- syslog-ng - lists.balabit.hu

syslog-ng server monitoring with mobile app
by Prerit Garg 10 Mar '15

10 Mar '15

Hey, I am Prerit Garg. I would like to take up this project for Gsoc this year. I have a pretty good experience in android application development. I recently developed an android app for an organisation and published it on playstore. Please Help me get started with this project.

2 1

Mutual Authentication and Encryption With Rsyslog
by Michael Starks 09 Mar '15

09 Mar '15

I am trying to get mutual authentication working between a syslog-ng server and an Rsyslog client, using startssl.com issued certificates. The client does properly authenticate the server, but syslog-ng does not recognize the client as trusted. Server info: ------------ # cat /etc/redhat-release CentOS release 6.6 (Final) # /usr/local/syslog-ng/sbin/syslog-ng --version syslog-ng 3.2.4 Installer-Version: 3.2.4 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#ef7b91e4a1b1f9628c66138b4ae83de7e4c697c6 Compile-Date: Aug 18 2013 22:16:35 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: on Enable-Pcre: on Enable-Pacct: off source s_network_secure { tcp(flags(no-multi-line) ip(0.0.0.0) port(6514) tls( key-file("/usr/local/syslog-ng/etc/cert.d/cert.key") cert-file("/usr/local/syslog-ng/etc/cert.d/cert.pem") ca_dir("/usr/local/syslog-ng/etc/cert.d") peer_verify(required-untrusted)) ); }; And of course this is defined in a log statement. Here is the directory. Note that the symbolic link of the hash has been created. # ll /usr/local/syslog-ng/etc/cert.d/ total 204 lrwxrwxrwx. 1 root root 13 Mar 3 13:51 876f1e28.0 -> ca-bundle.pem -rw-r--r--. 1 root root 195587 Mar 3 13:08 ca-bundle.pem -r--------. 1 root root 1679 Feb 28 11:21 cert.key -r--------. 1 root root 2260 Feb 28 11:50 cert.pem -rw-r--r--. 1 root root 2281 Mar 3 13:58 client.key required-untrusted works, but required-trusted doesn't. So I figured maybe it was an SSL issue with the authority, but it seems to validate OK. # openssl verify -CAfile 876f1e28.0 -verbose client.key client.key: OK Client info: ------------ # cat /etc/lsb-release DISTRIB_ID=Ubuntu DISTRIB_RELEASE=14.04 DISTRIB_CODENAME=trusty DISTRIB_DESCRIPTION="Ubuntu 14.04.1 LTS" # rsyslogd -v rsyslogd 7.4.4, compiled with: FEATURE_REGEXP: Yes FEATURE_LARGEFILE: No GSSAPI Kerberos 5 support: Yes FEATURE_DEBUG (debug build, slow code): No 32bit Atomic operations supported: Yes 64bit Atomic operations supported: Yes Runtime Instrumentation (slow code): No uuid support: Yes See http://www.rsyslog.com for more information. I suppose there's no additional client info needed since I know it is presenting the certificate--the issue seems to be that the syslog-ng server simply doesn't trust it. All suggestions appreciated.

3 5

syslog-ng in Google Summer of Code 2015 (GSoC)
by Czanik, Péter 09 Mar '15

09 Mar '15

Hi, As you might have already noticed from the increased traffic: the syslog-ng project is participating again in GSoC! Our page at Google is available at https://www.google-melange.com/gsoc/org2/google/gsoc2015/syslog_ng We have many interesting project ideas to choose from. This years focus is on Java and Python language bindings and making configuration easier using a QT or web based GUI. If you are a student please check our ideas page at https://github.com/balabit/syslog-ng/wiki/GSoC2015-idea-&-project-list which of the projects suits you best. You can also help, if you are already not a student: please follow us on Twitter and re-tweet our GSoC tweets, so students among your followers have a chance to learn about the syslog-ng GSoC possibilities. We are @sngose on twitter: https://twitter.com/sngose Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Use receiving file name / path as a macro on the server
by Thanuje Ashwin Nallaperuma 09 Mar '15

09 Mar '15

Hi all, I have multiple files with the same content on the syslog-ng client These files are stored on different locations with the same file name and same content After receiving I want to store these files with different names on sysog-ng server Is there any way I could use the filepath or filename of the receiving file as a macro or any way to achieve this..?

