- syslog-ng - lists.balabit.hu

CentOS EoL is near
by Peter Czanik (pczanik) 16 Nov '21

16 Nov '21

Hi, For many years CentOS Linux was the most popular platform to run syslog-ng. Unfortunately, CentOS 8 will be end of life by the end of the year: https://www.centos.org/centos-linux-eol/ I wonder if you already made the switch to something else, RHEL, one of the old or new RHEL clones, CentOS Stream or something completely different. Or are you still in the planning phase? Or completely unaware of the CentOS Linux EoL? I put together a poll on Twitter: https://twitter.com/PCzanik/status/1460610601848299525 and I would appreciate voting and retweets. And of course, I'm very interested in your experiences: where did you switch, why, how did it go. Either here on the mailing list, or directly to me if you do not want to share it publicly. Your answers help me to decide where should I put more effort while packaging and testing syslog-ng. And of course, also what OS should I use more often in my blogs. Previously the focus was CentOS with everything else appearing a lot less, now BSD variants and openSUSE also appear frequently. Thanks, Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng-3.35.1
by Attila Szakacs (aszakacs) 15 Nov '21

15 Nov '21

3.35.1 syslog-ng OSE APT repository >From now on, Ubuntu and Debian packages will be published with every syslog-ng release in the form of an APT repository. We, syslog-ng developers, provide these packages and the APT repository "as is" without warranty of any kind, on a best-effort level. Currently, syslog-ng packages are released for the following distribution versions (x86-64): * Debian: bullseye, buster, stretch, sid, testing * Ubuntu: Impish, Focal, Bionic, Xenial For instructions on how to install syslog-ng on Debian/Ubuntu distributions, see the README<https://github.com/syslog-ng/syslog-ng/blob/master/README.md#debianubuntu>. Highlights * throttle(): added a new filter that allows rate limiting messages based on arbitrary keys in each message. Note: messages over the rate limit are dropped (just like in any other filter). filter f_throttle { throttle( template("$HOST") rate(5000) ); }; (#3781<https://github.com/syslog-ng/syslog-ng/pull/3781>) * mqtt(): added a new source that can be used to receive messages using the MQTT protocol. Supported transports: tcp, ws, ssl, wss Example config: source { mqtt{ topic("sub1"), address("tcp://localhost:4445") }; }; (#3809<https://github.com/syslog-ng/syslog-ng/pull/3809>) Features * afsocket: Socket options, such as ip-ttl() or tcp-keepalive-time(), are traditionally named by their identifier defined in socket(7) and unix(7) man pages. This was not the case with the pass-unix-credentials() option, which - unlike other similar options - was also possible to set globally. A new option called so-passcred() is now introduced, which works similarly how other socket related options do, which also made possible a nice code cleanup in the related code sections. Of course the old name remains supported in compatibility modes. The PR also implements a new source flag ignore-aux-data, which causes syslog-ng not to propagate transport-level auxiliary information to log messages. Auxiliary information includes for example the pid/uid of the sending process in the case of UNIX based transports, OR the X.509 certificate information in case of SSL/TLS encrypted data streams. By setting flags(ignore-aux-data) one can improve performance at the cost of making this information unavailable in the log messages received through affected sources. (#3670<https://github.com/syslog-ng/syslog-ng/pull/3670>) * network: add support for PROXY header before TLS payload This new transport method called proxied-tls-passthrough is capable of detecting the PROXY header<http://www.haproxy.org/download/1.8/doc/proxy-protocol.txt> before the TLS payload. Loggen has been updated with the--proxied-tls-passthrough option for testing purposes. source s_proxied_tls_passthrough{ network( port(1234) transport("proxied-tls-passthrough"), tls( key-file("/path/to/server_key.pem"), cert-file("/path/to/server_cert.pem"), ca-dir("/path/to/ca/") ) ); }; (#3770<https://github.com/syslog-ng/syslog-ng/pull/3770>) * mqtt() destination: added client-id option. It specifies the unique client ID sent to the broker. (#3809<https://github.com/syslog-ng/syslog-ng/pull/3809>) Bugfixes * unset(), groupunset(): fix unwanted removal of values on different log paths Due to a copy-on-write bug, unset() and groupunset() not only removed values from the appropriate log paths, but from all the others where the same message went through. This has been fixed. (#3803<https://github.com/syslog-ng/syslog-ng/pull/3803>) * regexp-parser(): fix storing unnamed capture groups under prefix() (#3810<https://github.com/syslog-ng/syslog-ng/pull/3810>) * loggen: cannot detect plugins on platforms with non .so shared libs (osx) (#3832<https://github.com/syslog-ng/syslog-ng/pull/3832>) Packaging * debian/control: Added libcriterion-dev as a build dependency, where it is available from APT. (debian-bullseye, debian-testing, debian-sid) (#3794<https://github.com/syslog-ng/syslog-ng/pull/3794>) * centos-7: kafka and mqtt modules are now packaged. The following packages are used as dependencies: * librdkafka-devel from EPEL 7 * paho-c-devel from copr:copr.fedorainfracloud.org:czanik:syslog-ng-githead (#3797<https://github.com/syslog-ng/syslog-ng/pull/3797>) * debian: Added bullseye support. (#3794<https://github.com/syslog-ng/syslog-ng/pull/3794>) * bison: support build with bison 3.8 (#3784<https://github.com/syslog-ng/syslog-ng/pull/3784>) Notes to developers * dbld: As new distributions use python3 by default it makes sense to explicitly state older platforms which use python2 instead of the other way around, so it is not necessary to add that new platform to the python3 case. (#3780<https://github.com/syslog-ng/syslog-ng/pull/3780>) * dbld: move dbld image cache from DockerHub to GitHub In 2021, GitHub introduced the GitHub Packages service. Among other repositories - it provides a standard Docker registry. DBLD uses this registry, to avoid unnecessary rebuilding of the images. (#3782<https://github.com/syslog-ng/syslog-ng/pull/3782>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Antal Nemes, Attila Szakacs, Balazs Scheidler, Balázs Barkó, Benedek Cserhati, Colin Douch, Gabor Nagy, Laszlo Szemere, László Várady, Norbert Takacs, Parrag Szilárd, Peter Czanik (CzP), Peter Kokai, Robert Paschedag, Ryan Faircloth, Szilárd Parrag, Thomas Klausner, Zoltan Pallagi

1 0

Sequence – making PatternDB creation for syslog-ng easier
by Peter Czanik (pczanik) 09 Nov '21

