- syslog-ng - lists.balabit.hu

Debug connection issue. no "connection accepted" logs
by Evan Rempel 02 Jul '26

02 Jul '26

I'm not sure when this stopped but version 4.11.0 is not logging the lines of Syslog connection accepted; fd='1686', client='AF_INET(1.2.3.4:53538)', local='AF_INET(5.6.7.8:601)' I am unable to find a setting that might enable this. The logs contain many other "internal" log messages. syslog-ng starting up; version='4.11.0' Syslog connection established; fd='29', server='AF_INET(127.0.0.1:1514)', local='AF_INET(5.6.7.8:0)' Accepting connections; listen_fd='13', addr='AF_INET(5.6.7.8:601)' Loading the new configuration; Configuration reload finished; My system running version syslog-ng-4.6.0 logs the "connection accepted" for all new connections. Any help to enable the "connection accepted" log lines would be awesome. -- Evan

2 1

Question re: syslog-ng TLS and monitoring of the certificate
by Chris Moody 05 Jun '26

05 Jun '26

Hello everyone. Wanted to first send a huge thank you to everybody for this kick-@$$ software. I have been evangelizing its use since hell, the earliest releases in the late 90's. Built everything from global anycast aggregators to single-instances and everything betweeen. I do have a question however about TLS handling. I have a client that has a request to have frequent health-checks for the validity of their certificates throughout their infrastructure (OMD/naemon/custom plugins to the rescue). I have this working great for common services that can be checked via some scripts utilizing 'openssl s_client -connect' and parsing the output. Where I am stumbling into some trouble though is in monitoring the TLS certificate being served via their syslog-ng [syslog-ng 4 (4.8.1) on Debian 13] that is aggregating/receiving logs. Via some debugging I found that using 'openssl s_client' can cause some 'hung' TLS communication as it does not cleanly send the expected 'eof' when closing the connection as I am checking via tcp/6514 instead of say, one of the in-built tls handshakes in openssl (smtp, imap, ldap, etc). Not at all syslog-ng's problem, I understand. [reference: https://ithy.com/article/fix-openssl-error0a000126-for-ssl-8w813fv2] I have had some success in instructing the the receiver to more gracefully handle this condition by adding 'Options = SSL_OP_IGNORE_UNEXPECTED_EOF' to openssl.conf as well as including the openssl option '-no_ign_eof' in my socket check. By "some success", I mean the socket responds a little bit longer, but still fails. Again, still openssl's issue, I understand. I am investigating other methods such as gnutls-cli, etc but haven't (yet) found anything that returns the certificate data itself for grokking out the 'notAfter' value of the certificate. The reason I am asking here is to see if anyone else has found and/or solved for similar behavior since it appears thus far that it is syslog-ng and the 'tls' option that seem to be what is ceasing to respond after some time. When I have done these certificate checks against other daemons that lack the in-built tls handshakes in openssl and they continue responding with certificate data whereas syslog-ng starts choking on the "error:0A000126:SSL routines::unexpected eof while reading Unable to establish SSL connection" until the daemon gets restarted, then all responds again appropriately. I've run the following and the syslog-ng tls only responds properly for approx 70 seconds and starts failing. for ((i=1;i>0;i++)); do echo "===[ `date`"; openssl s_client -connect dmz-log.DOMAIN.com:6514 -no_ign_eof < /dev/null 2>&1 | openssl x509 -enddate -noout; sleep 10; done ========== ===[ Thu Jun 4 03:09:08 PM PDT 2026 notAfter=Aug 8 05:37:10 2026 GMT ===[ Thu Jun 4 03:09:18 PM PDT 2026 Could not find certificate from <stdin> 40770E8A267F0000:error:1608010C:STORE routines:ossl_store_handle_load_result:unsupported:../crypto/store/store_result.c:160:provider=default ========== Anybody with any insights or that may have found a way to solve for this, I would greatly appreciate any hints. Thanks so much, -Chris -- Node-Nine, Inc. chris(a)node-nine.com 619.354.6463

1 0

libbasicfuncs.so error
by Robert Koktan 25 May '26

25 May '26

Hello! Using syslog-ng 4.6.0-bp156.1.4 on SUSE Linux Enterprise Server 15SP6 on s390x, via the packageHub repository. I see this error frequently in the logs and when I run # syslog-ng -s... /usr/lib64/syslog-ng/libbasicfuncs.so: error: symbol lookup error: undefined symbol: fmod (fatal) I also have several identical systems with the same version of syslog-ng that do not return this error. Can you tell me if there is an actual problem with this, or is the message moreso cosmetic? Thanks, Rob

1 0

Fedora 44, CentOS 7 and Amazon Linux syslog-ng questions
by Peter Czanik (pczanik) 19 May '26

19 May '26

Hi, This is a repost of my blog from last week, here on the mailing list. I need your feedback on CentOS 7 and Amazon Linux 2023 packages. You can respond here, or even better: at the URL at the end of my e-mail. Peter Fedora 44 was announced last week: syslog-ng 4.11 is part of it. While checking the Fedora Copr build service for Fedora 44, I realized that CentOS 7 and Amazon Linux 2023 packages are also there. I have a few questions about those for you! Fedora 44 The availability of the Fedora 44 release was announced last week. Vesion 4.11 of syslog-ng, the current latest release, is part of it. As usual, I did a quick test: everything works as expected. RHEL 6 The removal of RHEL 6 packages from Copr was announced many years ago. Then, the countdown was silently canceled. I have just checked: RHEL 6 packages are no longer available, so I deleted all my related repositories. Also, I deleted a couple of temporary test repos along the way. CentOS 7 When talking to product manager friends around the world, I realized that syslog-ng is not an “enterprise” application. “Enterprise” developers are still actively maintaining packages for RHEL 6, when even RHEL 7 has reached end of life a long time ago. Of course, this is just a satirical definition of “enterprise”, at least in my view… Support for RHEL 7 / CentOS 7 was dropped in syslog-ng a month before the distro became end-of-life. Copr announced the deletion of CentOS 7 packages, but after a while, the countdown suddenly disappeared. Packages built 10+ years ago are still here, and CentOS 7 is still a valid build target. Question: is there anyone still using my syslog-ng packages on RHEL 7 / CentOS 7? Otherwise, I would be happy to delete anything related from my Copr repositories. I could delete many repositories, save storage, and I would not have to deselect them as a build target during package builds. Amazon Linux 2023 Another question mark in my mind is Amazon Linux 2023 support. If we can believe the download statistics provided by Copr, then this is one of the most popular syslog-ng repos on Copr. However, over the years, I only received a single feedback about it, which was on Twitter years ago: “Thanks, I use it.” That is all. While there were regular requests to create these packages, nobody asked for features, updates, whatever. The repo is still stuck at syslog-ng version 4.8. Question: should I update syslog-ng to a more recent version, as time permits? What is next? Share your thoughts with us in this syslog-ng GitHub discussion: https://github.com/syslog-ng/syslog-ng/discussions/5691 or reach out to me on Twitter / Mastodon / LinkedIn. Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> One Identity (Balabit) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

The syslog-ng Insider 2026-05: OTEL; central log collection; old Mac
by Peter Czanik (pczanik) 14 May '26

14 May '26

Dear syslog-ng users, This is the 140th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Streaming syslog-ng data to your lakehouse using OTEL Version 4.11.0 of syslog-ng contains contributions from Databricks related to OAuth2 authentication. Recently, they published a blog about how this enables their customers to send logs to their data lake using syslog-ng and the OpenTelemetry protocol. https://www.syslog-ng.com/community/b/blog/posts/streaming-syslog-ng-data-t… Central log collection - more than just compliance I often hear, even at security conferences that “no central log collection here” or “we have something due to compliance”. Central logging is more than just compliance. It makes logs easier to use, available and secure, thus making your life easier in operations, security, development, but also in marketing, sales, and so on. https://www.syslog-ng.com/community/b/blog/posts/central-log-collection---m… Compiling syslog-ng on an old Mac I have an aging, but fully functional MacBook. I bought it for syslog-ng testing, but I also use for watching movies. Homebrew no more fully supports old, Intel-based Macs. This blog helps to compile the latest syslog-ng release on these old, but otherwise functional machines. https://www.syslog-ng.com/community/b/blog/posts/compiling-syslog-ng-on-an-… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> One Identity (Balabit) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

The syslog-ng Insider 2026-04: wildcard-file; fix; UDP
by Peter Czanik (pczanik) 08 Apr '26

08 Apr '26

Dear syslog-ng users, This is the 138th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Automatic configuration of the syslog-ng wildcard-file() source Reading files and monitoring directories became a lot more efficient in recent syslog-ng releases. However, it is also needed manual configuration. Version 4.11 of syslog-ng can automatically configure the optimal setting for both. https://www.syslog-ng.com/community/b/blog/posts/automatic-configuration-of… What to fix next in syslog-ng? Version 4.11 of syslog-ng will feature a brand-new Kafka source. While it is being tested and reviewed, we are working on reducing the number of open issues. What should be fixed next? https://www.syslog-ng.com/community/b/blog/posts/what-to-fix-next-in-syslog… UDP reliability improved in syslog-ng Debian packaging UDP log collection is a legacy feature that does not provide any security or reliability, but is still in wide use. You can improve its reliability using eBPF on Linux in recent syslog-ng versions. Support for eBPF was added to Debian packages while preparing for the 4.11.0 syslog-ng release. https://www.syslog-ng.com/community/b/blog/posts/udp-reliability-improved-i… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> One Identity (Balabit) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Syslogd in pfSense Community Edition Firewall version 2.8.1 Stops Sending Firewall Logs to Kiwi Syslog Server Every 7-8 days
by Turritopsis Dohrnii Teo En Ming 31 Mar '26

31 Mar '26

Subject: Syslogd in pfSense Community Edition Firewall version 2.8.1 Stops Sending Firewall Logs to Kiwi Syslog Server Every 7-8 days Good day from Singapore, I have a pfSense Community Edition Firewall version 2.8.1 at home. It is based on FreeBSD 15.0-CURRENT. My firewall hardware appliance has Intel Celeron J4125 CPU, 8 GB RAM and 64 GB of SSD. Now, every 7-8 days, syslogd in my pfsense firewall will stop sending firewall logs to Kiwi Syslog Server. I have already done my due diligence checks. There is nothing wrong with the Kiwi Syslog Server on my Windows 11 Home edition computer. Syslogd in my pfsense firewall will simply stop sending firewall logs to Kiwi Syslog Server every 7-8 days. I have to manually restart syslogd in pfsense firewall before it will send firewall logs to Kiwi Syslog Server again. How can I troubleshoot the problem in such a situation given there are no logging? Thank you in advance for your advice. Regards, Mr. Turritopsis Dohrnii Teo En Ming Extremely Democratic People's Republic of Singapore 31 Mar 2026 Tuesday 11.30 pm Singapore Time

