- syslog-ng - lists.balabit.hu

syslog-ng split long rows
by Giovanni Mancuso 18 Aug '15

18 Aug '15

Hi, i try to do a simple configuration of syslog-ng: Konsole output source mailet_log { file("/opt/myApp/mylog.log"log_msg_size(81920)); }; destination mailet_test { file("/tmp/mylog_syslog.log"); }; log { source(mailet_log); destination(mailet_test); }; It works, but if i have in a source file a row that has Konsole output70410 70410 char (for example), in the destionation file i have two different row (first: 65024 char, second: 5433 char). Is it normal? can i configure syslog-ng to not split the lines? Thanks --

4 7

Multiple failures while inserting this record to the java destination, message dropped
by Jacek Drewniak 18 Aug '15

18 Aug '15

Hello, from yesterday passing logs to elasticsearch is strange. It works some times, for example by 1 hour, and then nothings happens. I had changed parsing logs to syslog-protocol, but I tried with the default file parsing too. No errors, warnings, nothing. I left my station for 24h and I can see that log appears in the night, but this time ends with this errors: PROGRAM:syslog-ng PRIORITY:err PID:21417 MESSAGE:Failed to send message: failed to parse; ISODATE:August 17th 2015, 23:34:07.000 PROGRAM:syslog-ng PRIORITY:err PID:21417 MESSAGE:Multiple failures while inserting this record to the java destination, message dropped; number_of_retries='3' ISODATE:August 17th 2015, 23:34:07.000 -- *Jacek Drewniak* R&D *email*: jacek.drewniak(a)oort.in *mobile*: *+**48 696 151 670* *website*: www.oort.in AWARDS Bluetooth Breakthrough Award Finalist CES 2015 Envisioneering Innovation & Design Award Winner Tech Trailblazers Awards Winner Most exciting company at Bluetooth Media Event in New York 2014 Polish Agency for Enterprise Development Award Winner

1 0

Syslog-ng message formating
by Jacek Drewniak 18 Aug '15

18 Aug '15

Hello, I am new in logging world. I am formating my logs according to: https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-… I am using *syslog* protocol. For example I am logging this: http://pastebin.com/4UtUYiJJ But it is parsed to fields (I can see this on kibana) : http://pastebin.com/cNX8PZJp Can You tell me what I am doing wrong? -- *Jacek Drewniak* R&D *email*: jacek.drewniak(a)oort.in *mobile*: *+**48 696 151 670* *website*: www.oort.in AWARDS Bluetooth Breakthrough Award Finalist CES 2015 Envisioneering Innovation & Design Award Winner Tech Trailblazers Awards Winner Most exciting company at Bluetooth Media Event in New York 2014 Polish Agency for Enterprise Development Award Winner

