- syslog-ng - lists.balabit.hu

Trying to get json out of 3.7beta2
by Russell Fulton 08 Jul '15

08 Jul '15

Hi Thanks to various folks I managed to build 3.7b2 with json. I am now trying to convert my ELSA config to produce a parsed output in json that I can feed into Elastic Search. Having failed to make my full config work (I had to try ;) so I tried a basic one based on https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-… [ Aside: minor syntax error on this page — lnside log {} you can not name parser elements ] here is my conf: @version: 3.7 source s_json { network(port(1514) flags(no-parse)); }; destination d_json { file("/data/russell/test.json” template("$(format-json --scope dot-nv-pairs)\n")); }; log { source(s_json); parser { json-parser (prefix(".json.")); }; destination(d_json); }; I get no output and ‘stats’ shows: [rful011@secmgrprd01 ~]$ sudo /usr/local/syslog-ng/sbin/syslog-ng-ctl stats SourceName;SourceId;SourceInstance;State;Type;Number src.none;;;a;processed;0 src.none;;;a;stamp;0 source;s_json;;a;processed;19375 global;payload_reallocs;;a;processed;25710 global;msg_clones;;a;processed;0 destination;d_json;;a;processed;0 center;;queued;a;processed;0 global;sdata_updates;;a;processed;0 center;;received;a;processed;19375 global;internal_queue_length;;a;processed;19378 Which is the same as I get with my full config with lots of patterns. As usual am missing something basic!

5 7

configure for beta 2 not finding jsonc on RHEL 6
by Russell Fulton 05 Jul '15

05 Jul '15

Hi I have installed the libjson-devel package via yum but ./configure says: checking for JSON: no the library is in /lib64 and headers in /usr/include/json-c/ I can’t figure out what configure options I need to get this to work. Thanks, Russell

3 3

syslog-ng 3.6.4 Debian packages are available
by Budai, László 03 Jul '15

03 Jul '15

Hi, I've just created an OBS repo[1] for syslog-ng 3.6.x series (current version: 3.6.4 [2] ). This means that this is not an official Debian/Ubuntu APT repository but one hosted by OBS. List of supported OSs (i386/amd64): * Debian 7.0 * Debian 8.0 * Ubuntu 12.04 * Ubuntu 14.04 * Ubuntu 14.10 * Ubuntu 15.04 Install ------- 1. get release key wget -qO - http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng-3.6… | sudo apt-key add - 2. add repo to APT sources eg.: /etc/apt/sources.list.d/syslog-ng-obs.list deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng-3.6… ./ Then `apt-get update` and `apt-get install syslog-ng-core=3.6.4-1` You can replace Debian_8.0 to * Debian_7.0 * xUbuntu_12.04, * xUbuntu_14.04 * xUbuntu_14.10 * xUbuntu_15.04 (`x` before Ubuntu is not a typo ;-) ) Available packages: * syslog-ng-core * syslog-ng-dbg * syslog-ng-dev * syslog-ng-mod-amqp * syslog-ng-mod-geoip * syslog-ng-mod-graphite * syslog-ng-mod-json * syslog-ng-mod-mongodb * syslog-ng-mod-redis * syslog-ng-mod-riemann * syslog-ng-mod-smtp * syslog-ng-mod-sql * syslog-ng-mod-stomp Links -------- [1] https://build.opensuse.org/project/show/home:laszlo_budai:syslog-ng-3.6 [2] https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.6.4 regards, Laszlo Budai (lbudai)

3 6

Problems trying to compile syslog-ng 3.6.4 on Solaris 11.2 (SPARC)
by Cottington-Bray, Ian 01 Jul '15