1 0

The syslog-ng Insider 2026-03: 4.11.0 release; OpenSearch; ElasticSearch
by Peter Czanik (pczanik) 11 Mar '26

11 Mar '26

Dear syslog-ng users, This is the 138th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Version 4.11.0 of syslog-ng is now available Version 4.11.0 of syslog-ng is now available. The main attraction is the brand new Kafka source, but there are many other smaller features and improvements, as well. https://www.syslog-ng.com/community/b/blog/posts/version-4-11-0-of-syslog-n… Using OpenSearch data streams in syslog-ng Recently, one of our power users contributed OpenSearch data streams support to syslog-ng, which reminded me to also do some minimal testing on the latest OpenSearch release with syslog-ng. TL;DR: both worked just fine. https://www.syslog-ng.com/community/b/blog/posts/using-opensearch-data-stre…<https://www.syslog-ng.com/community/b/blog/posts/using-the-blank-filter-of-…> Changes in the syslog-ng Elasticsearch destination While testing the latest Elasticsearch release with syslog-ng, I realized that there was already a not fully documented elasticsearch-datastream() driver. Instead of fixing the docs, I reworked the elasticsearch-http() destination to support data streams. So, what was the problem? The driver follows a different logic in multiple places than the base elasticsearch-http() destination driver. Some of the descriptions were too general, others were missing completely. You had to read the configuration file in the syslog-ng configuration library (SCL) to configure the destination properly. While preparing for syslog-ng 4.11.0, the OpenSearch destination received a change that allows support for data streams. I applied these changes to the elasticsearch-http() destination, and did a small compatibility change along the way, so old configurations and samples from blogs work. https://www.syslog-ng.com/community/b/blog/posts/changes-in-the-syslog-ng-e… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> One Identity (Balabit) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng version 4.11.0 is now available
by Peter Czanik (pczanik) 25 Feb '26

25 Feb '26

Hi, I'm happy to share that syslog-ng version 4.11.0 is now available. 4.11.0 syslog-ng provides RPM<https://github.com/syslog-ng/syslog-ng#rhel> and DEB<https://github.com/syslog-ng/syslog-ng#debianubuntu> package repositories for Ubuntu, Debian, and RHEL, for both amd64 and arm64 architectures. We also provide ready-to-test binaries in Docker containers<https://hub.docker.com/r/balabit/syslog-ng/tags> based on the current stable Debian image. For more details, visit our Documentation Center<https://syslog-ng.github.io/> Highlights * kafka-source(): The new kafka() source can directly fetch log messages from the Apache Kafka message bus using the librdkafka client. It can fetch messages from explicitly named or wildcard-matching Kafka topics, and from a single partition, explicitly listed partitions, or all partitions of the selected topic(s). It supports the two main strategies — assign and subscribe — providing the flexibility to adapt to a wide range of Kafka setups and practical use cases, instead of forcing a single approach that may not fit all scenarios. It can fetch and process messages from the Kafka broker using multiple workers(), which may further improve throughput, especially when the main worker can fetch messages at high speed. For more details<https://syslog-ng.github.io/admin-guide/060_Sources/038_Kafka/README> and for all available options<https://syslog-ng.github.io/admin-guide/060_Sources/038_Kafka/001_Kafka_opt…>, please see our documentation. (#5564<https://github.com/syslog-ng/syslog-ng/pull/5564>) Features * cloud-auth: Add generic OAuth2 authentication module A generic OAuth2 authentication module supporting client credentials flow with configurable authentication methods (HTTP Basic Auth or POST body credentials) has been added. The module is extensible via virtual methods, allowing future authenticators to inherit common OAuth2 token management logic. (#5571<https://github.com/syslog-ng/syslog-ng/pull/5571>) * cloud-auth, grpc: Add OAuth2 support for gRPC destinations The cloud-auth() plugin now supports gRPC destinations in addition to HTTP destinations. This enables OAuth2 token management for any gRPC-based destination driver (such as bigquery(), opentelemetry(), loki(), etc.). The implementation uses the same signal/slot pattern as HTTP. Example configuration: destination d_grpc { opentelemetry( url("example.com:443") cloud-auth( oauth2( client_id("client-id") client_secret("client-secret") token_url("https://auth.example.com/token") scope("api-scope") ) ) ); } (#5584<https://github.com/syslog-ng/syslog-ng/pull/5584>) * darwinosl(): Added (fixed in an alternative way and enabled) the log-fetch-limit() option, which allows batched message forwarding in the log path. The fetch-delay() and fetch-retry-delay() options have both been renamed with the log- prefix; the old keywords are still supported but marked as deprecated. The enhanced internal loop for OSLog message processing now uses fewer resources during both processing and idle time. (#5547<https://github.com/syslog-ng/syslog-ng/pull/5547>) * network-load-balancer: add support for failover The confgen script for network-load-balancer now supports failover, generating the list of failover servers for each destination automatically. (#5562<https://github.com/syslog-ng/syslog-ng/pull/5562>) * file(), wildcard-file() source: Add auto follow-method() option A new follow-method() option, auto, has been added. In this automatic mode, syslog-ng OSE uses the following sequence to decide which method to use: Unfortunately, for backward compatibility reasons, the new auto option could not become the default at this time, but for new configurations, we recommend using monitor-method("auto") and follow-method("auto") to achieve the best available performance on the given platform. (#5602<https://github.com/syslog-ng/syslog-ng/pull/5602>) * the inotify method is used automatically if the system supports it (and none of the IV_SELECT_POLL_METHOD or IV_EXCLUDE_POLL_METHOD environment variables are set); otherwise * the best available (or the IV_SELECT_POLL_METHOD or IV_EXCLUDE_POLL_METHOD forced) system (ivykis) poll method of the platform is used; if none is available, * the old poll method is used * network()/syslog(): Add extended-key-usage-verify() option to TLS sources and destinations (#5588<https://github.com/syslog-ng/syslog-ng/pull/5588>) * Number parsing: Improve @NUMBER@ / @DOUBLE@ support for signed numbers When parsing numbers using the @NUMBER@ or @DOUBLE@ pattern parsers, certain signs were not allowed, causing PatternDB to reject properly formatted numbers. Explicit + signs at the beginning of a number or in the exponent part were rejected, and a - sign before a hexadecimal value was also not accepted. (#5620<https://github.com/syslog-ng/syslog-ng/pull/5620>) * elasticsearch, opensearch: Update SCL to support data streams (#5586<https://github.com/syslog-ng/syslog-ng/pull/5586>) * elasticsearch-http() and opensearch() now support data streams when using the op_type("create") parameter * the type("") parameter can now be omitted, and its value is silently ignored Bugfixes * json-parser: Fixed quoting of JSON array elements containing commas. (#5604<https://github.com/syslog-ng/syslog-ng/pull/5604>) * transport(proxied-tcp): Fixed an internal assertion–caused crash when a Proxy Protocol v2 message was received with a LOCAL command that was not handled previously. LOCAL commands are now treated as health check messages for both v1 and v2 proxy messages — accepted but dropped — as the protocol definition<https://github.com/syslog-ng/syslog-ng/blob/syslog-ng-4.11.0/www.haproxy.or…> specifies. (#5608<https://github.com/syslog-ng/syslog-ng/pull/5608>) * afsocket-source: Fixed two keep-alive() configuration reload–related issues. First, when a reload switched from keep-alive(yes) to keep-alive(no) with so-reuseport(no), the newly loaded configuration’s socket instance could fail to open. Second, in case of an error in the new configuration, the reload could fail to properly restore the previous connection state. (#5552<https://github.com/syslog-ng/syslog-ng/pull/5552>) * log-transport-tls: TLS-related macros, such as ${tls.x509_cn}, were not set in the first log message. (#5603<https://github.com/syslog-ng/syslog-ng/pull/5603>) * stats: Fixed stats reset memory counter underflow. (#5563<https://github.com/syslog-ng/syslog-ng/pull/5563>) * afsocket-source: Added a workaround for an issue where a reload switches from keep-alive(yes) to keep-alive(no) with so-reuseport(no), causing the newly loaded configuration’s socket instance to fail to open. (#5552<https://github.com/syslog-ng/syslog-ng/pull/5552>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: AshFungor, Bálint Horváth, Peter Czanik (CzP), davidtosovic-db, egglessness, Daniele Ferla, Hofi, Tamas Pal, Romain Tartière, Fᴀʙɪᴇɴ Wᴇʀɴʟɪ — This release has 3 assets: * syslog-ng-4.11.0.tar.gz * Source code (zip) * Source code (tar.gz) Visit the release page<https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.11.0> to download them. Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Plans for next release?
by David Tosovic 24 Feb '26

24 Feb '26

Hi all, I'm currently building syslog-ng from source as I'm utilizing some recent changes that are not in 4.10.2. I'm wondering if the next release is scheduled soon? Thanks, David

2 4

The syslog-ng Insider 2026-02: stats-exporter; blank filter; Kafka source
by Peter Czanik (pczanik) 12 Feb '26

12 Feb '26

Dear syslog-ng users, This is the 137th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS The syslog-ng stats-exporter() now has all functionality of syslog-ng-ctl The syslog-ng stats-exporter() allows you to collect syslog-ng statistics using Prometheus. Version 4.10 of syslog-ng added options to ensure that all related options of syslog-ng-ctl are now available in stats-exporter() too. https://www.syslog-ng.com/community/b/blog/posts/the-syslog-ng-stats-export… Using the blank() filter of syslog-ng The blank() filter is a filter function with a descriptive name: it selects empty or undefined name-value pairs. While most of the functionalities that blank filter provides are available long time ago, using this new filter makes configurations easier to understand. https://www.syslog-ng.com/community/b/blog/posts/using-the-blank-filter-of-… How to test the syslog-ng Kafka source by building the package yourself? A long-waited feature for syslog-ng, the Kafka source, is getting ready soon. The development is still in progress, but you can already try it, and it is worth the effort. How? Using the very same tool the syslog-ng testing and release process relies on. https://www.syslog-ng.com/community/b/blog/posts/how-to-test-the-syslog-ng-… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

iptables.log
by A 28 Dec '25

28 Dec '25

How to exclude such lines from logging? IN=net0 OUT= SRC=xxx.xxx.xxx.xxx DST=xxx.xxx.xxx.xxx LEN=xx TOS=0xxx PREC=0xxx TTL=xx ID=xxxx DF PROTO=xxx SPT=xxxx DPT=137 WINDOW=xxxxx RES=0xxx XXX URGP=X --