09 Nov '21

Hi, I try not to spam the mailing list about each of my blogs separately. However, with all its problems I love sysog-ng's PatternDB technology for message parsing. Thanks to the hard work of Fabien Wernli and his colleagues, creating patterns for PatternDB just became a whole lot more easier! "We are well into the 21st century, but most of the log messages still arrive in an unstructured format. For well over a decade, syslog-ng had a solution to turn unstructured messages into name-value pairs, called PatternDB. However, creating a pattern database for PatternDB from scratch is a source of major pain. Or rather, it was: sequence-rtg – a fork of the sequence log analyzer – provides a new hope! It can easily create ready-to-use patterns for your most frequent log messages. Sequence-rtg is still in beta phase, and therefore is a bit rough around the edges. However, once you deal with the initial struggles of creating the database, it works just fine. Especially if you have lots of log messages. My experience was that the more log messages and larger batch sizes I had, the better quality patterns were generated." Read my blog at https://www.syslog-ng.com/community/b/blog/posts/sequence-making-patterndb-… Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Insider 2021-10: OpenSearch; udp-balancer(); mqtt() destination; process accounting;
by Peter Czanik (pczanik) 21 Oct '21

21 Oct '21

Dear syslog-ng users, This is the 95th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Elasticsearch 7.14 and OpenSearch 1.0 are available – and work fine with syslog-ng ------------------------ One of the most popular destinations in syslog-ng is Elasticsearch. Due to the license change of the Elastic stack, some people changed quickly to Grafana/Loki and other technologies. However, most syslog-ng users decided to wait and see. Version 1.0.0 of OpenSearch, a fork of the Elastic code base from before the license change is now available. Elastic also published a new release last week. For this blog, I tested the latest and greatest from both product lines and I’m sharing my experiences. For the impatient: both work perfectly well. https://www.syslog-ng.com/community/b/blog/posts/elasticsearch-7-14-and-ope… Using the udp-balancer() source of syslog-ng PE ----------------------------------------------- UDP-based log collection is so last century. We had TCP-based log collection for decades and TLS encryption to secure connections. Still, UDP is in wide use, especially at large companies and industrial automation, where every change is slow. In most cases, UDP logging is used by networking devices, but sometimes it is just left there from ancient times and people are reluctant to change it. In either case, at higher message rates it can lead to performance problems and thus to message loss. Originally, the udp() source of syslog-ng was single-threaded. That does not scale well with typical multi-core CPUs with slower cores. There are many tricks to enhance UDP performance in syslog-ng. Combining those with the udp-balancer() source of syslog-ng PE gives the most reliable solution. https://www.syslog-ng.com/community/b/blog/posts/using-the-udp-balancer-sou… Syslog-ng 3.33: the MQTT destination ------------------------------------ Version 3.33 of syslog-ng introduced an MQTT destination. It uses the paho-c client library to send log messages to an MQTT broker. The current implementation supports version 3.1 and 3.1.1 of the protocol over non-encrypted connections, but this is only a first step. From this blog, you can learn how to configure and test the mqtt() destination in syslog-ng. Note: syslog-ng 3.34 enhanced the mqtt() destination in many ways. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-3-33-the-mqtt-de… Collecting process accounting logs on Linux with syslog-ng ---------------------------------------------------------- Process accounting logs are collected into binary log files on Linux. You can turn them into human readable format locally, using various tools. You can also use syslog-ng to read those files. Syslog-ng can parse those binary logs, create name-value pairs from them and store the results. https://www.syslog-ng.com/community/b/blog/posts/collecting-process-account… WEBINARS * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng-stable updated
by Peter Czanik (pczanik) 29 Sep '21

29 Sep '21

Hi, My unofficial syslog-ng-stable repos are now updated to syslog-ng version 3.34. Along the way unsupported openSUSE releases were removed and new releases were added. Note, that if you use Kafka: librdkafka was updated from version 1.0 to 1.5. You can read more about the unofficial syslog-ng-stable repo at https://www.syslog-ng.com/community/b/blog/posts/introducing-the-syslog-ng-… Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Debian 11 repo
by Pal, Laszlo 27 Sep '21

27 Sep '21

Hi, One of my customers started to upgrade Debian 11. Is there any repo for this? Thx L:

2 1

LF Rhel8 Repo
by Pal, Laszlo 27 Sep '21

27 Sep '21

Hi, It seems Rhel8 repo a bit abandoned at https://copr-be.cloud.fedoraproject.org/results/czanik/syslog-ng-stable/. The latest version is 3.31. Is there any other alternative? Thx L:

3 2

Insider 2021-09: 3.34; OpenBSD; OpenSearch; http() destination;
by Peter Czanik (pczanik) 17 Sep '21

17 Sep '21

Dear syslog-ng users, This is the 94th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Version 3.34.1 available ------------------------ Version 3.34.1 of syslog-ng has been released with many interesting new features. There is now a new parser that can parse messages with regular expressions. The throughput of the Redis destination driver has increased drastically. TLS and WebSocket Secure support have been added to the MQTT destination. Performance of the disk-buffer has improved considerably. For a full list of changes and source code, check https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-3.34.1 Syslog-ng updated in OpenBSD ports ---------------------------------- Recently I have found that the number of syslog-ng users on OpenBSD is growing, even with an ancient syslog-ng version in OpenBSD ports that is unable to collect local log messages. Then I remembered that Todd Miller – maintainer of sudo, and my colleague at One Identity – is also an OpenBSD user and developer. I asked him for a little help, which turned out to be quite a lot in the end, but syslog-ng is now updated to the latest version in OpenBSD ports! https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-updated-in-openb… Opensearch and syslog-ng ------------------------ Opensearch is a fork of the Elastic stack code base, made right before the license change. The first release candidate (RC1) has been released recently. Next to plain text files, Elasticsearch is one of the most popular destinations in syslog-ng, but after the license change people started to look for alternatives. I did some quick tests and using the elasticsearch-http() destination, syslog-ng seems to work fine with Opensearch as well. You can learn from this blog how to get started with Opensearch, dashboards and syslog-ng. Another alternative that syslog-ng users explored is Grafana Loki. https://www.syslog-ng.com/community/b/blog/posts/opensearch-and-syslog-ng Creating a new http()-based syslog-ng destination: Seq ------------------------------------------------------ Recently, many services provide an HTTP-based API to send messages. With a bit of luck, the given service is already supported directly by syslog-ng, or by using the Apprise Python library from the syslog-ng Python destination. In other cases, you need to do the research yourself on how the given HTTP-based service works. It might be scary at first, but often, it just takes a bit of experimenting and reading the documentation. In this blog, I’m showing you how to send log messages to Seq, a container-based log management software for application logs. The focus of this blog is to understand what to look for in the documentation of software to create an http()-based destination in syslog-ng. You can install Seq in a container, it is easy, but not necessary. https://www.syslog-ng.com/community/b/blog/posts/creating-a-new-http--based… WEBINARS * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng on NetBSD
by Peter Czanik (pczanik) 14 Sep '21

14 Sep '21

Hi, I just published updated syslog-ng pkgsrc for NetBSD on GitHub for testing. From the README: " syslog-ng pkgsrc for testing Thanks to the syslog-ng team, syslog-ng now works fine on NetBSD. This is my attempt to update syslog-ng in pkgsrc from version 3.17 to 3.34. It works on my machine (AMD64, NetBSD 9.2), but before trying to submit it to pkgsrc I'd love to see, that it also works for others :-) Rename /usr/pkgsrc/sysutils/syslog-ng to something else, copy the syslog-ng directory from this repo to replace it. Now you are ready to compile syslog-ng. " It is available at: https://github.com/czanik/netbsd Any feedback is welcome! Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng-3.34.1
by Attila Szakacs (aszakacs) 14 Sep '21

