- syslog-ng - lists.balabit.hu

Google Summer Of Code Student
by Mehul Prajapati 07 May '19

07 May '19

Hi All, I'm Mehul Prajapati, a graduate student in Masters of Applied Computer Science program at Concordia University, Canada. My project in GSoC 2019 is - Improve Debun tool collected information. I have 6+ years of professional work experience in C, Linux Bash Shell, and Python programming. I am an active contributor of syslog-ng project. -- Regards, Mehul Prajapati Embedded Software Developer Website: https://mehul-m-prajapati.github.io/ Email: mehulprajapati2802(a)gmail.com Mobile: +1 514-431-2331

1 0

Project of Google Summer Of Code
by Enis Kollugil 07 May '19

07 May '19

Hi everyone, My name is Enis Kollugil. I am one of your Google Summer Of Code students. I'm a final year undergraduate student in Istanbul Technical University, Turkey. I have been working at the IT Head Office for 2 years. I managed both Linux and Windows systems for these years. My main task is writing script Powershell and managing backup process (Tape and File Backup). I will do my best to create a snippet for Vscode. If you have any suggestion or desire on my topic, I would like to hear. Thank you for everything. Best Regards, Enis Kollugil

1 0

Re: [syslog-ng] syslog-ng Digest, Vol 169, Issue 3
by Simon Tyler 02 May '19

02 May '19

Hi Peter, I commented out the network entry and uncommented this tcp entry: source s_net { tcp(ip(10.8.41.60) port(514)); }; I can see syslog-ng start up and process local log messages: [root@ip-10-8-41-60 syslog-ng]# syslog-ng --debug Trying to open module; module='syslogformat', filename='/lib64/syslog-ng/libsyslogformat.so' Trying to open module; module='basicfuncs', filename='/lib64/syslog-ng/libbasicfuncs.so' Trying to open module; module='afsocket', filename='/lib64/syslog-ng/libafsocket.so' Trying to open module; module='affile', filename='/lib64/syslog-ng/libaffile.so' Trying to open module; module='afprog', filename='/lib64/syslog-ng/libafprog.so' Trying to open module; module='afuser', filename='/lib64/syslog-ng/libafuser.so' Trying to open module; module='dbparser', filename='/lib64/syslog-ng/libdbparser.so' Trying to open module; module='csvparser', filename='/lib64/syslog-ng/libcsvparser.so' Trying to open module; module='afsql', filename='/lib64/syslog-ng/libafsql.so' Starting to read include file; filename='/etc/syslog-ng/scl.conf', depth='1' Global value changed; define='scl-root', value='/usr/share/syslog-ng/include/scl' Global value changed; define='include-path', value='/etc/syslog-ng:/usr/share/syslog-ng/include' Starting to read include file; filename='/etc/syslog-ng/modules.conf', depth='2' Global value changed; define='autoload-compiled-modules', value='0' Trying to open module; module='syslogformat', filename='/lib64/syslog-ng/libsyslogformat.so' Attempted to register the same plugin multiple times, ignoring; context='format', name='syslog' Trying to open module; module='basicfuncs', filename='/lib64/syslog-ng/libbasicfuncs.so' Attempted to register the same plugin multiple times, ignoring; context='template-func', name='echo' Attempted to register the same plugin multiple times, ignoring; context='template-func', name='grep' Attempted to register the same plugin multiple times, ignoring; context='template-func', name='if' Trying to open module; module='afsocket', filename='/lib64/syslog-ng/libafsocket.so' Attempted to register the same plugin multiple times, ignoring; context='source', name='unix-stream' Attempted to register the same plugin multiple times, ignoring; context='destination', name='unix-stream' Attempted to register the same plugin multiple times, ignoring; context='source', name='unix-dgram' Attempted to register the same plugin multiple times, ignoring; context='destination', name='unix-dgram' Attempted to register the same plugin multiple times, ignoring; context='source', name='tcp' Attempted to register the same plugin multiple times, ignoring; context='destination', name='tcp' Attempted to register the same plugin multiple times, ignoring; context='source', name='tcp6' Attempted to register the same plugin multiple times, ignoring; context='destination', name='tcp6' Attempted to register the same plugin multiple times, ignoring; context='source', name='udp' Attempted to register the same plugin multiple times, ignoring; context='destination', name='udp' Attempted to register the same plugin multiple times, ignoring; context='source', name='udp6' Attempted to register the same plugin multiple times, ignoring; context='destination', name='udp6' Attempted to register the same plugin multiple times, ignoring; context='source', name='syslog' Attempted to register the same plugin multiple times, ignoring; context='destination', name='syslog' Trying to open module; module='affile', filename='/lib64/syslog-ng/libaffile.so' Attempted to register the same plugin multiple times, ignoring; context='source', name='file' Attempted to register the same plugin multiple times, ignoring; context='source', name='pipe' Attempted to register the same plugin multiple times, ignoring; context='destination', name='file' Attempted to register the same plugin multiple times, ignoring; context='destination', name='pipe' Trying to open module; module='afprog', filename='/lib64/syslog-ng/libafprog.so' Attempted to register the same plugin multiple times, ignoring; context='source', name='program' Attempted to register the same plugin multiple times, ignoring; context='destination', name='program' Trying to open module; module='afuser', filename='/lib64/syslog-ng/libafuser.so' Attempted to register the same plugin multiple times, ignoring; context='destination', name='usertty' Trying to open module; module='dbparser', filename='/lib64/syslog-ng/libdbparser.so' Attempted to register the same plugin multiple times, ignoring; context='parser', name='db-parser' Trying to open module; module='csvparser', filename='/lib64/syslog-ng/libcsvparser.so' Attempted to register the same plugin multiple times, ignoring; context='parser', name='csv-parser' Finishing include; filename='/etc/syslog-ng/modules.conf', depth='2' Starting to read include file; filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', depth='2' Trying to open module; module='confgen', filename='/lib64/syslog-ng/libconfgen.so' Finishing include; filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', depth='2' Starting to read include file; filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', depth='2' Finishing include; filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', depth='2' Starting to read include file; filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf', depth='2' Trying to open module; module='confgen', filename='/lib64/syslog-ng/libconfgen.so' Finishing include; filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf', depth='2' Finishing include; filename='/etc/syslog-ng/scl.conf', depth='1' Running application hooks; hook='1' Running application hooks; hook='3' syslog-ng starting up; version='3.2.5' Incoming log entry; line='<30>May 2 15:20:55 dhclient[1689]: XMT: Solicit on eth0, interval 129080ms.' But, there is no syslog process listening on port 514 or any other port. I did try upgrading to a more recent version 3.19 from here: https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng319/repo/epel-7/cza… however this is an Amazon linux instance and it appears to conflict with some of the operating system packages. I thought I would check in with you one more time to see if you have any other suggestions; otherwise, I can try Centos and a more recent version of syslog-ng. Thanks again for your help, Simon Tyler | Senior Systems Administrator - PathWise Solutions Group Aon 225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.979.7724 simon.tyler(a)aon.com PLEASE NOTE that my email address has changed to simon.tyler(a)aon.com -----Original Message----- From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: Thursday, May 02, 2019 1:23 AM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 169, Issue 3 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: syslog-ng Digest, Vol 169, Issue 1 (Péter) ---------------------------------------------------------------------- Message: 1 Date: Thu, 2 May 2019 07:22:28 +0200 From: Péter, Kókai <peter.kokai(a)oneidentity.com> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] syslog-ng Digest, Vol 169, Issue 1 Message-ID: <CABxQCphefFz0VVvGYVkGzMr6GzUPbeHVp3b8Gq_fbgcRazKJaQ(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Hello, Okay I see it now. You are using a version (3.2) which as far as I can see did not have *network* keyword at all. Instead of *network*, you could use tcp, udp, tls, ... Or even better upgrade to something much newer if possible :) The "Avaiable-Modules" is also a later feature, so that was a reason not to show up the list of modules, not the lack of them. -- Kokan On Wed, May 1, 2019 at 9:41 PM Simon Tyler <simon.tyler(a)aon.com> wrote: > Hi Kohan, > > It appears that modules are not loading? > > [root@ip-10-8-41-60 syslog-ng]# syslog-ng -V > syslog-ng 3.2.5 > Installer-Version: 3.2.5 > Revision: ssh+git://bazsi@git.balabit > //var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#9d4bea28198bd731df1a61e980a2af5b88d81116 > Compile-Date: Jul 25 2014 15:20:50 > Enable-Threads: on > Enable-Debug: off > Enable-GProf: off > Enable-Memtrace: off > Enable-Sun-STREAMS: off > Enable-IPv6: on > Enable-Spoof-Source: on > Enable-TCP-Wrapper: on > Enable-SSL: off > Enable-SQL: on > Enable-Linux-Caps: off > Enable-Pcre: on > Enable-Pacct: off > > ------------------------------------------------------------- > I tried putting full path to modules.conf in scl.conf: > > [root@ip-10-8-41-60 syslog-ng]# cat scl.conf > > ############################################################################# > # Copyright (c) 2010 BalaBit IT Ltd, Budapest, Hungary > # > # This program is free software; you can redistribute it and/or modify it > # under the terms of the GNU General Public License version 2 as published > # by the Free Software Foundation, or (at your option) any later version. > # > # As an additional exemption you are allowed to compile & link against the > # OpenSSL libraries as published by the OpenSSL project. See the file > # COPYING for details. > # > # This program is distributed in the hope that it will be useful, > # but WITHOUT ANY WARRANTY; without even the implied warranty of > # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the > # GNU General Public License for more details. > # > # You should have received a copy of the GNU General Public License > # along with this program; if not, write to the Free Software > # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 > USA > # > > ############################################################################# > # > # This file is placed into /etc/syslog-ng in order to make it trivial to > # include in user written syslog-ng.conf files. It sets up 'scl-root' and > # `include-path`, then includes all SCL supplied plugins. > # > > @define scl-root "`syslog-ng-data`/include/scl" > @define include-path "`include-path`:`syslog-ng-data`/include" > > #@include 'modules.conf' > @include '/etc/syslog-ng/modules.conf' > @include 'scl/system/plugin.conf' > @include 'scl/pacct/plugin.conf' > @include 'scl/syslogconf/plugin.conf' > > --------------------------------------------------- > Debug it seems to be trying to open modules, and it knows where they live: > [root@ip-10-8-41-60 syslog-ng]# syslog-ng --debug > Trying to open module; module='syslogformat', > filename='/lib64/syslog-ng/libsyslogformat.so' > Trying to open module; module='basicfuncs', > filename='/lib64/syslog-ng/libbasicfuncs.so' > Trying to open module; module='afsocket', > filename='/lib64/syslog-ng/libafsocket.so' > Trying to open module; module='affile', > filename='/lib64/syslog-ng/libaffile.so' > Trying to open module; module='afprog', > filename='/lib64/syslog-ng/libafprog.so' > Trying to open module; module='afuser', > filename='/lib64/syslog-ng/libafuser.so' > Trying to open module; module='dbparser', > filename='/lib64/syslog-ng/libdbparser.so' > Trying to open module; module='csvparser', > filename='/lib64/syslog-ng/libcsvparser.so' > Trying to open module; module='afsql', > filename='/lib64/syslog-ng/libafsql.so' > Starting to read include file; filename='/etc/syslog-ng/scl.conf', > depth='1' > Global value changed; define='scl-root', > value='/usr/share/syslog-ng/include/scl' > Global value changed; define='include-path', > value='/etc/syslog-ng:/usr/share/syslog-ng/include' > Starting to read include file; filename='/etc/syslog-ng/modules.conf', > depth='2' > Global value changed; define='autoload-compiled-modules', value='0' > Trying to open module; module='syslogformat', > filename='/lib64/syslog-ng/libsyslogformat.so' > Attempted to register the same plugin multiple times, ignoring; > context='format', name='syslog' > Trying to open module; module='basicfuncs', > filename='/lib64/syslog-ng/libbasicfuncs.so' > Attempted to register the same plugin multiple times, ignoring; > context='template-func', name='echo' > Attempted to register the same plugin multiple times, ignoring; > context='template-func', name='grep' > Attempted to register the same plugin multiple times, ignoring; > context='template-func', name='if' > Trying to open module; module='afsocket', > filename='/lib64/syslog-ng/libafsocket.so' > Attempted to register the same plugin multiple times, ignoring; > context='source', name='unix-stream' > Attempted to register the same plugin multiple times, ignoring; > context='destination', name='unix-stream' > Attempted to register the same plugin multiple times, ignoring; > context='source', name='unix-dgram' > Attempted to register the same plugin multiple times, ignoring; > context='destination', name='unix-dgram' > Attempted to register the same plugin multiple times, ignoring; > context='source', name='tcp' > Attempted to register the same plugin multiple times, ignoring; > context='destination', name='tcp' > Attempted to register the same plugin multiple times, ignoring; > context='source', name='tcp6' > Attempted to register the same plugin multiple times, ignoring; > context='destination', name='tcp6' > Attempted to register the same plugin multiple times, ignoring; > context='source', name='udp' > Attempted to register the same plugin multiple times, ignoring; > context='destination', name='udp' > Attempted to register the same plugin multiple times, ignoring; > context='source', name='udp6' > Attempted to register the same plugin multiple times, ignoring; > context='destination', name='udp6' > Attempted to register the same plugin multiple times, ignoring; > context='source', name='syslog' > Attempted to register the same plugin multiple times, ignoring; > context='destination', name='syslog' > Trying to open module; module='affile', > filename='/lib64/syslog-ng/libaffile.so' > Attempted to register the same plugin multiple times, ignoring; > context='source', name='file' > Attempted to register the same plugin multiple times, ignoring; > context='source', name='pipe' > Attempted to register the same plugin multiple times, ignoring; > context='destination', name='file' > Attempted to register the same plugin multiple times, ignoring; > context='destination', name='pipe' > Trying to open module; module='afprog', > filename='/lib64/syslog-ng/libafprog.so' > Attempted to register the same plugin multiple times, ignoring; > context='source', name='program' > Attempted to register the same plugin multiple times, ignoring; > context='destination', name='program' > Trying to open module; module='afuser', > filename='/lib64/syslog-ng/libafuser.so' > Attempted to register the same plugin multiple times, ignoring; > context='destination', name='usertty' > Trying to open module; module='dbparser', > filename='/lib64/syslog-ng/libdbparser.so' > Attempted to register the same plugin multiple times, ignoring; > context='parser', name='db-parser' > Trying to open module; module='csvparser', > filename='/lib64/syslog-ng/libcsvparser.so' > Attempted to register the same plugin multiple times, ignoring; > context='parser', name='csv-parser' > Finishing include; filename='/etc/syslog-ng/modules.conf', depth='2' > Starting to read include file; > filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', depth='2' > Trying to open module; module='confgen', > filename='/lib64/syslog-ng/libconfgen.so' > Finishing include; > filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', depth='2' > Starting to read include file; > filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', depth='2' > Finishing include; > filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', depth='2' > Starting to read include file; > filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf', > depth='2' > Trying to open module; module='confgen', > filename='/lib64/syslog-ng/libconfgen.so' > Finishing include; > filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf', > depth='2' > Finishing include; filename='/etc/syslog-ng/scl.conf', depth='1' > Error parsing source, source plugin network not found in > /etc/syslog-ng/syslog-ng.conf at line 85, column 2: > > network( > ^^^^^^^ > --------------------------------------------------------------- > It is not clear to me what the name is for network module; here are the > modules in the file system: > [root@ip-10-8-41-60 syslog-ng]# ls /lib64/syslog-ng/ > libaffile.so libafsocket-notls.so libafsql.so libbasicfuncs.so > libconvertfuncs.so libdbparser.so libsyslogformat.so > libafprog.so libafsocket.so libafuser.so libconfgen.so > libcsvparser.so libdummy.so > > Thank you for your advice, > > > > > Simon Tyler | Senior Systems Administrator - PathWise Solutions Group > Aon > 225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada > t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.979.7724 > simon.tyler(a)aon.com > PLEASE NOTE that my email address has changed to simon.tyler(a)aon.com > > > > -----Original Message----- > From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of > syslog-ng-request(a)lists.balabit.hu > Sent: Wednesday, May 01, 2019 12:47 PM > To: syslog-ng(a)lists.balabit.hu > Subject: syslog-ng Digest, Vol 169, Issue 1 > > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. source plugin network not found/problems getting syslog-ng > to listen on tcp port (Simon Tyler) > 2. Re: source plugin network not found/problems getting > syslog-ng to listen on tcp port (Péter) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 1 May 2019 15:22:26 +0000 > From: Simon Tyler <simon.tyler(a)aon.com> > To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> > Subject: [syslog-ng] source plugin network not found/problems getting > syslog-ng to listen on tcp port > Message-ID: > < > DM5P170MB0015DD8BF273A79D22817BAAFB3B0(a)DM5P170MB0015.NAMP170.PROD.OUTLOOK.COM > > > > Content-Type: text/plain; charset="utf-8" > > Hello, > > I'm new to syslog-ng, and I'm having some trouble just getting it to > listen on a tcp port. I've tried several different configurations. Some of > the start up with no error, but a netstat or lsof command shows that there > is no open /listening tcp port associated with the process. I'm pretty sure > my mistake is basic or fundamental, but I haven't had much luck finding > specific details to resolve this issue; there is a fair amount of material > to comb through. I've tried several different tutorials. > > I want a central log server that accepts logs from multiple sources, so I > started by trying to configure it to listen on a tcp port, I'm thinking 514 > because we don't use rshell anywhere, but it doesn't really matter what > port. > > The current error I'm getting is: > > [root@ip-10-8-41-60 syslog-ng]# service syslog-ng start > Error parsing source, source plugin network not found in > /etc/syslog-ng/syslog-ng.conf at line 85, column 2: > > network( > ^^^^^^^ > > The section of the config file related to networking is below; I've > commented out several attempts. > > # s_net = Network listener. This is listening on TCP port 514, no UDP > #source s_net { tcp(port(514) max-connections(5000)); udp();}; > > #source s_net { > # tcp(ip(10.8.41.60) port(514)); > #}; > > #source s_net { > # network(ip(10.8.41.60) port(514)); > #}; > > #source s_network { > # default-network-drivers(); > #}; > > #source s_syslog { syslog( > # ip(10.8.41.60) port(514) transport("tcp")); }; > > source s_network { > network( > ip("10.8.41.60") > transport("tcp") > listen-backlog(2048) > ); > }; > > There is a line at the top of the file: > @include "scl.conf" > > I've attached the entire file. > > Any guidance would be very much appreciated, > > Simon Tyler | Senior Systems Administrator - PathWise Solutions Group > Aon > 225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada > t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.979.7724 > simon.tyler(a)aon.com<mailto:simon.tyler@aon.com> > PLEASE NOTE that my email address has changed to simon.tyler(a)aon.com > > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: < > http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190501/4cfbf496/a… > > > -------------- next part -------------- > A non-text attachment was scrubbed... > Name: syslog-ng.conf > Type: application/octet-stream > Size: 4159 bytes > Desc: syslog-ng.conf > URL: < > http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190501/4cfbf496/a… > > > > ------------------------------ > > Message: 2 > Date: Wed, 1 May 2019 18:46:41 +0200 > From: Péter, Kókai <peter.kokai(a)oneidentity.com> > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Subject: Re: [syslog-ng] source plugin network not found/problems > getting syslog-ng to listen on tcp port > Message-ID: > <CABxQCphBGgTm47G= > KVSB67Ri6BRKUZYgX-HvAj1SrS9ofMoaoQ(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hello, > > It either looks for a wrong place for the network module or that actually > really not installed. > > You could run the following: syslog-ng -V > That should provide something like this: > > syslog-ng 3.20.1.317.g98479aa > Config version: 3.20 > Installer-Version: 3.20.1.317.g98479aa > Revision: 3.20.1.317.g98479aa > Module-Directory: /tmp/install/lib/syslog-ng > Module-Path: /tmp/install/lib/syslog-ng > Include-Path: /tmp/install/share/syslog-ng/include > Available-Modules: > > xml,tags-parser,system-source,sdjournal,syslogformat,stardate,snmptrapd_parser,riemann,mod-python,pseudofile,pacctformat,map_value_pairs,linux-kmsg-format,kvformat,json-plugin,http,hook-commands,graphite,tfgetent,geoip2-plugin,geoip-plugin,examples,disk-buffer,dbparser,date,csvparser,cryptofuncs,confgen,cef,basicfuncs,appmodel,afuser,afstomp,afsql,afsocket,afprog,affile,afamqp,add_contextual_data > Enable-Debug: on > Enable-GProf: off > Enable-Memtrace: off > Enable-IPv6: on > Enable-Spoof-Source: off > Enable-TCP-Wrapper: off > Enable-Linux-Caps: on > Enable-Systemd: on > > Check if the "Available-Modules" line has the *afsocket*, if the *afsocket* > is not listed there, try to look in the "Module-Path:" directory for > *libafsocket.so", if it is missing maybe it is actually in a different > package, you may need to install something like syslog-ng-mod-afsocket. > > If you find the *libafsocket.so* in the directory I would run > syslog-ng --module-registry -dvt (possibly past its result here) or look > for error message as why it cannot load *libafsocket.so*. > > > -- > Kokan > > On Wed, May 1, 2019 at 5:22 PM Simon Tyler <simon.tyler(a)aon.com> wrote: > > > Hello, > > > > > > > > I’m new to syslog-ng, and I’m having some trouble just getting it to > > listen on a tcp port. I’ve tried several different configurations. Some > of > > the start up with no error, but a netstat or lsof command shows that > there > > is no open /listening tcp port associated with the process. I’m pretty > sure > > my mistake is basic or fundamental, but I haven’t had much luck finding > > specific details to resolve this issue; there is a fair amount of > material > > to comb through. I’ve tried several different tutorials. > > > > > > > > I want a central log server that accepts logs from multiple sources, so I > > started by trying to configure it to listen on a tcp port, I’m thinking > 514 > > because we don’t use rshell anywhere, but it doesn’t really matter what > > port. > > > > > > > > The current error I’m getting is: > > > > > > > > [root@ip-10-8-41-60 syslog-ng]# service syslog-ng start > > > > Error parsing source, source plugin network not found in > > /etc/syslog-ng/syslog-ng.conf at line 85, column 2: > > > > > > > > network( > > > > ^^^^^^^ > > > > > > > > The section of the config file related to networking is below; I’ve > > commented out several attempts. > > > > > > > > # s_net = Network listener. This is listening on TCP port 514, no UDP > > > > #source s_net { tcp(port(514) max-connections(5000)); udp();}; > > > > > > > > #source s_net { > > > > # tcp(ip(10.8.41.60) port(514)); > > > > #}; > > > > > > > > #source s_net { > > > > # network(ip(10.8.41.60) port(514)); > > > > #}; > > > > > > > > #source s_network { > > > > # default-network-drivers(); > > > > #}; > > > > > > > > #source s_syslog { syslog( > > > > # ip(10.8.41.60) port(514) transport("tcp")); }; > > > > > > > > source s_network { > > > > network( > > > > ip("10.8.41.60") > > > > transport("tcp") > > > > listen-backlog(2048) > > > > ); > > > > }; > > > > > > > > There is a line at the top of the file: > > > > @include "scl.conf" > > > > > > > > I’ve attached the entire file. > > > > > > > > Any guidance would be very much appreciated, > > > > > > > > *Simon Tyler *| Senior Systems Administrator - PathWise Solutions Group > > Aon > > 225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada > > t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.979.7724 > > *simon.tyler(a)aon.com <simon.tyler(a)aon.com>* > > > > *PLEASE NOTE that my email address has changed to simon.tyler(a)aon.com > > <http://simon.tyler@aon.com>* > > > > > > > > > ______________________________________________________________________________ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: < > http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190501/715578b1/a… > > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > ------------------------------ > > End of syslog-ng Digest, Vol 169, Issue 1 > ***************************************** > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190502/b6b91ca5/a…> ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng ------------------------------ End of syslog-ng Digest, Vol 169, Issue 3 *****************************************

