- syslog-ng - lists.balabit.hu

[Bug 201] New: system() does not work on FreeBSD: /dev/ klog is pretty much ignored
by bugzilla＠bugzilla.balabit.com 13 Oct '12

13 Oct '12

https://bugzilla.balabit.com/show_bug.cgi?id=201 Summary: system() does not work on FreeBSD: /dev/klog is pretty much ignored Product: syslog-ng Version: 3.3.x Platform: All OS/Version: FreeBSD Status: ASSIGNED Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: algernon(a)balabit.hu ReportedBy: algernon(a)balabit.hu Type of the Report: --- Estimated Hours: 0.0 While debugging another problem, I found a couple of issues with system() on FreeBSD: * follow-freq(0) doesn't appear to work, so /dev/klog gets ignored outright * Even with follow-freq(1), we never read from /dev/klog, because stat() will report its size to be 0, so we never end up reading from it. The second is easy to fix, adding an || !S_ISREG(st.st_mode) to the appropriate condition in log_reader_io_follow_file() does the right thing. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

[Bug 200] New: logging does not work on FreeBSD
by bugzilla＠bugzilla.balabit.com 13 Oct '12

13 Oct '12

https://bugzilla.balabit.com/show_bug.cgi?id=200 Summary: logging does not work on FreeBSD Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: FreeBSD Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: czanik(a)balabit.hu Type of the Report: --- Estimated Hours: 0.0 Using the latest syslog-ng 3.4 git, with Algernon sandbox patches applied (to be able to generate a tar.gz dist file), logging does not seem to work. Without command line arguments, nothing gets logged, except for version information at startup. When using "-vdF", logs coming from the network are logged. Tested on FreeBSD 9.0 with a slightly modified sysutils/syslog-ng-rc port (removed utmp magic from ports Makefile). -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

cisco rewrite code
by Evan Rempel 12 Oct '12

12 Oct '12

Does anyone have a pre build set of patterns/rewrite rule to rewrite all cisco logs into something that is a little more compliant? We are trying to use a master pattern database to identify/classify messages, but the cisco logs don't have usable "program names" so the pattern database can't even get started :-( Thanks for any pointers. -- Evan

4 3

[PATCH (3.4)] afsocket: Use the "dgram" proto for dgram sockets
by Gergely Nagy 11 Oct '12

11 Oct '12

When applying a transport to a socket, don't just set the transport, but also set logproto_name properly: "dgram" for SOCK_DGRAM sockets, "text" for everything else. If this is not done, and our socket is SOCK_DGRAM, we'd use the text proto, which after the refactoring, would look for a terminating new line, instead of datagram boundary - and it wouldn't find it, which will result in partial messages accumulating in a buffer, to eventually be sent out as garbage. This patch simply makes it so that SOCK_DGRAM will use the "dgram" logproto, which does the right thing, and knows about datagram boundaries. Reported-by: Peter Czanik <czanik(a)balabit.hu> Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/afsocket/afunix.c | 8 ++++++-- 1 files changed, 6 insertions(+), 2 deletions(-) diff --git a/modules/afsocket/afunix.c b/modules/afsocket/afunix.c index 1a1465f..8849927 100644 --- a/modules/afsocket/afunix.c +++ b/modules/afsocket/afunix.c @@ -172,12 +172,16 @@ afunix_sd_apply_transport(AFSocketSourceDriver *s) if (!self->super.bind_addr) self->super.bind_addr = g_sockaddr_unix_new(self->filename); + self->super.logproto_name = "text"; + if (self->super.sock_type == SOCK_DGRAM) - afsocket_sd_set_transport(&self->super.super.super, "unix-dgram"); + { + afsocket_sd_set_transport(&self->super.super.super, "unix-dgram"); + self->super.logproto_name = "dgram"; + } else afsocket_sd_set_transport(&self->super.super.super, "unix-stream"); - self->super.logproto_name = "text"; return TRUE; } -- 1.7.9

1 0

syslog-ng Insider - October 2012
by Peter Czanik 11 Oct '12

11 Oct '12

Dear syslog-ng users, This is the 17th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com <mailto:documentation@balabit.com> FEATURED NEWS New AMQP destination driver --------------------------- An important milestone in syslog-ng's history is the AMQP destination driver, which is the first complete module contributed by a third party, and was not originated from within BalaBit! The destination allows syslog-ng to publish messages (using various exchange types) to an AMQP server such as RabbitMQ using an intuitive method: sending the headers selected by value-pairs() as headers, thereby solving the problem of how to serialize the payload: don't. For more information about the driver, see the announcement at: https://lists.balabit.hu/pipermail/syslog-ng/2012-October/019483.html A comparison of PE diskbuffer and the AMQP driver: http://algernon.blogs.balabit.com/2012/10/syslog-ng-amqp-and-disk-buffers/ Vote for syslog-ng Store Box to become the Best Computer Forensics Tool ------------------------------------------------------------------ We’re proud to announce we entered our syslog-ng Store Box appliance into the SC Awards US for the Best Computer Forensic Tool. Voting is now open until Oct 26. (requires registration or subscription to SC Magazine) so we kindly ask you visit https://www.bigpulse.com/m20086/intro to vote for us. We appreciate your help. syslog-ng 3.3.7RC2 is released ------------------------------ Version 3.3.7 is scheduled to arrive at the end of October, and a second release candidate was released for it (called version 3.3.6.91). It has many fixes for FreeBSD, so it should compile with the bundled ivykis on FreeBSD 8 and 9. Patches to compile it on FreeBSD 7 are included in the updated sysutils/syslog-ng-rc port: http://www.freshports.org/sysutils/syslog-ng-rc/ Packages for all supported or development versions of openSUSE are also available: https://build.opensuse.org/project/show?project=home%3Aczanik%3Asyslog-ng33 Announcement for 3.3.6.91: https://lists.balabit.hu/pipermail/syslog-ng/2012-October/019480.html OTHER SHORT NEWS * syslog-ng will be presented at two conferences in October: http://fedoraproject.org/wiki/FUDCon:Paris_2012 and http://conference.opensuse.org/ NEW RELEASES: * syslog-ng OSE 3.3.6.91: https://lists.balabit.hu/pipermail/syslog-ng/2012- <https://lists.balabit.hu/pipermail/syslog-ng/2012-October/019480.html>October/019480.html <https://lists.balabit.hu/pipermail/syslog-ng/2012-October/019480.html> ARCHIVE http://insider.blogs.balabit.com/ -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

