- syslog-ng - lists.balabit.hu

syslog-ng-ctl stats -> EOF on control channel
by Lucas, Sascha 03 Apr '13

03 Apr '13

Hi, I regularly run "syslog-ng-ctl stats" for monitoring purpose. My log-analyses shows that following messages is logged to priority err: EOF on control channel, closing connection; I would expect this with priority info. Or is there an error calling the above command? My syslog-ng version is 3.4.1. Thanks, Sascha. Vorsitzender des Aufsichtsrates: Ralf Hiltenkamp Geschäftsführung: Michael Krüger (Sprecher), Stephan Drescher Sitz der Gesellschaft: Halle/Saale Registergericht: Amtsgericht Stendal | Handelsregister-Nr. HRB 208414 UST-ID-Nr. DE 158253683 Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Empfänger sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail oder des Inhalts dieser Mail sind nicht gestattet. Diese Kommunikation per E-Mail ist nicht gegen den Zugriff durch Dritte geschützt. Die GISA GmbH haftet ausdrücklich nicht für den Inhalt und die Vollständigkeit von E-Mails und den gegebenenfalls daraus entstehenden Schaden. Sollte trotz der bestehenden Viren-Schutzprogramme durch diese E-Mail ein Virus in Ihr System gelangen, so haftet die GISA GmbH - soweit gesetzlich zulässig - nicht für die hieraus entstehenden Schäden.

2 1

OSE 3.4(.1) block() argument parse issue
by Eric Berggren 30 Mar '13

30 Mar '13

syslog-ng OSE 3.4.1 is unable to parse the "Example 5.8: Passing arguments to blocks" excerpt in the v3.4 admin guide, which exemplifies a common construct used in our current 3.2 config : @version: 3.4 block source s_logfile (filename("messages")) { file("/var/log/`filename`" ); }; source s_example { s_logfile(filename("logfile.log")); }; host# ./syslog-ng -s -f ./s2.conf : Error parsing affile, syntax error, unexpected LL_IDENTIFIER in source block s_logfile at line 2, column 19: included from /home/eberggren/proj/syslog-ng/config/s2.conf line 7, column 36 file("/var/log/"logfile.log ^^^^^^^^^^^ 3.3.8 appears to be okay with it, however (and our existing 3.2 config). thanks, -eric

2 2

[Bug 225] New: patterndb can not use HOST as variable in pattern
by bugzilla＠bugzilla.balabit.com 30 Mar '13

30 Mar '13

https://bugzilla.balabit.com/show_bug.cgi?id=225 Summary: patterndb can not use HOST as variable in pattern Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 This fails in the patterndb test --validate with the error ERROR:logmsg.c:540:log_msg_set_value_indirect: assertion failed: (handle >= LM_V_MAX) <rule id="50b9250d-2191-43af-8008-089c50224dc2" class="erempel" provider="UVic"> <patterns> <pattern>replace HOST with @ANYSTRING:HOST@</pattern> </patterns> <examples> <example> <test_message program="something">replace HOST with some.host.here</test_message> <test_values> <test_value name="HOST">some.host.here</test_value> </test_values> </example> </examples> </rule> but this succeeds and replaces the HOST macro <rule id="50b9250d-2191-43af-8008-089c50224dc2" class="erempel" provider="UVic"> <patterns> <pattern>replace HOST with @ANYSTRING:tempHost@</pattern> </patterns> <values> <value name="HOST">$tempHost</value> </values> <examples> <example> <test_message program="something">replace HOST with some.host.here</test_message> <test_values> <test_value name="tempHost">some.host.here</test_value> </test_values> </example> </examples> </rule> I would expect the both to work. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 7

How to build a filter where one message from one host not logged
by Niels Graupe 29 Mar '13

29 Mar '13

Hi ! I want to filter with syslog-ng that a message from a special host with a special message was not filtered and everything else goes to the logfile filter f_cisco_switches_knownerrors1 { host ("hostxy") and match("ENVIRONMENT-3-RPS_FAILED"); }; The Log-Message : Mar 29 12:29:19 hostxy err 20979: Mar 29 12:29:18: %ENVIRONMENT-3-RPS_FAILED: Faulty internal power supply detected Thanks, Niels

2 1

Closing destination file when date changes.
by andrea.meconi＠libero.it 23 Mar '13