2 1

Re: [syslog-ng] syslog-ng Digest, Vol 169, Issue 1
by Simon Tyler 02 May '19

02 May '19

Hi Kohan, It appears that modules are not loading? [root@ip-10-8-41-60 syslog-ng]# syslog-ng -V syslog-ng 3.2.5 Installer-Version: 3.2.5 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#9d4bea28198bd731df1a61e980a2af5b88d81116 Compile-Date: Jul 25 2014 15:20:50 Enable-Threads: on Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-SSL: off Enable-SQL: on Enable-Linux-Caps: off Enable-Pcre: on Enable-Pacct: off ------------------------------------------------------------- I tried putting full path to modules.conf in scl.conf: [root@ip-10-8-41-60 syslog-ng]# cat scl.conf ############################################################################# # Copyright (c) 2010 BalaBit IT Ltd, Budapest, Hungary # # This program is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License version 2 as published # by the Free Software Foundation, or (at your option) any later version. # # As an additional exemption you are allowed to compile & link against the # OpenSSL libraries as published by the OpenSSL project. See the file # COPYING for details. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA # ############################################################################# # # This file is placed into /etc/syslog-ng in order to make it trivial to # include in user written syslog-ng.conf files. It sets up 'scl-root' and # `include-path`, then includes all SCL supplied plugins. # @define scl-root "`syslog-ng-data`/include/scl" @define include-path "`include-path`:`syslog-ng-data`/include" #@include 'modules.conf' @include '/etc/syslog-ng/modules.conf' @include 'scl/system/plugin.conf' @include 'scl/pacct/plugin.conf' @include 'scl/syslogconf/plugin.conf' --------------------------------------------------- Debug it seems to be trying to open modules, and it knows where they live: [root@ip-10-8-41-60 syslog-ng]# syslog-ng --debug Trying to open module; module='syslogformat', filename='/lib64/syslog-ng/libsyslogformat.so' Trying to open module; module='basicfuncs', filename='/lib64/syslog-ng/libbasicfuncs.so' Trying to open module; module='afsocket', filename='/lib64/syslog-ng/libafsocket.so' Trying to open module; module='affile', filename='/lib64/syslog-ng/libaffile.so' Trying to open module; module='afprog', filename='/lib64/syslog-ng/libafprog.so' Trying to open module; module='afuser', filename='/lib64/syslog-ng/libafuser.so' Trying to open module; module='dbparser', filename='/lib64/syslog-ng/libdbparser.so' Trying to open module; module='csvparser', filename='/lib64/syslog-ng/libcsvparser.so' Trying to open module; module='afsql', filename='/lib64/syslog-ng/libafsql.so' Starting to read include file; filename='/etc/syslog-ng/scl.conf', depth='1' Global value changed; define='scl-root', value='/usr/share/syslog-ng/include/scl' Global value changed; define='include-path', value='/etc/syslog-ng:/usr/share/syslog-ng/include' Starting to read include file; filename='/etc/syslog-ng/modules.conf', depth='2' Global value changed; define='autoload-compiled-modules', value='0' Trying to open module; module='syslogformat', filename='/lib64/syslog-ng/libsyslogformat.so' Attempted to register the same plugin multiple times, ignoring; context='format', name='syslog' Trying to open module; module='basicfuncs', filename='/lib64/syslog-ng/libbasicfuncs.so' Attempted to register the same plugin multiple times, ignoring; context='template-func', name='echo' Attempted to register the same plugin multiple times, ignoring; context='template-func', name='grep' Attempted to register the same plugin multiple times, ignoring; context='template-func', name='if' Trying to open module; module='afsocket', filename='/lib64/syslog-ng/libafsocket.so' Attempted to register the same plugin multiple times, ignoring; context='source', name='unix-stream' Attempted to register the same plugin multiple times, ignoring; context='destination', name='unix-stream' Attempted to register the same plugin multiple times, ignoring; context='source', name='unix-dgram' Attempted to register the same plugin multiple times, ignoring; context='destination', name='unix-dgram' Attempted to register the same plugin multiple times, ignoring; context='source', name='tcp' Attempted to register the same plugin multiple times, ignoring; context='destination', name='tcp' Attempted to register the same plugin multiple times, ignoring; context='source', name='tcp6' Attempted to register the same plugin multiple times, ignoring; context='destination', name='tcp6' Attempted to register the same plugin multiple times, ignoring; context='source', name='udp' Attempted to register the same plugin multiple times, ignoring; context='destination', name='udp' Attempted to register the same plugin multiple times, ignoring; context='source', name='udp6' Attempted to register the same plugin multiple times, ignoring; context='destination', name='udp6' Attempted to register the same plugin multiple times, ignoring; context='source', name='syslog' Attempted to register the same plugin multiple times, ignoring; context='destination', name='syslog' Trying to open module; module='affile', filename='/lib64/syslog-ng/libaffile.so' Attempted to register the same plugin multiple times, ignoring; context='source', name='file' Attempted to register the same plugin multiple times, ignoring; context='source', name='pipe' Attempted to register the same plugin multiple times, ignoring; context='destination', name='file' Attempted to register the same plugin multiple times, ignoring; context='destination', name='pipe' Trying to open module; module='afprog', filename='/lib64/syslog-ng/libafprog.so' Attempted to register the same plugin multiple times, ignoring; context='source', name='program' Attempted to register the same plugin multiple times, ignoring; context='destination', name='program' Trying to open module; module='afuser', filename='/lib64/syslog-ng/libafuser.so' Attempted to register the same plugin multiple times, ignoring; context='destination', name='usertty' Trying to open module; module='dbparser', filename='/lib64/syslog-ng/libdbparser.so' Attempted to register the same plugin multiple times, ignoring; context='parser', name='db-parser' Trying to open module; module='csvparser', filename='/lib64/syslog-ng/libcsvparser.so' Attempted to register the same plugin multiple times, ignoring; context='parser', name='csv-parser' Finishing include; filename='/etc/syslog-ng/modules.conf', depth='2' Starting to read include file; filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', depth='2' Trying to open module; module='confgen', filename='/lib64/syslog-ng/libconfgen.so' Finishing include; filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', depth='2' Starting to read include file; filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', depth='2' Finishing include; filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', depth='2' Starting to read include file; filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf', depth='2' Trying to open module; module='confgen', filename='/lib64/syslog-ng/libconfgen.so' Finishing include; filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf', depth='2' Finishing include; filename='/etc/syslog-ng/scl.conf', depth='1' Error parsing source, source plugin network not found in /etc/syslog-ng/syslog-ng.conf at line 85, column 2: network( ^^^^^^^ --------------------------------------------------------------- It is not clear to me what the name is for network module; here are the modules in the file system: [root@ip-10-8-41-60 syslog-ng]# ls /lib64/syslog-ng/ libaffile.so libafsocket-notls.so libafsql.so libbasicfuncs.so libconvertfuncs.so libdbparser.so libsyslogformat.so libafprog.so libafsocket.so libafuser.so libconfgen.so libcsvparser.so libdummy.so Thank you for your advice, Simon Tyler | Senior Systems Administrator - PathWise Solutions Group Aon 225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.979.7724 simon.tyler(a)aon.com PLEASE NOTE that my email address has changed to simon.tyler(a)aon.com -----Original Message----- From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: Wednesday, May 01, 2019 12:47 PM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 169, Issue 1 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. source plugin network not found/problems getting syslog-ng to listen on tcp port (Simon Tyler) 2. Re: source plugin network not found/problems getting syslog-ng to listen on tcp port (Péter) ---------------------------------------------------------------------- Message: 1 Date: Wed, 1 May 2019 15:22:26 +0000 From: Simon Tyler <simon.tyler(a)aon.com> To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] source plugin network not found/problems getting syslog-ng to listen on tcp port Message-ID: <DM5P170MB0015DD8BF273A79D22817BAAFB3B0(a)DM5P170MB0015.NAMP170.PROD.OUTLOOK.COM> Content-Type: text/plain; charset="utf-8" Hello, I'm new to syslog-ng, and I'm having some trouble just getting it to listen on a tcp port. I've tried several different configurations. Some of the start up with no error, but a netstat or lsof command shows that there is no open /listening tcp port associated with the process. I'm pretty sure my mistake is basic or fundamental, but I haven't had much luck finding specific details to resolve this issue; there is a fair amount of material to comb through. I've tried several different tutorials. I want a central log server that accepts logs from multiple sources, so I started by trying to configure it to listen on a tcp port, I'm thinking 514 because we don't use rshell anywhere, but it doesn't really matter what port. The current error I'm getting is: [root@ip-10-8-41-60 syslog-ng]# service syslog-ng start Error parsing source, source plugin network not found in /etc/syslog-ng/syslog-ng.conf at line 85, column 2: network( ^^^^^^^ The section of the config file related to networking is below; I've commented out several attempts. # s_net = Network listener. This is listening on TCP port 514, no UDP #source s_net { tcp(port(514) max-connections(5000)); udp();}; #source s_net { # tcp(ip(10.8.41.60) port(514)); #}; #source s_net { # network(ip(10.8.41.60) port(514)); #}; #source s_network { # default-network-drivers(); #}; #source s_syslog { syslog( # ip(10.8.41.60) port(514) transport("tcp")); }; source s_network { network( ip("10.8.41.60") transport("tcp") listen-backlog(2048) ); }; There is a line at the top of the file: @include "scl.conf" I've attached the entire file. Any guidance would be very much appreciated, Simon Tyler | Senior Systems Administrator - PathWise Solutions Group Aon 225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.979.7724 simon.tyler(a)aon.com<mailto:simon.tyler@aon.com> PLEASE NOTE that my email address has changed to simon.tyler(a)aon.com -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190501/4cfbf496/a…> -------------- next part -------------- A non-text attachment was scrubbed... Name: syslog-ng.conf Type: application/octet-stream Size: 4159 bytes Desc: syslog-ng.conf URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190501/4cfbf496/a…> ------------------------------ Message: 2 Date: Wed, 1 May 2019 18:46:41 +0200 From: Péter, Kókai <peter.kokai(a)oneidentity.com> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] source plugin network not found/problems getting syslog-ng to listen on tcp port Message-ID: <CABxQCphBGgTm47G=KVSB67Ri6BRKUZYgX-HvAj1SrS9ofMoaoQ(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Hello, It either looks for a wrong place for the network module or that actually really not installed. You could run the following: syslog-ng -V That should provide something like this: syslog-ng 3.20.1.317.g98479aa Config version: 3.20 Installer-Version: 3.20.1.317.g98479aa Revision: 3.20.1.317.g98479aa Module-Directory: /tmp/install/lib/syslog-ng Module-Path: /tmp/install/lib/syslog-ng Include-Path: /tmp/install/share/syslog-ng/include Available-Modules: xml,tags-parser,system-source,sdjournal,syslogformat,stardate,snmptrapd_parser,riemann,mod-python,pseudofile,pacctformat,map_value_pairs,linux-kmsg-format,kvformat,json-plugin,http,hook-commands,graphite,tfgetent,geoip2-plugin,geoip-plugin,examples,disk-buffer,dbparser,date,csvparser,cryptofuncs,confgen,cef,basicfuncs,appmodel,afuser,afstomp,afsql,afsocket,afprog,affile,afamqp,add_contextual_data Enable-Debug: on Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-Linux-Caps: on Enable-Systemd: on Check if the "Available-Modules" line has the *afsocket*, if the *afsocket* is not listed there, try to look in the "Module-Path:" directory for *libafsocket.so", if it is missing maybe it is actually in a different package, you may need to install something like syslog-ng-mod-afsocket. If you find the *libafsocket.so* in the directory I would run syslog-ng --module-registry -dvt (possibly past its result here) or look for error message as why it cannot load *libafsocket.so*. -- Kokan On Wed, May 1, 2019 at 5:22 PM Simon Tyler <simon.tyler(a)aon.com> wrote: > Hello, > > > > I’m new to syslog-ng, and I’m having some trouble just getting it to > listen on a tcp port. I’ve tried several different configurations. Some of > the start up with no error, but a netstat or lsof command shows that there > is no open /listening tcp port associated with the process. I’m pretty sure > my mistake is basic or fundamental, but I haven’t had much luck finding > specific details to resolve this issue; there is a fair amount of material > to comb through. I’ve tried several different tutorials. > > > > I want a central log server that accepts logs from multiple sources, so I > started by trying to configure it to listen on a tcp port, I’m thinking 514 > because we don’t use rshell anywhere, but it doesn’t really matter what > port. > > > > The current error I’m getting is: > > > > [root@ip-10-8-41-60 syslog-ng]# service syslog-ng start > > Error parsing source, source plugin network not found in > /etc/syslog-ng/syslog-ng.conf at line 85, column 2: > > > > network( > > ^^^^^^^ > > > > The section of the config file related to networking is below; I’ve > commented out several attempts. > > > > # s_net = Network listener. This is listening on TCP port 514, no UDP > > #source s_net { tcp(port(514) max-connections(5000)); udp();}; > > > > #source s_net { > > # tcp(ip(10.8.41.60) port(514)); > > #}; > > > > #source s_net { > > # network(ip(10.8.41.60) port(514)); > > #}; > > > > #source s_network { > > # default-network-drivers(); > > #}; > > > > #source s_syslog { syslog( > > # ip(10.8.41.60) port(514) transport("tcp")); }; > > > > source s_network { > > network( > > ip("10.8.41.60") > > transport("tcp") > > listen-backlog(2048) > > ); > > }; > > > > There is a line at the top of the file: > > @include "scl.conf" > > > > I’ve attached the entire file. > > > > Any guidance would be very much appreciated, > > > > *Simon Tyler *| Senior Systems Administrator - PathWise Solutions Group > Aon > 225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada > t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.979.7724 > *simon.tyler(a)aon.com <simon.tyler(a)aon.com>* > > *PLEASE NOTE that my email address has changed to simon.tyler(a)aon.com > <http://simon.tyler@aon.com>* > > > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190501/715578b1/a…> ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng ------------------------------ End of syslog-ng Digest, Vol 169, Issue 1 *****************************************