4 9

Patterndb to get timestamp from log record in file
by Thanh Dat 17 Aug '15

17 Aug '15

2 2

syslog-ng 3.7.1 released
by Budai, László 17 Aug '15

17 Aug '15

3.7.1New dependencies OpenSSL is now a required dependency for syslog-ng because the newly added hostid and uniqid features requires a CPRNG provided by OpenSSL. Therefore non-embedded crypto lib is not a real option, so the support of having such a crypto lib discontinued and all SSL-dependent features enabled by default. Library updates - Minimal libriemann-client version bumped from 1.0.0 to 1.6.0. - Added support for the monolithic libsystemd library (systemd 209). - RabbitMQ submodule upgraded. FeaturesLanguage bindings - Java-destination driver ported from syslog-ng-incubator. Purpose of having Java destination driver is to make it possible to implement destination drivers in the Java language (and using 'official' Java client libraries). - Python language support is ported from syslog-ng incubator and has been completely reworked. Now, it is possible to implement template functions in Python language and also destination drivers. Main purpose of supporting Python language is to implement a nice interactive syslog-ng config debugger for syslog-ng. New driversNew Java destination drivers ElastiSearch, Kafka and HDFS destination drivers are implemented by using the 'official' Java client libraries and syslog-ng provides a way to set their own, native configuration file. Log messages generated by the client Java libraries are redirected to syslog-ng via our own Log4JAppender which means that those logs are available as internal syslog-ng messages. - ElasticSearch - Kafka - Hadoop/HDFS - HTTP Parsers - Added a geoip() parser, that can look up the country code and latitude/longitude information from an IPv4 address. For lat/long to work, one will need the City database. - New parser, extract-solaris-msgid() added for automatically extracts (parses & removes) the msgid portion of Solaris messages. - Extended the set of supported characters to every printable ASCII's except ., [ and ] in extract-prefix for json-parser(). - Added string-delimiters option to csvparser to support multi character delimiters in CSV parsing. - A kv-parser() introduced for WELF (WebTrens Enhanced Log Format) that implements key=value parsing. The kv-parser() tries to extract key=value formatted name-value pairs from the input string. - value-pairs: make it possible to pass --key as a positional argument From now it is possible to use value-pairs expressions like this: $(format-json MSG DATE) instead of $(format-json --key MSG --key DATE) Filters - Added IPv6 netmask filter for selecting only messages sent by a host whose IP address belongs to the specified IPv6 subnet. Macros - Added a new macro, called HOSTID which is a 32-bit number generated by a cryptographically secure PRNG. Its purpose is to identify the syslog-ng host, thus it is the same for every message generated on the same host. - Added a new macro, called UNIQID which is a practically unique ID generated from the HOSTID and the RCPTID in the format of HOSTID@RCPTID. Uniqid is a derived value: it is built up from the always available hostid and the optional rcptid. In other words: uniqid is an extension over rcptid. For that reason use-rcptid has been deprecated and use-uniqid could be use instead. Templates - welf was renamed to kvformat As this reflects the purpose of this module much better, WELF is just one of the format it has support for. - $(format-cim) template function added into an SCL module. - It is possible to create templates without braces. SMTP destination - The afsmtp driver now supports templatable recipients field. Just like the subject() and body() fields, now the address containing parameters of to(), from(), cc() and bcc() can contain macros. Unix Domain Sockets - Added pass-unix-credentials() global option for enabling/disabling unix credentials passing on those platforms which has this feature. By default it is enabled. - Added create-dirs() option to unix-*() sources for creating the containing directories for Unix domain sockets. Riemann destination - Added batched event sending support for riemann destination driver which makes the riemann destination respect flush-lines(), and send event in batches of configurable amount (defaults to 1). In case of an error, all messages within the batch will be dropped. Dropped messages, and messages that result in formatting errors do not count towards the batch size. There is no timeout, but messages will be flushed upon deinit. - A timeout() option added to the Riemann destination. PatternDB - Earlier, in patterndb, the first applicable rule won, even if it was only a partial match. This means that when rules overlapped, the shorter match would have been found, if it was the first to be loaded. A strong preference introduced for rules that match the input string completely. The load order is still applicable though, it is possible to create two distinct rules that would match the same input, in those cases the first one to be loaded wins. Miscellaneous features - New builtin interactive syslog-ng.conf debugger implemented for syslog-ng. The debugger has a Python frontend which contains a full Completer (just press TABs and works like bash) - Added a reset option to syslog-ng-ctl stats. With this option the non-stored stats counters can be zeroed. - New parameter added to loggen: --permanent (-T) wich is for sending logs indefinitely. - Loggen uses the proper timezone offset in generated message. - The ssl_options inside tls() extended with the following set: no-sslv2, no-sslv3, no-tlsv1, no-tlsv11, no-tlsv12. - Added syslog-debug bundle generator script to make it easier to reproduce bugs by collecting debug related information, like: - process information gathering - syscall tracing (strace/truss) - configuration gathering - selinux related information gathering - solaris information gathering (sysdef, kstat, showrev, release) - get information about syslog-ng svr4 solaris packages, if possible Bugfixes - New utf8 string sanitizers instead of old broken one. - syslog-ng won't send SIGTERM when getpgid() fails in program destination (afprog). - In some cases program destination respawned during syslog-ng stop/restart (afprog). - syslog-ng generates mark messages when mark-mode is set to host-idle. - Using msg_control only when credential passing is supported in socket destination (afsocket). - Writer is replaced only when protocol changed during reload in socket destination (afsocket). - Fix spinning on EOF for unix-stream() sockets. Root cause of the spinning was that a unix-dgram socket was created even in case of unix-stream. - When the configured host was not available during the initialization of afsocket destination syslog-ng just didn't start. From now, syslog-ng starts in that case and will retry connecting to the host periodically. - Fixed BSD year inference in syslogformat. When the difference between the current month and the month part of the timestamp of an incoming logmessage in BSD format (which has no year part) was greater than 1 then syslog-ng computed the year badly. - In some cases, localtime related macros had a wrong value(eg.:$YEAR). - TLS support added to Riemann destination - Excluded "tags" from Riemann destination driver as an attribute which conflicts with reserved keyword - When a not writeable/non-existent file becomes writeable/exists later, syslog-ng recognize it (with the help of reopen-timer) and delivers messages to the file without dropping those which were received while the file was not available (affile). - Fixed a crash around affile at the first message delivery when templates were used (affile). - Fixed a configure error around libsystemd-journal. - Removed syslog.socket from service file on systems using systemd. Syslog-ng reads the messages directly from journal on systems with systemd. - Fixed compilation where the monolitic libsystemd was not available. - Fixed compilation failure on OpenBSD. - AMQP connection process fixed. - Added DOS/Windows line ending support in config. - Retries fixed in SQL destination. In some circumstances when retry_sql_inserts was set to 1, after an insertion failure all incoming messages were dropped. - Transaction handling fixed in SQL destination. In some circumstances when both select and insert commands were run within a single transaction and the select failed (eg.: in case of mssql), the log messages related to the insert commands, broken by the invalid transaction, were lost. - Fixed a memleak in SQL destination driver. The memleak occured during one of the transaction failures. - Memory leak around reload and internal queueing mechanism has been fixed. - Fixed a potential abort when the localhost name cannot be detected. - Security issue fixed around $HOST. Tech details: When the name of the host is too long, the buffer we use to format the chained hostname is truncated. However snprintf() returns the length the result would be if no truncation happened, thus we will read uninitialized bytes off the stack when we use that pointer to set $HOST with log_msg_set_value(). There can be some security implications, like reading values from the stack that can help to craft further exploits, especially in the presense of address space randomization. It can also cause a DoS if the hostname length is soo large that we would read over the top-of-the-stack, which is probably not mmapped causing a SIGSEGV. - Journal entries containing name-value pairs without '=' caused syslog-ng to crash. Instead of crashing, syslog-ng just drop these nv pairs. - Fixed the encoding of characters below 32 if escaping is enabled in templates. Templated outputs never contained references to characters below 32, essentially they were dropped from the output for two reasons: - the prefixing backslash was removed from the code - the format_uint32_padded() function produced no outputs in base 8 - Fixed afstomp destination port issue. It always tried to connect to the port 0. - Fixed memleak in db-parser which could happen at every reload. - Fixed a class of rule conflicts in db-parser: Because an error in the pdb load algorithms, some rules would conflict which shouldn't have done that. The problem was that several programs would use the same RADIX tree to store their patterns. Merging independent programs meant that if they the same pattern listed, it would clash, even though their $PROGRAM is different. There were multiple issues: - we looked up pattern string directly, even they might have contained @parser <https://github.com/parser>@ references. It was simply not designed that way and only worked as long as we didn't have the possibility to use parsers in program names - we could merge programs with the same prefix, e.g. su, supervise/syslog-ng and supervise/logindexd would clash, on "su", which is a common prefix for all three. The solution involved in using a separate hash table for loading, which at the end is turned into the radix tree. - pdbtool match when used with the --debug-pattern option used a low-level lookup function, that didn't perform all the db-parser actions specified in the rule - Max packet length for spoof source is set to 1024 (previously : 256). - A certificate which is not contained by the list of fingerprints is rejected from now. - Hostname check in tls certificate is case insensitive from now. - There is a use-case where user wants to ignore an assignment to a name-value pair. (eg.: when using csv-parser(), sometimes we get a column we really want to drop instead of adding it to the message). In previous versions an error message was printed out: 'Name-value pairs cannot have a zero-length name'. That error message has been removed. - Fixed a docbook related compilation error: there was a hardcoded path that caused build to fail if docbook is not on that path. Debian based platforms did not affected by this problem. Now a new option was created for ./configure that is --enable-manpages that enables the generation of manpages using docbook from online source. '--with-docbook=PATH' gives you the opportunity to specify the path for your own installed docbook. Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Adam Arsenault, Adam Istvan Mozes, Alex Badics, Andras Mitzki, Balazs Scheidler, Bence Tamas Gedai, Ben Kibbey, Botond Borsits, Fabien Wernli, Gergely Nagy, Gergo Nagy, Gyorgy Pasztor, Kristof Havasi, Laszlo Budai, Manikandan-Selvaganesh, Michael Sterrett, Peter Czanik, Robert Fekete, Sean Hussey, Tibor Benke, Toralf Förster, Viktor Juhasz, Viktor Tusa, Vincent Bernat, Zdenek Styblik, Zoltan Fried, Zoltan Pallagi. — View it on GitHub <https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.7.1>.