23 Mar '13

Hello. I'm using a very simple configuration on Ubuntu 12.04.2 LTS @version: 3.3 @include "scl.conf" source from-network { udp(ip("0.0.0.0") port(514)); }; destination local-file { file("/var/log/temporary-encrypted/$YEAR-$MONTH-$DAY.log"); }; log { source(from-network); destination(local-file);}; Log on a destination file using date as filename. I need to close this file when date changes at 00:00. How? Thanks. Andrea

4 3

R: Re: Closing destination file when date changes.
by andrea.meconi＠libero.it 22 Mar '13

22 Mar '13

Thank. I'm reconfiguring syslog-ng using macro and sending HUP. Regards. Andrea >----Messaggio originale---- >Da: algernon(a)balabit.hu >Data: 22/03/2013 15.44 >A: "Syslog-ng users' and developers' mailing list"<syslog-ng(a)lists.balabit. hu> >Ogg: Re: [syslog-ng] Closing destination file when date changes. > >Sandor Geller <Sandor.Geller(a)morganstanley.com> writes: > >> On Fri, Mar 22, 2013 at 9:37 AM, andrea.meconi(a)libero.it >> <andrea.meconi(a)libero.it> wrote: >>> Hello. >>> I'm using a very simple configuration on Ubuntu 12.04.2 LTS >>> >>> >>> @version: 3.3 >>> @include "scl.conf" >>> source from-network { udp(ip("0.0.0.0") port(514)); }; >>> destination local-file { >>> file("/var/log/temporary-encrypted/$YEAR-$MONTH-$DAY.log"); }; >>> log { source(from-network); destination(local-file);}; >>> >>> >>> Log on a destination file using date as filename. >>> I need to close this file when date changes at 00:00. How? >> >> Unused file destinations could get reaped, see time_reap(). However >> you should take into account that the macros you used in the filename >> are dependent of keep_timestamp() and by default use the timestamp in >> the log message so the destination file could get opened when further >> logs arrive with timestamps referring to the given date... If you want >> to use files based on the receiver's time then I suggest using the R_ >> macros. > >That, and you can force syslog-ng to reinitialize the destinations by >sending it a HUP signal. So using the R_* family of macros, and sending >a SIGHUP shortly after 00:00 will result in syslog-ng closing the old >files. > >-- >|8] > >______________________________________________________________________________ >Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >Documentation: http://www.balabit.com/support/documentation/?product=syslog- ng >FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >

1 0

R: Re: Closing destination file when date changes.
by andrea.meconi＠libero.it 22 Mar '13

22 Mar '13

Thank. I'm reconfiguring syslog-ng using macro and sending HUP. Regards. Andrea >----Messaggio originale---- >Da: algernon(a)balabit.hu >Data: 22/03/2013 15.44 >A: "Syslog-ng users' and developers' mailing list"<syslog-ng(a)lists.balabit. hu> >Ogg: Re: [syslog-ng] Closing destination file when date changes. > >Sandor Geller <Sandor.Geller(a)morganstanley.com> writes: > >> On Fri, Mar 22, 2013 at 9:37 AM, andrea.meconi(a)libero.it >> <andrea.meconi(a)libero.it> wrote: >>> Hello. >>> I'm using a very simple configuration on Ubuntu 12.04.2 LTS >>> >>> >>> @version: 3.3 >>> @include "scl.conf" >>> source from-network { udp(ip("0.0.0.0") port(514)); }; >>> destination local-file { >>> file("/var/log/temporary-encrypted/$YEAR-$MONTH-$DAY.log"); }; >>> log { source(from-network); destination(local-file);}; >>> >>> >>> Log on a destination file using date as filename. >>> I need to close this file when date changes at 00:00. How? >> >> Unused file destinations could get reaped, see time_reap(). However >> you should take into account that the macros you used in the filename >> are dependent of keep_timestamp() and by default use the timestamp in >> the log message so the destination file could get opened when further >> logs arrive with timestamps referring to the given date... If you want >> to use files based on the receiver's time then I suggest using the R_ >> macros. > >That, and you can force syslog-ng to reinitialize the destinations by >sending it a HUP signal. So using the R_* family of macros, and sending >a SIGHUP shortly after 00:00 will result in syslog-ng closing the old >files. > >-- >|8] > >______________________________________________________________________________ >Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >Documentation: http://www.balabit.com/support/documentation/?product=syslog- ng >FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >

1 0

AUTO: James B Horwath is out of the office (returning 03/25/2013)
by James B Horwath 22 Mar '13