3 6

The syslog-ng Insider 2025-12: logrotation; release RPM; nightly RPM
by Peter Czanik (pczanik) 11 Dec '25

11 Dec '25

Dear syslog-ng users, This is the 136th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS File size-based log rotation in syslog-ng ----------------------------------------- Version 4.10 of syslog-ng introduced file size-based log rotation. Thanks to this, storage space is no longer filled with logs with the risk that you might not see older logs if the message rate is higher than expected. https://www.syslog-ng.com/community/b/blog/posts/file-size-based-log-rotati… Syslog-ng release packages for RHEL & Co. ----------------------------------------- I’ve been providing syslog-ng users release RPM packages for almost a decade now. However, from now on, RHEL & Co users can use packages provided directly by the syslog-ng team from a lot less obscure location. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-release-packages… Nightly syslog-ng RPM packages for RHEL & Co. --------------------------------------------- I have been providing syslog-ng users with weekly git snapshot RPM packages for almost a decade. From now on, RHEL & Co users can use nightly packages provided by the syslog-ng team, and from a lot less obscure location. As usual, these packages are for testing, not for production. https://www.syslog-ng.com/community/b/blog/posts/nightly-syslog-ng-rpm-pack… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Version 4.10.2 of syslog-ng is now available
by Peter Czanik (pczanik) 26 Nov '25

26 Nov '25

Hi, Version 4.10.2 of syslog-ng is now available. It's yet another bug fix release for 4.10 and fixes a number of problems reported after the release. If you use the webhook source, start syslog-ng directly from scripts or check stats values on a system with disk buffer, you should upgrade to 4.10.2. Otherwise, your current version should be OK. Peter 4.10.2 syslog-ng provides RPM<https://github.com/syslog-ng/syslog-ng#rhel> and DEB<https://github.com/syslog-ng/syslog-ng#debianubuntu> package repositories for Ubuntu, Debian, and RHEL, for both amd64 and arm64 architectures. We also provide ready-to-test binaries in Docker containers<https://hub.docker.com/r/balabit/syslog-ng/tags> based on the current stable Debian image. For more details, visit our Documentation Center<https://syslog-ng.github.io/> Version 4.10.2 is a bugfix release, and resolves the following issues. Bugfixes * Queued stats values of destinations could still contain weird values. (#5527<https://github.com/syslog-ng/syslog-ng/pull/5527>) * Unclosed standard file handlers could cause a hang when syslog-ng was started as a daemon. (#5532<https://github.com/syslog-ng/syslog-ng/pull/5532>) * The WebHook Python module could hang syslog-ng when started by systemd and systemctl stop syslog-ng was requested. (#5522<https://github.com/syslog-ng/syslog-ng/pull/5522>) * Our installer packages now include static index web pages and are browsable via RPM<https://ose-repo.syslog-ng.com/yum/> and DEB<https://ose-repo.syslog-ng.com/apt/>. (#5517<https://github.com/syslog-ng/syslog-ng/pull/5517>, #5518<https://github.com/syslog-ng/syslog-ng/pull/5518>, #5520<https://github.com/syslog-ng/syslog-ng/pull/5520>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Vivek Anand, Hofi, gotyaoi, Kovacs Gergo Ferenc, Tamas Pal, Tinkiter — This release has 3 assets: * syslog-ng-4.10.2.tar.gz * Source code (zip) * Source code (tar.gz) Visit the release page<https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.10.2> to download them. Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

4 9

issues with syslog facility "overflowing" to user facility?
by Ian Veach 19 Nov '25

19 Nov '25

Hi all - We're seeing some weird behavior on our central loghosts. Could be config, I suppose, but it seems unusual and I don't see config issue causing it. The summary is that we are using stats and dumping them into syslog.log, and that's fine. But we see weird "remnants" in user.log. It seems to contain syslog facility messages and is malformed as well. Bug? Or us? 🙂 This is a snip of the expected syslog.log: 2025-11-19T00:00:03.392632-08:00 redacted [syslog.info] syslog-ng[758325]: Log statistics; msg_size_avg='dst.file(d_log#0,/var/log/other/20251110/daemon.log)=111', truncated_bytes='dst.file(d_log#0,/var/log/other/20251006/daemon.log)=0', truncated_bytes='dst.file(d_log_systems#0,/var/log/other/20251002/syste..... This is a snip of user.log (same event/time looks like): 2025-11-19T00:00:03.392632-08:00 redacted [user.notice] var/log/other/20251022/daemon.log)=111',[]: eps_last_24h='dst.file(d_log#0,/var/log/other/20251022/daemon.log)=0', eps_last_1h='dst.file(d_log#0,/var/log/other/20250922/daemon.log)=0', eps_last_24h='dst.file(d_log#0,/var/log/other/20250922/daemon.log)=0',...... Here you can see for user.log that the format is actually messed up. $PROGRAM[$PID]: is missing/truncated (although look at the []: at the end of the first line), and the first part of the $MESSAGE is also missing/truncated. Some notes: * We're running syslog-ng as provided by Red Hat (syslog-ng-3.35.1-7.el9.x86_64) * endpoint is logging correctly (nothing in user.log). This is only centralized loghosts that we see this. * Stats level 1, freq 21600 Relevant configuration snips: log { source(s_local); source(s_net_unix_tcp); source(s_net_unix_udp); filter(f_catchall); destination(d_arc); }; filter f_catchall { not facility(local0, local1, local2, local3, local4, local5, local6, local7); }; destination d_arc { file("`LPTH`/$HOST_FROM/$YEAR/$MONTH/$DAY/$FACILITY.log" template(t_std) ); }; t_std: template("${ISODATE} $HOST_FROM [$FACILITY.$LEVEL] $PROGRAM[$PID]: $MESSAGE\n"); Thanks for any guidance! PUBLIC RECORDS NOTICE: In accordance with NRS Chapter 239, this email and responses, unless otherwise made confidential by law, may be subject to the Nevada Public Records laws and may be disclosed to the public upon request.

1 0

yum repository not browsable
by Evan Rempel 31 Oct '25

31 Oct '25

From time to time we have some challenge with the installation of packages from a repository. To troubleshoot the issue we usually use a web browser to brows the repository to "see what is there" and to download and inspect individual packages to determine signing and dependencies. The repository at ose-repo.syslog-ng.com is not browsable. https://ose-repo.syslog-ng.com/yum/stable/ results in a 404 error. Can the repository be changed to allow it to be browsed? Is there some reason to disallow browsing that escapes me? -- Evan

4 4

Beware Debian 13 syslog-ng stats setting
by John Kristoff 28 Oct '25

28 Oct '25

If you use Debian's packaged syslog-ng beware that you may have this set in your Debian 13 /etc/syslog-ng/syslog-ng.conf: stats(freq(1)); This was briefly introduced and then removed. You probably don't want it if you have it - daemon stats would be logged every second. Debian does not install syslog-ng by default and many may be installing packages from elsewhere or from source, so hopefully this does not have a wide impact. Where it was added: <https://github.com/gcsideal/syslog-ng-debian/commit/319fd669944def7dbb1bc50…> Where it was removed: <https://github.com/gcsideal/syslog-ng-debian/commit/f7ee172d62009cc6b5e6a62…> John

1 0

The syslog-ng Insider 2025-10: values; BastilleBSD; Debian
by Peter Czanik (pczanik) 09 Oct '25

09 Oct '25

Dear syslog-ng users, This is the 135th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS The core values of syslog-ng ---------------------------- Whenever I present syslog-ng at a conference or I stand next to a booth, people often ask me why should they use syslog-ng instead of one of its competitors. So let me summarize what the users and developers of syslog-ng typically consider as its most important values. https://www.syslog-ng.com/community/b/blog/posts/the-core-values-of-syslog-… Running syslog-ng in BastilleBSD -------------------------------- Bastille, the lightweight jail (container) management system for FreeBSD, was already covered here. Recently, they released Bastille 1.0 and BastilleBSD, a hardened FreeBSD variant that comes with Bastille pre-installed. https://www.syslog-ng.com/community/b/blog/posts/running-syslog-ng-in-basti… Debian and Ubuntu blogs updated ------------------------------- Recent Debian and Ubuntu releases changed, how gpg keys of repositories can be added to a sytem. Related blogs are now updated: https://www.syslog-ng.com/community/b/blog/posts/nightly-syslog-ng-builds-f… https://www.syslog-ng.com/community/b/blog/posts/installing-the-latest-sysl… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

stats collection sometimes wrong
by Evan Rempel 08 Oct '25

08 Oct '25

We collect stats every 10 minutes via the command syslog-ng-ctl stats --control=$syslogSocket And we log the results back to syslog as well as generate alerts when things start queuing. Sometimes the queued numbers reported are extremely incorrect. 2025-09-16T21:15:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0 2025-09-16T21:25:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0 2025-09-16T21:35:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0 2025-09-16T21:35:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;processed;15568 2025-09-16T21:45:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;18446744073709551608 2025-09-16T21:45:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;processed;15773 2025-09-16T21:55:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;18446744073709551608 2025-09-16T21:55:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;processed;15972 2025-09-16T22:05:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0 2025-09-16T22:15:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0 It is not possible to queue more messages that the difference reported in the processed numbers. -- Evan

2 3

Version 4.10.1 of syslog-ng now available
by Peter Czanik (pczanik) 01 Oct '25

01 Oct '25

Hi, Version 4.10.1 is a bugfix release, not needed by most users. It fixes the syslog-ng container and platform support in some less common situations. Before you begin I assume that most people are lazy and/or overbooked, just like me. So, if you already have syslog-ng 4.10.0 up and running, and packaged for your platform, just skip this bugfix release. What is fixed? • You can now compile syslog-ng on FreeBSD 15 again. • The syslog-ng container has Python support working again. • Stackdump support compiles only on glibc Linux systems, but it also used to be enabled on others when libunwind was present. This problem affected embedded Linux systems using alternative libc implementations like OpenWRT and Gentoo in some cases. It is now turned off by default, therefore it needs to be explicitly enabled. What is next? If you are switching to 4.10.X now, using 4.10.1 might spare you some extra debugging. Especially if you are developing for an embedded system. Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng 4.10.0 packages, and spreading the news
by Peter Czanik (pczanik) 23 Sep '25

