- syslog-ng - lists.balabit.hu

Plugin module not found and Error parsing source, source plugin pipe not found
by Jean Faye 01 Aug '14

01 Aug '14

confirm a6d843f7ad7d1dbf1fefb6f12432e54941a680a9 Hi all, When I run syslog-ng on my platform I faced the issue below. Could you please tell me why this issues happen and how can I fixed them? I am using syslog-ng-3.2.5 and eventlog-0.2.13. See in below the syslog-ng.conf I used. Thank you in advance Ismael /**************Error Logs*******************/ Starting syslog-ng:Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='syslogformat' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='basicfuncs' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='afsocket' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='affile' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='afprog' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='afuser' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='dbparser' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='csvparser' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='syslogformat' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='basicfuncs' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='afsocket' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='affile' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='afprog' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='afuser' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='dbparser' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='csvparser' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='confgen' Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng', module='confgen' Error parsing source, source plugin pipe not found in /etc/syslog-ng.conf at line 26, column 2: pipe("/tmp/pipe" pad_size(2048)); ^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng confirm a6d843f7ad7d1dbf1fefb6f12432e54941a680a9 syslog-ng.conf @version: 3.2 @include "scl.conf" # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. Originally written by anonymous (I can't find his name) # Revised, and rewrited by me (SZALAY Attila <sasa(a)debian.org>) # First, set some global options. options { long_hostnames(off); flush_lines(0); use_dns(no); use_fqdn(no); owner("root"); group("adm"); perm(0640); stats_freq(0); bad_hostname("^gconfd$");create_dirs(yes); }; ######################## # Sources ######################## # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source s_src { unix-dgram("/dev/log"); internal(); # file("/proc/kmsg" program_override("kernel")); #}; ######FIJ###### source s_mysource { pipe("/tmp/pipe" pad_size(2048)); #file("/var/log/ldb/fij_source.log" create_dirs(yes)); }; ############### # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. # #source s_net { tcp(ip(127.0.0.1) port(1000) authentication(required) encrypt(allow)); }; ######################## # Destinations ######################## # First some standard logfile # #destination d_auth { file("/var/log/auth.log"); }; #destination d_cron { file("/var/log/cron.log"); }; #destination d_daemon { file("/var/log/daemon.log"); }; #destination d_kern { file("/var/log/kern.log"); }; #destination d_lpr { file("/var/log/lpr.log"); }; #destination d_mail { file("/var/log/mail.log"); }; #destination d_syslog { file("/var/log/syslog"); }; #destination d_user { file("/var/log/user.log"); }; #destination d_uucp { file("/var/log/uucp.log"); }; # This files are the log come from the mail subsystem. # #destination d_mailinfo { file("/var/log/mail/mail.info"); }; #destination d_mailwarn { file("/var/log/mail/mail.warn"); }; #destination d_mailerr { file("/var/log/mail/mail.err"); }; # Logging for INN news system # #destination d_newscrit { file("/var/log/news/news.crit"); }; #destination d_newserr { file("/var/log/news/news.err"); }; #destination d_newsnotice { file("/var/log/news/news.notice"); }; # Some `catch-all' logfiles. # #destination d_debug { file("/var/log/debug"); }; #destination d_error { file("/var/log/error"); }; #destination d_messages { file("/var/log/messages"); }; # The root's console. # #destination d_console { usertty("root"); }; # Virtual console. # #destination d_console_all { file("/dev/tty10"); }; # The named pipe /dev/xconsole is for the nsole' utility. To use it, # you must invoke nsole' with the -file' option: # # $ xconsole -file /dev/xconsole [...] # #destination d_xconsole { pipe("/dev/xconsole"); }; # Send the messages to an other host # #destination d_net { tcp("127.0.0.1" port(1000) authentication(on) encrypt(on) log_fifo_size(1000)); }; # Debian only #destination d_ppp { file("/var/log/ppp.log"); }; ######FIJ###### ########################Vérifier l'option create_dirs(yes)###################### destination d_GEN { #file("/var/log/ldb/GENTrace.log" create_dirs(yes)); file("/var/log/ldb/GENTrace.log"); }; destination d_SU { #file("/var/log/ldb/SUTrace.log" create_dirs(yes)); file("/var/log/ldb/SUTrace.log"); }; destination d_WAN { #file("/var/log/ldb/WANTrace.log" create_dirs(yes)); file("/var/log/ldb/WANTrace.log"); }; destination d_CPL { #file("/var/log/ldb/CPLTrace.log" create_dirs(yes)); file("/var/log/ldb/CPLTrace.log"); }; ############### ######################## # Filters ######################## # Here's come the filter options. With this rules, we can set which # message go where. #filter f_dbg { level(debug); }; #filter f_info { level(info); }; #filter f_notice { level(notice); }; #filter f_warn { level(warn); }; #filter f_err { level(err); }; #filter f_crit { level(crit .. emerg); }; #filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); }; #filter f_error { level(err .. emerg) ; }; #filter f_messages { level(info,notice,warn) and # not facility(auth,authpriv,cron,daemon,mail,news); }; #filter f_auth { facility(auth, authpriv) and not filter(f_debug); }; #filter f_cron { facility(cron) and not filter(f_debug); }; #filter f_daemon { facility(daemon) and not filter(f_debug); }; #filter f_kern { facility(kern) and not filter(f_debug); }; #filter f_lpr { facility(lpr) and not filter(f_debug); }; #filter f_local { facility(local0, local1, local3, local4, local5, # local6, local7) and not filter(f_debug); }; #filter f_mail { facility(mail) and not filter(f_debug); }; #filter f_news { facility(news) and not filter(f_debug); }; #filter f_syslog3 { not facility(auth, authpriv, mail) and not filter(f_debug); }; #filter f_user { facility(user) and not filter(f_debug); }; #filter f_uucp { facility(uucp) and not filter(f_debug); }; #filter f_cnews { level(notice, err, crit) and facility(news); }; #filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; #filter f_ppp { facility(local2) and not filter(f_debug); }; #filter f_console { level(warn .. emerg); }; ######FIJ###### filter f_GEN { facility(local0) and filter(nom_du_composant_applicatif); }; filter f_SU { facility(local0) and filter(nom_du_composant_applicatif); }; filter f_WAN { facility(local0) and filter(nom_du_composant_applicatif); }; filter f_CPL { facility(local0) and filter(nom_du_composant_applicatif); }; ############### ######################## # Log paths ######################## #log { source(s_src); filter(f_auth); destination(d_auth); }; #log { source(s_src); filter(f_cron); destination(d_cron); }; #log { source(s_src); filter(f_daemon); destination(d_daemon); }; #log { source(s_src); filter(f_kern); destination(d_kern); }; #log { source(s_src); filter(f_lpr); destination(d_lpr); }; #log { source(s_src); filter(f_syslog3); destination(d_syslog); }; #log { source(s_src); filter(f_user); destination(d_user); }; #log { source(s_src); filter(f_uucp); destination(d_uucp); }; #log { source(s_src); filter(f_mail); destination(d_mail); }; #log { source(s_src); filter(f_mail); filter(f_info); destination(d_mailinfo); }; #log { source(s_src); filter(f_mail); filter(f_warn); destination(d_mailwarn); }; #log { source(s_src); filter(f_mail); filter(f_err); destination(d_mailerr); }; #log { source(s_src); filter(f_news); filter(f_crit); destination(d_newscrit); }; #log { source(s_src); filter(f_news); filter(f_err); destination(d_newserr); }; #log { source(s_src); filter(f_news); filter(f_notice); destination(d_newsnotice); }; #log { source(s_src); filter(f_cnews); destination(d_console_all); }; #log { source(s_src); filter(f_cother); destination(d_console_all); }; #log { source(s_src); filter(f_ppp); destination(d_ppp); }; #log { source(s_src); filter(f_debug); destination(d_debug); }; #log { source(s_src); filter(f_error); destination(d_error); }; #log { source(s_src); filter(f_messages); destination(d_messages); }; #log { source(s_src); filter(f_console); destination(d_console_all); destination(d_xconsole); }; #log { source(s_src); filter(f_crit); destination(d_console); }; # All messages send to a remote site # #log { source(s_src); destination(d_net); }; ######FIJ###### log { source(s_mysource); filter(f_GEN); destination(d_GEN); }; log { source(s_mysource); filter(f_SU); destination(d_SU); }; log { source(s_mysource); filter(f_WAN); destination(d_WAN); }; log { source(s_mysource); filter(f_CPL); destination(d_CPL); }; ###############

