- syslog-ng - lists.balabit.hu

3.7.3 unofficial openSUSE / SLES packages
by Czanik, Péter 22 Mar '16

22 Mar '16

Hi, My unofficial syslog-ng 3.7.3 openSUSE / SLES packages are available at https://build.opensuse.org/project/show/home:czanik:syslog-ng37 I'll fix the Tumbleweed build later this week. If you have any questions or run into any problems, let me know! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

syslog-ng-3.7.3 unofficial Debian/Ubuntu packages
by Budai, László 22 Mar '16

22 Mar '16

Hi, I've just created my unofficial OBS repo[1] for syslog-ng 3.7.3 (latest revision: 3.7.3-2). List of supported OSs (i386/amd64): * Debian 7.0 * Debian 8.0 * Ubuntu 12.04 * Ubuntu 14.04 * Ubuntu 14.10 * Ubuntu 15.04 * Ubuntu 15.10 [newly added] Install ------- example: Debian 8.0 1. get release key wget -qO - http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… | sudo apt-key add - 2. add repo to APT sources eg.: /etc/apt/sources.list.d/syslog-ng-obs.list deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… ./ Then `apt-get update` and `apt-get install syslog-ng-core` You can replace Debian_8.0 to * Debian_7.0 * xUbuntu_12.04, * xUbuntu_14.04 * xUbuntu_14.10 * xUbuntu_15.04 * xUbuntu_15.10 Available packages: * syslog-ng-core * syslog-ng-dbg * syslog-ng-dev * syslog-ng-mod-stomp * syslog-ng-mod-amqp * syslog-ng-mod-elastic * syslog-ng-mod-geoip * syslog-ng-mod-graphite * syslog-ng-mod-hdfs * syslog-ng-mod-http * syslog-ng-mod-java * syslog-ng-mod-java-common-lib * syslog-ng-mod-journal * syslog-ng-mod-json * syslog-ng-mod-kafka * syslog-ng-mod-mongodb * syslog-ng-mod-python * syslog-ng-mod-redis * syslog-ng-mod-riemann * syslog-ng-mod-smtp * syslog-ng-mod-sql * syslog-ng-mod-stomp Notes to the java destinations ------------------------------ About the ``` Error opening plugin module; module='mod-java', error='libjvm.so: cannot open shared object file: No such file or directory' ``` problem. libmod-java.so is linked to the libjvm.so library. If your java installation doesn't create a symlink in /usr/lib directory to libjvm.so then you have to modify your ld.so.conf or expand your LD_LIBRARY_PATH with the containing library before starting syslog-ng. eg.: LD_LIBRARY_PATH=/usr/lib/jvm/java-7-openjdk-amd64/jre/lib/amd64/server:$LD_LIBRARY_PATH Links -------- [1] https://build.opensuse.org/project/show/home:laszlo_budai:syslog-ng [2] https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.7.3 regards, Laszlo Budai

1 0

syslog-ng-3.7.3
by Budai, László 22 Mar '16

22 Mar '16

3.7.3 Changes compared to 3.7.2: Improvements - Updated Python package requirements. - Can now compile without MongoDB. - Added eventlog to the list of required pkg-config packages. - Basic FreeBSD and HP-UX support of syslog debug bundle generator by improving POSIX shell compatibility. - Keep the program destination open between configuration reloads. - system-source now uses keep-timestamp(no) for Linux kernel log. The time source used by /dev/kmsg is not updated after system SUSPEND/RESUME. Fixes - Fix a SIGSEGV when a Redis command returns an error. - Resolve deadlock in logwriter triggered by suppress() - Mitigate possible deadlock in patterndb - Fixed global inheritance of pass-unix-credentials() and create-dirs(). - Certain compilers complained about an undefined symbol when setting keep-alive(yes). - For certain use cases, afsocket would not handle procfs read errors due to an integer underflow. - Enhanced Java version check and the handling of SyslogNgInternalLogger (used by Kafka), the FATAL loglevel and getLocationInformation(). - When a big amount of kernel log was produced in a very short time, the syslog-ng process sometimes entered into a spin and stop processing messages. Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: András Mitzki, Avleen Vig, Balázs Scheidler, Ben Kibbey, Christian Herzig, David Schweikert, Douglas Carmichael, Dezso Endre Molnar, Fabien Wernli, Gergely Czuczy, Gergely Nagy, Gergo Nagy, Hanno Böck, Herzig, Christian, Laszlo Budai, László Várady, MÓZES Ádám István, PÁSZTOR György, Péter Czanik, Robert Fekete, Saurabh Shukla, Tamás Nagy, Tibor Benke, Viktor Juhász, Vincent Bernat, Wang Long, Zdenek Styblik, Zoltán FRIED, Zoltán Pallagi — You are receiving this because you are subscribed to this thread. View it on GitHub <https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.7.3>

1 0

[GSoC] Interested in Python support for Correlation Library
by Akshay Aurora 22 Mar '16

22 Mar '16

Hi, I'm Akshay, computer science student from India. I have decent experience with Python and system programming. Being a Mozillian, I have always been a big fan of Rust and Servo project. I have previously dabbled with Rust – and think of it as next system programming language. I hope to improve my Rust skills as part of this project and write production quality code. I have also been Google Summer of Code student at Inclusive Design Institute in 2013 and Mozilla in 2014. Few questions and ideas related to the project - - While the reason to switch away from handlebars makes sense - Why do we want to using Python as templating language? What are some of the use cases, where Python could be beneficial over any other templating language? - Are there any existing projects using Python as templating language? How is this going to be different than passing the context data to a Python script? - For the SQL-like syntax mentioned in project description - Can we design it as Python library using Rust via CFFI [0]. I have filled the student application form. I'm already trying to understand the correlation library and playing around with existing tests. How can I get more involved and better understand the requirements of the project? [0] - https://github.com/tremolo/rust_python_integration -- - Akshay Aurora ᐧ

2 3

syslog-ng 3.7.2
by Budai, László 22 Mar '16

22 Mar '16

3.7.2 This is the first maintenance release for the 3.7.x series. Changes compared to 3.7.1: Improvements - Added mbox() source. This source can be used to fetch emails from local mbox files: source { mbox("/var/spool/mail/root"); }; This will fetch root emails and parse them into a multiline $MSG. Original implementation by Fabien Wernli, I only converted it into an SCL. - It is possible to append dynamically options into SCL blocks from now. - concurrent_request option added to ElasticSearch with default value 1. - In elasticsearch destinaton, message_template() argument renamed to template(). - SCL added to every Java module (ElasticSearch, Kafka, HDFS). - Linux Audit Parser added for parsing key-value pairs produced by the Linux Audit subsystem. - HTTP destination is now able to receive HTTP method as an option. All the supported methods are available (POST, PUT, HEAD, OPTIONS, DELETE, TRACE, GET). Fixes - In some circumstances syslog-ng mod-journal re-read every already processed messages. - When syslog-ng got a reload and the reload process done within 1 second then mafter the reload, syslog-ng stop generating mark-messages. - When initialization of a network destination in syslog-ng failed (eg. due to DNS resolution failure) we didn't create a queue which caused message loss. - syslog-ng segfaulted on TLS errors when wrong certs was provided (eg.: CA cert with the cert-file directive instead of the server cert). - Fixed a continuous spinning case in the file driver, when the destination file is a device (e.g. /dev/stdout). - A memory leak in around template functions in grammar fixed. - Fixed Python3 support. - Fixed Python GIL issue in python destination. - From now, instead of skipping doc/ alltogether when ENABLE_MANPAGES is not set, only skip the actual man pages, but handle the rest properly. - Allow overriding the python setup.py options. When installing the python modules, allow overriding the options. This is useful for distributions that want to pass extra options. For example, on Debian, we want --install-layout="deb" instead of the --prefix and --root options. With this change, the previous behaviour remains the default, but one can supply PYSETUP_OPTIONS on the make command-line to override it. - The systemd service file read /etc/default/syslog-ng and /etc/sysconfig/syslog-ng, but didn't do anything with their contents. $SYSLOGNG_OPTS added to ExecStart, so that the EnvironmentFiles have an effect (at least on Debian). - Java support checking fixed (not only jdk is required but also gradle). - Memory leak around ping() in Redis fixed. - A crash in pdbtool fixed around r_parser_email(). - Removed cygwin fdlimit statement. Make the default for RLIMIT_NOFILE equal to the current system limits. --fd-limit can still override this, but the default will be configured based on existing system limits. - Fixed BSD year inference. Fixed logic and made clearer the inference of year from bsd-style rfc3164 syslog-messages, which do not include a year. - Handle correctly the epoch 0 timestamp. (Previously, syslog-ng cached the zero timestamp and treated 1970 as it was 1900.) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Adam Arsenault, Adam Istvan Mozes, Andras Mitzki, Avleen Vig, Balazs Scheidler, Fabien Wernli, Gergely Czuczy, Gergely Nagy, Gergo Nagy, Laszlo Budai, Peter Czanik, Robert Fekete, Saurabh Shukla, Tamas Nagy, Tibor Benke, Viktor Juhasz, Vincent Bernat, Wang Long, Zdenek Styblik, Zoltan Pallagi. — View it on GitHub <https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.7.2>.

4 3

error='self signed certificate in certificate chain'
by Girish Kumar 17 Mar '16

17 Mar '16

Hi All, I am getting following error while starting syslog-ng with tls option. Could you please help me on this Mar 12 18:14:24 (none) syslog-ng[6136]: Syslog connection established; fd='5', server='AF_INET(10.135.83.103:6514)', local='AF_INET(0.0.0.0:0)' Mar 12 18:14:24 (none) syslog-ng[6136]: Certificate validation failed; subject='emailAddress=giri(a)gmail.com, CN=girish kumar, OU=esd, O=enterprise, L=BAN, ST=KA, C=IN', issuer='emailAddress=giri(a)gmail.com, CN=girish kumar, OU=esd, O=enterprise, L=BAN, ST=KA, C=IN', error='self signed certificate in certificate chain', depth='1' Mar 12 18:14:24 (none) syslog-ng[6136]: SSL error while writing stream; tls_error='SSL routines:ssl3_get_server_certificate:certificate verify failed' Mar 12 18:14:24 (none) syslog-ng[6136]: I/O error occurred while writing; fd='5', error='Broken pipe (32)' Mar 12 18:14:24 (none) syslog-ng[6136]: Syslog connection broken; fd='5', server='AF_INET(10.135.83.103:6514)', time_reopen='60' //server conf source d_source { #syslog(ip("mysyslog.server.com") port(6514) syslog(ip("10.135.83.103") port(6514) transport("tls") tls( key_file("/etc/cert.d/mySerPrivate.key") cert_file("/etc/cert.d/mySerCert.pem") ca_dir("/etc/ca.d") ssl-options(no-sslv2, no-sslv3, no-tlsv1, no-tlsv11) ) ); }; //Client conf destination d_destination { #syslog("mysyslog.server.com" port(6514) syslog("10.135.83.103" port(6514) transport("tls") tls( ca_dir("/etc/ca.d") key_file("/etc/cert.d/myCliPrivate.key") cert_file("/etc/cert.d/myCliCert.pem") ssl-options(no-sslv2, no-sslv3, no-tlsv1, no-tlsv11) ) ); }; Regard, Girish