01 Jul '15

Have compiled and installed eventlog-0.2.12 (into /usr/local/syslog-ng). Now trying to compile syslog-ng I'm hitting the error shown at the end. Following commands were used to configure the environment for the compile export PKG_CONFIG_PATH=/usr/local/syslog-ng/lib/pkgconfig ./configure --prefix=/usr/local/syslog-ng --enable-sun-streams --enable-tcp-wrapper --enable-ipv6 --enable-sql --enable-ssh --with-ld-library-path=/usr/local/syslog-ng/lib --disable-amqp --enable-sun-door Any suggestions ? Thanks Ian CC modules/afsocket/modules_afsocket_libafsocket_notls_la-transport-mapper-unix.lo CC modules/afsocket/modules_afsocket_libafsocket_notls_la-transport-unix-socket.lo modules/afsocket/transport-unix-socket.c: In function â_format_proc_file_nameâ: modules/afsocket/transport-unix-socket.c:50:3: warning: format â%dâ expects argument of type âintâ, but argument 4 has type âpid_tâ [-Wformat=] g_snprintf(buf, buflen, "/proc/%d/%s", pid, proc_file); ^ modules/afsocket/transport-unix-socket.c: In function â_unix_socket_readâ: modules/afsocket/transport-unix-socket.c:219:6: error: âstruct msghdrâ has no member named âmsg_controlâ msg.msg_control = ctlbuf; ^ modules/afsocket/transport-unix-socket.c:220:6: error: âstruct msghdrâ has no member named âmsg_controllenâ msg.msg_controllen = sizeof(ctlbuf); ^ modules/afsocket/transport-unix-socket.c: In function âlog_transport_unix_dgram_socket_newâ: modules/afsocket/transport-unix-socket.c:261:3: warning: implicit declaration of function âsocket_set_pass_credentialsâ [-Wimplicit-function-declaration] socket_set_pass_credentials(fd); ^ modules/afsocket/transport-unix-socket.c: At top level: modules/afsocket/transport-unix-socket.c:36:1: warning: â_add_nv_pair_intâ defined but not used [-Wunused-function] _add_nv_pair_int(LogTransportAuxData *aux, const gchar *name, gint value) ^ modules/afsocket/transport-unix-socket.c:102:1: warning: â_add_nv_pair_proc_read_unless_unsetâ defined but not used [-Wunused-function] _add_nv_pair_proc_read_unless_unset(LogTransportAuxData *aux, const gchar *name, pid_t pid, const gchar *proc_file, const gchar *unset_value) ^ modules/afsocket/transport-unix-socket.c:115:1: warning: â_add_nv_pair_proc_read_argvâ defined but not used [-Wunused-function] _add_nv_pair_proc_read_argv(LogTransportAuxData *aux, const gchar *name, pid_t pid, const gchar *proc_file) ^ modules/afsocket/transport-unix-socket.c:135:1: warning: â_add_nv_pair_proc_readlinkâ defined but not used [-Wunused-function] _add_nv_pair_proc_readlink(LogTransportAuxData *aux, const gchar *name, pid_t pid, const gchar *proc_file) ^ gmake[2]: *** [modules/afsocket/modules_afsocket_libafsocket_notls_la-transport-unix-socket.lo] Error 1 gmake[1]: *** [all-recursive] Error 1 gmake: *** [all] Error 2 The contents of this e-mail are confidential and for the exclusive use of the intended recipient. If you are not the intended recipient you should not read, copy, retransmit or disclose its contents. If you have received this email in error please delete it from your system immediately and notify us either by email or telephone. The views expressed in this communication may not necessarily be the views held by McLaren Technology Group Limited. McLaren Technology Group Limited | McLaren Technology Centre | Chertsey Road | Woking | Surrey | GU21 4YH | UK | Company Number: 01967715

