- syslog-ng - lists.balabit.hu

Re: [syslog-ng] periodic disconnect of TCP sessions
by Wilson, Jonathan 15 Nov '19

15 Nov '19

Laci, thank you for your thoughts and questions. Some answers: My organization controls all the clients, but there are a _lot_ of them. Most are network devices or applications. Yes, the reason for multiple instances is HA. We have one in each of our data centers. A hardware load balancer provides the DNS entry and resolution (a "wide IP"), and it IS aware of the states of the servers - it checks both every few seconds to ensure that it can establish a TCP connection. If it cannot, the DNS name will not be switched to that server's IP. System load is not high. Both are VMs with multiple (virtual) CPUs, and syslog-ng rarely uses more than 10% of CPU. We get about 10k UDP messages per minute and about 1000 over TCP. None of the usual stress indicators - no UDP Rcvbuf errors, no bottlenecks that I can see. When initially set up, having two copies of every syslog was not a problem - it's just disk space. But when we starting indexing them in Splunk, it became a concern since Splunk is licensed by the volume of data indexed. Concurrent connections - less than 20 TCP connections at a time. I suppose what I'm looking for is a more granular load balancing, if that makes sense. With UDP, it's very granular, since each packet is sent statelessly to wherever the "wide IP" points at that second. But with TCP, long-lived connections are the rule - great for throughput, but they kind of defeat the purpose. If syslog-ng kept a count of messages received over each TCP connection and did an orderly shutdown after "n" had been received, the client would reconnect seamlessly and all would be well. Alternatively, shut down a TCP connection after it had been open for "n" seconds. Thanks, Jon Message: 1 Date: Fri, 15 Nov 2019 10:16:18 +0000 From: "Laszlo Szemere (lszemere)" <Laszlo.Szemere(a)oneidentity.com> To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] periodic disconnect of TCP sessions Message-ID: <BL0PR1901MB20170F90FB51A130781F3F429D700(a)BL0PR1901MB2017.namprd19.prod.outlook.com> Content-Type: text/plain; charset="Windows-1252" Hello Jon, There is currently no way to deliberately terminate an active TCP session. What I was thinking about, that there might be a better approach to the original problem, and terminating the TCP session is just a fragile workaround. I have a couple of questions about your setup, so I can get a better understanding of the problem: - Is all of the clients controlled by you? (Maybe they are syslog-ng instances in the first place?) - Is there a particular reason to have multiple syslog-ng instances? At a first glance (with the parallel sending) it looked like a HA(ish) setup, but the later round-robin solution ruled it out. Also it looks like the DNS server is not aware of the states of the servers. - What is the current load on the system? Have you experienced any throttling or bottle neck. (Why do I ask? If the reason behind using multiple syslog-ng instances, is to load balance the traffic for the Splunk servers, than it can be achieved in a different way. - How many concurrent connections do you expect at the peak load? Best regards, Laci ________________________________________ From: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of Wilson, Jonathan <jonathan.wilson(a)vumc.org> Sent: Wednesday, November 13, 2019 23:03 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] periodic disconnect of TCP sessions CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe. Hello all, I am using a pair of syslog-ng OSE 3.22.1 servers that write logfiles which are then scanned by a Splunk Universal Forwarder. They receive messages over TCP, TCP with TLS, and UDP. We have always had devices and systems that send us syslog messages simply send to both syslog-ng servers; however, this resulted in double indexing of the log data in Splunk. To deal with this we set up a DNS name that round-robins across the two syslog-ng servers’ IPs every 30 seconds. The devices and systems that send to us now send to that DNS name. That neatly prevents the double indexing. If the messages are coming in over stateless UDP, the messages are load balanced in that they all go to one server for 30 seconds, then the other. However, TCP sessions are much longer lived, and some senders send many messages every second – they will latch onto one of our syslog servers and stay connected to it all day. What I am looking for is a way to limit the lifetime of a TCP connection into syslog-ng, either by time or by number of messages received; after the connection is dropped, the sender will reconnect to whichever server is indicated by the round-robin DNS name, and over time about half of the messages will go to each server. Is there already a way to do this? Failing that, can you suggest a place to start in patching the source? Thanks, Jon

1 0

periodic disconnect of TCP sessions
by Wilson, Jonathan 15 Nov '19

15 Nov '19

Hello all, I am using a pair of syslog-ng OSE 3.22.1 servers that write logfiles which are then scanned by a Splunk Universal Forwarder. They receive messages over TCP, TCP with TLS, and UDP. We have always had devices and systems that send us syslog messages simply send to both syslog-ng servers; however, this resulted in double indexing of the log data in Splunk. To deal with this we set up a DNS name that round-robins across the two syslog-ng servers' IPs every 30 seconds. The devices and systems that send to us now send to that DNS name. That neatly prevents the double indexing. If the messages are coming in over stateless UDP, the messages are load balanced in that they all go to one server for 30 seconds, then the other. However, TCP sessions are much longer lived, and some senders send many messages every second - they will latch onto one of our syslog servers and stay connected to it all day. What I am looking for is a way to limit the lifetime of a TCP connection into syslog-ng, either by time or by number of messages received; after the connection is dropped, the sender will reconnect to whichever server is indicated by the round-robin DNS name, and over time about half of the messages will go to each server. Is there already a way to do this? Failing that, can you suggest a place to start in patching the source? Thanks, Jon

2 1

Insider 2019-11: logging to Elasticsearch; PE 6 to 7 upgrade; Elastic 7; in-list(); off-line deb; Splunk conf;
by Peter Czanik (pczanik) 14 Nov '19

14 Nov '19

Dear syslog-ng users, This is the 76th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Logging to Elasticsearch made simple with syslog-ng --------------------------------------------------- Elasticsearch is gaining momentum as the ultimate destination for log messages. You can store arbitrary name-value pairs coming from structured logging or message parsing and you can use Kibana as a search and visualization interface. You can use syslog-ng as an all in one solution (system and application logs, message parsing, filtering and queuing) to collect and forward log messages to Elasticsearch: https://www.syslog-ng.com/community/b/blog/posts/logging-to-elasticsearch-m… Upgrading syslog-ng PE from version 6 to 7 ------------------------------------------ Learn the major steps necessary to upgrade your system from syslog-ng Premium Edition version 6 to 7. As you will see, it is no more difficult than any other major software version upgrade, and after the upgrade you can start using all the new and useful features that are available in version 7. https://www.syslog-ng.com/community/b/blog/posts/upgrading-syslog-ng-pe-fro… syslog-ng and Elasticsearch 7: getting started on RHEL/CentOS ------------------------------------------------------------- Version 7 of the Elastic Stack, packed with new features and improved performance, has now been available for some time. Elasticsearch is not the only one to have come up with a major new version recently: starting with version 3.21, syslog-ng features a new Elasticsearch destination driver (based on the http() destination) that does not require Java. In most cases, it is more resource friendly than the Java-based driver and it is definitely easier to configure. It also has the benefit that unlike the Java-based driver, it can be included in Linux distributions. This is a quick how-to guide to get you started with syslog-ng and Elasticsearch 7 on RHEL/CentOS 7. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-and-elasticsearc… Handling lists in syslog-ng: the in-list() filter ------------------------------------------------- Recently, a number of quite complex configurations came up while syslog-ng users were asking for advice. Some of these configurations were even pushing the limits of syslog-ng (regarding the maximum number of configuration objects). As it turned out, these configurations could be significantly simplified using the in-list() filter, one of syslog-ng’s lesser known features. https://www.syslog-ng.com/community/b/blog/posts/handling-lists-in-syslog-n… Offline syslog-ng DEB package installer --------------------------------------- “How can I install the unofficial syslog-ng packages on a machine without Internet access?” This question has been raised several times recently. As it entails more than simply downloading the repository containing the packages, syslog-ng lead developer Laszlo Budai created a script that solves the problem for Debian and Ubuntu users. The script downloads syslog-ng along with its dependencies using a container, and produces an archive containing all DEB packages necessary to install syslog-ng as well as a simple script responsible for the installation. Using a container in this case might seem like over complication, but it is still the easiest way to ensure that all dependencies are included in the archive. https://www.syslog-ng.com/community/b/blog/posts/offline-syslog-ng-deb-pack… syslog-ng at Splunk .conf 2019 ------------------------------ The syslog-ng team participated at Splunk .conf 2019 and came home with positive experiences. They met enthusiastic users, who use syslog-ng in front of Splunk as log management layer. Many of them already using the HTTP event collector and use syslog-ng to load-balance log messages among collectors. They also demonstrated how syslog-ng can collect over one million log messages a second over UDP. https://twitter.com/OneIdentity/status/1187852500222693377 WEBINARS * You can achieve 1m+ UDP messages per second ingestion challenge: https://www.syslog-ng.com/webcast-ondemand/you-can-achieve-1m-udp-messages-… * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

3 3

syslog-ng in EPEL 8
by Peter Czanik (pczanik) 13 Nov '19

13 Nov '19

Hi, Version 3.23.1 of syslog-ng is now available in EPEL 8. It has most, but not all of the syslog-ng features available. Missing features: * kafka destination, C implementation, as librdkafka is too old * Java destination drivers (kafka, elastic, hdfs), as sources necessary to compile them are not in the distro. Note, that Elastic is supported through elastic-http() * tcp wrapper, as support was removed from RHEL * riemann does not have sub-second precision, as client in EPEL is too old As missing dependencies arrived to EPEL 8, right now the official EPEL 8 syslog-ng package has more features enabled, than my own experimental EPEL 8 package 🙂 Once 3.25.1 is released, I hope to support RHEL/CentOS 8 from my regular syslog-ng repositories. The difference is not as big as it was before missing dependencies became available, but I still need to figure out some RPM spec magic 🙂 EPEL 8 stays at 3.23 (no version update is allowed there). There are plans to allow new versions into EPEL with each new minor RHEL release, but seeing is believing. It was promised for too many years. Bye, Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

2 7

parse rancher logs from syslog-ng files
by Tech Gurus 13 Nov '19

13 Nov '19

Hi , I have setup where rancher 2.3 send logs ogs to syslog-ng server , I am getting several GB per hour and write them to text file. The log format are dynamic , general form are [timestamp SourceContainer-host-IP Source-Program list-of-nested-json-key/value-pairs] .. I got the elasticsearch forwarding wokring with config below, however all json kv gets written to message field.. I need to be able to : * Parse json kv into diffeent fields to elastic and flatten the json fields. * Use one field to create the index on destination elastic like "program" or custom added field on source side like "k8s-cluster-name" Thanks for help John destination d_elasticsearch_http { elasticsearch-http( url("https://elastricsearch:9200/_bulk") template("$(format-json --scope rfc5424 --scope dot-nv-pairs --rekey .* --shift 1 --scope nv-pairs --exclude DATE --key ISODATE @timestamp=${ISODATE})") index("syslog-ng-test") #time-zone("UTC") type("") workers(4) batch-lines(100) #batch-timeout(10000) #timeout(10) tls( #ca-dir("/etc/syslog-ng/conf.d") ca-file("/etc/syslog-ng/conf.d/root-ca.pem") cert-file("/etc/syslog-ng/conf.d/admin.pem") key-file("/etc/syslog-ng/conf.d/admin.key") peer-verify(no) ) ); };

2 1

Building syslog with cmake as external project
by Alexandre Santos 12 Nov '19

12 Nov '19

Hi All, I am trying to build syslog-ng with cmake to add it to a custom Linux distribution. The problem is that when the syslog-ng is compiled it gets the RPATH of the location where it has been generated: *root@5526d87140af:/home/src/**chassisx/build# ldd syslog-ng-install/sbin/syslog-* *ng linux-vdso.so.1 (0x00007fff151ed000) libsyslog-ng.so.3.24.1 => /home/src/target/build/**syslog-ng-install/lib/* *libsyslog-ng.so.3.24.1 (0x00007f81baf89000) libeventlog.so => /home/src/target/build/**syslog-ng-install/lib/* *libeventlog.so (0x00007f81bad84000) libgmodule-2.0.so.0 => /usr/lib/x86_64-linux-gnu/* *libgmodule-2.0.so.0 (0x00007f81bab80000) libgthread-2.0.so.0 => /usr/lib/x86_64-linux-gnu/* *libgthread-2.0.so.0 (0x00007f81ba97e000) libglib-2.0.so.0 => /lib/x86_64-linux-gnu/libglib-* *2.0.so.0 (0x00007f81ba66a000) libivykis.so.0 => /home/src/target/build/**syslog-ng-install/lib/* *libivykis.so.0 (0x00007f81ba45b000) libpcre.so.3 => /lib/x86_64-linux-gnu/libpcre.* *so.3 (0x00007f81ba1e8000) libresolv.so.2 => /lib/x86_64-linux-gnu/* *libresolv.so.2 (0x00007f81b9fd1000) libssl.so.1.1 => /usr/lib/x86_64-linux-gnu/* *libssl.so.1.1 (0x00007f81b9d65000) libcrypto.so.1.1 => /usr/lib/x86_64-linux-gnu/* *libcrypto.so.1.1 (0x00007f81b98cc000) libsecret-storage.so => /home/src/target/build/**syslog-ng-install/lib/* *libsecret-storage.so (0x00007f81b96c8000) libpthread.so.0 => /lib/x86_64-linux-gnu/* *libpthread.so.0 (0x00007f81b94ab000) libc.so.6 => /lib/x86_64-linux-gnu/libc.so.* *6 (0x00007f81b910c000) /lib64/ld-linux-x86-64.so.2 (0x00007f81bb48e000) libdl.so.2 => /lib/x86_64-linux-gnu/libdl.**so.2 (0x00007f81b8f08000)* I am using the cmake file in attachment. Can you help me? Thanks in advance, Alex