22 Mar '13

I am out of the office until 03/25/2013. I will be out of the office until 03/25/2013 with limited access to e-mail. If you have an urgent issue please contact Sunil Gupta at (610)-807-6710 or Dylan Yoder at (610)-807-7230. Regards Jim Horwath IT Security Services & Governance, Corporate BTS and IT Security/Risk Tel 610-807-8795 Mobile 610-533-6972 3900 Burgess Place, Bethlehem, Pa. 18017 Jim_Horwath(a)glic.com Note: This is an automated response to your message "syslog-ng Digest, Vol 95, Issue 14" sent on 3/22/2013 7:00:02. This is the only notification you will receive while this person is away. ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

1 0

flags(final) in version 3.4
by Fanselow, William 22 Mar '13

22 Mar '13

According to this report, the flags(final) does not work in 3.4 as one got used to in prior versions. https://lists.balabit.hu/pipermail/syslog-ng/2013-February/020039.html In version 3.3 I used flags(final) in each of my log{ } statements so that a message was not unnecessarily processed by anything beyond a matching filter. My last entry in the config used flags(fallback) so that any message not previously sent to a destination was caught by this final stanza. With version 3.4, the same syntax does not work, and all messages appear to be passing through every filter and getting duplicated in the first match and my final log destination. Surely, there must be another way to handle this sort of thing. Not only is it useful for processing efficiency, but it is also a useful way to identify "unmatched" filters in the config. Any suggestions for replicating the 3.3 behavior would be appreciated. Thanks Bill Fanselow

5 4

syslog-ng Insider - March 2013
by Peter Czanik 14 Mar '13

14 Mar '13

Dear syslog-ng users, This is the 22th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com <mailto:documentation@balabit.com> FEATURED NEWS Video: networking scenarios and filters --------------------------------------- There is a video series in the work to introduce the basics of syslog-ng. The third video is online now, which explains networking scenarios and filters. You can watch it at https://www.youtube.com/watch?v=VR3t7p04GUI Masking credit card numbers in log messages with syslog-ng ---------------------------------------------------------- Compliance with different regulations is becoming more and more important recently also in logging. One of these, PCI-DSS requires credit card numbers to be masked in logs. Our CTO describes, how it can be achieved using the freshly released syslog-ng 3.4 at http://marci.blogs.balabit.com/2013/02/masking-credit-card-numbers-in-log-m… Brand new syslog-ng Superhero T-shirt available ----------------------------------------------- The syslog-ng Superhero T-shirt was designed for open source fan geeks. Can't wait more to get one? Simply tell us which version of syslog-ng (OSE, PE or SSB) you use, and be our public syslog-ng reference. Please send an email to Peter Czanik for more information and don't forget to include your t-shirt size.;-) T-shirt pictures on Facebook: http://www.facebook.com/media/set/?set=a.10151698258059867.609510.124671654… T-shirt pictures on the web: http://bit.ly/ZFmmVq SHORT NEWS: * openSUSE 12.3 was released yesterday and is the first Linux distribution to include syslog-ng 3.4.1 NEW RELEASES: * SSB 3F1: http://gyp.blogs.balabit.com/2013/03/introducing-syslog-ng-store-box-3f1/ ARCHIVE http://insider.blogs.balabit.com/ -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

[Bug 228] New: match regex not working
by bugzilla＠bugzilla.balabit.com 13 Mar '13

13 Mar '13

https://bugzilla.balabit.com/show_bug.cgi?id=228 Summary: match regex not working Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: critical Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: blackluck(a)ktk.bme.hu Type of the Report: bug Estimated Hours: 0.0 Sziasztok! Ubuntu 8.04 lts-rol megfelelo lepesekben frissitve lett rendszer 12.04 lts-re, abban talalhato syslog-ng 3.3.4 -ben nem mukodik jol a match regex szures. Konkretan ugy viselkedik hogy sima stringre szures csak akkor ervenyesul ha bejovo logban string elott van space. Filter: filter f_EQAM_BW_OVERSUB { netmask("172.18.96.0/255.255.224.0") and match("Bandwidth Oversubscribed" value("MESSAGE")); }; ha netcat-el kuldok bele teszt uzenetet, csak akkor ervenyeul a filter ha van szokoz a keresett szoveg es az elotte talalhato tartalom kozott, pl : "test Bandwidth Oversubscribed" mukodik "testBandwidth Oversubscribed" nem mukodik Korabban 8.04-es ubuntu alatt ez mukodott rendben (csak akkor match-nek nem kellett megadni a value("MESSAGE") reszt), szintaktikai hibat nem ad a konfigra. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

Writing JSON message to a MongoDB destination
by Al Itchon 07 Mar '13

07 Mar '13

I tried using I'm getting an error trying to use json-parser here: parser p_json { json-parser(prefix(".json.")); }; But I get this error: Error parsing parser expression, parser plugin json-parser not found in /usr/local/etc/syslog-ng.conf at line 38, column 3: json-parser(prefix(".json.")); I'm pretty sure I'm using syslog-ng 3.4.1. Any idea on what I'm missing?