challenges with SDATA
by Chris Johnson 09 Oct '12

09 Oct '12

I have successfully written parsers for unstructured logs, but would like to be able to leverage SDATA. Based on what I have researched so far, I have built the following skeleton conf file for writing to mongodb #####Filter##### filter f_session_close {message("RT_FLOW_SESSION_CLOSE");}; #####Destinations##### destination d_mongodb_close { mongodb( collection("close") value-pairs( scope(rfc5424 sdata) ) ); }; #####Log##### log { source(s_network); filter(f_session_close); destination(d_mongodb_close); }; With this in mind, I get the following logs with only the rfc5424 scope: "DATE" : "Oct 5 20:40:21", "FACILITY" : "user", "HOST" : "192.168.199.2", "MESSAGE" : "2012-10-05T20:40:20.444 SRX100 RT_FLOW - RT_FLOW_SESSION_CREATE [junos(a)2636.1.1.1.2.36 source-address=\"192.168.199.207\" source-port=\"55625\" destination-address=\"130.57.4.24\" destination-port=\"80\" service-name=\"junos-http\" nat-source-address=\"50.193.12.149\" nat-source-port=\"28178\" nat-destination-address=\"130.57.4.24\" nat-destination-port=\"80\" src-nat-rule-name=\"source-nat-rule\" dst-nat-rule-name=\"None\" protocol-id=\"6\" policy-name=\"trust-to-untrust\" source-zone-name=\"trust\" destination-zone-name=\"untrust\" session-id-32=\"61189\" username=\"N/A\" roles=\"N/A\" packet-incoming-interface=\"vlan.0\"]", "PRIORITY" : "info", "PROGRAM" : "1", "_id" : ObjectId("506fa825817f52de65000001") When using the SDATA scope, I only get an object id. None of the structured data is ever parsed. Is there something special I need to do to parse the structured portion of the messge? Chris

2 1

[Bug 151] New: syslog-ng opens /dev/ log device on every HUP without closing it first
by bugzilla＠bugzilla.balabit.com 08 Oct '12

08 Oct '12

https://bugzilla.balabit.com/show_bug.cgi?id=151 Summary: syslog-ng opens /dev/log device on every HUP without closing it first Product: syslog-ng Version: 3.3.x Platform: Other OS/Version: Solaris Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: michael.hocke(a)nyu.edu Type of the Report: bug Estimated Hours: 0.0 On Solaris 10 the /dev/log device can be held open concurrently for up to only 16 instances. syslog-ng opens a new instance of /dev/log after HUPing the process, i.e. after the 16th HUP syslog-ng quits because the new configuration fails and so does the previous configuration. This has been working fine in 3.0. I cannot test if this started to happen in 3.1, 3.2, or if this is new for 3.3. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 8

Strange error in /var/log/message about GPF (ip protection)
by Sebastien Pasche 06 Oct '12

06 Oct '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello I have some strange messages in my var/log/message about ip protection. Oct 5 16:54:01 mgblcof01 kernel: [1284555.180325] syslog-ng[9735] general protection ip:36104616f2 sp:7fba6e3304a0 error:0 in libglib-2.0.so.0.3200.4[3610400000+11d000] Any idea what would make syslog-ng having trouble with GPF ? My version of syslog-ng [root@mgblcof01 ]# syslog-ng --version syslog-ng 3.3.6.90 Installer-Version: 3.3.6.90 Revision: Compile-Date: Sep 20 2012 13:34:34 Default-Modules: affile,afprog,afsocket,afuser,basicfuncs,csvparser,dbparser,syslogformat,afsql Available-Modules: afsocket-tls,dbparser,afuser,syslogformat,afprog,confgen,csvparser,affile,dummy,basicfuncs,afsocket,afmongodb,tfjson,afsocket-notls,afsql,convertfuncs Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: on Enable-Pcre: on OS : [root@mgblcof01 ]# uname -a Linux mgblcof01 3.5.3-1.fc17.x86_64 #1 SMP Wed Aug 29 18:46:34 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux Thank ! Sébastien -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://www.enigmail.net/ iQIcBAEBAgAGBQJQbvbbAAoJEE3IBph3MKVPeM0P/js5cILHxgbACshcmcPPlXUH ELiDuP50QKkOHTzQOprK8kpBrRuzE2El5PuI0Tyyvbo4pF/Ehtlbe0donSh1w2aF vWGdj6EVxCtUDLJ3L2ZGiIxICyqDW/EDeSz04FGMp5pMdX++iVg2vnMuMic4kHsu OSaUWTdQ3v4ntC4HaI26xtnqjw7+egKND34ll2XgYFCMstTBwHdHwdXYWAD3KPBj jX+nqXgk5ADJybjAXS0u3TAb7rmPZsZ3cNn41i+15ed+I6ZcPGwkefFRsMmxbzrN wrwg+Dc2gk2ezP/Cdk5uZzlyYJe9R5AMeTeGvwPCaoEzznyAuDPlC+v+tF38KGri t+pEJ1Vy9QL1uqVAgj6aYzOzGZhAEimNfwBo/0WqV7DL2+FfT+5IyvIR9goRP+sS 7odfN9OyCnR3cYPSQLmtC4Xqlq4XwHE3BpIV364WArSblmGNpiuE3uMUwiHpjvrO mkSHzTmZLjvLfuJfV+ECC+xwBqVVStvB8r/upotFsT05ArQCJb5y+wJOlofPP3cg bQ+pGDw1Wf1OdyGj6n6ITu18VLKV1jx4XIkv3yTqbggffbAvuZ7XaUXVQQQYsaFT 4hIA2/YrMqEXK8HVHb1/zSD36bYzI/zrmUSs3H2opjW+b5doqmZ0KCYDgmvvnIEo wTdz8m7ZiQT+AJ8Lp+Ng =4lxl -----END PGP SIGNATURE-----

3 2

Syslog stops writing logs with extra [SQL] destination
by Anton Koldaev 05 Oct '12