2 5

[GSOC]Some questions about the project:WebSocket for syslog-ng
by Yilin Li 17 Mar '16

17 Mar '16

Hi, I got some questions about GSOC Project: WebSocket for syslog-ng 1) WebSocket support two-way communication. However, I found only one-way communication will be used in the project Idea. If this destination will be used for alerting, what are the advantages of using Websocket? Is it mainly for supporting another new protocol or better performance of WebSocket ? 2) It says we need a sample webserver to receive and handle messages coming from syslog-ng. Can this sample webserver written in python ? Does "handle" just mean recieve messages and display them to prove the destination is working properly? Need the webserver do anything else such as writing them to files or sending emails for altering? Thanks :) -- Thanks, Yiln Li -- Institute of Software Chinese Academy of Sciences

3 5

[GSoC]
by Juhász, Viktor 16 Mar '16

16 Mar '16

Dear GSoC Student Applicant, We would like to thank you for filling the Student Application Form. To finish your application process, do not forget to write your proposal Best Regards, Viktor Juhasz The syslog-ng project

1 0

Re: [syslog-ng] syslog-ng GSoC 2016
by Laszlo Budai 11 Mar '16

11 Mar '16

Hi, please read the GSoC docs provided by Google: https://developers.google.com/open-source/gsoc/rules They say that : Each Student may submit up to five (5) Project Proposals; however, only one (1) Project Proposal may be accepted per Student. So the short answer is yes, you can :) L. Sent from my HTC ----- Reply message ----- From: "Yilin Li" <liyilin1214(a)gmail.com> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] syslog-ng GSoC 2016 Date: Thu, Mar 10, 2016 17:06 Hi, Really grateful for your guidance. I've got some questions. If I'm interested in more than one projects. Can I submit more than one proposals? Thanks! 2016-03-10 23:24 GMT+08:00 Budai, László <laszlo.budai(a)balabit.com>: > Hi, > > the syslog-ng team invites you to join GSoC with us : > http://youtu.be/hCLOGU8OooM . > > If you are interested in GSoC, visit our homepage where we share some > useful information with you: https://syslog-ng.org/gsoc-2016/ . > > > regards, > Laszlo Budai > > > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > -- Thanks, Yiln Li -- Institute of Software Chinese Academy of Sciences ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

2 1

syslog-ng GSoC 2016
by Budai, László 10 Mar '16

10 Mar '16

Hi, the syslog-ng team invites you to join GSoC with us : http://youtu.be/hCLOGU8OooM . If you are interested in GSoC, visit our homepage where we share some useful information with you: https://syslog-ng.org/gsoc-2016/ . regards, Laszlo Budai

2 1

[GSoC] Project: Kafka source
by md mehrab 10 Mar '16

10 Mar '16

Hi all, I am currently 4th year undergraduate student at Faculty of Engineering, Jamia Millia Islamia, New Delhi, India. I would like to contribute to a GSoC 2016 project with open source community of syslog-ng. In last summer vacation i worked (as intern )for a company where i was the part of data aggregator project (one of the core member of this project ). Main idea of this project is to build scalable system so that it can handle millions of request per minute. For this we used kafka messaging system. Producer simply produce message to particular topic and consumer get message from that topic and feed to async task (celery worker). I think I can contribute syslog-ng project kafka source. @Viktor Juhasz <https://github.com/juhaszviktor> (Mentor) kindly give me suggestions. -- Md Mehrab Alam https://www.linkedin.com/in/iammehrabalam https://github.com/iammehrabalam

2 3

Insider 2016-03: GSoC; disk buffer; Rust; blogs; DevConf.cz
by Czanik, Péter 10 Mar '16

10 Mar '16

Dear syslog-ng users, This is the 48th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Google Summer of Code (GSoC) ---------------------------- The syslog-ng project will participate GSoC this year again. We published our application form: https://syslog-ng.org/gsoc-2016-applicant-form-syslog-ng-project/ As you can see, we plan to publish a GsoC release once the coding period is over. Topics cover many different aspects of syslog-ng, from release engineering through database connections to message correlation. Disk-based buffering -------------------- Disk-based buffering is now merged to syslog-ng git master and will be part of syslog-ng 3.8. It can be used for storing messages on the local hard disk if the central log server or the network connection to the server becomes unavailable. The syslog-ng application automatically sends the stored messages to the server when the connection is reestablished. For details and information how to test it now read https://syslog-ng.org/493-2/ Rust: Filling the parse() method -------------------------------- Tibor Benke has posted an article about writing a parser that uses regular expressions in Rust. Read more at https://syslog-ng.org/filling-the-parse-method/ Parsers in syslog-ng: making sense of Zorp firewall logs -------------------------------------------------------- Figuring out how to parse your firewall logs is not always easy. This blogpost shows you some useful log-parsing techniques. For the examples, I use the logs of the Zorp proxy firewall. https://czanik.blogs.balabit.com/2016/03/making-sense-of-zorp-firewall-logs… Community driven blogging ------------------------- >From time to time, we publish blog posts about syslog-ng and we hope you find them interesting and useful. However, we would like to become better at this: we want to give you more and better content, more regularly. Also, we would like to be transparent about it, and give you the possibility to get involved. Read how you can participate: https://syslog-ng.org/525-2/ DevConf.cz ---------- This year it was even more difficult to decide how to spend my time at DevConf, the annual Fedora, Red Hat, JBoss developers’ conference in Brno. As a community manager for syslog-ng, I have tried to focus on community-related presentations and on technologies related to syslog-ng: containers, security and packaging. https://czanik.blogs.balabit.com/2016/02/devconf-2016-community-and-contain… NEW RELEASES syslog-ng PE 5 F6: https://istvanszabo.blogs.balabit.com/2016/03/syslog-ng-premium-edition-5f6… Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com . To read this newsletter on-line, visit: http://insider.blogs.balabit.com/ Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

NG License Usage
by Schoonover, Mark E HHHH 09 Mar '16

09 Mar '16

Thanks for reading, We had an issue today where a flood of new devices far exceeded our license count. Is there a way to monitor how many licenses are in use? We'd like to set up an alert to let us know we're close to running out of licenses. Thanks! Regards, Mark Schoonover Infrastructure Engineering Manager ENE : Tools, Instrumentation and Common Services Team Office: 32.8697° N, 116.9711° W Phone : 770-261-7934 Email : mark.schoonover(a)cigna.com<mailto:mark.schoonover@cigna.com> Confidential, unpublished property of Cigna Health & Life Insurance Co.. Do not duplicate or distribute. Use and distribution limited solely to authorized personnel. ©2016 CIGNA. ------------------------------------------------------------------------------ CONFIDENTIALITY NOTICE: If you have received this email in error, please immediately notify the sender by e-mail at the address shown. This email transmission may contain confidential information. This information is intended only for the use of the individual(s) or entity to whom it is intended even if addressed incorrectly. Please delete it from your files if you are not the intended recipient. Thank you for your compliance. Copyright (c) 2016 Cigna ==============================================================================

1 1

Syslog over TLS : Protocol is TCP and TLS
by Girish Kumar 09 Mar '16

09 Mar '16

Hi All, Finally I was able to setup syslog-ng client and server. Communicate over TLS. Thanks for all your help. In wireshark capture I am seeing all protocol as TCP and not as TLS. Please let me know whether my communication has happened over TLS. If yes how do I validate that. Can I enable additional logs in syslog-ng ? My tls part of conf file Client -------- destination d_destination { syslog("135.254.163.151" port(6514) transport("tls") tls( ca_dir("/etc/ca.d") key_file("/etc/cert.d/myCliPrivate.key") cert_file("/etc/cert.d/myCliCert.pem") ) ); }; Server --------- source d_source { syslog(ip("135.254.163.151") port(6514) transport("tls") tls( key_file("/etc/syslog-ng/cert.d/mySerPrivate.key") cert_file("/etc/syslog-ng/cert.d/mySerCert.pem") ca_dir("/etc/syslog-ng/ca.d")) ); }; Regards, Girish

2 5

removing old versions of syslog-ng
by Tim Lavin 08 Mar '16

08 Mar '16

Hi All, I recently inherited some old syslog-ng relay servers and I'm wanting to find the best way to upgrade them to syslog-ng PE 5.0. The syslog-ng versions are · 3.0.3 · 2.1.4 The PE admin guide mentions that upgrading is supported from OSE version 3.2. This leads me to understand I'll need to remove any version I find that's lower than 3.2, yet I do not see an uninstall script or reference to uninstalling syslog-ng in any of the documentation. Is uninstalling as simple as just removing all files and directories? Thanks, Tim Tim Lavin, Security Engineer Apollo Education Group, Inc | Security Operations 4035 S. Riverpoint Parkway │ MS: AA-M002 | Phoenix, AZ 85040 phone: 602-557-6400 | email: tim.lavin(a)phoenix.edu<mailto:tim.lavin@phoenix.edu> "This message is intended only for the use of the addressee(s) and may contain information that is PRIVILEGED and CONFIDENTIAL. If you are not the intended recipient(s), you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please erase all copies of the message and its attachments and notify the sender immediately."

3 2

Does syslog-ng 3.5.6 read from /run/systemd/journal/syslog ?
by Per Jessen 08 Mar '16

08 Mar '16

On openSUSE 13.2 with syslog-ng 3.5.6, I'm seeing these messages frequently: Mar 08 14:15:01 piccard systemd-journal[367]: Forwarding to syslog missed 1 messages. Mar 08 14:15:43 piccard systemd-journal[367]: Forwarding to syslog missed 3 messages. Mar 08 14:20:01 piccard systemd-journal[367]: Forwarding to syslog missed 1 messages. Mar 08 14:20:43 piccard systemd-journal[367]: Forwarding to syslog missed 1 messages. journald by default has ForwardtoSyslog=yes, but # lsof /run/systemd/journal/syslog COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME systemd 1 root 27u unix 0xffff880013130400 0t0 13446 /run/systemd/journal/syslog syslog-ng 584 root 3u unix 0xffff880013130400 0t0 13446 /run/systemd/journal/syslog seems to suggest syslog-ng is reading from /run/systemd/journal/syslog ? syslog-ng.conf: source src { system(); internal(); }; -- Per Jessen, Zürich (2.4°C) http://www.dns24.ch/ - your free DNS host, made in Switzerland.