4 8

syslog-ng 3.7.0beta2
by Budai, László 26 Jun '15

26 Jun '15

3.7.0beta2 This is the second beta release of the upcoming syslog-ng OSE 3.7 branch. Changes compared to the previous alpha release: Features - Added a geoip parser. - ssl_options inside tls() extended with the following set: no-sslv2, no-sslv3, no-tlsv1, no-tlsv11, no-tlsv12 - minimal libriemann-client version bumped from 1.0.0 to 1.6.0 - TLS support added to Riemann destination - timeout() option added to Riemann destination Fixes - SyslogNg.jar removed from the release tarball. - When the configured host was not available during the initialization of afsocket destination syslog-ng just didn't start. From now, syslog-ng starts in that case and will retry connecting to the host periodically. - When a not writeable file becomes writeable later, syslog-ng recognize it (with the help of reopen-timer) and delivers messages to the file without dropping those which were received during the file was not available. - Fixed a configure error around libsystemd-journal. - --disable-python option and other Python related fixes addded to configure - Retries fixed in SQL destination. In some circumstances when retry_sql_inserts was set to 1, after an insertion failure all incoming messages were dropped. - Added DOS/Windows line ending support in config. - Parallel build is supported for Python and Java destination drivers. - Fixed compilation failure on OpenBSD - Memory leak around reload and internal queueing mechanism has been fixed. - AMQP connection process fixed. - Fixed a potential abort when the localhost name cannot be detected. - Security issue fixed around $HOST. Tech details: When the name of the host is too long, the buffer we use to format the chained hostname is truncated. However snprintf() returns the length the result would be if no truncation happened, thus we will read uninitialized bytes off the stack when we use that pointer to set $HOST with log_msg_set_value(). There can be some security implications, like reading values from the stack that can help to craft further exploits, especially in the presense of address space randomization. It can also cause a DoS if the hostname length is soo large that we would read over the top-of-the-stack, which is probably not mmapped causing a SIGSEGV. - Journal entries containing name-value pairs without '=' caused syslog-ng to crash. Instead of crashing, syslog-ng just drop these nv pairs. Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Alex Badics, Andras Mitzki, Balazs Scheidler, Bence Tamas Gedai, Fabien Wernli, Gergely Nagy, Gergo Nagy, Gyorgy Pasztor, Istvan Adam Mozes, Laszlo Budai, Peter Czanik, Robert Fekete, Tibor Benke, Viktor Juhasz, Zoltan Pallagi. — View it on GitHub <https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.7.0beta2>.

3 2

3.7beta2 packages for openSUSE / SLES
by Czanik, Péter 26 Jun '15

26 Jun '15

Hi, My unofficial syslog-ng 3.7 beta2 packages for openSUSE / SLES are now available, at this time completely untested (I'm sitting at a conference right now... :-) ). They are available at the usual location: https://build.opensuse.org/package/show/home:czanik:syslog-ng37/syslog-ng Python support failed to build on SLES11 (most likely missing pkg-config information for python) and java failed in post build checks... Have a nice weekend! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Migrating from syslog-ng v 3.2.5 to 3.6.4
by Tech Support 26 Jun '15

26 Jun '15

All; I am currently migrating a CentOS 6.6 server running syslog-ng 3.2.5 to a CentOS 7.1 system running syslog-ng 3.6.4. I'm trying to use the same configuration file, but I'm getting the following message: /usr/sbin/syslog-ng -v -s -f /etc/syslog-ng/syslog-ng.conf [2015-06-25T09:05:16.796854] Using /dev/log Unix socket with systemd is not possible. Changing to systemd-syslog source, which supports socket activation.; I know one problem is that I'm just not up to speed yet with systemd, but I was hoping that someone could shed some light on this error. Any help at all would be greatly appreciated. Thanks; John V. Tech Support Tech Support VoIP Business Solutions 240-215-3479 x325 <mailto:fsd@voipbusiness.us> support(a)voipbusiness.us

2 2

syslog-ng with http
by westlake 26 Jun '15

26 Jun '15

is it possible to send http-put traffic as a destination with syslog-ng? thanks

3 2

snmp traps from network devices
by Ranganathan Kanagarajan 25 Jun '15

25 Jun '15

Hi All, I have setup a syslog-ng version 3.6.3 in Suse linux. I am able to configure and get the logs from linux servers. I am trying to collect the snmp traps for the follwing logging snmp-trap emergencies logging snmp-trap alerts logging snmp-trap critical logging snmp-trap errors logging snmp-trap warnings logging snmp-trap informational logging host 10.10.10.10 snmp-server enable traps syslog PLease provide me a existing configuration file which will help me. Thanks, Ranga

2 1

CentOS7 syslog-ng 3.5.6: TLS: SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca
by Schulte, Klaus (Nokia - DE/Ulm) 25 Jun '15