23 Sep '25

Hi, Let me collect you some more syslog-ng 4.10.0-related information. Release notes with all the new features, bug fixes and various other changes: https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.10.0 RPM packages for openSUSE / SLES, Fedora and RHEL are now available: https://www.syslog-ng.com/community/b/blog/posts/installing-latest-syslog-n… (blog updated, even if it still mentions RHEL 7 and a 2021 date 🙂) DEB packages for Debian and Ubuntu are available: https://www.syslog-ng.com/community/b/blog/posts/installing-the-latest-sysl… Starting with this release, RPM packages for RHEL 8, 9 and 10 on ARM and x86_64 are provided also on syslog-ng.com, just like DEB packages. More on this next week, but you can already test it based on the release notes 🙂 Help us to spread the word about this release. Write something using your own words, or simply share one of my posts about syslog-ng 4.10.0: LinkedIn: https://www.linkedin.com/posts/peterczanik_release-syslog-ng-4100-syslog-ng… Twitter: https://x.com/PCzanik/status/1970479911396589717 Mastodon: https://fosstodon.org/@PCzanik/115253846672000598 BlueSky: https://bsky.app/profile/pczanik.bsky.social/post/3lzizqcctnk22 Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng 4.10.0 released
by Peter Czanik (pczanik) 23 Sep '25

23 Sep '25

Hi, I'm happy to announe hat syslog-ng 4.10.0 is now released. From the release notes: syslog-ng provides RPM<https://github.com/syslog-ng/syslog-ng#rhel> and DEB<https://github.com/syslog-ng/syslog-ng#debianubuntu> package repositories for Ubuntu, Debian, and RHEL, for both amd64 and arm64 architectures. We also provide ready-to-test binaries in Docker containers<https://hub.docker.com/r/balabit/syslog-ng/tags> based on the current stable Debian image. For more details, visit our Documentation Center<https://syslog-ng.github.io/> Highlights * affile: add support for filesize based logrotation Config file example: destination d_file_logrotate { file("/my-logfile.log", logrotate(enable(yes), size(30KB), rotations(5))); }; (#5191<https://github.com/syslog-ng/syslog-ng/pull/5191>) Features * filter: Add a blank filter that test if a value is blank. A value is considered blank if it is not set, is an empty string, is an empty list, is a string with only whitespace, or is boolean false. (#5425<https://github.com/syslog-ng/syslog-ng/pull/5425>) * http-destination: add msg_data_in_header option to be able to turn off sending message content-related data in the HTTP header (#5455<https://github.com/syslog-ng/syslog-ng/pull/5455>) * stats-exporter: Add stats-without-orphaned() and stats-with-legacy() options to further filter the stats output. (#5424<https://github.com/syslog-ng/syslog-ng/pull/5424>) * affile: Add ability to refine the wildcard-file() filename-pattern() option with exclude-pattern(), to exclude some matching files. For example, match all *.log but exclude *.?.log. (#5416<https://github.com/syslog-ng/syslog-ng/pull/5416>) Bugfixes * afprog: Fix invalid access of freed log-writer cfg. (#5445<https://github.com/syslog-ng/syslog-ng/pull/5445>) * s3: Fixed bug where in certain conditions finished object buffers would fail to upload. (#5447<https://github.com/syslog-ng/syslog-ng/pull/5447>) * stats-exporter: Fix leaks caused by missing "virtual destructor" calls. (#5441<https://github.com/syslog-ng/syslog-ng/pull/5441>) * wildcard-file: Fix possible act_tracker crash caused by duplicated file change notification handler invocation. (#5437<https://github.com/syslog-ng/syslog-ng/pull/5437>) Packaging * packaging: New package formats, platforms, and architectures! * the long-awaited RPM repository is here, we have RHEL-8, RHEL-9, and REHL-10 packages available, both for amd64 and arm64 architectures, just download and install the repository definition sudo curl -o /etc/yum.repos.d/syslog-ng-ose-stable.repo https://ose-repo.syslog-ng.com/yum/syslog-ng-ose-stable.repo * we fixed the publishing of our arm64 DEB packages * added new DEB packages for Debian Trixie, both for amd64 and arm64. * new DBLD docker images for Rocky-9, OpenSuse Tumbleweed, Ubuntu Plucky, and Debian Trixie (#5449<https://github.com/syslog-ng/syslog-ng/pull/5449>) Notes to developers * mongo-c: now we can build against both the v1 and v2 versions of the mongo-c driver automatically (#5442<https://github.com/syslog-ng/syslog-ng/pull/5442>) * manpages: Finally, we have added manpage generation to the CMake builds as well. The new single source of truth solution can either use the sometimes more up-to-date version from the documentation<https://syslog-ng.github.io/admin-guide/190_The_syslog-ng_manual_pages/READ…>, or, by default, the locally available ready-to-use instance (which is also synced from the online version, but may lag behind). This can be controlled via the --with-mapages=local|remote, or the -DWITH_MANPAGES=LOCAL|REMOTE configuration options. (#5459<https://github.com/syslog-ng/syslog-ng/pull/5459>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Alexander Zikulnig, Ben Ireland, Bálint Horváth, Gyula Kerekes, Hofi, Romain Tartière, Ross Williams, Tamas Pal Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

The syslog-ng Insider 2025-09: AI; syslog; FreeBSD
by Peter Czanik (pczanik) 11 Sep '25

11 Sep '25

Dear syslog-ng users, This is the 134th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Syslog-ng development and AI ---------------------------- Recently, several people have asked me about the syslog-ng project’s view on AI. In short, there is cautious optimism: we embrace AI, but it does not take over any critical tasks from humans. But what does this mean for syslog-ng? https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-development-and-… Dealing with multiple syslog protocols in syslog-ng made easy ------------------------------------------------------------- There are multiple syslog protocols with multiple variants. The new transport(auto) option of the syslog() source allows you to support all TCP-based variants with a single source driver. https://www.syslog-ng.com/community/b/blog/posts/dealing-with-multiple-sysl… FreeBSD audit source is coming to syslog-ng ------------------------------------------- Last year, I wrote a small configuration snippet for syslog-ng: FreeBSD audit source. I published it in a previous blog, and based on feedback, it is already used in production. And soon, it will be available also as part of a syslog-ng release. https://www.syslog-ng.com/community/b/blog/posts/freebsd-audit-source-is-co… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng version 4.9.0 is now available
by Peter Czanik (pczanik) 26 Aug '25

