size(100); log_fetch_limit(100); # chain_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { system(); #unix-stream("/dev/log"); internal(); network( port(6514) # tcp(port(5140)); # file("/proc/kmsg" log_prefix("kernel: ")); transport("tls") tls( key_file("/etc/syslog-ng/cert.d/serverkey.pem") cert_file("/etc/syslog-ng/cert.d/servercert.pem") ca_dir("/etc/syslog-ng/ca.d")) ); }; destination d_mongodb { mongodb( servers("localhost:27017") # database("syslog") uri('mongodb://localhost/syslog-ng') collection("messages") value-pairs( scope("selected-macros" "nv-pairs" "sdata") ) ); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" flush_lines(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_kern { file("/var/log/kern"); }; destination d_mlal { usertty("*"); }; filter f_kernel { facility(kern); }; filter f_default { level(info..emerg) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_auth { facility(authpriv); }; filter f_mail { facility(mail); }; filter f_emergency { level(emerg); }; filter f_news { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_boot { facility(local7); }; filter f_cron { facility(cron); }; #log { source(s_sys); filter(f_kernel); destination(d_cons); }; log { source(s_sys); filter(f_kernel); destination(d_mongodb); }; log { source(s_sys); filter(f_default); destination(d_mongodb); }; log { source(s_sys); filter(f_auth); destination(d_mongodb); }; log { source(s_sys); filter(f_mail); destination(d_mongodb); }; log { source(s_sys); filter(f_emergency); destination(d_mongodb); }; log { source(s_sys); filter(f_news); destination(d_mongodb); }; log { source(s_sys); filter(f_boot); destination(d_mongodb); }; log { source(s_sys); filter(f_cron); destination(d_mongodb); }; log { source(s_sys); destination(d_mongodb); }; # Source additional configuration files (.conf extension only) @include "/etc/syslog-ng/conf.d/*.conf" # vim:ft=syslog-ng:ai:si:ts=4:sw=4:et: On 04/21/2016 06:12 PM, Scot Needy wrote: Or the module does not die on stop and tries to start another. On Apr 21, 2016, at 11:20 AM, Balazs Scheidler <bazsi77(a)gmail.com> wrote: maybe you have two sources binding on the same port? On Thu, Apr 21, 2016 at 4:36 PM, Scot Needy < <scotrn(a)gmail.com> scotrn(a)gmail.com> wrote: > I don’t see your conf files but I suspect it’s trying to load the tls > module twice ? > > > On Apr 21, 2016, at 10:04 AM, Ivan Adji - Krstev < <akivanradix(a)gmail.com> > akivanradix(a)gmail.com> wrote: > > It is the same ... if i restart the syslog-ng after that ill get the same > error. If i stop the syslog-ng that port is not used anymore ... > Here is the output of the *syslog-ng -Fevd* > > [2016-04-21T16:02:41.478174] WARNING: Starting with syslog-ng 3.6, the > system() source performs JSON parsing of messages starting with the '@cim:' > prefix. No additional action is needed; > [2016-04-21T16:02:41.478635] Module loaded and initialized successfully; > module='sdjournal' > [2016-04-21T16:02:41.478776] Finishing include; content='source confgen > system', depth='1' > [2016-04-21T16:02:41.479601] Module loaded and initialized successfully; > module='afsocket' > [2016-04-21T16:02:41.481135] Module loaded and initialized successfully; > module='afmongodb' > [2016-04-21T16:02:41.481914] Module loaded and initialized successfully; > module='affile' > [2016-04-21T16:02:41.482779] Module loaded and initialized successfully; > module='afuser' > [2016-04-21T16:02:41.484211] Unable to detect fully qualified hostname for > localhost, use_fqdn() will use the short hostname; > [2016-04-21T16:02:41.484252] Compiling #unnamed sequence [log] at > [/etc/syslog-ng/syslog-ng.conf:128:7] > [2016-04-21T16:02:41.484264] Compiling s_sys reference [source] at > [/etc/syslog-ng/syslog-ng.conf:128:7] > [2016-04-21T16:02:41.484276] Compiling s_sys sequence [source] at > [/etc/syslog-ng/syslog-ng.conf:29:1] > [2016-04-21T16:02:41.484286] Compiling #unnamed junction [log] at > [/etc/syslog-ng/syslog-ng.conf:29:15] > [2016-04-21T16:02:41.484295] Compiling #unnamed sequence [log] at > [source confgen system:2:5] > [2016-04-21T16:02:41.484304] Compiling #unnamed sequence > [source] at [source confgen system:2:5] > [2016-04-21T16:02:41.484314] Compiling #unnamed junction [log] > at [source confgen system:2:13] > [2016-04-21T16:02:41.484323] Compiling #unnamed single [log] > at [source confgen system:3:1] > [2016-04-21T16:02:41.484337] Compiling #unnamed single [log] at > [/etc/syslog-ng/syslog-ng.conf:32:2] > [2016-04-21T16:02:41.484347] Compiling #unnamed single [log] at > [/etc/syslog-ng/syslog-ng.conf:33:2] > [2016-04-21T16:02:41.484363] Compiling f_auth reference [filter] at > [/etc/syslog-ng/syslog-ng.conf:128:22] > [2016-04-21T16:02:41.484374] Compiling f_auth sequence [filter] at > [/etc/syslog-ng/syslog-ng.conf:112:1] > [2016-04-21T16:02:41.484383] Compiling #unnamed single [log] at > [/etc/syslog-ng/syslog-ng.conf:112:22] > [2016-04-21T16:02:41.484393] Compiling d_mongodb reference [destination] > at [/etc/syslog-ng/syslog-ng.conf:128:38] > [2016-04-21T16:02:41.484403] Compiling d_mongodb sequence > [destination] at [/etc/syslog-ng/syslog-ng.conf:57:1] > [2016-04-21T16:02:41.484413] Compiling #unnamed junction [log] at > [/etc/syslog-ng/syslog-ng.conf:57:24] > [2016-04-21T16:02:41.484422] Compiling #unnamed single [log] at > [/etc/syslog-ng/syslog-ng.conf:58:5] > [2016-04-21T16:02:41.484434] Compiling #unnamed sequence [log] at > [/etc/syslog-ng/syslog-ng.conf:133:7] > [2016-04-21T16:02:41.484445] Compiling s_sys reference [source] at > [/etc/syslog-ng/syslog-ng.conf:133:7] > [2016-04-21T16:02:41.484456] Compiling f_emergency reference [filter] at > [/etc/syslog-ng/syslog-ng.conf:133:22] > [2016-04-21T16:02:41.484467] Compiling f_emergency sequence [filter] > at [/etc/syslog-ng/syslog-ng.conf:114:1] > [2016-04-21T16:02:41.484476] Compiling #unnamed single [log] at > [/etc/syslog-ng/syslog-ng.conf:114:22] > [2016-04-21T16:02:41.484486] Compiling d_mongodb reference [destination] > at [/etc/syslog-ng/syslog-ng.conf:133:43] > [2016-04-21T16:02:41.484497] Compiling #unnamed sequence [log] at > [/etc/syslog-ng/syslog-ng.conf:152:7] > [2016-04-21T16:02:41.484506] Compiling s_sys reference [source] at > [/etc/syslog-ng/syslog-ng.conf:152:7] > [2016-04-21T16:02:41.484517] Compiling d_mongodb reference [destination] > at [/etc/syslog-ng/syslog-ng.conf:152:22] > [2016-04-21T16:02:41.484873] Seeking the journal to the last cursor > position; > cursor='s=9383cb3eb8ee41eda3468d9841333aef;i=131c;b=0f07653f04794e14beeeebb18131926b;m=214f74fdf;t=530ff299a3a8e;x=d0f0c56745dc963a' > [2016-04-21T16:02:41.485562] Module loaded and initialized successfully; > module='syslogformat' > [2016-04-21T16:02:41.485834] Error binding socket; > addr='AF_INET(0.0.0.0:6514)', error='Address already in use (98)' > [2016-04-21T16:02:41.485874] Error initializing message pipeline; > > > On 04/21/2016 03:40 PM, Scot Needy wrote: > > kill -9 2411 > > On Apr 21, 2016, at 7:58 AM, Ivan Adji - Krstev < <akivanradix(a)gmail.com> > akivanradix(a)gmail.com> wrote: > > 2411 > > > > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > ______________________________________________________________________________ > Member info: <https://lists.balabit.hu/mailman/listinfo/syslog-ng> > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > <http://www.balabit.com/support/documentation/?product=syslog-ng> > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: <http://www.balabit.com/wiki/syslog-ng-faq> > http://www.balabit.com/wiki/syslog-ng-faq > > > > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > <http://www.balabit.com/support/documentation/?product=syslog-ng> > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > -- Bazsi ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

