- syslog-ng - lists.balabit.hu

syslog-ng 3.4.7 has been released
by devel＠balabit.hu 24 Dec '13

24 Dec '13

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.4.7 SUMMARY : new stable release DATE : Dec 24, 2013 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.4.7) has been released. For latest fixes in the 3.4.x feature branch you are recommended to upgrade to this version. CHANGES: 3.4.7 Tue, 24 Dec 2013 21:07:34 +0100 This is the sixth bug-fix release for the 3.4.x series, with a number of important fixes over the 3.4.6 release. Upgrading to this release is highly recommended. Bugfixes ======== * Node flag propagation has been fixed, so flags(final) works the same as it did in 3.3, when embedded log statements are used too. * Using the value-pairs() framework, either via the $(format-json) template function or any of the destinations that make use of it, will now correctly skip and ignore empty values, even in SDATA. * A file descriptor and memory leak has been fixed in the syslog() destination. * The pdbtool program will warn in test mode when a test message has no program attribute. [BugZilla #263] * If the PID property is overwritten, syslog-ng will now stop using the cached MSGHDR value, and therefore, use the newly set PID instead, as it was supposed to. * The localport() option of various network destinations has been restored, and will work correctly now. [BugZilla #266] * The upstart service file in contrib has been updated to use a different process mode (background), as we do not need a supervisor when running under upstart. This also means that upstart will be far less confused. Credits ======= syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Andras Mitzki <micek(a)balabit.hu> Balazs Scheidler <bazsi(a)balabit.hu> Chris Johnson <chris.johnson3(a)hp.com> Fabien Wernli <cpan(a)faxm0dem.org> Gergely Nagy <algernon(a)balabit.hu> Lucas McLane <lucas(a)clicksecurity.com> Peter Czanik <czanik(a)balabit.hu> Sebastiaan Hoogeveen <zebaz(a)xs4all.nl> Tobias Schwab <tobias.schwab(a)dynport.de> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

[Bug 265] New: syslog-ng does not output the $PID of the process, even when forced
by bugzilla＠bugzilla.balabit.com 23 Dec '13

23 Dec '13

https://bugzilla.balabit.com/show_bug.cgi?id=265 Summary: syslog-ng does not output the $PID of the process, even when forced Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: support(a)sikkerhed.org Type of the Report: --- Estimated Hours: 0.0 I'm researching syslog-ng, in order to set it up on all my machines, and have them log to a central server on the network. Things are going great, except I can't seem to force syslog-ng to report the $PID of the program that logs, so sometimes I get lines that have missing $PIDS: (anonymized, but based on real log line) 2013-12-05T19:40:44.388099+01:00 web15.example.org pop3d: Connection, ip=[::ffff:x.y.z.w] Whereas I was able to change pureftpd to log with pid: 2013-12-05T19:40:44.639127+01:00 web15.example.org pure-ftpd[872804]: (?(a)x.y.z.w) [INFO] New connection from x.y.z.w Unfortunately, courier-imap does not have such a logging option. I thought that using $PID in the output template would force syslog-ng to log the PID of the reporting process, but this does not seem to be the case. Is it really true that there is no way to force syslog-ng to report the PID? I know that rsyslog has this feature, but I would much rather use syslog-ng :) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 6

[Bug 186] New: resettable stats
by bugzilla＠bugzilla.balabit.com 21 Dec '13

21 Dec '13

https://bugzilla.balabit.com/show_bug.cgi?id=186 Summary: resettable stats Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: szaki(a)balabit.hu Type of the Report: --- Estimated Hours: 0.0 According to https://lists.balabit.hu/pipermail/syslog-ng/2011-October/017457.html It would be a good idea to be able to reset the statistic, when needed, without full restart, or any magic like altering the config a bit and reload. So I suggest the enable_stats_reset(yes) default option, for sources and destinations (everywhere are statcounters defined), and the syslog-ng-ctl reset-stats command - to reset the statistic where the enable_stats_reset(yes) option allows this. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

[Bug 262] New: patterndb: Computed <values> are not expanded in context-id
by bugzilla＠bugzilla.balabit.com 20 Dec '13

20 Dec '13

https://bugzilla.balabit.com/show_bug.cgi?id=262 Summary: patterndb: Computed <values> are not expanded in context-id Product: syslog-ng Version: 3.5.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.balabit(a)faxm0dem.org Type of the Report: --- Estimated Hours: 0.0 Created an attachment (id=87) --> (https://bugzilla.balabit.com/attachment.cgi?id=87) patterndb ruleset It seems the values are not being expanded as expected in the context-id: -- pdbtool test /tmp/test.pdb -vd Module loaded and initialized successfully; module='syslogformat' Module loaded and initialized successfully; module='basicfuncs' Testing message program='' message='the big "brown" fox' patterndb rule matches; rule_id='A' Advancing patterndb current time because of an incoming message; utc='-1' Correllation context lookup failure, starting a new context; rule='A', context='brown.', context_timeout='0', context_expiration='-1' Match name='.classifier.rule_id', value='A', expected='A' Match name='matched.var', value='brown', expected='brown' -- as you can see, context-id='brown.' instead of 'brown.brown' as expected by expanding '${matched.var}.${computed.var}' -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

[Bug 263] New: patterndb: missing "program" attribute in test_message silently ignored
by bugzilla＠bugzilla.balabit.com 20 Dec '13

20 Dec '13

https://bugzilla.balabit.com/show_bug.cgi?id=263 Summary: patterndb: missing "program" attribute in test_message silently ignored Product: syslog-ng Version: 3.5.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.balabit(a)faxm0dem.org Type of the Report: --- Estimated Hours: 0.0 Although the attached pdb validates, the test messages are not run, because "program" attribute is missing. There should be a warning, or something: -- pdbtool --validate test /tmp/test2.pdb -dv Module loaded and initialized successfully; module='syslogformat' Module loaded and initialized successfully; module='basicfuncs' /tmp/test2.pdb validates -- -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