3 4

strange error message: Invalid byte sequence or other error while converting input
by Lucas, Sascha 01 Mar '13

01 Mar '13

Hi, I'm running a self-compiled syslog-ng-3.4.1 on SLES11-SP2. Compilation is mostly identical to the rpm-spec from OBS home:czanik:syslog-ng34, expect spoof-source is disabled. I have the following configuration enabled, to avoid non-UTF8 chars in mongodb: source s_network { tcp( max-connections(10) port(2012) encoding(UTF-8)); udp( port(2012) encoding(UTF-8)); }; Feb 27 12:54:13 gisu1000 syslog-ng[3335]: Syslog connection accepted; fd='11', client='AF_INET(x.x.x.x:50928)', local='AF_INET(0.0.0.0:2012)' Feb 27 12:54:13 gisu1000 syslog-ng[3335]: Invalid byte sequence or other error while converting input, skipping character; encoding='UTF-8', char='0xd2' Feb 27 12:54:13 gisu1000 syslog-ng[3335]: Syslog connection closed; fd='11', client='AF_INET(x.x.x.x:50928)', local='AF_INET(0.0.0.0:2012)' Can someone point me to what this means and how to avoid this? Thanks, Sascha. Vorsitzender des Aufsichtsrates: Ralf Hiltenkamp Geschäftsführung: Michael Krüger (Sprecher), Stephan Drescher Sitz der Gesellschaft: Halle/Saale Registergericht: Amtsgericht Stendal | Handelsregister-Nr. HRB 208414 UST-ID-Nr. DE 158253683 Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Empfänger sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail oder des Inhalts dieser Mail sind nicht gestattet. Diese Kommunikation per E-Mail ist nicht gegen den Zugriff durch Dritte geschützt. Die GISA GmbH haftet ausdrücklich nicht für den Inhalt und die Vollständigkeit von E-Mails und den gegebenenfalls daraus entstehenden Schaden. Sollte trotz der bestehenden Viren-Schutzprogramme durch diese E-Mail ein Virus in Ihr System gelangen, so haftet die GISA GmbH - soweit gesetzlich zulässig - nicht für die hieraus entstehenden Schäden.

1 1

credit card masking in log messages
by Marton ILLES 01 Mar '13

01 Mar '13

Hello Loggers! I was playing around with the latest 3.4.1 release and created two rewrite configuration blocks to mask and hash credit card numbers in log messages. I think it would be a good idea to add these config blocks to SCL so anyone could use it latter easily. These are fairly simple two blocks: block rewrite hash_cc(value("MESSAGE")) { subst( "(?P<1>:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|6(?:011|5[0-9][0-9])[0-9]{12}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|(?:2131|1800|35\d{3})\d{11})", "$(sha1 --length 16 $1)", value(`value`), flags(global, store-matches), type(pcre)); }; block rewrite mask_cc(value("MESSAGE")) { subst( "(?P<1>:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|6(?:011|5[0-9][0-9])[0-9]{12}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|(?:2131|1800|35\d{3})\d{11})", "$(substr $1 0 6)******$(substr $1 -4 4)" value(`value`), flags(global, store-matches), type(pcre)); }; You can use it in your rewrite statements easily: log { source(s_local); rewrite { mask_cc(); }; #rewrite { hash_cc(value(".sdata.my-cc")); }; destination(d_local); }; And it turns a message like this: Transaction approved; checkout-id='46255763', amount='38.43', cc='5542043004559005' Into this, in case of masking: Transaction approved; checkout-id='46255763', amount='38.43', cc='554204******9005' And in case of hashing: Transaction approved; checkout-id='46255763', amount='38.43', cc='986d97fc95435b22' For anyone interested in more details on credit card number masking/hashing/tokenization I also wrote a blogpost about this: http://marci.blogs.balabit.com/2013/02/masking-credit-card-numbers-in-log-m… The regexps could be enhanced further, but I guess it is good for a start. Bazsi, Algernon could you please add this to SCL? Sorry, I was lazy to generate a git pull request. :( Happy Masking! cheers, Marton