14 Sep '21

3.34.1 Highlights * regexp-parser(): new parser that can parse messages with regular expressions Example: regexp-parser( template("${MESSAGE}") prefix(".regexp.") patterns("(?<DN>foo)", "(?<DN>ball)") ); regexp-parser() can be used as an intuitive replacement for regexp filters that had their store-matches flag set in order to save those matches. (#3702<https://github.com/syslog-ng/syslog-ng/pull/3702>) * redis(): workers() and batching support The Redis driver now support the workers() option, which specifies the number of parallel workers, and the batch-lines() option. This could drastically increase the throughput of the Redis destination driver. Example: redis( host("localhost") port(6379) command("HINCRBY", "hosts", "$HOST", "1") workers(8) batch-lines(100) batch-timeout(10000) log-fifo-size(100000) ); (#3732<https://github.com/syslog-ng/syslog-ng/pull/3732>, #3745<https://github.com/syslog-ng/syslog-ng/pull/3745>) * mqtt(): TLS and WebSocket Secure support The MQTT destination now supports TLS and WSS. Example config: mqtt( address("ssl://localhost:8883") topic("syslog/$HOST") fallback-topic("syslog/fallback") tls( ca-file("/path/to/ca.crt") key-file("/path/to/client.key") cert-file("/path/to/client.crt") peer-verify(yes) ) ); (#3747<https://github.com/syslog-ng/syslog-ng/pull/3747>) Features * system() source: added support for NetBSD (#3761<https://github.com/syslog-ng/syslog-ng/pull/3761>) * stats: new statistics counter The following statistics are now available for the HTTP destination, and other file and network based sources/destinations: * msg_size_max/msg_size_avg: Shows the largest/average message size of the given source/destination that has been measured so far. * batch_size_max/batch_size_avg: When batching is enabled, then this shows the largest/average batch size of the given source/destination that has been measured so far. * eps_last_1h, eps_last_24h, eps_since_start: Events per second, measured for the last hour, for the last 24 hours, and since syslog-ng startup, respectively. Notes: * Message sizes are calculated from the incoming raw message length on the source side, and from the outgoing formatted message length on the destination side. * EPS counters are just approximate values, they are updated every minute. (#3753<https://github.com/syslog-ng/syslog-ng/pull/3753>) * mqtt(): username/password authentication Example config: mqtt( address("tcp://localhost:1883") topic("syslog/messages") username("user") password("passwd") ); Note: The password is transmitted in cleartext without using ssl:// or wss://. (#3747<https://github.com/syslog-ng/syslog-ng/pull/3747>) * mqtt(): new option http-proxy() for specifying HTTP/HTTPS proxy for WebSocket connections (#3747<https://github.com/syslog-ng/syslog-ng/pull/3747>) * syslog-ng-ctl: new flag for pruning statistics syslog-ng-ctl stats --remove-orphans can be used to remove "orphaned" statistic counters. It is useful when, for example, a templated file destination ($YEAR.$MONTH.$DAY) produces a lot of stats, and one wants to remove those abandoned counters occasionally/conditionally. (#3760<https://github.com/syslog-ng/syslog-ng/pull/3760>) * disk-buffer(): added a new option to reliable disk-buffer: qout-size(). This option sets the number of messages that are stored in the memory in addition to storing them on disk. The default value is 1000. This serves performance purposes and offers the same no-message-loss guarantees as before. It can be used to maintain a higher throughput when only a small number of messages are waiting in the disk-buffer. (#3754<https://github.com/syslog-ng/syslog-ng/pull/3754>) Bugfixes * network(), syslog(): fixed network sources on NetBSD On NetBSD, TCP-based network sources closed their listeners shortly after startup due to a non-portable TCP keepalive setting. This has been fixed. (#3751<https://github.com/syslog-ng/syslog-ng/pull/3751>) * disk-buffer(): fixed a very rare case, where the reliable disk-buffer never resumed after triggering flow-control. (#3752<https://github.com/syslog-ng/syslog-ng/pull/3752>) * disk-buffer(): fixed a rare memory leak that occurred when mem-buf-length() or mem-buf-size() was configured incorrectly (#3750<https://github.com/syslog-ng/syslog-ng/pull/3750>) * redis(): fixed command errors that were not detected and marked as successful delivery (#3748<https://github.com/syslog-ng/syslog-ng/pull/3748>) Notes to developers * Light framework: new proxy-related options are supported with loggen: --proxy-src-ip, --proxy-dst-ip, --proxy-src-port, --proxy-dst-port (#3766<https://github.com/syslog-ng/syslog-ng/pull/3766>) * log-threaded-dest: descendant drivers from LogThreadedDest no longer inherit batch-lines() and batch-timeout() automatically. Each driver have to opt-in for these options with log_threaded_dest_driver_batch_option. log_threaded_dest_driver_option has been renamed to log_threaded_dest_driver_general_option, and log_threaded_dest_driver_workers_option have been added similarly to the batch-related options. (#3741<https://github.com/syslog-ng/syslog-ng/pull/3741>) Other changes * disk-buffer(): performance improvements Based on our measurements, the following can be expected compared to the previous syslog-ng release (v3.33.1): * non-reliable disk buffer: up to 50% performance gain; * reliable disk buffer: up to 80% increase in performance. (#3743<https://github.com/syslog-ng/syslog-ng/pull/3743>, #3746<https://github.com/syslog-ng/syslog-ng/pull/3746>, #3754<https://github.com/syslog-ng/syslog-ng/pull/3754>, #3756<https://github.com/syslog-ng/syslog-ng/pull/3756>, #3757<https://github.com/syslog-ng/syslog-ng/pull/3757>) * disk-buffer(): the default value of the following options has been changed for performance reasons: * truncate-size-ratio(): from 0.01 to 0.1 (from 1% to 10%) * qout-size(): from 64 to 1000 (this affects only the non-reliable disk buffer) (#3757<https://github.com/syslog-ng/syslog-ng/pull/3757>) * kafka-c(): properties-file() option is removed Please list librdkafka properties in the config() option in syslog-ng's configuration. See librdkafka configuration here<https://github.com/edenhill/librdkafka/blob/master/CONFIGURATION.md>. (#3704<https://github.com/syslog-ng/syslog-ng/pull/3704>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Attila Szakacs, Balazs Scheidler, Balázs Barkó, Benedek Cserhati, Fabrice Fontaine, Gabor Nagy, Laszlo Szemere, LittleFish33, László Várady, Norbert Takacs, Parrag Szilárd, Peter Czanik, Peter Kokai, Zoltan Pallagi