[Bug 266] New: localport option does not bind to a specific port
by bugzilla＠bugzilla.balabit.com 20 Dec '13

20 Dec '13

https://bugzilla.balabit.com/show_bug.cgi?id=266 Summary: localport option does not bind to a specific port Product: syslog-ng Version: unspecified Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: zebaz(a)xs4all.nl Type of the Report: bug Estimated Hours: 0.0 The localport option to specify a source port when opening a TCP connection no longer seems to be working. For testing I used the following simplified configurations: @version: 3.5 source src { unix-stream("/dev/log" max-connections(256)); internal(); file("/proc/kmsg"); }; destination logcentral { tcp("logcentral" port(514) localport(1014)); }; log { source(src); destination(logcentral); }; When running syslog-ng -d the relevant output is: Syslog connection established; fd='8', server='AF_INET(<ip removed>:514)', local='AF_INET(0.0.0.0:0)' I tried some variations in the configuration: - source port > 1024 gives the same result - specifying the localip option binds the local socket explicitly to that IP address but still not to a specific port Behaviour has been checked to occur with versions 3.4.2 and 3.4.6 from Gentoo as well as 3.5.2 from the upstream site (compiled from source). Other installations with identical kernel versions run older syslog-ng installations (3.2.x and 3.3.x) with the same settings without a problem. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 11

Please help getting patterndb working.
by Nick 19 Dec '13

19 Dec '13

Hello, By following the documentation examples I think I have recreated a custom parser, but it doesn't work, please can you advise what I have missed? To create my patterndb I have used the example in link [1], to load it and output to a file I have kinda copied the example in link [2]. The issue I have is that my output file is mostly empty, it's like the variables are not being read properly. In case the files do not render properly , please see this gist -> https://gist.github.com/linickx/8002981 I have built a clean fedora 19 box which ships with syslog-ng-3.4.6-1. My /etc/syslog-ng/syslog-ng conf looks like: <PASTE> @version:3.2 # Default options copied from distribution options { flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); owner("nick"); group("nick"); perm(0640); }; source test_logfile { file("/home/nick/testfile.log"); }; parser test_pattern { db_parser( file("/home/nick/example.xml") ); }; destination test_output { file("/home/nick/output.log" template("${SSH_USERNAME}; ${SSH_CLIENT_ADDRESS}; \n") template_escape(no) ); }; log { source (test_logfile); parser(test_pattern); destination (test_output); }; </PASTE> The /home/nick/example.xml looks like <PASTE> <patterndb version='4' pub_date='2010-10-17'> <ruleset name='ssh' id='123456678'> <pattern>ssh</pattern> <rules> <rule provider='me' id='182437592347598' class='system'> <patterns> <pattern>Accepted @QSTRING:SSH.AUTH_METHOD: @ for@QSTRING:SSH_USERNAME: @from\ @QSTRING:SSH_CLIENT_ADDRESS: @port @NUMBER:SSH_PORT_NUMBER:@ ssh2</pattern> </patterns> <examples> <example> <test_message>Accepted password for sampleuser from 10.50.0.247 port 42156 ssh2</test_message> <test_values> <test_value name="SSH.AUTH_METHOD">password</test_value> <test_value name="SSH_USERNAME">sampleuser</test_value> <test_value name="SSH_CLIENT_ADDRESS">10.50.0.247</test_value> <test_value name="SSH_PORT_NUMBER">42156</test_value> </test_values> </example> </examples> </rule> </rules> </ruleset> </patterndb> </PASTE> For /home/nick/testfile.log I have used <PASTE> Accepted password for sampleuser from 10.50.0.247 port 42156 ssh2 Accepted password for user from 10.51.0.27 port 4256 ssh2 </PASTE> after starting syslog-ng I get the following in /home/nick/output.log PASTE ; ; ; ; </PASTE> Any pointers on what I'm doing wrong would be very much appreciated. This is a cross-post from http://communities.balabit.com/balabit/topics/please_help_me_get_patterndb_…, apologies if this offends, the balabit.com website is not clear on where the most active community can be found. Thanks in Advance, Nick [1] http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.3-guid… [2] http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.4-guid…