SSL Problem after update
by Ivan Adji - Krstev 22 Apr '16

22 Apr '16

Hi all, I have update the syslog-ng to 3.8 ( yum remove syslog-ng && yum install syslog-ng ) and change from MySQL to Mongo DB and now when i restart i have the following errors: Error binding socket; addr='AF_INET(0.0.0.0:6514)', error='Address already in use (98)' I'm using mutual self certification and the certificates are there in the directories "ca.d" "cert.d". Do i have to re-create all the certificates now or can i fix this somehow. P.S. This problem i have on the Syslog-NG Server, they all send messages to this server. So if i have to change the certificate here i will have to change on the clients too. :( Any hints on this ?

5 17

Syslog-NG with MongoDB
by Ivan Adji - Krstev 21 Apr '16

21 Apr '16

Hi all, I'm trying to change the DB from InooDB to MongoDB, and i have install the MongoDB but i can't configure/create the database and tables on it. Can some one provide with simple tutorial or the best way to create and configure the MongoDB database and tables so that can be used by syslog-ng ? Kind regards Ivan

4 4

Elastic search data loading ?
by Scot Needy 15 Apr '16

15 Apr '16

Hi, When setting up syslog-ng -> ELK the logstash portion should not be needed as syslog-ng writes directly to an ES node or remote “transport” My understanding is logstash would post parse a log for a given interval and send it to ES like lodrotated. Not a solution for a syslog-ng realtime model. So my ElK stack is built but I don’t seem to be able to make the connection or data format between syslog-ng 3.8 and ES2. I can see syslog-ng writing data to the local log file destination and syslog-ng and es2 logs indicate the TCP connection was successful on startup… But I see no data in Kibana nor do I see any activity in syslog-ng or es logs using either of the templates below. NOTE: Removing syslog-ng->es and running flat logs through logstash does seem to populate data but that is not the solution. destination d_es { elasticsearch2( index("syslog-ng_${YEAR}.${MONTH}.${DAY}") type("syslog-ng") # Description: The type of the index. For example, type("test") template("$(format-json --scope rfc5424 --exclude DATE --key ISODATE @timestamp=${ISODATE})") #template("$(format-json --scope rfc3164 --scope nv-pairs --exclude R_DATE --key ISODATE)\n") port("9300") server("localhost") flush_limit("5000") client_mode("node") cluster("syslog-ng") custom_id("syslog") resource("/etc/elasticsearch/elasticsearch.yml") client_lib_dir("/usr/share/elasticsearch/lib") concurrent_requests("100") ); }; # sending logs to ES destination log { source(s_net); parser(pattern_db); destination(d_es); flags(flow-control); }; /etc/elasticsearch/elasticsearch.yml cluster.name: syslog node.name: node-1 path.home: /usr/share/elasticsearch

3 7

systemd syslog-ng does not start CentOS 7.2.1511
by Scot Needy 14 Apr '16

14 Apr '16

Hi, I need help setting up my control files for systemd I can’t figure out what I am doing wrong. If I make a SystemV start stop script it runs fine. From systemd I think there is something missing in the control files that lets syslog-ng report that is started successfully. When I add -F to SYSLOGNG_OPTS then systemctl start syslog-g.service never returns but syslog-ng does start. Compiled syslog-ng syslog-ng 3.8.0alpha0 no problems. On the command line syslog-ng will start fine. /opt/syslog-ng/sbin/syslog-ng -f /opt/syslog-ng/etc/syslog-ng.conf -p /var/run/syslogd.pid Using contrib/systemd/syslog-ng.service as an example I created /usr/lib/systemd/system/syslog-ng.service [Unit] Description=System Logger Daemon Documentation=man:syslog-ng(8) [Service] Type=notify ExecStart=/opt/syslog-ng/sbin/syslog-ng $SYSLOGNG_OPTS ExecReload=/bin/kill -HUP $MAINPID EnvironmentFile=-/opt/syslog-ng/etc/syslog-ng.env StandardOutput=journal StandardError=journal Restart=on-failure [Install] WantedBy=multi-user.target cat /opt/syslog-ng/etc/syslog-ng.env LD_LIBRARY_PATH=/usr/java/jdk1.8.0_77/jre/lib/amd64/server:$LD_LIBRARY_PATH SYSLOGNG_OPTS="-f /opt/syslog-ng/etc/syslog-ng.conf -p /var/run/syslogd.pid" systemctl daemon-reload systemctl restart systemd-journald systemctl start syslog-ng.service systemctl status syslog-ng.service ● syslog-ng.service - System Logger Daemon Loaded: loaded (/usr/lib/systemd/system/syslog-ng.service; enabled; vendor preset: enabled) Active: inactive (dead) since Tue 2016-04-12 14:51:04 EDT; 29s ago Docs: man:syslog-ng(8) Process: 2494 ExecStart=/opt/syslog-ng/sbin/syslog-ng $SYSLOGNG_OPTS (code=exited, status=0/SUCCESS) Main PID: 2494 (code=exited, status=0/SUCCESS) Apr 12 14:41:08 loghost systemd[1]: Unit syslog-ng.service entered failed state. Apr 12 14:41:08 loghost systemd[1]: syslog-ng.service failed. Apr 12 14:41:08 loghost systemd[1]: syslog-ng.service holdoff time over, scheduling restart. Apr 12 14:41:08 loghost systemd[1]: Starting System Logger Daemon... I can see syslog-ng starting and stoping over and over from /var/log/messages