2 1

librdkafka config property error on startup
by Sanjay Patel 09 Sep '21

09 Sep '21

I am trying to use Kafka-c with Syslog-ng. I have version Kafka 3.31 of Kafka installed, and I have syslog-ng-mod-rdkafka installed. When I start Syslog-ng, I get the following error. I can't figure out where it is getting this setting from. Syslog starts, but it does not send any logs to Kafka. kafka: error setting librdkafka config property; name='topic.partitioner', value='murmur2_random', error='No such configuration property: My Kafka config looks as follows: @include "scl.conf" destination d_kafka { kafka-c( bootstrap-servers("10.254.164.15:9092") topic("incoming") ); }; log { source(s_network); destination(d_kafka); }; Any help will be deeply appreciated. SKP <https://t.sidekickopen07.com/s3t/o/5/f18dQhb0S7n28cFBYDW5xwfpz2zGCvGW40Fv_6 2SXRqbW4NBnl23Lrg1WW5vbH2n1cd60nf197v5Y04?si=7000000000968799&pi=6743fafd-f6 76-41ef-ba50-d690c0278659>

3 3

Re: [syslog-ng] FW: Resource temporarily unavailable while reading from system.journal
by Alexandre Santos 02 Sep '21

02 Sep '21

Hi Laszlo, I am running a debian10 with syslog-ng 3.32. If using the default syslog-ng configuration for Debian 10, the error is reproducible. It happened to me when stimulating the syslog-ng using logger command. Sorry for the delay in reply. Thanks and regards, Alex On Wed, Aug 18, 2021 at 9:39 AM Alexandre Santos <ASantos(a)infinera.com> wrote: > > > > > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> * On Behalf Of *Laszlo > Szemere (lszemere) > *Sent:* 17 de agosto de 2021 15:20 > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Resource temporarily unavailable while reading > from system.journal > > > > Hello Alex, > > > > sorry for not responding sooner. > > > > From my experience, the most common reasons behind this error messages are: > > > > 1) Syslog-ng do not have the proper permissions to read /dev/log > > 2) /dev/log is already opened by an another process. (Maybe Syslog-ng > started multiple times.) > > > > > > If the problem still exists, please share the details of your platform and > I will try to reproduce your problem with the attached configuration. > > > > > > Best regards, > > Laszlo > > > ------------------------------ > > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Alexandre Santos <alexandre.rosas.santos(a)gmail.com> > *Sent:* Thursday, August 12, 2021 15:40 > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* [syslog-ng] Resource temporarily unavailable while reading > from system.journal > > > > Hi, > > > > I am seeing the following strace log when running the syslog-ng 3.32 with > the configuration in the attachment: > > root@myhost:/home/shared# sudo strace -f -yyy -s 256 -e trace=read -p 2539 > strace: Process 2539 attached with 4 threads > [pid 2539] read(48<anon_inode:[timerfd]>, "\1\0\0\0\0\0\0\0", 8) = 8 > [pid 2539] read(11<anon_inode:inotify>, > "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 > [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN > (Resource temporarily unavailable) > [pid 2539] read(11<anon_inode:inotify>, > "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 > [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN > (Resource temporarily unavailable) > [pid 2539] read(11<anon_inode:inotify>, > "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 > [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN > (Resource temporarily unavailable) > [pid 2539] read(11<anon_inode:inotify>, > "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 > [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN > (Resource temporarily unavailable) > [pid 2539] read(11<anon_inode:inotify>, > "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 > [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN > (Resource temporarily unavailable) > [pid 2539] read(11<anon_inode:inotify>, > "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 > [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN > (Resource temporarily unavailable) > [pid 2539] read(11<anon_inode:inotify>, > "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 > [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN > (Resource temporarily unavailable) > [pid 2539] read(11<anon_inode:inotify>, > "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 > [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN > (Resource temporarily unavailable) > [pid 2539] read(11<anon_inode:inotify>, > "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 > [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN > (Resource temporarily unavailable) > ^Cstrace: Process 2539 detached > strace: Process 11623 detached > strace: Process 20518 detached > strace: Process 22517 detached > > > > This normal behaviour? > > > > Thanks & Regards, > > Alex >

1 0

FW: librdkafka config property error on startup
by Sanjay Patel 02 Sep '21

02 Sep '21

I am trying to use Kafka-c with Syslog-ng. I have version Kafka 3.31 of Kafka installed, and I have syslog-ng-mod-rdkafka installed. When I start Syslog-ng, I get the following error. I can't figure out where it is getting this setting from. Syslog starts, but it does not send any logs to Kafka. kafka: error setting librdkafka config property; name='topic.partitioner', value='murmur2_random', error='No such configuration property: My Kafka config looks as follows: @include "scl.conf" destination d_kafka { kafka-c( bootstrap-servers("10.254.164.15:9092") topic("incoming") ); }; log { source(s_network); destination(d_kafka); }; Any help will be deeply appreciated. SKP <https://t.sidekickopen07.com/s3t/o/5/f18dQhb0S7n28cFBYDW5xwfpz2zGCvGW40Fv_6 2SXRqbW4NBnl23Lrg1WW5vbH2n1cd60nf197v5Y04?si=7000000000968799&pi=e03e7148-99 d8-470a-8205-9df1e2d92622>

1 0

No remote logging
by Alexandre Santos 01 Sep '21

01 Sep '21

Hi, I tying to do some remote logging from a Debian10 with syslog-ng 3.19. I have 2 syslog-ng's running, one in the default VRF which receives the logs from the applications, and another syslog-ng in an EXTERNAL VRF which send the logs to log-servers. The default VRF sends the logs to the EXTERNAL VRF via a unix domain. The problem is that sometimes is not streaming anything to remote log servers after configuring it. I have to restart the syslog-ng processes to start the remote logging. Local logging is working fine. Have you come across this issue before? Thanks and Regards, Alex

1 0

Resource temporarily unavailable while reading from system.journal
by Alexandre Santos 17 Aug '21

17 Aug '21

Hi, I am seeing the following strace log when running the syslog-ng 3.32 with the configuration in the attachment: root@myhost:/home/shared# sudo strace -f -yyy -s 256 -e trace=read -p 2539 strace: Process 2539 attached with 4 threads [pid 2539] read(48<anon_inode:[timerfd]>, "\1\0\0\0\0\0\0\0", 8) = 8 [pid 2539] read(11<anon_inode:inotify>, "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN (Resource temporarily unavailable) [pid 2539] read(11<anon_inode:inotify>, "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN (Resource temporarily unavailable) [pid 2539] read(11<anon_inode:inotify>, "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN (Resource temporarily unavailable) [pid 2539] read(11<anon_inode:inotify>, "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN (Resource temporarily unavailable) [pid 2539] read(11<anon_inode:inotify>, "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN (Resource temporarily unavailable) [pid 2539] read(11<anon_inode:inotify>, "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN (Resource temporarily unavailable) [pid 2539] read(11<anon_inode:inotify>, "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN (Resource temporarily unavailable) [pid 2539] read(11<anon_inode:inotify>, "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN (Resource temporarily unavailable) [pid 2539] read(11<anon_inode:inotify>, "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN (Resource temporarily unavailable) ^Cstrace: Process 2539 detached strace: Process 11623 detached strace: Process 20518 detached strace: Process 22517 detached This normal behaviour? Thanks & Regards, Alex