3 6

quote characters (or other specials) in patterens?
by Nick 19 Dec '13

19 Dec '13

Hello, How should I handle quote characters (or other specials) in patterens? (To help with redering the examples below can be found here: https://gist.github.com/linickx/8038784) This works and will validate as expected (working.xml)... <patterndb version='4' pub_date='2013-12-17'> <ruleset name='bluecoat' id='dd001'> <pattern>bluecoat</pattern> <rules> <rule provider='linickx' id='nbdd001' class='system'> <patterns> <pattern>@NUMBER:BC_HOUR:@:@NUMBER:BC_MIN:@:@NUMBER:BC_SEC:@ @NUMBER:BC_TIME_TAKEN:@ @IPv4:BC_CLIENT_ADDRESS:@ - - - @ESTRING:BC_ACTION: @</pattern> </patterns> <examples> <example> <test_message program="bluecoat">10:57:56 43 10.8.26.200 - - - OBSERVED "Web Ads/Analytics" http://googleads.g.doubleclick.net/mads/ 200 TCP_CLIENT_REFRESH GET image/png http pagead2.googlesyndication.com 80 / pagead/images/nessie_icon_chevron_white.png - png "Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; P76a(K3G5) Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 (Mobile; afma-sdk-a-v6.2.1)" 10.8.24.5 724 1277 -</t est_message> <test_values> <test_value name="BC_HOUR">10</test_value> <test_value name="BC_MIN">57</test_value> <test_value name="BC_SEC">56</test_value> <test_value name="BC_TIME_TAKEN">43</test_value> <test_value name="BC_CLIENT_ADDRESS">10.8.26.200</test_value> <test_value name="BC_ACTION">OBSERVED</test_value> </test_values> </example> </examples> </rule> </rules> </ruleset> </patterndb> Simply by updating <pattern> with a quote for my next match (broken1.xml) ... <pattern>@NUMBER:BC_HOUR:@:@NUMBER:BC_MIN:@:@NUMBER:BC_SEC:@ @NUMBER:BC_TIME_TAKEN:@ @IPv4:BC_CLIENT_ADDRESS:@ - - - @ESTRING:BC_ACTION: @ "</pattern> ... the whole thing bjorks (broken1_output.txt)... [nick@localhost ~]$ pdbtool test --validate nick.xml nick.xml validates Key contains '@' without escaping; key='@"', value='nbdd001' Testing message program='bluecoat' message='10:57:56 43 10.8.26.200 - - - OBSERVED "Web Ads/Analytics" http://googleads.g.doubleclick.net/mads/ 200 TCP_CLIENT_REFRESH GET image/png http pagead2.googlesyndication.com 80 /pagead/images/nessie_icon_chevron_white.png - png "Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; P76a(K3G5) Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 (Mobile; afma-sdk-a-v6.2.1)" 10.8.24.5 724 1277 -' Wrong match name='.classifier.rule_id', value='', expected='nbdd001' Wrong match name='BC_HOUR', value='', expected='10' Wrong match name='BC_MIN', value='', expected='57' Wrong match name='BC_SEC', value='', expected='56' Wrong match name='BC_TIME_TAKEN', value='', expected='43' Wrong match name='BC_CLIENT_ADDRESS', value='', expected='10.8.26.200' Wrong match name='BC_ACTION', value='', expected='OBSERVED' [nick@localhost ~]$ I have tried various escape methods... (escape_traditional.xml) <pattern>@NUMBER:BC_HOUR:@:@NUMBER:BC_MIN:@:@NUMBER:BC_SEC:@ @NUMBER:BC_TIME_TAKEN:@ @IPv4:BC_CLIENT_ADDRESS:@ - - - @ESTRING:BC_ACTION: @ \"</pattern> or (escape_at.xml) <pattern>@NUMBER:BC_HOUR:@:@NUMBER:BC_MIN:@:@NUMBER:BC_SEC:@ @NUMBER:BC_TIME_TAKEN:@ @IPv4:BC_CLIENT_ADDRESS:@ - - - @ESTRING:BC_ACTION: @ @"</pattern> I have tried various match methods... (test_estring_stopquote.xml) <pattern>@NUMBER:BC_HOUR:@:@NUMBER:BC_MIN:@:@NUMBER:BC_SEC:@ @NUMBER:BC_TIME_TAKEN:@ @IPv4:BC_CLIENT_ADDRESS:@ - - - @ESTRING:BC_ACTION: @ "@ESTRING:BC_CATEGORY:"@</pattern> <test_value name="BC_CATEGORY">Web Ads/Analytics</test_value> or (test_estring_incquotes.xml) <pattern>@NUMBER:BC_HOUR:@:@NUMBER:BC_MIN:@:@NUMBER:BC_SEC:@ @NUMBER:BC_TIME_TAKEN:@ @IPv4:BC_CLIENT_ADDRESS:@ - - - @ESTRING:BC_ACTION: @ @ESTRING:BC_CATEGORY: @</pattern> <test_value name="BC_CATEGORY">"Web Ads/Analytics"</test_value> or (test_qstring.xml) <pattern>@NUMBER:BC_HOUR:@:@NUMBER:BC_MIN:@:@NUMBER:BC_SEC:@ @NUMBER:BC_TIME_TAKEN:@ @IPv4:BC_CLIENT_ADDRESS:@ - - - @ESTRING:BC_ACTION: @ @QSTRING:BC_CATEGORY:"@</pattern> <test_value name="BC_CATEGORY">Web Ads/Analytics</test_value> But no joy! (same error output as above) Any pointers would be appreciated! Testing carried out on: > Fedora release 19 (Schrödinger’s Cat) > syslog-ng-3.4.6-1.fc19.i686 Thanks in Advance, Nick

2 2

[Bug 258] New: syslog-ng 3.4.2 stalls on Ubuntu 12.04 Precise with /var/ log full
by bugzilla＠bugzilla.balabit.com 19 Dec '13