5 17

Configuring syslog-ng on a computer with multiple ethernet interfaces
by Dave Florek 11 Apr '16

11 Apr '16

Hi, How do I configure syslog-ng to use a specific ethernet interface on a computer with multiple interfaces enabled? Sincerely,

2 1

CentOS configure failed from git clone
by Scot Needy 07 Apr '16

07 Apr '16

Hi Has anyone else seen this error from configure ? checking for JSON... yes checking for LIBMONGO... no checking for prop_get in -lsasl2... no checking for libESMTP... yes checking for HIREDIS... yes checking for RIEMANN_CLIENT... no checking for PYTHON... no checking for JAVA_VERSION... 1.8 checking for GRADLE_VERSION... 2 checking whether to enable Sun STREAMS support... no checking whether to enable IPv6 support... yes checking whether to enable Linux capability support... no checking whether to enable mongodb destination support... yes checking whether to enable amqp destination support... yes checking for UUID... no ./configure: line 19787: syntax error near unexpected token `syslog-ng-config.h,' ./configure: line 19787: `AX_PREFIX_CONFIG_H(syslog-ng-config.h, "SYSLOG_NG")'

2 3

Syslog-NG 3.8 SSL Error
by Ivan Adji - Krstev 05 Apr '16

05 Apr '16

Hi all, I have install the syslog-ng v.3.8 on CentOS 7 and using selfsignature (SSL/TLS). I have done the same procedure but using syslog-ng v.3.7 on CentOS 6 and everything works perfect. Here i have some problems after i done everything and configuration i have the following errors about SSL. Can someone give me some hints ? Apr 5 20:13:20 localhost root: This is a test message Apr 5 20:13:25 DenLuGW syslog-ng[32145]: Syslog connection established; fd='12', server='AF_INET(5.144.33.25:6514)', local='AF_INET(0.0.0.0:0)' Apr 5 20:13:25 DenLuGW syslog-ng[32145]: SSL error while writing stream; tls_error='SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca' Apr 5 20:13:25 DenLuGW syslog-ng[32145]: I/O error occurred while writing; fd='12', error='Broken pipe (32)' Apr 5 20:13:25 DenLuGW syslog-ng[32145]: Syslog connection broken; fd='12', server='AF_INET(5.144.33.25:6514)', time_reopen='10' Apr 5 20:13:35 DenLuGW syslog-ng[32145]: Syslog connection established; fd='12', server='AF_INET(5.144.33.25:6514)', local='AF_INET(0.0.0.0:0)' Apr 5 20:13:35 DenLuGW syslog-ng[32145]: SSL error while writing stream; tls_error='SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca' Apr 5 20:13:35 DenLuGW syslog-ng[32145]: I/O error occurred while writing; fd='12', error='Broken pipe (32)' Apr 5 20:13:35 DenLuGW syslog-ng[32145]: Syslog connection broken; fd='12', server='AF_INET(5.144.33.25:6514)', time_reopen='10' [root@DenLuGW syslog-ng]# syslog-ng --version syslog-ng 3.8.0alpha0 Installer-Version: 3.8.0alpha0 Revision: DA BE DA Module-Directory: //usr/lib64/syslog-ng Module-Path: //usr/lib64/syslog-ng Available-Modules: afamqp,affile,afprog,afsocket,afstomp,afuser,basicfuncs,cef,confgen,cryptofuncs,csvparser,date,dbparser,disk-buffer,graphite,json-plugin,kvformat,linux-kmsg-format,pseudofile,sdjournal,syslogformat,system-source Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: off Any hints about it ? Kind regards Ivan