1 1

Community driven blogging
by Budai, László 07 Mar '16

07 Mar '16

Hi, from time to time, we publish blog posts about syslog-ng and we hope you find them interesting and useful. However, we would like to become better at this: we want to give you more and better content, more regularly. Also, we would like to be transparent about it, and give you the possibility to get involved. Continue reading : https://syslog-ng.org/525-2/ regards, Laszlo Budai

1 0

Re: [syslog-ng] Regarding GSoC16 Project: syslog-ng as a command line tool
by Scheidler, Balázs 07 Mar '16

07 Mar '16

Hi, I've Cced the syslog-ng list, so others can see this description as well. The goal here is to change syslog-ng to be able to process input from stdin and produce output to stdout and exit when the EOF is reached, while processing a "potentially" simplified syslog-ng configuration block. A bit similar to how awk works, but instead of the awk language, use syslog-ng's constructs. E.g. $ syslog-ng -P 'parser { kv-parser(); }; destination { stdout(template("$(format-json *"))); };' < log-file-with-keywords.log > log-file-in-json Where -P would be equivalent to --pipe, the next argument is a configuration snippet. This snippet would get all logs as read from stdin() and that would be default functionality provided by the --pipe construct. Probably --pipe would use a configuration file something like: log { source { stdin(); }; # program supplied by --pipe would be included here pipe-program(); }; This is the basic idea, some customization would be useful, like: - being able to specify the source as well (so the above wouldn't be hardwired, only used as a default) - maybe use a default for output as well, so I wouldn't have to include it in the actual language - examples: a few examples how to process existing log files from postfix, iptables, snort/suricata, etc to convert their logs into json. This would be both a set of examples and could also drive the functionality further, so we don't miss important options. Code wise, this would need something like: - stdin source: would probably only be an SCL wrapper around the existing file() driver; e.g. file("/dev/stdin"); check for portability on various UNIXes (freebsd, solaris, macosx) - stdout destination: would probably only be an SCL wrapper around the existing file driver, e.g. file("/dev/stdout"); - stderr destinatiion: would probably only be an SCL wrapper around the existing file driver, e.g. file("/dev/stderr"); - a means to construct the complete configuration as passed in by command line arguments; would probably need to register confgen blocks, and a larger configuration frame where they are inserted. - a means to terminate syslog-ng when we read the entire input and all outputs are finished. (would probably be the most difficult) - tests Hope this helps. Bazsi -- Bazsi On Mon, Mar 7, 2016 at 6:37 AM, Viraj Madhawa <emadhawa23(a)gmail.com> wrote: > Dear Sir, > > I'm a computer engineering undergraduate student of University of > Peradeniya Sri Lanka. During my internship period I done a log managment > system project to a bank (using syslog protocol) . I'm quite interested > about this project idea and I like to get more details about it (ask some > questions). > > -- > Thank you, > Viraj Premaratne > > >

1 0

GSoC'16 [Automated release generation for syslog-ng]
by Arpit Singla 06 Mar '16

06 Mar '16

Hi, I am Arpit Singla. I would love to contribute to "Automated release generation for syslog-ng" project. I am an active member of SDSLabs <https://sdslabs.co/> and have a good knowledge of python. Please help me get started. Arpit Singla B.Tech., 2nd year, Electrical Engineering IIT Roorkee

1 0

For GSoC students
by Budai, László 06 Mar '16

06 Mar '16

Hi, here is a nice chance for contributing to syslog-ng : https://github.com/balabit/syslog-ng/pull/952 regards, Laszlo Budai