4 8

syslog-ng with mongodb support in EPEL7
by Peter Czanik 01 Aug '14

01 Aug '14

Hi, syslog-ng with mongodb support was successfully built for EPEL7. It should be on the mirrors by the weekend. If you are really inpatient, you can download libmongo-client and the new build directly from the build system: libmongo-client: http://koji.fedoraproject.org/koji/buildinfo?buildID=549386 syslog-ng: http://koji.fedoraproject.org/koji/buildinfo?buildID=549647 Have a nice weekend! Bye -- Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

syslog-ng-3.5.5 bison: invalid argument `no-yacc' for `--warnings'
by Scot Needy 31 Jul '14

31 Jul '14

Sorry if this is a dupe. Looked through my mail archives and didn’t see any hits. Trying to compile syslog-ng on CentOS 6.5 final and make fails on bison arguments. [root(a)syslog-ng-3.5.5]# make YACC lib/rewrite/rewrite-expr-grammar.c bison: invalid argument `no-yacc' for `--warnings' Valid arguments are: - `none - no warnings' - `midrule-values - unset or unused midrule values' - `yacc - incompatibilities with POSIX YACC' - `all - all of the above' - `error - warnings are errors' YACC lib/rewrite/rewrite-expr-grammar.h …. ….. …. bison: invalid argument `no-yacc' for `--warnings' Valid arguments are: - `none - no warnings' - `midrule-values - unset or unused midrule values' - `yacc - incompatibilities with POSIX YACC' - `all - all of the above' - `error - warnings are errors' make --no-print-directory all-recursive CC lib/lib_libsyslog_ng_la-afinter.lo CC lib/lib_libsyslog_ng_la-apphook.lo YACC lib/block-ref-grammar.h bison: invalid argument `no-yacc' for `--warnings' Valid arguments are: - `none - no warnings' - `midrule-values - unset or unused midrule values' - `yacc - incompatibilities with POSIX YACC' - `all - all of the above' - `error - warnings are errors' CC lib/lib_libsyslog_ng_la-block-ref-parser.lo lib/block-ref-parser.c:26:31: error: block-ref-grammar.h: No such file or directory lib/block-ref-parser.c:43: error: 'LL_CONTEXT_BLOCK_REF' undeclared here (not in a function) make[2]: *** [lib/lib_libsyslog_ng_la-block-ref-parser.lo] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 ============== ./configure output =================== configure: creating ./config.status config.status: creating librabbitmq.pc config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged config.status: executing depfiles commands config.status: executing libtool commands rabbitmq-c build options: Host: x86_64-unknown-linux-gnu Version: 0.2.0 64-bit: no Tools: no Documentation: no syslog-ng Open Source Edition 3.5.5 configured Compiler options: compiler : gcc -std=gnu99 compiler options : -g -O2 -Wall -pthread -pthread -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/usr/local/include/eventlog -I$(top_srcdir)/lib/ivykis/src/include -I$(top_builddir)/lib/ivykis/src/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : prefix : /usr/local linking mode : dynamic embedded crypto : no __thread keyword : yes Submodules: ivykis : internal libmongo-client : internal librabbitmq : internal Features: Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : yes spoof-source support : no tcp-wrapper support : no Linux capability support : no PCRE support : no Env wrapper support : no systemd support : no (unit dir: none) Modules: Module search path : /usr/local/lib/syslog-ng Sun STREAMS support (module): no SSL support (module) : yes SQL support (module) : no PACCT module (EXPERIMENTAL) : no MongoDB destination (module): yes JSON support (module) : yes SMTP support (module) : yes AMQP destination (module) : yes STOMP destination (module) : yes GEOIP support (module) : no Redis support (module) : no