1 1

Re: [syslog-ng] syslog-ng Digest, Vol 131, Issue 30
by Munh-Erdene E 04 Apr '16

04 Apr '16

Unsubscribe On 24 Mar 2016 19:00, <syslog-ng-request(a)lists.balabit.hu> wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. 3.7.3 unofficial Fedora / RHEL7 packages (Czanik) > 2. Re: 3.7.3 unofficial Fedora / RHEL7 packages (Czanik) > 3. Re: Collecting messages from text files (Girish Kumar) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 23 Mar 2016 14:06:13 +0100 > From: Czanik, P?ter <peter.czanik(a)balabit.com> > Subject: [syslog-ng] 3.7.3 unofficial Fedora / RHEL7 packages > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <CANcUavuUC+jqFa3nEfhhJM0A6fni= > PLh6U74RmYh7zGeWDofSw(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Hi, > > My unofficial syslog-ng 3.7.3 Fedora / RHEL7 packages are available at > https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng37/ Packages > for RHEL6 will follow later this week. If you have any questions or > run into any problems, let me know! > > Bye, > > Peter Czanik (CzP) <peter.czanik(a)balabit.com> > Balabit / syslog-ng upstream > http://czanik.blogs.balabit.com/ > https://twitter.com/PCzanik > > > ------------------------------ > > Message: 2 > Date: Wed, 23 Mar 2016 14:54:27 +0100 > From: Czanik, P?ter <peter.czanik(a)balabit.com> > Subject: Re: [syslog-ng] 3.7.3 unofficial Fedora / RHEL7 packages > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > < > CANcUavtxXHKfyPMHjwDNoqa6XHKow3r+6MKgu5sE-1MJuSe-MA(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > And the RHEL6 repo is updated as well: > https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng37epel6/ As > usual, let me know if you have any problems! > Bye, > Peter Czanik (CzP) <peter.czanik(a)balabit.com> > Balabit / syslog-ng upstream > http://czanik.blogs.balabit.com/ > https://twitter.com/PCzanik > > > On Wed, Mar 23, 2016 at 2:06 PM, Czanik, P?ter <peter.czanik(a)balabit.com> > wrote: > > Hi, > > > > My unofficial syslog-ng 3.7.3 Fedora / RHEL7 packages are available at > > https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng37/ Packages > > for RHEL6 will follow later this week. If you have any questions or > > run into any problems, let me know! > > > > Bye, > > > > Peter Czanik (CzP) <peter.czanik(a)balabit.com> > > Balabit / syslog-ng upstream > > http://czanik.blogs.balabit.com/ > > https://twitter.com/PCzanik > > > ------------------------------ > > Message: 3 > Date: Thu, 24 Mar 2016 07:21:38 +0000 > From: Girish Kumar <girish.kumar(a)al-enterprise.com> > Subject: Re: [syslog-ng] Collecting messages from text files > To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> > Message-ID: > < > VI1PR08MB0959FE8ED5E7F227BEAA8170C0820(a)VI1PR08MB0959.eurprd08.prod.outlook.com > > > > Content-Type: text/plain; charset="us-ascii" > > Could you please update on the following. > > Regards, > Girish > > From: syslog-ng-bounces(a)lists.balabit.hu [mailto: > syslog-ng-bounces(a)lists.balabit.hu] On Behalf Of Girish Kumar > Sent: Tuesday, March 22, 2016 4:10 PM > To: Syslog-ng users' and developers' mailing list > Subject: [syslog-ng] Collecting messages from text files > > Hi All, > > I am using file(filename) option for source of log. The filename is the > log generated by my application. The scenario is explained below. > > Writes to Reads from > Application --- ---- >filename-----------> syslog-ng > > Since the application is continuously writing to file and syslog-ng is > reading from the file, is there any chance syslog-ng missing some logs from > the file. > I am telling in reader writer context > > I referred following link to understand and implement file(filename) option > > https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-… > > > Regards, > Girish >