2 2

unofficial syslog-ng 3.7.1 Debian packages
by Budai, László 17 Aug '15

17 Aug '15

Hi, I've just created my unofficial OBS repo[1] for syslog-ng 3.7.1 series (current version: 3.7.1-1 ). List of supported OSs (i386/amd64): * Debian 7.0 * Debian 8.0 * Ubuntu 12.04 * Ubuntu 14.04 * Ubuntu 14.10 * Ubuntu 15.04 Install ------- example: Debian 8.0 1. get release key wget -qO - http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… | sudo apt-key add - 2. add repo to APT sources eg.: /etc/apt/sources.list.d/syslog-ng-obs.list deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… ./ Then `apt-get update` and `apt-get install syslog-ng-core=3.7.1-1` You can replace Debian_8.0 to * Debian_7.0 * xUbuntu_12.04, * xUbuntu_14.04 * xUbuntu_14.10 * xUbuntu_15.04 (`x` before Ubuntu is not a typo ;-) ) Available packages: * syslog-ng-core * syslog-ng-dbg * syslog-ng-dev * syslog-ng-mod-stomp * syslog-ng-mod-amqp * syslog-ng-mod-elastic * syslog-ng-mod-geoip * syslog-ng-mod-graphite * syslog-ng-mod-hdfs * syslog-ng-mod-http * syslog-ng-mod-java * syslog-ng-mod-java-common-lib * syslog-ng-mod-journal * syslog-ng-mod-json * syslog-ng-mod-kafka * syslog-ng-mod-mongodb * syslog-ng-mod-python * syslog-ng-mod-redis * syslog-ng-mod-riemann * syslog-ng-mod-smtp * syslog-ng-mod-sql * syslog-ng-mod-stomp Notes to the java destinations ------------------------------ About the ``` Error opening plugin module; module='mod-java', error='libjvm.so: cannot open shared object file: No such file or directory' ``` problem. libmod-java.so is linked to the libjvm.so library. If your java installation doesn't create a symlink in /usr/lib directory to libjvm.so then you have to modify your ld.so.conf or expand your LD_LIBRARY_PATH with the containing library before starting syslog-ng. eg.: LD_LIBRARY_PATH=/usr/lib/jvm/java-7-openjdk-amd64/jre/lib/amd64/server:$LD_LIBRARY_PATH Links -------- [1] https://build.opensuse.org/project/show/home:laszlo_budai:syslog-ng [2] https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.7.1 regards, Laszlo Budai