26 Aug '25

Hi, I am happy to announce that version 4.9.0 of syslog-ng is now available. Thanks everyone who contributed code, documentation, testing, or in any other way. Peter 4.9.0 Highlights * stats-exporter: Added two new sources, stats-exporter() and stats-exporter-dont-log(), which directly serve the output of syslog-ng-ctl stats and syslog-ng-ctl query to a http scraper. The only difference is that stats-exporter-dont-log() suppresses log messages from incoming scraper requests, ensuring no messages appear in the log path. Meanwhile, stats-exporter() logs unparsed messages, storing incoming scraper HTTP requests in the MSG field. Example usage for a Prometheus Scraper which logs the HTTP request of the scraper to /var/log/scraper.log: @version: 4.9 @include "scl.conf" source s_prometheus_stat { stats-exporter( ip("0.0.0.0") port(8080) stat-type("query") stat-query("*") scrape-freq-limit(30) single-instance(yes) ); }; log { source(s_prometheus_stat); destination { file(/var/log/scraper.log); }; }; Example usage for a generic HTTP Scraper which sends e.g. the GET /stats HTTP/1.1 HTTP request to get statistics of syslog-ng, do not want to log or further process the HTTP requests in the log pipe, and needs the response in CSV format: @version: 4.9 @include "scl.conf" source s_scraper_stat { stats-exporter-dont-log( ip("0.0.0.0") port(8080) stat-type("stats") stat-format("csv") scrape-pattern("GET /stats*") scrape-freq-limit(30) single-instance(yes) ); }; log { source(s_scraper_stat); }; Note: A destination is not required for this to work; the stats-exporter() source will respond to the scraper regardless of whether a destination is present in the log path. Available options: stat-type(string) - query or stats, just like for the syslog-ng-ctl command line tool, see there for the details stat-query(string) - the query regex string that can be used to filter the output of a query type request stat-format(string) - the output format of the given stats request, like the -m option of the syslog-ng-ctl command line tool scrape-pattern(string) – the pattern used to match the HTTP header of incoming scraping requests. A stat response will be generated and sent only if the header matches the pattern string scrape-freq-limit(non-negative-int) - limits the frequency of repeated scraper requests to the specified number of seconds. Any repeated request within this period will be ignored. A value of 0 means no limit single-instance(yes/no) - if set to yes only one scraper connection and request will be allowed at once (#5259<https://github.com/syslog-ng/syslog-ng/pull/5259>) * syslog() source driver: add support for RFC6587 style auto-detection of octet-count based framing to avoid confusion that stems from the sender using a different protocol to the server. This behaviour can be enabled by using transport(auto) option for the syslog() source. (#5322<https://github.com/syslog-ng/syslog-ng/pull/5322>) * wildcard-file: Added inotify-based regular file change detection using the existing inotify-based directory monitor. This improves efficiency on OSes like Linux, where only polling was available before, significantly reducing CPU usage while enhancing change detection accuracy. To enable this feature, inotify kernel support is required, along with monitor-method() set to inotify or auto, and follow-freq() set to 0. (#5315<https://github.com/syslog-ng/syslog-ng/pull/5315>) Features * cisco: Added support for Cisco Nexus NXOS 9.3 syslog format. The parser now recognises NXOS 9.3 timestamps in YYYY MMM DD HH:MM:SS format and handles the different sequence number prefix (: instead of seqno: ) used by NXOS 9.3 compared to traditional IOS formats. Example Cisco configuration: Example syslog-ng configuration: @include "scl.conf" source s_cisco { network(ip(0.0.0.0) transport("udp") port(2000) flags(no-parse)); }; parser p_cisco { cisco-parser(); }; destination d_placeholder { # Define your destination here }; log { source(s_cisco); parser(p_cisco); destination(d_placeholder); }; (#5412<https://github.com/syslog-ng/syslog-ng/pull/5412>) * NXOS: (config)# logging server <syslog-ng-server-ip> port 2000 * IOS: (config)# logging host <syslog-ng-server-ip> transport udp port 2000 * bigquery(), google-pubsub-grpc(): Added service-account() authentication option. Example usage: destination { google-pubsub-grpc( project("test") topic("test") auth(service-account(key ("path_to_service_account_key.json"))) ); }; Note: In contrary to the http() destination's similar option, we do not need to manually set the audience here as it is automatically recognized by the underlying gRPC API. (#5270<https://github.com/syslog-ng/syslog-ng/pull/5270>) * gRPC based destinations: Added response-action() option With this option, it is possible to fine tune how syslog-ng behaves in case of different gRPC results. Supported by the following destination drivers: Supported gRPC results: Supported actions: Usage: google-pubsub-grpc( project("my-project") topic("my-topic") response-action( not-found => disconnect unavailable => drop ) ); (#5332<https://github.com/syslog-ng/syslog-ng/pull/5332>) * opentelemetry() * loki() * bigquery() * clickhouse() * google-pubsub-grpc() * ok * unavailable * cancelled * deadline-exceeded * aborted * out-of-range * data-loss * unknown * invalid-argument * not-found * already-exists * permission-denied * unauthenticated * failed-precondition * unimplemented * internal * resource-exhausted * disconnect * drop * retry * success * s3: Added two new options Example: s3( url("http://localhost:9000") bucket("testbucket") object_key("testobject") access_key("<ACCESS_KEY_ID>") secret_key("<SECRET_ACCESS_KEY>") content_type("text/plain") use_checksum("when_required") ); (#5286<https://github.com/syslog-ng/syslog-ng/pull/5286>) * content-type(): users now can change the content type of the objects uploaded by syslog-ng. * use_checksum(): This option allows the users to change the default checksum settings for S3 compatible solutions that don't support checksums. Requires botocore 1.36 or above. Acceptable values are when_supported (default) and when_required. * loki(): Added batch-bytes() and compression() options. (#5174<https://github.com/syslog-ng/syslog-ng/pull/5174>) * syslog-ng-ctl: Formatting the output of the syslog-ng-ctl stats and syslog-ng-ctl query commands is unified. Both commands got a new --format (-m) argument that can control the output format of the given stat or query. The following formats are supported: * kv - the legacy key-value-pairs e.g. center.queued.processed=0 (only for the query command yet) * csv - comma separated values e.g. center;;queued;a;processed;0 * prometheus - the prometheus scraper ready format e.g. syslogng_center_processed{stat_instance="queued"} 0 (#5248<https://github.com/syslog-ng/syslog-ng/pull/5248>) * network(), syslog() sources: add $PEERIP and $PEERPORT macros The $PEERIP and $PEERPORT macros always display the address and port of the direct sender. In most cases, these values are identical to $SOURCEIP and $SOURCEPORT. However, when dealing with proxied protocols, $PEERIP and $PEERPORT reflect the proxy's address and port, while $SOURCEIP and $SOURCEPORT indicate the original source of the message. (#5291<https://github.com/syslog-ng/syslog-ng/pull/5291>) * webhook(),opentelemetry() sources: support input_event_bytes metrics (#5324<https://github.com/syslog-ng/syslog-ng/pull/5324>) * freebsd-audit(): added a simple source SCL to collect FreeBSD audit logs using the built-in praudit program https://www.syslog-ng.com/community/b/blog/posts/freebsd-audit-source-for-s… (#5383<https://github.com/syslog-ng/syslog-ng/pull/5383>) * webhook(): headers support include-request-headers(yes) stores request headers under the ${webhook.headers} key, allowing further processing proxy-header("x-forwarded-for") helps retain the sender's original IP and the proxy's IP address ($SOURCEIP, $PEERIP). (#5333<https://github.com/syslog-ng/syslog-ng/pull/5333>) * check-program: Introduced as a flag for global or source options. By default, this flag is set to false. Enabling the check-program flag triggers program name validation for RFC3164 messages. Valid program names must adhere to the following criteria: Contain only these characters: [a-zA-Z0-9-_/().] Include at least one alphabetical character. If a program name fails validation, it will be considered part of the log message. Example: source { network(flags(check-hostname, check-program)); }; (#5264<https://github.com/syslog-ng/syslog-ng/pull/5264>) * syslog(transport(proxied-*)) and network(transport(proxied-*)): changed where HAProxy transport saved the original source and destination addresses. Instead of using dedicated PROXIED_* name-value pairs, use the usual $SOURCEIP, $SOURCEPORT, $DESTIP and $DESTPORT macros, making haproxy based connections just like native ones. $SOURCEPORT: added new macro which expands to the source port of the peer. (#5305<https://github.com/syslog-ng/syslog-ng/pull/5305>) * opentelemetry(), syslog-ng-otlp(): Added keep-alive() options. Keepalive can be configured with the time(), timeout() and max-pings-without-data() options of the keep-alive() block. opentelemetry( ... keep-alive(time(20000) timeout(10000) max-pings-without-data(0)) ); (#5174<https://github.com/syslog-ng/syslog-ng/pull/5174>) * bigquery(): Added auth() options. Similarly to other gRPC based destination drivers, the bigquery() destination now accepts different authentication methods, like adc(), alts(), insecure() and tls(). bigquery ( ... auth( tls( ca-file("/path/to/ca.pem") key-file("/path/to/key.pem") cert-file("/path/to/cert.pem") ) ) ); (#5174<https://github.com/syslog-ng/syslog-ng/pull/5174>) * cloud-auth: Added azure-monitor() destination Added oauth2 authentication for azure monitor destinations. Example usage: azure-monitor( dcr-id("dcr id") dce-uri("dce uri") stream_name("stream name") auth( tenant-id("tenant id") app-id("app id") app-secret("app secret") ) ) (#5293<https://github.com/syslog-ng/syslog-ng/pull/5293>) * multi-line-mode(): Added a new mutiline detection mode empty-line-separated that, as its name suggests, reads and treats all messages as one till it receives an empty line (which contains only a \r, \n or \r\n sequence). (#5259<https://github.com/syslog-ng/syslog-ng/pull/5259>) * google-pubsub-grpc(): Added a new destination that sends logs to Google Pub/Sub via the gRPC interface. Example config: google-pubsub-grpc( project("my_project") topic($topic) data($MESSAGE) attributes( timestamp => $S_ISODATE, host => $HOST, ) workers(4) batch-timeout(1000) # ms batch-lines(1000) ); The project() and topic() options are templatable. The default service endpoint can be changed with the service_endpoint() option. (#5266<https://github.com/syslog-ng/syslog-ng/pull/5266>) * ivykis: We have switched to our own fork<https://github.com/balabit/ivykis> of ivykis as the source for builds when using syslog-ng’s internal ivykis option (--with-ivykis=internal in autotools or -DIVYKIS_SOURCE=internal in CMake). We recommend switching to this internal version, as it includes new features not available in the original version<https://github.com/buytenh/ivykis> and likely never will be. (#5307<https://github.com/syslog-ng/syslog-ng/pull/5307>) * ivykis: Fixed and merged the in development phase io_uring based polling method solution to our ivykis fork<https://github.com/balabit/ivykis>. This is am experimental integration and not selected by default, you must activate it directly either using the IV_EXCLUDE_POLL_METHOD or IV_SELECT_POLL_METHOD as described here<https://syslog-ng.github.io/admin-guide/060_Sources/020_File/001_File_follo…>. (#5312<https://github.com/syslog-ng/syslog-ng/pull/5312>) * file(), wildcard-file(): Added follow-method() option. |Accepted values:| legacy | inotify | poll | system | This option controls how syslog-ng will follow file changes. The default legacy mode preserves the pre-4.9 version file follow-mode behavior of syslog-ng, which is based on the value of follow-freq(). The poll value forces syslog-ng to poll for file changes at the interval specified by the monitor-freq() option, even if a more efficient method (such as inotify or kqueue) is available. If inotify is selected and supported by the platform, syslog-ng uses it to detect changes in source files. This is the most efficient and least resource-consuming option available on Linux for regular files. The system value will use system poll methods (via ivykis) like port-timer port dev_poll epoll-timerfd epoll kqueue ppoll poll and uring. For more information about how to control the system polling methods used, see How content changes are followed in file() and wildcard-file() sources<https://syslog-ng.github.io/admin-guide/060_Sources/020_File/001_File_follo…>. (#5338<https://github.com/syslog-ng/syslog-ng/pull/5338>) * opentelemetry(), loki() destination: Add support for templated header() values (#5184<https://github.com/syslog-ng/syslog-ng/pull/5184>) Bugfixes * syslog-ng-otlp() destination: Fixed a crash. (#5267<https://github.com/syslog-ng/syslog-ng/pull/5267>) * Fixed some time parsing and time formatting issues. (#5386<https://github.com/syslog-ng/syslog-ng/pull/5386>) * syslogformat: Fix integer overflow on set pri (#5254<https://github.com/syslog-ng/syslog-ng/pull/5254>) * network(), syslog(): Fixed a potential crash for TLS destinations during reload In case of a TLS connection, if the handshake didn't happen before reloading syslog-ng, it crashed on the first message sent to that destination. (#5303<https://github.com/syslog-ng/syslog-ng/pull/5303>) * collectd(): fix not reading server responses (#5390<https://github.com/syslog-ng/syslog-ng/pull/5390>) * metrics: syslog-ng-ctl --reset will no longer reset Prometheus metrics (#5261<https://github.com/syslog-ng/syslog-ng/pull/5261>) * rate-limit(): fix precision issue that could occur at a very low message rate (#5346<https://github.com/syslog-ng/syslog-ng/pull/5346>) * network(), syslog() sources and destinations: fix TCP/TLS shutdown (#5271<https://github.com/syslog-ng/syslog-ng/pull/5271>) * http: Fixed a batching related bug that happened with templated URLs and a single worker. (#5281<https://github.com/syslog-ng/syslog-ng/pull/5281>) * network(), syslog() destinations: handle async TLS messages (KeyUpdate, etc.) (#5390<https://github.com/syslog-ng/syslog-ng/pull/5390>) Notes to developers * editorconfig: configure supported editors for the project's style (#5331<https://github.com/syslog-ng/syslog-ng/pull/5331>) Other changes * java-modules: Upgrade java common and hdfs dependencies. (#5366<https://github.com/syslog-ng/syslog-ng/pull/5366>) * java-modules: Remove depricated java destinations: elasticsearch2, kafka-java and the java-http. The following destinations can be used instead: * elasticsearch2 - Both elastic-datastream()<https://syslog-ng.github.io/admin-guide/070_Destinations/035_elasticsearch-…> or the elastic-http()<https://syslog-ng.github.io/admin-guide/070_Destinations/030_Elasticsearch-…> can be used. * kafka-java - The C based kafka-c()<https://syslog-ng.github.io/admin-guide/070_Destinations/100_Kafka-c/README> destination can be used instead. To help with migration check out the Shifting from Java implementation to C implementation<https://syslog-ng.github.io/admin-guide/070_Destinations/100_Kafka-c/001_Sh…> page. * java-http - the C based http()<https://syslog-ng.github.io/admin-guide/070_Destinations/081_http/README> destination can be used. (#5366<https://github.com/syslog-ng/syslog-ng/pull/5366>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Alex Becker, Attila Szakacs, Balazs Scheidler, Bálint Horváth, David Mandelberg, Eli Schwartz, Hofi, Kovács Gergő Ferenc, László Várady, Peter Czanik (CzP), Petr Vaganov, Shiraz, Szilard Parrag, Tamas Pal, Tamás Kosztyu, shifter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