05 Oct '12

Hello, I have the same "expr" logs going to file AND sql. With file-only logging it works great. When I'm enabling SQL logging it stops writing both to file and to sql ~1-10min(from 10 000 to 200 000 lines) after start. Every time there are no dropped messages, but 1000 stored for SQL location. syslog-ng 3.3.6 - number of nodes: ~150 - max-connections(200) - log_iw_size(20000) - log_fetch_limit(100) - log_fifo_size (400000); - flush_lines(100) - flush_timeout(100) - flags(flow-control) # the same issue with and without flow control syslog-server ~ % sudo syslog-ng-ctl stats | sort -rnk6 -t ";" | grep expr dst.file;d_app_expr#0;/logs/app/expr.log;o;processed;30457 destination;d_app_expr;;a;processed;30457 destination;d_mysql_expr;;a;processed;30003 * dst.sql;d_mysql_expr#0;mysql,mysql-db-ip,port,syslog_production,expr_${HOST}_${R_Y;a;stored;1000 * dst.sql;d_mysql_expr#0;mysql,mysql-db-ip,port,syslog_production,expr_${HOST}_${R_Y;a;dropped;0 dst.file;d_app_expr#0;/logs/app/expr.log;o;stored;0 dst.file;d_app_expr#0;/logs/app/expr.log;o;dropped;0 I see no errors in syslog-ng debug logs or mysql error log. After restarting syslog-ng it writes both logs for some time and stops again. I will appreciate any help. Additional question: is there any mysqltuner.pl-like tool for syslog-ng? I don't feel happy to tune all those buffers and windows manually with no being sure it will help. -- Best regards, Koldaev Anton

1 1

Re: [syslog-ng] I need some help with Syslog-ng and the new json parser
by Sebastien Pasche 05 Oct '12

05 Oct '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Thank a lot for the help. I tested with syslog-ng 3.4.0 alpha3 and its working but I use 3.3 :-( So I will use regex and move to json parser when 3.4 will be stable :) Thanks again ! Sébastien On 10/05/2012 12:00 PM, syslog-ng-request(a)lists.balabit.hu wrote: > Sebastien Pasche <braoru(a)gmail.com> writes: > >> > I will present to you what I want to do and what I actually have. >> > >> > I would like to extract a field from a json log arriving in this source : >> > >> > source s_collector_tcp_json { >> > tcp(ip(0.0.0.0) port(514) flags(no-multi-line) flags(no-parse)); >> > }; >> > >> > And replacing the Program field I use in my destination > [...] >> > from the field @type of this json log : >> > >> > { >> > "@source": "tcp://127.0.0.1:9999/client/127.0.0.1:57530", >> > "@type": "tomcat_logstash_raw_json", >> > "@tags": [ >> > "tomcat_site" >> > ], >> > "@fields": { >> > "priority": "INFO", >> > "logger_name": "com.zzz.user.UserData", >> > "thread": "TP-Processor7", >> > "class": >> > "org.apache.jsp.WEB_002dINF.jsp.user.ViewInvoiceDetail_jsp", >> > "file": "ViewInvoiceDetail_jsp.java:162", >> > "method": "_jspService", >> > "prop_userIp": "192.168.215.50", >> > "prop_userId": "1440704" >> > }, >> > "@source_host": "127.0.0.1:57530", >> > "@source_path": "com.leshop.user.UserData", >> > "@message": "order : {WAREHOUSE_TYPE=drive, OID=5693367, >> > ORDER_DATE=2012-10-03 08:49:17.41, SHIPPING_FRESH=0.0, >> > FROZEN_DEPOSIT=0.0, WAREHOUSE_ID=5, DUE_AMOUNT=0.0, TOTAL_CREDITS=0.0, >> > ADDRESS_NUMBER=, DELIV_HELPFUL_INDICATION=, DELIVERY_MODE=20:00, >> > DELIVERY_DATE=2012-10-03 00:00:00.0, TOTAL=134.75, ACTION_TOTAL=0.0, >> > ORDER_NUMBER=abc-014085706-xyz, TRACK_TRACE=, RETAILER_GROUP=0, ZIP=, >> > ORDER_STATE=3, PAYMENT_TYPE=7, DELIV_DOORCODE=, FROZEN_FEES=0.0, >> > ENV_CO2=0.0, NAME= , ENV_CO2_RETAIL=0.0, HIDE_BVR=false, ADDRESS=, >> > TOTAL_CREDIT=0.0, MODIFICATION_STATE=1, REMINDER_LEVEL=0, >> > SUBTOTAL=134.75, GRAND_TOTAL=134.75, BVR_REFERENCE=, CITY=, >> > DELIV_PHONE=, SHIPPING_FIXED=0.0}", >> > "@timestamp": "2012-10-03T06:49:23.373000Z" >> > } > [...] > > Assuming that the JSON arrives on a single line, something along these > lines should do the trick: > > parser p_tomcat_json { > json-parser(prefix("json.")); > }; > > rewrite rw_tomcat_site_logstash_json_program_name { > set("${json.type}", value("$PROGRAM")); > }; > > And then chain it together: > > log { > source(s_collector_tcp_json); > parser(p_tomcat_json); > rewrite(rw_tomcat_site_logstash_json_program_name); > destination(d_file_normal_r); > }; > > Hope that helps! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://www.enigmail.net/ iQIcBAEBAgAGBQJQbrE/AAoJEE3IBph3MKVPidkQALooeGZRm2FEIGPN7uqJVrRc 2yeQ0L68Nny0WLnR2mZU4nOy7EHMKLPufrYINAp1FyNM7U4xDOkLTxoVhkPtejis hKce2Z/djJX1cABlPl0qf3ClBsSnH7oe745BvSdXUnBXFGc7mBV7E10GF4tb4Ce/ ElUUEx2UyIfCByOcETOJkvZrY1WSky1MqJZLI5dX2BzjKsdBML5Bmi/pj1VVRCaa WUC6lkSnGUdoyAdVCF7hHzNwQbm1txTUjsdo1oUvdaly4ASDkHWuHhRXsNw9gugA 3TRNugj/69oeOzxZkt/eVukpcK2JbeJ6UGVWpYe8Vo3x5slHXT5tObOcIni4eCYU /DnGFs7UT1nGmQ8HYTkytgnDUa3dpAcVU60xdyLsjkx7WPUmLjKJcKD//cXdJXH/ uzI3WvEEqnPqb3oRJfNqrR0Ikn1tF0jOHpJxeW3lQIYMaadahdTUQ1dhccycUWrB ISEoy1tFSUJepOHcZf+RGRTopxJVxvpK7JondR3oV0BMDf00Vgu8SLmuWl/ok3aZ KFAZ019kMYX1Bq0sCAtOyJwWzIXUFEtMz8rEkc1V0fbAI032WY6IzUecWuLGM783 uZ/C2bDBR2Xgbs/oDMhZImKJzjouN8IGuNK9ZaRMH0Qx0dx4wjc8QORD9hB2kmmF lEjQIEQ8D8ADAavqwURp =pUIX -----END PGP SIGNATURE-----