1 0

Error in pattern ?
by Thanh Dat 17 Aug '15

17 Aug '15

2 2

There is only last field of host ip.
by Jacek Drewniak 11 Aug '15

11 Aug '15

Hi, I have problem, the host field contains only last field of client ip. For example if my client ip is 192.168.1.234 on server in host field I only have 234. There is my server config: http://pastebin.com/hwgNXCQK How to get whole ip? -- *Jacek Drewniak* R&D *email*: jacek.drewniak(a)oort.in *mobile*: *+**48 696 151 670* *website*: www.oort.in AWARDS Bluetooth Breakthrough Award Finalist CES 2015 Envisioneering Innovation & Design Award Winner Tech Trailblazers Awards Winner Most exciting company at Bluetooth Media Event in New York 2014 Polish Agency for Enterprise Development Award Winner

1 0

Re: [syslog-ng] Log rotation in Syslog-ng
by jrhendri＠roadrunner.com 11 Aug '15

11 Aug '15

Agree about doing rotation separately. I create the logs by date (using macros within syslog-ng destinations) then run a couple cron jobs to manage retention. You should tweak this to your own preferences: Here are some pertinent options: options { check_hostname(yes); # check if the hostname contains valid characters use_dns(no); # do not resolve names for speed dns_cache(no); # no DNS cache since we do not resolve names keep_hostname(yes); # keep hostnames to enable related macros chain_hostnames(no); # do not track / forward syslog forwarder chain # options related to file and directories dir_owner("root"); dir_group("logadmin"); owner("root"); group("logadmin"); perm(0640); dir_perm(0750); create_dirs(yes); }; and an example destination: destination d_separatedbyhosts { file("/data/syslog-ng/$YEAR/$MONTH/$DAY/$HOST_FROM/$HOST_FROM.$FACILITY.$PRIORITY.$YEAR.$MONTH.$DAY"); }; This way each filename uniquely identifies the source and date (in case you need to send copies somewhere, they aren't all named "messages"...) This is an example command that compresses after 1 day (run nightly) /bin/find /data/syslog-ng -type f -mtime +1 ! -name \*.gz -exec /bin/gzip --best {} \; And this deletes after 90 days (also run nightly) /bin/find /data/syslog-ng -type f -name \*.gz -mtime +90 -exec /bin/rm {} \; Good luck, Jim ---- Justin Kala <justinkala(a)gmail.com> wrote: > Can we control the log retention/rotation in syslog-ng.conf .Syslog-ng > server version is 3.4 OSE Solaris 10. > > If so, how do we do it ?? Highly appreciate if you can share the examples > /links > -- > Kaladhar

1 0

Log rotation in Syslog-ng
by Justin Kala 10 Aug '15

10 Aug '15

Can we control the log retention/rotation in syslog-ng.conf .Syslog-ng server version is 3.4 OSE Solaris 10. If so, how do we do it ?? Highly appreciate if you can share the examples /links -- Kaladhar