3 3

The syslog-ng Insider 2025-08: HDFS; configuration; Prometheus
by Peter Czanik (pczanik) 14 Aug '25

14 Aug '25

Dear syslog-ng users, This is the 133rd issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Deprecating Java-based drivers from syslog-ng: Is HDFS next? ------------------------------------------------------------ While most Java-based drivers have been deprecated in syslog-ng years ago, we have recently removed all of them in preparation to syslog-ng 4.9.0. Right now, the only Java-based driver remaining is HDFS, so we want to ask the syslog-ng community if the HDFS destination is still needed for them. https://www.syslog-ng.com/community/b/blog/posts/deprecating-java-based-dri… Your first steps configuring syslog-ng -------------------------------------- Some of our most active users chose syslog-ng because of its detailed and accurate documentation (https://syslog-ng.github.io/) Later I received complaints that it is too detailed, and we need a tutorial: https://peter.czanik.hu/posts/syslog-ng-tutorial-toc/. This time, I was asked for something even shorter. Here you are! https://www.syslog-ng.com/community/b/blog/posts/your-first-steps-configuri… Prometheus exporter in syslog-ng -------------------------------- Last year, we published a Prometheus exporter for syslog-ng, implemented in Python. However, syslog-ng 4.9.0 will include one that runs as part of syslog-ng. Needless to say, testing and feedback are very welcome! https://www.syslog-ng.com/community/b/blog/posts/prometheus-exporter-in-sys… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

The syslog-ng Insider 2025-06: arm64; PAM; testing
by Peter Czanik (pczanik) 18 Jun '25

18 Jun '25

Dear syslog-ng users, This is the 132nd issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Installing nightly syslog-ng arm64 packages on a Raspberry Pi -------------------------------------------------------- Last week, I posted about running nightly syslog-ng container images on arm64. However, you can also install syslog-ng directly on the host (in my case, a Raspberry Pi 3), running the latest Raspberry OS. https://www.syslog-ng.com/community/b/blog/posts/installing-nightly-syslog-… Working with One Identity Cloud PAM Linux agent logs in syslog-ng ------------------------------------------------- One Identity Cloud PAM is one of the latest security products by One Identity. It provides asset management as well as secure and monitored remote access for One Identity Cloud users to hosts on their local network. Last year, I showed you how collect One Identity Cloud PAM Network Agent log messages on Windows and create alerts when somebody connects to a host on your local network using PAM Essentials. This time, I will show you how to work with the Linux version of the Network Agent. https://www.syslog-ng.com/community/b/blog/posts/working-with-one-identity-… Testing the new syslog-ng wildcard-file() source options on Linux ---------------------------------------------------------- Last year, syslog-ng 4.8.0 improved the wildcard-file() source on FreeBSD and MacOS. Version 4.9.0 will do the same for Linux by using inotify for file and directory monitoring, resulting in faster performance while using significantly less resources. This blog is a call for testing the new wildcard-file() source options before release. https://www.syslog-ng.com/community/b/blog/posts/testing-the-new-syslog-ng-… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng to Azure Sentinel
by David Jones 23 May '25

23 May '25

I am dealing with the known Cisco bug for Excessive logging of "vpn:vpn [INFO] device" messages in /var/log/messages file. It is filling our ingestion cap. I have tried numerous ways to block this from being ingested but nothing has worked(adding filter and log). Below is my syslog-ng.conf and I am looking for any advice to stop the "vpn:vpn [INFO] device" messages from being sent. There are no syslog ids for this either so blocking it from FMC also isn't working source s_sys { system(); internal(); # udp(ip(0.0.0.0) port(514)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" flush_lines(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_kern { file("/var/log/kern"); }; destination d_mlal { usertty("*"); }; filter f_kernel { facility(kern); }; filter f_default { level(info..emerg) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_auth { facility(authpriv); }; filter f_mail { facility(mail); }; filter f_emergency { level(emerg); }; filter f_news { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_boot { facility(local7); }; filter f_cron { facility(cron); }; #log { source(s_sys); filter(f_kernel); destination(d_cons); }; log { source(s_sys); filter(f_kernel); destination(d_kern); }; log { source(s_sys); filter(f_default); destination(d_mesg); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_mail); destination(d_mail); }; log { source(s_sys); filter(f_emergency); destination(d_mlal); }; log { source(s_sys); filter(f_news); destination(d_spol); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; log { source(s_sys); filter(f_cron); destination(d_cron); }; # Source additional configuration files (.conf extension only) @include "/etc/syslog-ng/conf.d/*.conf" # vim:ft=syslog-ng:ai:si:ts=4:sw=4:et: # # source s_src { udp( port(514)); tcp( port(514));}; Confidentiality Notice: This message is confidential, intended only for the named recipient(s) and may contain information that is privileged, attorney work product or exempt from disclosure under applicable law. If you are not the intended recipient(s), you are notified that the dissemination, distribution or copying of this message is strictly prohibited. If you receive this message in error, or are not the named recipient(s), please notify the sender at the email address or Becket & Lee, LLP at 610-644-7800 and delete this email from your computer. Receipt by anyone other than the named recipient(s) is not a waiver of any attorney-client, work product, or other applicable privilege. Thank you.

2 1

Re: [syslog-ng] trouble using kubernetes source
by Evan Rempel 22 May '25

22 May '25

Thanks. I had to install all auxiliary syslog-ng packages and do a recursive grep to find it. Then trace the found file back to the rpm needed. Finally remove all of the auxiliary packages and install just the one I needed. syslog-ng-python-modules Which had a dependency on syslog-ng-python I have what I need now. Thanks. -- Evan ________________________________ From: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of Balazs Scheidler <bazsi77(a)gmail.com> Sent: May 22, 2025 2:05 PM To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] trouble using kubernetes source You don't often get email from bazsi77(a)gmail.com. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification> Kubernetes used Python under the hood, so the kubernetes source might be packaged along with the python package. On Thu, May 22, 2025, 22:30 Evan Rempel <erempel(a)uvic.ca<mailto:erempel@uvic.ca>> wrote: I'm running syslog-ng-4.8.1-2.el8.x86_64 from the copr stable repository. I'm trying to configure the kubernetes() source. By compete configuration file is @version: 4.8 @include 'scl.conf' source s_k8s { kubernetes(); }; When I check this syntax Error parsing config, syntax error, unexpected LL_IDENTIFIER, expecting '}' in /etc/syslog-ng/kubernetes.conf:7:5-7:15: 2 3 @include 'scl.conf' 4 5 6 source s_k8s { 7-----> kubernetes(); 7-----> ^^^^^^^^^^ 8 }; I can't find any information on where the kubernets source is defined. Is this defined in a scl include? Do I need another rpm package? Do I need to load a module? What is my next step? -- Evan ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

trouble using kubernetes source
by Evan Rempel 22 May '25

22 May '25

I'm running syslog-ng-4.8.1-2.el8.x86_64 from the copr stable repository. I'm trying to configure the kubernetes() source. By compete configuration file is @version: 4.8 @include 'scl.conf' source s_k8s { kubernetes(); }; When I check this syntax Error parsing config, syntax error, unexpected LL_IDENTIFIER, expecting '}' in /etc/syslog-ng/kubernetes.conf:7:5-7:15: 2 3 @include 'scl.conf' 4 5 6 source s_k8s { 7-----> kubernetes(); 7-----> ^^^^^^^^^^ 8 }; I can't find any information on where the kubernets source is defined. Is this defined in a scl include? Do I need another rpm package? Do I need to load a module? What is my next step? -- Evan

2 1

The syslog-ng Insider 2025-05: develop branch; Active Roles; ARM container
by Peter Czanik (pczanik) 15 May '25

15 May '25

Dear syslog-ng users, This is the 131st issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Introducing the develop branch of the syslog-ng git repo -------------------------------------------------------- For many years, the development of syslog-ng happened on the master branch in Git. However, if you follow that branch, you might have noticed that there has not been much activity on it lately. That is because we introduced a new branch in git called “develop”. https://www.syslog-ng.com/community/b/blog/posts/introducing-the-develop-br… Working with Active Roles debug logs in syslog-ng ------------------------------------------------- >From my previous Active Roles blogs, you could learn how to forward regular Active Roles logs from Windows Event Log to a central syslog-ng server, where it parses, filters, stores and forwards the logs. In this blog, I show you how to work with Active Roles debug logs, that is reading them using syslog-ng Agent for Windows and forwarding them to a central syslog-ng server for long(er) term storage. https://www.syslog-ng.com/community/b/blog/posts/working-with-active-roles-… Nightly arm64 syslog-ng container builds are now available ---------------------------------------------------------- Recently we enabled nightly syslog-ng builds and container builds for arm64. It means that from now on, you can run the latest syslog-ng on 64bit ARM platforms. https://www.syslog-ng.com/community/b/blog/posts/nightly-arm64-syslog-ng-co… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng version 4.8.2 is available
by Peter Czanik (pczanik) 07 May '25