3 4

Problem with mongodb
by DeeKaeOne 31 Jul '14

31 Jul '14

Hi, I have a fresh CentOS 7 minimal installation and enabled the EPEL 7 repo. Then installed syslog-ng and syslog-dbi in the following versions: Installed Packages Name : syslog-ng Arch : x86_64 Version : 3.5.5 Release : 1.el7 Size : 1.6 M Repo : installed >From repo : epel Summary : Next-generation syslog server URL : http://www.balabit.com/network-security/syslog-ng Installed Packages Name : syslog-ng-libdbi Arch : x86_64 Version : 3.5.5 Release : 1.el7 Size : 61 k Repo : installed >From repo : epel Summary : libdbi support for syslog-ng URL : http://www.balabit.com/network-security/syslog-ng All documentations say that this version should support mongodb, but after some debugging I found this output while failing to start syslog-ng: Adding include file; filename='/etc/syslog-ng/conf.d/mongodb.conf' Starting to read include file; filename='/etc/syslog-ng/conf.d/mongodb.conf', depth='1' Error parsing destination, destination plugin mongodb not found in /etc/syslog-ng/conf.d/mongodb.conf at line 2, column 5: included from /etc/syslog-ng/syslog-ng.conf line 68, column 1 mongodb( ^^^^^^^ Where my /etc/syslog-ng/conf.d/mongodb.conf looks like this: destination d_mongodb { mongodb(); }; log { source(s_sys); destination(d_mongodb); }; Am I missing something or is that rpm compiled without mongodb support? Glad about any ideas! Cheers, Dennis --

2 3

Can you have multiple non-standard TCP ports as sources
by Smith, Jerry Don II 30 Jul '14

30 Jul '14

Good Afternoon, I am trying to setup a syslog-ng aggregation server and I can currently get it to listen on standard 601/514 ports. source remote { udp(ip(0.0.0.0)); tcp(ip(0.0.0.0) port(601) max-connections(200)); }; and source remote_2 { tcp(ip(0.0.0.0) port(514) max-connections(200)); }; [root@ms30snllx opt]# netstat -pan |grep syslog tcp 0 0 0.0.0.0:601 0.0.0.0:* LISTEN 22113/syslog-ng tcp 0 0 0.0.0.0:514 0.0.0.0:* LISTEN 22113/syslog-ng udp 3328 0 0.0.0.0:514 0.0.0.0:* 22113/syslog-ng But when I add a new source and have it listen on 1514 for example: source remote_3 { tcp(ip(0.0.0.0) port(1514) max-connections(200)); }; I don't get a listener on 1514 as well when looking via netstat . Is there something I am missing? Thanks in advance,