2 1

syslong-ng-ctl stats
by Faine, Mark R. (MSFC-IS40)[NICS] 16 Aug '21

16 Aug '21

Can syslog-ng-ctl stats show me the not just the number of messages processed but size transferred and/or on disk? Thanks, -Mark

2 1

Re: [syslog-ng] syslog-ng Digest, Vol 195, Issue 9
by Linn, William 23 Jul '21

23 Jul '21

Laci, Thanks for your response, I figured out my problem. Thanks again -----Original Message----- From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: Friday, July 23, 2021 4:08 AM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 195, Issue 9 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://urldefense.com/v3/__https://lists.balabit.hu/mailman/listinfo/syslo… or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: syslog-ng Digest, Vol 195, Issue 7 (Laszlo Szemere (lszemere)) ---------------------------------------------------------------------- Message: 1 Date: Fri, 23 Jul 2021 08:08:10 +0000 From: "Laszlo Szemere (lszemere)" <Laszlo.Szemere(a)oneidentity.com> To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] syslog-ng Digest, Vol 195, Issue 7 Message-ID: <DM6PR19MB346532CA52F4D51920BFFC529DE59(a)DM6PR19MB3465.namprd19.prod.outlook.com> Content-Type: text/plain; charset="iso-8859-1" Hello Linn, I am sorry, but I haven't noticed your message before. (My email client mixed it because of the subject.) Could you please elaborate on the statement "fails to work"? What are the symptoms? Syslog-ng fails to start, or it is working differently than what you expect? Starting Syslog-ng with debugging enabled, might help to pinpoint the problem. ./syslog-ng -Fdevt -F, --foreground Do not go into the background after initialization -v, --verbose Be a bit more verbose -d, --debug Enable debug messages -t, --trace Enable trace messages -e, --stderr Log messages to stderr Best regards, Laci ________________________________ From: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of Linn, William <wlinn(a)bofa.com> Sent: Tuesday, July 20, 2021 16:08 To: syslog-ng(a)lists.balabit.hu <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] syslog-ng Digest, Vol 195, Issue 7 CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe. I am having issues with a previous configuration set up in 2012. How to re-write it to work, here is the configuration that fails to work. destination d_apps { file("/syslog-ng/app/${HOST}/${HOST}-application.log.${DAY}" owner("root") group("root") perm(0644) dir_perm(0755) create_dirs(yes) overwrite_if_older(604800) ); }; destination d_systems {file("/syslog-ng/sys/${HOST}/${HOST}-system.log.${DAY}" owner("root") group("root") perm(0644) dir_perm(0755) create_dirs(yes) overwrite_if_older(604800) ); }; destination d_auth {file("/syslog-ng/auth/auth.log.${MONTH}" owner("root") group("root") perm(0640) dir_perm(0750) create_dirs(yes) overwrite_if_older(604800) ); }; -----Original Message----- From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: Tuesday, July 20, 2021 8:00 AM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 195, Issue 7 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://urldefense.com/v3/__https://nam12.safelinks.protection.outlook.com/… or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. syslog-ng-3.33.2 (Laszlo Szemere (lszemere)) ---------------------------------------------------------------------- Message: 1 Date: Mon, 19 Jul 2021 13:38:23 +0000 From: "Laszlo Szemere (lszemere)" <Laszlo.Szemere(a)oneidentity.com> To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] syslog-ng-3.33.2 Message-ID: <DM6PR19MB346594FBE1EDA3F73ACFEB699DE19(a)DM6PR19MB3465.namprd19.prod.outlook.com> Content-Type: text/plain; charset="iso-8859-1" 3.33.2 Bugfixes * disk-buffer: fixed a bug, which was introduced in 3.33.1, where we sometimes corrupted the disk-buffer file when it reached full size. (#3726<https://urldefense.com/v3/__https://nam12.safelinks.protection.outlook.com/… >) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Antal Nemes, Attila Szakacs, Balázs Barkó, Balazs Scheidler, Benedek Cserhati, Gabor Nagy, Josef Schlehofer, Laszlo Budai, Laszlo Szemere, László Várady, Norbert Takacs, Parrag Szilárd, Peter Kokai, Zoltan Pallagi -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://urldefense.com/v3/__https://nam12.safelinks.protection.outlook.com/… > ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://urldefense.com/v3/__https://nam12.safelinks.protection.outlook.com/… ------------------------------ End of syslog-ng Digest, Vol 195, Issue 7 ***************************************** ---------------------------------------------------------------------- This message, and any attachments, is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at https://urldefense.com/v3/__https://nam12.safelinks.protection.outlook.com/… . If you are not the intended recipient, please delete this message. ______________________________________________________________________________ Member info: https://urldefense.com/v3/__https://nam12.safelinks.protection.outlook.com/… Documentation: https://urldefense.com/v3/__https://nam12.safelinks.protection.outlook.com/… FAQ: https://urldefense.com/v3/__https://nam12.safelinks.protection.outlook.com/… -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://urldefense.com/v3/__http://lists.balabit.hu/pipermail/syslog-ng/att… > ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://urldefense.com/v3/__https://lists.balabit.hu/mailman/listinfo/syslo… ------------------------------ End of syslog-ng Digest, Vol 195, Issue 9 ***************************************** ---------------------------------------------------------------------- This message, and any attachments, is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.bankofamerica.com/emaildisclaimer. If you are not the intended recipient, please delete this message.