2 1

source plugin network not found/problems getting syslog-ng to listen on tcp port
by Simon Tyler 01 May '19

01 May '19

Hello, I'm new to syslog-ng, and I'm having some trouble just getting it to listen on a tcp port. I've tried several different configurations. Some of the start up with no error, but a netstat or lsof command shows that there is no open /listening tcp port associated with the process. I'm pretty sure my mistake is basic or fundamental, but I haven't had much luck finding specific details to resolve this issue; there is a fair amount of material to comb through. I've tried several different tutorials. I want a central log server that accepts logs from multiple sources, so I started by trying to configure it to listen on a tcp port, I'm thinking 514 because we don't use rshell anywhere, but it doesn't really matter what port. The current error I'm getting is: [root@ip-10-8-41-60 syslog-ng]# service syslog-ng start Error parsing source, source plugin network not found in /etc/syslog-ng/syslog-ng.conf at line 85, column 2: network( ^^^^^^^ The section of the config file related to networking is below; I've commented out several attempts. # s_net = Network listener. This is listening on TCP port 514, no UDP #source s_net { tcp(port(514) max-connections(5000)); udp();}; #source s_net { # tcp(ip(10.8.41.60) port(514)); #}; #source s_net { # network(ip(10.8.41.60) port(514)); #}; #source s_network { # default-network-drivers(); #}; #source s_syslog { syslog( # ip(10.8.41.60) port(514) transport("tcp")); }; source s_network { network( ip("10.8.41.60") transport("tcp") listen-backlog(2048) ); }; There is a line at the top of the file: @include "scl.conf" I've attached the entire file. Any guidance would be very much appreciated, Simon Tyler | Senior Systems Administrator - PathWise Solutions Group Aon 225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.979.7724 simon.tyler(a)aon.com<mailto:simon.tyler@aon.com> PLEASE NOTE that my email address has changed to simon.tyler(a)aon.com

2 1

syslog-ng for filtering and execute external application
by Thomas Schmiedl 29 Apr '19

29 Apr '19

Hello, I use the mediaserver xupnpd2 (https://github.com/clark15b/xupnpd2) on the router to show HLS streams on the TV. Unfortunately, the software is no longer maintained by the original developer (I'm not a developer myself). The HLS processing would have to be revised. My idea is to start a ffmpeg and a local web server on the router, if I want to display the stream (the script xupnpd.lua will be executed, which starts ffmpeg etc.). Unfortunately there is not such a script when terminating the stream (exit ffmpeg etc.). xupnpd2 uses a log where you can track the start as well as the ending of the stream. Since the router has only a small amount of internal memory to write and analyze a logfile, I have the question, if I could use syslog-ng to filter the start and stop of the stream and execute an action "ffmpeg stop" and "delete video segments". I have very little Linux knowledge, maybe you can help me. Here is the excerpt from the xupnpd2 log (Loglevel 8). When starting the stream: run child, pid = 1715 using handler 'hls' for '... URL ...' When stopping the stream: exit child, pid = 1715 Best regards, Thomas Schmiedl

2 7

Bumped off the list again
by Scot 28 Apr '19

28 Apr '19

Anyone else using gmail getting bumped off the list ? Twice so far due to too many bounces to my gmail account.

4 4

how to insert a word before forwarding to another remote host
by Lin, Victor 25 Apr '19

25 Apr '19

Dear all, Could anyone let me know how can Insert a label into a syslog message? I received Cisco syslog from port514, Arista 5214, Airwave 5514, then my syslog forwarding these into one remote host with port 5714 ( they don't want separate port for each vendor) , so I will need to insert "Cisco" or "Arista" or "Airwave" before forwarding Thank you very much for your direction! VL If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. RBC collects information from you and your device, including through use of cookies, in order to improve your digital experience and measure the effectiveness of RBC digital channels. Additional information may be found here <https://www.rbc.com/privacysecurity/ca/online-privacy.html>. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future. RBC recueille des renseignements fournis par vous et par votre appareil, de même que par l’utilisation de témoins, dans le but d’améliorer votre expérience numérique et de mesurer l’efficacité de nos canaux numériques. Vous pouvez obtenir des renseignements supplémentaires

1 0

startup and network sources
by Evan Rempel 18 Apr '19

18 Apr '19

I've been looking at an interesting scenario on Redhat 7 (systemd) where syslog-ng fails to start because it can not resolve a network source name. This happens because the network has not started. Systemd attempts to restart syslog-ng a few times and then decides that it is restarting syslog-ng too quickly and gives up on it. 2019-04-17T05:13:30.009 daemon.warning systemd[1]: start request repeated too quickly for syslog-ng.service 2019-04-17T05:13:30.010 daemon.err systemd[1]: Failed to start System Logger Daemon. 2019-04-17T05:13:30.010 daemon.notice systemd[1]: Unit syslog-ng.service entered failed state. 2019-04-17T05:13:30.010 daemon.warning systemd[1]: syslog-ng.service failed. My first reaction was to add the "Wants=network-online.target" to the service definition to make syslog-ng start after the network has started, but that would mean that if I boot up without a network that syslog-ng would never start, and that seems incorrect to me. Is there a way to to configure a network source to be optional and continue to retry binding to it after startup? How do others handle this issue? -- Evan

2 3

Permissions Issues
by Faine, Mark R. (MSFC-IS40)[NICS] 16 Apr '19

16 Apr '19

syslog-ng 3.18.1 RHEL 6.10 Can someone please help me understand what I'm doing wrong? I thought that when I set the following on a destination: create_dirs(yes); dir-owner(myuser); dir-group(myuser); group(myuser); owner(myuser); perm(0640); that files and directories would be created with those permissions, however, I'm seeing something strange. It seems that syslog-ng still wants to create and write to files with root.root. Also, and this is even more unexpected. If I change the permissions on the directories before starting syslog-ng, it fails to write to the directories that are not root.root. Am I missing something? Thanks, -Mark

2 4

Missing http module 3.18.1 CentOS
by Faine, Mark R. (MSFC-IS40)[NICS] 10 Apr '19

10 Apr '19

Forgive me if this is common knowledge or an easy fix but I just installed syslog-ng 3.18.1 on CentOS 7.6.1810 and I'm seeing the following message on startup and when doing syntax checks. It seems to be working otherwise. [2019-04-09T18:44:57.702909] Plugin module not found in 'module-path'; module-path='//usr/lib64/syslog-ng', module='http' Thanks, -Mark

3 4

Insider 2019-04: Tetris; Docker; Podman; python-fetcher
by Czanik, Péter 10 Apr '19

10 Apr '19

Dear syslog-ng users, This is the 74th issue of syslog-ng Insider, a monthly newsletter that brings you news related to syslog-ng. NEWS Tetris destination ------------------ In this blog post we show you a fun way of using the Python destination of syslog-ng. We will write a Tetris destination. We will use the built-in Tetris implementation of Emacs. The syslog-ng Python destination will connect to an Emacs server. The log messages will be turned into Tetris commands inside Emacs. Using an stdin source, users can interactively feed syslog-ng with messages that will control the Tetris in the end. https://www.syslog-ng.com/community/b/blog/posts/tetris-destination A simplified guide to logging Docker to Elasticsearch in 2019 using syslog-ng ----------------------------------- This simplified guide shows you how to send logs of containers into Elasticsearch. Although there are several tutorials on logging Docker to Elasticsearch, this one is entirely different, as it uses syslog-ng. You can also visualize your Docker logs on a nice dashboard in Kibana. https://balagetech.com/simplified-logging-docker-elasticsearch-syslog-ng/ Replacing Docker with Podman in the syslog-ng build container ------------------------------------------------------------- The syslog-ng source code includes a container-based build system. You can use this build system to generate source tarballs (the official syslog-ng release tarball is also generated this way) and to build packages for RHEL 7 as well as different Debian and Ubuntu releases. Although it was originally built around Docker, with the general availability of RHEL 8 is drawing near, I wanted to know how difficult it is to replace Docker with Podman in the syslog-ng build system. Originally I tested this replacement on Fedora Silverblue (Silverblue), then a week later on RHEL 8 Beta. While the syslog-ng build scripts do not support these distributions (yet), the point was to check Podman as a Docker replacement. https://www.syslog-ng.com/community/b/blog/posts/replacing-docker-with-podm… The syslog-ng python-fetcher(): collecting load average data ------------------------------------------------------------ Using python-fetcher() simplifies developing a source driver for syslog-ng even further. You do not have to implement your own event loop, since syslog-ng does it for you. You only need to focus on what information you need and how you (or your code) can fetch it. In this blog I will show you two examples. The first one is a dead end: it is a project that looked simple at first but turned out to be problematic later on. The second one is simple but still manages to illustrate most features of the python-fetcher. https://www.syslog-ng.com/community/b/blog/posts/the-syslog-ng-python-fetch… CONFERENCES * LOADays (https://loadays.org/) syslog-ng featured in my sudo talk * Red Hat Summit (https://www.redhat.com/en/summit/2019) One Identity booth WEBINARS Upcoming: * Bridge the gap between cloud and on-premises: https://www.syslog-ng.com/event/bridge-the-gap-between-cloud-and-onpremises… You can watch our past webinars: * Got a hungry Splunk? Feed it smartly with syslog-ng: https://www.brighttalk.com/webcast/16207/350610 Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Re: [syslog-ng] syslog-ng Digest, Vol 168, Issue 11
by Aguilu, Miguel 10 Apr '19