1 0

I need some help with Syslog-ng and the new json parser
by Sebastien Pasche 04 Oct '12

04 Oct '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello :) I will present to you what I want to do and what I actually have. I would like to extract a field from a json log arriving in this source : source s_collector_tcp_json { tcp(ip(0.0.0.0) port(514) flags(no-multi-line) flags(no-parse)); }; And replacing the Program field I use in my destination : #Destination that uses received time as timestamp for logs destination d_file_normal_r {file("/var/log/leshop/leshop_log/$R_YEAR/$HOST/$PROGRAM/$R_YEAR-$R_MONTH-$R_DAY.log" template(t_d_default_r) group(users) dir_group(users) perm(0640) dir_perm(0750) flags(no-multi-line) frac_digits(6));}; #Templates for destination that uses received time as timestamp for logs template t_d_default_r { template("$R_ISODATE $HOST LEVEL=$LEVEL $MSGHDR $MSG\n"); }; from the field @type of this json log : { "@source": "tcp://127.0.0.1:9999/client/127.0.0.1:57530", "@type": "tomcat_logstash_raw_json", "@tags": [ "tomcat_site" ], "@fields": { "priority": "INFO", "logger_name": "com.zzz.user.UserData", "thread": "TP-Processor7", "class": "org.apache.jsp.WEB_002dINF.jsp.user.ViewInvoiceDetail_jsp", "file": "ViewInvoiceDetail_jsp.java:162", "method": "_jspService", "prop_userIp": "192.168.215.50", "prop_userId": "1440704" }, "@source_host": "127.0.0.1:57530", "@source_path": "com.leshop.user.UserData", "@message": "order : {WAREHOUSE_TYPE=drive, OID=5693367, ORDER_DATE=2012-10-03 08:49:17.41, SHIPPING_FRESH=0.0, FROZEN_DEPOSIT=0.0, WAREHOUSE_ID=5, DUE_AMOUNT=0.0, TOTAL_CREDITS=0.0, ADDRESS_NUMBER=, DELIV_HELPFUL_INDICATION=, DELIVERY_MODE=20:00, DELIVERY_DATE=2012-10-03 00:00:00.0, TOTAL=134.75, ACTION_TOTAL=0.0, ORDER_NUMBER=abc-014085706-xyz, TRACK_TRACE=, RETAILER_GROUP=0, ZIP=, ORDER_STATE=3, PAYMENT_TYPE=7, DELIV_DOORCODE=, FROZEN_FEES=0.0, ENV_CO2=0.0, NAME= , ENV_CO2_RETAIL=0.0, HIDE_BVR=false, ADDRESS=, TOTAL_CREDIT=0.0, MODIFICATION_STATE=1, REMINDER_LEVEL=0, SUBTOTAL=134.75, GRAND_TOTAL=134.75, BVR_REFERENCE=, CITY=, DELIV_PHONE=, SHIPPING_FIXED=0.0}", "@timestamp": "2012-10-03T06:49:23.373000Z" } I know I can do it with patterndb or directly with a regex like . #match and create a group with le type value filter f_bigip_http_vs_extract { match('"@type": "([^\"]+)",' value("MESSAGE") type("pcre") flags("store-matches" "ignore-case")); }; #replace program field with extracted value from le log line rewrite rw_tomcat_site_logstash_json_program_name { subst('.*', "${1}", value("PROGRAM"));}; But I would like to use the new json parser to keep a configuration as clean as possible. Anyone can help me to know where I need to start ? (not found anyting into the admin guide :/) My version of syslog-ng : [root@mgblcof01 192.168.217.205]# syslog-ng --version syslog-ng 3.3.6.90 Installer-Version: 3.3.6.90 Revision: Compile-Date: Sep 20 2012 13:34:34 Default-Modules: affile,afprog,afsocket,afuser,basicfuncs,csvparser,dbparser,syslogformat,afsql Available-Modules: afsocket-tls,dbparser,afuser,syslogformat,afprog,confgen,csvparser,affile,dummy,basicfuncs,afsocket,afmongodb,tfjson,afsocket-notls,afsql,convertfuncs Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: on Enable-Pcre: on Thank ! Seb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://www.enigmail.net/ iQIcBAEBAgAGBQJQbStAAAoJEE3IBph3MKVPpZgP/0fyydXA3dBwBm4/A66DsJCJ DfsGtQYVEXMgtQhit+nh47ruBvl6O+E6XPTnL2vKjObKr8J7A1gy3Zsf6CAzkBod Wxs74wPHOvy8UIRRmzDl2rU+xv0Ak84lN7ngFjgJZpqlqajlPyfj48dKPwINV80X 3hZLpFHXD0y0T8JoL30rm35nbDMVfRBqFnLd5U4J8dMBZ6O8Y0bnYvPZ65GR3M0S L8x3cc4suOBSg/PEF4FAL/j/QMCTAnGvntIFN4pYOU9qkXixqtwheJ2EenzI+W2M mcs8VPWjRAfgg2w3gzy3UOGMgogHS2yR9guqHowGOeTuVfKEO1D7ZaP1MRHEfATj AdJVNGuDilquJwuLCLUwinvp68BpcJ1cM5E2t5P7FwZJQxfX8MJrGwQ+4bF2pvhI YzIRGHDmB888CRNYoyyrFCoXkjZ3/Nd8FxSx2BBhb3PNRgEkNWgfbkuAr422W+Ni ZzzDrD5Rpl7E7Fzz7Xb2XAxJJS7E+tj5d/ukD3PGFFfr6kXNHwfQyxCCgQOt93+2 zuSYGg0QPpztyK4y83NXaM+L7dYsP75pG24FhnUQFvA164sOKqT/i4/4mgu6u8pF ZX1Ji//fa2CfqEw0nhmrZxYYwXi4HYZ8uUd6MpQSfE04J5ymyOcrWa7wVBN+jlev Ts/ZAjTBDJku7JYLBmSf =VpL2 -----END PGP SIGNATURE-----