25 Jun '15

Dear all, I've this source settings for TLS: source s_tcp_tls { network( transport("tls") ip(10.46.130.65) port(6514) tls( peer-verify("optional-untrusted") key-file("/etc/syslog-ng/key.d/syslog-ng.key") cert-file("/etc/syslog-ng/cert.d/syslog-ng.cert") ) ); }; But when a client connects via TCP/TLS to the syslog-ng service.. In syslog-ng these messages are showing up: syslog-ng starting up; version='3.5.6' Syslog connection accepted; fd='12', client='AF_INET(10.46.160.78:48075)', local='AF_INET(10.46.130.65:6514)' SSL error while reading stream; tls_error='SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca' I/O error occurred while reading; fd='12', error='Connection reset by peer (104)' Syslog connection closed; fd='12', client='AF_INET(10.46.160.78:48075)', local='AF_INET(10.46.130.65:6514)' Closing log transport fd; fd='12' I don't know why syslog-ng is proving the CA? As far as I know the configuration is a non-mutual authentication - so the CA shouldn't play a role in this - is this correct? The client sends messages in RFC5424 format. Any help is appriciated - I've no clue what's going wrong. Best regards Klaus ____________________________________________

2 3

Re: [syslog-ng] Problems trying to compile syslog-ng 3.6.4 on Solaris 11.2 (SPARC)
by Cottington-Bray, Ian 25 Jun '15

25 Jun '15

Any suggestions ?? From: Cottington-Bray, Ian Sent: 23 June 2015 11:28 To: 'syslog-ng(a)lists.balabit.hu' Subject: Problems trying to compile syslog-ng 3.6.4 on Solaris 11.2 (SPARC) Have compiled and installed eventlog-0.2.12 (into /usr/local/syslog-ng). Now trying to compile syslog-ng I'm hitting the error shown at the end. Following commands were used to configure the environment for the compile export PKG_CONFIG_PATH=/usr/local/syslog-ng/lib/pkgconfig ./configure --prefix=/usr/local/syslog-ng --enable-sun-streams --enable-tcp-wrapper --enable-ipv6 --enable-sql --enable-ssh --with-ld-library-path=/usr/local/syslog-ng/lib --disable-amqp --enable-sun-door Any suggestions ? Thanks Ian CC modules/afsocket/modules_afsocket_libafsocket_notls_la-transport-mapper-unix.lo CC modules/afsocket/modules_afsocket_libafsocket_notls_la-transport-unix-socket.lo modules/afsocket/transport-unix-socket.c: In function â_format_proc_file_nameâ: modules/afsocket/transport-unix-socket.c:50:3: warning: format â%dâ expects argument of type âintâ, but argument 4 has type âpid_tâ [-Wformat=] g_snprintf(buf, buflen, "/proc/%d/%s", pid, proc_file); ^ modules/afsocket/transport-unix-socket.c: In function â_unix_socket_readâ: modules/afsocket/transport-unix-socket.c:219:6: error: âstruct msghdrâ has no member named âmsg_controlâ msg.msg_control = ctlbuf; ^ modules/afsocket/transport-unix-socket.c:220:6: error: âstruct msghdrâ has no member named âmsg_controllenâ msg.msg_controllen = sizeof(ctlbuf); ^ modules/afsocket/transport-unix-socket.c: In function âlog_transport_unix_dgram_socket_newâ: modules/afsocket/transport-unix-socket.c:261:3: warning: implicit declaration of function âsocket_set_pass_credentialsâ [-Wimplicit-function-declaration] socket_set_pass_credentials(fd); ^ modules/afsocket/transport-unix-socket.c: At top level: modules/afsocket/transport-unix-socket.c:36:1: warning: â_add_nv_pair_intâ defined but not used [-Wunused-function] _add_nv_pair_int(LogTransportAuxData *aux, const gchar *name, gint value) ^ modules/afsocket/transport-unix-socket.c:102:1: warning: â_add_nv_pair_proc_read_unless_unsetâ defined but not used [-Wunused-function] _add_nv_pair_proc_read_unless_unset(LogTransportAuxData *aux, const gchar *name, pid_t pid, const gchar *proc_file, const gchar *unset_value) ^ modules/afsocket/transport-unix-socket.c:115:1: warning: â_add_nv_pair_proc_read_argvâ defined but not used [-Wunused-function] _add_nv_pair_proc_read_argv(LogTransportAuxData *aux, const gchar *name, pid_t pid, const gchar *proc_file) ^ modules/afsocket/transport-unix-socket.c:135:1: warning: â_add_nv_pair_proc_readlinkâ defined but not used [-Wunused-function] _add_nv_pair_proc_readlink(LogTransportAuxData *aux, const gchar *name, pid_t pid, const gchar *proc_file) ^ gmake[2]: *** [modules/afsocket/modules_afsocket_libafsocket_notls_la-transport-unix-socket.lo] Error 1 gmake[1]: *** [all-recursive] Error 1 gmake: *** [all] Error 2 The contents of this e-mail are confidential and for the exclusive use of the intended recipient. If you are not the intended recipient you should not read, copy, retransmit or disclose its contents. If you have received this email in error please delete it from your system immediately and notify us either by email or telephone. The views expressed in this communication may not necessarily be the views held by McLaren Technology Group Limited. McLaren Technology Group Limited | McLaren Technology Centre | Chertsey Road | Woking | Surrey | GU21 4YH | UK | Company Number: 01967715