2 4

Insert SequenceNumber into FileName
by William Luiz Ribeiro Vasconcelos Da Silva 12 Nov '19

12 Nov '19

Good Morning Is this possible put some kind of sequence Number or some kind ID number at the fileName, when the syslog-ng is writing the file???? If it's possible, how to do this? Tks, Atenciosamente, WILLIAM LUIZ R V SILVA Mediation Ericsson, Brazil Mobile +55 11 97979-9886 wsilva_ericsson(a)timbrasil.com.br<mailto:wsilva_ericsson@timbrasil.com.br> www.ericsson.com<http://www.ericsson.com/> [Descri??o: Descri??o: Ericsson]<http://www.ericsson.com/> Esta mensagem, incluindo seus anexos, pode conter informa??es privilegiadas e/ou de car?ter confidencial, n?o podendo ser retransmitida sem autoriza??o do remetente. Se voc? n?o ? o destinat?rio ou pessoa autorizada para receb?-la, informamos que o seu uso, divulga??o, c?pia ou arquivamento s?o proibidos. Portanto, se voc? recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conte?do. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto

2 1

Certificate valid, but invalid purpose
by W3EUU 12 Nov '19

12 Nov '19

Running syslog-ng 3.22 OSE on Fedora 31 installation. I am in the process of implementing TLS encryption on the remote links. I have the links working, including the mutual authentication function. However, I am getting the warning "Certificate valid, but purpose is invalid" on startup. Since it is a warning, it does not seem to be affecting the functionality. The certificates are self signed, with TLS Web Server Authentication and TLS Web Client Authentication extensions, among others. I am unable to find any documentation defining what additional extensions are needed to silence this warning. Can anyone tell me what additional is required?

2 1

Syslog-ng don't Listening UDP packets PORT(514) - Problem History
by William Luiz Ribeiro Vasconcelos Da Silva 08 Nov '19

08 Nov '19

Good Morning, Yesterday, we performed the first test of syslog-ng 3.24 OSE on a RHEL 7.6 VM in our customer's production environment. And we identified a very strange behavior. We saw through tcpdump that packets were being received by the network card but were not captured by syslog-ng. We have a UDP packet send simulator, and when I was pointing my simulator to another IP on the same machine(the users' connection IP), syslog-ng does the capping and consequently the treatment we put into the syslog-ng.conf file. What kind of TROUBLESHOOTING we can do in order to identify the reason for syslog-ng to capture packets on the users' connection IP, but for the application connection IP, it doesn't identify anything. It is informed by the client at the beginning of our project that syslog should always capture all UDP packets received by the application IP. This is the configuration of the "source" we have on this machine in our client's productive environment. source s_model { #udp(port(514)); udp(ip(10.46.105.34) port(514)); # udp(); #network(transport("udp")); #network( # ip("10.46.105.34") # transport("udp") #); }; Tks, Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada para recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteúdo. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto

3 3

Syslog-ng don't Listening UDP packets PORT(514)
by William Luiz Ribeiro Vasconcelos Da Silva 08 Nov '19

08 Nov '19

Hello guys, We are doing a test in a VM RHEL 7.6, and the syslog-ng OSE 3.24, do Not capturing UDP packets. This is my configuration: ######################################################################################### source s_net { #udp(port(514)); udp(ip("10.46.105.34") port(514)); #udp(ip("10.25.17.4") port(514)); # udp(); #network(transport("udp")); #network( # ip("10.46.105.34") # transport("udp") #); }; destination d_dest { file("/syslog_out/${HOST}_${YEAR}${MONTH}${DAY}${HOUR}${MIN}${SEC}_GMT${TZ}_${RCPTID}.log" template("${PROGRAM};${MESSAGE};\n") owner(syslog) group(syslog) perm (0755) ); }; log { source(s_net ); destination(d_dest ); }; ########################################################################################### What kind of configuration i have to do, or what I need to check in OS, to do the capturing UDP packets. Tks, William Luiz Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada para recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteúdo. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto

1 0

syslog-ng-stable RPM repo
by Peter Czanik (pczanik) 04 Nov '19

04 Nov '19

Hi, Until now I had a single request for a syslog-ng-stable repo, which always contains the latest stable release of syslog-ng. But the discussion about my cleanup plans brought up the topic again, and Bazsi wrote me, that there were more such requests coming from the Splunk Slack channel. So I did it: * fedora/rhel/centos: https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng-stable/ * openSUSE/SLES: https://build.opensuse.org/project/show/home:czanik:syslog-ng-stable In theory it should be the exact copy of my unofficial 3.23.1 packages and some fixes backported for openSUSE Tumbleweed. New syslog-ng versions will first appear in versioned repositories, as usual. I plan to push packages to the stable repo only after a week or two delay, so there is time find major bugs, have a .2 release if necessary. Once we have more experience that it works as expected, I'll update my blogs and the syslog-ng website. Until that I'm waiting for your feedback, especially once 3.24.1 comes out. Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

2 2

GLib missing when running compilation with cmake
by Alexandre Santos 04 Nov '19

04 Nov '19

Hi All, I got the following error, when compiling with cmake: ... -- Found PkgConfig: /usr/bin/pkg-config (found version "0.29") CMake Error at /usr/share/cmake-3.7/Modules/FindPackageHandleStandardArgs.cmake:138 (message): Could NOT find GLIB (missing: GLIB_INCLUDE_DIRS GLIB_LIBRARIES GLIB_GMODULE_LIBRARIES GLIB_GTHREAD_LIBRARIES) Call Stack (most recent call first): /usr/share/cmake-3.7/Modules/FindPackageHandleStandardArgs.cmake:378 (_FPHSA_FAILURE_MESSAGE) cmake/Modules/FindGLIB.cmake:111 (FIND_PACKAGE_HANDLE_STANDARD_ARGS) CMakeLists.txt:168 (find_package) -- Configuring incomplete, errors occurred! See also "/thanos/src/syslog-ng/build/CMakeFiles/CMakeOutput.log". See also "/thanos/src/syslog-ng/build/CMakeFiles/CMakeError.log". Nevertheless, I have the following GLibs installed: root@5526d87140af:/asantos/src/syslog-ng-git# apt list libglib* Listing... Done libglib-object-introspection-perl/oldstable 0.042-1 amd64 libglib-perl/oldstable 3:1.324-1 amd64 libglib2.0-0/oldstable,now 2.50.3-2+deb9u1 amd64 [installed,automatic] libglib2.0-0-dbg/oldstable 2.50.3-2+deb9u1 amd64 libglib2.0-bin/oldstable 2.50.3-2+deb9u1 amd64 libglib2.0-cil/oldstable 2.12.40-2 amd64 libglib2.0-cil-dev/oldstable 2.12.40-2 amd64 libglib2.0-data/oldstable,now 2.50.3-2+deb9u1 all [installed,automatic] libglib2.0-dev/oldstable 2.50.3-2+deb9u1 amd64 libglib2.0-doc/oldstable 2.50.3-2+deb9u1 all libglib2.0-tests/oldstable 2.50.3-2+deb9u1 amd64 libglib3.0-cil/oldstable 2.99.3-2+b1 amd64 libglib3.0-cil-dev/oldstable 2.99.3-2+b1 amd64 libglibmm-2.4-1v5/oldstable 2.50.0-1 amd64 libglibmm-2.4-dev/oldstable 2.50.0-1 amd64 libglibmm-2.4-doc/oldstable 2.50.0-1 all root@5526d87140af:/asantos/src/syslog-ng-git# Can you explain me what is happening? Thanks, Alex

2 2

email alert on timeout
by Gregg Nicholas 31 Oct '19

31 Oct '19

I'm new to syslog-ng OSE. I've been able to follow the samples, and configured an email alert when a syslog message is received. Now I'm trying to configure an email alert when it has been too long since I've received a particular syslog message. First, I configured a destination: destination d_heartbeat { file("/var/log/heartbeat.log" mark-freq(60) mark-mode(dst-idle) ); }; Then, I configured a filter and log: filter f_heartbeat { match("I am still here" value("MESSAGE) ); }; Log { source(s_network); filter(f_heartbeat); destination(d_heartbeat); }; I was pleasantly surprised that this worked. The heartbeat.log file received the message, and 60 seconds later it received the "syslog -- MARK --" Since I wanted an email alert, I defined a new source, to grab the output of my heartbeat.log as input: source s_heartbeat { file(""/var/log/heartbeat.log"); }; destination d_smtp { smtp( host("10.10.10.25") port(25) from("syslog-ng" "noreply(a)mydomain.com <mailto:noreply@mydomain.com> ") to("me" "myemail(a)mydomain.com <mailto:myemail@mydomain.com> ") subject("host is down") body("no heartbeat received from the program on host\n") ); }; filter f_timeout { match ("MARK --" value("MESSAGE")); }; log { source(s_heartbeat); filter(f_timeout); destination(d_smtp); }; This seemed to work when I tested it with a single heartbeat followed by timeout, but I'm still misunderstanding something. If it gets more than one message written to heartbeat.log, then the timeout MARK doesn't happen. What am I missing? Is there a better way to accomplish this alert? Thanks, Gregg (running syslog-ng v3.19.1-5 on debian 10)

3 3

syslog-ng 3.22.1 consuming a lot of RAM on amqp or kafka destinations
by joao reis 24 Oct '19

24 Oct '19

Hi, I'm having high RAM consuming problems using both amqp or kafka destinations. I'm using patterndb (without any context definition) some basic filters. Changing the destination to "file" or "program" type, the high RAM problem doesn't happen. I tested these backends only in this version of syslog-ng and I don't know if it is a version specific problem. The backends are up and running and receiving correctly from syslog-ng. Here are my configurations: destination d_amqp { amqp( vhost("/email_log") host("127.0.0.1") port(5672) exchange("maillog") username("maillog") password("maillog") disk-buffer( mem-buf-size(10000) disk-buf-size(2000000) reliable(yes) dir("/tmp/disk-buffer") ) exchange-type("fanout") routing-key("") persistent(yes) value-pairs( scope("nv-pairs") ) ); }; destination d_kafka { kafka( bootstrap-servers("127.0.0.1:9092") topic("MYTOPIC") ); }; I added the disk-buffer option to see if it gets any better, but without any good result; Here the syslog-ng-ctl output, when configured to amqp: [root@logserver3 conf.d]# syslog-ng-ctl stats SourceName;SourceId;SourceInstance;State;Type;Number global;payload_reallocs;;a;processed;3635299 src.journald;s_sys#0;journal;a;processed;542 src.journald;s_sys#0;journal;a;stamp;1566648214 global;sdata_updates;;a;processed;0 global;scratch_buffers_bytes;;a;queued;512 source;s_host;;a;processed;5440633 destination;d_boot;;a;processed;0 destination;d_kern;;a;processed;9 source;s_sys;;a;processed;612 dst.amqp;d_amqp#0;amqp,/email_log,127.0.0.1,5672,maillog,fanout;a;dropped;0 dst.amqp;d_amqp#0;amqp,/email_log,127.0.0.1,5672,maillog,fanout;a;processed;2691676 dst.amqp;d_amqp#0;amqp,/email_log,127.0.0.1,5672,maillog,fanout;a;queued;0 dst.amqp;d_amqp#0;amqp,/email_log,127.0.0.1,5672,maillog,fanout;a;written;2691676 src.internal;s_sys#1;;a;processed;70 src.internal;s_sys#1;;a;stamp;1566648339 global;msg_clones;;a;processed;2691634 global;internal_queue_length;;a;processed;0 destination;d_spol;;a;processed;0 destination;d_mlal;;a;processed;0 center;;received;a;processed;5441245 destination;d_mesg;;a;processed;531 destination;d_mail;;a;processed;0 destination;d_auth;;a;processed;29 destination;d_cron;;a;processed;52 destination;d_amqp;;a;processed;2691676 global;scratch_buffers_count;;a;queued;5970004541496 center;;queued;a;processed;2692297 Thanks in advance.