1 0

Re: [syslog-ng] syslog-ng Digest, Vol 195, Issue 7
by Linn, William 23 Jul '21

23 Jul '21

I am having issues with a previous configuration set up in 2012. How to re-write it to work, here is the configuration that fails to work. destination d_apps { file("/syslog-ng/app/${HOST}/${HOST}-application.log.${DAY}" owner("root") group("root") perm(0644) dir_perm(0755) create_dirs(yes) overwrite_if_older(604800) ); }; destination d_systems {file("/syslog-ng/sys/${HOST}/${HOST}-system.log.${DAY}" owner("root") group("root") perm(0644) dir_perm(0755) create_dirs(yes) overwrite_if_older(604800) ); }; destination d_auth {file("/syslog-ng/auth/auth.log.${MONTH}" owner("root") group("root") perm(0640) dir_perm(0750) create_dirs(yes) overwrite_if_older(604800) ); }; -----Original Message----- From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: Tuesday, July 20, 2021 8:00 AM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 195, Issue 7 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://urldefense.com/v3/__https://lists.balabit.hu/mailman/listinfo/syslo… or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. syslog-ng-3.33.2 (Laszlo Szemere (lszemere)) ---------------------------------------------------------------------- Message: 1 Date: Mon, 19 Jul 2021 13:38:23 +0000 From: "Laszlo Szemere (lszemere)" <Laszlo.Szemere(a)oneidentity.com> To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] syslog-ng-3.33.2 Message-ID: <DM6PR19MB346594FBE1EDA3F73ACFEB699DE19(a)DM6PR19MB3465.namprd19.prod.outlook.com> Content-Type: text/plain; charset="iso-8859-1" 3.33.2 Bugfixes * disk-buffer: fixed a bug, which was introduced in 3.33.1, where we sometimes corrupted the disk-buffer file when it reached full size. (#3726<https://urldefense.com/v3/__https://github.com/syslog-ng/syslog-ng/pull/372… >) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Antal Nemes, Attila Szakacs, Balázs Barkó, Balazs Scheidler, Benedek Cserhati, Gabor Nagy, Josef Schlehofer, Laszlo Budai, Laszlo Szemere, László Várady, Norbert Takacs, Parrag Szilárd, Peter Kokai, Zoltan Pallagi -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://urldefense.com/v3/__http://lists.balabit.hu/pipermail/syslog-ng/att… > ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://urldefense.com/v3/__https://lists.balabit.hu/mailman/listinfo/syslo… ------------------------------ End of syslog-ng Digest, Vol 195, Issue 7 ***************************************** ---------------------------------------------------------------------- This message, and any attachments, is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.bankofamerica.com/emaildisclaimer. If you are not the intended recipient, please delete this message.

2 1

syslog-ng-3.33.2
by Laszlo Szemere (lszemere) 19 Jul '21

19 Jul '21

3.33.2 Bugfixes * disk-buffer: fixed a bug, which was introduced in 3.33.1, where we sometimes corrupted the disk-buffer file when it reached full size. (#3726<https://github.com/syslog-ng/syslog-ng/pull/3726>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Antal Nemes, Attila Szakacs, Balázs Barkó, Balazs Scheidler, Benedek Cserhati, Gabor Nagy, Josef Schlehofer, Laszlo Budai, Laszlo Szemere, László Várady, Norbert Takacs, Parrag Szilárd, Peter Kokai, Zoltan Pallagi

1 0

Re: [syslog-ng] Logging to postgresql - error creating table with IP
by Herda, Martin 14 Jul '21

14 Jul '21

Thanks for your reply, I did indeed apply the single quotes and also tried with escaped double quotes. In either case the SQL statment string gets malformed to this: CREATE TABLE _logs_192.168.75.130_ Which will result in the same error as before: Error running SQL query; type='pgsql', host='127.0.0.1', port='5432', user='syslog', database='db_syslog', error='6819553: FEHLER: ERROR: Syntax error at >.168<\x0aLINE 1: CREATE TABLE _logs_192.168.75.130_ (datetime varchar(16), ho...\x0a ^\x0a', query='CREATE TABLE _logs_192.168.75.130_ (datetime varchar(16), host varchar(32), program varchar(20), pid varchar(10), message varchar(800))' Error creating table, giving up; table='_logs_192.168.75.130_' Br, MH Von: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> Im Auftrag von Laszlo Szemere (lszemere) Gesendet: Dienstag, 13. Juli 2021 19:24 An: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Betreff: Re: [syslog-ng] Logging to postgresql - error creating table with IP Hello, as a quick and dirty test I found an online Postgress test env. https://extendsclass.com/postgresql-online.html I made some tests with the following commands: -- create table scientist (id integer, firstname varchar(100), lastname varchar(100)); -- insert into scientist (id, firstname, lastname) values (1, 'albert', 'einstein'); -- insert into scientist (id, firstname, lastname) values (2, 'isaac', 'newton'); -- insert into scientist (id, firstname, lastname) values (3, 'marie', 'curie'); -- select * from scientist; DROP TABLE "logs_192.168.75.102"; CREATE TABLE "logs_192.168.75.102" (datetime varchar(16), host varchar(32), program varchar(20), pid varchar(10), message varchar(800)); insert into "logs_192.168.75.102" (datetime, host, program, pid, message) values ('datetime', 'host', 'program', 'pid', 'message'); insert into "logs_192.168.75.102" (datetime, host, program, pid, message) values ('datetime', 'host', 'program', 'pid', 'message'); insert into "logs_192.168.75.102" (datetime, host, program, pid, message) values ('datetime', 'host', 'program', 'pid', 'message'); select * from "logs_192.168.75.102"; As it turned out, Postgres indeed accepts dots in the table name, however the SQL statement tourns out to be syntactically invalid without quoting it. (Please confirm: Did you apply quotes during the manual test?) Syslog-ng do not apply any (unnecessary?) quotes to the table name: https://github.com/syslog-ng/syslog-ng/blob/master/modules/afsql/afsql.c#L5… It looks like, simply adding it to the template of the table option: table("logs_${HOST}") --> table("'logs_${HOST}'") should do the trick. However, I cannot test it right now. Sorry. (Please inform me if the problem persists, and I will investigate it further when I am back to my machine.) Br, Laci ________________________________ From: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu<mailto:syslog-ng-bounces@lists.balabit.hu>> on behalf of Herda, Martin <Martin.Herda(a)fritz-edv.de<mailto:Martin.Herda@fritz-edv.de>> Sent: Tuesday, July 13, 2021 17:15 To: 'syslog-ng(a)lists.balabit.hu' <syslog-ng(a)lists.balabit.hu<mailto:syslog-ng@lists.balabit.hu>> Subject: [syslog-ng] Logging to postgresql - error creating table with IP CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe. Greetings to all, Im on Debian 4.19.194-2 using syslog-ng 3.19.1 The .conf is set to send all incoming syslog packages into pg database: destination d_pgsql { sql(type(pgsql) host("127.0.0.1") username("syslog") password("syslog") port("5432") database("db_syslog") table("logs_${HOST}") columns("datetime varchar(16)", "host varchar(32)", "program varchar(20)", "pid varchar(10)", "message varchar(800)") values("$R_DATE", "${HOST}", "$PROGRAM", "$PID", "$MSG") indexes("datetime", "host", "program", "pid", "message")); }; When there is a hostname available, the table is created successfully. When hostname can not be resolved, IP Address is used instead. But in this case syslog-ng is unable to create a new table: syslog-ng[499]: Error running SQL query; type='pgsql', host='127.0.0.1', port='5432', user='syslog', database='db_syslog', error='6819553: ERROR: Syntax error at >.168<\x0aLINE 1: CREATE TABLE logs_192.168.75.102 (datetime varchar(16), ho...\x0a ^\x0a', query='CREATE TABLE logs_192.168.75.102 (datetime varchar(16), host varchar(32), program varchar(20), pid varchar(10), message varchar(800))' Error creating table, giving up; table='logs_192.168.75.102' The issue seems to be the dot of the IP address. But dots in table names are possible AFAIK. Im able to manually create this table via HeidiSQL with no issues. Does the CREATE TABLE statement need to be escaped in some way? Or is there a way to replace the dots from the $HOST macro with underscores?