10 Apr '19

If it is a simple typo I do not see it. But I did remove all sources with the exception of the upd on all filters. So, it is writing the udp traffic to the log. But getting errors: - You are using the pipe() driver, underlying file is not a FIFO, it should be used by file(); filename='/opt/log/nco' - Apr 9 19:18:01 eorcrp-dsc-ncsl1-new-ms syslog-ng[15695]: Error opening file for writing; filename='/opt/log/nco', error='Invalid argument (22)' Regard Essentially I can write to a log but not a pipe even when create the file as a pipe or let syslog-ng create it - eventually after the creation will start companying it can't write to it. Not sure if I am missing something the pipe configuration (don’t think so) or there is a bug in this version 3.19/3.14/3.1. Yes I am on my 3rd version to see if a see anything different. But so far, I am seeing the same behavior Any thought Thanks Miguel Office - 321.939.7483 Cell - 321.261.1385 PCell – 321.693.5726 miguel.aguilu(a)atos.net Upcoming PTO: TBD On 4/9/19, 2:54 PM, "syslog-ng on behalf of syslog-ng-request(a)lists.balabit.hu" <syslog-ng-bounces(a)lists.balabit.hu on behalf of syslog-ng-request(a)lists.balabit.hu> wrote: Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.bal… or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: Syslog-ng 3.16 unable to write to pipe (Evan Rempel) 2. Missing http module 3.18.1 CentOS (Faine, Mark R. (MSFC-IS40)[NICS]) ---------------------------------------------------------------------- Message: 1 Date: Tue, 9 Apr 2019 07:57:41 -0700 From: Evan Rempel <erempel(a)uvic.ca> To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] Syslog-ng 3.16 unable to write to pipe Message-ID: <cf965cf4-ada3-42c7-f875-d7325a4887ec(a)uvic.ca> Content-Type: text/plain; charset="utf-8"; Format="flowed" You keep referring to /opt/log but your configuration is for /var/log/nco.pipe destination netcool { pipe("/var/log/nco.pipe"); }; Is this a simple typo? On 4/9/19 6:38 AM, Aguilu, Miguel wrote: > > We are in the middle of a project to Migrate from 3.0 to 3.16 (latest in redhat distro) > > The standard 3.14 config works fine writing to some standard logs in /var/log > > But we need to write special files to /opt/log/ > > * In this directory will be a file type pipe to be read by a syslog probe (parse messages into alerts). Using the following configuration NG returns unable to write. > > source s_dgram > > { unix-dgram("/dev/log"); }; > > source s_kernel > > { file("/proc/kmsg" program_override("kernel: ")); }; > > source s_udp > > { udp(); }; > > destination netcool { pipe("/var/log/nco.pipe"); }; > > log { source(s_dgram); > > source(s_kernel); > > source(s_udp); filter(f_NOfwflow); > > filter(f_NOdata_cent); > > filter(f_NOtacacs); > > filter(f_netcool); destination(netcool); }; > > * Even if I remove the filter I get the same error. > * Also removed all of the sources with the exception of the upd and got the same error. > * Changed the file type to file and getting: > o OLLERR occurred while idle; fd='66' > o Apr 9 13:17:45 wbucrp-isdmz1a-lb err syslog-ng[2475]: Connection broken; time_reopen='60' > o Apr 9 13:17:47 wbucrp-isdmz1b-lb err syslog-ng[10934]: POLLERR occurred while idle; fd='66' > o Apr 9 13:17:47 wbucrp-isdmz1b-lb err syslog-ng[10934]: Connection broken; time_reopen='60' > o Apr 9 13:17:51 wapcrp-isdmz0a-lb err syslog-ng[3713]: I/O error occurred while writing; fd='38', error='Connection refused (111)' > o Apr 9 13:17:51 wapcrp-isdmz0a-lb err syslog-ng[3713]: Connection broken; time_reopen='60' > o Apr 9 13:17:51 wapcrp-isdmz0a-lb notice syslog-ng[3713]: Suspending write operation because of an I/O error; fd='38', time_reopen='60' > * The permissions in /opt/log are 777 and owned by root which is the user syslog-ng is running under. > * Also change the path to where the config was updating file (/varr/log) and attemted to create the pipe and no luck > > Here are my global options: > > * options { > * flush_lines (0); > * # time_reopen (10); > * log_fifo_size (1000); > * chain_hostnames (on); > * use_dns (yes); ## changed test > * use_fqdn (yes); > * keep_hostname (yes); > * owner("root"); > * group("root"); > * create_dirs(yes); #Test > * dir_perm(0755); > * perm(0644); > * }; > > ANY Ideas? > > Thanks > > Miguel > -- Evan -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.bala…> ------------------------------ Message: 2 Date: Tue, 9 Apr 2019 18:53:44 +0000 From: "Faine, Mark R. (MSFC-IS40)[NICS]" <mark.faine(a)nasa.gov> To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] Missing http module 3.18.1 CentOS Message-ID: <BN6PR09MB14584A6B3A85C39D8AFB049BE92D0(a)BN6PR09MB1458.namprd09.prod.outlook.com> Content-Type: text/plain; charset="utf-8" Forgive me if this is common knowledge or an easy fix but I just installed syslog-ng 3.18.1 on CentOS 7.6.1810 and I'm seeing the following message on startup and when doing syntax checks. It seems to be working otherwise. [2019-04-09T18:44:57.702909] Plugin module not found in 'module-path'; module-path='//usr/lib64/syslog-ng', module='http' Thanks, -Mark -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.bala…> ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.bal… ------------------------------ End of syslog-ng Digest, Vol 168, Issue 11 ******************************************

1 0

Syslog-ng 3.16 unable to write to pipe
by Aguilu, Miguel 09 Apr '19

09 Apr '19

We are in the middle of a project to Migrate from 3.0 to 3.16 (latest in redhat distro) The standard 3.14 config works fine writing to some standard logs in /var/log But we need to write special files to /opt/log/ * In this directory will be a file type pipe to be read by a syslog probe (parse messages into alerts). Using the following configuration NG returns unable to write. source s_dgram { unix-dgram("/dev/log"); }; source s_kernel { file("/proc/kmsg" program_override("kernel: ")); }; source s_udp { udp(); }; destination netcool { pipe("/var/log/nco.pipe"); }; log { source(s_dgram); source(s_kernel); source(s_udp); filter(f_NOfwflow); filter(f_NOdata_cent); filter(f_NOtacacs); filter(f_netcool); destination(netcool); }; * Even if I remove the filter I get the same error. * Also removed all of the sources with the exception of the upd and got the same error. * Changed the file type to file and getting: * OLLERR occurred while idle; fd='66' * Apr 9 13:17:45 wbucrp-isdmz1a-lb err syslog-ng[2475]: Connection broken; time_reopen='60' * Apr 9 13:17:47 wbucrp-isdmz1b-lb err syslog-ng[10934]: POLLERR occurred while idle; fd='66' * Apr 9 13:17:47 wbucrp-isdmz1b-lb err syslog-ng[10934]: Connection broken; time_reopen='60' * Apr 9 13:17:51 wapcrp-isdmz0a-lb err syslog-ng[3713]: I/O error occurred while writing; fd='38', error='Connection refused (111)' * Apr 9 13:17:51 wapcrp-isdmz0a-lb err syslog-ng[3713]: Connection broken; time_reopen='60' * Apr 9 13:17:51 wapcrp-isdmz0a-lb notice syslog-ng[3713]: Suspending write operation because of an I/O error; fd='38', time_reopen='60' * The permissions in /opt/log are 777 and owned by root which is the user syslog-ng is running under. * Also change the path to where the config was updating file (/varr/log) and attemted to create the pipe and no luck Here are my global options: * options { * flush_lines (0); * # time_reopen (10); * log_fifo_size (1000); * chain_hostnames (on); * use_dns (yes); ## changed test * use_fqdn (yes); * keep_hostname (yes); * owner("root"); * group("root"); * create_dirs(yes); #Test * dir_perm(0755); * perm(0644); * }; ANY Ideas? Thanks Miguel [miki1] Miguel A Aguilu Netcool Suite SME Walt Disney Account Atos Consulting Mobile: (321) 261-1385 1120 Celebration Blvd Celebration, FL 34747 Miguel.Aguilu(a)Atos.net<mailto:Craig.Elliott@Atos.net> www.atos.net<http://www.atos.net/> [/Users/aguim114/Library/Containers/com.microsoft.Outlook/Data/Library/Caches/Signatures/signature_1691773396] Upcoming PTO: TBD This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, the Atos group liability cannot be triggered for the message content. Although the sender endeavors to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted.

2 1

tcpdump shows device sending syslog from UDP
by Lin, Victor 08 Apr '19

08 Apr '19

Hello Fabien, I was running tcpdump on my syslog-ng server, and able to see the package from 1.2.3.4 but my local logfile for UDP 514 didn't show any syslog from 1.2.3.4. Is there another configuration file need to be setup in somewhere? Thank you very much! VL -----Original Message----- From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: 2019, April, 08 8:00 AM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 168, Issue 8 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: WebGUI for Syslog-ng storing logs in HDFS (Lee Keng Ket) 2. Re: tcpdump shows device sending syslog from UDP 514 but not write to local log file (Fabien Wernli) ---------------------------------------------------------------------- Message: 1 Date: Mon, 8 Apr 2019 14:24:09 +0800 From: Lee Keng Ket <kengket(a)gmail.com> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] WebGUI for Syslog-ng storing logs in HDFS Message-ID: <CAHJFZ9edfAq2tKKfjYxNqFJrzjx-Yb77-BxFak4F+vCQDYWoWw(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Hi, Peter Thanks for your info, will look into the link you share. As HDFS is decided to be the storage of logs, I'm trying not to store another copy in ES. Hi, Nik What's the difference between this open-distro and the ES from elastic.co? Thank you. Regards, KK On Fri, Apr 5, 2019 at 10:21 PM Nik Ambrosch <nik(a)ambrosch.com> wrote: > I was considering HDFS but ultimately chose ES because of simplicity. > I too spent a while looking for a pre-packaged suite but most things > are commercial. > > I'd like to check this out sometime, just haven't had the opportunity > - https://opendistro.github.io/for-elasticsearch/ > > On Fri, Apr 5, 2019 at 10:00 AM Czanik, Péter > <peter.czanik(a)balabit.com> > wrote: > >> Hi, >> >> Many syslog-ng users store logs to Elasticsearch and search/analyze >> them using Kibana. Personally I never tested, but should take a look >> at Elasticsearch-Hadoop if it solves your problem: >> https://www.elastic.co/products/hadoop >> >> Bye, >> >> Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit (a OneIdentity >> company) / syslog-ng upstream https://syslog-ng.com/community/ >> https://twitter.com/PCzanik >> >> >> On Fri, Apr 5, 2019 at 3:50 PM Lee Keng Ket <kengket(a)gmail.com> wrote: >> >>> Hi, >>> >>> How about open source webGUI? Any recommendations? >>> >>> Thank you. >>> >>> Regards, >>> KK >>> >>> >>> On Fri, 5 Apr 2019, 20:56 Jim Hendrick, <james.r.hendrick(a)gmail.com> >>> wrote: >>> >>>> It's not free - but you might look at the Syslog Store Box - >>>> https://www.syslog-ng.com/products/log-management-appliance/ >>>> >>>> They have also done some cool stuff with a native splunk HEC >>>> destination in the professional edition of syslog-ng. Might look at >>>> using that and splunk for the front-end? >>>> >>>> Jim >>>> >>>> >>>> On Fri, Apr 5, 2019 at 2:38 AM Lee Keng Ket <kengket(a)gmail.com> wrote: >>>> >>>>> Hi, >>>>> >>>>> I'm looking for a WebGUI application for users to search for >>>>> syslog, which the logs are stored by syslog-ng into HDFS. >>>>> >>>>> Can you please share what WebGUI you're using? >>>>> >>>>> I realize ElasticSearch with Kibana are the famous solution for >>>>> this, however, I wish to store my syslog in HDFS. >>>>> >>>>> Thank you. >>>>> >>>>> Regards, >>>>> KK >>>>> >>>>> __________________________________________________________________ >>>>> ____________ Member info: >>>>> https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>>> Documentation: >>>>> http://www.balabit.com/support/documentation/?product=syslog-ng >>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>>>> >>>>> >>>> ___________________________________________________________________ >>>> ___________ Member info: >>>> https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>> Documentation: >>>> http://www.balabit.com/support/documentation/?product=syslog-ng >>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>>> >>>> >>> ____________________________________________________________________ >>> __________ Member info: >>> https://lists.balabit.hu/mailman/listinfo/syslog-ng >>> Documentation: >>> http://www.balabit.com/support/documentation/?product=syslog-ng >>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>> >>> >> _____________________________________________________________________ >> _________ Member info: >> https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: >> http://www.balabit.com/support/documentation/?product=syslog-ng >> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >> >> > ______________________________________________________________________ > ________ Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190408/feb5e5c1/a…> ------------------------------ Message: 2 Date: Mon, 8 Apr 2019 10:40:05 +0200 From: Fabien Wernli <wernli(a)in2p3.fr> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] tcpdump shows device sending syslog from UDP 514 but not write to local log file Message-ID: <20190408084005.j4v2k5atrmcn6amp(a)ccfawe.in2p3.fr> Content-Type: text/plain; charset=us-ascii On Fri, Apr 05, 2019 at 03:46:37PM +0000, Lin, Victor wrote: > When use: tcpdump src host 1.3.4.5 and port 514 , I can see host 1.3.4.5 is sending the syslog to my syslog-ng > But when I search my local log special for port 514, I didn't see any > syslog from 1.3.4.5 firewall? ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng ------------------------------ End of syslog-ng Digest, Vol 168, Issue 8 ***************************************** _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future.

2 1

tcpdump shows device sending syslog from UDP 514 but not write to local log file
by Lin, Victor 08 Apr '19

08 Apr '19

Dear all, When use: tcpdump src host 1.3.4.5 and port 514 , I can see host 1.3.4.5 is sending the syslog to my syslog-ng But when I search my local log special for port 514, I didn't see any syslog from 1.3.4.5 Is there another location to config the syslog-ng, except /app/syslog-ng/custom/conf/syslog-ng.conf ? Below is from my syslog-ng.conf # Syslog collection for all devices source s_network { network( transport("udp") port(514) flags(syslog_protocol) keep_hostname(yes) keep_timestamp(yes) use_dns(no) use_fqdn(no) ); }; destination d_all_logs { file("/app/syslog-ng/custom/output/all_devices.log"); network("102.45.2.86" port(514) transport(udp) spoof_source(yes)); }; log { source(s_network); source(s_arista_network); destination(d_all_logs); }; Thank you very much for reply in advance!!!!! VL _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future.

2 1

WebGUI for Syslog-ng storing logs in HDFS
by Lee Keng Ket 08 Apr '19

08 Apr '19

Hi, I'm looking for a WebGUI application for users to search for syslog, which the logs are stored by syslog-ng into HDFS. Can you please share what WebGUI you're using? I realize ElasticSearch with Kibana are the famous solution for this, however, I wish to store my syslog in HDFS. Thank you. Regards, KK

4 5

Dropping specific messages from Syslog-NG
by Bell, Christopher E. 05 Apr '19

05 Apr '19

Disclaimer: I'm not an expert in either Linux or syslog-ng. I'm also not a programmer :). That being said, I've built a syslog-ng --> Splunk deployment and I'm trying to drop unwanted log messages before they make their way to Splunk... so drop them at syslog-ng. There are going to be approx. 700 devices logging to this deployment (routers, switches, firewalls, IPAM, AAA, etc..) so I need to make sure whatever I do can scale easily and my teammates can help me manage it. I'm trying to drop messages that are similar to the below: Apr 5 06:02:17 x.x.x.x 2019 Apr 5 06:02:17 EDT: %USER-3-SYSTEM_MSG: NTP Receive dropping message: Received NTP control mode packet. Drop count:4200 - ntpd As well as: Apr 5 08:03:49 x.x.x.x Apr 5 2019 12:03:48.895 UTC: %SNMP-3-RESPONSE_DELAYED: processing GetNext of entPhysicalEntry.2.1065 (5739 msecs) Two different devices. I've tried literally dozens of methods, my latest is below and I can't figure out why we're still logging these messages: filter f_trash { match(SNMP-3-RESPONSE_DELAYED value(MSGHDR)); and match(NTP Receive dropping message value(MSG))}; log { source(s_sys); filter(f_trash); flags (final);}; Any help / constructive criticism would be greatly appreciated.