2 1

how to convert multiline message to single line?
by Sergey V. Lobanov 03 Oct '12

03 Oct '12

Hello, I'd like to see multiline syslog messages as one line. Is it possible via syslog-ng 3.0? -- wbr, Sergey V. Lobanov Timezone: MSK(GMT+4)

4 6

[PATCH] afmongodb: Include libmongo-client/configure.gnu in the tarball
by Gergely Nagy 02 Oct '12

02 Oct '12

In order to install cleanly with an internal libmongo-client, we need that library to be compiled in statically, which is what the configure.gnu script (installed via autogen.sh from git) enforces. However, since configure.gnu is not part of libmongo-client, its make dist will not include it, so its parent must do that. For this reason, and similarly to how the same file in lib/ivykis is handled, include libmongo-client/configure.gnu in the EXTRA_DIST of afmongodb/Makefile.am. Reported-by: Peter Czanik <czanik(a)balabit.hu> Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/afmongodb/Makefile.am | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/modules/afmongodb/Makefile.am b/modules/afmongodb/Makefile.am index d022912..eb6b27b 100644 --- a/modules/afmongodb/Makefile.am +++ b/modules/afmongodb/Makefile.am @@ -17,7 +17,7 @@ libafmongodb_la_LDFLAGS = $(MODULE_LDFLAGS) endif BUILT_SOURCES = afmongodb-grammar.y afmongodb-grammar.c afmongodb-grammar.h -EXTRA_DIST = $(BUILT_SOURCES) afmongodb-grammar.ym +EXTRA_DIST = $(BUILT_SOURCES) afmongodb-grammar.ym libmongo-client/configure.gnu include $(top_srcdir)/build/lex-rules.am -- 1.7.9

1 0

[PATCH 1/2] json: Include all sources in _SOURCES
by Gergely Nagy 02 Oct '12

02 Oct '12

With the renaming and such the list of sources required to build the plugin got out of sync with reality. This patch corrects that, by adding the two new headers, and removing an old, unused one. Reported-by: Peter Czanik <czanik(a)balabit.hu> Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/json/Makefile.am | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/modules/json/Makefile.am b/modules/json/Makefile.am index 110b1b5..3338ff5 100644 --- a/modules/json/Makefile.am +++ b/modules/json/Makefile.am @@ -9,10 +9,11 @@ module_LTLIBRARIES = libjson-plugin.la libjson_plugin_la_SOURCES = \ format-json.c \ + format-json.h \ jsonparser.c \ + jsonparser.h \ jsonparser-grammar.y \ jsonparser-parser.c jsonparser-parser.h \ - json-plugin.h \ json-plugin.c libjson_plugin_la_CPPFLAGS = $(AM_CPPFLAGS) -- 1.7.9

1 1

Re: [syslog-ng] Syslog_NG
by Munh-Erdene E 02 Oct '12

02 Oct '12

Dears,,, Tnx for your quickly reply. :) I've 1 syslog-ng server and 8 clients in my network. Syslog-Ng server collecting all log of that clients. But syslog-ng can collecting only bash & sh shell logs. Can't collect all command log off csh, tcsh ... etc. other shells... BR--- Munkh-Erdene On Mon, Oct 1, 2012 at 10:47 PM, Gergely Nagy <algernon(a)balabit.hu> wrote: > Hi! > > I would like to ask you to write to the syslog-ng mailing list > (https://lists.balabit.hu/mailman/listinfo/syslog-ng) with syslog-ng > questions instead of contacting me directly. > > However, I will try to answer your mail here now, since I'm a little > confused about what you're trying to accomplish. > > Munh-Erdene E <munhluu(a)gmail.com> writes: > > > Syslog_NG works fine with bash & sh shells &&& writing clientlogs on > > server. > > > > But not working other shells, example: csh, ksh, tscsh ... > > > > In Client side: > > Add some config on *Vi /etc/bashrc * > > > > # log to syslog > > > > declare ME > > > > ME=$(awk -v val=$UID -F ":" '$3==val{print $1}' /etc/passwd) > > > > export PROMPT_COMMAND='{ msg=$(history 1 | { read x y; echo $y; }); > logger > > -p local5.info "CMDLOG PWD=$PWD ; USER=$ME ; COMMAND=$msg"; }' > > > > > > > > *2. Vi /etc/rsyslog.conf* > > > > > > > > *.info;mail.none;authpriv.none;cron.none @192.168.0.1 > > > > authpriv.* @192.168.0.1 > > > > Can you help me? pls > > I don't really see where syslog-ng comes into play here? Neither logger > nor rsyslog have much to do with syslog-ng itself. Nor should any shell > or whatsoever affect syslog-ng, as it's a daemon that should be started > at boot time, the shell you use need not have any effect on its > behaviour. > > -- > |8] > >

2 1

[Bug 199] New: syslog-ng 3.3.6. 90 sometimes exits on SIGHUP on Solaris 10 SPARC
by bugzilla＠bugzilla.balabit.com 28 Sep '12