1 0

Re: [syslog-ng] I need assistance converting a syslog-ng.conf file from V 1.5.16 to 3.2.4...
by Mason, Tron 25 Jun '15

25 Jun '15

Hello... I'm getting the following errors. Please help. Thanks. bash-3.2# /usr/local/sbin/syslog-ng -v -s -f /usr/local/etc/syslog-ng/syslog-ng.conf WARNING: the match() filter without the use of the value() option is deprecated and hinders performance, please update your configuration; bash-3.2# /usr/local/etc/syslog-ng/syslog-ng.conf -a -f /usr/local/sbin/syslog-ng /usr/local/etc/syslog-ng/syslog-ng.conf: line 10: @version:: command not found /usr/local/etc/syslog-ng/syslog-ng.conf: line 12: syntax error near unexpected token `(' /usr/local/etc/syslog-ng/syslog-ng.conf: line 12: `options { use_dns(yes); ' Tron G Mason

2 1

mark-freq() and mark-mode() understanding
by Sergey Y. Afonin 24 Jun '15

24 Jun '15

Hello. I need an explanation of mark-freq() and mark-mode() works. === a part of syslog-ng.conf === options { ... mark-freq(300); ... } destination mesg { file("/var/log/syslog/messages" mark-mode(periodical)); }; === === a part of /var/log/syslog/messages === Jun 24 08:26:35 -- MARK -- Jun 24 08:30:01 crond[10512]: (root) CMD ( /usr/bin/freshclam --quiet --daemon-notify) Jun 24 08:31:30 -- MARK -- Jun 24 09:01:01 crond[10544]: (root) CMD (run-parts /etc/cron.hourly) Jun 24 09:25:30 syslog-ng[9983]: Log statistics ... === "MARK" label absent between 08:31:30 and 09:01:01 for example. Does it turns out that "idle" is checked for all file() globally ? Can I setup it for one file() ? -- Regards, Sergey.

1 0

3.6.4 in FreeBSD ports and for EPEL6
by Czanik, Péter 23 Jun '15

23 Jun '15

Hi, As promised: - FreeBSD ports now has 3.6.4: http://www.freshports.org/sysutils/syslog-ng/ - my unofficial EPEL6 (RHEL/CentOS/etc.) repo is also updated: https://copr.fedoraproject.org/coprs/czanik/syslog-ng36epel6/ Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

CzP in Boston @ Red Hat Summit
by Czanik, Péter 22 Jun '15

22 Jun '15

Hi, This week I'm in Boston at the Red Hat Summit: https://czanik.blogs.balabit.com/2015/06/red-hat-summit-syslog-ng-docker-co… If you are at the Summit or just in the Boston area and would like to talk to a BalaBit engineer about syslog-ng, contact me by e-mail or twitter (@PCzanik)! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

my unofficial 3.6.4 packages for opensuse/sles/fedora/rhel7
by Czanik, Péter 22 Jun '15