2 3

Interest in GSoC 2019
by Kushal K S V S 03 Apr '19

03 Apr '19

Hi, I am Kushal. I am a Final Year Undergrad in Computer Science IIT Guwahati, India. I am very much interested in working on Syslog-ng and with the community on the project "Analyze and improve JSON performance". I have installed from the source code and am currently going through the code. I have already participated in GSoC in 2017 as a part of The FreeType Org. Many of my projects including the previous GSoC project are in C. I am well-versed in C, C++, Bash, makefile, etc. which will be the technologies to be used for this project. Hope I am not too late. I am thinking of analyzing the JSON parsers available to get an idea on how to proceed. Any help regarding this would be highly appreciated. Yours sincerely, Kushal K S V S

1 0

syslog-ng moving to its own organization on github
by Scheidler, Balázs 01 Apr '19

01 Apr '19

Hi, syslog-ng as an open source project has long been supported and sponsored by a company called Balabit (which I personally was the founder of), hence syslog-ng related online resources like the github project was published under github.com/balabit. Since Balabit was acquired last January by One Identity (www.oneidentity.com) going forward, the Balabit branding is not the right one for the syslog-ng project. Since the acquisition, all on-line syslog-ng presence was concentrated under the "syslog-ng" brand. An example for this is the website, which is now at www.syslog-ng.com. In a similar way, developer and open source related resources should follow suit. Our plan is to use "syslog-ng" everywhere where we were using "balabit". This includes github, dockerhub, gitter, slack, mailing list etc. We expect that the transition will take time, and that old links, chat rooms, docker images will work for a time yet, redirects will be there for those of us still using the old links. However it is a good idea to update bookmarks & git remotes that this will work on the long run. Over time, the name "Balabit" will fade a bit, at least within the syslog-ng community, but that's good. That's progress. Cheers, Bazsi founder of syslog-ng founder of Balabit

1 0

Redhat repo
by Faine, Mark R. (MSFC-IS40)[NICS] 01 Apr '19

01 Apr '19

I have a question about the Redhat repo for the unofficial OSE builds. It seems as though they are tied to a specific version. For example, I'm currently using czanik-syslog-ng318epel6, however, I see that 3.19 has a different repo specifically for that version. This seems to be counter to the point of yum repositories and it imposes an additional maintenance burden. Am I maybe not properly understanding how it works, and if not, is there a repo that tracks with the latest stable version? -Mark

6 9

Bind source IP using localip()?
by Scot 29 Mar '19

29 Mar '19

Is there a way to bind to a src IP when sending forwarding an event from syslog-ng ? We have an alias on the system and want to use that as the sending IP address for a forward. Tried the localip option which seems to pass conf check but ignored for destinations. Looked in the network and syslog driver documentation and didn't see anything obvious. syslog-ng 3 (3.14.1) Config version: 3.14 Installer-Version: 3.14.1 Revision: Compile-Date: Mar 14 2018 09:48:15 Module-Directory: //usr/lib64/syslog-ng Module-Path: //usr/lib64/syslog-ng Available-Modules: add-contextual-data,affile,afprog,afsocket,afstomp,afuser,basicfuncs,cef,confgen,cryptofuncs,csvparser,date,dbparser,disk-buffer,graphite,json-plugin,kvformat,linux-kmsg-format,pseudofile,sdjournal,syslogformat,system-source,afsmtp,geoip-plugin,mod-java,map-value-pairs,snmptrapd-parser,stardate,tfgetent,appmodel,tags-parser,xml,geoip2-plugin,afamqp Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: on Enable-Systemd: on

3 2

Convert if/else to nested log paths
by Faine, Mark R. (MSFC-IS40)[NICS] 27 Mar '19

27 Mar '19

What is the conversion of an if/else to embedded log path statements? I tried to do this today and didn't have any luck so I reverted back to if/else. I have a log statement with a series of if/else blocks: log { source(pan_splunk); if { filter { host("^[a-z]+\.foo.*$") or netmask('192.168.1.100/32') or netmask('192.168.1.101/32'); }; rewrite { set("foo" value("location")); }; } elif { filter { host("^[a-z]+\.bar.*$") or netmask('192.168.1.102/32') or netmask('192.168.1.103/32'); }; } else { rewrite { set("unknown" value("location")); }; } Can this be written with embedded log statements? The if/else blocks are working for me so this is just an academic exercise but I'd really like to understand how to do it with embedded log paths. Thanks, -Mark

2 2

Filtering out messages before any other action
by Faine, Mark R. (MSFC-IS40)[NICS] 27 Mar '19

27 Mar '19

I have the following as the first log path in my configuration, however, My understanding is that this should match any message with the text 'type=traffic' AND any of the listed policyid=## or a message with the text 'action=timeout'. Flags(final) indicates that it should not be further processed by any other log path. However, I'm still seeing messages that should be discarded, am I doing something wrong? log { if { filter { message('type=traffic') }; filter { ( message('policyid=35 ') or message('policyid=37 ') or message('policyid=38 ') or message('policyid=40_D ') or message('policyid=5 ') or message('policyid=10 ') or message('policyid=12 ') or message('policyid=50 ') or message('policyid=3 ') or message('action=timeout ') ) }; destination { file("/dev/null"); }; }; flags(final); }; Thanks, -Mark

2 2

syslog-ng.conf filter not working
by Lin, Victor 27 Mar '19

27 Mar '19

Dear All, I am trying to forwarding all cisco IOS and Nexus to remote server Here is from my syslog-ng.conf ********************* # Syslog collection for all devices source s_network { network( transport("udp") port(514) flags(syslog_protocol) keep_hostname(yes) keep_timestamp(yes) use_dns(no) use_fqdn(no) ); }; destination d_all_logs { file("/app/syslog-ng/My_custom/My_output/all_devices.log"); }; #All syslogs log { source(s_network); destination(d_all_logs); }; ***************************** #Cisco to elastic Mar.22.2019 destination d_cisco_logs { file("/app/syslog-ng/My_custom/My_output/cisco.log"); network("10.20.30.44" port(2514) transport(udp) spoof_source(yes)); }; ***************************************** #Cisco logs to elastic Mar.22.2019 log { source(s_network); filter(f_cisco_message); destination(d_cisco_logs); }; *********************************** #Cisco to elastic Mar.22.2019 filter f_cisco_message { match ("Cisco IOS", value ("MESSAGE")); or match ("Cisco Nexus", value ("MESSAGE")); }; But looks like cisco.log is never have any data inside. Below is from Could you please review my config and advice ? Thank you so much for your reply in advance! VL _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future.

2 1

Best way to manage apache's access logs
by Nik Ambrosch 26 Mar '19

26 Mar '19

How are people managing their apache access logs using syslog-ng these days - still just piping through logger? I'm looking to take over logging entirely using syslog-ng, not just reading files from disk and sending to ES or something. In the past I've used cronolog, which works fine, but I'd love the flexibility of sending the logs through syslog-ng.

3 4

Setting and using variables
by Faine, Mark R. (MSFC-IS40)[NICS] 25 Mar '19

25 Mar '19

Is there a way to set variables in syslog-ng? I have a log path with about 20 if/else branches and each one does a unnamed destination for that branch: log { source(pan_splunk); if ( tags('mytag') ) { destination { file("/var/log/remote/backup/$HOST/asa/${HOST}_asa.log" create-dirs(yes) dir-owner("splunk") dir-group("splunk") dir-perm(0750)); }; } elif ( message('something else') ) { destination { file("/var/log/remote/backup/$HOST/pubfw/${HOST}_pubfw.log" create-dirs(yes) dir-owner("splunk") dir-group("splunk") dir-perm(0750)); }; } elif { filter { message('foo') or message('bar') or message('baz') or ... I'd need to introduce another directory level as a variable and I'd also like to change an existing part of the path to a variable so that then I could then do something like this: if ( tags('mytag') ) { app = asa location = msfc elif ... and at the end I could then just do a single destination that had a file path with the variables file("/var/log/remote/backup/$location/$HOST/$app/${HOST}_$app.log" Thanks, -Mark

3 11

seems like program filter is broken
by Stanislav 22 Mar '19

22 Mar '19

Greetings, I'm getting this issue after my last package upgrade ====================================== Name : syslog-ng Version : 3.20.1 Installed on : Mon Mar 11 23:27:29 2019 EET Origin : sysutils/syslog-ng Architecture : FreeBSD:12:amd64 Prefix : /usr/local Categories : sysutils Licenses : Maintainer : cy(a)FreeBSD.org WWW : http://www.syslog-ng.org/ Comment : Powerful syslogd replacement Options : AMQP : off CURL : off DOCS : on GEOIP2 : off IPV6 : off JAVA : off JAVA_MOD : off JSON : on MONGO : off PYTHON : off REDIS : off RIEMANN : off SMTP : off SPOOF : off SQL : off TCP_WRAPPERS : off ====================================== I have following configuration: options { chain_hostnames(off); flush_lines(0); threaded(yes); create_dirs(yes); }; source local { internal(); unix-dgram( "/var/run/log" owner(root) group(wheel) perm(0666) ); unix-dgram( "/var/run/logpriv" owner(root) group(wheel) perm(0600) ); file( "/dev/klog" program_override("kernel") ); }; ... destination all { file("/var/log/all.log"); }; destination maillog_mda { file("/var/log/maillog-mda"); }; ... filter p_mail_imap { program("dovecot"); }; ... log { source(local); destination(all); }; log { source(local); filter(p_mail_imap); destination(maillog_mda); }; ====================================== # ps auxww|grep dovecot root 9648 0.0 0.1 13268 4196 - Is 00:46 0:00.04 /usr/local/sbin/dovecot -c /usr/local/etc/dovecot/dovecot.conf dovecot 9651 0.0 0.0 12724 3784 - I 00:46 0:00.01 anvil: [2 connections] (anvil) root 15259 0.0 0.0 12796 4168 - I 01:42 0:00.00 dovecot/log root 16126 0.0 0.1 13744 5020 - I 01:52 0:00.02 dovecot/config dovecot 16127 0.0 0.0 12724 4180 - I 01:52 0:00.01 stats: [3 connections] (stats) dovecot 17328 0.0 0.1 21284 12276 - I 02:05 0:00.01 auth: [0 wait, 0 passdb, 0 userdb] (auth) ====================================== # syslog-ng -s # echo $? 0 ====================================== I'm getting logs from dovecot program to /var/log/all.log but not /var/log/maillog-mda . As I mentioned before it was working on previous version of syslog-ng . Does anybody have this issue? Just me, lucky?

3 8

use loggen to insert content of a file into local log file
by Lin, Victor 19 Mar '19

19 Mar '19

Hello Fabien, Udp 5514 be listening by syslog-ng and write the info into /app/syslog-ng/output/AAA.log ****************************************************************** Here is from syslog-ng.conf source s_AAA_network { network( transport("udp") port(5514) flags(syslog_protocol) keep_hostname(yes) keep_timestamp(yes) use_dns(no) use_fqdn(no) tags("cppm") ); }; destination d_cppm_logs { file("/app/syslog-ng/output/AAA.log"); network("192.168.22. 39" port(5514) transport(udp) spoof_source(yes)); }; log { source(s_AAA_network); destination(d_AAA_Audit_logs); }; I can see both AAA.log and remote server 192.168.22. 39 can receive the syslog messages. ************************************************************************ When I run a test command below, I got the following output /app/syslog-ng/bin/loggen -D localhost 5514 "test test test" count=1864, rate = 963.75 msg/sec count=2348, rate = 967.19 msg/sec count=2830, rate = 963.87 msg/sec count=3314, rate = 967.87 msg/sec count=3796, rate = 963.87 msg/sec count=4280, rate = 967.41 msg/sec count=4762, rate = 963.75 msg/sec count=5246, rate = 967.87 msg/sec count=5728, rate = 963.87 msg/sec count=6212, rate = 967.87 msg/sec count=6694, rate = 963.71 msg/sec count=7177, rate = 965.46 msg/sec count=7660, rate = 965.70 msg/sec count=8142, rate = 963.74 msg/sec count=8626, rate = 967.71 msg/sec count=9108, rate = 963.85 msg/sec count=9590, rate = 963.84 msg/sec count=10074, rate = 966.30 msg/sec count=10554, rate = 959.80 msg/sec average rate = 1055.01 msg/sec, count=10554, time=10.0037, (average) msg size=256, bandwidth=263.75 kB/sec but I didn't see "test test test" been writen into /app/syslog-ng/output/AAA.log Do I using the correct format of loggen command? Thank you very much! VL -----Original Message----- From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: 2019, March, 07 7:00 AM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 167, Issue 15 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: use loggen to insert content of a file into local log file (Fabien Wernli) ---------------------------------------------------------------------- Message: 1 Date: Thu, 7 Mar 2019 09:03:34 +0100 From: Fabien Wernli <wernli(a)in2p3.fr> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] use loggen to insert content of a file into local log file Message-ID: <20190307080334.n3xc2q5nq2kfr7wv(a)ccfawe.in2p3.fr> Content-Type: text/plain; charset=iso-8859-1 On Wed, Mar 06, 2019 at 01:35:02PM +0000, Lin, Victor wrote: > Could anyone can give an example of using loggen to insert content of a file into a local log file ? you could use loggen to send to a specific port, on which syslog-ng would be listening, then create a log statement sendîng to that file, e.g. off the top of my head: log { source { syslog( port(1234) ); }; destination { file( '/tmp/loggen.log' ); }; }; loggen -D "blah blah blah" localhost 1234 ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng ------------------------------ End of syslog-ng Digest, Vol 167, Issue 15 ****************************************** _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future.

2 1

Insider 2019-03: syslog-ng 3.20.1; fail2ban; HTTP source; container tools; UDP; Conferences & Webinars
by Czanik, Péter 14 Mar '19

14 Mar '19

Dear syslog-ng users, This is the 73rd issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS syslog-ng 3.20.1 released ------------------------- Version 3.20.1 of syslog-ng was released. It adds persist-tool to manipulate persists files, a collectd destination, parsers for Netskope and Websense logs, and list support to JSON and XML. Naturally, bug fixes and many more changes were under the hood as well. There are some developer facing improvements, too, such as the fact that Python developers can now generate internal() log messages. For a complete list of changes with links to individual pull requests describing the changes in more detail, check https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.20.1 Documentation for most of the new features is now available online at https://www.syslog-ng.com/technical-documents/list/syslog-ng-open-source-ed… Visualizing Fail2ban logs in Kibana ----------------------------------- In his previous syslog-ng blog post, Balage wrote about how you can enrich Fail2ban logs with GeoIP metadata and other data parsed from the logs. In this post he will show you how you can use syslog-ng to send the logs into Elasticsearch and how visualizing Fail2ban logs in Kibana can show you where the failed login attempts come from. https://balagetech.com/visualizing-fail2ban-logs-in-kibana/ Creating an HTTP source for syslog-ng in Python ----------------------------------------------- HTTP is quickly becoming the universal transport protocol of the Internet. Nowadays even DNS over HTTPS implementations are available. There is no HTTP source implemented in C for syslog-ng, but starting with syslog-ng version 3.18, you can write new source drivers for syslog-ng in Python. While performance is not as good as it would be using C, you gain flexibility and ease of implementation by using Python. From this blog post you can learn how to create a basic HTTP source for syslog-ng in Python. https://www.syslog-ng.com/community/b/blog/posts/creating-an-http-source-fo… Building and running a syslog-ng container using the latest tools ----------------------------------------------------------- >From this blog you can learn the basics of skopeo, buildah and podman through the examples of a syslog-ng container. These tools come from Red Hat, replacing and extending functionality of the docker daemon without the need to run a “big fat daemon” on the hosts. The architectural redesign is closer to the UNIX philosophy and here is no single point of failure. https://www.syslog-ng.com/community/b/blog/posts/building-and-running-a-sys… Improved log collection over UDP -------------------------------- “I'd tell you the joke about UDP, but you might not get it.” This old joke perfectly summarizes UDP. There is no guarantee (frankly, not even a real effort) that data sent over UDP ever reaches the receiving end. Still, a surprisingly large number of syslog(-ng) users still keep using UDP as their transport protocol. The introduction of the so-reuseport() option for the UDP source in syslog-ng 3.19 is for those people who, for policy or other reasons, can not switch to TCP logging but still want to make UDP log reception as reliable as possible. https://www.syslog-ng.com/community/b/blog/posts/improved-log-collection-ov… CONFERENCES * DevOps Pro talk: Syslog-ng for DevOps: Customized Logging with Python ( https://devopspro.lt/peter-czanik/ ) WEBINARS You can watch our past webinars: * Got a Hungry Splunk? Feed it Smartly with syslog-ng: https://www.brighttalk.com/webcast/16207/350610 Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Trigger dynamic action in syslog-ng
by Jim Hendrick 08 Mar '19

08 Mar '19

I was wondering if anyone has used syslog-ng to trigger some dynamic action based on logs. For example, if a certain threshold of messages happens in a time window, send an alert. LIke suppress () but more general actions. Or if a specific event happens, send *.debug from that system for 5 minutes. Or run a program to collect system data and send it along based on some condition. Not thinking SIEM functionality here, but maybe allow the log servers to be more dynamic around what actions they take for basic things. Thoughts? Thanks. Jim

3 3

Problems parsing Cisco syslogs
by N. Max Pierson 08 Mar '19

08 Mar '19

Hi List, I have been trying to get something in place that can parse syslogs from various Cisco devices. The message format is almost the same with a few exceptions. Here is what I have tried and it works but now it has created another problem I do not know how to troubleshoot. So that I could see exactly what was being parsed, I disabled the default parsing using the below. source s_network { udp(ip(0.0.0.0) port(514) flags(no-parse)); }; rewrite r_cisco{ subst('^<\d+>(\d+:|:)\s+(\.\w+|\w+)\s+\d+\s+\d+\s\d+:\d+:\d+:\s|^<\d+>:\s+\d+\s+\w+\s+\d+\s+\d+:\d+:\d+\s\w+:\s|^<\d+>(\d+:|:)\s', "", value("MESSAGE"), type("pcre"), flags("ignore-case")); }; destination d_mysql { sql(type(mysql) host("127.0.0.1") username("syslog-ng") password("password") database("syslog") table("messages_${HOST}") columns("datetime datetime", "host varchar(50)", "level varchar(10)", "message text") values("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "${HOST}", "${LEVEL}", "${MESSAGE}") indexes("datetime", "level") ); }; log { source(s_network); rewrite(r_cisco); destination(d_mysql); }; This works perfectly as it formats the message as I want and covers IOS and NX-OS devices. The problem is when I turned off the default parser, now all of my logs show "notice" in the $LEVEL macro and doesn't reflect the real message header level. The $HOST macro still works fine however. Is this the expected behavior that the message header fields are not parsed as well as the $MESSAGE itself not being parsed? How can map the header level field properly to the $LEVEL marco if I disable the default parser? Regards, Max

7 20

use loggen to insert content of a file into local log file
by Lin, Victor 07 Mar '19

07 Mar '19

Dear All, Could anyone can give an example of using loggen to insert content of a file into a local log file ? Thank you very much for you great help! VL _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future.