28 Sep '12

https://bugzilla.balabit.com/show_bug.cgi?id=199 Summary: syslog-ng 3.3.6.90 sometimes exits on SIGHUP on Solaris 10 SPARC Product: syslog-ng Version: 3.3.x Platform: Other OS/Version: Solaris Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: irwin(a)princeton.edu Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=66) --> (https://bugzilla.balabit.com/attachment.cgi?id=66) configure.out Version: syslog-ng 3.3.6.90 Platform: Solaris 10 on SPARC I've been running syslog-ng 3.0.6 fine for several years. I've been trying to upgrade to 3.3.latest. When I upgraded to 3.3.6, syslog-ng would sometimes quit and dump core unexpectedly when I sent it SIGHUP as part of log file rotation. I figured it might be an ivykis issue perhaps related to https://bugzilla.balabit.com/show_bug.cgi?id=190 , so I've just tried upgrading to 3.3.6.90. But the error I see remains the same. Log message: Sep 26 03:00:03 example.org supervise/syslog-ng[23280]: Daemon exited due to a deadlock/signal/failure, restarting; exitcode='131' Here's the core dump's backtrace: gdb /usr/local/sbin/syslog-ng /var/core/core.syslog-ng.0.23281 GNU gdb (GDB) 7.4 ... Reading symbols from /var/local/sbin/syslog-ng...done. [New LWP 1] [New LWP 2] [New LWP 3] [Thread debugging using libthread_db enabled] [New Thread 1 (LWP 1)] [New Thread 2 (LWP 2)] [New Thread 3 (LWP 3)] Core was generated by `/usr/local/sbin/syslog-ng --cfgfile /etc/syslog-ng/main.conf --pidfile /var/run'. Program terminated with signal 3, Quit. #0 0xfef4e068 in kill () from /lib/libc.so.1 (gdb) bt #0 0xfef4e068 in kill () from /lib/libc.so.1 #1 0xff2b4c24 in main_loop_reload_config_apply () at mainloop.c:518 #2 0xff2b4640 in main_loop_io_worker_sync_call (func=0xff2b4a20 <main_loop_reload_config_apply>) at mainloop.c:455 #3 0xff2d68c8 in iv_signal_event (_this=0xff30ddfc) at iv_signal.c:169 #4 0xff2d62b8 in iv_event_raw_got_event (_this=0xff30de20) at iv_event_raw.c:87 #5 0xff2d3d38 in iv_run_active_list (active=<optimized out>, st=<optimized out>) at iv_main.c:235 #6 iv_main () at iv_main.c:279 #7 0xff2b4474 in main_loop_run () at mainloop.c:735 #8 0x00011538 in main (argc=1, argv=0xffbffd4c) at main.c:263 -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

Problem with csv-parser
by Tracy Dalzell 26 Sep '12

26 Sep '12

I am having a problem with the csv-parser. I expect the parser to not include the single quotes in the MACRO (column). It does not include the single quotes for the first column (id) but they are included for every column after the first one. Relevent details below: parser p_apistats { db-parser(file("/etc/syslog-ng/apilogs.xml"));}; parser p_apistats returns ${VALUES} = 'b8144eea3646a7bc47169e0b9cc5f575', '555.55.55.555', 'web07.myhost.com' parser p_apistatscsv { csv-parser(columns(id, ip, host) delimiters(",") flags(greedy,strip-whitespace) template("${VALUES}")); }; destination d_test { file("/var/log/splunk/$HOST" template("{ \"id\" : \"${id}\" \"ip\" : \"${ip}\" \"host\" : \"${host}\" }\n")); }; log { source(s_remote); parser(p_apistats); parser(p_apistatscsv); destination(d_test); }; Results: { "id" : "b8144eea3646a7bc47169e0b9cc5f575" "ip" : "'555.55.55.555'" "host" : "'web07.myhost.com'" }

1 0

[Bug 197] New: Characters lost when sending message over network that begins with {
by bugzilla＠bugzilla.balabit.com 25 Sep '12

25 Sep '12

https://bugzilla.balabit.com/show_bug.cgi?id=197 Summary: Characters lost when sending message over network that begins with { Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bfield.wrk(a)gmail.com Type of the Report: --- Estimated Hours: 0.0 When sending a message that begins with { over the network the leading parenthesis and white space are lost. I've tested this on 3.3.4 with a manually compiled version and the version distributed with Ubuntu. Both are impacted by this bug. Here is a simple configuration to try: --------- syslog-ng.conf --------- source s_src { system(); }; source s_udp { udp(ip(127.0.0.1)); }; destination d_testfile { file("/var/log/test_json" template("$MSG\n")); }; destination d_udp_addparen { udp("127.0.0.1" template("{ second: { $MSG\n")); }; destination d_filedirect { file("/var/log/test_jsondirect" template("{ second: { $MSG\n")); }; log { source(s_src); destination(d_udp_addparen); destination(d_filedirect); }; log { source(s_udp); destination(d_testfile); }; -------- end syslog-ng.conf ------- # echo "{ json type message }" | logger # tail /var/log/test_jsondirect { second: { { json type message } # tail /var/log/test_json second: { { json type message } -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[PATCH] system-source: Correct a typo in the unix-dgram() part
by Gergely Nagy 25 Sep '12

25 Sep '12

From: Gergely Nagy <algernon(a)madhouse-project.org> The option is called perm(), not perms(). Reported-by: Peter Czanik <czanik(a)balabit.hu> Signed-off-by: Gergely Nagy <algernon(a)madhouse-project.org> --- modules/system-source/system-source.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/system-source/system-source.c b/modules/system-source/system-source.c index 9ba0480..929a5f8 100644 --- a/modules/system-source/system-source.c +++ b/modules/system-source/system-source.c @@ -41,7 +41,7 @@ system_sysblock_add_unix_dgram(GString *sysblock, const gchar *path, { g_string_append_printf(sysblock, "unix-dgram(\"%s\"", path); if (perms) - g_string_append_printf(sysblock, " perms(%s)", perms); + g_string_append_printf(sysblock, " perm(%s)", perms); g_string_append(sysblock, ");\n"); } -- 1.7.10

1 0

[Bug 196] New: syslog-ng fails to compile with json-c >= 0.10
by bugzilla＠bugzilla.balabit.com 25 Sep '12

25 Sep '12

https://bugzilla.balabit.com/show_bug.cgi?id=196 Summary: syslog-ng fails to compile with json-c >= 0.10 Product: syslog-ng Version: 3.3.x Platform: All OS/Version: All Status: ASSIGNED Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: algernon(a)balabit.hu ReportedBy: algernon(a)balabit.hu Type of the Report: bug Estimated Hours: 0.0 The json-c 0.10 release changed how it serializes data, and that in turn broke syslog-ng, as we relied on the old not-all-that-public interface. Bumping the version requirement to >= 0.10 would not be wise, so syslog-ng should support both. I have a fix already, but that currently depends on other work I did starting from the 3.4 branch, so it needs to be backported to 3.3. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