2 2

[Bug 220] New: Version 3. 4 logical configuration incompatible with previous versions
by bugzilla＠bugzilla.balabit.com 01 Mar '13

01 Mar '13

https://bugzilla.balabit.com/show_bug.cgi?id=220 Summary: Version 3.4 logical configuration incompatible with previous versions Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 In version 3.3 the top level configuration structure treated all log statements as if they were inside a single block. If there was a log statement with a flags(final) then no other log statements were processed. This allowed @include statements to include snippets that included logs statements with flags(final). In version 3.4 the top level configuration structure treats all log statements independently. If there was a log statement with a flags(final) it only affects processing within that log statement and processing does continue with then next log statement. Including files with log statements and flags(final) can'r really be done and the @include can not be used inside of log statements. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 9

storing an array in mongodb
by Lucas, Sascha 27 Feb '13

27 Feb '13

Hi, I'm experimenting with patterndb and the classifier (syslog-ng 3.4.1). ATM the classifier is stored in the TAGS key as a comma separated string. For searching on different classes it would be nice to store it in an array. This can be indexed and searched (per element). Is this possible? TIA, Sascha. Vorsitzender des Aufsichtsrates: Ralf Hiltenkamp Geschäftsführung: Michael Krüger (Sprecher), Stephan Drescher Sitz der Gesellschaft: Halle/Saale Registergericht: Amtsgericht Stendal | Handelsregister-Nr. HRB 208414 UST-ID-Nr. DE 158253683 Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Empfänger sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail oder des Inhalts dieser Mail sind nicht gestattet. Diese Kommunikation per E-Mail ist nicht gegen den Zugriff durch Dritte geschützt. Die GISA GmbH haftet ausdrücklich nicht für den Inhalt und die Vollständigkeit von E-Mails und den gegebenenfalls daraus entstehenden Schaden. Sollte trotz der bestehenden Viren-Schutzprogramme durch diese E-Mail ein Virus in Ihr System gelangen, so haftet die GISA GmbH - soweit gesetzlich zulässig - nicht für die hieraus entstehenden Schäden.

3 2

No "-n" switch for syslog-ng?
by P Levine 27 Feb '13

27 Feb '13

I've been getting many "syslog-ng.service start request repeated too quickly..." issues in systemd journal . The syslog-ng service would always fail. I noticed there seems to be a bug in which systemd executes syslog-ng with the "-n" flag. I recently posted the bug here: https://bugs.freedesktop.org/show_bug.cgi?id=61324 After modifying lib/gprocess.c to accept "-n" in place of "-F", recompiling, and reinstalling, the problem has disappeared and the syslog-ng process remains up. Is this a systemd bug? I have been googling for 2 days to see if it relates to any other bugs and have found nothing. I just started using systemd 4 days ago and its my impression that syslog-ng has supported systemd for some time. So, could there be something on my end causing the issue?

4 15

syslog-ng OSE 3.4 doc updates
by Fekete Robert 26 Feb '13

26 Feb '13

Hi, I am currently working on updating the 3.4 adminguide, and releasing updated drafts every few days. The current version already has two short sections about junctions and channels (and a bunch of smaller updates as well). http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.4-guid… http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.4-guid… Any feedback, comment, clarification request, or real-life use-case is most welcome. I hope to release more stuff on Friday, and also to write a list of the new features that are already documented. Kind Regards, Robert