2 3

Use specific python3 binary file
by Armando Martires 24 Oct '19

24 Oct '19

Hi, I have a python destination but I have to use a python3 that is not the system installed python3, in order to use a speficic set of libraries that can't be installed system wide. This alternative python3 is in a folder /apps/python3. How can I configure syslog-ng to use this alternative binary file? Thanks! Regards, Armando Mártires

2 4

Monitoring log traffic
by László Pál 18 Oct '19

18 Oct '19

Hi, My shiny new log infrastructure is almost complete, however I still have some maintenance kind of work to be done, so I asked myself, why not ask community? :) So, it is basically just a server to store logs from various places as usual, however I would like to implement some anomaly detection. I mean, if some logs sources are sending significantly less or more logs a day. Do you think there is an easy solution for this? If needed, I have also a Graylog instance to index logs, so I’m already thinking to implement some kind of alerting there, however obviously I’m not sending everything to Graylog, just what users need to search, so I’m thinking about something I can put on the syslog-ng server and relays to detect anomalies. Any thoughts? Thanks Laszlo

1 0

syslog-ng 3.24 OBS packages for Ubuntu 19.10
by Laszlo Budai 18 Oct '19

18 Oct '19

Hi, syslog-ng 3.24 packages are available for Ubuntu 19.10 wget -qO - http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/xUb… | sudo apt-key add - echo "deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/xUb… ./<http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/xUb…>" | sudo tee /etc/apt/sources.list.d/syslog-ng-obs.list sudo apt-get update sudo apt-get install syslog-ng-core regards, Laszlo Budai

1 0

Install Syslog-ng OSE into Virtual Machine - RHEL OS
by William Luiz Ribeiro Vasconcelos Da Silva 17 Oct '19

17 Oct '19

Good aftenoon ! I will install the syslog-ng OSE into a virtual machine with RHEL 7. Is there anything I should worry about when installing on a virtual machine? Is there something to configurated on OS, before or after the install syslog-ng? Tks, William Luiz Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada para recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteúdo. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto

3 4

Syslog-ng + graylog2 destination
by László Pál 14 Oct '19

14 Oct '19

Hi, I’m playing with syslog-ng OSE and Graylog. In this project I try to find the best method to deliver logs from my central log server to Graylog. So far, it seems graylog2 destination looks the best, however I have a strange issue and I can’t find a solution It seems the other side permanenty drops the connections like this Oct 14 13:53:20 lumberjack syslog-ng[2174]: Casting error; value='', type-hint='int32' Oct 14 13:53:20 lumberjack syslog-ng[2174]: I/O error occurred while writing; fd='481', error='Connection reset by peer (104)' Oct 14 13:53:20 lumberjack syslog-ng[2174]: Syslog connection broken; fd='481', server='AF_INET(10.72.0.137:12201)', time_reopen='10' Oct 14 13:53:30 lumberjack syslog-ng[2174]: Syslog connection established; fd='501', server='AF_INET(10.72.0.137:12201)', local='AF_INET(0.0.0.0:0)’ My destination config is quite simple #Graylog native GELF destination destination d_graylog_gelf { graylog2( log_fifo_size(500000) host("10.72.0.137") transport (tcp) ); }; I’ve tried this with flow-control and w/o flow-control, so I think it must be some tuning issue either on Graylog side or at Syslog. What is interesting, is I don’t have such an issue if I use raw-tcp or syslog destinations toward Graylog Thx L:

2 3

"Reinsert" message into syslog-ng via pipe?
by Matthias Gruber 14 Oct '19

14 Oct '19

Hi Perhaps my idea is absolutely nuts and there is a better way, but I would like to do the following: I receive weblogs in apache-format from my F5 Loadbalancer via syslog-tcp now I would like to use the apache-accesslog-parser on the message to extract some values more easy. I would try to setup following (not a syslog-ng syntax in that description) source: F5 -- via 5140/tcp into syslog-ng syslog-ng: Destination pipe(my-f5-logs) syslog-ng: source(pipe(my-f5-logs)) -> parser(apache-accesslog-parser) -> extract some fields -> write to file The whole runs on the same syslog-ng Is that too complex or a normal way? We are running a syslog-ng OSE 3.23.1 Any clues or a simple "nod thats okay" would be nice cheers Matthias ------------------------------------------------------------------------------------ METZLER Informationstechnologie Matthias Gruber IT-Infrastruktur & -Betrieb B. Metzler seel. Sohn & Co. Kommanditgesellschaft auf Aktien Untermainanlage 1 60329 Frankfurt am Main Telefon (0 69) 21 04 - 43 30 Telefax (0 69) 21 04 - 40 40 MGruber(a)metzler.com www.metzler.com Persönlich haftende Gesellschafter: Harald Illy, Michael Klaus, Friedrich von Metzler, Emmerich Müller, Gerhard Wiesheu Vorsitzender des Aufsichtsrats: Dr. Christoph Schücking Sitz der Gesellschaft: Frankfurt am Main, Handelsregister-Nr. HRB 27 515 Diese Nachricht ist vertraulich. Sollten Sie nicht der vorgesehene Empfänger sein, so bitten wir Sie höflich, dies unverzüglich dem Absender mitzuteilen und die Nachricht zu löschen. Es ist unzulässig, die Nachricht unbefugt weiterzuleiten oder zu kopieren. Da wir nicht die Echtheit oder Vollständigkeit der in dieser Nachricht enthaltenen Informationen garantieren oder zusichern können, sind die vorstehenden Ausführungen rechtlich nicht bindend. Eine Haftung hierfür wird ausgeschlossen. This message is confidential. If you are not the intended recipient, we kindly ask you to inform the sender and delete the information. Any unauthorised dissemination or copying hereof is prohibited. As we cannot guarantee or assure the genuineness or completeness of the information contained in this message, the statements set forth above are not legally binding. Accordingly we cannot accept any liability for their contents.

3 2

unix-stream: ignore non-existent pipe
by Sergey 10 Oct '19

10 Oct '19

Hello. Can I configure syslog-ng to ignore non-existing unix-stream? -- Regards, Sergey

4 6

Adding new fields to existing logs
by Allen Olivas 09 Oct '19

09 Oct '19

Hello, I need to add some new fields to an existing log before it gets sent to its destination. I'm trying to decode these logs with Wazuh and will need some unique fields in the beginning of the message so I can successfully prematch my decoder. I was looking through previous cases and saw the comments on Regular Expressions in rewrite. After studying those posts to this mailing list (https://lists.balabit.hu/pipermail/syslog-ng/2019-August/025392.html) and reviewing the documentation I'm pretty sure this can be done, just not sure how to start, to use a macro or no macro, template or no template. Here are the specifics: Raw log file snippet: "Oct 1 13:48:01 SOME-DEVICE-HOSTNAME Core: Last message...." I would like to add something like "Ruckus VirtualSmartZone" to the log before SOME-DEVICE-HOSTNAME. So the new log entry that goes to the destination looks like "Oct 1 13:48:01 Ruckus VirtualSmartZone SOME-DEVICE-HOSTNAME Core: Last message..." Do I need to write a filter (with regex) to screen for the time stamp and hostname, then rewrite it to add that entry "Ruckus VirtualSmartZone"? Or if not how best to approach this? Thanks, Allen Olivas

2 2

Unofficial Debian(including Debian 10)/Ubuntu packages for syslog-ng 3.24.1
by Laszlo Budai 08 Oct '19

08 Oct '19

Hi, syslog-ng 3.24.1[1] packages are available in OBS repo[2, 3]. List of supported OSs: * Debian 8.0 * Debian 9.0 [including armv7l] * Raspbian 9.0 * Ubuntu 14.04 * Ubuntu 16.04 * Ubuntu 18.04 * Ubuntu 18.10 newly added distributions: * Rasbian 10 * Debian 10 (without java modules) * Ubuntu 19.04 (without java modules) Please note that newly added distributions are not tested yet. Any feedback are welcome. Install ------- example: Debian 9.0 1. get release key wget -qO - http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… | sudo apt-key add - 2. add repo to APT sources eg.: /etc/apt/sources.list.d/syslog-ng-obs.list deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… ./ Then `apt-get update` and `apt-get install syslog-ng-core` Links -------- [1] https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.24.1<https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.23.1> [2] https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-…<https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-…> [3] https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-… regards, Laszlo Budai

1 0

syslog-ng-3.24.1
by Laszlo Budai 08 Oct '19

08 Oct '19

3.24.1 Highlights * Add a new template function called $(format-flat-json), which generates flattened json output. This is useful for destinations, where the json parsing does not handle nested json format. (#2890<https://github.com/syslog-ng/syslog-ng/pull/2890>) * Add ISO 8601 compliant week numbering. Use it with the ${ISOWEEK} macro and and all its variants: S_ISOWEEK, R_ISOWEEK and C_ISOWEEK. (#2878<https://github.com/syslog-ng/syslog-ng/pull/2878>) * Add add-contextual-data() glob selector. It matches the message with shell style globbing. Enable it by setting selector(glob("$my_template") in the add-contextual-data() block. (#2936<https://github.com/syslog-ng/syslog-ng/pull/2936>) * Add new rewrite operations to manipulate the timezone portion of timestamps have been added. set-timezone() to set the timezone value to a specific value, fix-timezone() to fix up an incorrectly recognized timezone and guess-timezone() to automatically deduce the timezone value on the assumption that the message is received in near real time. (#2818<https://github.com/syslog-ng/syslog-ng/pull/2818>) * Send Server Name Identification (SNI) information with transport(tls). Enable it by setting the sni(yes) option in the tls block in your destination. (#2930<https://github.com/syslog-ng/syslog-ng/pull/2930>) Features * templates: change the $LOGHOST macro to honour use-fqdn() (#2894<https://github.com/syslog-ng/syslog-ng/pull/2894>) * Define syslog-ng-sysconfdir (#2932<https://github.com/syslog-ng/syslog-ng/pull/2932>) * dqtool: add assign dqfile to persist file feature (#2872<https://github.com/syslog-ng/syslog-ng/pull/2872>) Bugfixes * Fix backtick subsitution of defines/environment variables in the main configuration file. (#2906<https://github.com/syslog-ng/syslog-ng/issues/2906>, #2909<https://github.com/syslog-ng/syslog-ng/pull/2909>) * Fix SCL block parameter substitution of quoted escaped newline (#2901<https://github.com/syslog-ng/syslog-ng/pull/2901>) * python, diskq, random-generator source: crash after failed reload (#2907<https://github.com/syslog-ng/syslog-ng/pull/2907>) * Fix crash at shutdown on 32bit systems (#2893<https://github.com/syslog-ng/syslog-ng/issues/2893>, #2895<https://github.com/syslog-ng/syslog-ng/pull/2895>) * Invalidate the value of the LEGACY_MSGHDR macro in case either the PID or the PROGRAM macros are unset() using a rewrite rule. Previously LEGACY_MSGHDR would retain the old values. (#2896<https://github.com/syslog-ng/syslog-ng/pull/2896>) * on 32bit platform diskq ftruncate could fail due to size 32/64 interface (#2892<https://github.com/syslog-ng/syslog-ng/pull/2892>) * Support new tzdata format, starting from version 2009.XXX, in tzinfo parser. (#2898<https://github.com/syslog-ng/syslog-ng/pull/2898>) * udp, udp6, tcp, tcp6, syslog, network destination: Correctly detect and set IP_MULTICAST_TTL in case of multicast ip address (#2905<https://github.com/syslog-ng/syslog-ng/pull/2905>) * Fix hostname resolve on systems with only the loopback network interface configured (#2933<https://github.com/syslog-ng/syslog-ng/pull/2933>) * wildcard-file(): Add multi-line(), pad_size() and multi-line-mode() option validation. (#2922<https://github.com/syslog-ng/syslog-ng/pull/2922>) * kafka-c: Fix multiple memleaks (#2944<https://github.com/syslog-ng/syslog-ng/pull/2944>) Other changes * geoip: remove deprecated module, geoip2 database location detection (#2780<https://github.com/syslog-ng/syslog-ng/pull/2780>) * various refactor, build issue fixes (#2902<https://github.com/syslog-ng/syslog-ng/pull/2902>) Notes to the developers * LightRunWithStrace: Run syslog-ng behind strace (#2921<https://github.com/syslog-ng/syslog-ng/pull/2921>) * LightVerboseLogOnError: Increase default pytest verbosity on error (#2919<https://github.com/syslog-ng/syslog-ng/pull/2919>) * Dbld image caching (#2858<https://github.com/syslog-ng/syslog-ng/pull/2858>) * Dbld gradle caching (#2857<https://github.com/syslog-ng/syslog-ng/pull/2857>) * logreader,logsource: move scratch-buffer mark and reclaim into LogSource (#2903<https://github.com/syslog-ng/syslog-ng/pull/2903>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Antal Nemes, Attila Szakacs, Balazs Scheidler, Bertrand Jacquin, Gabor Nagy, Henrik Grindal Bakken, Kerin Millar, kjhee43, Laszlo Budai, Laszlo Szemere, László Várady, Péter Kókai, Raghunath Adhyapak, Zoltan Pallagi.