2 2

syslog-ng 3.6.0alpha1 has been released
by devel＠balabit.hu 30 Jul '14

30 Jul '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.6.0alpha1 SUMMARY : new alpha release DATE : Jul 30, 2014 ------------------------------------------------------------------------------ DESCRIPTION: The first alpha version of syslog-ng Open Source Edition (3.6.0alpha1) has been released. This being an alpha release, testing is most welcome, but production use is not recommended! CHANGES: 3.6.0alpha1 Wed, 30 Jul 2014 15:40:42 +0200 This is the first alpha release of the upcoming syslog-ng OSE 3.6 branch, a result of about seven months of work, by more than a dozen contributors, touching 379 files, and changing over twenty thousand lines. Compared to the latest stable release (3.5.5), this alpha release contains the following noteworthy changes: New dependencies ---------------- PCRE is now a required dependency of syslog-ng, and is not optional anymore. Features -------- ### New options * A new `custom-domain()` global setting was introduced, which allows the administrator to override the local domain name used by syslog-ng. It affects all locally generated log messages. * Added a `use-rcptid()` global option, that tells syslog-ng to assign a reception ID to each message received and generated by syslog-ng. This ID is available as the `$RCPTID` macro, and is unique on a given host. The counter wraps around at 48 bits and is never zero. ### New drivers * The `pseudofile()` destination driver is a very simple driver, aimed at delivering messages to special files in `/proc` or `/dev`. It opens and closes the file on each message, instead of keeping it open. It does not support templates in the filename, and does not have a queue (and as such, is not adequate in high traffic situations). * The new `nodejs()` source driver (implemented as an SCL macro) adds a source driver that allows syslog-ng to accept messages from node.js applications that use the `winston` logging API. ### Miscellaneous new features * The `multi-line-mode()` option gained a new setting: `prefix-suffix`, which works similarly to the `prefix-garbage` (which is the new name for `regexp`), except it appends the garbage part to the message, instead of discarding it. This new mode can be used to work around the absence of a timeout. * Filters default to PCRE matching, instead of the previous POSIX regexp default. ### Statistics * The stats counter for PROGRAM counters now includes the timestamp of the last update. * A new `stats-lifetime()` global option was introduced, which controls how often dynamic counters are expired. The timer is not exact, some timers may live a little bit longer than the specified time. * Dynamic counters are now cleaned up every `stats-lifetime()` minutes (defaulting to 10 minutes) instead of only on reloads. This change was done to reduce the memory used by dynamic counters. * There is now an `internal_queue_length` statistic, which shows the length of the internal queue. This is most useful to see if the `internal()` source is not connected, or if it is not being emptied fast enough (which, again, indicates a more serious error). ### MongoDB * The `mongodb()` driver now supports authentication, even when using replica sets. When re-connecting to another member of the set, the driver will automatically re-authenticate. * The `--with-libmongo-client` option of the configure script now supports `auto` as a value, and will then detect whether to use the system version of the library or the internal copy. We default to `auto` now, which prefers the system library over the internal copy. * The driver does not automatically add an `_id` field to the message: the server will do that automatically, if none is present. This allows users to override the field from within their syslog-ng config. * A new `retries()` option can be used to tell the driver how many times it should try to insert a message into the database before giving up (defaults to 3). This fixes the case where a rogue message could hold up the entire queue, as it was retried forever. * The driver now enables `safe-mode()` by default. * There is now a one-minute timeout for MongoDB operations. If an operation times out, it will be considered failed. * The driver can now connect to MongoDB via UNIX domain sockets. * The `double()` type hint is now supported by the driver. ### Unix Domain Sockets * The `unix-dgram()` and `unix-stream()` sources now extract UNIX credentials (PID, UID and GID of the sending application) from the passed messages, if any. On Linux, and FreeBSD, the path of the executable belonging to PID is extracted too, along with command-line arguments. The extracted values are available in `${.unix.pid}`, `${.unix.uid}`, `${.unix.gid}`, `${.unix.exe}` and `${.unix.cmdline}`, respectively. * The `system()` source will overwrite the PID macro with the value of `${.unix.pid}`, if present. ### JSON * The json-parser gained an `extract-prefix()` option, which can be used to tell the parser to only extract JSON members from a specific subtree of the incoming object. Example: `json-parser(extract-prefix("foo.bar[5]"));` Assuming that the incoming object is named msg, this is equivalent to the following javascript code: `msg.foo.bar[5]` The resulting expression must be a JSON object, so that syslog-ng can extract its members into LogMessage name-value pairs. This also works when the top-level object is an array, as `extract-prefix()` allows the use of an array index at the first indirection level, for example: `json-parser(extract-prefix("[5]"));`, which translates to `msg[5]`. * The `$(format-json)` template function now handles the `double()` type hint. ### Debugging * When sending messages to stderr in debug mode, prepend a timestamp to the messages. * The new `$RUNID` macro is available for templates, which changes its value every time syslog-ng is restarted, but not when reloaded. * A Valgrind suppression file was added (available under `contrib/valgrind/`), to aid in debugging memory leaks in syslog-ng. It supresses a couple of known false positives, and a few other things in third-party libraries. * A new utility, `system-expand`, was added, which returns what the `system()` source would expand to. Bugfixes -------- * With the MongoDB destination, successfully inserted messages are not counted as "stored" anymore: stored messages are those that are in a memory or disk buffer. * In the MongoDB destination, reconnecting in a replica-set environment now works correctly, and reliably. * The reliability of the `usertty()` destination driver was greatly improved. Previously, some parts of it were not thread-safe, which could result in strange behaviour. * The handling of escape related flags of `csvparser()` was changed: instead of these flags overwriting all other (even non-escape related) flags, if the flag to set is an escape-flag, it will keep all non-escape flags, and set the new one. If it is a not such a flag, then it will clear all flags, and set the previous escape flags, and the new flag. This, in essence, means that when setting flags on a `csvparser()`, if it is an escape flag, only escape flags will be affected. If not, then escape flags will not be affected at all. * The SQL destination now correctly continues $SEQNUM counting after a reload, instead of starting afresh. * When tring to stop syslog-ng while a reload is in progress, syslog-ng will now correctly shut down cleanly. * When the local hostname is not an FQDN, and the local resolver fails to return an FQDN too, syslog-ng does not abort anymore, but continues using a non-FQDN hostname after emitting a warning on the internal source. Furthermore, syslog-ng will try to resolve the FQDN harder: when multiple names are returned, it will search for the first FQDN one, instead of stopping at the primary name. * The `update-patterndb` script will now work correctly when the current working directory contains .pdb files. * We will now correctly handle time going backwards in patterndb: it will realign its idea of current time with the system. This corrects a bug where timeouts did not function properly when system time was set backwards. * The Linux capability support is now correctly auto-detected by the configure script, and defaults to off on FreeBSD 9+, as it should. * Various memory leak fixes around the code base. Developer notes --------------- The code base went through a lot of refactoring, too many to list in a simple NEWS file. Groundwork has been laid out for future features which are yet to hit the 3.6 branch. Credits ------- syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Andres Tamayo, Balazs Scheidler, Csaba Karsai, Daniel Gados, Evan Rempel, Fabien Wernli, Gergely Nagy, Igor Ippolitov, Imre Lazar, Jakub Wilk, Laszlo Budai, Lucas McLane, Martin Bagge, Matyas Koszik, Nick Alcock, Otto Berger, Peter Czanik, Peter Gyongyosi, Sebastien Badia, Sebastiaan Hoogeveen, Tamas Pal, Tibor Benke, Tobias Schwab, Viktor Juhasz, Viktor Tusa, Xufeng Zhang DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.6.0a… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

syslog driver parse bug?
by John Cole 25 Jul '14

25 Jul '14

Apologies if I missed a bugfix in my web searching and manually scanning the changelogs. I'm running syslog-ng (syslog-ng-3.2.5-3.el6.x86_64) on EL6 with the syslog driver as my network source: source s_network { syslog(ip(0.0.0.0) transport("udp") port(514)); syslog(ip(0.0.0.0) transport("tcp") port(514)); }; I have an application that does not have an internal synchronized clock source. Per RFC5424, "A syslog application MUST use the NILVALUE as TIMESTAMP if the syslog application is incapable of obtaining system time." And, the grammar shows TIMESTAMP = NILVALUE / FULL-DATE "T" FULL-TIME When I specify the "-" NILVALUE in the syslog message, the syslog driver does not seem to be able to parse the message and does not log anything. If I hardcode a time value, all message fields seem to post appropriately. Is this a new issue, or did I miss a version that addressed the handling of NILVALUE? Given RedHat lagging on versions, and Fedora's subsequent changes, I haven't yet begun the effort of retrofitting the RPM source in RAWHIDE to test, with the hope that someone might recognize the bug, or have a pointer to a EL6 SRPM so I can test against latest... Thanks for any/all pointers for a quick resolution! John