19 Dec '13

https://bugzilla.balabit.com/show_bug.cgi?id=258 Summary: syslog-ng 3.4.2 stalls on Ubuntu 12.04 Precise with /var/log full Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: carl.chenet-ext(a)cloudwatt.com Type of the Report: bug Estimated Hours: 0.0 Hi, We had several cases of frozen KVM virtual machines running Ubuntu 12.04 Precise with syslog-ng 3.4.2 taken from madhouse Debian repository. Issue: the servers are not reachable any more. You can initiate a ssh/console connection but the connection freezes before displaying the banner. Each time the /var/log lvm file system is full. The following errors occur in /var/log/system.log : Oct 30 07:05:18 s-metcld-0002 syslog-ng[8467]: I/O error occurred while writing; fd='16', error='No space left on device (28)' Oct 30 07:06:18 s-metcld-0002 syslog-ng[8467]: I/O error occurred while writing; fd='16', error='No space left on device (28)' Oct 30 07:07:18 s-metcld-0002 syslog-ng[8467]: internal() messages are looping back, preventing loop by suppressing all internal messages until the current message is processed; trigger-msg='', first-suppressed-msg='I/O error occurred while writing; fd=\'16\', error=\'No space left on device (28)\'' Oct 30 07:08:18 s-metcld-0002 syslog-ng[8467]: I/O error occurred while writing; fd='16', error='No space left on device (28)' Oct 30 07:09:18 s-metcld-0002 syslog-ng[8467]: I/O error occurred while writing; fd='16', error='No space left on device (28)' Oct 30 07:10:18 s-metcld-0002 syslog-ng[8467]: internal() messages are looping back, preventing loop by suppressing all internal messages until the current message is processed; trigger-msg='', first-suppressed-msg='I/O error occurred while writing; fd=\'16\', error=\'No space left on device (28)\'' Oct 30 07:11:18 s-metcld-0002 syslog-ng[8467]: I/O error occurred while writing; fd='16', error='No space left on device (28)' Oct 30 07:12:18 s-metcld-0002 syslog-ng[8467]: I/O error occurred while writing; fd='16', error='No space left on device (28)' Oct 30 07:13:19 s-metcld-0002 syslog-ng[8467]: internal() messages are looping back, preventing loop by suppressing all internal messages until the current message is processed; trigger-msg='', first-suppressed-msg='I/O error occurred while writing; fd=\'16\', error=\'No space left on device (28)\'' Oct 30 07:14:19 s-metcld-0002 syslog-ng[8467]: I/O error occurred while writing; fd='16', error='No space left on device (28)' Oct 30 07:15:19 s-metcld-0002 syslog-ng[8467]: I/O error occurred while writing; fd='16', error='No space left on device (28)' Oct 30 07:16:19 s-metcld-0002 syslog-ng[8467]: internal() messages are looping back, preventing loop by suppressing all internal messages until the current message is processed; trigger-msg='', first-suppressed-msg='I/O error occurred while writing; fd=\'16\', error=\'No space left on device (28)\'' Oct 30 07:17:19 s-metcld-0002 syslog-ng[8467]: I/O error occurred while writing; fd='16', error='No space left on device (28)' Workaround: We have the mcollective client installed on each server so we were able to kill the syslog-ng process by mcollective. when syslog-ng is killed, the system stops freezing immedialty, the ssh connection is back. I'm not sure to understand how syslog-ng freezes the system but it is worth reporting I guess. Regards, Carl Chenet -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 4

Continue on with filter errors
by Lay, James 18 Dec '13

18 Dec '13

Question...is there a way to tell syslog-ng to try and continue on with configuration errors (filter)? Weird question maybe, but I was just wondering. Thank you. James

3 4

[RFC]: syslog-ng and UNIX credentials
by Gergely Nagy 14 Dec '13

14 Dec '13

Hi! We had a short chat with Bazsi earlier today, and he's working on a feature that will allow syslog-ng to pick out UNIX credentials passed through unix sockets (such as /dev/log). This means that we receive the PID, the UID and the GID of the sending program, and can opt to store it someplace. So far, syslog-ng was not doing that, but with the new feature, it becomes possible to store these. The idea at the moment is, is to have a flag for unix-* sources that enables collecting these credentials. If turned off (the default, unless using system(), which would turn it on for /dev/log), nothing changes. If turned on, it would replace the $PID sent over the socket with the one extracted from credentials. It would also add the "${.unix.GID}" and "${.unix.UID}" properties to the log message, along with "${.unix.EXE}" on platforms that support looking up the executable (Linux, for now). We'd like to invite the broader community to share your feelings about this feature, the naming of the properties and how You would like it to work, if you're interested in making use of this functionality. -- |8]

3 4

Output to file in /proc
by Valentijn Sessink 13 Dec '13

13 Dec '13

Hello list, As most of the functionality of "sshguard", "fail2ban" and others is in syslog-ng, I'm trying to use syslog-ng to add entries to my Linux kernel based firewall (iptables). I'm almost ready to implement one, but I have a question about undeliverable log lines: what happens if a certain file() destination blocks? Will syslog-ng retry to deliver the same message, or will it lose the message? What I'm doing is using the "ipt_recent" module; with this module, one can check if a certain IP address was seen before. For example, the following rule will block you if you were seen 5 or more times ("hitcount 5") in the "violators" list last minute ("seconds 60): iptables -A INPUT -m recent \ --rcheck --hitcount 5 --seconds 60 --name violators -j DROP The fun part is, that you can add IP adresses by stuffing them into a file in /proc: echo '+127.0.0.1' > /proc/net/xt_recent/violators ... will add 127.0.0.1 to the "violators" with the current time. However: echo 'whatever' > /proc/net/xt_recent/violators ... gives an error: Invalid argument (22) As far as I can see, syslog-ng will not try again to deliver the same message; but is this by design? I.e. can I trust syslog-ng to not "block" because of a single malformed IP address? Because then, an implementation of sshguard could be simply swapped with a simple: destination df_ipt_recent { file ("/proc/net/xt_recent/blocker" template("+${usracct.device}\n") ); }; filter f_ipt_recent { tags("secevt") and match("REJECT" value("secevt.verdict")); }; log { source (s_all); parser(pattern_db); filter(f_addtofirewall);destination(df_addtofirewall);}; ... which would be cool! Best regards, Valentijn

6 26

syslog-ng 3.5.1 - question about flags(final)...
by Johnson, Chris (HP TippingPoint Roseville) 10 Dec '13