2 1

syslog-ng 3.7.2 + ES 2.2.0
by Robin Blanchard 04 Mar '16

04 Mar '16

Hi, I'm trying to push from syslog-ng-3.7.2 (yum repo czanik-syslog-ng37) directly into a single-node ES 2.2.0 (yum repo elasticsearch-2.x). Relevant syslog-ng.conf snippet: destination d_elasticsearch { elasticsearch( index("syslog-ng_${YEAR}.${MONTH}.${DAY}") type("syslog-ng") class-path("/usr/lib64/syslog-ng/java-modules/*.jar:/usr/lib/syslog-ng-java-module-dependency-jars/jars/*.jar:/usr/share/elasticsearch/lib/*.jar:/usr/share/elasticsearch/modules/*.jar") client_mode("node") server("127.0.0.1") port("9300") cluster("dev-elasticsearch") #client_mode("transport") #resource("/etc/elasticsearch/elasticsearch.yml") template("$(format-json -s all-nv-pairs -p @timestamp=$ISODATE -p @message=$MSG)") ); }; Very minimal elasticsearch.yaml: cluster.name: dev-elasticsearch node.name: dev-applog01 network.host: 127.0.0.1 http.port: 9200 node.master: true node.data: true node.max_local_storage_nodes: 1 discovery.zen.ping.multicast.enabled: false discovery.zen.ping.unicast.hosts: ["dev-applog01.dev.local"] #discovery.zen.ping.unicast.hosts: ["127.0.0.1"] ES itself looks happy: $ curl 'localhost:9200/_nodes/jvm?pretty' { "cluster_name" : "dev-elasticsearch", "nodes" : { "QkZpHu32Rdeh0InUvsSSKw" : { "name" : "dev-applog01", "transport_address" : "127.0.0.1:9300", "host" : "127.0.0.1", "ip" : "127.0.0.1", "version" : "2.2.0", "build" : "8ff36d1", "http_address" : "127.0.0.1:9200", "attributes" : { "max_local_storage_nodes" : "1", "master" : "true" }, "jvm" : { "pid" : 25310, "version" : "1.8.0_66", "vm_name" : "Java HotSpot(TM) 64-Bit Server VM", "vm_version" : "25.66-b17", "vm_vendor" : "Oracle Corporation", "start_time_in_millis" : 1457041645379, "mem" : { "heap_init_in_bytes" : 8589934592, "heap_max_in_bytes" : 8572502016, "non_heap_init_in_bytes" : 2555904, "non_heap_max_in_bytes" : 0, "direct_max_in_bytes" : 8572502016 }, "gc_collectors" : [ "ParNew", "ConcurrentMarkSweep" ], "memory_pools" : [ "Code Cache", "Metaspace", "Compressed Class Space", "Par Eden Space", "Par Survivor Space", "CMS Old Gen" ], "using_compressed_ordinary_object_pointers" : "true" } } } } $ curl -XGET 'http://localhost:9200/_cluster/health?pretty=true' { "cluster_name" : "dev-elasticsearch", "status" : "green", "timed_out" : false, "number_of_nodes" : 1, "number_of_data_nodes" : 1, "active_primary_shards" : 0, "active_shards" : 0, "relocating_shards" : 0, "initializing_shards" : 0, "unassigned_shards" : 0, "delayed_unassigned_shards" : 0, "number_of_pending_tasks" : 0, "number_of_in_flight_fetch" : 0, "task_max_waiting_in_queue_millis" : 0, "active_shards_percent_as_number" : 100.0 } $ curl localhost:9200 { "name" : "dev-applog01", "cluster_name" : "dev-elasticsearch", "version" : { "number" : "2.2.0", "build_hash" : "8ff36d139e16f8720f2947ef62c8167a888992fe", "build_timestamp" : "2016-01-27T13:32:39Z", "build_snapshot" : false, "lucene_version" : "5.4.1" }, "tagline" : "You Know, for Search" } Syslog-ng seems to be unable to establish a connection. Running in the foreground I find: $ syslog-ng -dv -F [2016-03-03T18:18:32.583896] Systemd is detected as the running init system; [2016-03-03T18:18:32.584453] Starting to read include file; filename='/etc/syslog-ng/scl.conf', depth='1' [2016-03-03T18:18:32.584567] Global value changed; define='scl-root', value='/usr/share/syslog-ng/include/scl' [2016-03-03T18:18:32.584589] Global value changed; define='include-path', value='/etc/syslog-ng:/usr/share/syslog-ng/include' [2016-03-03T18:18:32.584747] Adding include file; filename='/usr/share/syslog-ng/include/scl/cim/template.conf' [2016-03-03T18:18:32.584754] Adding include file; filename='/usr/share/syslog-ng/include/scl/elasticsearch/plugin.conf' [2016-03-03T18:18:32.584758] Adding include file; filename='/usr/share/syslog-ng/include/scl/graphite/plugin.conf' [2016-03-03T18:18:32.584761] Adding include file; filename='/usr/share/syslog-ng/include/scl/hdfs/plugin.conf' [2016-03-03T18:18:32.584765] Adding include file; filename='/usr/share/syslog-ng/include/scl/kafka/plugin.conf' [2016-03-03T18:18:32.584769] Adding include file; filename='/usr/share/syslog-ng/include/scl/mbox/mbox.conf' [2016-03-03T18:18:32.584772] Adding include file; filename='/usr/share/syslog-ng/include/scl/nodejs/plugin.conf' [2016-03-03T18:18:32.584776] Adding include file; filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf' [2016-03-03T18:18:32.584779] Adding include file; filename='/usr/share/syslog-ng/include/scl/rewrite/cc-mask.conf' [2016-03-03T18:18:32.584782] Adding include file; filename='/usr/share/syslog-ng/include/scl/solaris/plugin.conf' [2016-03-03T18:18:32.584786] Adding include file; filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf' [2016-03-03T18:18:32.584790] Adding include file; filename='/usr/share/syslog-ng/include/scl/system/plugin.conf' [2016-03-03T18:18:32.584799] Starting to read include file; filename='/usr/share/syslog-ng/include/scl/cim/template.conf', depth='2' [2016-03-03T18:18:32.584864] Reading path for candidate modules; path='//usr/lib64/syslog-ng' [2016-03-03T18:18:32.584910] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='grok-parser.so', module='grok-parser' [2016-03-03T18:18:32.585383] Registering candidate plugin; module='grok-parser', context='parser', name='grok', preference='0' [2016-03-03T18:18:32.585442] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='tfgetent.so', module='tfgetent' [2016-03-03T18:18:32.585579] Registering candidate plugin; module='tfgetent', context='template-func', name='getent', preference='0' [2016-03-03T18:18:32.585600] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='dbparser.so', module='dbparser' [2016-03-03T18:18:32.585760] Registering candidate plugin; module='dbparser', context='parser', name='db-parser', preference='0' [2016-03-03T18:18:32.585783] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='graphite.so', module='graphite' [2016-03-03T18:18:32.585905] Registering candidate plugin; module='graphite', context='template-func', name='graphite_output', preference='0' [2016-03-03T18:18:32.585925] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='basicfuncs-plus.so', module='basicfuncs-plus' [2016-03-03T18:18:32.586055] Registering candidate plugin; module='basicfuncs-plus', context='template-func', name='//', preference='0' [2016-03-03T18:18:32.586062] Registering candidate plugin; module='basicfuncs-plus', context='template-func', name='state', preference='0' [2016-03-03T18:18:32.586080] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='syslogformat.so', module='syslogformat' [2016-03-03T18:18:32.586235] Registering candidate plugin; module='syslogformat', context='format', name='syslog', preference='0' [2016-03-03T18:18:32.586247] Registering candidate plugin; module='syslogformat', context='parser', name='syslog-parser', preference='0' [2016-03-03T18:18:32.586266] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='basicfuncs.so', module='basicfuncs' [2016-03-03T18:18:32.586405] Registering candidate plugin; module='basicfuncs', context='template-func', name='grep', preference='0' [2016-03-03T18:18:32.586413] Registering candidate plugin; module='basicfuncs', context='template-func', name='if', preference='0' [2016-03-03T18:18:32.586417] Registering candidate plugin; module='basicfuncs', context='template-func', name='or', preference='0' [2016-03-03T18:18:32.586422] Registering candidate plugin; module='basicfuncs', context='template-func', name='echo', preference='0' [2016-03-03T18:18:32.586427] Registering candidate plugin; module='basicfuncs', context='template-func', name='length', preference='0' [2016-03-03T18:18:32.586431] Registering candidate plugin; module='basicfuncs', context='template-func', name='substr', preference='0' [2016-03-03T18:18:32.586436] Registering candidate plugin; module='basicfuncs', context='template-func', name='strip', preference='0' [2016-03-03T18:18:32.586462] Registering candidate plugin; module='basicfuncs', context='template-func', name='sanitize', preference='0' [2016-03-03T18:18:32.586467] Registering candidate plugin; module='basicfuncs', context='template-func', name='lowercase', preference='0' [2016-03-03T18:18:32.586472] Registering candidate plugin; module='basicfuncs', context='template-func', name='uppercase', preference='0' [2016-03-03T18:18:32.586476] Registering candidate plugin; module='basicfuncs', context='template-func', name='replace-delimiter', preference='0' [2016-03-03T18:18:32.586481] Registering candidate plugin; module='basicfuncs', context='template-func', name='padding', preference='0' [2016-03-03T18:18:32.586485] Registering candidate plugin; module='basicfuncs', context='template-func', name='+', preference='0' [2016-03-03T18:18:32.586489] Registering candidate plugin; module='basicfuncs', context='template-func', name='-', preference='0' [2016-03-03T18:18:32.586493] Registering candidate plugin; module='basicfuncs', context='template-func', name='*', preference='0' [2016-03-03T18:18:32.586498] Registering candidate plugin; module='basicfuncs', context='template-func', name='/', preference='0' [2016-03-03T18:18:32.586502] Registering candidate plugin; module='basicfuncs', context='template-func', name='%', preference='0' [2016-03-03T18:18:32.586506] Registering candidate plugin; module='basicfuncs', context='template-func', name='ipv4-to-int', preference='0' [2016-03-03T18:18:32.586510] Registering candidate plugin; module='basicfuncs', context='template-func', name='indent-multi-line', preference='0' [2016-03-03T18:18:32.586515] Registering candidate plugin; module='basicfuncs', context='template-func', name='context-length', preference='0' [2016-03-03T18:18:32.586519] Registering candidate plugin; module='basicfuncs', context='template-func', name='env', preference='0' [2016-03-03T18:18:32.586523] Registering candidate plugin; module='basicfuncs', context='template-func', name='template', preference='0' [2016-03-03T18:18:32.586544] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='afstomp.so', module='afstomp' [2016-03-03T18:18:32.586674] Registering candidate plugin; module='afstomp', context='destination', name='stomp', preference='0' [2016-03-03T18:18:32.586695] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='monitor-source.so', module='monitor-source' [2016-03-03T18:18:32.586911] Registering candidate plugin; module='monitor-source', context='source', name='monitor', preference='0' [2016-03-03T18:18:32.586945] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='afamqp.so', module='afamqp' [2016-03-03T18:18:32.587080] Registering candidate plugin; module='afamqp', context='destination', name='amqp', preference='0' [2016-03-03T18:18:32.587102] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='trigger-source.so', module='trigger-source' [2016-03-03T18:18:32.587228] Registering candidate plugin; module='trigger-source', context='source', name='trigger', preference='0' [2016-03-03T18:18:32.587249] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='lua.so', module='lua' [2016-03-03T18:18:32.587721] Registering candidate plugin; module='lua', context='destination', name='lua', preference='0' [2016-03-03T18:18:32.587763] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='confgen.so', module='confgen' [2016-03-03T18:18:32.587904] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='mod-java.so', module='mod-java' [2016-03-03T18:18:32.589487] Registering candidate plugin; module='mod-java', context='destination', name='java', preference='0' [2016-03-03T18:18:32.589637] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='system-source.so', module='system-source' [2016-03-03T18:18:32.589795] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='sdjournal.so', module='sdjournal' [2016-03-03T18:18:32.589931] Registering candidate plugin; module='sdjournal', context='source', name='systemd-journal', preference='0' [2016-03-03T18:18:32.589954] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='afprog.so', module='afprog' [2016-03-03T18:18:32.590113] Registering candidate plugin; module='afprog', context='source', name='program', preference='0' [2016-03-03T18:18:32.590120] Registering candidate plugin; module='afprog', context='destination', name='program', preference='0' [2016-03-03T18:18:32.590139] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='kafka.so', module='kafka' [2016-03-03T18:18:32.590331] Registering candidate plugin; module='kafka', context='destination', name='kafka', preference='0' [2016-03-03T18:18:32.590366] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='pseudofile.so', module='pseudofile' [2016-03-03T18:18:32.590493] Registering candidate plugin; module='pseudofile', context='destination', name='pseudofile', preference='0' [2016-03-03T18:18:32.590514] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='linux-kmsg-format.so', module='linux-kmsg-format' [2016-03-03T18:18:32.590642] Registering candidate plugin; module='linux-kmsg-format', context='format', name='linux-kmsg', preference='0' [2016-03-03T18:18:32.590661] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='affile.so', module='affile' [2016-03-03T18:18:32.590798] Registering candidate plugin; module='affile', context='source', name='file', preference='0' [2016-03-03T18:18:32.590807] Registering candidate plugin; module='affile', context='source', name='pipe', preference='0' [2016-03-03T18:18:32.590812] Registering candidate plugin; module='affile', context='destination', name='file', preference='0' [2016-03-03T18:18:32.590817] Registering candidate plugin; module='affile', context='destination', name='pipe', preference='0' [2016-03-03T18:18:32.590836] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='afsocket.so', module='afsocket' [2016-03-03T18:18:32.591123] Registering candidate plugin; module='afsocket', context='source', name='unix-stream', preference='100' [2016-03-03T18:18:32.591132] Registering