2 1

Issue with filtering messages and sending them
by Cosmin Neagu 10 Aug '15

10 Aug '15

Hello everyone, I have an issue with syslog-ng (detailed below) and I tend to incline is related to syslog-ng, an I hope will find some answers here. I set up a "solution" so that when someone fails to login to a ssh linux server, I receive an email with info about that. The idea is like this: Syslog-ng should look for any messages containing info about login failures, and when it sees those messages, it should pass them to a little script that emails them. Syslog-ng relevant config for that: filter f_ssh {program (sshd) and match("Failed password" value("MESSAGE")); }; destination d_sshalert { program("/home/cosmin/sshalert.sh"); }; #this is the script that is sendind the emails destination d_sshfile { file("/home/cosmin/LOGS/sshdfailed.log"); }; log { source(s_src); filter(f_ssh); destination(d_sshfile);}; #log { source(s_src); filter(f_ssh); destination(d_sshalert); flags(final); }; log { source(s_src); filter(f_ssh); destination(d_sshalert);}; And the script that is sending the emails: cosmin@srv:~$ cat sshalert.sh #!/bin/bash email="someone(a)gmail.com" while read event; do echo -e "Subject:*** SSH failed attempt on domain.ro ***\nFrom:SSH Watcher <admin(a)domain.ro>\nTo:someone@gmail.com\n\n####### WARNING #######\n\nA failed SSH attempt has been logged:\n${event}\n\n*** Required actions***\n1. Check ip owner and location:\nEx: #curl ipinfo.io/X.Y.Z.T\n2. Ban the source IP address in iptables.rules\n***********************\n\nFor any questions contact: admin(a)domain.ro\nHave a nice day\n" | /usr/sbin/sendmail -f admin(a)domain.ro ${email} done Everything is working as expected, I receive mails like this when failed attempts exists: ####### WARNING ####### A failed SSH attempt has been logged: *Aug 6 15:49:47 srv sshd[18236]: Failed password for someone from 173.XX.220.XX port 59004 ssh2* *** Required actions*** 1. Check ip owner and location: Ex: #curl ipinfo.io/X.Y.Z.T 2. Ban the source IP address in iptables.rules *********************** For any questions contact:admin@domain.ro Have a nice day Please not that the log inserted is the right one: Aug 6 15:49:47 srv sshd[18236]: Failed password for someone from 173.XX.220.XX port 59004 ssh2 My problem is that form time to time (did not manage to discover a time pattern), I also receive some strange mails like the following: ####### WARNING ####### A failed SSH attempt has been logged: *Aug 6 16:09:47 srv -- MARK --* *** Required actions*** 1. Check ip owner and location: Ex: #curl ipinfo.io/X.Y.Z.T 2. Ban the source IP address in iptables.rules *********************** For any questions contact:admin@domain.ro Have a nice day As you can see, the log inserted in the mail is strange: *Aug 6 16:09:47 srv -- MARK --*. I assume that somehow, syslog-ng is the one that is sending this log to my script which is why I configured another destination to a local file to test my hypothesis (d_sshfile) but the message is not inserted in that local file Now, my question for you is: is there a way to determine if syslog-ng is the one responsible for sending that strange message and why? Am I doing something wrong with syslog-ng config (maybe the filter is not right?) Any help would be appreciated. Thanks -- Best Regards Cosmin Neagu

3 5

cloudinit
by Amar Johal 09 Aug '15

09 Aug '15

Hi, We are moving from rsyslog to syslog-ng, we know that rsyslog as /etc/rsyslog.d/21-cloudinit.conf for cloud init logs, once we remove rsyslog for syslog-ng what would happen to our cloudinit logs? Thanks!

3 2

3.7 rpm-s from git HEAD (without Java support)
by Czanik, Péter 08 Aug '15

08 Aug '15

Hi, I just updated my 3.7 packages to git head. Along the way support for key value pairs was added and support for Java was removed. Compiling Java modules requires gradle, which is not available for openSUSE / SLES12 as a package. Gradle is available for Fedora22, but compiling java modules fails. Unfortunately compiling Java support independent of Java modules is not possible right now... openSUSE / SLES12: https://build.opensuse.org/project/show/home:czanik:syslog-ng37 Fedora / EPEL7: https://copr.fedoraproject.org/coprs/czanik/syslog-ng37/ Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Re: [syslog-ng] Failed to compile syslog-ng-incubator with 3.7.0beta2
by Jacek Drewniak 05 Aug '15