10 Dec '13

Hello all, I'm in the process of upgrading from version 3.3.9 to 3.5.1 and have a question about how the 'flags(final);' is working in 3.5.1. In 3.3.9, I use the following structure of imbedded log statements: ################################################################################ # Service ipsec # filter f_ipsec_pgm{program("IPSEC-*" type("glob")) or program("IKE-*" type("glob")) or program("CHARON-*" type("glob")) or program("charon-*" type("glob")); }; filter f_ipsec_lvl_01{level(warning..emerg)}; filter f_ipsec_lvl_02{level(info..emerg)}; log { source(s_local); filter(f_ipsec_pgm); log { filter(f_ipsec_lvl_01); destination(d_logID_11); }; log { filter(f_ipsec_lvl_02); rewrite(r_quote_newlines); destination(d_logID_13); }; flags(final); }; In this case log messages of the 'correct' program would further be filtered on their severity level. * Info level messages would only be sent to 'd_logID_13' * Warning level messages (and above) would be sent to BOTH 'd_logID_11' and 'd_logID_13'. * Debug level messages would be discarded. Under 3.5.1, the 'filtering ' stops after it matches once: * Warning messages (and above) are only sent to 'd_logID_11' and NOT 'd_logID_13'. * Info messages are still (correctly) being sent only to 'd_logID_13'. If I remove (or comment out) the 'flags(final);' statement, messages are filtered correctly (i.e. the way I *want* them to be filtered :)) except that they also are being processed by all the following log statements and are being caught in my final filter of 'program("*" type("glob"))'. NOTE: yes, I know that I could use 'flags(fallback)' in my final filter, but that would still have every message processed by every log filter, and I would like to avoid that. So, what would be the correct way to set up my log statement to re-create the 3.3 behavior? Thanks, Chris ---------------------------------------- Christopher Johnson chris.johnson3(a)hp.com<mailto:chris.johnson3@hp.com> HP Software - Security Product Group (916) 785-2817 ----------------------------------------

3 7

[review request] 3.6queue/f/stats-reset
by Balazs Scheidler 10 Dec '13

10 Dec '13

Hi, I'm about to integrate a stats-counter related change and prior to doing that I'd like to solicit feedback. There are both user-visible changes and developer visible changes, feedback on both is sought. Code related comments are preferred on github, functionality comments are best sent via email in response to this one. Here's the branch: https://github.com/balabit/syslog-ng/tree/3.6queue/f/stats-reset Thanks in advance. User-visible changes: ===================== syslog-ng is keeping track on a number of statistics counters that can be used to track what is happening. The detail level of these counters is controlled by the stats-level() global option, which defaults to zero. syslog-ng reports these counters periodically every stats-freq() seconds, or preferably on-demand by invoking "syslog-ng-ctl stats" on the command line. At stats-level(3) a number of "dynamic" counters are enabled, which track the number of messages on a per $HOST, per $PROGRAM and per $HOST_FROM basis. This means that you can follow how many messages a given $PROGRAM is generating in a period. The issue with dynamic counters is that they can consume a lot of memory if the rate of new $PRORGRAM/$HOST values is high. Previously the cleanup happened in a limited way at configuration reload (e.g. SIGHUP) time, which is not really useful for controlling memory usage by this feature. The current patch series introduces a stats-lifetime() option and syslog-ng starts inspecting counters every once in a while and prune those that are updated earlier than stats-lifetime(). Not-so visible changes ====================== I have fixed a few bugs and renamed a function to make it easier to understand. Details are in the git history. Balazs Scheidler (7): logsource: use stats_instant_inc_dynamic_counter() for HOST counters logsource: track time for PROGRAM counters mainloop: remove old orphanage based stats cleanup stats: add stats_prune_old_counters() stats-timer: implement stats_lifetime option cfg: add stats-lifetime() global option stats: rename stats_instance_inc_dynamic_counter() to stats_register_and_increment_dynamic_counter() lib/cfg-grammar.y | 16 ++++++++------- lib/cfg-parser.c | 1 + lib/cfg.c | 3 ++- lib/cfg.h | 1 + lib/logsource.c | 15 +++----------- lib/mainloop.c | 1 - lib/stats-timer.c | 61 +++++++++++++++++++++++++++++++++++++++---------------- lib/stats-timer.h | 2 +- lib/stats.c | 52 +++++++++++++++++++++++++++++++++++++++-------- lib/stats.h | 7 +++---- 10 files changed, 108 insertions(+), 51 deletions(-) -- Bazsi

6 12

[review request] please check
by Balazs Scheidler 10 Dec '13

10 Dec '13

Hi, As a number of things depend on the logtransport.c split, I'd like to merge that separately. https://github.com/balabit/syslog-ng/pull/36 The branch itself is really just shuffling around files, basically the monolitic logtransport.c that contained 4 classes were split into separate files under the lib/transport subdirectory. Thanks in advance. Bazsi

2 1

[git] 3.6queue prefix in branches changed to 3.6
by Balazs Scheidler 07 Dec '13

07 Dec '13

Hi, For consistency, I've renamed all "3.6queue" prefixes in branch names to 3.6. This makes them possible to push all "pending" branches with a single push call and is consistent with the branches aimed at different major releases. I might remove the prefix altogether in the future (e.g. using no prefix for development branches destined at the latest master), but as I'm working a number of things in parallel for 3.6, I prefer to keep them as one bunch for now. -- Bazsi

1 0

Trouble with microseconds
by Clayton Dukes 06 Dec '13

06 Dec '13

Hi, I have a system configured to microseconds logging, but for most of entries it's always zero - actually the only program which logs it correctly is the syslog-ng itself. @1386239689.000000 13 blah @1386239859.947724 45 syslog-ng shutting down; version='3.5.2' @1386239860.304194 45 syslog-ng starting up; version='3.5.2' @1386239860.337325 45 EOF on control channel, closing connection; @1386239865.000000 13 blah Anyone have an idea what I'm doing wrong? Here's the config: destination d_mydest{ program("/somepath" template("@${UNIXTIME:--}\t${PRI:--}\t${MSGONLY}\n") flags(no_multi_line) flush_timeout(100) frac_digits(6) ); }; ______________________________________________________________ Clayton Dukes ______________________________________________________________