Can't seem to do a simple parse
by Tracy Dalzell 21 Sep '12

21 Sep '12

I am trying to do a very simple parsing test to reformat a message using syslog-ng 3.3.6 and I can't seem to use the value of my macro (mystring): patterndb (test.xml): <patterndb version='4' pub_date='2012-09-21'> <ruleset name='test' id='123456678'> <pattern>test</pattern> <rules> <rule provider='me' id='182437592347598' class='system'> <patterns> <pattern>@STRING:mystring: @</pattern> </patterns> </rule> </rules> </ruleset> </patterndb> pdbtool results: [root@loghost01 syslog-ng]# pdbtool match -c -D -v -p test.xml -P test -M "INSERT INTO Test (id, value) VALUES (1, .044212)" Pattern matching part: @STRING:mystring=INSERT INTO Test @ Matching part: INSERT INTO Test Values: MESSAGE=INSERT INTO Test (id, value) VALUES (1, .044212) PROGRAM=test .classifier.class=unknown TAGS=.classifier.unknown relevent syslog-ng.conf lines: source s_remote { tcp(); }; parser p_test { db-parser(file("/etc/syslog-ng/test.xml")); }; destination d_test { file("/var/log/splunk/$HOST" template("Here is the message: ${R_DATE} ${mystring}\n")); }; log { source(s_remote); parser(p_test); destination(d_test); };\n")); }; Results from logger "INSERT INTO Test (id, value) VALUES (1, .044212)" on client are: Here is the message: Sep 21 16:46:53 Value of ${mystring} is null. What am I missing?

2 2

syslog-ng Insider - September 2012
by Peter Czanik 20 Sep '12

20 Sep '12

Dear syslog-ng users, This is the 16th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com <mailto:documentation@balabit.com> FEATURED NEWS syslog-ng 3.3.6 is released --------------------------- There was a new release for the syslog-ng stable line: version 3.3.6 There are mostly bugfixes in this release but also some smaller but long waited features: * the @include statement now accepts globs * upstream ivykis is used * better systemd support The change to upstream ivykis introduced a bug on FreeBSD and some other problems were also discovered. Version 3.3.7 is scheduled to arrive at the end of October, and there is now a 3.3.6.90, aka 3.3.7RC available for testing. Announcement for 3.3.6: https://lists.balabit.hu/pipermail/syslog-ng-announce/2012-August/000146.ht… Announcement for 3.3.6.90: https://lists.balabit.hu/pipermail/syslog-ng/2012-September/019365.html syslog-ng 3.4 news ------------------ Although there aren't any new alpha releases yet, there are already plenty of news for the development branch aswell! * The MongoDB destination received a major speed boost, and work is underway to make it even more performant. * The $(format-json) function now supports nested structures * There's a MAC address parser available for patterndb * A couple of new template functions were introduced, $(md5), $(sha1) and others. * The unit tests were improved upon greatly, and many many bugs were squashed aswell. For the complete list of changes, you can browse the commit messages at https://github.com/balabit/syslog-ng-3.4/commits/master And while there, check out the sources and give it a try, feedback is appreciated, help us make syslog-ng even better! SSB 3 LTS: wildcard search in logspaces --------------------------------------- The third important new feature in SSB 3 LTS is the ability to search within log messages using wildcard characters. It is indeed a small and simple change on the surface, but brings a lot of new possibilities. Read about the details at http://gyp.blogs.balabit.com/2012/07/new-features-in-ssb-3-lts-wildcard-sea… OTHER SHORT NEWS * syslog-ng ports in FreeBSD explained: https://czanik.blogs.balabit.com/2012/09/syslog-ng-rc/ * syslog-ng will be presented at two conferences in October: http://fedoraproject.org/wiki/FUDCon:Paris_2012 and http://conference.opensuse.org/ NEW RELEASES: * syslog-ng OSE 3.3.6: https://lists.balabit.hu/pipermail/syslog-ng-announce/2012-August/000146.ht… * syslog-ng OSE 3.3.6.90: https://lists.balabit.hu/pipermail/syslog-ng/2012-September/019365.html CASE STUDY: * University of Victoria: http://www.balabit.com/support/documentation/syslog-ng_cs_uvic_en.pdf ARCHIVE http://insider.blogs.balabit.com/ -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

[PATCH 0/7] value-pairs dot notation walker
by Gergely Nagy 16 Sep '12

16 Sep '12

The patches that will follow this overview soon implement a 'walker' for value-pairs, a way to walk the internal flat structure syslog-ng uses as if it was a tree. This is important for two modules in particular: $(format-json) and the mongodb destination. The latter already supportes storing structured data, but it is using upserts (with all its downsides) to accomplish that. The former - up until now - was only able to format flat JSON. With these patches, both change: $(format-json) becomes able to emit structured data, and the mongodb destination starts to use inserts. The patches also merge the tfjson and jsonparser modules into a single json module, and implements our own JSON formatting for $(format-json). This means that json-glib support is completely removed, as it became unnecessary, and json-c is only used by the parser, but for practical reasons, required to build the plugin. That is, it is no longer possible to build $(format-json) only, but not json-parser, nor the other way around. The final patch is a bonus, that corrects a small error in jsonparser, and stops it from emitting an assertion warning on stderr in certain cases.