3 7

syslog-ng is now available in EPEL7
by Peter Czanik 23 Jul '14

23 Jul '14

Hi, syslog-ng 3.5.5 just arrived to EPEL7: https://czanik.blogs.balabit.com/2014/07/epel-7-now-contains-syslog-ng/ As far as I can see, not all mirrors carry it yet... Bye, -- Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

compiling problems --enable-mongodb --enable-json --enable-redis
by jrhendri＠roadrunner.com 22 Jul '14

22 Jul '14

Hi, I am trying to get syslog-ng to be the front-end for a larger log collection architecture including mongodb, redis, elasticsearch, possibly logstash & kibana. Have been trying to build syslog-ng with the necessary modules and failing miserably. I know it must be me - that said, I have spent several hours trying to get this to compile on both RHEL 5 and Ubuntu 14.04 I ran into a few things that might be useful (or not), but since the platforms and libraries installed are different, yet the end error is the same I thought I would ask for other eyes / brains to help here... Thanks for any assistance! Jim RHEL 5: I have installed json-c & redis-stable which provides these libraries: ./redis-stable/deps/hiredis/hiredis.h ./redis-stable/deps/hiredis/libhiredis.a and created links here to try and get around issues: /usr/lib/hiredis /usr/lib/hiredis/libhiredis.a /usr/include/hiredis /usr/include/hiredis/hiredis.h configure succeeds with this: Modules: Module search path : /usr/local/lib/syslog-ng Sun STREAMS support (module): no SSL support (module) : no SQL support (module) : no PACCT module (EXPERIMENTAL) : no MongoDB destination (module): yes JSON support (module) : yes SMTP support (module) : no AMQP destination (module) : yes STOMP destination (module) : yes GEOIP support (module) : no Redis support (module) : yes Make fails here: CC modules/redis/modules_redis_libredis_la-redis-grammar.lo CC modules/redis/modules_redis_libredis_la-redis.lo CC modules/redis/modules_redis_libredis_la-redis-parser.lo CCLD modules/redis/libredis.la /usr/bin/ld: cannot find -lhiredis collect2: ld returned 1 exit status make[2]: *** [modules/redis/libredis.la] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 [n0142566@VDDP13E-F1A47ED syslog-ng-3.5.4.1]$ Ubuntu: I have installed json-c, redis-stable & libredis: /usr/local/lib/libredis.so.1.0.0 /usr/local/lib/libredis.1 /usr/local/lib/libredis.la /usr/local/include/redis.h configure succeeds with this: Modules: Module search path : /usr/local/lib/syslog-ng Sun STREAMS support (module): no SSL support (module) : yes SQL support (module) : no PACCT module (EXPERIMENTAL) : no MongoDB destination (module): yes JSON support (module) : yes SMTP support (module) : no AMQP destination (module) : yes STOMP destination (module) : yes GEOIP support (module) : no Redis support (module) : yes Make fails with: CC modules/redis/modules_redis_libredis_la-redis-grammar.lo CC modules/redis/modules_redis_libredis_la-redis.lo CC modules/redis/modules_redis_libredis_la-redis-parser.lo CCLD modules/redis/libredis.la /usr/bin/ld: cannot find -lhiredis collect2: ld returned 1 exit status make[2]: *** [modules/redis/libredis.la] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 [n0142566@picard:~/src/syslog-ng-3.5.5$ ===========================================

3 6

Syslog-ng using an old Template
by Anwar El fatayri 22 Jul '14

22 Jul '14

Hey, I was using this template for my tests : template t_lyraJBossFormat { template("${DATE} ${FULLHOST} jboss_vad - ------------ - SD : ${SDATA} - ------------ - MSG : ${MSGONLY}\n"); template_escape(no);}; This template is a Format that I use for JBoss Logs. The syslog packet (IETF) is created and then sent to syslog-ng via a named pipe. After Debugging all the problems, the following template was created to be used for all Jboss Logs : template t_lyraJBossFormat { template("${DATE} ${FULLHOST} jboss_vad - ${SDATA} - ${MSGONLY}\n"); template_escape(no);}; The problem is that syslog-ng is still using the old template. (I restarted the syslog-ng service of course) Any ideas ? Thanks in advance. El Fatayri Anwar

3 3

redis/tcp destination throughput and dropped messages
by Nicholas Radonicich 21 Jul '14

21 Jul '14

Hello, hoping someone might be able to help... I am attempting to build a syslog server with outputs to Logstash/Elasticsearch via redis but am having issues with dropped messages in such that i cannot get over ~4000 messages per second out to a destination (TCP or redis) without the rest being dropped. I have tried various tuning on the tcp output with flush_lines() and threaded() to no avail, as well as some things on the inputs. Both redis and logstash (used for tcp inputs) were on the localhost. redis-benchmark has no issues doing >70000 LPUSH/second and the file based destinations of syslog-ng are not dropping messages (we are sending almost 80k/s) so I don’t know where I am going wrong. loggen was accepting > 110000mps its just on the outputs it seems. Thanks, Nick The information in this message, including in all attachments, is confidential or privileged. In the event you have received this message in error and are not the intended recipient, you are hereby advised that any use, copying or reproduction of this document is strictly forbidden. Please notify immediately the sender of this error and destroy this message, including its attachments, as the case may be. L'information apparaissant dans ce message électronique et dans les documents qui y sont joints est de nature confidentielle ou privilégiée. Si ce message vous est parvenu par erreur et que vous n'en êtes pas le destinataire visé, vous êtes par les présentes avisé que toute utilisation, copie ou distribution de ce message est strictement interdite. Vous êtes donc prié d’en informer immédiatement l’expéditeur et de détruire ce message, ainsi que les documents qui y sont joints, le cas échéant. Ce courriel provient de Nicholas.Radonicich(a)cogeco.com . Pour assurer la livraison de futurs envois, veuillez inclure la présente adresse courriel à votre carnet d’adresses ou votre liste d’expéditeurs autorisés. Si vous ne souhaitez plus recevoir de messages promotionnels de la part de Cogeco, veuillez envoyer un courriel à desabonnement(a)cogeco.com<mailto:desabonnement@cogeco.com?Subject=Unsubscribe%20to%20mail%20from%20Nicholas.Radonicich@cogeco.com>. Politique en matière de protection des renseignements personnels de Cogeco et Engagement en matière d’anti-spam<http://www.cogeco.ca/cable/entreprise/cca/vie_privee.html> – Contactez-nous<http://www.cogeco.ca/web/qc/fr/residentiel/soutien/contact_telephone.php> Cogeco Câble Canada, 5 Place Ville-Marie, Bureau 1700, Montréal, Québec, H3B 0B3 -- This email is from Nicholas.Radonicich(a)cogeco.com . To ensure the delivery of future emails, please add the current email address to your address book or safe senders list. If you no longer wish to receive promotional emails from Cogeco, please send an email to unsubscribe(a)cogeco.com<mailto:unsubscribe@cogeco.com?Subject=Unsubscribe%20to%20mail%20from%20Nicholas.Radonicich@cogeco.com>. Privacy Policy and Anti-spam Commitment<http://www.cogeco.ca/cable/corporate/cgo/privacy.html> - Contact us<http://www.cogeco.ca/web/on/en/residential/support/contact_phone.php> Cogeco Cable Canada, 5 Place Ville-Marie, Suite 1700, Montreal, Quebec, H3B 0B3