1 0

group-by() send all messages to destination() ?
by Jason Cooper 06 Oct '19

06 Oct '19

All, I have Cloudflare Workers sending log messages to my syslog-ng server. There is an intermediary step where nginx receives a POST with a JSON body containing all the messages for a given run (try{}catch(e){} ensures it sends the accumulated messages at the end of each run). Some Lua in the nginx server parses the JSON and separates the array of messages into individual writes to the unix domain socket syslog-ng is listening on. This whole setup is tested, and working great. I even get the stack trace (JS, not a core dump) when I screw up. :-) Now, I'd like to auto-fire an email on certain events. e.g. when .json.level == "CRIT" (script threw an error). The trick is, I'd like to dump *all* the log messages for the matching run (only a single line from a run might match) to the email / process destination. See the commented out alert_parser{}, below. The last message of every run (equivalent to a unique .json.rayid, which I treat as a process id) always starts with 'BAIL'. So I use that as a trigger. I've been using $searchengine[*] and not been able to figure out how to send /all/ of the messages in a group to aggregate(). I even dug into the source a bit and saw that I can reference messages by '@2' for the second message back. But I see no way to a) get the number of messages, b) loop through the messages, or c) reference all of them, e.g. '@*'. Has anyone solved this problem? tia, Jason. ----------->8--------------------------------------------------------- @version: 3.22 # common parser nginx-lua-parser { json-parser (prefix(".json.")); }; #parser alert_parser { # grouping-by( # key("${json.rayid}") # scope("process") # timeout(5) # having("CRIT") # trigger("BAIL") # aggregate( # value("MESSAGE" "\n\n") # inherit-mode("context") # ) # inject-mode("pass-through") # ); #}; # template nginx-lua-template "${.json.timestamp} ${.json.colo} ${.json.script}[${.json.rayid}]: ${.json.level} ${.json.message}\n"; source worker-src { unix-stream("/var/run/nginx-lua/worker.sock", group(nginx) flags(no-parse)); }; # development logs filter worker-dev-filter {match("-dev" value (".json.script"));}; destination worker-dev-dest { file("/var/log/worker/development.log" template(nginx-lua-template)); }; log { source(worker-src); parser(nginx-lua-parser); filter(worker-dev-filter); destination(worker-dev-dest); }; # production logs filter worker-prod-filter {match("-prod" value (".json.script"));}; destination worker-prod-dest { file("/var/log/worker/production.log" template(nginx-lua-template)); }; log { source(worker-src); parser(nginx-lua-parser); filter(worker-prod-filter); destination(worker-prod-dest); };

4 10

In-list problem
by László Pál 04 Oct '19

04 Oct '19

Hi, I have a strange (at least to me :) issue. In my new system I’m heavily using in-list in my filters to tell which logs should be forwarded. In my lists it is sometimes hostnames, sometimes programs sometimes source IP, but it is very erratic. What I think because I’m using it wrong. What exact pattern matching is used in this feature? Is this posix regex or simply glob? I have lines like this in my files 1.2..3.4 Host.domain.com ssh.* host.* The problem is, sometimes it is matches sometimes not…. So, my question is how to use it to work properly? Unfortunately the admin guide is quite poor around this subject Thanks Laszlo

1 1

Remove Part of message
by William Luiz Ribeiro Vasconcelos Da Silva 03 Oct '19

03 Oct '19

Good afternoon every one!, This is a example of message collected using syslo-ng: RELEASE: 100.80.93.85 -> 189.40.107.74:55200-55215 0x5d8f3e5a And I need remove from message this part: 0x5d8f3e5a. My question is, how I can remove it ? Because the message should be send to destination without this part. Thanks for your help! William Luiz Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada para recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteúdo. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto

2 1

Re: [syslog-ng] filter not working
by Lin, Victor 01 Oct '19

01 Oct '19

Dear all, I found my issue with syslog-ng.conf's filter. After I replaced "or" with "and". Filter start working Thank you! VL -----Original Message----- From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: 2019, September, 30 1:28 AM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 173, Issue 34 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. filter not working (Lin, Victor) 2. Re: filter not working (Attila Szakacs (aszakacs)) ---------------------------------------------------------------------- Message: 1 Date: Mon, 30 Sep 2019 01:19:35 +0000 From: "Lin, Victor" <victor.lin(a)rbc.com> To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] filter not working Message-ID: <9715f6b2792e4fbf919ab60ef8c5205a(a)SXSCMA01.fg.rbc.com> Content-Type: text/plain; charset="utf-8" Dear all, I don't want forwarding the syslog messages which contain the following to my local syslog, so I setup the filter like below ISDN-6-CONNECT ISDN-6-DISCONNECT changed by user However the messages contain the above are still show up in my local syslog file ForMe.log Below is from my syslog-ng.conf source s_network { network( transport("udp") port(514) flags(syslog_protocol) keep_hostname(yes) keep_timestamp(yes) use_dns(yes) use_fqdn(yes) ); }; destination d_ForMe_logs { file("/app/syslog-ng/custom/output/ForMe.log"); }; filter f_DoNotSendtoMe { not match("ISDN-6-CONNECT" value("MESSAGE")); or not match("ISDN-6-DISCONNECT" value("MESSAGE")); or not match("changed by user" value("MESSAGE")); }; log { source(s_network); filter(f_DoNotSendtoMe); destination(d_ForMe_logs); }; Do I missing any confing ? Thank you so much for your expertize! VL -----Original Message----- From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: 2019, September, 27 12:52 PM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 173, Issue 33 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: Enable SNI (Server Name Identification) in TLS connection (Raghunath Adhyapak) ---------------------------------------------------------------------- Message: 1 Date: Fri, 27 Sep 2019 22:22:14 +0530 From: Raghunath Adhyapak <funduraghu(a)gmail.com> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] Enable SNI (Server Name Identification) in TLS connection Message-ID: <CAEiok=Qrmw-s5r-ttRrQyQ+8CSq0BzdXgfzw+L0GhvR0_w-gUg(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" I built from source and tested and it worked fine I need Deb package to ease install on my machines. I can wait for some more time. Raghu On Fri, Sep 27, 2019, 12:35 Gabor Nagy (gnagy) <Gabor.Nagy(a)oneidentity.com> wrote: > If you would like to test before the upcoming release, you can create > a deb package with our docker based package scripts: > https://github.com/syslog-ng/syslog-ng/tree/master/dbld > > depending on your platform, it would be "dbld/rules deb" or > "dbld/rules deb-ubuntu-xenial" > > > Regards, > Gabor > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Thursday, September 26, 2019 15:30 > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Thanks. Now waiting for Debian package > > Raghu > > On Thu, Sep 26, 2019, 18:26 Attila Szakacs (aszakacs) < > Attila.Szakacs(a)oneidentity.com> wrote: > > Hi Raghu, > > It got merged to master! 🙂 > https://github.com/syslog-ng/syslog-ng/pull/2930 > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit > hub.com%2Fsyslog-ng%2Fsyslog-ng%2Fpull%2F2930&data=02%7C01%7Cgabor.nag > y%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e4 > 39c989c1867ec606603%7C0%7C0%7C637051014645449880&sdata=CYEi5latvJWnPQo > 7xYHa3klvdXiNVyXai5PhV51yVeI%3D&reserved=0> > > Best regards, > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Wednesday, September 18, 2019 5:35 PM > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > That's awesome. > > Thanks > Raghu > > On Wed, Sep 18, 2019, 17:05 Attila Szakacs (aszakacs) < > Attila.Szakacs(a)oneidentity.com> wrote: > > To the other question: It will be merged on the master branch probably > in a week. > > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Attila Szakacs (aszakacs) <Attila.Szakacs(a)oneidentity.com> > *Sent:* Wednesday, September 18, 2019 1:28 PM > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Hi Raghu, > > You are welcome! Thanks for the good idea. > If everything goes well, this feature will be released in version > 3.24, in > 3-4 weeks. > The packaging happens at the same time, you will find the 3.24 > installer at > https://download.opensuse.org/repositories/home:/laszlo_budai:/syslog- > ng/ > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdow > nload.opensuse.org%2Frepositories%2Fhome%3A%2Flaszlo_budai%3A%2Fsyslog > -ng%2F&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b0 > 7d408d74285c639%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014 > 645459869&sdata=krct3nD%2BVSMEQG00R0VJO2D1CeLqITAi8ZNTI7mV1a8%3D&reser > ved=0> > > Best regards, > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Wednesday, September 18, 2019 12:50 PM > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Hi Atilla, > > I updated the code, compiled it and tested the changes. > The changes works as expected. > Thanks for the addressing the issue in such a short time. > > Follow-up question: > When will this change get merged into the master branch? > Also, when will this get packaged in Debian package? > > Thanks > Raghu > > On Tue, Sep 17, 2019 at 4:27 PM Attila Szakacs (aszakacs) < > Attila.Szakacs(a)oneidentity.com> wrote: > > Hi Raghu, > > Currently we are not sending SNI extension in the Client Hello message. > However, I made a PR to implement this: > https://github.com/balabit/syslog-ng/pull/2930 > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit > hub.com%2Fbalabit%2Fsyslog-ng%2Fpull%2F2930&data=02%7C01%7Cgabor.nagy% > 40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439 > c989c1867ec606603%7C0%7C0%7C637051014645459869&sdata=IlcWEnngIqkJFPjWv > S7hrar4Tli4Kqgad5IdN7X5WVc%3D&reserved=0> > > Can you build syslog-ng from source? It would be great, if you tested > the PR. > > Best regards, > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Tuesday, September 17, 2019 9:05 AM > *To:* syslog-ng(a)lists.balabit.hu <syslog-ng(a)lists.balabit.hu> > *Subject:* [syslog-ng] Enable SNI (Server Name Identification) in TLS > connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Hi, > > I am using TLS over TCP connection to forward my syslog events to a > remote server. > My remote server uses SNI (Server Name Identification) to route > connections/events to one of the available backend servers. > > I observe that syslog-ng doesn't send SNI during TLS handshake. > > How can I enable it? > > My configuration is as follows: > > =================================== > source s_net { syslog(transport(udp) port(1514)); }; destination d_tcp > { > tcp( > "XX.example.net > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2FXX.e > xample.net&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf4 > 30b07d408d74285c639%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C63705 > 1014645469860&sdata=RTiMaNycpB56zTGx2gmqeFESNI2QO3JvOvSXUyC2MRk%3D&res > erved=0> > " > port(96) > tls( > peer-verify(required-untrusted) > ca_dir("/etc/syslog-ng/ssl") > > key-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.key.pem") > > cert-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.cert.pem") > ) > ); > }; > log { > source(s_net); > destination(d_tcp); > }; > =================================== > > I want syslog-ng to send XX.example.net > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2FXX.e > xample.net&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf4 > 30b07d408d74285c639%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C63705 > 1014645469860&sdata=RTiMaNycpB56zTGx2gmqeFESNI2QO3JvOvSXUyC2MRk%3D&res > erved=0> > as SNI to my remote server > > Please advise > > Thanks > Raghu > > ______________________________________________________________________ > ________ Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flis > ts.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cgabor.na > gy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e > 439c989c1867ec606603%7C0%7C0%7C637051014645479861&sdata=gHBU5J5tU99NDH > J4PwjtxlnS0jVp2Vxh%2BgAuiTsVKaE%3D&reserved=0> > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02 > %7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c63 > 9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014645479861&sdat > a=NmD0lHSiQw0DbM8voUKjVOFX2fSnDwhyqaZvA7%2BBmnA%3D&reserved=0> > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cgabor.nagy%40oneiden > tity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439c989c1867 > ec606603%7C0%7C0%7C637051014645489858&sdata=9VaEY4yqC3Y8y0gQZbVY6M0g%2 > F2rhXsfXRlw2%2Fwbik2s%3D&reserved=0> > > > ______________________________________________________________________ > ________ Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flis > ts.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cgabor.na > gy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e > 439c989c1867ec606603%7C0%7C0%7C637051014645489858&sdata=EWEYbbHYLIenlm > GBceeB%2B0pLauNIABFmT0dt6%2F77TUs%3D&reserved=0> > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02 > %7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c63 > 9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014645499850&sdat > a=mVlgDpNt3RVoHdr7ESi2Im89VnA0W7NOjkQbB11V3LM%3D&reserved=0> > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cgabor.nagy%40oneiden > tity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439c989c1867 > ec606603%7C0%7C0%7C637051014645499850&sdata=mNe53MBvTKfpkm1a%2FS6rEvCt > YPwO3Pfjca0jLyPNeqw%3D&reserved=0> > > > ______________________________________________________________________ > ________ Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flis > ts.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cgabor.na > gy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e > 439c989c1867ec606603%7C0%7C0%7C637051014645509849&sdata=YUrhyXSF6MkgRf > RsxlOWqsSBsedoNo8UPb292Y0vTps%3D&reserved=0> > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02 > %7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c63 > 9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014645509849&sdat > a=I2zhc1DPDcvLEShMr4v2V2MgtEZf72oDOvqx%2F607r%2BA%3D&reserved=0> > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cgabor.nagy%40oneiden > tity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439c989c1867 > ec606603%7C0%7C0%7C637051014645519834&sdata=eicWBDsPB4aguw98EKqegLs0ZB > NcHmbifbm8lEFeKF0%3D&reserved=0> > > > ______________________________________________________________________ > ________ Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190927/04aa6f04/a…> ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng ------------------------------ End of syslog-ng Digest, Vol 173, Issue 33 ****************************************** _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future. ------------------------------ Message: 2 Date: Mon, 30 Sep 2019 05:28:01 +0000 From: "Attila Szakacs (aszakacs)" <Attila.Szakacs(a)oneidentity.com> To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] filter not working Message-ID: <MN2PR19MB32298B32AD5C8D777E992FF59E820(a)MN2PR19MB3229.namprd19.prod.outlook.com> Content-Type: text/plain; charset="utf-8" Hi, I think your filter expression should have "and" instead of "or", like: filter f_DoNotSendtoMe { not match("ISDN-6-CONNECT" value("MESSAGE")); and not match("ISDN-6-DISCONNECT" value("MESSAGE")); and not match("changed by user" value("MESSAGE")); }; Just imagine: with "or" connections, when you receive a message with "ISDN-6-DISCONNECT", syslog-ng checks the first expression: not match("ISDN-6-CONNECT" value("MESSAGE")); It will be true, as it does not match with "ISDN-6-CONNECT", so the whole filter returns true. With "and" connections, we make sure, that none of the expressions match with the message. Best regards, Attila ________________________________ From: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of Lin, Victor <victor.lin(a)rbc.com> Sent: Monday, September 30, 2019 3:19 AM To: syslog-ng(a)lists.balabit.hu <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] filter not working CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe. Dear all, I don't want forwarding the syslog messages which contain the following to my local syslog, so I setup the filter like below ISDN-6-CONNECT ISDN-6-DISCONNECT changed by user However the messages contain the above are still show up in my local syslog file ForMe.log Below is from my syslog-ng.conf source s_network { network( transport("udp") port(514) flags(syslog_protocol) keep_hostname(yes) keep_timestamp(yes) use_dns(yes) use_fqdn(yes) ); }; destination d_ForMe_logs { file("/app/syslog-ng/custom/output/ForMe.log"); }; filter f_DoNotSendtoMe { not match("ISDN-6-CONNECT" value("MESSAGE")); or not match("ISDN-6-DISCONNECT" value("MESSAGE")); or not match("changed by user" value("MESSAGE")); }; log { source(s_network); filter(f_DoNotSendtoMe); destination(d_ForMe_logs); }; Do I missing any confing ? Thank you so much for your expertize! VL -----Original Message----- From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: 2019, September, 27 12:52 PM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 173, Issue 33 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.bal… or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: Enable SNI (Server Name Identification) in TLS connection (Raghunath Adhyapak) ---------------------------------------------------------------------- Message: 1 Date: Fri, 27 Sep 2019 22:22:14 +0530 From: Raghunath Adhyapak <funduraghu(a)gmail.com> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] Enable SNI (Server Name Identification) in TLS connection Message-ID: <CAEiok=Qrmw-s5r-ttRrQyQ+8CSq0BzdXgfzw+L0GhvR0_w-gUg(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" I built from source and tested and it worked fine I need Deb package to ease install on my machines. I can wait for some more time. Raghu On Fri, Sep 27, 2019, 12:35 Gabor Nagy (gnagy) <Gabor.Nagy(a)oneidentity.com> wrote: > If you would like to test before the upcoming release, you can create > a deb package with our docker based package scripts: > https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgith > ub.com%2Fsyslog-ng%2Fsyslog-ng%2Ftree%2Fmaster%2Fdbld&data=02%7C01 > %7Cattila.szakacs%40oneidentity.com%7Cb9e9365d670d40a9c18708d7454447a9 > %7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637054031891964192&s > data=KqQzgSFM9LZjrO8Yoe%2FInZ64tgMoydhB4REPmH7TEM8%3D&reserved=0 > > depending on your platform, it would be "dbld/rules deb" or > "dbld/rules deb-ubuntu-xenial" > > > Regards, > Gabor > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Thursday, September 26, 2019 15:30 > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Thanks. Now waiting for Debian package > > Raghu > > On Thu, Sep 26, 2019, 18:26 Attila Szakacs (aszakacs) < > Attila.Szakacs(a)oneidentity.com> wrote: > > Hi Raghu, > > It got merged to master! 🙂 > https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgith > ub.com%2Fsyslog-ng%2Fsyslog-ng%2Fpull%2F2930&data=02%7C01%7Cattila > .szakacs%40oneidentity.com%7Cb9e9365d670d40a9c18708d7454447a9%7C91c369 > b51c9e439c989c1867ec606603%7C0%7C0%7C637054031891964192&sdata=8vSu > SCX6t33xfYtXSKmsH2WIxkr6CXrKT0MnGnYVulw%3D&reserved=0 > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit > hub.com%2Fsyslog-ng%2Fsyslog-ng%2Fpull%2F2930&data=02%7C01%7Cgabor.nag > y%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e4 > 39c989c1867ec606603%7C0%7C0%7C637051014645449880&sdata=CYEi5latvJWnPQo > 7xYHa3klvdXiNVyXai5PhV51yVeI%3D&reserved=0> > > Best regards, > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Wednesday, September 18, 2019 5:35 PM > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > That's awesome. > > Thanks > Raghu > > On Wed, Sep 18, 2019, 17:05 Attila Szakacs (aszakacs) < > Attila.Szakacs(a)oneidentity.com> wrote: > > To the other question: It will be merged on the master branch probably > in a week. > > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Attila Szakacs (aszakacs) <Attila.Szakacs(a)oneidentity.com> > *Sent:* Wednesday, September 18, 2019 1:28 PM > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Hi Raghu, > > You are welcome! Thanks for the good idea. > If everything goes well, this feature will be released in version > 3.24, in > 3-4 weeks. > The packaging happens at the same time, you will find the 3.24 > installer at > https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdown > load.opensuse.org%2Frepositories%2Fhome%3A%2Flaszlo_budai%3A%2Fsyslog- > &data=02%7C01%7Cattila.szakacs%40oneidentity.com%7Cb9e9365d670d40a > 9c18708d7454447a9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C6370540 > 31891964192&sdata=hLf%2BXVakNoLjXSxORRVifqFgKK%2F84YvD564uAe1AErE% > 3D&reserved=0 > ng/ > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdow > nload.opensuse.org%2Frepositories%2Fhome%3A%2Flaszlo_budai%3A%2Fsyslog > -ng%2F&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b0 > 7d408d74285c639%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014 > 645459869&sdata=krct3nD%2BVSMEQG00R0VJO2D1CeLqITAi8ZNTI7mV1a8%3D&reser > ved=0> > > Best regards, > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Wednesday, September 18, 2019 12:50 PM > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Hi Atilla, > > I updated the code, compiled it and tested the changes. > The changes works as expected. > Thanks for the addressing the issue in such a short time. > > Follow-up question: > When will this change get merged into the master branch? > Also, when will this get packaged in Debian package? > > Thanks > Raghu > > On Tue, Sep 17, 2019 at 4:27 PM Attila Szakacs (aszakacs) < > Attila.Szakacs(a)oneidentity.com> wrote: > > Hi Raghu, > > Currently we are not sending SNI extension in the Client Hello message. > However, I made a PR to implement this: > https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgith > ub.com%2Fbalabit%2Fsyslog-ng%2Fpull%2F2930&data=02%7C01%7Cattila.s > zakacs%40oneidentity.com%7Cb9e9365d670d40a9c18708d7454447a9%7C91c369b5 > 1c9e439c989c1867ec606603%7C0%7C0%7C637054031891964192&sdata=cTMURG > BeAIsPwwGsBUmmsIwPDwJpDabqBkek6LlASEo%3D&reserved=0 > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit > hub.com%2Fbalabit%2Fsyslog-ng%2Fpull%2F2930&data=02%7C01%7Cgabor.nagy% > 40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439 > c989c1867ec606603%7C0%7C0%7C637051014645459869&sdata=IlcWEnngIqkJFPjWv > S7hrar4Tli4Kqgad5IdN7X5WVc%3D&reserved=0> > > Can you build syslog-ng from source? It would be great, if you tested > the PR. > > Best regards, > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Tuesday, September 17, 2019 9:05 AM > *To:* syslog-ng(a)lists.balabit.hu <syslog-ng(a)lists.balabit.hu> > *Subject:* [syslog-ng] Enable SNI (Server Name Identification) in TLS > connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Hi, > > I am using TLS over TCP connection to forward my syslog events to a > remote server. > My remote server uses SNI (Server Name Identification) to route > connections/events to one of the available backend servers. > > I observe that syslog-ng doesn't send SNI during TLS handshake. > > How can I enable it? > > My configuration is as follows: > > =================================== > source s_net { syslog(transport(udp) port(1514)); }; destination d_tcp > { > tcp( > "XX.example.net > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2FXX.e > xample.net&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf4 > 30b07d408d74285c639%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C63705 > 1014645469860&sdata=RTiMaNycpB56zTGx2gmqeFESNI2QO3JvOvSXUyC2MRk%3D&res > erved=0> > " > port(96) > tls( > peer-verify(required-untrusted) > ca_dir("/etc/syslog-ng/ssl") > > key-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.key.pem") > > cert-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.cert.pem") > ) > ); > }; > log { > source(s_net); > destination(d_tcp); > }; > =================================== > > I want syslog-ng to send XX.example.net > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2FXX.e > xample.net&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf4 > 30b07d408d74285c639%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C63705 > 1014645469860&sdata=RTiMaNycpB56zTGx2gmqeFESNI2QO3JvOvSXUyC2MRk%3D&res > erved=0> > as SNI to my remote server > > Please advise > > Thanks > Raghu > > ______________________________________________________________________ > ________ Member info: > https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flist > s.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cattil > a.szakacs%40oneidentity.com%7Cb9e9365d670d40a9c18708d7454447a9%7C91c36 > 9b51c9e439c989c1867ec606603%7C0%7C0%7C637054031891974190&sdata=t7d > 8IBFLJO9uUAMf4s%2BzfzYHgA3SBOR58DmTfnuxE1M%3D&reserved=0 > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flis > ts.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cgabor.na > gy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e > 439c989c1867ec606603%7C0%7C0%7C637051014645479861&sdata=gHBU5J5tU99NDH > J4PwjtxlnS0jVp2Vxh%2BgAuiTsVKaE%3D&reserved=0> > Documentation: > https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.b > alabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data > =02%7C01%7Cattila.szakacs%40oneidentity.com%7Cb9e9365d670d40a9c18708d7 > 454447a9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C6370540318919741 > 90&sdata=RsEoc2uH1DoInM3kgU6h710DWrWqLC5LwFe99F9wBro%3D&reserv > ed=0 > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02 > %7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c63 > 9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014645479861&sdat > a=NmD0lHSiQw0DbM8voUKjVOFX2fSnDwhyqaZvA7%2BBmnA%3D&reserved=0> > FAQ: > https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.b > alabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cattila.szakacs%40 > oneidentity.com%7Cb9e9365d670d40a9c18708d7454447a9%7C91c369b51c9e439c9 > 89c1867ec606603%7C0%7C0%7C637054031891974190&sdata=vExFemoXWyItsTk > VAxjJAlKpv4FODd8IFP2BktJpwio%3D&reserved=0 > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cgabor.nagy%40oneiden > tity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439c989c1867 > ec606603%7C0%7C0%7C637051014645489858&sdata=9VaEY4yqC3Y8y0gQZbVY6M0g%2 > F2rhXsfXRlw2%2Fwbik2s%3D&reserved=0> > > > ______________________________________________________________________ > ________ Member info: > https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flist > s.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cattil > a.szakacs%40oneidentity.com%7Cb9e9365d670d40a9c18708d7454447a9%7C91c36 > 9b51c9e439c989c1867ec606603%7C0%7C0%7C637054031891974190&sdata=t7d > 8IBFLJO9uUAMf4s%2BzfzYHgA3SBOR58DmTfnuxE1M%3D&reserved=0 > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flis > ts.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cgabor.na > gy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e > 439c989c1867ec606603%7C0%7C0%7C637051014645489858&sdata=EWEYbbHYLIenlm > GBceeB%2B0pLauNIABFmT0dt6%2F77TUs%3D&reserved=0> > Documentation: > https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.b > alabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data > =02%7C01%7Cattila.szakacs%40oneidentity.com%7Cb9e9365d670d40a9c18708d7 > 454447a9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C6370540318919741 > 90&sdata=RsEoc2uH1DoInM3kgU6h710DWrWqLC5LwFe99F9wBro%3D&reserv > ed=0 > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02 > %7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c63 > 9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014645499850&sdat > a=mVlgDpNt3RVoHdr7ESi2Im89VnA0W7NOjkQbB11V3LM%3D&reserved=0> > FAQ: > https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.b > alabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cattila.szakacs%40 > oneidentity.com%7Cb9e9365d670d40a9c18708d7454447a9%7C91c369b51c9e439c9 > 89c1867ec606603%7C0%7C0%7C637054031891974190&sdata=vExFemoXWyItsTk > VAxjJAlKpv4FODd8IFP2BktJpwio%3D&reserved=0 > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cgabor.nagy%40oneiden > tity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439c989c1867 > ec606603%7C0%7C0%7C637051014645499850&sdata=mNe53MBvTKfpkm1a%2FS6rEvCt > YPwO3Pfjca0jLyPNeqw%3D&reserved=0> > > > ______________________________________________________________________ > ________ Member info: > https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flist > s.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cattil > a.szakacs%40oneidentity.com%7Cb9e9365d670d40a9c18708d7454447a9%7C91c36 > 9b51c9e439c989c1867ec606603%7C0%7C0%7C637054031891974190&sdata=t7d > 8IBFLJO9uUAMf4s%2BzfzYHgA3SBOR58DmTfnuxE1M%3D&reserved=0 > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flis > ts.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cgabor.na > gy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e > 439c989c1867ec606603%7C0%7C0%7C637051014645509849&sdata=YUrhyXSF6MkgRf > RsxlOWqsSBsedoNo8UPb292Y0vTps%3D&reserved=0> > Documentation: > https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.b > alabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data > =02%7C01%7Cattila.szakacs%40oneidentity.com%7Cb9e9365d670d40a9c18708d7 > 454447a9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C6370540318919741 > 90&sdata=RsEoc2uH1DoInM3kgU6h710DWrWqLC5LwFe99F9wBro%3D&reserv > ed=0 > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02 > %7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c63 > 9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014645509849&sdat > a=I2zhc1DPDcvLEShMr4v2V2MgtEZf72oDOvqx%2F607r%2BA%3D&reserved=0> > FAQ: > https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.b > alabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cattila.szakacs%40 > oneidentity.com%7Cb9e9365d670d40a9c18708d7454447a9%7C91c369b51c9e439c9 > 89c1867ec606603%7C0%7C0%7C637054031891974190&sdata=vExFemoXWyItsTk > VAxjJAlKpv4FODd8IFP2BktJpwio%3D&reserved=0 > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cgabor.nagy%40oneiden > tity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439c989c1867 > ec606603%7C0%7C0%7C637051014645519834&sdata=eicWBDsPB4aguw98EKqegLs0ZB > NcHmbifbm8lEFeKF0%3D&reserved=0> > > > ______________________________________________________________________ > ________ Member info: > https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flist > s.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cattil > a.szakacs%40oneidentity.com%7Cb9e9365d670d40a9c18708d7454447a9%7C91c36 > 9b51c9e439c989c1867ec606603%7C0%7C0%7C637054031891974190&sdata=t7d > 8IBFLJO9uUAMf4s%2BzfzYHgA3SBOR58DmTfnuxE1M%3D&reserved=0 > Documentation: > https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.b > alabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data > =02%7C01%7Cattila.szakacs%40oneidentity.com%7Cb9e9365d670d40a9c18708d7 > 454447a9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C6370540318919741 > 90&sdata=RsEoc2uH1DoInM3kgU6h710DWrWqLC5LwFe99F9wBro%3D&reserv > ed=0 > FAQ: > https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.b > alabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cattila.szakacs%40 > oneidentity.com%7Cb9e9365d670d40a9c18708d7454447a9%7C91c369b51c9e439c9 > 89c1867ec606603%7C0%7C0%7C637054031891974190&sdata=vExFemoXWyItsTk > VAxjJAlKpv4FODd8IFP2BktJpwio%3D&reserved=0 > > -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.bala…> ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.bal… ------------------------------ End of syslog-ng Digest, Vol 173, Issue 33 ****************************************** _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future. ______________________________________________________________________________ Member info: https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.bal… Documentation: https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabi… FAQ: https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabi… -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190930/9b03bc99/a…> ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng ------------------------------ End of syslog-ng Digest, Vol 173, Issue 34 ****************************************** _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future.