2 1

Logging to postgresql - error creating table with IP
by Herda, Martin 13 Jul '21

13 Jul '21

Greetings to all, Im on Debian 4.19.194-2 using syslog-ng 3.19.1 The .conf is set to send all incoming syslog packages into pg database: destination d_pgsql { sql(type(pgsql) host("127.0.0.1") username("syslog") password("syslog") port("5432") database("db_syslog") table("logs_${HOST}") columns("datetime varchar(16)", "host varchar(32)", "program varchar(20)", "pid varchar(10)", "message varchar(800)") values("$R_DATE", "${HOST}", "$PROGRAM", "$PID", "$MSG") indexes("datetime", "host", "program", "pid", "message")); }; When there is a hostname available, the table is created successfully. When hostname can not be resolved, IP Address is used instead. But in this case syslog-ng is unable to create a new table: syslog-ng[499]: Error running SQL query; type='pgsql', host='127.0.0.1', port='5432', user='syslog', database='db_syslog', error='6819553: ERROR: Syntax error at >.168<\x0aLINE 1: CREATE TABLE logs_192.168.75.102 (datetime varchar(16), ho...\x0a ^\x0a', query='CREATE TABLE logs_192.168.75.102 (datetime varchar(16), host varchar(32), program varchar(20), pid varchar(10), message varchar(800))' Error creating table, giving up; table='logs_192.168.75.102' The issue seems to be the dot of the IP address. But dots in table names are possible AFAIK. Im able to manually create this table via HeidiSQL with no issues. Does the CREATE TABLE statement need to be escaped in some way? Or is there a way to replace the dots from the $HOST macro with underscores?

2 1

syslog-ng-3.33.1
by László Várady (lvarady) 07 Jul '21

07 Jul '21

3.33.1 Highlights * MQTT destination The new mqtt() destination can be used to publish messages using the MQTT protocol. Currently MQTT 3.1.1 and 3.1 are supported. Supported transports: tcp, ws. Example config: destination { mqtt{ address("tcp://localhost:1883"), topic("syslog/$HOST"), fallback-topic("syslog/fallback")) }; }; Note: MQTT 5.0 and TLS (ssl://, wss://) are currently not supported. (#3703<https://github.com/syslog-ng/syslog-ng/pull/3703>) * discord() destination syslog-ng now has a webhook-based Discord destination. Example usage: destination { discord(url("https://discord.com/api/webhooks/x/y")); }; The following options can be used to customize the destination further: avatar-url(), username("$HOST-bot"), tts(true), template("${MSG:-[empty message]}"). (#3717<https://github.com/syslog-ng/syslog-ng/pull/3717>) Features * kafka-c: batching support in case of sync-send(yes) kafka-c( bootstrap-server("localhost:9092") topic("syslog-ng") sync-send(yes) batch-lines(10) batch-timeout(10000) ); Note1: batch-lines are accepted in case of sync-send(no), but no batching is done. Note2: messages are still sent one at a time to kafka, the batch yields multiple message per transaction. (#3699<https://github.com/syslog-ng/syslog-ng/pull/3699>) * kafka-c: sync-send(yes) enables synchronous message delivery, reducing the possibility of message loss. kafka-c( bootstrap-server("localhost:9092") topic("syslog-ng") sync-send(yes) ); Warning: this option also reduces significantly the performance of kafka-c driver. (#3681<https://github.com/syslog-ng/syslog-ng/pull/3681>) * disk-buffer: Now we optimize the file truncating frequency of disk-buffer. The new behavior saves IO time, but loses some disk space, which is configurable with a new option. The new option in the config is settable at 2 places: * truncate-size-ratio() in the disk-buffer() block, which affects the given disk-buffer. * disk-buffer(truncate-size-ratio()) in the global options block, which affects every disk-buffer which did not set truncate-size-ratio() itself. The default value is 0.01, which operates well with most disk-buffers. If the possible size reduction of the truncation does not reach truncate-size-ratio() x disk-buf-size(), we do not truncate the disk-buffer. To completely turn off truncating (maximal disk space loss, maximal IO time saved) set truncate-size-ratio(1), or to mimic the old behavior (minimal disk space loss, minimal IO time saved) set truncate-size-ratio(0). (#3689<https://github.com/syslog-ng/syslog-ng/pull/3689>) Bugfixes * syslog-format: fixing the check-hostname(yes|no) option The check-hostname(yes|no) option detected every value as invalid, causing a parse error when enabled. (#3690<https://github.com/syslog-ng/syslog-ng/pull/3690>) * disk-buffer(): fix crash when switching between disk-based and memory queues When a disk-buffer was removed from the configuration and the new config was applied by reloading syslog-ng, a crash occurred. (#3700<https://github.com/syslog-ng/syslog-ng/pull/3700>) * logpath: Fixed a message write protection bug, where message modifications (rewrite rules, parsers, etc.) leaked through preceding path elements. This may have resulted not only in unwanted/undefined message modification, but in certain cases crash as well. (#3708<https://github.com/syslog-ng/syslog-ng/pull/3708>) * mongodb(): fix crash with older mongo-c-driver versions syslog-ng crashed (was aborted) when the mongodb() destination was used with older mongo-c-driver versions (< v1.11.0). (#3677<https://github.com/syslog-ng/syslog-ng/pull/3677>) * java(): fix debug logging of Java-based destinations Java debug logging was not enabled previously when syslog-ng was started in debug/trace mode. This has been fixed. (#3679<https://github.com/syslog-ng/syslog-ng/pull/3679>) * kafka-c: fixed a hang during shutdown/reload, when multiple workers is used (workers() option is set to 2 or higher) and the librdkafka internal queue is filled. (error message was kafka: failed to publish message; topic='test-topic', error='Local: Queue full') (#3711<https://github.com/syslog-ng/syslog-ng/pull/3711>) Packaging * kafka: minimum version of librdkafka is changed from 1.0.0 to 1.1.0 (#3706<https://github.com/syslog-ng/syslog-ng/pull/3706>) * configure: now supporting python with two digit minor version (#3713<https://github.com/syslog-ng/syslog-ng/pull/3713>) Other changes * kafka: removed some deprecated options: client-lib-dir(), option(), template(), kafka-bootstrap-servers() (#3698<https://github.com/syslog-ng/syslog-ng/pull/3698>) * kafka: properties-file() option is deprecated. Please list the librdkafka properties in the config() option in syslog-ng's configuration. (#3698<https://github.com/syslog-ng/syslog-ng/pull/3698>) * smtp(): libesmtp is now detected via pkg-config (#3669<https://github.com/syslog-ng/syslog-ng/pull/3669>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Antal Nemes, Attila Szakacs, Balazs Scheidler, Balázs Barkó, Benedek Cserhati, Gabor Nagy, L4rS6, Laszlo Budai, Laszlo Szemere, LittleFish33, László Várady, Norbert Takacs, Peter Czanik, Peter Kokai, Todd C. Miller, Tomáš Mózes, Zoltan Pallagi

1 0

query on remote logging
by SIMON BABY 07 Jul '21

07 Jul '21

Hi Team, Can I know if there is a configuration in syslog-ng.conf for logging the messages from a remote client. Can you please send me a sample configuration? Regards Simon