2 2

syslog-ng 3.5.5 has been released
by devel＠balabit.hu 21 Jul '14

21 Jul '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.5.5 SUMMARY : new stable release DATE : Jul 21, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.5.5) has been released. For latest fixes in the 3.5.x feature branch you are recommended to upgrade to this version. CHANGES: 3.5.5 Mon, 21 Jul 2014 17:00:00 +0200 This is the fifth bug-fix release for the 3.5.x series. Starting with this release, the 3.5 branch replaces 3.4 as the current "stable" version. Upgrading from earlier versions - and especially earlier branches - is highly recommended. New features ============ * The facility() filter now supports ranges, allowing one to capture a range of facilities: facility(local0..local6). * The $(format-json) template function now supports SEQNUM. * The upstart script in contrib has been improved to allow the user to override certain settings (such as the configuration file, and the pidfile), and allow extra options to be specified. Bugfixes ======== * Major memory leaks have been fixed in various parts of syslog-ng, including but not limited to network and file destinations and sources, value-pairs (thus affecting mongodb, $(format-json), and others), template handling and rewrite rules. Some of these leaks only happened during reload, some leaked on every message. They have now been plugged. * The value-pairs framework has seen a lot of updates, too: - It now honors time zone settings, so everything that uses value-pairs, will correctly take time zone settings into account. - Using globs in the key() option of value pairs will now also search macros for matches (thus key("D*") will match DATE too). - The syslog-proto (RFC5424) scope now correctly includes SDATA. - A bug that resulted in hierarchical elements being misparsed and made to appear in random places have been fixed. * The body() and subject() options of the SMTP destinations are now mandatory, and a double-free was also fixed in the driver. * Minor fixes were made to the $(env) template function, so that when looking up an empty environment variable, we will no longer trigger a glib warning. A misleading error message was also corrected. * The pdbtool patternize tool will now output version 4 PDB XML. * The configure script will not try to configure the AMQP module if no suitable version of python is installed. This avoids a difficult to diagnose error message during compilation. Developer news ============== * When compiled with internal ivykis, we will now install its headers too, along with our own. This is to make it easier for the Incubator to be compiled against a syslog-ng with embedded ivykis. * Plugin symbols are now loaded differently, in a way that lets plugins load further plugins, and use already loaded symbols. This is required for the various scripting destinations in the Incubator. * Starting with this release, we are installing the testing helpers as a convenience library (available under the syslog-ng-test pkg-config module). This allows third party projects to use our helpers. Credits ======= syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Balazs Scheidler <bazsi(a)balabit.hu> Daniel Gados Fabien Wernli Gergely Nagy <algernon(a)balabit.hu> Laszlo Budai <lbudai(a)balabit.hu> Laszlo Meszaros <lmesz(a)balabit.hu> Nick Alcock <nix(a)esperi.org.uk> Peter Czanik <czanik(a)balabit.hu> Peter Gyongyosi <gyp(a)balabit.hu> Sebastien Badia <seb(a)sebian.fr> Tibor Benke <tibor.benke(a)balabit.com> Viktor Juhasz <viktor.juhasz(a)balabit.com> Viktor Tusa <tusa(a)balabit.hu> Xufeng Zhang <xufeng.zhang(a)windriver.com> Zoltan Pallagi <pzolee(a)balabit.hu> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

(no subject)
by Radu Gheorghe 21 Jul '14

21 Jul '14

Hi, This is my first post here, so I have to start by thanking all the contributors for an awesome product :) My question is about adding an array to a JSON document. What I'm trying to do is to send a message like this: @cee: {"message": "test message", "tags":["test", "message"]} My template looks a like this: template("@cee: $(format-json --pair message=\"$MSG\" --pair tags="test")\n") This works fine for a single tag, but how can I add multiple ones? The broader use-case is that I want to add tags to logs matching a specific filter. For example: ---------------------- filter user_tests { facility(user) and message(test) }; destination logsene_tests { syslog("logsene-receiver-syslog.sematext.com" transport("tcp") port(514) template("@cee: $(format-json --pair message=\"$MSG\" --pair tags=\"test\")\n") ); }; log { source(all_syslog); filter(user_tests); destination(logsene_tests); flags(final); }; ---------------------- If there's a better way to add multiple tags to a log, please tell me - I'm good with making big changes if it leads to a cleaner/better config. Best regards, Radu -- Performance Monitoring * Log Analytics * Search Analytics Solr & Elasticsearch Support * http://sematext.com/

3 7

syslog-ng 2.1.4 - file sources are read only when reload or restart is performed?
by Rafał Radecki 18 Jul '14