05 Aug '15

Ok, I understand, thank You. But now I have other compilation error: *(...)* Download https://repo1.maven.org/maven2/org/apache/directory/api/api-asn1-api/1.0.0-… Download https://repo1.maven.org/maven2/org/apache/directory/api/api-util/1.0.0-M20/… Download https://repo1.maven.org/maven2/javax/xml/stream/stax-api/1.0-2/stax-api-1.0… Download https://repo1.maven.org/maven2/javax/activation/activation/1.1/activation-1… Download https://repo1.maven.org/maven2/org/apache/httpcomponents/httpclient/4.2.5/h… :hdfs:processResources UP-TO-DATE :hdfs:classes :hdfs:jar :hdfs:assemble :hdfs:compileTestJava UP-TO-DATE :hdfs:processTestResources UP-TO-DATE :hdfs:testClasses UP-TO-DATE :hdfs:test UP-TO-DATE :hdfs:check UP-TO-DATE :hdfs:build :http:compileJava *FAILURE*: Build failed with an exception. * What went wrong: Could not resolve all dependencies for configuration ':http:compile'. *> Could not find :syslog-ng-common:.* Searched in the following locations: file:/home/jacek/syslog-ng-master/modules/java/syslog-ng-core/libs/syslog-ng-common-.jar file:/home/jacek/syslog-ng-master/modules/java/syslog-ng-core/libs/syslog-ng-common.jar file:/home/jacek/syslog-ng-master/modules/java-modules/common/http/libs/syslog-ng-common-.jar file:/home/jacek/syslog-ng-master/modules/java-modules/common/http/libs/syslog-ng-common.jar file:/usr/lib/syslog-ng-java-module-dependency-jars/jars/syslog-ng-common-.jar file:/usr/lib/syslog-ng-java-module-dependency-jars/jars/syslog-ng-common.jar Required by: java-modules:http:unspecified * Try: Run with --stacktrace option to get the stack trace. Run with --info or --debug option to get more log output. *BUILD FAILED* Total time: 46.271 secs make[2]: *** [java-modules] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 -- *Jacek Drewniak* R&D *email*: jacek.drewniak(a)oort.in *mobile*: *+**48 696 151 670* *website*: www.oort.in AWARDS Bluetooth Breakthrough Award Finalist CES 2015 Envisioneering Innovation & Design Award Winner Tech Trailblazers Awards Winner Most exciting company at Bluetooth Media Event in New York 2014 Polish Agency for Enterprise Development Award Winner 2015-08-05 14:30 GMT+02:00 Fabien Wernli <wernli(a)in2p3.fr>: > On Wed, Aug 05, 2015 at 02:01:15PM +0200, Jacek Drewniak wrote: > > Yes I have oracle-jave8 and grandle2 but still elasticsearch doesnt > appear > > in configure summary. > > > > Here I paste the configuration http://pastie.org/10331217 > > it won't appear in config.log > it appears as: > > java : yes > >

2 1

Failed to compile syslog-ng-incubator with 3.7.0beta2
by Jacek Drewniak 05 Aug '15

05 Aug '15

Hi, I would like to compile incubator to use elasticsearch destination. Unfortunately there is an error during compilation. :( syslog-ng Incubator 0.4.1 configured ------------------------------------ Debugging: no Modules: basicfuncs-plus yes kafka yes logmongource: yes lua: yes (lua5.1) monitor-source: yes (lua5.1) perl: no python: yes (python) rss yes trigger-source yes tfgetent yes zmq no grok-parser no date-parser yes java yes jacek@uwbTestField:~/syslog-ng-incubator$ make /usr/local/share/tools/lex-rules.am:14: warning: overriding commands for target `.y.c' make: warning: ignoring old commands for target `.y.c' GEN modules/trigger-source/trigger-source-grammar.y YACC modules/trigger-source/trigger-source-grammar.c GEN modules/monitor-source/monitor-source-grammar.y YACC modules/monitor-source/monitor-source-grammar.c GEN modules/rss/rss-grammar.y YACC modules/rss/rss-grammar.c GEN modules/lua/lua-grammar.y YACC modules/lua/lua-grammar.c GEN modules/python/python-grammar.y YACC modules/python/python-grammar.c GEN modules/kafka/kafka-grammar.y YACC modules/kafka/kafka-grammar.c GEN modules/zmq/zmq-grammar.y YACC modules/zmq/zmq-grammar.c GEN modules/java/native/java-grammar.y YACC modules/java/native/java-grammar.c GEN modules/java/org/syslog_ng/InternalMessageSender.class GEN modules/java/org/syslog_ng/SyslogNgClassLoader.class GEN modules/java/org/syslog_ng/LogMessage.class GEN modules/java/org/syslog_ng/LogTemplate.class GEN modules/java/org/syslog_ng/LogPipe.class GEN modules/java/org/syslog_ng/LogDestination.class GEN modules/java/org/syslog_ng/TextLogDestination.class GEN modules/java/org/syslog_ng/StructuredLogDestination.class GEN modules/java/org/syslog_ng/DummyTextDestination.class GEN modules/java/org/syslog_ng/DummyStructuredDestination.class GEN modules/java/LogDestination.h GEN modules/java/LogMessage.h GEN modules/java/LogTemplate.h GEN modules/java/InternalMessageSender.h GEN modules/java/SyslogNg.jar added manifest adding: org/(in = 0) (out= 0)(stored 0%) adding: org/syslog_ng/(in = 0) (out= 0)(stored 0%) adding: org/syslog_ng/LogPipe.class(in = 1461) (out= 825)(deflated 43%) adding: org/syslog_ng/SyslogNgClassLoader.class(in = 4154) (out= 2224)(deflated 46%) adding: org/syslog_ng/DummyTextDestination.class(in = 1273) (out= 675)(deflated 46%) adding: org/syslog_ng/LogMessage.class(in = 576) (out= 353)(deflated 38%) adding: org/syslog_ng/DummyStructuredDestination.class(in = 1692) (out= 905)(deflated 46%) adding: org/syslog_ng/SyslogNgClassLoader$1.class(in = 1305) (out= 648)(deflated 50%) adding: org/syslog_ng/TextLogDestination.class(in = 491) (out= 334)(deflated 31%) adding: org/syslog_ng/InternalMessageSender.class(in = 875) (out= 448)(deflated 48%) adding: org/syslog_ng/LogDestination.class(in = 908) (out= 516)(deflated 43%) adding: org/syslog_ng/LogTemplate.class(in = 785) (out= 477)(deflated 39%) adding: org/syslog_ng/StructuredLogDestination.class(in = 649) (out= 406)(deflated 37%) GEN modules/date/date-parser-grammar.y YACC modules/date/date-parser-grammar.c make all-am make[1]: Entering directory `/home/jacek/syslog-ng-incubator' /usr/local/share/tools/lex-rules.am:14: warning: overriding commands for target `.y.c' make[1]: warning: ignoring old commands for target `.y.c' CC modules/trigger-source/modules_trigger_source_libtrigger_source_la-trigger-source-grammar.lo CC modules/trigger-source/modules_trigger_source_libtrigger_source_la-trigger-source.lo modules/trigger-source/trigger-source.c: In function 'trigger_source_new': modules/trigger-source/trigger-source.c:167:27: error: too few arguments to function 'log_source_set_options' owner->super.super.id, NULL, FALSE, FALSE); ^ In file included from modules/trigger-source/trigger-source.h:28:0, from modules/trigger-source/trigger-source.c:24: /usr/local/include/syslog-ng/logsource.h:97:6: note: declared here void log_source_set_options(LogSource *self, LogSourceOptions *options, gint stats_level, gint stats_source, const gchar *stats_id, const gchar *stats_instance, gboolean threaded, gboolean pos_tracked, LogExprNode *expr_node); ^ make[1]: *** [modules/trigger-source/modules_trigger_source_libtrigger_source_la-trigger-source.lo] Error 1 make[1]: Leaving directory `/home/jacek/syslog-ng-incubator' make: *** [all] Error 2 -- *Jacek Drewniak* R&D *email*: jacek.drewniak(a)oort.in *mobile*: *+**48 696 151 670* *website*: www.oort.in AWARDS Bluetooth Breakthrough Award Finalist CES 2015 Envisioneering Innovation & Design Award Winner Tech Trailblazers Awards Winner Most exciting company at Bluetooth Media Event in New York 2014 Polish Agency for Enterprise Development Award Winner