22 Jun '15

Hi, Most of my unofficial syslog-ng packages are now ready: openSUSE/SLES: https://build.opensuse.org/project/show/home:czanik:syslog-ng36 Fedora/RHEL7: https://copr.fedoraproject.org/coprs/czanik/syslog-ng36/ RHEL6 and FreeBSD ports will hopefully follow later this week. As I'm off to the Red Hat Summit this week ( https://czanik.blogs.balabit.com/2015/06/red-hat-summit-syslog-ng-docker-co… ) my response time will be slower than usual. Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

insider 2015-06: Red Hat Summit; EU Data Security; GSoC IRC; syslog-ng 3.6.3
by Czanik, Péter 18 Jun '15

18 Jun '15

Dear syslog-ng users, This is the 42th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS syslog-ng @ Red Hat Summit -------------------------- Come to visit the BalaBit booth (#301) at the Red Hat Summit in Boston! We hare happy to discuss the latest trends in log management, new features of syslog-ng, talk about Docker integration and the new BigData destinations. For details, read https://czanik.blogs.balabit.com/2015/06/red-hat-summit-syslog-ng-docker-co… GSoC IRC meeting ---------------- On the 4th of June we had a successful IRC meeting, which involved GSoC students and mentors, syslog-ng developers and users. Based on this experience we plan to have regular IRC meetings in the future. If you have a question you don't need to wait for a dedicated meeting, just join the channel and ask! The syslog-ng IRC channel is available on the freenode network: #syslog-ng on irc.freenode.net You can also use http://webchat.freenode.net/ to join if you don't have a dedicated client. EU Data Security Requirements and log management ------------------------------------------------ As technology changes, data security requirements needs to be adopted to it. After almost 20 years the EU updates its related regulations. Read about the implications for log management: https://jluby.blogs.balabit.com/2015/06/03/data-security-requirements-in-eu… syslog-ng 3.6.3 released ------------------------ A long awaited maintenance release for the 3.6 series was made available last week. It fixes many issues, including some long standing problems reported also for earlier versions. It is recommended to update to this version. A list of fixes is available at https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.6.3 NEW RELEASES syslog-ng 3.6.3: https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.6.3 Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com To read this newsletter on-line, visit: http://insider.blogs.balabit.com/ Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

errors compiling 3.7.0-beta 1 on rhe6.4
by Russell Fulton 18 Jun '15

18 Jun '15

compiling on RHE 6.4, ./configure make .. . . . CC lib/template/lib_libsyslog_ng_la-templates.lo In file included from ./lib/template/repr.h:28, from lib/template/templates.c:25: ./lib/template/function.h:31: error: redefinition of typedef 'LogTemplateOptions' ./lib/template/common-template-typedefs.h:27: note: previous declaration of 'LogTemplateOptions' was here ./lib/template/function.h:32: error: redefinition of typedef 'LogTemplate' ./lib/template/templates.h:70: note: previous declaration of 'LogTemplate' was here In file included from lib/template/templates.c:26: ./lib/template/compiler.h:30: error: redefinition of typedef 'LogTemplate' ./lib/template/function.h:32: note: previous declaration of 'LogTemplate' was here make[2]: *** [lib/template/lib_libsyslog_ng_la-templates.lo] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2

3 3

syslogng-web
by Rick Silacci 17 Jun '15

17 Jun '15

I have a 450 G database. It looks like syslogng-web only has the most recent 40 pages available. How do you access the older data through syslogng-web? Rick Silacci Velociter Wireless 1525 Second Street Escalon, CA 95320 Phone: 209.838.1221

2 1

substr function issues
by westlake 17 Jun '15

17 Jun '15

I'm stumped on a little problem with syslog-ng, basically what I'm trying to do is extract text from a string and place that into a new macro, eg -> set($(substr ${MSG} 7 12), value("${MACRO"); here the syntax checker stops short around the first dollar sign and i'm not sure how else I can apply this. thanks