18 Jul '14

Hi All ;) I am using a virtual machine with: Red Hat Enterprise Linux Server release 5.7 (Tikanga) Linux logserver01 2.6.18-274.el5 #1 SMP Fri Jul 8 17:36:59 EDT 2011 x86_64 x86_64 x86_64 GNU/Linux syslog-ng 2.1.4 I have following configuration: ... 9 options { 10 create_dirs (yes); 11 dir_group (root); 12 dir_owner (root); 13 dir_perm (0700); 14 group (root); 15 owner (root); 16 perm (0600); 17 flush_lines(1); 18 flush_timeout (1000); 19 keep_hostname (yes); 20 log_fifo_size (1); 21 use_dns (no); 22 use_fqdn (no); 23 }; ... 39 source s_stdout { 40 # file ("/logs/stdout.log" flags(no-parse) follow_freq(1)); 41 file ("/logs/stdout.log" flags(no-parse)); 42 }; ... 61 destination d_stdout { file("/var/log/$YEAR$MONTH$DAY/stdout"); }; ... 80 log { source(s_stdout); destination(d_stdout); }; The problem is that changes in /logs/stdout.log are only visible in /var/log/20140717/stdout when I perform /etc/init.d/syslog-ng reload or restart. I tried several settings of flush_*, log_fifo_size and follow_freq but with no luck :D Is it a problem withe the version that I use (quite old :D ) or is there a mistake in my configuration maybe? BR, Rafal.

3 3

Logs sent to wrong destination
by Renato Bezerra 18 Jul '14

18 Jul '14

Hi, I'm using syslog-ng in a long time, but recently i noted that, in some cases, the log has sent to a wrong destination. I have many devices sending logs to my host, the problem appears when the server receive webservers logs, they are delivered to a different destination and I don't known how. here is the configuration: destination apache { file("/var/log/webserver/$R_YEAR-$R_MONTH-$R_DAY-$R_HOUR" owner(ll) group(ll) perm(0644) dir_perm(0755) create_dirs(yes)); }; filter f_apache { ( host("xxx.xxx.xxx.82") or host("xxx.xxx.xxx.137") ); }; log { source(aaa); filter(f_apache); destination(apache); }; The ip address xxx.xxx.xxx.137 send a duplicate log event to another directory, without any other configuration. Have you seen this?

3 4

Apache Kafka output module
by Pierre-Yves Ritschard 11 Jul '14

11 Jul '14

Hi list, I submitted a PR for an Apache Kafka [1] output module. This is my first syslog-ng module, so it might need a bit of guidance. This provides the ability to create a partitioned stream of logs based on a message field or static key. A typical destination configuration will look like: destination d_kafka { kafka( properties(metadata.broker.list("localhost:9092")) topic("syslog") payload("$(format-json --scope all-nv-pairs --scope core)") partition("static-key") # partition(random) # partition(field("$PROGRAM")) ); }; For reference, this allows us to work on logs locally with syslog, extract fields, then publish on a queue whose consumers will index logs in our data stores. [1]. http://kafka.apache.org

2 1

patterndb and context - access fields from initial message
by Atom2 11 Jul '14

11 Jul '14

Hi guys, I did have a conversation today on IRC with algernon (again many thanks to him) about the problem I am faced with and we agreed that I should send my question to the list. My aim is to consolidate a bunch of related syslog messages into a single message once the final message has come in (or a timeout has occured for whatever reason). To do this I use patterndb together with a defined context linking related messages to the context. Unfortunately the length of the context (i.e. the number of messages within the context) is unknown from the outset. Basically it (mainly) depends on how long the context is active for - which can be any time and is completely unforseeable. Now my problem is as follows: From the initial message I parse (using patterndb) certain fields into a number of named MACROS. This is all solved and works very well. When the final message comes in (or in case a timeout occurs) I would like to trigger an action (triggered by match or timeout respectively) to generate and subsequently inject a message about the full context using certain fields, mainly from the final message, but also including a number of fields from the inital message of the context. Generally a field is available using the syntax ${MACRO}@# where @# denotes a reference to a previous message within the same context - so ${MACRO}@5 would use the value of MACRO from a message with a distance of 5 from the curren message (where the distance of the current message to itself is 1 - so @5 references the 4th previous message). That also works very well but obviously requires that one knows which message to refer to using the distance value. The problem comes when the context-length is unknown and thus the distance of the initial message to the final message is not a fixed, pre-determined number but rather varies. Although there seems to be a variable/macro indicating/storing the context-length which (according to the manual) can be accessed by $(context-length) [NOTE: the paranthesis instead of the curly braces] the combination of the two does not seem to work out: I was expecting that ${MACRO}@$(context-length) would provide me with the required information - that is: the value of the parsed field from the initial message - but my construct unfortunately fails. Is there anything I am doing wrong here (i.e. is there any quoting/esacping required for certain characters), is my thought process flawed or does this not work/is it a bug. In case it does not work, how would I be able to achieve my goal. Many thanks and best regards, Atom2 P.S. The version of syslog-ng I am using is 3.4.7, compiled from sources, using the latest stable gentoo ebuild.

4 6

Syslog-ng completely unusable after upgrade
by James Lay 10 Jul '14

10 Jul '14

Well shoot...here's what I got...I'm using the stock syslog-ng.conf installed with 3.5.4.1 just for testing: ############################################################################# # Default syslog-ng.conf file which collects all local logs into a # single file called /var/log/messages. # @version: 3.3 @include "scl.conf" source s_local { system(); internal(); }; source s_network { udp(); }; destination d_local { file("/var/log/messages"); }; log { source(s_local); # uncomment this line to open port 514 to receive messages #source(s_network); destination(d_local); }; Running strace here's the last bit: /usr/sbin/syslog-ng -t -d -v -F -f /usr/etc/syslog-ng.conf open("/usr/lib/libsyslog-ng-3.3.11.so", O_RDONLY) = 10 read(10, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0@0\1\000"..., 512) = 512 fstat64(10, {st_mode=S_IFREG|0755, st_size=1427313, ...}) = 0 mmap2(NULL, 447784, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 10, 0) = 0xb79d7000 mmap2(0xb7a40000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 10, 0x68) = 0xb7a40000 mmap2(0xb7a44000, 1320, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7a44000 close(10) = 0 write(2, "iv_tls_user_register: called aft"..., 43iv_tls_user_register: called after iv_init ) = 43 rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0 tgkill(5172, 5172, SIGABRT) = 0 --- SIGABRT (Aborted) @ 0 (0) --- +++ killed by SIGABRT +++ Process 5172 detached And that's it....I'm glad I'm doing this on a virtual machine. I've not been able to anything on this online...thoughts or help are appreciated. James