2 4

Syslog-ng cross compile
by Jacek Drewniak 04 Aug '15

04 Aug '15

Hello, I am trying to cross compile syslog-ng with yocto distro. I have problem with --prefix. I would like to install syslog-ng to some custom folder and than copy all files into my board. But prefix hadrcode files path into syslog-ng. It is very hard to copy compilled files from build directory (without --prefix and make install, to not install into my desktop). It is possible to --prefix installation without hardcode paths to files? In the other hand I configure syslog-ng without json but config still needs it. I have to delete *cim* to go further. *Error parsing config, Error compiling template (Unknown template function "format-json") in /usr/local/share/include/scl/cim/template.conf at line 23, column 32:* * included from /usr/local/etc/scl.conf line 32, column 1* * included from /usr/local/etc/syslog-ng.conf line 8, column 1* *template-function "format-cim" "$(format-json --pair @timestamp='${R_ISODATE}' --pair @message='${MSG}' --key .cim.* --shift 5 --key _* --key .* --replace-prefix .=_ --key *.*)\n";* * ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^* -- *Jacek Drewniak* R&D *email*: jacek.drewniak(a)oort.in *mobile*: *+**48 696 151 670* *website*: www.oort.in AWARDS Bluetooth Breakthrough Award Finalist CES 2015 Envisioneering Innovation & Design Award Winner Tech Trailblazers Awards Winner Most exciting company at Bluetooth Media Event in New York 2014 Polish Agency for Enterprise Development Award Winner

3 4

csv-parser deactivate default_flags strip_whitespaces
by mona 30 Jul '15

30 Jul '15

Dear all, How do I deactivate in the csv-parsers that the default flag setting includes stripping whitespace in Line 37? https://github.com/balabit/syslog-ng/blob/syslog-ng-3.7.0beta2/modules/csvp… <https://github.com/balabit/syslog-ng/blob/syslog-ng-3.7.0beta2/modules/csvp…> Kind regards, Mona

1 1

Errors compiling syslog-ng 3.6.4 in CentOS 7.1
by C. L. Martinez 29 Jul '15

29 Jul '15

Hi all, I am trying to update my syslog-ng 3.5.x release to syslog-ng 3.6.4. When I run autogen.sh, the following error appears: [root@c071pubwww syslog-ng-syslog-ng-3.6.4]# ./autogen.sh Running autogen in 'lib/ivykis'... Don't know how to bootstrap submodule 'lib/ivykis' Any idea??