2 2

syslog - sql error
by vijay 03 Dec '13

03 Dec '13

HI All, Iam using syslog-ng3.2.5 rpm in centos x86_64 environment.Past days it is working well.Suddenly iam seeing a problem in writing to mysql Error running SQL query; type='mysql', host='192.168.9.68', port='3306', user='cygnet', database='CygNetDB', error='1072: Key column \'date\' doesn\'t exist in table', query='CREATE INDEX SYSLOGS_20131130_date_idx ON SYSLOGS_20131130 (date)' Error adding missing index; table='SYSLOGS_20131130', column='date' Error running SQL query; type='mysql', host='192.168.9.68', port='3306', user='cygnet', database='CygNetDB', error='1170: BLOB/TEXT column \'facility\' used in key specification without a key length', query='CREATE INDEX SYSLOGS_20131130_facility_idx ON SYSLOGS_20131130 (facility)' Error adding missing index; table='SYSLOGS_20131130', column='facility' vijay

2 1

[PATCH] rewrite_rule_clone: unit tests for clone of rewrite rules are implemented
by Juhász Viktor 02 Dec '13

02 Dec '13

These tests evince some problems about clone implementation. The clone implementations didn't increased the reference of the condition, and it leaks the template which is used by the constructors (set, subst). These errors are corrected in this patch. Signed-off-by: Juhász Viktor <jviktor(a)balabit.hu> --- lib/rewrite/Makefile.am | 2 + lib/rewrite/rewrite-set-tag.c | 2 +- lib/rewrite/rewrite-set.c | 4 +- lib/rewrite/rewrite-subst.c | 4 +- lib/rewrite/tests/Makefile.am | 9 ++++ lib/rewrite/tests/test_clone.c | 96 ++++++++++++++++++++++++++++++++++++++++++ libtest/test_case.h | 37 ++++++++++++++++ 7 files changed, 149 insertions(+), 5 deletions(-) create mode 100644 lib/rewrite/tests/Makefile.am create mode 100644 lib/rewrite/tests/test_clone.c create mode 100644 libtest/test_case.h diff --git a/lib/rewrite/Makefile.am b/lib/rewrite/Makefile.am index b111935..bc6547f 100644 --- a/lib/rewrite/Makefile.am +++ b/lib/rewrite/Makefile.am @@ -21,3 +21,5 @@ BUILT_SOURCES += \ lib/rewrite/rewrite-expr-grammar.h EXTRA_DIST += lib/rewrite/rewrite-expr-grammar.ym + +include lib/rewrite/tests/Makefile.am diff --git a/lib/rewrite/rewrite-set-tag.c b/lib/rewrite/rewrite-set-tag.c index 45d3cbf..154973d 100644 --- a/lib/rewrite/rewrite-set-tag.c +++ b/lib/rewrite/rewrite-set-tag.c @@ -56,7 +56,7 @@ log_rewrite_set_tag_clone(LogPipe *s) log_rewrite_init(&cloned->super); cloned->super.super.clone = log_rewrite_set_tag_clone; cloned->super.process = log_rewrite_set_tag_process; - cloned->super.condition = self->super.condition; + cloned->super.condition = self->super.condition ? filter_expr_ref(self->super.condition) : NULL; cloned->tag_id = self->tag_id; cloned->value = self->value; diff --git a/lib/rewrite/rewrite-set.c b/lib/rewrite/rewrite-set.c index 5b117ff..de42c8d 100644 --- a/lib/rewrite/rewrite-set.c +++ b/lib/rewrite/rewrite-set.c @@ -56,9 +56,9 @@ log_rewrite_set_clone(LogPipe *s) LogRewriteSet *self = (LogRewriteSet *) s; LogRewriteSet *cloned; - cloned = (LogRewriteSet *) log_rewrite_set_new(log_template_ref(self->value_template)); + cloned = (LogRewriteSet *) log_rewrite_set_new(self->value_template); cloned->super.value_handle = self->super.value_handle; - cloned->super.condition = self->super.condition; + cloned->super.condition = self->super.condition ? filter_expr_ref(self->super.condition) : NULL; return &cloned->super.super; } diff --git a/lib/rewrite/rewrite-subst.c b/lib/rewrite/rewrite-subst.c index f16afae..385fb82 100644 --- a/lib/rewrite/rewrite-subst.c +++ b/lib/rewrite/rewrite-subst.c @@ -101,10 +101,10 @@ log_rewrite_subst_clone(LogPipe *s) LogRewriteSubst *self = (LogRewriteSubst *) s; LogRewriteSubst *cloned; - cloned = (LogRewriteSubst *) log_rewrite_subst_new(log_template_ref(self->replacement)); + cloned = (LogRewriteSubst *) log_rewrite_subst_new(self->replacement); cloned->matcher = log_matcher_ref(self->matcher); cloned->super.value_handle = self->super.value_handle; - cloned->super.condition = self->super.condition; + cloned->super.condition = self->super.condition ? filter_expr_ref(self->super.condition) : NULL; return &cloned->super.super; } diff --git a/lib/rewrite/tests/Makefile.am b/lib/rewrite/tests/Makefile.am new file mode 100644 index 0000000..c5f740d --- /dev/null +++ b/lib/rewrite/tests/Makefile.am @@ -0,0 +1,9 @@ +lib_rewrite_tests_TESTS = lib/rewrite/tests/test_clone + +check_PROGRAMS += ${lib_rewrite_tests_TESTS} + +lib_rewrite_tests_test_clone_CFLAGS = $(TEST_CFLAGS) \ + -I${top_srcdir}/lib/rewrite/tests + +lib_rewrite_tests_test_clone_LDADD = $(TEST_LDADD) \ + $(PREOPEN_SYSLOGFORMAT) diff --git a/lib/rewrite/tests/test_clone.c b/lib/rewrite/tests/test_clone.c new file mode 100644 index 0000000..8bb6d90 --- /dev/null +++ b/lib/rewrite/tests/test_clone.c @@ -0,0 +1,96 @@ +#include "apphook.h" +#include "plugin.h" +#include "testutils.h" +#include "lib/rewrite/rewrite-expr.h" +#include "lib/rewrite/rewrite-set.h" +#include "lib/rewrite/rewrite-subst.h" +#include "lib/rewrite/rewrite-set-tag.h" +#include "lib/filter/filter-cmp.h" +#include "test_case.h" + +typedef struct _RewriteTestCase { + TestCase super; + LogRewrite *test_set_rewrite; + LogRewrite *test_subst_rewrite; + LogRewrite *test_tag_rewrite; +} RewriteTestCase; + +void +rewrite_testcase_setup(TestCase *s) +{ + RewriteTestCase *self = (RewriteTestCase *)s; + configuration = cfg_new(0x305); + + FilterExprNode *set_condition = fop_cmp_new(log_template_new(configuration, "OP1"), log_template_new(configuration, "OP2"), 10520); + FilterExprNode *subst_condition = fop_cmp_new(log_template_new(configuration, "OP1"), log_template_new(configuration, "OP2"), 10520); + FilterExprNode *set_tag_condition = fop_cmp_new(log_template_new(configuration, "OP1"), log_template_new(configuration, "OP2"), 10520); + + LogTemplate *test_template = log_template_new(configuration, "TEST"); + + self->test_set_rewrite = log_rewrite_set_new(test_template); + self->test_subst_rewrite = log_rewrite_subst_new(test_template); + + self->test_tag_rewrite = log_rewrite_set_tag_new("test_tag", FALSE); + + log_rewrite_set_condition(self->test_set_rewrite, set_condition); + log_rewrite_set_condition(self->test_subst_rewrite, subst_condition); + log_rewrite_set_condition(self->test_tag_rewrite, set_tag_condition); + + log_rewrite_subst_set_matcher(self->test_subst_rewrite, log_matcher_posix_re_new()); + + log_template_unref(test_template); +} + +void +rewrite_testcase_teardown(TestCase *s) +{ + RewriteTestCase *self = (RewriteTestCase *)s; + log_pipe_unref((LogPipe *)self->test_subst_rewrite); + log_pipe_unref((LogPipe *)self->test_set_rewrite); + log_pipe_unref((LogPipe *)self->test_tag_rewrite); + cfg_free(configuration); +} + +void +test_clone(LogRewrite *rule) +{ + LogPipe *cloned_rule = log_pipe_clone((LogPipe *)rule); + assert_guint32(rule->condition->ref_cnt, 2, ASSERTION_ERROR("Bad reference number of condition")); + log_pipe_unref(cloned_rule); + assert_guint32(rule->condition->ref_cnt, 1, ASSERTION_ERROR("Bad reference number of condition")); +} + +void +test_reference_on_set_condition_cloned(TestCase *s) +{ + RewriteTestCase *self = (RewriteTestCase *) s; + test_clone(self->test_set_rewrite); +} + +void +test_reference_on_subst_condition_cloned(TestCase *s) +{ + RewriteTestCase *self = (RewriteTestCase *) s; + test_clone(self->test_subst_rewrite); +} + +void +test_reference_on_tag_condition_cloned(TestCase *s) +{ + RewriteTestCase *self = (RewriteTestCase *) s; + test_clone(self->test_tag_rewrite); +} + +int +main(int argc, char **argv) +{ + app_startup(); + putenv("TZ=MET-1METDST"); + tzset(); + + start_grabbing_messages(); + RUN_TESTCASE(RewriteTestCase, rewrite_testcase, test_reference_on_set_condition_cloned); + RUN_TESTCASE(RewriteTestCase, rewrite_testcase, test_reference_on_subst_condition_cloned); + RUN_TESTCASE(RewriteTestCase, rewrite_testcase, test_reference_on_tag_condition_cloned); + stop_grabbing_messages(); +} diff --git a/libtest/test_case.h b/libtest/test_case.h new file mode 100644 index 0000000..4a49c9a --- /dev/null +++ b/libtest/test_case.h @@ -0,0 +1,37 @@ +/* + * test_case.h + * + * Created on: Nov 27, 2013 + * Author: jviktor + */ + +#ifndef TEST_CASE_H_ +#define TEST_CASE_H_ + +typedef struct _TestCase TestCase; + +struct _TestCase { + void (*setup)(TestCase *self); + void (*run)(TestCase *self); + void (*teardown)(TestCase *self); +}; + + +static void +run_test_case(TestCase *tc) +{ + if (tc->setup) tc->setup(tc); + tc->run(tc); + if (tc->teardown) tc->teardown(tc); +} + +#define RUN_TESTCASE(class_name, test_case_prefix, test_function) { \ + class_name *tc = g_new0(class_name, 1); \ + tc->super.setup = test_case_prefix ## _setup; \ + tc->super.teardown = test_case_prefix ## _teardown; \ + tc->super.run = test_function;\ + run_test_case(&tc->super); \ + g_free(tc); \ +} + +#endif /* TEST_CASE_H_ */ -- 1.8.3.2

2 1

[Bug 264] New: docbug: all-hard-macros does not exist in value-pairs
by bugzilla＠bugzilla.balabit.com 02 Dec '13

02 Dec '13

https://bugzilla.balabit.com/show_bug.cgi?id=264 Summary: docbug: all-hard-macros does not exist in value-pairs Product: syslog-ng Version: 3.5.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.balabit(a)faxm0dem.org Type of the Report: --- Estimated Hours: 0.0 using this yields "Error parsing config, Error compiling template (Error parsing value-pairs: unknown scope all-hard-macros)" Indeed, the key "all-hard-macros" is not being referenced in 'lib/value-pairs.c' -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