candidate plugin; module='afsocket', context='destination', name='unix-stream', preference='100' [2016-03-03T18:18:32.591137] Registering candidate plugin; module='afsocket', context='source', name='unix-dgram', preference='100' [2016-03-03T18:18:32.591141] Registering candidate plugin; module='afsocket', context='destination', name='unix-dgram', preference='100' [2016-03-03T18:18:32.591146] Registering candidate plugin; module='afsocket', context='source', name='tcp', preference='100' [2016-03-03T18:18:32.591150] Registering candidate plugin; module='afsocket', context='destination', name='tcp', preference='100' [2016-03-03T18:18:32.591164] Registering candidate plugin; module='afsocket', context='source', name='tcp6', preference='100' [2016-03-03T18:18:32.591169] Registering candidate plugin; module='afsocket', context='destination', name='tcp6', preference='100' [2016-03-03T18:18:32.591173] Registering candidate plugin; module='afsocket', context='source', name='udp', preference='100' [2016-03-03T18:18:32.591178] Registering candidate plugin; module='afsocket', context='destination', name='udp', preference='100' [2016-03-03T18:18:32.591182] Registering candidate plugin; module='afsocket', context='source', name='udp6', preference='100' [2016-03-03T18:18:32.591187] Registering candidate plugin; module='afsocket', context='destination', name='udp6', preference='100' [2016-03-03T18:18:32.591191] Registering candidate plugin; module='afsocket', context='source', name='syslog', preference='100' [2016-03-03T18:18:32.591195] Registering candidate plugin; module='afsocket', context='destination', name='syslog', preference='100' [2016-03-03T18:18:32.591234] Registering candidate plugin; module='afsocket', context='source', name='network', preference='100' [2016-03-03T18:18:32.591240] Registering candidate plugin; module='afsocket', context='destination', name='network', preference='100' [2016-03-03T18:18:32.591244] Registering candidate plugin; module='afsocket', context='source', name='systemd-syslog', preference='100' [2016-03-03T18:18:32.591280] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='json-plugin.so', module='json-plugin' [2016-03-03T18:18:32.591464] Registering candidate plugin; module='json-plugin', context='parser', name='json-parser', preference='0' [2016-03-03T18:18:32.591479] Registering candidate plugin; module='json-plugin', context='template-func', name='format_json', preference='0' [2016-03-03T18:18:32.591516] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='afuser.so', module='afuser' [2016-03-03T18:18:32.591703] Registering candidate plugin; module='afuser', context='destination', name='usertty', preference='0' [2016-03-03T18:18:32.591727] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='csvparser.so', module='csvparser' [2016-03-03T18:18:32.591846] Registering candidate plugin; module='csvparser', context='parser', name='csv-parser', preference='0' [2016-03-03T18:18:32.591867] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='rss.so', module='rss' [2016-03-03T18:18:32.592020] Registering candidate plugin; module='rss', context='destination', name='rss', preference='0' [2016-03-03T18:18:32.592050] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='date-parser.so', module='date-parser' [2016-03-03T18:18:32.592171] Registering candidate plugin; module='date-parser', context='parser', name='date-parser', preference='0' [2016-03-03T18:18:32.592193] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='kvformat.so', module='kvformat' [2016-03-03T18:18:32.592252] Registering candidate plugin; module='kvformat', context='parser', name='kv-parser', preference='0' [2016-03-03T18:18:32.592259] Registering candidate plugin; module='kvformat', context='parser', name='linux-audit-parser', preference='0' [2016-03-03T18:18:32.592264] Registering candidate plugin; module='kvformat', context='template-func', name='format-welf', preference='0' [2016-03-03T18:18:32.592283] Reading shared object for a candidate module; path='//usr/lib64/syslog-ng', fname='cryptofuncs.so', module='cryptofuncs' [2016-03-03T18:18:32.592399] Registering candidate plugin; module='cryptofuncs', context='template-func', name='uuid', preference='0' [2016-03-03T18:18:32.592406] Registering candidate plugin; module='cryptofuncs', context='template-func', name='hash', preference='0' [2016-03-03T18:18:32.592411] Registering candidate plugin; module='cryptofuncs', context='template-func', name='sha1', preference='0' [2016-03-03T18:18:32.592416] Registering candidate plugin; module='cryptofuncs', context='template-func', name='sha256', preference='0' [2016-03-03T18:18:32.592421] Registering candidate plugin; module='cryptofuncs', context='template-func', name='sha512', preference='0' [2016-03-03T18:18:32.592425] Registering candidate plugin; module='cryptofuncs', context='template-func', name='md4', preference='0' [2016-03-03T18:18:32.592430] Registering candidate plugin; module='cryptofuncs', context='template-func', name='md5', preference='0' [2016-03-03T18:18:32.592692] Module loaded and initialized successfully; module='json-plugin' [2016-03-03T18:18:32.592840] Finishing include; filename='/usr/share/syslog-ng/include/scl/cim/template.conf', depth='2' [2016-03-03T18:18:32.592875] Starting to read include file; filename='/usr/share/syslog-ng/include/scl/elasticsearch/plugin.conf', depth='2' [2016-03-03T18:18:32.593010] Finishing include; filename='/usr/share/syslog-ng/include/scl/elasticsearch/plugin.conf', depth='2' [2016-03-03T18:18:32.593027] Starting to read include file; filename='/usr/share/syslog-ng/include/scl/graphite/plugin.conf', depth='2' [2016-03-03T18:18:32.593090] Finishing include; filename='/usr/share/syslog-ng/include/scl/graphite/plugin.conf', depth='2' [2016-03-03T18:18:32.593105] Starting to read include file; filename='/usr/share/syslog-ng/include/scl/hdfs/plugin.conf', depth='2' [2016-03-03T18:18:32.593179] Finishing include; filename='/usr/share/syslog-ng/include/scl/hdfs/plugin.conf', depth='2' [2016-03-03T18:18:32.593194] Starting to read include file; filename='/usr/share/syslog-ng/include/scl/kafka/plugin.conf', depth='2' [2016-03-03T18:18:32.593269] Finishing include; filename='/usr/share/syslog-ng/include/scl/kafka/plugin.conf', depth='2' [2016-03-03T18:18:32.593293] Starting to read include file; filename='/usr/share/syslog-ng/include/scl/mbox/mbox.conf', depth='2' [2016-03-03T18:18:32.593351] Finishing include; filename='/usr/share/syslog-ng/include/scl/mbox/mbox.conf', depth='2' [2016-03-03T18:18:32.593365] Starting to read include file; filename='/usr/share/syslog-ng/include/scl/nodejs/plugin.conf', depth='2' [2016-03-03T18:18:32.593429] Finishing include; filename='/usr/share/syslog-ng/include/scl/nodejs/plugin.conf', depth='2' [2016-03-03T18:18:32.593460] Starting to read include file; filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', depth='2' [2016-03-03T18:18:32.593527] Finishing include; filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', depth='2' [2016-03-03T18:18:32.593541] Starting to read include file; filename='/usr/share/syslog-ng/include/scl/rewrite/cc-mask.conf', depth='2' [2016-03-03T18:18:32.593611] Global value changed; define='balabit.credit-card-regexp', value='(?P<1>:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|6(?:011|5[0-9][0-9])[0-9]{12}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|(?:2131|1800|35d{3})d{11})' [2016-03-03T18:18:32.593650] Finishing include; filename='/usr/share/syslog-ng/include/scl/rewrite/cc-mask.conf', depth='2' [2016-03-03T18:18:32.593676] Starting to read include file; filename='/usr/share/syslog-ng/include/scl/solaris/plugin.conf', depth='2' [2016-03-03T18:18:32.593715] Finishing include; filename='/usr/share/syslog-ng/include/scl/solaris/plugin.conf', depth='2' [2016-03-03T18:18:32.593728] Starting to read include file; filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf', depth='2' [2016-03-03T18:18:32.593952] Module loaded and initialized successfully; module='confgen' [2016-03-03T18:18:32.593965] Finishing include; filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf', depth='2' [2016-03-03T18:18:32.593992] Starting to read include file; filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', depth='2' [2016-03-03T18:18:32.594201] Module loaded and initialized successfully; module='system-source' [2016-03-03T18:18:32.594216] Finishing include; filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', depth='2' [2016-03-03T18:18:32.594234] Finishing include; filename='/etc/syslog-ng/scl.conf', depth='1' [2016-03-03T18:18:32.595508] Module loaded and initialized successfully; module='mod-java' [2016-03-03T18:18:32.596214] Module loaded and initialized successfully; module='sdjournal' [2016-03-03T18:18:32.596321] Finishing include; content='source confgen system', depth='1' [2016-03-03T18:18:32.596649] Module loaded and initialized successfully; module='afsocket' [2016-03-03T18:18:32.596952] Module loaded and initialized successfully; module='affile' [2016-03-03T18:18:32.597231] Finishing include; content='destination block elasticsearch', depth='1' [2016-03-03T18:18:32.597670] Compiling #unnamed sequence [log] at [/etc/syslog-ng/syslog-ng.conf:105:5] [2016-03-03T18:18:32.597677] Compiling s_all reference [source] at [/etc/syslog-ng/syslog-ng.conf:105:5] [2016-03-03T18:18:32.597681] Compiling s_all sequence [source] at [/etc/syslog-ng/syslog-ng.conf:46:1] [2016-03-03T18:18:32.597685] Compiling #unnamed junction [log] at [/etc/syslog-ng/syslog-ng.conf:46:15] [2016-03-03T18:18:32.597688] Compiling #unnamed sequence [log] at [source confgen system:2:5] [2016-03-03T18:18:32.597691] Compiling #unnamed sequence [source] at [source confgen system:2:5] [2016-03-03T18:18:32.597694] Compiling #unnamed junction [log] at [source confgen system:2:13] [2016-03-03T18:18:32.597698] Compiling #unnamed single [log] at [source confgen system:3:1] [2016-03-03T18:18:32.597703] Compiling #unnamed junction [log] at [source confgen system:6:1] [2016-03-03T18:18:32.597706] Compiling #unnamed sequence [log] at [source confgen system:6:10] [2016-03-03T18:18:32.597709] Compiling #unnamed junction [log] at [source confgen system:7:3] [2016-03-03T18:18:32.597712] Compiling #unnamed sequence [log] at [source confgen system:8:5] [2016-03-03T18:18:32.597715] Compiling #unnamed sequence [parser] at [source confgen system:8:5] [2016-03-03T18:18:32.597718] Compiling #unnamed single [log] at [source confgen system:9:7] [2016-03-03T18:18:32.597723] Compiling #unnamed sequence [log] at [source confgen system:13:12] [2016-03-03T18:18:32.597727] Compiling #unnamed single [log] at [/etc/syslog-ng/syslog-ng.conf:48:5] [2016-03-03T18:18:32.597730] Compiling #unnamed single [log] at [/etc/syslog-ng/syslog-ng.conf:50:5] [2016-03-03T18:18:32.597733] Compiling #unnamed single [log] at [/etc/syslog-ng/syslog-ng.conf:51:5] [2016-03-03T18:18:32.597738] Compiling d_all reference [destination] at [/etc/syslog-ng/syslog-ng.conf:106:5] [2016-03-03T18:18:32.597741] Compiling d_all sequence [destination] at [/etc/syslog-ng/syslog-ng.conf:55:1] [2016-03-03T18:18:32.597745] Compiling #unnamed junction [log] at [/etc/syslog-ng/syslog-ng.conf:55:20] [2016-03-03T18:18:32.597748] Compiling #unnamed single [log] at [/etc/syslog-ng/syslog-ng.conf:56:5] [2016-03-03T18:18:32.597752] Compiling d_elasticsearch reference [destination] at [/etc/syslog-ng/syslog-ng.conf:108:5] [2016-03-03T18:18:32.597755] Compiling d_elasticsearch sequence [destination] at [/etc/syslog-ng/syslog-ng.conf:68:1] [2016-03-03T18:18:32.597758] Compiling #unnamed junction [log] at [/etc/syslog-ng/syslog-ng.conf:68:30] [2016-03-03T18:18:32.597761] Compiling #unnamed single [log] at [#buffer:2:3] [2016-03-03T18:18:32.597910] Seeking the journal to the last cursor position; cursor='s=72b441ec79314a56be3b86ef506fc109;i=3cfd;b=f0354cb6895a47b08113b3c5bd948cde;m=2ca3301178;t=52d2c4c757947;x=1ea7735e89f7c905' [2016-03-03T18:18:32.598177] Module loaded and initialized successfully; module='syslogformat' [2016-03-03T18:18:32.598539] WARNING: window sizing for tcp sources were changed in syslog-ng 3.3, the configuration value was divided by the value of max-connections(). The result was too small, clamping to 100 entries. Ensure you have a proper log_fifo_size setting to avoid message loss.; orig_log_iw_size='0', new_log_iw_size='100', min_log_fifo_size='102400' [2016-03-03T18:18:32.690908] Add path to classpath: //usr/lib64/syslog-ng/java-modules/syslog-ng-core.jar; [2016-03-03T18:18:32.691290] Add path to classpath: /usr/lib64/syslog-ng/java-modules/elastic.jar; [2016-03-03T18:18:32.691391] Add path to classpath: /usr/lib64/syslog-ng/java-modules/hdfs.jar; [2016-03-03T18:18:32.691478] Add path to classpath: /usr/lib64/syslog-ng/java-modules/java-modules.jar; [2016-03-03T18:18:32.691583] Add path to classpath: /usr/lib64/syslog-ng/java-modules/kafka.jar; [2016-03-03T18:18:32.691688] Add path to classpath: /usr/lib64/syslog-ng/java-modules/syslog-ng-core.jar; [2016-03-03T18:18:32.691793] Add path to classpath: /usr/lib64/syslog-ng/java-modules/log4j-1.2.16.jar; [2016-03-03T18:18:32.691883] Add path to classpath: /usr/lib64/syslog-ng/java-modules/dummy.jar; [2016-03-03T18:18:32.691985] Add path to classpath: /usr/lib64/syslog-ng/java-modules/syslog-ng-common.jar; [2016-03-03T18:18:32.692070] Add path to classpath: /usr/lib64/syslog-ng/java-modules/http.jar; [2016-03-03T18:18:32.692142] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/hsqldb-1.8.0.10.jar; [2016-03-03T18:18:32.692234] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/netty-3.7.0.Final.jar; [2016-03-03T18:18:32.692652] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/lucene-memory-4.10.4.jar; [2016-03-03T18:18:32.692785] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/elasticsearch-1.6.0.jar; [2016-03-03T18:18:32.692899] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/oro-2.0.8.jar; [2016-03-03T18:18:32.692990] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/kafka-clients-0.8.2.1.jar; [2016-03-03T18:18:32.693074] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/zkclient-0.3.jar; [2016-03-03T18:18:32.693164] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/commons-cli-1.2.jar; [2016-03-03T18:18:32.693259] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/commons-el-1.0.jar; [2016-03-03T18:18:32.693350] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/slf4j-api-1.7.10.jar; [2016-03-03T18:18:32.693432] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/asm-4.1.jar; [2016-03-03T18:18:32.693516] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/jasper-compiler-5.5.12.jar; [2016-03-03T18:18:32.693604] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/lucene-grouping-4.10.4.jar; [2016-03-03T18:18:32.693692] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/lz4-1.2.0.jar; [2016-03-03T18:18:32.693773] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/xml-apis-1.3.04.jar; [2016-03-03T18:18:32.693850] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/xercesImpl-2.9.1.jar; [2016-03-03T18:18:32.693947] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/httpcore-4.2.4.jar; [2016-03-03T18:18:32.694038] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/xz-1.0.jar; [2016-03-03T18:18:32.694118] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/lucene-core-4.10.4.jar; [2016-03-03T18:18:32.694246] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/lucene-queryparser-4.10.4.jar; [2016-03-03T18:18:32.694333] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/hadoop-annotations-2.7.1.jar; [2016-03-03T18:18:32.694420] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/commons-math-2.1.jar; [2016-03-03T18:18:32.694516] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/netty-all-4.0.23.Final.jar; [2016-03-03T18:18:32.694613] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/jets3t-0.9.0.jar; [2016-03-03T18:18:32.694705] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/junit-4.12.jar; [2016-03-03T18:18:32.694807] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/protobuf-java-2.5.0.jar; [2016-03-03T18:18:32.694893] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/gson-2.2.4.jar; [2016-03-03T18:18:32.694987] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/jsp-2.1-6.1.14.jar; [2016-03-03T18:18:32.695078] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/jetty-6.1.26.jar; [2016-03-03T18:18:32.695157] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/jackson-core-asl-1.9.13.jar; [2016-03-03T18:18:32.695248] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/avro-1.7.4.jar; [2016-03-03T18:18:32.695324] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/jasper-runtime-5.5.12.jar; [2016-03-03T18:18:32.695412] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/jersey-json-1.9.jar; [2016-03-03T18:18:32.695499] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/lucene-misc-4.10.4.jar; [2016-03-03T18:18:32.695598] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/hadoop-auth-2.7.1.jar; [2016-03-03T18:18:32.695686] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/snakeyaml-1.12.jar; [2016-03-03T18:18:32.695774] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/jsp-api-2.1.jar; [2016-03-03T18:18:32.695859] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/stax-api-1.0.1.jar; [2016-03-03T18:18:32.695936] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/jaxb-impl-2.2.3-1.jar; [2016-03-03T18:18:32.696041] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/servlet-api-2.5-20081211.jar; [2016-03-03T18:18:32.696137] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/commons-math3-3.1.1.jar; [2016-03-03T18:18:32.696229] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/slf4j-api-1.7.6.jar; [2016-03-03T18:18:32.696321] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/jersey-core-1.9.jar; [2016-03-03T18:18:32.696401] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/curator-framework-2.7.1.jar; [2016-03-03T18:18:32.696487] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/lucene-sandbox-4.10.4.jar; [2016-03-03T18:18:32.696566] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/jsch-0.1.42.jar; [2016-03-03T18:18:32.696646] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/syslog-ng-core.jar; [2016-03-03T18:18:32.696727] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/log4j-1.2.16.jar; [2016-03-03T18:18:32.696809] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/lucene-suggest-4.10.4.jar; [2016-03-03T18:18:32.696894] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/xmlenc-0.52.jar; [2016-03-03T18:18:32.697000] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/hadoop-common-2.7.1.jar; [2016-03-03T18:18:32.697095] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/curator-client-2.7.1.jar; [2016-03-03T18:18:32.701317] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/apacheds-i18n-2.0.0-M15.jar; [2016-03-03T18:18:32.701462] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/asm-3.1.jar; [2016-03-03T18:18:32.701548] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/htrace-core-3.1.0-incubating.jar; [2016-03-03T18:18:32.701689] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/lucene-queries-4.10.4.jar; [2016-03-03T18:18:32.701773] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/hadoop-hdfs-2.7.1.jar; [2016-03-03T18:18:32.701853] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/jersey-server-1.9.jar; [2016-03-03T18:18:32.701930] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/jsr305-3.0.0.jar; [2016-03-03T18:18:32.702013] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/jettison-1.1.jar; [2016-03-03T18:18:32.702090] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/ant-1.6.5.jar; [2016-03-03T18:18:32.702177] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/slf4j-log4j12-1.7.10.jar; [2016-03-03T18:18:32.702259] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/commons-io-2.4.jar; [2016-03-03T18:18:32.702331] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/commons-digester-1.8.jar; [2016-03-03T18:18:32.702403] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/jackson-mapper-asl-1.9.13.jar; [2016-03-03T18:18:32.702480] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/jline-0.9.94.jar; [2016-03-03T18:18:32.702552] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/apacheds-kerberos-codec-2.0.0-M15.jar; [2016-03-03T18:18:32.702639] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/asm-commons-4.1.jar; [2016-03-03T18:18:32.702715] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/spatial4j-0.4.1.jar; [2016-03-03T18:18:32.702794] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/servlet-api-2.5-6.1.14.jar; [2016-03-03T18:18:32.702869] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/lucene-analyzers-common-4.10.4.jar; [2016-03-03T18:18:32.702981] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/commons-httpclient-3.1.jar; [2016-03-03T18:18:32.703094] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/commons-daemon-1.0.13.jar; [2016-03-03T18:18:32.703176] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/paranamer-2.3.jar; [2016-03-03T18:18:32.703255] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/java-xmlbuilder-0.4.jar; [2016-03-03T18:18:32.703351] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/jackson-jaxrs-1.8.3.jar; [2016-03-03T18:18:32.703428] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/junit-3.8.1.jar; [2016-03-03T18:18:32.703498] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/log4j-1.2.17.jar; [2016-03-03T18:18:32.703569] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/jsp-api-2.1-6.1.14.jar; [2016-03-03T18:18:32.703652] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/metrics-core-2.2.0.jar; [2016-03-03T18:18:32.703728] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/syslog-ng-common.jar; [2016-03-03T18:18:32.703805] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/lucene-join-4.10.4.jar; [2016-03-03T18:18:32.703876] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/lucene-spatial-4.10.4.jar; [2016-03-03T18:18:32.703951] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/antlr-runtime-3.5.jar; [2016-03-03T18:18:32.704034] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/scala-library-2.10.4.jar; [2016-03-03T18:18:32.704112] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/activation-1.1.jar; [2016-03-03T18:18:32.704189] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/jopt-simple-3.2.jar; [2016-03-03T18:18:32.704278] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/lucene-highlighter-4.10.4.jar; [2016-03-03T18:18:32.704353] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/commons-collections-3.2.1.jar; [2016-03-03T18:18:32.704426] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/commons-logging-1.1.3.jar; [2016-03-03T18:18:32.704502] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/snappy-java-1.1.1.6.jar; [2016-03-03T18:18:32.704575] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/guava-16.0.1.jar; [2016-03-03T18:18:32.704656] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/leveldbjni-all-1.8.jar; [2016-03-03T18:18:32.704733] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/slf4j-log4j12-1.6.1.jar; [2016-03-03T18:18:32.704806] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/commons-compress-1.4.1.jar; [2016-03-03T18:18:32.706495] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/commons-beanutils-1.7.0.jar; [2016-03-03T18:18:32.706575] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/stax-api-1.0-2.jar; [2016-03-03T18:18:32.706643] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/kafka_2.10-0.8.2.1.jar; [2016-03-03T18:18:32.706719] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/commons-codec-1.6.jar; [2016-03-03T18:18:32.706783] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/core-3.1.1.jar; [2016-03-03T18:18:32.706842] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/httpclient-4.2.5.jar; [2016-03-03T18:18:32.706906] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/commons-configuration-1.6.jar; [2016-03-03T18:18:32.706987] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/jetty-util-6.1.26.jar; [2016-03-03T18:18:32.707051] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/hamcrest-core-1.3.jar; [2016-03-03T18:18:32.707116] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/api-util-1.0.0-M20.jar; [2016-03-03T18:18:32.707177] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/api-asn1-api-1.0.0-M20.jar; [2016-03-03T18:18:32.707250] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/curator-recipes-2.7.1.jar; [2016-03-03T18:18:32.707330] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/commons-net-3.1.jar; [2016-03-03T18:18:32.707393] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/servlet-api-2.5.jar; [2016-03-03T18:18:32.707453] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/commons-lang-2.6.jar; [2016-03-03T18:18:32.707535] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/jackson-xc-1.8.3.jar; [2016-03-03T18:18:32.707611] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/zookeeper-3.4.6.jar; [2016-03-03T18:18:32.707686] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/jaxb-api-2.2.2.jar; [2016-03-03T18:18:32.707751] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/snappy-java-1.0.4.1.jar; [2016-03-03T18:18:32.707813] Add path to classpath: /usr/lib/syslog-ng-java-module-dependency-jars/jars/commons-beanutils-core-1.8.0.jar; [2016-03-03T18:18:32.707897] Add path to classpath: /usr/share/elasticsearch/lib/lucene-sandbox-5.4.1.jar; [2016-03-03T18:18:32.707960] Add path to classpath: /usr/share/elasticsearch/lib/HdrHistogram-2.1.6.jar; [2016-03-03T18:18:32.708068] Add path to classpath: /usr/share/elasticsearch/lib/snakeyaml-1.15.jar; [2016-03-03T18:18:32.708221] Add path to classpath: /usr/share/elasticsearch/lib/lucene-backward-codecs-5.4.1.jar; [2016-03-03T18:18:32.708311] Add path to classpath: /usr/share/elasticsearch/lib/lucene-queries-5.4.1.jar; [2016-03-03T18:18:32.708402] Add path to classpath: /usr/share/elasticsearch/lib/hppc-0.7.1.jar; [2016-03-03T18:18:32.708489] Add path to classpath: /usr/share/elasticsearch/lib/lucene-highlighter-5.4.1.jar; [2016-03-03T18:18:32.708579] Add path to classpath: /usr/share/elasticsearch/lib/joda-time-2.8.2.jar; [2016-03-03T18:18:32.708666] Add path to classpath: /usr/share/elasticsearch/lib/netty-3.10.5.Final.jar; [2016-03-03T18:18:32.708753] Add path to classpath: /usr/share/elasticsearch/lib/lucene-join-5.4.1.jar; [2016-03-03T18:18:32.708814] Add path to classpath: /usr/share/elasticsearch/lib/lucene-grouping-5.4.1.jar; [2016-03-03T18:18:32.708870] Add path to classpath: /usr/share/elasticsearch/lib/jackson-dataformat-cbor-2.6.2.jar; [2016-03-03T18:18:32.708929] Add path to classpath: /usr/share/elasticsearch/lib/lucene-core-5.4.1.jar; [2016-03-03T18:18:32.709024] Add path to classpath: /usr/share/elasticsearch/lib/apache-log4j-extras-1.2.17.jar; [2016-03-03T18:18:32.709102] Add path to classpath: /usr/share/elasticsearch/lib/jackson-dataformat-yaml-2.6.2.jar; [2016-03-03T18:18:32.709166] Add path to classpath: /usr/share/elasticsearch/lib/lucene-analyzers-common-5.4.1.jar; [2016-03-03T18:18:32.709231] Add path to classpath: /usr/share/elasticsearch/lib/jackson-dataformat-smile-2.6.2.jar; [2016-03-03T18:18:32.709289] Add path to classpath: /usr/share/elasticsearch/lib/t-digest-3.0.jar; [2016-03-03T18:18:32.709341] Add path to classpath: /usr/share/elasticsearch/lib/joda-convert-1.2.jar; [2016-03-03T18:18:32.709392] Add path to classpath: /usr/share/elasticsearch/lib/commons-cli-1.3.1.jar; [2016-03-03T18:18:32.709443] Add path to classpath: /usr/share/elasticsearch/lib/spatial4j-0.5.jar; [2016-03-03T18:18:32.709497] Add path to classpath: /usr/share/elasticsearch/lib/log4j-1.2.17.jar; [2016-03-03T18:18:32.709548] Add path to classpath: /usr/share/elasticsearch/lib/jackson-core-2.6.2.jar; [2016-03-03T18:18:32.709598] Add path to classpath: /usr/share/elasticsearch/lib/jsr166e-1.1.0.jar; [2016-03-03T18:18:32.709651] Add path to classpath: /usr/share/elasticsearch/lib/lucene-misc-5.4.1.jar; [2016-03-03T18:18:32.709703] Add path to classpath: /usr/share/elasticsearch/lib/lucene-memory-5.4.1.jar; [2016-03-03T18:18:32.709754] Add path to classpath: /usr/share/elasticsearch/lib/lucene-spatial-5.4.1.jar; [2016-03-03T18:18:32.709808] Add path to classpath: /usr/share/elasticsearch/lib/lucene-spatial3d-5.4.1.jar; [2016-03-03T18:18:32.709866] Add path to classpath: /usr/share/elasticsearch/lib/jna-4.1.0.jar; [2016-03-03T18:18:32.709917] Add path to classpath: /usr/share/elasticsearch/lib/guava-18.0.jar; [2016-03-03T18:18:32.709976] Add path to classpath: /usr/share/elasticsearch/lib/elasticsearch-2.2.0.jar; [2016-03-03T18:18:32.710030] Add path to classpath: /usr/share/elasticsearch/lib/lucene-queryparser-5.4.1.jar; [2016-03-03T18:18:32.710084] Add path to classpath: /usr/share/elasticsearch/lib/lucene-suggest-5.4.1.jar; [2016-03-03T18:18:32.710135] Add path to classpath: /usr/share/elasticsearch/lib/jts-1.13.jar; [2016-03-03T18:18:32.710188] Add path to classpath: /usr/share/elasticsearch/lib/compiler-0.8.13.jar; [2016-03-03T18:18:32.710239] Add path to classpath: /usr/share/elasticsearch/lib/securesm-1.0.jar; [2016-03-03T18:18:32.710652] Add path to classpath: /usr/share/elasticsearch/lib/compress-lzf-1.0.2.jar; [2016-03-03T18:18:32.815477] Add path to classpath: //usr/lib64/syslog-ng/java-modules/syslog-ng-core.jar; [2016-03-03T18:18:32.995605] [Collector] version[1.6.0], pid[26563], build[cdd3ac4/2015-06-09T13:36:34Z]; [2016-03-03T18:18:32.995656] [Collector] initializing ...; [2016-03-03T18:18:32.995762] [Collector] using home [/home/dev.local/devadmin_rblanchard], config [/home/dev.local/devadmin_rblanchard/config], data [[/home/dev.local/devadmin_rblanchard/data]], logs [/home/dev.local/devadmin_rblanchard/logs], work [/home/dev.local/devadmin_rblanchard/work], plugins [/home/dev.local/devadmin_rblanchard/plugins]; [2016-03-03T18:18:33.001377] [Collector] [/home/dev.local/devadmin_rblanchard/plugins] directory does not exist.; [2016-03-03T18:18:33.002901] [Collector] [/home/dev.local/devadmin_rblanchard/plugins] directory does not exist.; [2016-03-03T18:18:33.003036] [Collector] loaded [], sites []; [2016-03-03T18:18:33.043579] using encoder [VanillaChunkDecoder] and decoder[{}] ; [2016-03-03T18:18:33.060562] [Collector] creating thread_pool [generic], type [cached], keep_alive [30s]; [2016-03-03T18:18:33.071549] [Collector] creating thread_pool [index], type [fixed], size [2], queue_size [200]; [2016-03-03T18:18:33.073694] [Collector] creating thread_pool [bulk], type [fixed], size [2], queue_size [50]; [2016-03-03T18:18:33.073796] [Collector] creating thread_pool [get], type [fixed], size [2], queue_size [1k]; [2016-03-03T18:18:33.073894] [Collector] creating thread_pool [search], type [fixed], size [4], queue_size [1k]; [2016-03-03T18:18:33.074009] [Collector] creating thread_pool [suggest], type [fixed], size [2], queue_size [1k]; [2016-03-03T18:18:33.074088] [Collector] creating thread_pool [percolate], type [fixed], size [2], queue_size [1k]; [2016-03-03T18:18:33.074182] [Collector] creating thread_pool [management], type [scaling], min [1], size [5], keep_alive [5m]; [2016-03-03T18:18:33.074874] [Collector] creating thread_pool [listener], type [fixed], size [1], queue_size [null]; [2016-03-03T18:18:33.074949] [Collector] creating thread_pool [flush], type [scaling], min [1], size [1], keep_alive [5m]; [2016-03-03T18:18:33.075029] [Collector] creating thread_pool [merge], type [scaling], min [1], size [1], keep_alive [5m]; [2016-03-03T18:18:33.075103] [Collector] creating thread_pool [refresh], type [scaling], min [1], size [1], keep_alive [5m]; [2016-03-03T18:18:33.075172] [Collector] creating thread_pool [warmer], type [scaling], min [1], size [1], keep_alive [5m]; [2016-03-03T18:18:33.075259] [Collector] creating thread_pool [snapshot], type [scaling], min [1], size [1], keep_alive [5m]; [2016-03-03T18:18:33.075324] [Collector] creating thread_pool [optimize], type [fixed], size [1], queue_size [null]; [2016-03-03T18:18:33.075394] [Collector] creating thread_pool [fetch_shard_started], type [scaling], min [1], size [4], keep_alive [5m]; [2016-03-03T18:18:33.075476] [Collector] creating thread_pool [fetch_shard_store], type [scaling], min [1], size [4], keep_alive [5m]; [2016-03-03T18:18:33.274792] [Collector] failed to load groovy; [2016-03-03T18:18:33.275906] [Collector] failed to load lucene expressions; [2016-03-03T18:18:34.190001] [Collector] enabled [true], last_gc_enabled [false], interval [1s], gc_threshold [{default=GcThreshold{name='default', warnThreshold=10000, infoThreshold=5000, debugThreshold=2000}, young=GcThreshold{name='young', warnThreshold=1000, infoThreshold=700, debugThreshold=400}, old=GcThreshold{name='old', warnThreshold=10000, infoThreshold=5000, debugThreshold=2000}}]; [2016-03-03T18:18:34.191027] [Collector] Using probe [org.elasticsearch.monitor.os.JmxOsProbe@26ae880a] with refresh_interval [1s]; [2016-03-03T18:18:34.194928] [Collector] Using probe [org.elasticsearch.monitor.process.JmxProcessProbe@185f7840] with refresh_interval [1s]; [2016-03-03T18:18:34.199815] [Collector] Using refresh_interval [1s]; [2016-03-03T18:18:34.200034] [Collector] Using probe [org.elasticsearch.monitor.network.JmxNetworkProbe@5bdd5689] with refresh_interval [5s]; [2016-03-03T18:18:34.201619] [Collector] net_info host [dev-applog01] eth91 display_name [eth91] address [/172.16.100.137] mtu [1500] multicast [true] ptp [false] loopback [false] up [true] virtual [false] lo display_name [lo] address [/127.0.0.1] mtu [65536] multicast [false] ptp [false] loopback [true] up [true] virtual [false] ; [2016-03-03T18:18:34.202074] [Collector] Using probe [org.elasticsearch.monitor.fs.JmxFsProbe@4c03a37] with refresh_interval [1s]; [2016-03-03T18:18:34.205731] using gathering [true]; [2016-03-03T18:18:34.231260] [Collector] using minimum_master_nodes [-1]; [2016-03-03T18:18:34.232708] [Collector] using group [224.2.2.4], with port [54328], ttl [3], and address [null]; [2016-03-03T18:18:34.236211] [Collector] using initial hosts [], with concurrent_connects [10]; [2016-03-03T18:18:34.237273] [Collector] using ping.timeout [3s], join.timeout [1m], master_election.filter_client [true], master_election.filter_data [false]; [2016-03-03T18:18:34.238426] [Collector] [master] uses ping_interval [1s], ping_timeout [30s], ping_retries [3]; [2016-03-03T18:18:34.240570] [Collector] [node ] uses ping_interval [1s], ping_timeout [30s], ping_retries [3]; [2016-03-03T18:18:34.541911] [Collector] using script cache with max_size [100], expire [null]; [2016-03-03T18:18:34.548568] [Collector] using node_concurrent_recoveries [2], node_initial_primaries_recoveries [4]; [2016-03-03T18:18:34.549223] [Collector] using [cluster.routing.allocation.allow_rebalance] with [indices_all_active]; [2016-03-03T18:18:34.549680] [Collector] using [cluster_concurrent_rebalance] with [2]; [2016-03-03T18:18:34.551350] [Collector] using max_bytes_per_sec[40mb], concurrent_streams [3], file_chunk_size [512kb], translog_size [512kb], translog_ops [1000], and compress [true]; [2016-03-03T18:18:34.580063] [Collector] using initial_shards [quorum]; [2016-03-03T18:18:34.684545] [Collector] using max_chunk_size[8kb], max_header_size[8kb], max_initial_line_length[4kb], max_content_length[100mb], receive_predictor[512kb->512kb], pipelining[true], pipelining_max_events[10000]; [2016-03-03T18:18:34.700545] [Collector] using indices.store.throttle.type [MERGE], with index.store.throttle.max_bytes_per_sec [20mb]; [2016-03-03T18:18:34.701314] [Collector] using index_buffer_size [354mb], with min_shard_index_buffer_size [4mb], max_shard_index_buffer_size [512mb], shard_inactive_time [5m]; [2016-03-03T18:18:34.702141] [Collector] using [node] weighted filter cache with size [10%], actual_size [354mb], expire [null], clean_interval [1m]; [2016-03-03T18:18:34.703351] [Collector] using size [-1] [-1b], expire [null]; [2016-03-03T18:18:34.730215] [Collector] using gateway.local.auto_import_dangled [YES], gateway.local.delete_timeout [30s], with gateway.local.dangling_timeout [2h]; [2016-03-03T18:18:34.731851] [Collector] using enabled [false], host [null], port [9700-9800], bulk_actions [1000], bulk_size [5mb], flush_interval [5s], concurrent_requests [4]; [2016-03-03T18:18:34.738136] [Collector] initialized; [2016-03-03T18:18:34.738200] [Collector] starting ...; [2016-03-03T18:18:34.754072] Using select timeout of 500; [2016-03-03T18:18:34.754121] Epoll-bug workaround enabled = false; [2016-03-03T18:18:34.775549] [Collector] using profile[default], worker_count[4], port[9300-9400], bind_host[null], publish_host[null], compress[false], connect_timeout[30s], connections_per_node[2/3/6/1/1], receive_predictor[512kb->512kb]; [2016-03-03T18:18:34.800996] [Collector] Bound profile [default] to address [/0.0.0.0:9301]; [2016-03-03T18:18:34.803168] [Collector] bound_address {inet[/0.0.0.0:9301]}, publish_address {inet[/172.16.100.137:9301]}; [2016-03-03T18:18:34.820210] [Collector] dev-elasticsearch/ssVO8lJIT_OSDIr0Hw8vyA; [2016-03-03T18:18:34.820833] [Collector] processing [initial_join]: execute; [2016-03-03T18:18:34.821474] [Collector] processing [initial_join]: took 0s no change in cluster_state; [2016-03-03T18:18:38.584284] [Collector] filtered ping responses: (filter_client[true], filter_data[false]) {none}; [2016-03-03T18:18:39.820568] [Collector] waited for 5s and no initial state was set by the discovery; [2016-03-03T18:18:39.820773] [Collector] can't wait on start for (possibly) reading state from gateway, will do it asynchronously; [2016-03-03T18:18:39.827304] [Collector] bound_address {inet[/0.0.0.0:9201]}, publish_address {inet[/172.16.100.137:9201]}; [2016-03-03T18:18:39.827533] [Collector] started; [2016-03-03T18:18:39.829568] Worker thread started; driver='d_elasticsearch#0' [2016-03-03T18:18:39.829805] connecting to cluster, cluster_name='dev-elasticsearch'; [2016-03-03T18:18:39.829840] Running application hooks; hook='1' [2016-03-03T18:18:39.829849] Running application hooks; hook='3' [2016-03-03T18:18:39.829887] syslog-ng starting up; version='3.7.2' [2016-03-03T18:18:39.834090] [Collector] no known master node, scheduling a retry; [2016-03-03T18:18:42.335988] [Collector] filtered ping responses: (filter_client[true], filter_data[false]) {none}; [2016-03-03T18:18:44.841864] [Collector] observer: timeout notification from cluster service. timeout setting [5s], time since start [5s]; [2016-03-03T18:18:44.843797] Failed to connect to dev-elasticsearch, reason='waited for [5s]'; [2016-03-03T18:18:46.087601] [Collector] filtered ping responses: (filter_client[true], filter_data[false]) {none}; [2016-03-03T18:18:49.839455] [Collector] filtered ping responses: (filter_client[true], filter_data[false]) {none}; [2016-03-03T18:18:53.591086] [Collector] filtered ping responses: (filter_client[true], filter_data[false]) {none}; [2016-03-03T18:18:54.853069] connecting to cluster, cluster_name='dev-elasticsearch'; [2016-03-03T18:18:54.853215] [Collector] no known master node, scheduling a retry; ^C[2016-03-03T18:18:55.760700] syslog-ng shutting down; version='3.7.2' [2016-03-03T18:18:57.343157] [Collector] filtered ping responses: (filter_client[true], filter_data[false]) {none}; [2016-03-03T18:18:59.853603] [Collector] observer: timeout notification from cluster service. timeout setting [5s], time since start [5s]; [2016-03-03T18:18:59.853990] Failed to connect to dev-elasticsearch, reason='waited for [5s]'; [2016-03-03T18:18:59.854109] Worker thread finished; driver='d_elasticsearch#0' [2016-03-03T18:18:59.854295] Closing log transport fd; fd='12' [2016-03-03T18:18:59.854458] [Collector] stopping ...; [2016-03-03T18:18:59.862200] [Collector] stopped; [2016-03-03T18:18:59.862247] [Collector] closing ...; [2016-03-03T18:18:59.868335] [Collector] closed; [2016-03-03T18:18:59.868583] Java machine free; [2016-03-03T18:18:59.880134] Running application hooks; hook='4' This then goes on ad-finitum. Any troubleshooting tips ? Thanks in advance -------------------------------------------------------------------------------------------------------------------------- This email has been sent to you on behalf of Nephila Advisors LLC (“Advisors”). Advisors provides consultancy services to Nephila Capital Ltd. (“Capital”), an investment advisor managed and carrying on business in Bermuda. Advisors and its employees do not act as agents for Capital or the funds it advises and do not have the authority to bind Capital or such funds to any transaction or agreement. The information in this e-mail, and any attachment therein, is confidential and for use by the addressee only. Any use, disclosure, reproduction, modification or distribution of the contents of this e-mail, or any part thereof, other than by the intended recipient, is strictly prohibited. If you are not the intended recipient, please return the e-mail to the sender and delete it from your computer. This email is for information purposes only, nothing contained herein constitutes an offer to sell or buy securities, as such an offer may only be made from a properly authorized offering document. Although Nephila attempts to sweep e-mail and attachments for viruses, it does not guarantee that either are virus-free and accepts no liability for any damage sustained as a result of viruses. --------------------------------------------------------------------------------------------------------------------------