07 May '25

Hi, Sources for syslog-ng version 4.8.2 are now available. Packages, container images, FreeBSD ports, etc. will follow in the coming hours and days. Peter Bugfixes * CVE-2024-47619 fixed: When using a wildcard syntax in the configuration file to specify the tls certificate name, syslog-ng would match the wildcard too loosely, accepting more than the intended certificate name. This could be exploited by knowing the original certificate name(s) and guessing the wildcard string used to match the correct certificate(s) and then creating fake certificates also satisfying the guessed wildcard sting using g_pattern_match_simple(). Since this exploit needs inside information, and does not lead to data loss or privileged access, it was deemed low impact. * s3: Bugfixes and general stability improvements for the s3 destination driver Refactored the python s3 destination driver to fix a major bug causing data loss if multithreaded upload was enabled via the upload-threads option. This pull request also Important: * Fixes another bug generic to all python drivers, causing syslog-ng to intermittently crash if stopped by SIGINT. * Adds a new suffix option to the s3 destination driver. The default suffix is .log, denoting file extension. * Removes more than 600 lines of superfluous code. * Brings major stability improvements to the s3 driver. * This change affects the naming of multipart objects, as the sequence index is moved in front of the suffix. * The upload-threads option is changed to act on a per-object basis, changing the maximum thread count dependent on max-pending-uploads * upload-threads. (#5257<https://github.com/syslog-ng/syslog-ng/pull/5257>) * We forgot to update all the scl files we have after a bug fix in 4.8.1. Also adds a more detailed HTTP error response logging of compressed error response data. Fixes elasticsearch-http() and other destinations. (#5232<https://github.com/syslog-ng/syslog-ng/pull/5232>) * cfg: Fixed syslog-ng crashing on startup when using certain scl drivers without some options defined. (#5163<https://github.com/syslog-ng/syslog-ng/pull/5163>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Bálint Horváth, David Mcanulty, Franco Fichtner, Hofi, Kovács Gergő Ferenc, László Várady, Romain Tartière, Tamas Pal, sulpher Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

stats frequency
by Peter Czanik (pczanik) 07 May '25

07 May '25

Hi, By default, syslog-ng saves statistics data every ten minutes. Nowadays there are much better methods to monitor syslog-ng (hello Prometheus). However, there are people who use it as a kind of mark message. Question: should we keep the 10 minutes default, or disable it completely? It can be set using stats(freq()); Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

2 1

Sending logs to Loki
by Alexey Vlasov 06 May '25

06 May '25

Hi, in accordance with: https://syslog-ng.github.io/admin-guide/070_Destinations/125_Loki/001_Loki_… I try to send logs to my loki server @version: 4.8 @include "scl.conf" options { chain_hostnames(off); use_fqdn(no); keep_hostname(yes); dns-cache-expire(87600); }; source s_internal { internal(); }; destination d_loki { loki( url("my.loki.ip.here:13100") port(13100) labels( "server" => "my-syslog-server", ) template("${MESSAGE}") auth(insecure()) ); }; log { source(s_internal); destination(d_loki); flags(final); }; but always get: 2025-05-06 15:00:50.373 Error establishing connection to server; driver='d_loki#0', worker_index='0', location= Test requests through curl pass well (from syslog host). Dump from tcpdump: - from syslog-ng: .U.Q...5PRI * HTTP/2.0 SM ..$.....................?.....?...... .................?.. - response from loki ...-.U.QHTTP/1.1 301 Moved Permanently Location: /%2A Date: Tue, 06 May 2025 11:56:42 GMT Content-Length: 0 Connection: close what could be wrong with my conf? Thanks in advance.

1 0

is multi-line support available?
by David Beecher 24 Apr '25

24 Apr '25

Hello, The available packages for linux do not seem to include "multi-line" and I downloaded the repository from git and tried to build with multi-line and it won't build completely. I need multiline to support tomcat logs, etc... am I going in the wrong direction? Thanks, David -- *David Beecher, President and CEO 720.729.0404 x8101* TekOps, Inc. <http://www.tekops.com> <http://www.tekops.com> We solve SoHo business needs! We bring enterprise solutions to SoHo business Websites, Email, Telephone Integration, CRM, Helpdesk, Intranet, and more /This email may contain data that is confidential, proprietary or "non-public personal information," as that term is defined in the Gramm-Leach-Bliley Act (collectively, "Confidential Information"). The Confidential Information is disclosed conditioned upon your agreement that you will treat it confidentially and in accordance with applicable law, ensure that such data is nto used or disclosed except for the limited purpose for which it's being provided and will ntoify and cooperate with us regarding any requested or unauthorized disclosure or use of any Confidential Information. By accepting and reviewing the Confidential Information you agree to indemnify us against any losses or expenses, including attorney's fees that we may incur as a result of any unauthorized use or disclosure of this data due to your acts or omissions. If a party other than the intended recipient receives this e-mail you are requested to instantly notify us of the erroneous delivery and return to us all dat so delivered./

2 1

Breaking changes between versions
by Faine, Mark R. (MSFC-IS64)[AEGIS] 22 Apr '25

22 Apr '25

I need to go from 3.31.2 to 3.37.1. Should I expect any breaking changes? Also, Redhat Insights is reporting that syslog-ng and syslog-ng-logrotate are signed with SHA1, are the newer packages signed with SHA2? Red Hat recommends that you adopt any of the options below: * Contact vendors of the packages to ask for new builds signed with supported signatures and re-install the new packages, * Resign packages with your own SHA-2 key or completely remove packages until a new build with SHA-2 signature is available from the 3rd-party vendor Thanks, Mark

2 2

The syslog-ng Insider 2025-04: Elasticsearch beta; Active Roles; RHEL UBI
by Peter Czanik (pczanik) 10 Apr '25

10 Apr '25

Dear syslog-ng users, This is the 130th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Testing Elasticsearch 9.0.0 beta1 with syslog-ng ------------------------------------------------ Each time a new major Elasticsearch version is released, someone asks if it works with syslog-ng. So I gave it a quick test and based on that, it works fine. But of course, some terms and conditions apply… :-) https://www.syslog-ng.com/community/b/blog/posts/testing-elasticsearch-9-0-… Working with parsed Active Roles logs in syslog-ng -------------------------------------------------- In my previous Active Roles blog, you learned how to forward Active Roles logs to a central syslog-ng server to parse and store the logs. In this blog, I’ll show you how to: - Work with parsed Active Roles logs. - Store logs to various document stores. - Prepare long-term storage. - Send alerts for some critical events. https://www.syslog-ng.com/community/b/blog/posts/working-with-parsed-active… Running syslog-ng PE in RHEL UBI --------------------------------- Recently I have posted a Dockerfile to run syslog-ng in an Alma Linux container. I got some encouraging feedback, so this week I experimented with syslog-ng Premium Edition (PE) in a RHEL UBI (Universal Base Image) container. While this is not officially supported by One Identity, we are really interested in your feedback. https://www.syslog-ng.com/community/b/blog/posts/running-syslog-ng-pe-in-rh… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Ticket Received - syslog-ng Digest, Vol 239, Issue 9
by Example 27 Mar '25

27 Mar '25

Dear Syslog-ng, We would like to acknowledge that we have received your request and a ticket has been created. A support representative will be reviewing your request and will send you a personal response.(usually within 24 hours). To view the status of the ticket or add comments, please visit https://teeraphanaotjantuek-help.freshdesk.com/helpdesk/tickets/3988 Thank you for your patience. Sincerely, Teeraphan Aotjantuek Support Team

2 1

Ticket Received - syslog-ng Digest, Vol 239, Issue 4
by Example 27 Mar '25

27 Mar '25

Dear Syslog-ng, We would like to acknowledge that we have received your request and a ticket has been created. A support representative will be reviewing your request and will send you a personal response.(usually within 24 hours). To view the status of the ticket or add comments, please visit https://teeraphanaotjantuek-help.freshdesk.com/helpdesk/tickets/3668 Thank you for your patience. Sincerely, Teeraphan Aotjantuek Support Team

1 0

Ticket Received - syslog-ng Digest, Vol 239, Issue 8
by Example 27 Mar '25

27 Mar '25

Dear Syslog-ng, We would like to acknowledge that we have received your request and a ticket has been created. A support representative will be reviewing your request and will send you a personal response.(usually within 24 hours). To view the status of the ticket or add comments, please visit https://teeraphanaotjantuek-help.freshdesk.com/helpdesk/tickets/3935 Thank you for your patience. Sincerely, Teeraphan Aotjantuek Support Team

1 0

Ticket Received - syslog-ng Digest, Vol 239, Issue 7
by Example 27 Mar '25

27 Mar '25

Dear Syslog-ng, We would like to acknowledge that we have received your request and a ticket has been created. A support representative will be reviewing your request and will send you a personal response.(usually within 24 hours). To view the status of the ticket or add comments, please visit https://teeraphanaotjantuek-help.freshdesk.com/helpdesk/tickets/3849 Thank you for your patience. Sincerely, Teeraphan Aotjantuek Support Team

1 0

Ticket Received - syslog-ng Digest, Vol 239, Issue 6
by Example 27 Mar '25

27 Mar '25

Dear Syslog-ng, We would like to acknowledge that we have received your request and a ticket has been created. A support representative will be reviewing your request and will send you a personal response.(usually within 24 hours). To view the status of the ticket or add comments, please visit https://teeraphanaotjantuek-help.freshdesk.com/helpdesk/tickets/3787 Thank you for your patience. Sincerely, Teeraphan Aotjantuek Support Team

1 0

Ticket Received - syslog-ng Digest, Vol 239, Issue 5
by Example 27 Mar '25

27 Mar '25

Dear Syslog-ng, We would like to acknowledge that we have received your request and a ticket has been created. A support representative will be reviewing your request and will send you a personal response.(usually within 24 hours). To view the status of the ticket or add comments, please visit https://teeraphanaotjantuek-help.freshdesk.com/helpdesk/tickets/3772 Thank you for your patience. Sincerely, Teeraphan Aotjantuek Support Team

1 0

Re: [syslog-ng] syslog-ng Digest, Vol 239, Issue 4
by Linn, William 27 Mar '25

27 Mar '25

Peter, The error I got was. warning: /tmp/syslog-ng-4.8.1-2.fc40.src.rpm: Header V4 RSA/SHA256 Signature, key ID bb1105ce: NOKEY I had downloaded it from the site, cannot remember exactly as it was done a couple of months ago preparing to upgrade the current version from 4.X. We are on RHEL 7 and upgrading the environment to RHEL 9. I do notice that the older version is.... syslog-ng-3.5.6-3.el7.x86_64.rpm and what I downloaded is syslog-ng-4.8.1-2.fc40.src.rpm maybe I have a source that needs compiled? Thanks William -----Original Message----- From: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: Thursday, March 27, 2025 8:00 AM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 239, Issue 4 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://urldefense.com/v3/__https://lists.balabit.hu/mailman/listinfo/syslo… or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. link (Linn, William) 2. Re: link (Peter Czanik (pczanik)) ---------------------------------------------------------------------- Message: 1 Date: Wed, 26 Mar 2025 12:06:03 +0000 From: "Linn, William" <wlinn(a)bofa.com> To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] link Message-ID: <e79007df7d2a4403b32d9f8b6a0c679a(a)bofa.com> Content-Type: text/plain; charset="us-ascii" I downloaded the RPM for RHEL 9 syslog-ng but getting a weird error. Can someone send the the link so I can make sure I have the right one? Thanks William ---------------------------------------------------------------------- This message, and any attachment(s), is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.bankofamerica.com/electronic-disclaimer. If you are not the intended recipient, please delete this message. For more information about how Bank of America protects your privacy, including specific rights that may apply, please visit the following pages: https://business.bofa.com/en-us/content/global-privacy-notices.html (which includes global privacy notices) and https://www.bankofamerica.com/security-center/privacy-overview/ (which includes US State specific privacy notices such as the http://www.bankofamerica.com/ccpa-notice)