1 0

filter not working
by Lin, Victor 30 Sep '19

30 Sep '19

Dear all, I don't want forwarding the syslog messages which contain the following to my local syslog, so I setup the filter like below ISDN-6-CONNECT ISDN-6-DISCONNECT changed by user However the messages contain the above are still show up in my local syslog file ForMe.log Below is from my syslog-ng.conf source s_network { network( transport("udp") port(514) flags(syslog_protocol) keep_hostname(yes) keep_timestamp(yes) use_dns(yes) use_fqdn(yes) ); }; destination d_ForMe_logs { file("/app/syslog-ng/custom/output/ForMe.log"); }; filter f_DoNotSendtoMe { not match("ISDN-6-CONNECT" value("MESSAGE")); or not match("ISDN-6-DISCONNECT" value("MESSAGE")); or not match("changed by user" value("MESSAGE")); }; log { source(s_network); filter(f_DoNotSendtoMe); destination(d_ForMe_logs); }; Do I missing any confing ? Thank you so much for your expertize! VL -----Original Message----- From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: 2019, September, 27 12:52 PM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 173, Issue 33 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: Enable SNI (Server Name Identification) in TLS connection (Raghunath Adhyapak) ---------------------------------------------------------------------- Message: 1 Date: Fri, 27 Sep 2019 22:22:14 +0530 From: Raghunath Adhyapak <funduraghu(a)gmail.com> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] Enable SNI (Server Name Identification) in TLS connection Message-ID: <CAEiok=Qrmw-s5r-ttRrQyQ+8CSq0BzdXgfzw+L0GhvR0_w-gUg(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" I built from source and tested and it worked fine I need Deb package to ease install on my machines. I can wait for some more time. Raghu On Fri, Sep 27, 2019, 12:35 Gabor Nagy (gnagy) <Gabor.Nagy(a)oneidentity.com> wrote: > If you would like to test before the upcoming release, you can create > a deb package with our docker based package scripts: > https://github.com/syslog-ng/syslog-ng/tree/master/dbld > > depending on your platform, it would be "dbld/rules deb" or > "dbld/rules deb-ubuntu-xenial" > > > Regards, > Gabor > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Thursday, September 26, 2019 15:30 > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Thanks. Now waiting for Debian package > > Raghu > > On Thu, Sep 26, 2019, 18:26 Attila Szakacs (aszakacs) < > Attila.Szakacs(a)oneidentity.com> wrote: > > Hi Raghu, > > It got merged to master! 🙂 > https://github.com/syslog-ng/syslog-ng/pull/2930 > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit > hub.com%2Fsyslog-ng%2Fsyslog-ng%2Fpull%2F2930&data=02%7C01%7Cgabor.nag > y%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e4 > 39c989c1867ec606603%7C0%7C0%7C637051014645449880&sdata=CYEi5latvJWnPQo > 7xYHa3klvdXiNVyXai5PhV51yVeI%3D&reserved=0> > > Best regards, > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Wednesday, September 18, 2019 5:35 PM > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > That's awesome. > > Thanks > Raghu > > On Wed, Sep 18, 2019, 17:05 Attila Szakacs (aszakacs) < > Attila.Szakacs(a)oneidentity.com> wrote: > > To the other question: It will be merged on the master branch probably > in a week. > > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Attila Szakacs (aszakacs) <Attila.Szakacs(a)oneidentity.com> > *Sent:* Wednesday, September 18, 2019 1:28 PM > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Hi Raghu, > > You are welcome! Thanks for the good idea. > If everything goes well, this feature will be released in version > 3.24, in > 3-4 weeks. > The packaging happens at the same time, you will find the 3.24 > installer at > https://download.opensuse.org/repositories/home:/laszlo_budai:/syslog- > ng/ > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdow > nload.opensuse.org%2Frepositories%2Fhome%3A%2Flaszlo_budai%3A%2Fsyslog > -ng%2F&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b0 > 7d408d74285c639%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014 > 645459869&sdata=krct3nD%2BVSMEQG00R0VJO2D1CeLqITAi8ZNTI7mV1a8%3D&reser > ved=0> > > Best regards, > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Wednesday, September 18, 2019 12:50 PM > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Hi Atilla, > > I updated the code, compiled it and tested the changes. > The changes works as expected. > Thanks for the addressing the issue in such a short time. > > Follow-up question: > When will this change get merged into the master branch? > Also, when will this get packaged in Debian package? > > Thanks > Raghu > > On Tue, Sep 17, 2019 at 4:27 PM Attila Szakacs (aszakacs) < > Attila.Szakacs(a)oneidentity.com> wrote: > > Hi Raghu, > > Currently we are not sending SNI extension in the Client Hello message. > However, I made a PR to implement this: > https://github.com/balabit/syslog-ng/pull/2930 > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit > hub.com%2Fbalabit%2Fsyslog-ng%2Fpull%2F2930&data=02%7C01%7Cgabor.nagy% > 40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439 > c989c1867ec606603%7C0%7C0%7C637051014645459869&sdata=IlcWEnngIqkJFPjWv > S7hrar4Tli4Kqgad5IdN7X5WVc%3D&reserved=0> > > Can you build syslog-ng from source? It would be great, if you tested > the PR. > > Best regards, > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Tuesday, September 17, 2019 9:05 AM > *To:* syslog-ng(a)lists.balabit.hu <syslog-ng(a)lists.balabit.hu> > *Subject:* [syslog-ng] Enable SNI (Server Name Identification) in TLS > connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Hi, > > I am using TLS over TCP connection to forward my syslog events to a > remote server. > My remote server uses SNI (Server Name Identification) to route > connections/events to one of the available backend servers. > > I observe that syslog-ng doesn't send SNI during TLS handshake. > > How can I enable it? > > My configuration is as follows: > > =================================== > source s_net { syslog(transport(udp) port(1514)); }; destination d_tcp > { > tcp( > "XX.example.net > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2FXX.e > xample.net&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf4 > 30b07d408d74285c639%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C63705 > 1014645469860&sdata=RTiMaNycpB56zTGx2gmqeFESNI2QO3JvOvSXUyC2MRk%3D&res > erved=0> > " > port(96) > tls( > peer-verify(required-untrusted) > ca_dir("/etc/syslog-ng/ssl") > > key-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.key.pem") > > cert-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.cert.pem") > ) > ); > }; > log { > source(s_net); > destination(d_tcp); > }; > =================================== > > I want syslog-ng to send XX.example.net > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2FXX.e > xample.net&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf4 > 30b07d408d74285c639%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C63705 > 1014645469860&sdata=RTiMaNycpB56zTGx2gmqeFESNI2QO3JvOvSXUyC2MRk%3D&res > erved=0> > as SNI to my remote server > > Please advise > > Thanks > Raghu > > ______________________________________________________________________ > ________ Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flis > ts.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cgabor.na > gy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e > 439c989c1867ec606603%7C0%7C0%7C637051014645479861&sdata=gHBU5J5tU99NDH > J4PwjtxlnS0jVp2Vxh%2BgAuiTsVKaE%3D&reserved=0> > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02 > %7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c63 > 9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014645479861&sdat > a=NmD0lHSiQw0DbM8voUKjVOFX2fSnDwhyqaZvA7%2BBmnA%3D&reserved=0> > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cgabor.nagy%40oneiden > tity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439c989c1867 > ec606603%7C0%7C0%7C637051014645489858&sdata=9VaEY4yqC3Y8y0gQZbVY6M0g%2 > F2rhXsfXRlw2%2Fwbik2s%3D&reserved=0> > > > ______________________________________________________________________ > ________ Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flis > ts.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cgabor.na > gy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e > 439c989c1867ec606603%7C0%7C0%7C637051014645489858&sdata=EWEYbbHYLIenlm > GBceeB%2B0pLauNIABFmT0dt6%2F77TUs%3D&reserved=0> > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02 > %7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c63 > 9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014645499850&sdat > a=mVlgDpNt3RVoHdr7ESi2Im89VnA0W7NOjkQbB11V3LM%3D&reserved=0> > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cgabor.nagy%40oneiden > tity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439c989c1867 > ec606603%7C0%7C0%7C637051014645499850&sdata=mNe53MBvTKfpkm1a%2FS6rEvCt > YPwO3Pfjca0jLyPNeqw%3D&reserved=0> > > > ______________________________________________________________________ > ________ Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flis > ts.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cgabor.na > gy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e > 439c989c1867ec606603%7C0%7C0%7C637051014645509849&sdata=YUrhyXSF6MkgRf > RsxlOWqsSBsedoNo8UPb292Y0vTps%3D&reserved=0> > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02 > %7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c63 > 9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014645509849&sdat > a=I2zhc1DPDcvLEShMr4v2V2MgtEZf72oDOvqx%2F607r%2BA%3D&reserved=0> > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cgabor.nagy%40oneiden > tity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439c989c1867 > ec606603%7C0%7C0%7C637051014645519834&sdata=eicWBDsPB4aguw98EKqegLs0ZB > NcHmbifbm8lEFeKF0%3D&reserved=0> > > > ______________________________________________________________________ > ________ Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190927/04aa6f04/a…> ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng ------------------------------ End of syslog-ng Digest, Vol 173, Issue 33 ****************************************** _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future.