Syslog-ng OSE Question.
by Malkin, Vlad 02 Dec '13

02 Dec '13

Hi, Is it possible to have syslog-ng client to invoke an external (to it) software to acknowledge when each individual log statement is sent to the server? Background: logs should not be lost. The system needs to store logs internally until they are transmitted to the server (use of TCP transport provides a level of reliable delivery). After each log statement is transmitted by syslog-ng client, it needs to be removed from internal store to preserve allocated space. Thank you for your help! --Vlad

5 6

syslog-ng 3.5.2 has been released
by devel＠balabit.hu 29 Nov '13

29 Nov '13

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.5.2 SUMMARY : new stable release DATE : Nov 29, 2013 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.5.2) has been released. For latest fixes in the 3.5.x feature branch you are recommended to upgrade to this version. CHANGES: 3.5.2 Fri, 29 Nov 2013 17:09:40 +0100 This is the first bug-fix release for the 3.5.x series, with a number of significant fixes over the original 3.5.1 release. Upgrading to this release is highly recommended. Bugfixes ======== * The system() source has been fixed on Solaris and HP-UX: it correctly recognises the system on Solaris, and uses /dev/log (and not /dev/pipe) on HP-UX. * The system() source has much stricter requirements to select /dev/kmsg on Linux, so it won't choose it over /proc/kmsg unless the kernel really does support it. * The syslog-format() module has been fixed to only set the PROGRAM to "kernel" if all of the previous conditions apply, and the message is a local message. * The linux-kmsg-format parser (and system() on Linux 3.5+ as a consequence) will correctly calculate the timestamp of kernel messages on 32-bit systems now. * The sun-streams() source has been fixed, it compiles and works again. * A very rare and short race condition has been fixed in the pipe() source and destination modules, which could leave the pipe available with elevated permissions for a short time. * The SQL, MongoDB and SMTP modules were fixed to not cause a segmentation fault when loaded before the socket module. * A crash was fixed in the no-tls build of the socket destination driver. * It is now possible to specify the host() and port() parameters for the redis() destination. * Various stability fixes, such as: - A use-after-free condition was corrected in the queue backlog acknowledgement code. - Always use setsid() when detaching, even if we're not detaching from a TTY. - Memory leaks were fixed in the persist state handling code. - Changing stats-level() and reloading syslog-ng produced a crash, which has been fixed. Credits: ======== syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Alexandre Lecuyer Balazs Scheidler <bazsi(a)balabit.hu> Daniel Gados <gdani(a)balabit.hu> Gergely Nagy <algernon(a)balabit.hu> Howard Tsai <htsai(a)skytap.com> Imre Lazar <imre(a)balabit.hu> Jakub Wilk <jwilk(a)debian.org> Laszlo Budai <lbudai(a)balabit.hu> Martin Bagge / brother <brother(a)bsnet.se> Matyas Koszik <koszik(a)atw.hu> Oscar Muñoz Otto Berger <otto(a)bergerdata.de> Viktor Juhasz <jviktor(a)balabit.hu> Viktor Tusa <tusa(a)balabit.hu> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

syslog-ng 3.4.6 has been released
by devel＠balabit.hu 27 Nov '13

27 Nov '13

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.4.6 SUMMARY : new stable release DATE : Nov 27, 2013 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.4.6) has been released. For latest fixes in the 3.4.x feature branch you are recommended to upgrade to this version. CHANGES: 3.4.6 Wed, 27 Nov 2013 16:21:47 +0100 This is the fifth bug-fix release for the 3.4.x series, with a number of significant fixes over the 3.4.5 release. Upgrading to this release is highly recommended. Bugfixes ======== * The system() source has been fixed on Solaris and HP-UX: it correctly recognises the system on Solaris, and uses /dev/log (and not /dev/pipe) on HP-UX. * The sun-streams() source has been fixed, it compiles and works again. * A very rare and short race condition has been fixed in the pipe() source and destination modules, which could leave the pipe available with elevated permissions for a short time. * The SQL, MongoDB and SMTP modules were fixed to not cause a segmentation fault when loaded before the socket module. * The syslog-format() module has been fixed to only set the PROGRAM to "kernel" if all of the previous conditions apply, and the message is a local message. Credits: ======== syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Alexandre Lecuyer Balazs Scheidler <bazsi(a)balabit.hu> Gergely Nagy <algernon(a)balabit.hu> Imre Lazar <imre(a)balabit.hu> Laszlo Budai <lbudai(a)balabit.hu> Matyas Koszik <koszik(a)atw.hu> Oscar Muñoz DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

Mongodb
by Nilo Cabeza Diaz 27 Nov '13

27 Nov '13

how send log to mongodb??? this is what I do in syslog-ng.conf and does nothing for me destination d_dw_v3_mongo { mongodb( host("localhost") port(27017) database("syslog") collection("messages") value-pairs( key("ISODATE") key("PRIORITY") pair("svc_id" "${.SDATA.syslog(a)0.svcid}") pair("tid" "${.SDATA.syslog(a)0.tid}") pair("act_id" "${.SDATA.syslog(a)0.id}") pair("act_eid" "${.SDATA.syslog(a)0.eid}") key("MESSAGE") key("SDATA") key("HOST") ); };

2 1

Error of parser
by Nilo Cabeza Diaz 26 Nov '13

26 Nov '13

hello: look this error Failed to start Syslog-NG server : * Starting system logging syslog-ng syslog-ng: Error setting capabilities, capability management disabled; error='Operation not permitted' Error parsing config, syntax error, unexpected KW_DESTINATION, expecting ';' in /etc/syslog-ng/syslog-ng.conf at line 94, column 1: destination d_mongodb { ^^^^^^^^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng ...fail!

2 1