2 4

TOS value updating from afinet_setup_socket
by Dilip Basavaraju 12 Jun '15

12 Jun '15

Dear All, I am facing issue in updating TOS value using setsockopt in the function afinet_setup_socket. //syslog_ng_dscp_val = 40; setsockopt(fd, SOL_IP, IP_TOS, &syslog_ng_dscp_val, sizeof(syslog_ng_dscp_val)); below is the function definition. I am not getting any print messages. I think this function is not being called. Please suggest me how to update the TOS value. I am waiting for your responses please. static gboolean afinet_setup_socket(gint fd, GSockAddr *addr, InetSocketOptions *sock_options, AFSocketDirection dir) { gint off = 0; if (!afsocket_setup_socket(fd, &sock_options->super, dir)) return FALSE; switch (addr->sa.sa_family) { case AF_INET: { struct ip_mreq mreq; if (dir & AFSOCKET_DIR_RECV) { memset(&mreq, 0, sizeof(mreq)); setsockopt(fd, SOL_IP, IP_ADD_MEMBERSHIP, &mreq, sizeof(mreq)); if (dir & AFSOCKET_DIR_SEND) setsockopt(fd, SOL_IP, IP_MULTICAST_TTL, &sock_options->ttl, sizeof(sock_options->ttl)); } else { if (sock_options->ttl && (dir & AFSOCKET_DIR_SEND)) setsockopt(fd, SOL_IP, IP_TTL, &sock_options->ttl, sizeof(sock_options->ttl)); } #if CONFIG_CP_DSCP //setsockopt(fd, SOL_IP, IP_TOS, &syslog_ng_dscp_val, sizeof(syslog_ng_dscp_val)); int tmpSouravVal = 40; //dilipu setsockopt(fd, SOL_IP, IP_TOS, &tmpSouravVal, sizeof(syslog_ng_dscp_val)); #if (CONFIG_CP_IPV6 && CONFIG_CP_DSCP) setsockopt(fd, IPPROTO_IPV6, IPV6_TCLASS, &syslog_ng_dscp_val, sizeof(syslog_ng_dscp_val)); #endif #else if (sock_options->tos && (dir & AFSOCKET_DIR_SEND)) setsockopt(fd, SOL_IP, IP_TOS, &sock_options->tos, sizeof(sock_options->tos)); #endif break; } } return TRUE; } Thanks and regards Dilip Kumar B [https://relayq.larsentoubro.com/DigitalSignature2015.jpg] L&T Technology Services Ltd www.LntTechservices.com<http://www.lnttechservices.com/> This Email may contain confidential or privileged information for the intended recipient (s). If you are not the intended recipient, please do not use or disseminate the information, notify the sender and delete it from your system.

2 3

Integrating with snmp traps
by Fabien Wernli 11 Jun '15

11 Jun '15

Hi, Does anybody on this fine list handle SNMP traps using syslog-ng? We used to just forward logs using syslog and snmptrapd as suggested on an old blog post from Baszi. The problem with this approach is that the messages are flat. We would actually like to parse all the key-values from the original payload, anyone done that before? Thanks!

2 6

organizing logs over network
by westlake 11 Jun '15

11 Jun '15

if i use source-> system(facility(local0)); and use an application that sends to local0, what's the most effective way of categorizing this into a special log file if the destination is over network? I'm using two dns machines and they both send output to one logging machine. So far I'm using the host() directive with filter{} and two log{} entries on the recipient, this way I can create a log depending on the ip. Is there a better way to organize the logs instead of using host() with filter{} ? thanks

2 1

Fedora packages for syslog-ng 3.6.3
by Czanik, Péter 10 Jun '15

10 Jun '15

Hi, syslog-ng 3.6.3 was released yesterday with a long list of bugfixes: https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.6.3 As usual, my unofficial Fedora packages follow. This time without Fedora 20 and EPEL7 (due to a systemd problem to be fixed by the next release). Packages are available at https://copr.fedoraproject.org/coprs/czanik/syslog-ng36/ Fedora 22 syslog-ng packages is added, but no incubator yet (one of the dependencies fails to compile). If you have any problems, please let me know! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

openSUSE/SLES packages for syslog-ng 3.6.3
by Czanik, Péter 10 Jun '15

10 Jun '15

Hi, syslog-ng 3.6.3 was released yesterday with a long list of bugfixes: https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.6.3 As usual, my unofficial openSUSE/SLES packages follow. This time without openSUSE 13.1 (due to a systemd problem to be fixed by the next release). Packages are available at https://build.opensuse.org/project/show/home:czanik:syslog-ng36 If you have any problems, please let me know! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0