2 1

Enable SNI (Server Name Identification) in TLS connection
by Raghunath Adhyapak 27 Sep '19

27 Sep '19

Hi, I am using TLS over TCP connection to forward my syslog events to a remote server. My remote server uses SNI (Server Name Identification) to route connections/events to one of the available backend servers. I observe that syslog-ng doesn't send SNI during TLS handshake. How can I enable it? My configuration is as follows: =================================== source s_net { syslog(transport(udp) port(1514)); }; destination d_tcp { tcp( "XX.example.net" port(96) tls( peer-verify(required-untrusted) ca_dir("/etc/syslog-ng/ssl") key-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.key.pem") cert-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.cert.pem") ) ); }; log { source(s_net); destination(d_tcp); }; =================================== I want syslog-ng to send XX.example.net as SNI to my remote server Please advise Thanks Raghu

3 9

Generate filename with part of message.
by William Luiz Ribeiro Vasconcelos Da Silva 26 Sep '19

26 Sep '19

Hello every one!, It's possible get part of the message obtained by syslog-ng to compose the file name. For example: The message: 2019-09-05;18:11:47;BLM0102-SP2[FWNAT]:ASP_NAT_PORT_BLOCK_ALLOC:;100.86.147.89;189.40.100.001:12800-12815 Expected filename: BLM0102-SP2_2019-09-05_18:11:47.syslog-ng How can I do to generate this nomenclature? Tks! Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada para recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteúdo. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto

2 1

OS Support Version for syslog-ng
by William Luiz Ribeiro Vasconcelos Da Silva 26 Sep '19

26 Sep '19

Hello Every one, Does SYSLOG-NG PE support RHEL version 7.7? Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada para recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteúdo. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto

1 0

Help needed in configuration file upgrade (from syslog-ng-3.11.1 to syslog-ng-3.23.1)
by Debananda Pal 26 Sep '19

26 Sep '19

Hi All, Sorry to send the mail to all as I am not aware about individual email id. I am trying to upgrade syslog-ng from 3.11.1 to 3.23.1 on Linux and finding some issues as below. I have changed few parameters like version, include, but at present getting error with file() configuration. ------------------------------------------------------------------------------------- ~ # /sbin/syslog-ng -f /tandberg/persistent/syslog-ng.conf -p /var/run/syslog-ng.pid [2019-09-25T13:40:11.707232] WARNING: Your configuration file uses an obsoleted keyword, please update your configuration; key word='flush_timeout', change='Some drivers support batch-timeout() instead that you can specify at the destination level.', lo cation='#buffer:15:5' *Error parsing source statement, source plugin file not found in /tandberg/persistent/syslog-ng.conf:31:5-31:9:* 26 27 # Sources 28 29 source s_everything { 30 internal(); 31----> file("/proc/kmsg" log_fetch_limit(100) log_iw_size(100)); 31----> ^^^^ 32 unix_dgram("/var/log/log" log_fetch_limit(100) log_iw_size(100)); 33 udp(ip(127.0.0.1) port(514) log_fetch_limit(100) log_iw_size(100)); 34 }; 35 36 # Destinations syslog-ng documentation: https://www.balabit.com/support/documentation?product=syslog-ng-ose contact: https://lists.balabit.hu/mailman/listinfo/syslog-ng ~ # ------------------------------------------------------------------------------------- I have attached the syslog-ng.conf file for your kind perusal. Please give your suggestion on the modified config file. Regards, D Pal

2 4

Disregard source if it fails
by Faine, Mark R. (MSFC-IS40)[NICS] 23 Sep '19

23 Sep '19

We have a requirement to send all our logs to two other servers so we have those configured as destinations in our configuration. However, sometimes their servers go down and the result is that we stop logging anything at all. Is there a way to disable those servers, either temporarily or until restarted if we can't connect? Thanks, -Mark Mark Faine System Administrator SAIC/NICS 215 Wynn Dr. 5065 Huntsville, AL 35805 256-961-1295 (Desk) 256-617-4861 (Work Cell)

2 2

Use jemalloc
by Jean-Baptiste Fuzier 19 Sep '19

19 Sep '19

Hi, I am having high memory usage with v3.23, as suggested in some tickets, I am trying to switch to jemalloc to see if there is any improvement. However I cannot use LD_PRELOAD as I am running syslogng as a standard user (setuid + setcap to bind to a port <1024). I can easily get rid of the setuid part, however I do not see how to get rid of the setcap beside using an ugly iptables trick. Or any solution for those : 1/ Syslogng runned as root (for port binding) then dropping to standard user ? 2/ Get LD_PRELOAD to work with setcap binaries ? 3/ build syslogng (link?) against jemalloc ? 4/ Manage to have ld.preload limited to an user or binary ? Thanks for your help -- Jean-Baptiste Fuzier

1 1

Error binding socket UDP
by William Luiz Ribeiro Vasconcelos Da Silva 18 Sep '19

18 Sep '19

Good Mornig Every one, How should I to corret the problema presented in the log below: Error binding socket; addr='AF_INET(10.178.40.247:514)', error='Cannot assign requested address (99)' Set 18 10:32:14 centosServerVirtual syslog-ng[1809]: [2019-09-18T10:32:14.855778] Error initializing message pipeline; plugin_name='udp', location='/etc/syslog-ng/syslog-ng.conf:33:4' My configuration on syslog-ng.conf is that: source s_net { udp(ip(10.178.40.247) port(514)); }; Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada para recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteúdo. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto

2 1

Log Rotation based on size
by Alexandre Santos 18 Sep '19

18 Sep '19

Hi All, I noticed that some years ago Elan Ruusamäe made a patch with log rotation by size in https://github.com/pld-linux/syslog-ng/blob/master/log-file-size-limit.patch. This was never included in the master branch. Are there any plans to release a log rotation based on size in syslog-ng? Cheers, Alex

2 1

Re: [syslog-ng] syslog-ng Digest, Vol 173, Issue 18
by Németh Balázs 17 Sep '19

17 Sep '19

Hi Laci, Elaaticsearch is not limited by any means regarding indexable traffic. Should you need any real life example then have a look at my blog: https://balagetech.com/tag/elasticsearch/ This page will show you the feature differences between different licenses: https://www.elastic.co/subscriptions Note that the free version does not have AD integration. (Maybe you could put a WAF before Kibana, or handling the AD integration with Apache + LDAP) ps: I am not paid by anyone to suggest Elasticsearch. It is simply a tool I use. Regards, <syslog-ng-request(a)lists.balabit.hu> ezt írta (időpont: 2019. szept. 17., K, 12:57): > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > Today's Topics: > > 1. Re: a bit [offtopic] but may not. syslog search solution for > free (Pal, Laszlo) > 2. Re: a bit [offtopic] but may not. syslog search solution for > free (Fabien Wernli) > 3. Re: Enable SNI (Server Name Identification) in TLS > connection (Attila Szakacs (aszakacs)) > > > > ---------- Forwarded message ---------- > From: "Pal, Laszlo" <vlad(a)vlad.hu> > To: "Syslog-ng users' and developers' mailing list" < > syslog-ng(a)lists.balabit.hu> > Cc: > Bcc: > Date: Tue, 17 Sep 2019 10:55:04 +0200 > Subject: Re: [syslog-ng] a bit [offtopic] but may not. syslog search > solution for free > Hi, > > Thanks for the answers. So, I definitely need an onprem solution and yes, > Elastic is a good idea, however based on my previous research even the OS > version is restricted to some amount of daily log. Maybe I'm wrong and in > this case I may give a try again. At this point I don't know how much logs > will I ingest daily but because it is more than 30K devices including core > routers, firewalls and all sort of servers, I don't think any traffic > limited solution will be sufficient. > > Graylog is a very good solution which I already tested but the "free" > version is limited to something like 50 Mbyet per day. > > I'll check this onion thingy, thank you Peter for the heads up > > Vlad > > On Tue, Sep 17, 2019 at 10:01 AM Peter Czanik (pczanik) < > Peter.Czanik(a)oneidentity.com> wrote: > >> Hi, >> >> These are not my personal experiences, but talking to thousands of >> syslog-ng users at different events: >> >> >> - Many are happy with grep and hate anything with a GUI. It works >> relatively well, if you have many small log files (separated by date, host, >> application, etc.), but if you have lots of logs, you can't avoid message >> parsing and indexing for efficient search. >> - Splunk is one of the most popular destinations with syslog-ng. OSE >> users tend to use the free version, which can index up to 500MB of logs a >> day. >> - Elasticsearch is the other most popular destination. With the >> latest version most of the security features are included in the open >> source version for free, so it does not need 3rd party extensions or a >> commercial license any more. >> - Graylog is also getting popular among syslog-ng users. We can feed >> it with structured log messages in multiple ways: either GELF or JSON. >> Free, open source, but commercial extensions and support are available. >> - I did not test recently, but Security Onion is a nice security >> analytic platform which also includes log management with analysis, >> dashboards, etc. It's free, open source, but commercial support is >> available. >> - Logzilla is focused on Cisco network devices and automation but >> also works for generic log management. It is commercial software, but a >> free version is also available. >> >> Of course any time indexing and GUI are involved you need some extra >> hardware compared syslog-ng, so definitely more expensive even if you go >> with the free versions. >> >> Bye, >> >> Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> >> Balabit (a OneIdentity company) / syslog-ng upstream >> https://syslog-ng.com/community/ >> https://twitter.com/PCzanik >> >> ------------------------------ >> *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of Pal, >> Laszlo <vlad(a)vlad.hu> >> *Sent:* Tuesday, September 17, 2019 9:16 AM >> *To:* Syslog-ng users' and developers' mailing list < >> syslog-ng(a)lists.balabit.hu> >> *Subject:* [syslog-ng] a bit [offtopic] but may not. syslog search >> solution for free >> >> CAUTION: This email originated from outside of the organization. Do not >> follow guidance, click links, or open attachments unless you recognize the >> sender and know the content is safe. >> >> Hi, >> >> Our new central syslog collect&store system are almost complete and >> finally it is based on Syslog-ng OSE. The only issue I want to solve, is >> how to present those logs to the users. Originally I thought it would be >> enough if they will get the directories as NFS exports and they can use >> their favourite grep to search files, but I thought maybe I can implement >> some more user friendly solution. >> >> In the planning phase of the project, I've tested various solutions >> including Graylog, ELK and of course I'm aware of the beauty of SSB :) , >> but all of these solutions are too expensive for this project. >> >> Then I thought maybe if I forward the logs to some database (SQL or >> noSQL) I can try to find some very simple frontend for that DB provides a >> simple search interface for those logs. Nothing fancy is required, but AD >> auth should be an option. >> >> I'm sure I'm not the only one facing this issue, so I hope someone in the >> community can share some previous experience on this >> >> Thanks >> Vlad >> >> >> >> >> ______________________________________________________________________________ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: >> http://www.balabit.com/support/documentation/?product=syslog-ng >> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >> >> > > > ---------- Forwarded message ---------- > From: Fabien Wernli <wernli(a)in2p3.fr> > To: "Syslog-ng users' and developers' mailing list" < > syslog-ng(a)lists.balabit.hu> > Cc: > Bcc: > Date: Tue, 17 Sep 2019 11:05:18 +0200 > Subject: Re: [syslog-ng] a bit [offtopic] but may not. syslog search > solution for free > On Tue, Sep 17, 2019 at 10:55:04AM +0200, Pal, Laszlo wrote: > > Thanks for the answers. So, I definitely need an onprem solution and yes, > > Elastic is a good idea, however based on my previous research even the OS > > version is restricted to some amount of daily log. Maybe I'm wrong and in > > It's not. By all means grab the -oss packages, they don't contain any > non-free code. > > > > > > ---------- Forwarded message ---------- > From: "Attila Szakacs (aszakacs)" <Attila.Szakacs(a)oneidentity.com> > To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> > Cc: > Bcc: > Date: Tue, 17 Sep 2019 10:57:14 +0000 > Subject: Re: [syslog-ng] Enable SNI (Server Name Identification) in TLS > connection > Hi Raghu, > > Currently we are not sending SNI extension in the Client Hello message. > However, I made a PR to implement this: > https://github.com/balabit/syslog-ng/pull/2930 > > Can you build syslog-ng from source? It would be great, if you tested the > PR. > > Best regards, > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Tuesday, September 17, 2019 9:05 AM > *To:* syslog-ng(a)lists.balabit.hu <syslog-ng(a)lists.balabit.hu> > *Subject:* [syslog-ng] Enable SNI (Server Name Identification) in TLS > connection > > CAUTION: This email originated from outside of the organization. Do not > follow guidance, click links, or open attachments unless you recognize the > sender and know the content is safe. > > Hi, > > I am using TLS over TCP connection to forward my syslog events to a remote > server. > My remote server uses SNI (Server Name Identification) to route > connections/events to one of the available backend servers. > > I observe that syslog-ng doesn't send SNI during TLS handshake. > > How can I enable it? > > My configuration is as follows: > > =================================== > source s_net { syslog(transport(udp) port(1514)); }; > destination d_tcp { > tcp( > "XX.example.net > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2FXX.example…> > " > port(96) > tls( > peer-verify(required-untrusted) > ca_dir("/etc/syslog-ng/ssl") > > key-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.key.pem") > > cert-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.cert.pem") > ) > ); > }; > log { > source(s_net); > destination(d_tcp); > }; > =================================== > > I want syslog-ng to send XX.example.net > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2FXX.example…> > as SNI to my remote server > > Please advise > > Thanks > Raghu > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

1 0

a bit [offtopic] but may not. syslog search solution for free
by Pal, Laszlo 17 Sep '19

17 Sep '19

Hi, Our new central syslog collect&store system are almost complete and finally it is based on Syslog-ng OSE. The only issue I want to solve, is how to present those logs to the users. Originally I thought it would be enough if they will get the directories as NFS exports and they can use their favourite grep to search files, but I thought maybe I can implement some more user friendly solution. In the planning phase of the project, I've tested various solutions including Graylog, ELK and of course I'm aware of the beauty of SSB :) , but all of these solutions are too expensive for this project. Then I thought maybe if I forward the logs to some database (SQL or noSQL) I can try to find some very simple frontend for that DB provides a simple search interface for those logs. Nothing fancy is required, but AD auth should be an option. I'm sure I'm not the only one facing this issue, so I hope someone in the community can share some previous experience on this Thanks Vlad

4 4

error while loading shared libraries: libsyslog-ng-3.23.so.0
by Laura Smith 15 Sep '19

15 Sep '19

Hi, I compiled syslog-ng 3.23 on Debian 10 (./configure --enable-systemd --with-systemdsystemunitdir=/etc/systemd/system --enable-mixed-linking) When I try a simple "syslog-ng -F", I get the following error: "syslog-ng: error while loading shared libraries: libsyslog-ng-3.23.so.0: cannot open shared object file: No such file or directory" However.... ldconfig -v | fgrep syslog libsyslog-ng-3.23.so.0 -> libsyslog-ng.so And .... # find / -name "libsyslog-ng-3.23.so.0" -print /usr/local/lib/libsyslog-ng-3.23.so.0 Any ideas ??