2 1

replacing log statements
by Sergey 06 Mar '19

06 Mar '19

Hello. "allow-config-dups" allow to replace some objects. As I understand log objects cann't have identifier and cann't be replaced therefore. Is it true or I wrong? It would be nice to be able to replace log object also. -- Regards, Sergey

4 5

Check if field in message and use default if not.
by Ronald Fenner 05 Mar '19

05 Mar '19

I generate a Kafka topic to send the message to by doing: topic("${topic}.${environment}") What I'd like to do if the field wasn't in the json message to provide a default value. Im looking for like a tertiary operator to use In the topic or perhaps a rewrite rule. I see the conditional expressions but from the docs it doesn't look like I can use it in the topic or a rewrite rule NOTE: My messages are json stings that get parsed and then imploded back to json as it's sent. Thanks Ronald Fenner Network Architect Game Circus LLC. rfenner(a)gamecircus.com

3 4

RFC 3195
by venkateswarlu vinjamuri 04 Mar '19

04 Mar '19

Hi All, I would like to know if there is any syslog-ng version that supports RFC-3195. If so, please let me know the version and any config related changes. Please also provide the links for the same. Regards Venkat

2 1

How to use regex in syslog-ng.conf
by Lin, Victor 04 Mar '19

04 Mar '19

Thanks a lot Kokan!!!!! I got the result :-) One more question For the following two %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.94.200.210@pts/0:syslogtest:deleted user victor %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.94.201.173@pts/0:syslogtest:added user victor I try to use the following regex to match the text in red color, it shows works. AAA-6-AAA_ACCOUNTING_MESSAGE: [a-zA-Z0-9]+:[0-9.]+@[a-zA-Z0-9]+\/[a-zA-Z0-9]+:[a-zA-Z0-9]+:[a-zA-Z]+ user Is there a simple way to math " update:10.94.200.210@pts/0:syslogtest:" Thank you very much again‼‼! VL -----Original Message----- From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: 2019, March, 01 7:00 AM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 167, Issue 1 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu<mailto:syslog-ng@lists.balabit.hu> To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu<mailto:syslog-ng-request@lists.balabit.hu> You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu<mailto:syslog-ng-owner@lists.balabit.hu> When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. unofficial syslog-ng 3.20 packages for Debian/Ubuntu (Laszlo Budai) 2. Re: How to use regex in syslog-ng.conf (Péter) 3. Re: How to use regex in syslog-ng.conf (Fabien Wernli) ---------------------------------------------------------------------- Message: 1 Date: Fri, 1 Mar 2019 10:09:03 +0000 From: Laszlo Budai <laszlo.budai(a)outlook.com<mailto:laszlo.budai@outlook.com>> To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu<mailto:syslog-ng@lists.balabit.hu>> Subject: [syslog-ng] unofficial syslog-ng 3.20 packages for Debian/Ubuntu Message-ID: <VI1PR0601MB2237CC24E8908466F6ABC1B38E760(a)VI1PR0601MB2237.eurprd06.prod.outlook.com<mailto:VI1PR0601MB2237CC24E8908466F6ABC1B38E760@VI1PR0601MB2237.eurprd06.prod.outlook.com>> Content-Type: text/plain; charset="iso-8859-1" Hi, syslog-ng 3.20.1[1] packages are available in OBS repo[2]. List of supported OSs: * Debian 8.0 * Debian 9.0 [including armv7l] * Ubuntu 14.04 * Ubuntu 16.04 * Ubuntu 16.10 * Ubuntu 17.04 * Ubuntu 17.10 * Ubuntu 18.04 * Ubuntu 18.10 Install ------- example: Debian 9.0 1. get release key wget -qO - http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… | sudo apt-key add - 2. add repo to APT sources eg.: /etc/apt/sources.list.d/syslog-ng-obs.list deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… ./ Then `apt-get update` and `apt-get install syslog-ng-core` Links -------- [1] https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.20.1 [2] https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-… regards, Laszlo Budai -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190301/2e2934b4/a…> ------------------------------ Message: 2 Date: Fri, 1 Mar 2019 11:34:00 +0100 From: Péter, Kókai <peter.kokai(a)oneidentity.com<mailto:peter.kokai@oneidentity.com>> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu<mailto:syslog-ng@lists.balabit.hu>> Subject: Re: [syslog-ng] How to use regex in syslog-ng.conf Message-ID: <CABxQCpjDdn3JSwA1btkF7GZGLX_De0qGq+i9GtOcz8JWjhgpzA(a)mail.gmail.com<mailto:CABxQCpjDdn3JSwA1btkF7GZGLX_De0qGq+i9GtOcz8JWjhgpzA@mail.gmail.com>> Content-Type: text/plain; charset="utf-8" Hello, Based on your example one possible solution could be: match("cmd=username [a-z]+ privilege 15" value("MESSAGE")); You could also check out the syslog-ng administrator guide, it covers a lot of possibilities: https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edi… -- Kokan On Thu, Feb 28, 2019 at 3:50 PM Lin, Victor <victor.lin(a)rbc.com<mailto:victor.lin@rbc.com>> wrote: > Dear all, > > I am trying to use regex in syslog-ng.conf without success L > > Below is from my filter > > match("cmd=username toto privilege 15", value("MESSAGE")); > > could you please let me know how could I replace username toto with > regex ? tried /w+ , but didn’t passing through > > Thank you very much for your instruction! > > VL > > > > > ______________________________________________________________________ > _ > > If you received this email in error, please advise the sender (by > return email or otherwise) immediately. You have consented to receive > the attached electronically at the above-noted email address; please > retain a copy of this confirmation for future reference. > > Si vous recevez ce courriel par erreur, veuillez en aviser > l'expéditeur immédiatement, par retour de courriel ou par un autre > moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par > voie électronique à l'adresse courriel indiquée ci-dessus; veuillez > conserver une copie de cette confirmation pour les fins de reference future. > > > ______________________________________________________________________ > ________ Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190301/7921ceb3/a…> ------------------------------ Message: 3 Date: Fri, 1 Mar 2019 12:50:50 +0100 From: Fabien Wernli <wernli(a)in2p3.fr<mailto:wernli@in2p3.fr>> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu<mailto:syslog-ng@lists.balabit.hu>> Subject: Re: [syslog-ng] How to use regex in syslog-ng.conf Message-ID: <20190301115050.hs3d5vjf27a7lwfe(a)ccfawe.in2p3.fr<mailto:20190301115050.hs3d5vjf27a7lwfe@ccfawe.in2p3.fr>> Content-Type: text/plain; charset="iso-8859-1" On Fri, Mar 01, 2019 at 11:34:00AM +0100, Péter, Kókai wrote: > Hello, > > Based on your example one possible solution could be: > match("cmd=username [a-z]+ privilege 15" value("MESSAGE")); > > You could also check out the syslog-ng administrator guide, it covers > a lot of possibilities: > https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-sourc > e-edition/3.20/administration-guide/63#TOPIC-1122022 also, prefer single quotes over double quotes: will make escaping easier -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 2801 bytes Desc: not available URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190301/21433a6a/a…> ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu<mailto:syslog-ng@lists.balabit.hu> https://lists.balabit.hu/mailman/listinfo/syslog-ng ------------------------------ End of syslog-ng Digest, Vol 167, Issue 1 ***************************************** _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future.

2 1

How to send test syslog message to a local log file
by Lin, Victor 04 Mar '19

04 Mar '19

Dear All, Could you please let me know can I do this? Would like to insert the following test syslog messages Feb 5 10:16:03 10.2.3.4 2019 Feb 5 15:16:03.560 UTC: %AUTHPRIV-5-SYSTEM_MSG: New user added with username victor - securityd Feb 5 10:16:03 10.2.3.4 2019 Feb 5 15:16:03.561 UTC: %AAA-6-AAA_ACCOUNTING_MESSAGE: update:10.24.3.46@pts/0:syslogtest:added user victor Feb 5 10:16:03 10.2.3.4 2019 Feb 5 15:16:03.561 UTC: %TACACS-6-TACACS_ACCOUNTING_MESSAGE: update: 10.24.3.46@pts/0: syslogtest: added user victor to a local log file /MyApp/syslog-ng/output/test.log Thank you so much for your help! VL _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future.

2 1

3.19.1 and "make check"
by Sergey 03 Mar '19

03 Mar '19

Hello. How can I use unit tests when building? As I see $ ./configure --help | grep "unit test" --enable-valgrind Whether to enable Valgrind on the unit tests I should enable "valgrind". Ok, I attempt to do it but it unsuccesful. valgrind is detected: checking whether to enable Valgrind on the unit tests... checking for valgrind... valgrind yes checking for Valgrind tool memcheck... memcheck checking for Valgrind tool helgrind... helgrind checking for Valgrind tool drd... drd checking for Valgrind tool exp-sgcheck... exp-sgcheck but isn't used: Test dependencies: Criterion : no Unit tests : no And expected: $ make check Makefile:21717: *** "Unit tests disabled". Stop. Or is availability of Criterion a necessary condition also ? btw, what is the "Criterion"? Is it https://github.com/Snaipe/Criterion ? -- Regards, Sergey

2 1

How to add a keyword into syslog
by Lin, Victor 03 Mar '19

03 Mar '19

Dear All, I would like to add the sources of syslog (for example CiscoIOS, CiscoNXOS, Arista) when I forward the received syslog to remote server, Could you please let me know how to do it? Below is from my current syslog-ng.conf destination d_Arista_logs { file("/MyApp/syslog-ng/output/Arista.log"); network("10.2.234.21" port(514) transport(udp) spoof_source(yes)); }; VL _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future.

1 0

How to use regex in syslog-ng.conf
by Lin, Victor 01 Mar '19

01 Mar '19

Dear all, I am trying to use regex in syslog-ng.conf without success :( Below is from my filter match("cmd=username toto privilege 15", value("MESSAGE")); could you please let me know how could I replace username toto with regex ? tried /w+ , but didn't passing through Thank you very much for your instruction! VL _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future.

3 2

unofficial syslog-ng 3.20 packages for Debian/Ubuntu
by Laszlo Budai 01 Mar '19

01 Mar '19

Hi, syslog-ng 3.20.1[1] packages are available in OBS repo[2]. List of supported OSs: * Debian 8.0 * Debian 9.0 [including armv7l] * Ubuntu 14.04 * Ubuntu 16.04 * Ubuntu 16.10 * Ubuntu 17.04 * Ubuntu 17.10 * Ubuntu 18.04 * Ubuntu 18.10 Install ------- example: Debian 9.0 1. get release key wget -qO - http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… | sudo apt-key add - 2. add repo to APT sources eg.: /etc/apt/sources.list.d/syslog-ng-obs.list deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… ./ Then `apt-get update` and `apt-get install syslog-ng-core` Links -------- [1] https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.20.1 [2] https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-… regards, Laszlo Budai

1 0

OSE 3.20.1
by Szakacs, Attila 28 Feb '19

28 Feb '19

3.20.1Features - Add persist-tool (#2511 <https://github.com/balabit/syslog-ng/pull/2511>) - Collectd destination (#1433 <https://github.com/balabit/syslog-ng/pull/1433>) - Config reload status feedback (#2367 <https://github.com/balabit/syslog-ng/pull/2367>) - Netskope parser (#2541 <https://github.com/balabit/syslog-ng/pull/2541> ) - Websense parser (#2471 <https://github.com/balabit/syslog-ng/pull/2471> ) - Json list support (#2536 <https://github.com/balabit/syslog-ng/pull/2536>) - Xml-parser: add list support (#2544 <https://github.com/balabit/syslog-ng/pull/2544>) Bugfixes - DNS memory leak/segfault fix (#2500 <https://github.com/balabit/syslog-ng/pull/2500>) - Elasticsearch2: fix bulk send for client-mode("http") (#2478 <https://github.com/balabit/syslog-ng/pull/2478>) - Few leak fix (#2563 <https://github.com/balabit/syslog-ng/pull/2563>) - Filter-re: ref/unref NVTable around regex eval (#2494 <https://github.com/balabit/syslog-ng/pull/2494>) - Fix allowing negative version number in config (#2548 <https://github.com/balabit/syslog-ng/pull/2548>) - Fix app-parser() per reload memory leak (#2469 <https://github.com/balabit/syslog-ng/pull/2469>) - Fix non-reliable disk-queue truncating problem on load (#2406 <https://github.com/balabit/syslog-ng/pull/2406>) - Fix threaded source/destination crash when reverting configuration ( #2555 <https://github.com/balabit/syslog-ng/pull/2555>) - Http: add missing free for self->body_template (#2558 <https://github.com/balabit/syslog-ng/pull/2558>) - Java, elasticsearch2, explicit unsupport for named templates (#2534 <https://github.com/balabit/syslog-ng/pull/2534>) - Loggen: parameter handling (#2477 <https://github.com/balabit/syslog-ng/pull/2477>) - Python-source: fix crash when posting from python thread (#2533 <https://github.com/balabit/syslog-ng/pull/2533>) - Read acknowledgments send by Riemann (#2523 <https://github.com/balabit/syslog-ng/pull/2523>) - Redis, Riemann: fix ref/unref-ing templates (#2514 <https://github.com/balabit/syslog-ng/pull/2514>, #2530 <https://github.com/balabit/syslog-ng/pull/2530>) - Syslog-ng@default: use pid file location on control socket (#2489 <https://github.com/balabit/syslog-ng/pull/2489>) - Threaded-dest: Fix integer overflow (#2512 <https://github.com/balabit/syslog-ng/pull/2512>) - Threaded-dest: make persist_name local (#2516 <https://github.com/balabit/syslog-ng/pull/2516>) - Xml/geoip2: make prefix optional (#2538 <https://github.com/balabit/syslog-ng/pull/2538>) Other changes - Autotools, cmake: add detection for pylint, nosetests (#2537 <https://github.com/balabit/syslog-ng/pull/2537>,#2564 <https://github.com/balabit/syslog-ng/pull/2564>) - Autotools: relaxing python dependency requirement (#2472 <https://github.com/balabit/syslog-ng/pull/2472>) - Cfg-parser: printing error positions in case of parse failure (#2455 <https://github.com/balabit/syslog-ng/pull/2455>) - Cmake: add missing detections (#2510 <https://github.com/balabit/syslog-ng/pull/2510>) - Collect-cov.sh: make coverage should work with lcov in bionic (#2515 <https://github.com/balabit/syslog-ng/pull/2515>) - Configure: fix "--with-docbook*" option usage (#2465 <https://github.com/balabit/syslog-ng/pull/2465>) - Custom LGTM.com query for detecting uses of gmtime that are not covered by a lock (#2413 <https://github.com/balabit/syslog-ng/pull/2413> ) - Fix static uClibc-ng support (#2501 <https://github.com/balabit/syslog-ng/pull/2501>) - Format non-literal fixes (#2567 <https://github.com/balabit/syslog-ng/pull/2567>) - Grammar: remove the pragma less include (#2550 <https://github.com/balabit/syslog-ng/pull/2550>) - Http-worker: refactor & fix curl_easy_getinfo error message (#2527 <https://github.com/balabit/syslog-ng/pull/2527>) - Lib/compat: replace strcasestr() implementation (#2482 <https://github.com/balabit/syslog-ng/pull/2482>) - Libtest: Adding stopwatch.h into libtest_HEADERS list (#2553 <https://github.com/balabit/syslog-ng/pull/2553>) - Packaging: fix the description of mod-examples (#2522 <https://github.com/balabit/syslog-ng/pull/2522>) - Python-debugger: fix macro completion (#2439 <https://github.com/balabit/syslog-ng/pull/2439>) - Python, java destination add already introduced retry (#2559 <https://github.com/balabit/syslog-ng/pull/2559>) - Remove elastic v1 support (#2554 <https://github.com/balabit/syslog-ng/pull/2554>) - Simplify libtest queue utils (#2556 <https://github.com/balabit/syslog-ng/pull/2556>) - Syslog-ng.8.xml: remove unneeded default-modules section (#2475 <https://github.com/balabit/syslog-ng/pull/2475>) - Travis: use the latest Bison version (macOS) (#2529 <https://github.com/balabit/syslog-ng/pull/2529>) - Various fixes for issues reported by LGTM (#2524 <https://github.com/balabit/syslog-ng/pull/2524>) Notes to the developers - Example-msg-generator: num option (#2565 <https://github.com/balabit/syslog-ng/pull/2565>) - Own grammar support in generator plugin (#2552 <https://github.com/balabit/syslog-ng/pull/2552>) - ProtoClient: provide process_in function to logwriter (#2468 <https://github.com/balabit/syslog-ng/pull/2468>) - Pytest_framework: eliminating __registered_instances, exposing SyslogNgCtl to user api (#2503 <https://github.com/balabit/syslog-ng/pull/2503>) - Pytest_framework: MessageReader: Explain the local context around python asserts (#2507 <https://github.com/balabit/syslog-ng/pull/2507>) - Pytest_framework: support for implicit groups in config.create_logpath (#2490 <https://github.com/balabit/syslog-ng/pull/2490>) - Pytest: Renaming pytest_framework to python_functional (#2542 <https://github.com/balabit/syslog-ng/pull/2542>) - Python-destination: send can return worker_insert_result_t, flush support (#2487 <https://github.com/balabit/syslog-ng/pull/2487>) - Python: internal() source exposed via syslogng.Logger (#2505 <https://github.com/balabit/syslog-ng/pull/2505>) - Remove unused submodules (#2525 <https://github.com/balabit/syslog-ng/pull/2525>) - Simpler names for WORKER_INSERT_RESULT_T in language bindings (#2506 <https://github.com/balabit/syslog-ng/pull/2506>) - Split xml-parser into xml-parser and xml-scanner (#2459 <https://github.com/balabit/syslog-ng/pull/2459>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Andrej Valek, Antal Nemes, Attila Szakacs, Balazs Scheidler, Bas van Schaik, Fᴀʙɪᴇɴ Wᴇʀɴʟɪ, Gabor Nagy, Laszlo Boszormenyi, Laszlo Budai, Lorand Muzamel, László Várady, Mehul Prajapati, Naveen Revanna, Peter Czanik, Peter Kokai, Romain Tartière, Stephen, Terez Nemes, Norbert Takács, Soubhik Chakraborty, NottyRu, Chris Packham. https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.20.1 Best regards, Attila Szakacs