3 4

link
by Linn, William 27 Mar '25

27 Mar '25

I downloaded the RPM for RHEL 9 syslog-ng but getting a weird error. Can someone send the the link so I can make sure I have the right one? Thanks William ---------------------------------------------------------------------- This message, and any attachment(s), is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.bankofamerica.com/electronic-disclaimer. If you are not the intended recipient, please delete this message. For more information about how Bank of America protects your privacy, including specific rights that may apply, please visit the following pages: https://business.bofa.com/en-us/content/global-privacy-notices.html (which includes global privacy notices) and https://www.bankofamerica.com/security-center/privacy-overview/ (which includes US State specific privacy notices such as the http://www.bankofamerica.com/ccpa-notice)

2 1

The syslog-ng Insider 2025-03: EPEL 10; Elasticsearch; Active Roles
by Peter Czanik (pczanik) 12 Mar '25

12 Mar '25

Dear syslog-ng users, This is the 129th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Test syslog-ng on EPEL 10! -------------------------- CentOS Stream 10 and EPEL 10 just became available, and as usual, I tried to build syslog-ng as soon as possible. For now it is available in my git snapshot repository, but I am also planning to make it available in EPEL 10 soon. https://www.syslog-ng.com/community/b/blog/posts/test-syslog-ng-on-epel-10 Collecting Active Roles logs centrally using the syslog-ng Windows Agent -------------------------------- One Identity Active Roles allows you to easily and securely manage Active Directory (AD), Entra ID and M365 Identity objects. While Active Roles stores its log messages into Windows Event Log, most log management and log analytics applications expect to receive log messages over the syslog protocol. This is where syslog-ng Premium Edition (PE) can help you. The syslog-ng Windows Agent can collect and forward Active Roles log messages from Windows Event Log, while the syslog-ng server can collect, process, store and forward Active Roles log messages to multiple destinations. https://www.syslog-ng.com/community/b/blog/posts/collecting-active-roles-lo… syslog-ng OSE 4.8.1 is now in EPEL 10, quick fix for Elasticsearch --------------------------------- This blog is just a quick announcement that syslog-ng 4.8.1 is now available in EPEL 10, so you do not have to use the testing repository anymore. Thanks everyone for the feedback! However, support for Elasticsearch 7+ is broken in this release, as some of you reported. You can fix this problem as described in https://github.com/syslog-ng/syslog-ng/issues/5207 by removing references to “type”. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-ose-4-8-1-is-now… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

TCP orig_log_iw_size='3', why?
by claudio＠witel.it 02 Mar '25

02 Mar '25

Hello syslog-ng community, I get this warning at syslog-ng start (or restart) when running journalctl [...] Feb 27 02:46:57 xxxsplunksyslog1 syslog-ng[2998304]: [2025-02-27T02:46:57.330923] WARNING: window sizing for tcp sources were changed in syslog-ng 3.3, the configuration value was divided by the value of max-connections(). The result was too small, clamping to value of min_iw_size_per_reader. Ensure you have a proper log_fifo_size setting to avoid message loss.; orig_log_iw_size='3', new_log_iw_size='100', min_iw_size_per_reader='100', min_log_fifo_size='30000' Feb 27 02:46:57 xxxsplunksyslog1 systemd[1]: Started System Logger Daemon. I thought the orig_log_iw_size value was coming from the formula log_iw_size/max_connections which should be 100/300=1/3 What is this orig_log_iw_size='3' ? Thanks.

2 4

The syslog-ng Insider 2025-02: Prometheus; RHEL UBI; WSL
by Peter Czanik (pczanik) 19 Feb '25

19 Feb '25

Dear syslog-ng users, This is the 128th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Syslog-ng Prometheus exporter added to RPM syslog-ng container image ------------------------------------------------- Recently I introduced you to my latest project: a syslog-ng container based on Alma Linux. Now I also added a syslog-ng Prometheus exporter to the container, so you can monitor syslog-ng, if you enable it. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-prometheus-expor… Running syslog-ng PE in RHEL UBI -------------------------------- Recently I have posted a Dockerfile to run syslog-ng in an Alma Linux container. I got some encouraging feedback, so this week I experimented with syslog-ng Premium Edition (PE) in a RHEL UBI (Universal Base Image) container. While this is not officially supported by One Identity, we are really interested in your feedback. https://www.syslog-ng.com/community/b/blog/posts/running-syslog-ng-pe-in-rh… Running a syslog-ng server in WSL --------------------------------- Windows Subsystem for Linux (WSL) allows you to run Linux applications on a Windows host. While you can install and run syslog-ng on a default WSL installation, it is not really practical: there is no systemd and WSL is behind NAT. This blog gives you some pointers for working around these problems. https://www.syslog-ng.com/community/b/blog/posts/running-a-syslog-ng-server… WEBINARS * New webinar: “High Availability for syslog-ng Store Box”. You can register for it at https://www.syslog-ng.com/event/high-availability-for-syslog-ng-store-box-/ * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

CRL handling in syslog
by Shankar Pramanik 18 Feb '25

18 Feb '25

I've configured syslog-ng 3.35.1 to use CRLs but things aren't working as expected. This is what I've done : 1. Create a self-signed CA and use it to sign a server certificate. The server certificate has a CRL distribution point in it. 2. Revoke the server certificate. Generate the revoked CRL and put it on the syslog client under /etc/syslog-ng/crl in PEM format. There's a <issuer hash>.r0 link to the CRL in this directory. 3. Configure ca-dir and crl-dir in the client's syslog config. Configure the client to connect to the remote syslog server. With this setup, I' d expect the syslog client to reject the server certificate since it's revoked, but that doesn't happen. The TLS handshake and subsequent communication is successful. Is there anything that I'm missing ? Any pointers will be appreciated. I can provide additional details of my setup if needed. Thanks! Shankar.

3 3

syslog-ng 3.38 UDP errors and missing messages
by Taavi Ansper 11 Feb '25

11 Feb '25

Hi I am running a syslog server that is having problems getting all of the data via UDP. I have gone through most of the tips for making the performance better, but something is still amiss. 1. The syslog-ng server is running in an VM. 8vcpu and 8gb RAM. Debian 12. 2. After restarting or starting the server the UDP errors are tamed. nstat -asz | grep Error UdpInErrors 0 0.0 UdpRcvbufErrors 0 0.0 After 15 minutes or so the errors start to appear. (This amount of errors is after some time.) UdpInErrors 6734175 0.0 UdpRcvbufErrors 6734175 0.0 After some time it starts to receive the packets again. I can see all of this clearly in my graylog graphics that sucks that log data in. (added picture) https://imgur.com/a/eeRpovh It goes like a sinewave up and down every 15 minutes or so. My config looks like this. options { ts-format(iso); frac-digits(6); keep-timestamp(no); chain-hostnames(no); keep-hostname(no); use-dns(yes); use-fqdn(yes); create-dirs(yes); dir-owner(root); dir-group(adm); dir-perm(0750); owner(root); group(adm); perm(0640); log-fifo-size(100000); }; source clients { network( transport(udp) so-rcvbuf(32MiB) log-iw-size(250k) log-fetch-limit(10k) ); network( transport(tcp) max-connections(100) so-rcvbuf(32MiB) log-iw-size(250k) log-fetch-limit(10k) ); }; source forward { network( port(6514) transport(tcp) keep-timestamp(yes) keep-hostname(yes) ); }; destination file { file("/srv/log/${HOST}/${FACILITY}.log"); }; destination forward { network( "192.168.X.X" port(6514) transport(tcp) so-keepalive(yes) disk-buffer( mem-buf-size(512M) disk-buf-size(2048M) reliable(yes) ) ); }; destination graylog { network( "192.168.X.X" port(5140) flags(syslog-protocol) transport(tcp) so-keepalive(yes) disk-buffer( mem-buf-size(512M) disk-buf-size(2048M) reliable(yes) ) ); }; filter graylog { host("^gw-example-") }; log { source(clients); destination(file); destination(forward); flags(flow-control); }; log { source(forward); destination(file); flags(flow-control); }; log { source(clients); filter(graylog); destination(graylog); flags(flow-control); }; My rmem_max is set like so: sysctl net.core.rmem_max net.core.rmem_max = 33445532 Any suggestions? Best regards -- Taavi Ansper taavi.ansper(a)cyber.ee

2 1

The syslog-ng Insider 2025-01: Alpine Linux; Leap 16.0; Alma Linux
by Peter Czanik (pczanik) 16 Jan '25

16 Jan '25

Dear syslog-ng users, This is the 127th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS A syslog-ng container image based on Alpine Linux ------------------------------------------------- Recently, someone suggested I should check out Alpine Linux and prepare a syslog-ng container image based on it. While not supported by the syslog-ng project, an Alpine-based syslog-ng container image already exist as part of the Linuxserver project. https://www.syslog-ng.com/community/b/blog/posts/a-syslog-ng-container-imag… Call for testing: syslog-ng in openSUSE Leap 16.0 ------------------------------------------------- Last week, I submitted syslog-ng to openSUSE Leap 16.0. While the distro is still in a pre-alpha stage, everything already works for me as expected. Well, except for syslog-ng, where I found a number of smaller problems. As such, this blog is a call for testing, both for syslog-ng on openSUSE Leap 16.0 and also for the distribution itself.https://www.syslog-ng.com/community/b/blog/posts/call-for-testing-sy… Experimental syslog-ng container image based on Alma Linux ---------------------------------------------------------- The official syslog-ng container image is based on Debian Stable. However, we’ve been getting requests for an RPM-based image for many years. So, I made an initial version available based on Alma Linux and now I need your feedback about it! https://www.syslog-ng.com/community/b/blog/posts/experimental-syslog-ng-con… WEBINARS * New webinar: “Performance tuning for syslog-ng deployments”. You can register for it at https://www.syslog-ng.com/event/performance-tuning-for-syslog-ng-deployment… * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0