4 6

Can I use a string as a delimiter on csv-parser
by Thanuje Ashwin Nallaperuma 09 Mar '15

09 Mar '15

Hi everyone, I need to split a macro using a string as a delimiter, Is there any way I can do it ? -Ashwin

2 2

Incompatible Version Warnings
by Dan Mahoney 09 Mar '15

09 Mar '15

Hey there, We have a number of systems that we're trying to deploy syslog-ng on, with puppet, which means we're dealing with multiple versions out there -- so we're trying to stay compatible with 3.4. On a newer version (3.6), we get the following errors on startup: (snip) [2015-03-06T20:47:33.065077] WARNING: Configuration file format is too old, syslog-ng is running in compatibility mode Please update it to use the syslog-ng 3.6 format at your time of convinience, compatibility mode can operate less efficiently in some cases. To upgrade the configuration, please review the warnings about incompatible changes printed by syslog-ng, and once completed change the @version header at the top of the configuration file.; [2015-03-06T20:47:33.096433] WARNING: Starting with syslog-ng 3.6, the system() source performs JSON parsing of messages starting with the '@cim:' prefix. No additional action is needed; [2015-03-06T20:47:33.096495] WARNING: Your configuration uses a newly introduced reserved word as identifier, please use a different name or enclose it in quotes before upgrading; keyword='channel', config-version='3.3', version='3.4', filename='source confgen system', line='1:1' Error parsing source, source plugin channel not found in source confgen system at line 1, column 1: included from /usr/local/etc/syslog-ng.conf line 27, column 9 channel ^^^^^^^ (snip) I've found if I comment out the "system()" source it makes this error go away, but the requisiste lines are exactly what are referenced in the manual: source s_local { system(); internal(); }; I suppose what's most confusing here, is syslog-ng is trying to tell me exactly where it finds the error, in the word "channel" saying "here, change this, this is the bad word I'm tripping over", but I don't find that word anywhere -- nor does it say *which* included file it's tripping over. Maybe it's telling me that's the word it *needs* to find, but that's less clear. I'm not finding anything in the mailing lists for this. Finally, I should probably ask -- since syslog-ng has the ability to tag your config files with a given version, is there a way to say "use this config if you're on 3.4 and this version if you're on 3.6", so I can stay compatible with the various versions I've got deployed. One other little nit: "Convenience" -Dan Mahoney

4 4

syslog-ng for Python regarding
by Nishaanth Gunasekeran 08 Mar '15

08 Mar '15

Hey, This is Nishaanth. I have been searching for a project to work on for SoC. I found syslog-ng for Python interesting. I am familiar with Python and also C. Anyone can help me?

1 0

Interested in syslog-ng's :: command line tool
by Fongoh Martin 07 Mar '15

07 Mar '15

Good day. I wish to make know my interest in working with syslog-ng organisation in this 2015 session of gsoc, under the project "syslog-ng as a command line tool". My name is Fongoh Martin, a 3rd year Bachelor in Computer Engineering, software specialty in the University of Buea, Cameroon. I am a Linux user with great experience and am good with the command line and have an extensive knowlege in shell scripting. I have 4 year experience in C, and 2 years experience in java, with a great idea on object orientation. Currently, I have cloned the source code from git and am going through it to get myself familiar and prepare for bug fixing. I am always ready to learn new technologies and techniques, following instructions and asking questions where not understood. Thanks as i await your reply.