1 0

Re: [syslog-ng] syslog-ng Digest, Vol 166, Issue 14
by Lin, Victor 27 Feb '19

27 Feb '19

Thanks a lot Kokan!!!!! After I put the individual name for each persist-name, no error any more :-). Have a great day! VL -----Original Message----- From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: 2019, February, 27 3:25 AM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 166, Issue 14 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: syslog-ng.conf error (Péter) ---------------------------------------------------------------------- Message: 1 Date: Wed, 27 Feb 2019 09:24:50 +0100 From: Péter, Kókai <peter.kokai(a)oneidentity.com> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] syslog-ng.conf error Message-ID: <CABxQCpj_YRnzzkskbCoi_CULFEuNskO=X1OpsKrQ0T=0V3crug(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Hello, In order to point out the exact location of issue, you have to share your configuration. If you do not want to share it, there is two hint to find it yourself: 1) The message "Error checking the uniqueness of the persist names, please override it with persist-name option. Shutting" actually truncated (possible by journalctl), and the full version should contain the location of the item that has conflicting persist-name. 2) About persist-name, syslog-ng uses a persist file to store some information (for example to keep data between restart/reload). Date is stored in that file via its key, those keys are generated based on the configuration item options (for file source it could be the path of the file, etc...), sometimes it could collide with other configured item and syslog-ng cannot resolve the name collition; but the user could with specifying the *persist-name* option, which override the default generated option. An example: source s { file("/tmp/file" persist-name("my-tmp-file") ); }; -- Kokan On Tue, Feb 26, 2019 at 9:57 PM Lin, Victor <victor.lin(a)rbc.com> wrote: > Dear all, > > I am a newbie for syslog-ng J, could you please help me to figure > out my issues with syslog-ng.conf ? > > After modified syslog-ng.conf by adding more source, destination and > filter, try to restart syslog-ng by /etc/init.d/syslog-ng restart > > Got the following error > ********************************************* > # */etc/init.d/syslog-ng restart* > Restarting syslog-ng (via systemctl): Job for syslog-ng.service > failed because the control process exited with error code. See > "systemctl status syslog-ng.service" and "journalctl -xe" for details. > [FAILED] > > **************************************** > # *systemctl status syslog-ng.service* â— syslog-ng.service - LSB: > start and stop syslog-NG daemon > Loaded: loaded (/etc/rc.d/init.d/syslog-ng; bad; vendor preset: > enabled > ) > Active: failed (Result: exit-code) since Tue 2019-02-26 15:17:04 > EST; 30s ago > Docs: man:systemd-sysv-generator(8) > Process: 53303 ExecStop=/etc/rc.d/init.d/syslog-ng stop > (code=exited, > status=0/SUCCESS) > Process: 292500 ExecReload=/etc/rc.d/init.d/syslog-ng reload > (code=exited, status=0/SUCCESS) > Process: 53320 ExecStart=/etc/rc.d/init.d/syslog-ng start > (code=exited, > status=1/FAILURE) > Main PID: 116276 > > Feb 26 15:17:04 ABCD.com syslog-ng[53320]: > [2019-02-26T15:17:04.083451] > WARNING: With use-dns(no), dns-cache() will be forced to 'no' too!; > Feb 26 15:17:04 ABCD.com syslog-ng[53320]: > [2019-02-26T15:17:04.083503] > WARNING: With use-dns(no), dns-cache() will be forced to 'no' too!; > Feb 26 15:17:04 ABCD.com syslog-ng[53320]: > [2019-02-26T15:17:04.083554] > WARNING: With use-dns(no), dns-cache() will be forced to 'no' too!; > Feb 26 15:17:04 ABCD.com syslog-ng[53320]: > [2019-02-26T15:17:04.250946] Error checking the uniqueness of the > persist names, please override it with persist-name op...conf:131:9' > Feb 26 15:17:04 ABCD.com syslog-ng[53320]: > [2019-02-26T15:17:04.250984] Error checking the uniqueness of the > persist names, please override it with persist-name op...conf:132:9' > Feb 26 15:17:04 ABCD.com syslog-ng[53320]: [FAILED] Feb 26 15:17:04 > ABCD.com systemd[1]: syslog-ng.service: control process exited, > code=exited status=1 Feb 26 15:17:04 ABCD.com systemd[1]: Failed to > start LSB: start and stop syslog-NG daemon. > Feb 26 15:17:04 ABCD.com systemd[1]: Unit syslog-ng.service entered > failed state. > Feb 26 15:17:04 ABCD.com systemd[1]: syslog-ng.service failed. > Hint: Some lines were ellipsized, use -l to show in full. > > > # *journalctl -xe* > Feb 26 15:05:28 ABCD.com puppet-agent[48945]: Could not send report: > getaddrinfo: No address associated with hostname Feb 26 15:09:40 > ABCD.com sshd[51578]: pam_sss(sshd:auth): authentication success; > logname= uid=0 euid=0 tty=ssh ruser= rhost= > m3vrb434.rbc1.royalbank.com user=VL51 Feb 26 15:09:40 ABCD.com > sshd[51578]: Accepted password for VL51 from > 10.94.201.168 port 62031 ssh2 > Feb 26 15:10:02 ABCD.com crond[51740]: pam_unix(crond:account): > password for user root will expire in 8 days Feb 26 15:10:02 ABCD.com > crond[51741]: pam_unix(crond:account): password for user root will > expire in 8 days Feb 26 15:10:02 ABCD.com crond[51740]: > pam_unix(crond:session): session opened for user root by (uid=0) Feb > 26 15:10:02 ABCD.com crond[51741]: pam_unix(crond:session): session > opened for user root by (uid=0) Feb 26 15:10:02 ABCD.com CROND[51743]: > (root) CMD (/usr/lib64/sa/sa1 1 1) Feb 26 15:10:02 ABCD.com > CROND[51742]: (root) CMD (/bin/printf > '\n******************************************************************* > ****************\n\n > For filesize:' >> /app/ > Feb 26 15:10:02 ABCD.com CROND[51740]: pam_unix(crond:session): > session closed for user root Feb 26 15:10:02 ABCD.com sendmail[51759]: > x1QKA2Bw051759: from=root, size=1598, class=-60, nrcpts=1, msgid=< > *201902262010.x1QKA2Bw051759(a)ABCD.com* > <201902262010.x1QKA2Bw051759(a)ABCD.com>>, relay=root@localho Feb 26 > 15:10:02 ABCD.com sendmail[51759]: x1QKA2Bw051759: to=root, > ctladdr=root (0/0), delay=00:00:00, xdelay=00:00:00, mailer=relay, > pri=139598, relay=[127.0.0.1] [127.0.0.1], Feb 26 15:10:02 ABCD.com > CROND[51741]: pam_unix(crond:session): session closed for user root > Feb 26 15:10:50 ABCD.com sudo[51905]: VL51 : TTY=pts/0 ; > PWD=/app/syslog-ng/custom/conf ; USER=root ; COMMAND=/usr/bin/su - Feb > 26 15:10:50 ABCD.com su[51909]: (to root) VL51 on pts/0 Feb 26 > 15:10:50 ABCD.com su[51909]: pam_unix(su-l:session): session opened > for user root by VL51(uid=0) Feb 26 15:15:01 ABCD.com crond[52764]: > pam_unix(crond:account): password for user root will expire in 8 days > Feb 26 15:15:01 ABCD.com crond[52764]: pam_unix(crond:session): > session opened for user root by (uid=0) Feb 26 15:15:01 ABCD.com > CROND[52765]: (root) CMD (/usr/sbin/logrotate > /app/syslog-ng/custom/conf/syslog-ng-rotate.conf) > Feb 26 15:15:01 ABCD.com CROND[52764]: pam_unix(crond:session): > session closed for user root Feb 26 15:17:02 ABCD.com polkitd[1117]: > Registered Authentication Agent for unix-process:53295:2185270730 > (system bus name :1.268 [/usr/bin/pkttyagent --notify-fd 5 > --fallback], Feb 26 15:17:02 ABCD.com systemd[1]: Stopping LSB: start > and stop syslog-NG daemon... > -- Subject: Unit syslog-ng.service has begun shutting down > -- Defined-By: systemd > -- Support: > *http://lists.freedesktop.org/mailman/listinfo/systemd-devel* > <http://lists.freedesktop.org/mailman/listinfo/systemd-devel> > -- > -- Unit syslog-ng.service has begun shutting down. > Feb 26 15:17:02 ABCD.com supervise/syslog-ng[116275]: Daemon exited > gracefully, not restarting; exitcode='0' > Feb 26 15:17:03 ABCD.com syslog-ng[53303]: Stopping syslog-ng: [ OK > ] Feb 26 15:17:03 ABCD.com systemd[1]: Starting LSB: start and stop > syslog-NG daemon... > -- Subject: Unit syslog-ng.service has begun start-up > -- Defined-By: systemd > -- Support: > *http://lists.freedesktop.org/mailman/listinfo/systemd-devel* > <http://lists.freedesktop.org/mailman/listinfo/systemd-devel> > -- > -- Unit syslog-ng.service has begun starting up. > Feb 26 15:17:04 ABCD.com syslog-ng[53320]: Starting syslog-ng: > [2019-02-26T15:17:04.082875] WARNING: With use-dns(no), dns-cache() > will be forced to 'no' too!; Feb 26 15:17:04 ABCD.com > syslog-ng[53320]: [2019-02-26T15:17:04.083333] > WARNING: With use-dns(no), dns-cache() will be forced to 'no' too!; > Feb 26 15:17:04 ABCD.com syslog-ng[53320]: > [2019-02-26T15:17:04.083396] > WARNING: With use-dns(no), dns-cache() will be forced to 'no' too!; > Feb 26 15:17:04 ABCD.com syslog-ng[53320]: > [2019-02-26T15:17:04.083451] > WARNING: With use-dns(no), dns-cache() will be forced to 'no' too!; > Feb 26 15:17:04 ABCD.com syslog-ng[53320]: > [2019-02-26T15:17:04.083503] > WARNING: With use-dns(no), dns-cache() will be forced to 'no' too!; > Feb 26 15:17:04 ABCD.com syslog-ng[53320]: > [2019-02-26T15:17:04.083554] > WARNING: With use-dns(no), dns-cache() will be forced to 'no' too!; > Feb 26 15:17:04 ABCD.com syslog-ng[53320]: > [2019-02-26T15:17:04.250946] Error checking the uniqueness of the > persist names, please override it with persist-name option. Shutting > Feb 26 15:17:04 ABCD.com syslog-ng[53320]: > [2019-02-26T15:17:04.250984] Error checking the uniqueness of the > persist names, please override it with persist-name option. Shutting > Feb 26 15:17:04 ABCD.com syslog-ng[53320]: [FAILED] Feb 26 15:17:04 > ABCD.com systemd[1]: syslog-ng.service: control process exited, > code=exited status=1 Feb 26 15:17:04 ABCD.com systemd[1]: Failed to > start LSB: start and stop syslog-NG daemon. > -- Subject: Unit syslog-ng.service has failed > -- Defined-By: systemd > -- Support: > *http://lists.freedesktop.org/mailman/listinfo/systemd-devel* > <http://lists.freedesktop.org/mailman/listinfo/systemd-devel> > -- > -- Unit syslog-ng.service has failed. > -- > -- The result is failed. > Feb 26 15:17:04 ABCD.com systemd[1]: Unit syslog-ng.service entered > failed state. > Feb 26 15:17:04 ABCD.com systemd[1]: syslog-ng.service failed. > Feb 26 15:17:04 ABCD.com polkitd[1117]: Unregistered Authentication > Agent for unix-process:53295:2185270730 (system bus name :1.268, > object path /org/freedesktop/PolicyKit1/Auth Feb 26 15:20:01 ABCD.com > crond[53909]: pam_unix(crond:account): password for user root will > expire in 8 days Feb 26 15:20:01 ABCD.com crond[53908]: > pam_unix(crond:account): password for user root will expire in 8 days > Feb 26 15:20:01 ABCD.com crond[53909]: pam_unix(crond:session): > session opened for user root by (uid=0) Feb 26 15:20:01 ABCD.com > crond[53908]: pam_unix(crond:session): session opened for user root by > (uid=0) Feb 26 15:20:01 ABCD.com CROND[53910]: (root) CMD > (/usr/lib64/sa/sa1 1 1) Feb 26 15:20:01 ABCD.com CROND[53911]: (root) > CMD (/bin/printf > '\n******************************************************************* > ****************\n\n > For filesize:' >> /app/ > Feb 26 15:20:01 ABCD.com CROND[53908]: pam_unix(crond:session): > session closed for user root Feb 26 15:20:01 ABCD.com sendmail[53926]: > x1QKK1vA053926: from=root, size=1805, class=-60, nrcpts=1, msgid=< > *201902262020.x1QKK1vA053926(a)ABCD.com* > <201902262020.x1QKK1vA053926(a)ABCD.com>>, relay=root@localho Feb 26 > 15:20:01 ABCD.com sendmail[53926]: x1QKK1vA053926: to=root, > ctladdr=root (0/0), delay=00:00:00, xdelay=00:00:00, mailer=relay, > pri=139805, relay=[127.0.0.1] [127.0.0.1], Feb 26 15:20:01 ABCD.com > CROND[53909]: pam_unix(crond:session): session closed for user root > > > Thank you very much for your expertize and instruction!!!!! > > *VL* > > > > > > > ______________________________________________________________________ > _ > > If you received this email in error, please advise the sender (by > return email or otherwise) immediately. You have consented to receive > the attached electronically at the above-noted email address; please > retain a copy of this confirmation for future reference. > > Si vous recevez ce courriel par erreur, veuillez en aviser > l'expéditeur immédiatement, par retour de courriel ou par un autre > moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par > voie électronique à l'adresse courriel indiquée ci-dessus; veuillez > conserver une copie de cette confirmation pour les fins de reference future. > > > ______________________________________________________________________ > ________ Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190227/351df70d/a…> ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng ------------------------------ End of syslog-ng Digest, Vol 166, Issue 14 ****************************************** _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future.