2 2

Configure option --disable-json doesn't seem to function
by James Lay 10 Jul '14

10 Jul '14

Topic says it: syslog-ng-3.5.4.1 ./configure --prefix=/usr --enable-dynamic-linking --disable-ipv6 --enable-spoof-source --disable-json checking python module: json... no configure: error: failed to find required module json configure: error: ./configure.gnu failed for modules/afamqp/rabbitmq-c It appears to still be looking. Thank you. James

2 9

syslog problem
by Riyas Ahamed 09 Jul '14

09 Jul '14

Hi, I have configured syslog-ng but I cannot able to see logs of network devices in syslog-ng server. Please help me to sort-out the problem. Regards, N.B.Riaz Ahmed http://www.csscorp.com/common/email-disclaimer.php

4 4

Recommended version
by James Lay 08 Jul '14

08 Jul '14

All, As I'm working with it here, what's the recommended version folks are running? Currently I'm on 3.3.11, and I figure I might as well upgrade..thanks for any pointers/tips. James

2 3

[Bug 280] New: Memory leak in value-pairs.c
by bugzilla＠bugzilla.balabit.com 08 Jul '14

08 Jul '14

https://bugzilla.balabit.com/show_bug.cgi?id=280 Summary: Memory leak in value-pairs.c Product: syslog-ng Version: 3.5.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sgounaro(a)optonline.net Type of the Report: bug Estimated Hours: 0.0 Hi , it looks like vp_walker_name_value_split_add_name_token has a memory leak in g_strndup call. Running syslog-ng with a lot of messages coming in about ~800 per sec , starts with 139m of memory and ends up with 9gig of memory in a day being used. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

Properly forwarding syslog messages
by James Lay 07 Jul '14

07 Jul '14

Hey all, So I've looked around and I'm just not sure what the best method is for forwarding syslog messages. I have a current setup that is working well. I'd like to try and get all the messages forward to another machine using standard udp 514. I'd like the messages to appear as if they are coming from the originating machine, not the syslog server. I did see a couple sites that say I have to compile with spoofing. Can anyone point me to some resources to do this? Thank you. James

2 3

Optional Parser Type Match
by Michael Starks 07 Jul '14

07 Jul '14

Can a parser type be made to optionally match? For example, given the message of 'DROP IN=vlan2 OUT= MAC=48:5b:39:e8:44:c5:00:1d:5a:1c:37:b9:08:00:45:00:00:28 SRC=1.2.3.4 DST=172.16.0.1 LEN=40 TOS=0x00 PREC=0x00 TTL=45 ID=61318 PROTO=TCP SPT=443 DPT=45872 SEQ=1548679084 ACK=0 WINDOW=0 RES=0x00 RST URGP' OUT= may or may not be defined. I would like to match it if it exists with a parser and maybe just set it to nul if it doesn't exist. Similarly, in this message: 'DROP IN=vlan2 OUT= MAC=48:5b:39:e8:44:c5:00:1d:5a:1c:37:b9:08:00:45:00:00:28 SRC=1.2.3.4 DST=172.16.0.2 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=3265 DF PROTO=TCP SPT=443 DPT=44616 SEQ=880418731 ACK=0 WINDOW=0 RES=0x00 RST UR' the DF field sometimes exists and sometimes doesn't. Whenever I define something like 'DROP IN=@ESTRING:s1: @OUT=@ESTRING:s0: @' the OUT= string doesn't match if there is no value.

2 2

No PatternDB Matches
by Michael Starks 02 Jul '14

02 Jul '14

x-posted from ELSA mailing list; no replies there so please excuse the noise. I am trying to add an additional ASA log message that is unclassified in ELSA. To make a long story short, *nothing" seems to be matching with pdbtool. Here is the line I am trying to work with: Jun 23 00:00:05 192.168.1.4 %ASA-3-106100: access-list INOUT denied tcp inside/1.2.3.4(64576) -> outside/5.6.7.8(80) hit-cnt 1 first hit [0x59bca63e, 0x620e5b55] Putting that aside for the moment since I can't get it to work, I went straight to the syslog-ng docs (https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.4-gui…) and used the example. I created /etc/elsa/patterns.d/test.xml with this content: <patterndb version='4' pub_date='2010-10-17'> <ruleset name='ssh' id='123456678'> <pattern>ssh</pattern> <rules> <rule provider='me' id='182437592347598' class='system'> <patterns> <pattern>Accepted @QSTRING:SSH.AUTH_METHOD: @ for@QSTRING:SSH_USERNAME: @from\ @QSTRING:SSH_CLIENT_ADDRESS: @port @NUMBER:SSH_PORT_NUMBER:@ ssh2</pattern> </patterns> </rule> </rules> </ruleset> </patterndb> I then tested with this line: /usr/local/syslog-ng/bin/pdbtool match -p /etc/elsa/patterns.d/test.xml -M "Accepted password for sampleuser from 10.50.0.247 port 42156 ssh2" The result is this: MESSAGE=Accepted password for sampleuser from 10.50.0.247 port 42156 ssh2 .classifier.class=unknown Details are: [root@hostname elsa]# /usr/local/syslog-ng-3.2.4/sbin/syslog-ng -V syslog-ng 3.2.4 Installer-Version: 3.2.4 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#ef7b91e4a1b1f9628c66138b4ae83de7e4c697c6 Compile-Date: May 23 2012 09:58:14 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: on Enable-Pcre: on Enable-Pacct: off [root@hostname elsa]# cat /etc/redhat-release Oracle Linux Server release 6.5 Thank you in advance.

2 3