4 7

[GSoC'16] Love to hack on syslog-ng
by Ankush Sharma 04 Mar '16

04 Mar '16

Hello all, I am Ankush Sharma from India, a fourth year undergraduate at IIT-BHU,Varanasi, India. I am a Python aficionado and a die hard Linux fan. I love to spent my time automating things on the web. Also, I am comfortable at JavaScript, C and many other programming languages. I contributed to *GNU-Mailman* during *GSoC'15*. I also delivered a talk at PyCon India 2014 about *powering apps with gesture control using python programming language **[1]**. *As an open source enthusiast, I regularly contribute to open source projects; here is my Github portfolio link <http://github.com/black-perl>. I have multiple projects and internship experiences, here is my LinkedIn handle <https://in.linkedin.com/in/ankushsharma003>. I found the two projects of strong interest : 1) Automated release generation for syslog-ng 2) syslog-ng configuration editor I automated the development setup of Mailman for new comers through a script <https://github.com/black-perl/mmdev_bootstrap>. So, the idea of automation of release generation is of particular interest to me. Also, I have good experience of working with Django, Flask, Express.js and other web frameworks, so the idea of having a web based configuration editor suits me too ;) Currently, I am going through the codebase and the issues. I have noticed a few things but it would be better to go through the whole architecture, docs and archives before pointing them out. Looking forward to contribute to syslog-ng through this year's GSOC program. Ankush Sharma ECE IV IIT-BHU Varanasi-221005 GITHUB : github.com/black-perl BLOG : http://black-perl.in Linkedin [1] in.pycon.org/funnel/2014/208-python-the-eyes-of-real-world-computer-applica…

1 0

syslog-ng to elasticsearch
by Mike Lewis 04 Mar '16

04 Mar '16

Hi, I’m having some issues trying to setup (syslog-ng v3.7.2) an elastic search destination. ES 2.2.0. In my syslog-ng.conf file, I have the destination defined as: destination d_elasticsearch { elasticsearch( index("syslog-ng_${YEAR}.${MONTH}.${DAY}") type("syslog-ng") class-path("/usr/lib64/syslog-ng/java-modules/*.jar:/usr/lib/syslog-ng-java-module-dependency-jars/jars/*.jar:/usr/share/elasticsearch/lib/*.jar:/usr/share/elasticsearch/modules/*.jar") client_mode("transport") server("172.16.100.137") port("9300") cluster("dev-elasticsearch") template("$(format-json -s all-nv-pairs -p @timestamp=$ISODATE -p @message=$MSG)") ); }; However, in the elastic search logs, I just see an exception through on each connection attempt: [2016-03-04 06:33:00,737][WARN ][transport.netty ] [node-1] exception caught on transport layer [[id: 0xe12086b7, /172.16.100.137:52583 => /172.16.100.137:9300]], closing connection java.lang.IllegalStateException: Message not fully read (request) for requestId [0], action [cluster/state], readerIndex [34] vs expected [49]; resetting at org.elasticsearch.transport.netty.MessageChannelHandler.messageReceived(MessageChannelHandler.java:120) Has anyone come across this issues previously? Regards, Mike Lewis -------------------------------------------------------------------------------------------------------------------------- This email has been sent to you on behalf of Nephila Advisors LLC (“Advisors”). Advisors provides consultancy services to Nephila Capital Ltd. (“Capital”), an investment advisor managed and carrying on business in Bermuda. Advisors and its employees do not act as agents for Capital or the funds it advises and do not have the authority to bind Capital or such funds to any transaction or agreement. The information in this e-mail, and any attachment therein, is confidential and for use by the addressee only. Any use, disclosure, reproduction, modification or distribution of the contents of this e-mail, or any part thereof, other than by the intended recipient, is strictly prohibited. If you are not the intended recipient, please return the e-mail to the sender and delete it from your computer. This email is for information purposes only, nothing contained herein constitutes an offer to sell or buy securities, as such an offer may only be made from a properly authorized offering document. Although Nephila attempts to sweep e-mail and attachments for viruses, it does not guarantee that either are virus-free and accepts no liability for any damage sustained as a result of viruses. -------------------------------------------------------------------------------------------------------------------------- -------------------------------------------------------------------------------------------------------------------------- This email has been sent to you on behalf of Nephila Advisors UK (“Advisors UK”). Advisors UK provides consultancy services to Nephila Capital Ltd. (“Capital”), an investment advisor managed and carrying on business in Bermuda. Advisors UK and its employees do not act as agents for Capital or the funds it advises and do not have the authority to bind Capital or such funds to any transaction or agreement. The information in this e-mail, and any attachment therein, is confidential and for use by the addressee only. Any use, disclosure, reproduction, modification or distribution of the contents of this e-mail, or any part thereof, other than by the intended recipient, is strictly prohibited. If you are not the intended recipient, please return the e-mail to the sender and delete it from your computer. This email is for information purposes only, nothing contained herein constitutes an offer to sell or buy securities, as such an offer may only be made from a properly authorized offering document. Although Nephila attempts to sweep e-mail and attachments for viruses, it does not guarantee that either are virus-free and accepts no liability for any damage sustained as a result of viruses. --------------------------------------------------------------------------------------------------------------------------

3 3

GSOC16. Interested in Automated release generation for syslog-ng
by Yilin Li 04 Mar '16

04 Mar '16

Hi, I am Yilin Li, a second-year postgraduate student at ISCAS(Institute of Software Chinese Academy of Sciences). I'm very familar with python and I have developed a lot project with it. I'm really interested in the idea [Automated release generation for syslog-ng]( https://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-list#proj… ) I plan to draft my schedule in a few days and send you for some opinons. If there is any thing that will make me understand this project better, please notify me. -- Thanks, Yiln Li -- Institute of Software Chinese Academy of Sciences

1 0

GSoC'16 Introduction and Project Idea
by Jaydeep Chauhan 03 Mar '16

03 Mar '16

Hello Everyone, Im Jaydeep Chauhan final year student of computer engineering.I like your proposed idea for GSoC'16 about command line tool and l found it interesting .I also like to propose my own idea for syslog-ng which will be on directory monitoring (like files created,deleted,open,etc). I have developed small implementation of directory monitoring.I come to know your community from GSoC im looking to contribute in it. Thank you!

1 0