3 5

Syslog-ng v3.5.3 - Core dump from a certain incoming message?
by Clayton Dukes 28 Jul '15

28 Jul '15

Has anyone seen this or know what may be causing it? When I run a stack trace, I can see that this host causes syslog-ng to crash every time it sends a message I've run a couple of tcpdumps and it *seems* to be caused by an ARP request from a Cyclades box. This seems very odd to me of course. 10 130.085308 Cyclades_01:be:4b SuperMic_9a:58:be ARP 60 Who has x.x.188.52? Tell x.x.188.11 The *only* other packets from that host are repeated so they don't seem to be the cause: 4 1.000259 x.x.188.11 x.x.188.52 Syslog 257 LOCAL0.NOTICE: Jul 23 11:04:05 src_dev_log@ACS-01 Buffering: S12.Server-Farm-6509-01 [Jul 23 11:04:03.267 EDT: %MCAST-SP-3-QUERY_INT_MISMATCH: Snooping Querier received a non-matching query interval (125000 msec),]\n [pid 28379] recvfrom(9, "<133>Jul 23 10:19:58 src_dev_log"..., 8192, 0, {sa_family=AF_INET, sin_port=htons(3284), sin_addr=inet_addr("x.x.188.11")}, [16]) = 181 [pid 28379] stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 [pid 28379] mprotect(0x7f956c346000, 12288, PROT_READ|PROT_WRITE) = 0 [pid 28379] write(2, "**\nERROR:../../lib/logmsg.c:535:"..., 114) = 114 [pid 28379] rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0 [pid 28379] tgkill(28374, 28379, SIGABRT) = 0 [pid 28379] --- SIGABRT {si_signo=SIGABRT, si_code=SI_TKILL, si_pid=28374, si_uid=0} --- [pid 28379] +++ killed by SIGABRT (core dumped) +++ [pid 28434] +++ killed by SIGABRT (core dumped) +++ [pid 28428] +++ killed by SIGABRT (core dumped) +++ +++ killed by SIGABRT (core dumped) +++ ______________________________________________________________ Clayton Dukes ______________________________________________________________

3 2

syslog-ng GSoC IRC event
by Budai, László 20 Jul '15

20 Jul '15

Hi, after midterm, we will have an IRC meeting. Participants: mainly students and mentors, and of course anyone else who are interested in :-) Topics: * Where are we now? Status updates on projects. * Talking about on how to share your results with community. (online demos, blogs, whatever...) DATE: Tue 7/21/15 4:00 PM – 5:00 PM Time zone: Budapest regards, Laszlo Budai

1 0

Behaviour with unavailable TCP destination
by ZeroUno 20 Jul '15

20 Jul '15

Hello, I was wondering what happens when you define a tcp() destination in syslog-ng.conf and then the destination is temporarily not available. I was not able to find the answer in the docs. Are any messages lost? Or are they kept somewhere and sent again when the destination becomes available again? Thank you. -- 01

3 2

Re: [syslog-ng] Using FIPS complaint OpenSSL with syslog-ng OSE
by Laszlo Budai 17 Jul '15

17 Jul '15

Hi, FIPS compliant OpenSSL is an openssl compiled and linked with FIPS object module. If syslog-ng not using disabled crypto functions (eg. md5) then it should work. Give it a try and if you will have some problems, just open an issue on our github page. regards, Laszlo Budai Sent from my HTC ----- Reply message ----- From: "Saurabh Shukla" <saurabh(a)purestorage.com> To: <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] Using FIPS complaint OpenSSL with syslog-ng OSE Date: Thu, Jul 16, 2015 22:43 Hi, I see that syslog-ng OSE uses OpenSSL libraries for TLS support. If my system has FIPS complaint OpenSSL installed, will syslog-ng OSE use those FIPS compliant libraries for TLS support? Do I need any change in the syslog-ng OSE's configuration for this? Thanks, -- Saurabh Shukla ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

Using FIPS complaint OpenSSL with syslog-ng OSE
by Saurabh Shukla 17 Jul '15

17 Jul '15

Hi, I see that syslog-ng OSE uses OpenSSL libraries for TLS support. If my system has FIPS complaint OpenSSL installed, will syslog-ng OSE use those FIPS compliant libraries for TLS support? Do I need any change in the syslog-ng OSE's configuration for this? Thanks, -- Saurabh Shukla

3 2

Host/port from environment variables
by Peter Flood 15 Jul '15

15 Jul '15

Hi I'm trying configure syslog-ng, I'd like to be able to use environment variables for host & port. I've tried the ones that work in the template formatter but it's not working (not suprisingly). Is there another way? destination d_my_dest { tcp("$(env MY_HOST)" port($(env MY_PORT)) # this doesn't work as you can't get env vars unless in a template tls(peer-verify(required-untrusted) ca_dir("/etc/syslog-ng/cert.d")) template(myTemplate)); }; Thanks

2 2

Problems trying to compile syslog-ng 3.6.4 on Solaris 11.2 (SPARC)
by Arsenault, Adam 11 Jul '15

11 Jul '15

With this patch, syslog-ng 3.6.4 compiles on Solaris 11.2 (X86-64). It will work on SPARC as well. https://github.com/balabit/syslog-ng/pull/543 -Adam Arsenault

5 8