3 3

Insider 2019-09: syslog-ng basics; relays; NGINX; Tic-Tac-Toe; sudo; Elastic stack 7; GitHub;
by Peter Czanik (pczanik) 12 Sep '19

12 Sep '19

Dear syslog-ng users, This is the 75th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Building blocks of syslog-ng ---------------------------- Recently I gave a syslog-ng introductory workshop at Pass the SALT conference in Lille, France. I got a lot of positive feedback, so I decided to turn all that content into a blog post. Naturally, I shortened and simplified it, but still managed to get enough material for multiple blog posts. This one gives you an overview of syslog-ng, its major features and an introduction to its configuration. https://www.syslog-ng.com/community/b/blog/posts/building-blocks-of-syslog-… What syslog-ng relays are good for ---------------------------------- While there are some users who run syslog-ng as a stand-alone application, the main strength of syslog-ng is central log collection. In this case the central syslog-ng instance is called the server, while the instances sending log messages to the central server are called the clients. There is a (somewhat lesser known) third type of instance called the relay, too. The relay collects log messages via the network and forwards them to one or more remote destinations after processing (but without writing them onto the disk for storage). A relay can be used for many different use cases. We will discuss a few typical examples below. https://www.syslog-ng.com/community/b/blog/posts/what-syslog-ng-relays-are-… Visualizing NGINX or Apache access logs in Kibana --------------------------------------- This tutorial shows you how to parse NGINX or Apache access logs with syslog-ng and create ECS compatible data in Elasticsearch. https://balagetech.com/visualizing-nginx-access-logs-kibana/ syslog-ng Tic-Tac-Toe --------------------- You can play the game of Tic-Tac-Toe using syslog-ng 3.22.1 or later. Learn how to configure syslog-ng for that: https://kokan.github.io/2019/06/16/syslog-ng-tic-tac-toe.html Alerting on sudo events using syslog-ng --------------------------------------- Why use syslog-ng to alert on sudo events? At the moment, alerting in sudo is limited to E-mail. Using syslog-ng, however, you can send alerts (more precisely, selected logs) to a wide variety of destinations. Logs from sudo are automatically parsed by recent (3.13+) syslog-ng releases, enabling fine-grained alerting. There is a lot of hype around our new Slack destination, so that is what I’ll show here. Naturally, there are many others available as well, including Telegram and, of course, good old E-mail. If something is not yet directly supported by syslog-ng, you can often utilize an HTTP API or write some glue code in Python. >From this blog post you can learn how to build up a syslog-ng configuration step by step and how to use different filters to make sure that you only receive logs (i.e. alerts) that are truly relevant for you. https://www.syslog-ng.com/community/b/blog/posts/alerting-on-sudo-events-us… GitHub and syslog-ng -------------------- As many of you know, the source code of syslog-ng is available on GitHub, just like its issue tracker. We just learned that GitHub itself is running syslog-ng as part of its stack: https://help.github.com/en/enterprise/2.18/admin/installation/log-forwarding syslog-ng with Elastic Stack 7 ------------------------------ For many years, anything I wrote about syslog-ng and Elasticsearch was valid for all available versions. Well, not anymore. With version 7 of Elasticsearch, there are some breaking changes. These changes are mostly related to the fact that Elastic is phasing out type support. This effects mapping (as the _default_ keyword is not used any more) and the syslog-ng configuration as well (as even though type() is a mandatory parameter, you should leave it empty). This blog post is a rewrite of one of my earlier blog posts (about creating a heat map using syslog-ng + Elasticsearch + Kibana), focusing on the changes and the new elasticsearch-http() destination: https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-with-elastic-sta… UPCOMING CONFERENCES * One Identity UNITE (https://www.oneidentity.com/unite-conference/unite-phoenix.aspx) syslog-ng booth * All Things Open (https://allthingsopen.org/) syslog-ng talk * Bsides Luxembourg (https://bsideslux.lu/2019/) syslog-ng workshop WEBINARS * How to Leverage NetFlow and vFlow to Better Monitor Network Traffic https://www.syslog-ng.com/event/how-to-leverage-netflow-and-vflow-to-monito… * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

cleaning up the unofficial rpm repositories
by Peter Czanik (pczanik) 12 Sep '19

12 Sep '19

Hi, Ever since I started my unofficial rpm packages for (open)SUSE and Fedora/RHEL/CentOS I created a new repository for each new release and never deleted them. Of course OBS and Copr guys did sometimes clean ups, so Fedora and openSUSE packages for long end of life distributions got deleted. But for the rest there are still syslog-ng 3.5 packages on-line. Not everyone likes to update syslog-ng every second month, so I keep the current workflow and create a new repo for each new release. This way your syslog-ng.conf or package management is not accidentally broken at a random time with a new update, you have a chance to test a new release thoroughly before upgrading. On the other hand I plan to keep only a year worth of releases instead of everything. Question: * Is there anyone, who needs packages older than one year? With the one year limit I'd delete anything older than 3.17 and delete 3.17 as well, once 3.24 is out, and so on. Bye, Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

5 7

How to enable log file generation by row size or Megabytes?
by William Luiz Ribeiro Vasconcelos Da Silva 09 Sep '19

09 Sep '19

Good afternoon everyone! Which parameters should be enabled in the "syslog-ng.conf" file, because I want the captured log files to be a maximum of 5Mb in size or 1500 lines. Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada para recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteúdo. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto

2 1

sub-second time digits all 0
by John Chang 09 Sep '19

09 Sep '19

Hello, I am not getting non-zero sub-second timestamp digits. My /etc/syslog-ng/syslog-ng.conf file includes this global configuration: # First, set some global options. options { frac-digits(3); chain_hostnames(off); flush_lines(0); use_dns(no); use_fqdn(no); owner("root"); group("adm"); perm(0640); stats_freq(0); bad_hostname("^gconfd$"); }; My syslog-ng.conf also includes a sub-config file for sending the logs to a remote host, with this configuration: destination d_net { udp("loggerhost" port(30515) frac-digits(3) ); }; log { source(s_src); destination(d_net); }; But all sub-second timestamp digits wind up being only zeroes on the remote "loggerhost", like this: 2019-09-03T21:57:23.000+00:00 10.73.254.255 [info] [sshd] 3284 Accepted password for root from 10.72.0.186 port 50720 ssh2 The sending host is running syslog-ng 3.5.3. The receiving "loggerhost" is running 3.5.6 Thanks in advance for any help you can afford.

2 3

How to parser the message obtained from syslog-ng?
by William Luiz Ribeiro Vasconcelos Da Silva 06 Sep '19

06 Sep '19

Hello every one! The Syslog-ng is writing the log with the layout below: Jun 7 11:54:23 2019 vXXXXX01-node1 RT_XXT: RT_SRC_XXT_PBA_ALLOC: Subscriber 100.64.0.2 But the system that will do the treatment expects to receive the log in the following layout: Jun 7;11:54:23;2019;vxxxxx01-node1;RT_xxT: RT_SRC_NAT_PBA_ALLOC:;Subscriber 100.64.0.2; What setting can I do to be able to do the requested? The expected result is as follows: Current: Jun 7 11:54:23 2019 vXXXXX01-node1 RT_XXT: RT_SRC_XXT_PBA_ALLOC: Subscriber 100.64.0.2 Changed: Jun 7;11:54:23;2019;vxxxxx01-node1;RT_xxT: RT_SRC_NAT_PBA_ALLOC:;Subscriber 100.64.0.2; Tks for the help! Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada para recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteúdo. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto

2 1

Regular expressions in rewrite
by Faine, Mark R. (MSFC-IS40)[NICS] 06 Sep '19

06 Sep '19

Is there a way to use regular expressions when setting a value in a rewrite rule? Something like: rewrite r_rewrite_set_host{ subst("^[a-z]+\-([a-z]+).*$", "$1", value("HOST")); set("HOST" value("location") condition( filter(f_filter_hostnames) ) ); }; But without changing the actual log message. The goal is to create a variable from a regular expression of the host field in the message that I can then use in a destination path. Thanks, -Mark Mark Faine System Administrator SAIC/NICS 215 Wynn Dr. 5065 Huntsville, AL 35805 256-961-1295 (Desk) 256-617-4861 (Work Cell)

4 4

Handling lists in syslog-ng: the in-list() filter
by Peter Czanik (pczanik) 05 Sep '19

05 Sep '19

Hi, Recently, a number of quite complex configurations came up here and on github issues. As it turned out, these configurations could be significantly simplified using the in-list() filter, one of syslog-ng’s lesser known features. So, if you have a long list of filters in your configuration containing IP addresses, host names, and so on, you should consider using the in-list() filter. Check out my latest blog about its advantages: https://www.syslog-ng.com/community/b/blog/posts/handling-lists-in-syslog-n… Bye, Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Elasticscearh-http dest wish list
by Russell Fulton 03 Sep '19

03 Sep '19

It would be really nice if nv pairs parsed as IP addresses got pushed to ES with a field mapping of IP rather than text and keyword. Russell(a)fulton.nz

3 5

syslog-ng: unofficial 3.23 Debian/Ubuntu packages
by Laszlo Budai 26 Aug '19

26 Aug '19

Hi, syslog-ng 3.23.1[1] packages are available in OBS repo[2]. List of supported OSs: * Debian 8.0 * Debian 9.0 [including armv7l] * Raspbian 9.0 * Ubuntu 14.04 * Ubuntu 16.04 * Ubuntu 18.04 * Ubuntu 18.10 Install ------- example: Debian 9.0 1. get release key wget -qO - http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… | sudo apt-key add - 2. add repo to APT sources eg.: /etc/apt/sources.list.d/syslog-ng-obs.list deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… ./ Then `apt-get update` and `apt-get install syslog-ng-core` Links -------- [1] https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.23.1 [2] https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-… regards, Laszlo Budai [Twitter]<https://twitter.com/Budai_L> [LinkedIn] <https://www.linkedin.com/in/laszlo-budai-55243a3/> [Github] <https://github.com/lbudai>

1 0

syslog-ng-3.23
by Laszlo Budai 26 Aug '19

26 Aug '19

3.23.1 ====== ## Features * The `redis()` destination now handles any number of command parameters. (#2816) * The `format()` option of `date-parser()` supports lists. From now on, a single `date-parser()` instance is able to process different date formats, making it easy to catch on when some programs change the way they log information. (#2779) * Add relocation support for `disk-buffer()`. The `relocate` subcommand of `dqtool` can be used to move a single or multiple queue files. (#2855) * `file(), pipe()`: The `time-reap()` option now can be set or disabled for each destination separately. Use `time-reap(0)` to disable closing idle destination files. (#2798) * `syslog-ng-ctl`: Add `list-files` subcommand to print files present in the current configuration. (#2797) ## Bugfixes * Fix minor memory leaks (#2868) * Add global context to standalone parsers (#2876) * Fix heap usage after free in cfg_run_parser_with_main_context (#2884) * Fix g_thread_init call order issue with older glibs (#2853) * SNMP destination: fixing statistics format (#2854) * eventlog: flush escaped_buffer when full (#2837) * dbparser: remove unnecessary lock (#2838) * dbparser: fix crash when context times out in the middle of another rule (#2832) * radix: fix grouping in PCRE (#2808) * add-contextual-data: make filters config plugin aware (#2886) * Undefined warning regression (#2829) ## Other changes * Disable `time-reap()` on non-templated filenames by default (#2798) * The `--preprocess-into` command line flag accepts `-`, and writes the preprocessed configuration to stdout. (#2869) * Add information on environment variables passed to the confgen script (#2888) * Light: minor fixes (#2867, #2844) * python: use malloc_debug for python unit tests (#2866) * Travis: verbose unit test output (#2851) * Travis cleanup (#2809) * filter: add unit tests to `filter-op` (#2835) * Fix clang/gcc diagnostic differences (#2810) * Fix leak in stats test (#2874) * cmake, autotools: -Wundef to enable-extra-warning (#2806) ## Notes to the developers * Check whether commit messages are properly formatted (#2803, #2807) * gitignore: tags file and build directory (#2794) ## Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Antal Nemes, Attila Szakacs, Balazs Scheidler, Gabor Nagy, Laszlo Budai, Laszlo Szemere, László Várady, Mark Bonsack, Mehul Prajapati, Péter Kókai, Romain Tartière, Zoltan Pallagi. https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.23.1

1 0