1 0

(no subject)
by Nikhil Ramesh 06 Mar '15

06 Mar '15

1 0

Re: [syslog-ng] Single host logs aren't being written
by Jim Hendrick 06 Mar '15

06 Mar '15

I would look at the macro parsing. Is HOST correctly being parsed, etc. You could create a separate file destination using one macro at a time to narrow it down. Also you could check the syslog-ng logs themselves to look at drops. Jim Sent from my Verizon Wireless 4G LTE smartphone -------- Original message -------- From: Brandon Kendall <brandon.kendall(a)gmail.com> Date: 03/06/2015 11:56 AM (GMT-05:00) To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Single host logs aren't being written Hello everyone. I have a centralized syslog-ng server running that collect syslog messages from Cisco firewalls. The .conf file is very straightforward and contains the following: options {use_fqdn(no);use_dns(yes);dns_cache(yes);dns_cache_size(2000);dns_cache_expire(87600);keep_hostname(no);long_hostnames(no);flush_lines(0);normalize_hostnames(yes);create_dirs(yes);dir_group(group_name);dir_perm(0751);stats_freq(600);stats_level(1);group(group_name);perm(0640);}; source s_network_1 {udp();}; destination d_network_1 {file ("/var/syslog/$R_YEAR-$R_MONTH-$R_DAY/$HOST/$R_YEAR-$R_MONTH-$R_DAY-$HOST-$R_HOUR.log");}; log {source(s_network_1);destination(d_network_1);}; The goal is to have the logs from each device arranged in a hierarchy that is as follows (simplified):Date/device_name/hour-1.logDate/device/name/hour2.logetc This has been working great. Recently I configured another network device to send syslog messages to this server, and they aren't being logged. Using tcpdump on the syslog-ng box, I've verified the messages are making it to the server from the network device. They are UDP and using the correct port. I've compared the message format in the pcap to other devices that are still logging and everything matches. I have no errors in /var/log/syslog files, nor do I have errors in /var/log/messages. I've hit a dead end in troubleshooting, since all other devices sending logs to this server are being correctly written to log files. Can someone point me to anything else to check? This is syslog-ng 3.1.2 running on RHEL 5.8. Thanks!

1 0

GSoC 2015 Language binding project
by Kata Jóna 06 Mar '15

06 Mar '15

Hey, I was looking through the GSoC projects and I really liked the syslog-ng 's language binding project. I wonder if it would be good in C++ language or do you want it in a different language. I would really like to do it, but I only know C and C++ languages. Kacsa

1 0

GSOC : syslog-ng as a command line tool
by Anshul Kushwaha 05 Mar '15

05 Mar '15

Hi, I am a final year undergraduate student of Computer Science from India, I love linux, C and the Open Source community. I coded for The Linux Foundation in GSOC 2013 and would love to code for syslog-ng this year. I've been using linux since school and throughout college. I'm quite experienced with C and love how simple yet incredibly powerful it is. Here are my profiles: LinkedIn: https://www.linkedin.com/in/anshulkushwaha GitHub: http://github.com/anshulk For this summer, I'd like to implement "syslog-ng as a command line tool". I match the requirements well and this project will help me sharpen my skills. It would be great if I can get some pointers to start this. Thank You, Sincerely, Anshul Kushwaha

1 0

GSoC - 2015
by Laszlo Budai 05 Mar '15

05 Mar '15

Dear GSoC aspirants, first of all thank you for answering our GSoC call. Some of you asking how could start with the project. First, you have to choose a project. After that it is highly recommended to contact with the project's mentor. You should get enough information from your mentor to create your proposal. Ask all the questions you need to be answered. After you sent your proposal, you will get a small task. I suggest you to try to be as independent as you can: if you have a concrete idea, want to change something, just tell it to your mentor. (eg.: if you don't know c++ but know python and want to create a gui config editor: it is OK, the target is to have a nice GUI tool and not writing softwares in c++ :-) ) br, Laszlo Budai Sent from my HTC