1 0

syslog-ng.conf error
by Lin, Victor 27 Feb '19

27 Feb '19

Dear all, I am a newbie for syslog-ng :), could you please help me to figure out my issues with syslog-ng.conf ? After modified syslog-ng.conf by adding more source, destination and filter, try to restart syslog-ng by /etc/init.d/syslog-ng restart Got the following error ********************************************* # /etc/init.d/syslog-ng restart Restarting syslog-ng (via systemctl): Job for syslog-ng.service failed because the control process exited with error code. See "systemctl status syslog-ng.service" and "journalctl -xe" for details. [FAILED] **************************************** # systemctl status syslog-ng.service â- syslog-ng.service - LSB: start and stop syslog-NG daemon Loaded: loaded (/etc/rc.d/init.d/syslog-ng; bad; vendor preset: enabled) Active: failed (Result: exit-code) since Tue 2019-02-26 15:17:04 EST; 30s ago Docs: man:systemd-sysv-generator(8) Process: 53303 ExecStop=/etc/rc.d/init.d/syslog-ng stop (code=exited, status=0/SUCCESS) Process: 292500 ExecReload=/etc/rc.d/init.d/syslog-ng reload (code=exited, status=0/SUCCESS) Process: 53320 ExecStart=/etc/rc.d/init.d/syslog-ng start (code=exited, status=1/FAILURE) Main PID: 116276 Feb 26 15:17:04 ABCD.com syslog-ng[53320]: [2019-02-26T15:17:04.083451] WARNING: With use-dns(no), dns-cache() will be forced to 'no' too!; Feb 26 15:17:04 ABCD.com syslog-ng[53320]: [2019-02-26T15:17:04.083503] WARNING: With use-dns(no), dns-cache() will be forced to 'no' too!; Feb 26 15:17:04 ABCD.com syslog-ng[53320]: [2019-02-26T15:17:04.083554] WARNING: With use-dns(no), dns-cache() will be forced to 'no' too!; Feb 26 15:17:04 ABCD.com syslog-ng[53320]: [2019-02-26T15:17:04.250946] Error checking the uniqueness of the persist names, please override it with persist-name op...conf:131:9' Feb 26 15:17:04 ABCD.com syslog-ng[53320]: [2019-02-26T15:17:04.250984] Error checking the uniqueness of the persist names, please override it with persist-name op...conf:132:9' Feb 26 15:17:04 ABCD.com syslog-ng[53320]: [FAILED] Feb 26 15:17:04 ABCD.com systemd[1]: syslog-ng.service: control process exited, code=exited status=1 Feb 26 15:17:04 ABCD.com systemd[1]: Failed to start LSB: start and stop syslog-NG daemon. Feb 26 15:17:04 ABCD.com systemd[1]: Unit syslog-ng.service entered failed state. Feb 26 15:17:04 ABCD.com systemd[1]: syslog-ng.service failed. Hint: Some lines were ellipsized, use -l to show in full. # journalctl -xe Feb 26 15:05:28 ABCD.com puppet-agent[48945]: Could not send report: getaddrinfo: No address associated with hostname Feb 26 15:09:40 ABCD.com sshd[51578]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=m3vrb434.rbc1.royalbank.com user=VL51 Feb 26 15:09:40 ABCD.com sshd[51578]: Accepted password for VL51 from 10.94.201.168 port 62031 ssh2 Feb 26 15:10:02 ABCD.com crond[51740]: pam_unix(crond:account): password for user root will expire in 8 days Feb 26 15:10:02 ABCD.com crond[51741]: pam_unix(crond:account): password for user root will expire in 8 days Feb 26 15:10:02 ABCD.com crond[51740]: pam_unix(crond:session): session opened for user root by (uid=0) Feb 26 15:10:02 ABCD.com crond[51741]: pam_unix(crond:session): session opened for user root by (uid=0) Feb 26 15:10:02 ABCD.com CROND[51743]: (root) CMD (/usr/lib64/sa/sa1 1 1) Feb 26 15:10:02 ABCD.com CROND[51742]: (root) CMD (/bin/printf '\n***********************************************************************************\n\n For filesize:' >> /app/ Feb 26 15:10:02 ABCD.com CROND[51740]: pam_unix(crond:session): session closed for user root Feb 26 15:10:02 ABCD.com sendmail[51759]: x1QKA2Bw051759: from=root, size=1598, class=-60, nrcpts=1, msgid=<201902262010.x1QKA2Bw051759(a)ABCD.com<mailto:201902262010.x1QKA2Bw051759@ABCD.com>>, relay=root@localho Feb 26 15:10:02 ABCD.com sendmail[51759]: x1QKA2Bw051759: to=root, ctladdr=root (0/0), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=139598, relay=[127.0.0.1] [127.0.0.1], Feb 26 15:10:02 ABCD.com CROND[51741]: pam_unix(crond:session): session closed for user root Feb 26 15:10:50 ABCD.com sudo[51905]: VL51 : TTY=pts/0 ; PWD=/app/syslog-ng/custom/conf ; USER=root ; COMMAND=/usr/bin/su - Feb 26 15:10:50 ABCD.com su[51909]: (to root) VL51 on pts/0 Feb 26 15:10:50 ABCD.com su[51909]: pam_unix(su-l:session): session opened for user root by VL51(uid=0) Feb 26 15:15:01 ABCD.com crond[52764]: pam_unix(crond:account): password for user root will expire in 8 days Feb 26 15:15:01 ABCD.com crond[52764]: pam_unix(crond:session): session opened for user root by (uid=0) Feb 26 15:15:01 ABCD.com CROND[52765]: (root) CMD (/usr/sbin/logrotate /app/syslog-ng/custom/conf/syslog-ng-rotate.conf) Feb 26 15:15:01 ABCD.com CROND[52764]: pam_unix(crond:session): session closed for user root Feb 26 15:17:02 ABCD.com polkitd[1117]: Registered Authentication Agent for unix-process:53295:2185270730 (system bus name :1.268 [/usr/bin/pkttyagent --notify-fd 5 --fallback], Feb 26 15:17:02 ABCD.com systemd[1]: Stopping LSB: start and stop syslog-NG daemon... -- Subject: Unit syslog-ng.service has begun shutting down -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit syslog-ng.service has begun shutting down. Feb 26 15:17:02 ABCD.com supervise/syslog-ng[116275]: Daemon exited gracefully, not restarting; exitcode='0' Feb 26 15:17:03 ABCD.com syslog-ng[53303]: Stopping syslog-ng: [ OK ] Feb 26 15:17:03 ABCD.com systemd[1]: Starting LSB: start and stop syslog-NG daemon... -- Subject: Unit syslog-ng.service has begun start-up -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit syslog-ng.service has begun starting up. Feb 26 15:17:04 ABCD.com syslog-ng[53320]: Starting syslog-ng: [2019-02-26T15:17:04.082875] WARNING: With use-dns(no), dns-cache() will be forced to 'no' too!; Feb 26 15:17:04 ABCD.com syslog-ng[53320]: [2019-02-26T15:17:04.083333] WARNING: With use-dns(no), dns-cache() will be forced to 'no' too!; Feb 26 15:17:04 ABCD.com syslog-ng[53320]: [2019-02-26T15:17:04.083396] WARNING: With use-dns(no), dns-cache() will be forced to 'no' too!; Feb 26 15:17:04 ABCD.com syslog-ng[53320]: [2019-02-26T15:17:04.083451] WARNING: With use-dns(no), dns-cache() will be forced to 'no' too!; Feb 26 15:17:04 ABCD.com syslog-ng[53320]: [2019-02-26T15:17:04.083503] WARNING: With use-dns(no), dns-cache() will be forced to 'no' too!; Feb 26 15:17:04 ABCD.com syslog-ng[53320]: [2019-02-26T15:17:04.083554] WARNING: With use-dns(no), dns-cache() will be forced to 'no' too!; Feb 26 15:17:04 ABCD.com syslog-ng[53320]: [2019-02-26T15:17:04.250946] Error checking the uniqueness of the persist names, please override it with persist-name option. Shutting Feb 26 15:17:04 ABCD.com syslog-ng[53320]: [2019-02-26T15:17:04.250984] Error checking the uniqueness of the persist names, please override it with persist-name option. Shutting Feb 26 15:17:04 ABCD.com syslog-ng[53320]: [FAILED] Feb 26 15:17:04 ABCD.com systemd[1]: syslog-ng.service: control process exited, code=exited status=1 Feb 26 15:17:04 ABCD.com systemd[1]: Failed to start LSB: start and stop syslog-NG daemon. -- Subject: Unit syslog-ng.service has failed -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit syslog-ng.service has failed. -- -- The result is failed. Feb 26 15:17:04 ABCD.com systemd[1]: Unit syslog-ng.service entered failed state. Feb 26 15:17:04 ABCD.com systemd[1]: syslog-ng.service failed. Feb 26 15:17:04 ABCD.com polkitd[1117]: Unregistered Authentication Agent for unix-process:53295:2185270730 (system bus name :1.268, object path /org/freedesktop/PolicyKit1/Auth Feb 26 15:20:01 ABCD.com crond[53909]: pam_unix(crond:account): password for user root will expire in 8 days Feb 26 15:20:01 ABCD.com crond[53908]: pam_unix(crond:account): password for user root will expire in 8 days Feb 26 15:20:01 ABCD.com crond[53909]: pam_unix(crond:session): session opened for user root by (uid=0) Feb 26 15:20:01 ABCD.com crond[53908]: pam_unix(crond:session): session opened for user root by (uid=0) Feb 26 15:20:01 ABCD.com CROND[53910]: (root) CMD (/usr/lib64/sa/sa1 1 1) Feb 26 15:20:01 ABCD.com CROND[53911]: (root) CMD (/bin/printf '\n***********************************************************************************\n\n For filesize:' >> /app/ Feb 26 15:20:01 ABCD.com CROND[53908]: pam_unix(crond:session): session closed for user root Feb 26 15:20:01 ABCD.com sendmail[53926]: x1QKK1vA053926: from=root, size=1805, class=-60, nrcpts=1, msgid=<201902262020.x1QKK1vA053926(a)ABCD.com<mailto:201902262020.x1QKK1vA053926@ABCD.com>>, relay=root@localho Feb 26 15:20:01 ABCD.com sendmail[53926]: x1QKK1vA053926: to=root, ctladdr=root (0/0), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=139805, relay=[127.0.0.1] [127.0.0.1], Feb 26 15:20:01 ABCD.com CROND[53909]: pam_unix(crond:session): session closed for user root Thank you very much for your expertize and instruction!!!!! VL _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future.

2 1

Syslog-ng setup for both RFC3164 and RFC5124
by Carlan Philippe 27 Feb '19

27 Feb '19

Hi all, Is there a way to configure syslog-ng to process properly both RFC3164 and RFC5124 on the same listening port ? The scenario is a bunch of devices sending traffic to one syslog server port (both udp + tcp) with the senders typically not knowing what protocol they are sending. We are running syslog-ng 3.13 with this setup: source s_syslog { udp(ip(0.0.0.0) port(514)) ; tcp(ip(0.0.0.0) port(514)); } If needed we could upgrade syslog-ng to 3.19.1 but having checked the doc for 3.19, it seems that the solution would be to create 2 source entries, 1 for RFC3164 with network() and 1 for RFC5124 with syslog(). Neverthless, these 2 sources would have to listen on *different* ports and that is the problem for us. Note that we also have an identical issue with cisco traffic, since it's not RFC compliant, syslog-ng adds automatically a header with timestamp and hostname. Thank you.

4 3

Re: [syslog-ng] syslog-ng Digest, Vol 166, Issue 8
by Nathan Fish 25 Feb '19

25 Feb '19

Could you please clarify why the sources don't know what protocol they are sending? Are they relaying from other unknown sources? > Date: Sun, 24 Feb 2019 01:07:01 +0000 (UTC) > From: Carlan Philippe <philrmls(a)yahoo.fr> > To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> > Subject: [syslog-ng] Syslog-ng setup for both RFC3164 and RFC5124 > Message-ID: <1313969407.6661190.1550970421020(a)mail.yahoo.com> > Content-Type: text/plain; charset="utf-8" > > Hi all, > Is there a way to configure syslog-ng to process properly both RFC3164 and RFC5124 on the same listening port ? > The scenario is a bunch of devices sending traffic to one syslog server port (both udp + tcp) with the senders typically not knowing what protocol they are sending. > We are running syslog-ng 3.13 with this setup: > source s_syslog { udp(ip(0.0.0.0) port(514)) ; tcp(ip(0.0.0.0) port(514)); } > > If needed we could upgrade syslog-ng to 3.19.1 but having checked the doc for 3.19, it seems that the solution would be to create 2 source entries, 1 for RFC3164 with network() and 1 for RFC5124 with syslog(). Neverthless, these 2 sources would have to listen on *different* ports and that is the problem for us. > Note that we also have an identical issue with cisco traffic, since it's not RFC compliant, syslog-ng adds automatically a header with timestamp and hostname. > > Thank you.

2 1

Relay log message through Application LoadBalancer
by Ronald Fenner 23 Feb '19

23 Feb '19

I'm trying to figure out how to relay a message through an AWS Application Load Balancer. I have the config setup to relay the message with: destination d_kafka_unstructured { network( "<dns-name>" port(9082) );}; Look at the tcpdump log I can see that the message is relayed but the ALB doesn't know how to handle it and responds with 400 sinceing the message isn't a HTTP Request. What would be the best way to wrap the message in a http like request that the ALB will understand. Is there an easy way to just tell syslog-ng to relay the message as HTTP or would I need to write something to add/strip the HTTP wrapper. Ronald Fenner Network Architect Game Circus LLC. rfenner(a)gamecircus.com

3 3

Latest syslog-ng RPM needed for RHEL7
by Harish Shetty 22 Feb '19

22 Feb '19

Hi I am planning to upgrade my syslog servers to RHEL7 , I am able to see syslog-ng-3.19.1.tar.gz. Can i get RPM for the same Regards Harish Shetty

2 1

Regex Irregularities
by N. Max Pierson 13 Feb '19

13 Feb '19

Hi List, I am having some weird issues with rewrite regex that I cannot explain. I am simply trying to filter out the first part of the message which has the date in this format. Feb 8 09:13:32 CST: (there is one space at the end) When I use the following syntax, it doesn't match as expected. ^\w+\s\d+\s\d+:\d+:\d+\s\w+:\s I know this is the correct pattern because it works just fine on www.regexpal.com. I did some further testing and I have narrowed it down to the below ... ^\w+ 8 09:55:54 CST: (this seemed to also remove the space behind the month) ^\w+\s 8 09:59:37 CST: (notice this is the exact same as the above without the beginning space) ^\w+\s\d+ Feb 8 10:07:04 CST: (doesn't match anything as though the space between Feb and 8 isn't there) ^\w+\d+ Feb 8 10:11:54 CST: (again doesn't match anything as though there is a space between Feb and 8) So it seems to be something either with \w word class or the + quantifier and it somehow eats the space behind it possibly?? I am running 3.19.1 on Centos 7. Can anyone test this to confirm it isn't just local to my install for whatever reason? Regards, Max

3 3