5 17

syslog-ng ruleset confusion or bug?
by David Stainton 26 Feb '13

26 Feb '13

Greetings, I am running syslog-ng-3.3.5-1 on CentOS release 6.3. It seems like there is a subtle bug in syslog-ng or more likely a bug in my syslog-ng configuration. I am unable to get log message to appear in the other destinations besides /var/log/messages... I've tried testing like this: logger info.local3 howdy logger info.local5 howdy logger info.local6 howdy logger emerg.local6 howdy However the log messages only show up in /var/log/messages. I wonder why! Any help, observations or suggestions would be much appreciated. Thanks! David PS Here is my simple config: @version: 3.3 options { create_dirs (yes); dir_perm(0755); keep_hostname (yes); perm(0644); flush_lines (0); time_reopen (10); use_dns (yes); use_fqdn (no); }; source s_sys { file ("/proc/kmsg" program_override("kernel: ")); unix-stream ("/dev/log"); internal(); unix-stream ("/var/named/chroot/dev/log" optional(yes)); }; destination d_mesg { file("/var/log/messages"); }; destination d_app { file("/var/log/philotic/$PROGRAM.log"); }; destination d_app_event { file("/var/log/philotic/$PROGRAM-event.log"); }; destination d_philotic { file("/var/log/philotic/$PROGRAM.log"); }; filter f_info { level(info..emerg) }; filter f_default { level(info..emerg) and not ( facility(mail) or facility(authpriv) or facility(cron) or facility(local6) or facility(local5) or facility(14) ); }; filter f_app_event { facility(local3); }; filter f_app { facility(local6); }; filter f_philotic { facility(local5); }; log { source(s_sys); filter(f_default); destination(d_mesg); }; log { source(s_sys); filter(f_info); filter(f_app); destination(d_app); }; log { source(s_sys); filter(f_info); filter(f_app_event); destination(d_app_event); }; log { source(s_sys); filter(f_info); filter(f_philotic); destination(d_philotic); };

2 2

syslog-ng OSE 3.3 and 3.4 documentation updates
by Fekete Robert 25 Feb '13

25 Feb '13

Hi, I have released updated version of The syslog-ng Open Source Edition 3.4 Administrator Guide. This release should document every feature of OSE 3.4 - if something is missing or unclear, please let me know. Comments and bug reports are welcome. I have also released an updated version of the The syslog-ng Open Source Edition 3.3 Administrator Guide - this is mostly a bugfix release, and is intended to be the last release of the 3.3 guide. Please note that because of some website reorganization, the URL of the docs has changed, so old bookmarks and browser history will not work. You can find the docs at http://www.balabit.com/support/documentation , just select _syslog-ng_ and the version number (3.3 or 3.4). The documentation of older releases has been moved to http://www.balabit.com/downloads/files/archived_documents Regards, Robert

1 0

Log file sending to syslog
by a bv 25 Feb '13

25 Feb '13

Hi, I have log files which i like to send these logs as real time events to the syslog-ng running and mysql running which collects the real time logs. How can i do this? Regards

3 2

sending faile based logs to syslog
by a bv 25 Feb '13

25 Feb '13

Hi, I have a box runing syslog-ng and mysql and php based gui which gets logs squid etc boxes. and i have file based squid logs. Can i send these logs in to the syslog-ng (box) like a real time event and get the database record it? Regards

1 0

syslog-ng 3.3.7 coredump on solaris 10 Opteron
by Rakesh Rajasekharan 23 Feb '13

23 Feb '13

I have compiled the syslog-ng 3.3.7 on solaris in mixed-linking mode . But syslog-ng is not logging anything.. upon debugging i found that it gets core dump.. I have compiled ivykis and have tried using the --with-ivykis=system option as well. # /opt/soe/local/syslog-ng-3.3.7/sbin/syslog-ng -Fvde the last few lines of the above command are... Trying to open module; module='afstreams', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libafstreams.so' Attempted to register the same plugin multiple times, ignoring; context='source', name='sun-streams' Finishing include; content='source confgen system', depth='1' Running application hooks; hook='1' Running application hooks; hook='3' syslog-ng starting up; version='3.3.7' iv_fd_port_poll: got error 95[Socket operation on non-socket] Abort(coredump). any suggestions please..

2 2

syslog-ng selinux context Centos 5.9 (RHEL5)
by Stuart Green 21 Feb '13

21 Feb '13

Hi, I'm having some trouble with selinux blocking syslog-ng from creating directories type=1400 audit(1361437595.431:297527809): avc: denied { create } for pid=2835 comm="syslog-ng" name="21" scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:syslogd_var_run_t:s0 tclass=dir printk: 512913 messages suppressed. There is a line which seems to define this context in: /etc/selinux/targeted/contexts/files/file_contexts /var/log/syslog-ng(/.*)? system_u:object_r:syslogd_var_run_t:s0 If I manually change the context to var_log_t as per: /var/log/.* system_u:object_r:var_log_t:s0 then it creates the directory successfully. I believe the policy configuration is standard and undoctored so believe there could be a problem with it? Does anyone have a similar environment or some knowledge on this? greets -Stu

2 1

get Forbidden on online syslog-ng Documentation
by Stefan Sabolowitsch 19 Feb '13

19 Feb '13

Hi all, is can not actually access on this URL: https://code.seas.harvard.edu/seas-academic-computing/syslog-ng-patterndb/t… Yesterday it's was successful Any idea ? thx Stefan

1 0