1 0

Weird issue with remote syslog-ng setup
by Dave Florek 29 Mar '16

29 Mar '16

Hi, I'm running into a weird issue where I have syslog-ng running on a client and server. Both are correctly configured to push log files from the client to the server and they're both Linux boxes. A netstat command on the client shows an established connection from the client to the server, however on the server, a netstat command does not show a connection from the server to the client or client to server. I checked firewall settings in iptables, however nothing seems to be working. Any ideas on how I can troubleshoot this? Sincerely,

3 2

Collecting messages from text files
by Girish Kumar 24 Mar '16

24 Mar '16

Hi All, I am using file(filename) option for source of log. The filename is the log generated by my application. The scenario is explained below. Writes to Reads from Application --- ---- >filename-----------> syslog-ng Since the application is continuously writing to file and syslog-ng is reading from the file, is there any chance syslog-ng missing some logs from the file. I am telling in reader writer context I referred following link to understand and implement file(filename) option https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-… Regards, Girish

1 1

3.7.3 unofficial Fedora / RHEL7 packages
by Czanik, Péter 23 Mar '16

23 Mar '16

Hi, My unofficial syslog-ng 3.7.3 Fedora / RHEL7 packages are available at https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng37/ Packages for RHEL6 will follow later this week. If you have any questions or run into any problems, let me know! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 1

Re: [syslog-ng] syslog-ng Digest, Vol 131, Issue 27
by amey jain 23 Mar '16

23 Mar '16

Hi, Girish can you tell why you think that messages are being dropped. Can you tell exact configuration of your syslog-ng. I didn't understand what exactly is the problem is. Can you be more detailed in it. Regards On Tue, Mar 22, 2016 at 4:30 PM, <syslog-ng-request(a)lists.balabit.hu> wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Re: Compile time error (Nagy) > 2. Re: syslog-ng 3.8 how to get configure script (Czanik) > 3. Collecting messages from text files (Girish Kumar) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 21 Mar 2016 16:45:51 +0100 > From: Nagy, Tam?s <tamas.nagy(a)balabit.com> > Subject: Re: [syslog-ng] Compile time error > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <CAJ3S0CmF75i=xWUxP=E_nr= > repNrHNrVA4tYqrZasi9W0vkaZQ(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > 1. Could you try with a newer mongo-c-driver version? You can edit the > respective section in .gitmodules and try branch=master (or some other > tag). You need to do this right after a clean checkout, although > running autogen.sh again before configure might also be enough. > > 2. Could you try after configuring with --disable-mongodb? > > On Thu, Mar 10, 2016 at 3:03 PM, Vithulan MV > <vithulanmv.12(a)cse.mrt.ac.lk> wrote: > > Hi, > > > > Yes it seems so, as per > > https://www.openssl.org/docs/manmaster/crypto/EVP_DigestInit.html > > > > Thanks for pointing that out. > > I tried installing openssl 1.0.1 but still the openssl version command > shows > > the version 1.1, How do I compile syslog-ng with OpenSSL 1.0.1? > > > > Thanks. > > > > Best regards, > > Vithulan > > > > On 7 March 2016 at 23:15, Tibor Benke <ihrwein(a)gmail.com> wrote: > >> > >> Hi, > >> > >> You probably use OpenSSL 1.1 (scroll down to the bottom of the page to > >> "History"): > >> https://www.openssl.org/docs/manmaster/crypto/EVP_DigestInit.html > >> > >> Please verify this. > >> > >> Could you try to compile syslog-ng with OpenSSL 1.0.1? > >> > >> Regards, > >> Tibor > >> > >> 2016-03-07 18:32 GMT+01:00 Vithulan MV <vithulanmv.12(a)cse.mrt.ac.lk>: > >>> > >>> Hi all, > >>> > >>> I added required dependencies and tried to build syslog-ng from the > >>> source, there was an error saying, > >>> > >>> > ${syslog-ng_HOME}/modules/afmongodb/mongo-c-driver/src/mongoc/mongoc-scram.c: > >>> In function '_mongoc_scram_sha1': storage size of 'digest_ctx' isn't > known > >>> (EVP_MD_CTX digest_ctx) > >>> I confirmed OpenSSL [1] headers are included in the file.Can you please > >>> point out whats wrong? > >>> > >>> [1] > >>> > https://github.com/mongodb/mongo-c-driver/blob/7415d3468de0c500fd6e630f7b52… > >>> > >>> Thanks. > >>> Regards, > >>> Vithulan > >>> > >>> > >>> > >>> > ______________________________________________________________________________ > >>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > >>> Documentation: > >>> http://www.balabit.com/support/documentation/?product=syslog-ng > >>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >>> > >>> > >> > >> > >> > >> > ______________________________________________________________________________ > >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > >> Documentation: > >> http://www.balabit.com/support/documentation/?product=syslog-ng > >> FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >> > >> > > > > > > > > -- > > Vithulan MV. > > > > Undergraduate, > > Department of Computer Science & Engineering, > > University of Moratuwa, > > Sri lanka. > > > > > ______________________________________________________________________________ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > ------------------------------ > > Message: 2 > Date: Tue, 22 Mar 2016 11:22:21 +0100 > From: Czanik, P?ter <peter.czanik(a)balabit.com> > Subject: Re: [syslog-ng] syslog-ng 3.8 how to get configure script > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <CANcUavt4iOerSVbJdSnJM= > Zg-fw1eSjwDwydLdz+MFM3jjdj0Q(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hi, > > I have now a completely untested rhel7 package available at > https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng38/ I'll try to > build also for rhel6 later this week. It includes Java modules, but not the > JAR dependencies. > > Bye, > > Peter Czanik (CzP) <peter.czanik(a)balabit.com> > Balabit / syslog-ng upstream > http://czanik.blogs.balabit.com/ > https://twitter.com/PCzanik > > On Sun, Mar 20, 2016 at 7:06 PM, Tibor Benke <ihrwein(a)gmail.com> wrote: > > > Hi Evan, > > > > I think you need to install the autoconf-archive package, then run > > ./autogen.sh. Everything else should be the same. > > > > Tibor > > > > 2016-03-20 17:52 GMT+01:00 Evan Rempel <erempel(a)uvic.ca>: > > > >> I wanted to start using elasticsearch 2.2 so need to start using > >> syslog-ng 3.8 but there is no > >> configure script in the master branch. > >> > >> autoconf returns a bunch of "possibly undefined macro" errors and leaves > >> a non-working configure script. > >> autoreconf does similar things. > >> > >> Can anyone give me some help on getting a working configure/make setup > >> for syslog-ng 3.8 > >> > >> I am attempting this on Redhat 6. > >> > >> Evan. > >> > >> > >> > ______________________________________________________________________________ > >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > >> Documentation: > >> http://www.balabit.com/support/documentation/?product=syslog-ng > >> FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >> > >> > > > > > > > ______________________________________________________________________________ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > > > >

2 1

Gsoc 2016 Introduction: Radcliffe
by Radcliffe Robinson 22 Mar '16

22 Mar '16

Hi there. My name is Radcliffe Robinson. I am a second year computer science student at the University of the West Indies, Jamaica. I actually first became interested interested in syslog-ng as a potential user while searching for a more palatable logging and log processing solution (something for sophisticated than ctrl+f) for a billing system a partner and I built in C to accompany the Asterisk pbx system at our internship. I had some time ago read about a company that logged all messages and controlled all their systems through a web server (localhost/product/restart to restart a service, localhost/product/logs?query=query to view logsm etc) and was searching for a similar way to send log messages from the billing software directly to the web-server i built to interfaces with customer database, where i would then do filtering and grouping etc of the log messages. It is for this reason that i am particularly interested in your project idea to create a websocket destination for syslog-ng. Syslog-ng already possess the filtering and grouping functionality, leaving only the act of implementing the websocket source. This something i could directly apply to an existing product of mine. However my passion for user interface design and extensive experience with web development draws my interest towards your idea for a drag and drop web interface for creating syslog-ng configuration files, purely because of the novelty of the idea and the opportunity to supersize some creative and aesthetic competency, a relatively rare experience in my short professional life as a developer. The more consideration i give to this idea, and the further i read through the admin guide, the more difficult a task it reveals itself to be but i have already devised a few possible solutions and began designing the database schema to facilitate it, and am confident that it is within the scope of my competency to create a useful and well designed web solution. I will be running these ideas by the project's mentor to seek feedback. I expect to end up sending in applications for multiple of the gsoc ideas the syslog-ng team has posted as they are the most interesting set of ideas which align well with my skill set that i have found. Thus, if given the opportunity, i look forward to working with the team this summer. Best regards, Radcliffe.

1 0