1 0

GSoC Introduction
by Bence Gedai 05 Mar '15

05 Mar '15

Hi everyone, My name is Bence Tamás Gedai, and I am an undergraduate student at Budapest University of Technology and Economics. I'm interested in the "Configuration visualization" project. I have been coding in C for about a year, but I think I have got the fundamental skills needed for this project. I am familiar with C# and c++ as well. The thing that caught my attention about this project is graph theory, I am really interested in his field and in algorithms related to that. I have alredy worked on a small issue at syslog-ng, so I know the basics of the code. I tried to contact the mentioned mentor, Viktor Tusa via tusa(a)balabit.com, but my mails were sent back. I have got a few questions about the project so can you direct me to the proper place? Thanks in advance, Bence Tamás Gedai

2 1

GSoC2015 Project: syslog-ng configuration editor using Qt
by damitha kithmal 05 Mar '15

05 Mar '15

Hi, I'm Damitha Kithmal , final year undergraduate of University of Moratuwa, Sri Lanka. I'm interested about the project idea of "*Project: syslog-ng configuration editor using Qt". *I have been working with Qt for more than two years. I also have done my internship in Qt at Millennium Information Technology, which is the largest C++ company in Sri Lanka. I'm also familiar with Squish Qt GUI Testing tool. I'm currently learning about the syslog-ng and hope it will be an advantage to do gsoc with syslog-ng. Thank You -- Damitha Kithmal *Undergraduate* *University of Moratuwa,* *Sri Lanka*.

1 0

Advice on "Websocket for syslog-ng"
by Kai Zhao 05 Mar '15

05 Mar '15

Hello, I am Kai Zhao, and I am a third-year graduate student in Beijing University of Posts and Telecommunications, China. I am eager to take the "Websocket for syslog-ng" project for I have related experience. Skills: C/C++ : Strong (I have coded more than 100 thousand lines in two project) Network programming: I have 2 year experience in network programming mostly under Fedora, for my internships involves SNMPv3, IPv6 at Siemens from 2012 to 2014. Thank you for give me some advice on the project. -- loverszhaokai motto：You got a dream and you gotta protect it. github：https://github.com/loverszhaokai blog：http://www.cnblogs.com/lovers/

1 0

GSOC 2015: Student Introduction
by hitesh ramani 04 Mar '15

04 Mar '15

Hello,My name is Hitesh Ramani, and I'm pursuing my Master's in Technology from Hyderabad Central University, Hyderabad, India. I've gone through the Projects page and the Project that caught my attention particularly was syslog-ng for Python.I, as my Post Graduation project, am currently working on Postgres, which is a C based ORDBMS, trying to extend it's functionalities. I also have a 2.5 year working experience with Python and am well versed with C and shell. Moreover, I have used Cython on a very small scale project in one of my labs so I've the basic knowledge of it. Please guide me as per how should I start with the project.Thank You.Hitesh Ramani

1 0

(no subject)
by Amar Budhiraja 04 Mar '15

04 Mar '15

Hi, I am a junior undergraduate student currently pursuing computer science and engineering. I was looking at the GSoC ideas for syslog-ng and I found the idea of syslog-ng server monitoring with mobile app quite interesting. My skill set includes Java, C/C++, Python and Android. I have worked with android earlier and I have developed about 5 applications, 2 end-to-end and 3 prototypes. I have also been coding in Java for about 3 years now and have a pretty good understanding of the same. I do not have any coding knowledge regarding SSL control socket but I have worked with socket in C for a networks project, so I believe I can pick it up as and when required. As for syslog-ng, I installed and worked around it a little bit and I found myself to be quite comfortable with it at a user level. I believe building a mobile application would be relatively less codebase dependent and more couple in a API sort of way. I would like to contribute to this project over the summer. Could you please guide me where should I start? May be wireframing or a small demo app? Thank you Sincerely, Amar Budhiraja