3 9

syslog-ng 3.3.7 RC1 (3.3.6.90) released
by Gergely Nagy 14 Sep '12

14 Sep '12

Hi! As promised earlier, I prepared a release candidate for the upcoming syslog-ng 3.3.7 release (due october 31), with the most pressing bugs already fixed. Testing this release candidate and reporting any and all issues found with it - be those regressions or anything else - would be greatly appreciated! The current state of the NEWS file is included below, and if anyone wants to track how the release is progressing and what needs to be fixed still before the final release, see the 3.3.7 target milestone on bugzilla: https://bugzilla.balabit.com/buglist.cgi?query_format=advanced&target_miles… The release is available from the following sources: GitHub ------ The release is tagged as v3.3.6.90 on the official repository at git://github.com/balabit/syslog-ng-3.3.git Tarball ------- A make dist tarball built from the same tag is available from my package repository: http://packages.madhouse-project.org/syslog-ng/3.3/3.3.6.90/syslog-ng-3.3.6… And finally, the NEWS file from the release: 3.3.6.90 (3.3.7 RC1) Thu, 06 Sep 2012 14:00:00 +0200 Bugfixes ======== * The bundled ivykis has been updated to fix two bugs found after the 3.3.6 release was tagged: * Fixed a Solaris-specific issue relating to TCP sources [#190] * Fixed a spinlock issue, triggered on at least FreeBSD [#193] * The glob-based configuration file inclusion was fixed to behave similarly to including a whole directory, to include files alphabetically. [#191] * Fixed a crash when trying to display the available modules in debug mode. [#189] * Fixed the building of afsocket-notls, so that it is correctly built without TLS support. [#188] * Fix compilation without spoof-source. [#192] Credits ======= syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Balazs Scheidler <bazsi(a)balabit.hu> Cy Schubert <cy(a)FreeBSD.org> Dave Reisner <dreisner(a)archlinux.org> Gergely Nagy <algernon(a)balabit.hu> Jose Pedro Oliveira <jpo(a)di.uminho.pt> Lennert Buytenhek <buytenh(a)wantstofly.org> Marvin Nipper <marvin.nipper(a)stream.com> Peter Czanik <czanik(a)balabit.hu> Tamas Pal <folti(a)balabit.hu> -- |8]

5 5

Syslog-ng configuration for network source (udp)
by Alex Clone 12 Sep '12

12 Sep '12

Hello, I am trying to "read" a log stream from interface eth0 and to save it in a file (/var/log/messages_tcp). I am newbie on the use of syslog-ng but I try to learn reading the official manual and a lot of configuration examples. Although, I have try a lot of different configurations, the result is always the same : Syslog-ng cannot read the streaming data. I hope that you can help me. That's the version of syslog-ng that I use: *~# /usr/local/syslog-ng/sbin/syslog-ng -V syslog-ng 3.2.4 Installer-Version: 3.2.4 Revision: ssh+git://bazsi@git.balabit //var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#ef7b91e4a1b1f9628c66138b4ae83de7e4c697c6 Compile-Date: Sep 6 2012 14:36:19 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: on Enable-Pcre: on Enable-Pacct: off* There is an incoming log stream in eth0 (udp), as you can see next : *~# tcpdump -i eth0 udp 'port 514' -v tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes 06:05:58.669992 IP (tos 0x0, ttl 254, id 20209, offset 0, flags [none], proto UDP (17), length 82) 172.29.1.6.syslog-ng > 172.30.6.70.syslog-ng: SYSLOG, length: 54 Facility local4 (20), Severity debug (7) Msg: %ASA-7-609001: Built local-host WAN:172.30.254.4\0x0a 06:05:58.670134 IP (tos 0x0, ttl 254, id 52, offset 0, flags [none], proto UDP (17), length 85) 172.29.1.6.syslog-ng > 172.30.6.70.syslog-ng: SYSLOG, length: 57 Facility local4 (20), Severity debug (7) Msg: %ASA-7-609001: Built local-host outside:172.26.10.4\0x0a ………..* The syslog-ng.conf that I use is the following: * @version: 3.2 options { chain_hostnames(off); long_hostnames(off); use_dns(no); # We don't want DNS names, IP's only. flush_lines(0); stats_freq(43200); time_reopen(10); }; source s_network { # tcp(ip("172.30.6.70") port(514)); # udp(ip("172.30.6.70") port(514)); # syslog( # flags(no-multi-line) # ip(172.30.6.70) # keep-alive(yes) # keep_hostname(yes) # transport(udp) # TLS Options # tls() # ); tcp(); udp(); }; destination d_tcp { file("/var/log/messages_tcp" owner("root") group("adm") perm(0640)); }; log { source(s_network); destination(d_tcp); }; * When I start syslog-ng in debug mode (syslog-ng -Fevd) the results are the followings: *~# /usr/local/syslog-ng/sbin/syslog-ng -Fevdt Trying to open module; module='syslogformat', filename='/usr/local/syslog-ng-3.2.4/lib/syslog-ng/libsyslogformat.so' Trying to open module; module='basicfuncs', filename='/usr/local/syslog-ng-3.2.4/lib/syslog-ng/libbasicfuncs.so' Trying to open module; module='afsocket', filename='/usr/local/syslog-ng-3.2.4/lib/syslog-ng/libafsocket.so' Trying to open module; module='affile', filename='/usr/local/syslog-ng-3.2.4/lib/syslog-ng/libaffile.so' Trying to open module; module='afprog', filename='/usr/local/syslog-ng-3.2.4/lib/syslog-ng/libafprog.so' Trying to open module; module='afuser', filename='/usr/local/syslog-ng-3.2.4/lib/syslog-ng/libafuser.so' Trying to open module; module='dbparser', filename='/usr/local/syslog-ng-3.2.4/lib/syslog-ng/libdbparser.so' Trying to open module; module='csvparser', filename='/usr/local/syslog-ng-3.2.4/lib/syslog-ng/libcsvparser.so' Running application hooks; hook='1' Running application hooks; hook='3' syslog-ng starting up; version='3.2.4' ^CTermination requested via signal, terminating; syslog-ng shutting down; version='3.2.4' Closing log transport fd; fd='6' Running application hooks; hook='4'* As you can see there is no "Incoming log entry..:" line. I pressed Ctrl+C for the termination of program. Also listening to the network interface seems to be right: *~# netstat -tanpu | grep syslog tcp 0 0 0.0.0.0:514 0.0.0.0:* LISTEN 25950/syslog-ng udp 0 0 0.0.0.0:514 0.0.0.0:* 25950/syslog-ng * Please, can anyone help me with this problem? I don't know what could be blocking the packets, if it is because of the OS or because of syslog-ng configuration.What could it be wrong? I am waiting for your response. PS. Sorry for my "bad" English. Thanks is advance, Alex

3 4