1 0

Gsoc 2015 Queries
by Nikhil Ramesh 04 Mar '15

04 Mar '15

Dear Sir, I am Nikhil.R, second year student in Birla Institute of Technology,Pilani, India. I am interested in applying for Google summer of Code(GSoc) under The syslog-ng project. I have around two years of experience in web development and I am currently working for startup also as a backend developer. I am very proficient in Javascript, PHP, Python, Lua, SQL, HTML5 and CSS3. I have done many side projects using the same tools. Link to github profile: https://github.com/rnikhil275 This should give you a good idea of the experience I have in this field. I have uploaded around 80% of my projects there. I am interested in: Project: syslog-ng configuration editor web based I want to learn more about the project and if possible submit a small demo, before submitting a final proposal. I also want to get some guidance on how these should be implemented so that I can start as soon as possible. I just wanted to know more about the project so that I can show you guys a prototype before the final proposal submission. I want to do some simple tasks first showing that I will be the right candidate for the project. Thank You, Nikhil.R BITS Pilani, Pilani Campus, India +91-7728835767

1 0

[GSOC 2015]:syslog-ng configuration editor using Qt
by siddharth singh 03 Mar '15

03 Mar '15

Hi mentors, After researching a while and going through documentation and man-pages of syslog-ng, syslog-ng.conf, syslog-ng-ctl, I assume that you are looking for a application that can help the user to enable, disable ,add, remove, update certain features of syslog-ng using the Gui. I would be using Qt with Python. Please correct me if i am wrong and add if something is missing. Regards Siddharth Singh irc:siddharth7 (1st year Bachelor in Technology Computer Science student from Indraprastha Institute of Information Technology, Delhi, India)

1 0

syslog-ng configuration editor using Qt
by siddharth singh 03 Mar '15

03 Mar '15

Hi Mentors, I was going through the idea page of syslog-ng and found this project (syslog-ng configuration editor using Qt) intriguing. I have a fair experience in Qt with python, but the project is C++ based. I would like to know if it could be done in python? Regards Siddharth Singh

1 0

GSOC 2015
by Amol Agrawal 02 Mar '15

02 Mar '15

Hello everyone, First of all congrats on being selected for GSOC 2015. Let me introduce myself. I am Amol Agrawal, a fourth year Information Technology undergraduate from Motilal Nehru National Institute of Technology, India. I read the project ideas for GSOC 2015 and the Configuration visualization project seems very interesting to me as I have been coding in C language for the last 4 years and have quite an experience with data structures. So can please anyone guide me how I should start? Regards, Amol.

1 0

Get host IP inside source { file ( ); } driver
by Thanuje Ashwin Nallaperuma 26 Feb '15

26 Feb '15

Hi, I want to read a file which is in the name of the IP of syslog-ng client machine I tried with $HOST macro source { file (/mnt/$HOST); }; But this does not work Any help on doing this ?

4 4

couple questions - geoip and also list archives
by jrhendri＠roadrunner.com 25 Feb '15

25 Feb '15

Hi, I would like to understand how the geoip module works, but cannot find any documentation (or really - any relevant source code so far). I assume it must use some downloaded database (or else it would seem like it would kill a local resolver) but cannot find anything describing it. Is anyone using it in reasonably high-performance environments? (like 5000+ events per second) Also, as I was looking for info, I cannot access the lists.balabit.hu archives (maybe I am *way* behind time, is this still maintained anywhere?) Thanks! Jim

6 8

Upcoming changes in unofficial packaging
by Gergely Nagy 23 Feb '15

23 Feb '15

Hi! I started packaging syslog-ng 3.6.1 for Debian and Ubuntu, to provide binaries at the usual[0] location. In the process, I intend to simplify and clean up the packaging considerably. This also means dropping support for a few older platforms. [0]: http://asylum.madhouse-project.org/projects/debian/ So beginning with 3.6.1, powerpc is going to be dropped, along with Debian Squeeze, and anything prior to Ubuntu Trusty (14.04) (mind you, I may need to add back Precise (12.04), for Travis CI). Furthermore, for Debian Wheezy, one will likely need to use the Debian backports repository[1] along with mine. [1]: http://backports.debian.org/Instructions/ I expect packages to be ready in a few days. -- |8]

3 4