2 1

Dynamic setting value out of message?
by Matthias Gruber 01 Jul '21

01 Jul '21

Hi! I hope it is simple and my thoughts and seeks about it were to complicated :-), simply I didnt know how to do that, perhaps someone has a clue for me I am getting e.g. messages like "MESSAGE": "UIMUC4Maintenance.py: \"== deactivate_uc4_monitoring = ENDE ==\"", (thats out of an JSON-formatted syslog-ng output), What I would like to do is, to extract the 'UIMUC4Maintenance.py:' and put it into a SDATA-Custom-Variable or PROG but based on a regex so some sort of rewrite-rule like (no not a correct syntax, only to describe it) rewrite r_fill_program { set(match("^\w*\.py:" value("MESSAGE")) value("PROG")); }; As far as I understand it, set requires a "string" as first parameter, I could use a lots of rewrites with a condition, but I am in "lack of a static string", this should be some sort of variable :-) or I could do that static with a filter for every "^\w*\.py:"-Text, but I hope I could do that dynamic, every time a match of my regex syslog-ng inserts that part into a variable and so on... Is that possible? cheers Matthias ------------------------------------------------------------------------------------ METZLER Informationstechnologie Matthias Gruber IT-Infrastruktur & -Betrieb B. Metzler seel. Sohn & Co. Aktiengesellschaft Untermainanlage 1 60329 Frankfurt am Main Telefon (0 69) 21 04 - 43 30 Telefax (0 69) 21 04 - 40 40 MGruber(a)metzler.com www.metzler.com Vorstand: Harald Illy, Emmerich Müller, Gerhard Wiesheu Vorsitzender des Aufsichtsrats: Dr. Christoph Schücking Sitz der Gesellschaft: Frankfurt am Main, Handelsregister-Nr. HRB 123 365 Diese Nachricht ist vertraulich. Sollten Sie nicht der vorgesehene Empfänger sein, so bitten wir Sie höflich, dies unverzüglich dem Absender mitzuteilen und die Nachricht zu löschen. Es ist unzulässig, die Nachricht unbefugt weiterzuleiten oder zu kopieren. Da wir nicht die Echtheit oder Vollständigkeit der in dieser Nachricht enthaltenen Informationen garantieren oder zusichern können, sind die vorstehenden Ausführungen rechtlich nicht bindend. Eine Haftung hierfür wird ausgeschlossen. This message is confidential. If you are not the intended recipient, we kindly ask you to inform the sender and delete the information. Any unauthorised dissemination or copying hereof is prohibited. As we cannot guarantee or assure the genuineness or completeness of the information contained in this message, the statements set forth above are not legally binding. Accordingly we cannot accept any liability for their contents.

3 4

Is there any compatibility between ver3.2 and ver3.25 about syslog-ng.conf?
by leis 25 Jun '21

25 Jun '21

Hello, I am looking to migrate my environment from CentOS5 syslog-ng ver3.2 to ubnutu20.02 syslog-ng ver3.25. But when I use syslog-ng.conf of ver3.2 to syslog-ng.conf of ver3.25, syslog-ng cannot start. Is there any compatibility between ver3.2's syslog-ng.conf and ver3.25's syslog-ng.conf? Thanks

2 1

Re: [syslog-ng] Tips to diagnose missing syslog messages?
by brian hoffman 15 Jun '21

15 Jun '21

We've spent a lot of time troubleshooting UDP drops, and the so_reuseport option did help quite a bit. There's a max number that the RECVQ can reach (which can be seen with: /usr/bin/netstat -tupln|egrep "(^udp.*syslog-ng)" ) that correlates to the so_rcvbuf. Having more queues won't keep drops from happening, since the hashing in the OSE is related to source IP, so a talkative host can still fill up one of those queues and cause drops. The PE uses eBPF which is apparently better at preventing this, but we found that by using the updated version at "copr:copr.fedorainfracloud.org:czanik:syslog-ng324/x86_64" instead of the stock RH one and bumping up the so_rcvbuf, it did perform much better (and I believe you may need that version for the so_reuseport).-Brian

1 0

Re: [syslog-ng] Request for config help
by Pradeep Gotaparthi 15 Jun '21

15 Jun '21

Hi, Could anybody help us out with the below query? Thanks. On Fri, Mar 26, 2021 at 12:06 AM Pradeep Gotaparthi <pradeep.gp(a)gmail.com> wrote: > Hi, > > We have been using syslog-ng for over a year now and it is working great, > thanks! > > One issue we face is that when we stop the process when there is some > buffer, the threshold is ignored and a bunch of logs get pushed out (as > much as 10 times the threshold value). This is causing problems on the > receiving end as it can't handle the load. We thought the log-fifo-size > parameter can help as syslog uses this parameter to store logs in memory > but it is not helping. > > It would be great if you can guide us. > > > Thanks. >

5 8

Insider 2021-06: Alerting; EoL technologies; Google Summer of Code;
by Peter Czanik (pczanik) 10 Jun '21

10 Jun '21

Dear syslog-ng users, This is the 92nd issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS First steps of sending alerts to Discord and others from syslog-ng: http() and Apprise ------------------------------- A returning question I get is: “I see, that you can send alerts from syslog-ng to Slack and Telegram, but do you happen to support XYZ?” Replace XYZ with Discord and countless others. Up until recently, my regular answer has been: “Take a look at the Slack destination of syslog-ng, and based on that, you can add support for your favorite service”. Then I learned about Apprise, a notification library for Python, supporting dozens of different services. This blog is the first part of a series. It covers how to send log messages to Discord using the http() destination of syslog-ng and an initial try at using Apprise for alerting. https://www.syslog-ng.com/community/b/blog/posts/first-steps-of-sending-ale… Changes in technologies supported by syslog-ng: Python 2, CentOS 6 & Co. ---------------------------------------------------- Technology is continuously evolving. There are regular changes in platforms running syslog-ng: old technologies disappear, and new technologies are introduced. While we try to provide stability and continuity to our users, we also need to adapt. Python 2 reached its end of life a year ago, CentOS 6 in November 2020. Using Java-based drivers has been problematic for many, so they were mostly replaced with native implementations. From this blog you can learn about recent changes affecting syslog-ng development and packaging. https://www.syslog-ng.com/community/b/blog/posts/changes-in-technologies-su… Google Summer of Code 2021 -------------------------- This year, the syslog-ng team participates in Google Summer of Code (GSoC) again as a mentoring organization. Two students paid by GSoC work on syslog-ng under the mentoring of syslog-ng developers. One of the students works on MacOS support, including the new ARM-based systems, while the other one is working developing on a new regular expression parser: https://summerofcode.withgoogle.com/organizations/5548293561516032/ WEBINARS * syslog-ng, Proxy Protocol Support: https://www.syslog-ng.com/event/syslogng-proxy-protocol-support-8148877/ * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Debian/Ubuntu OBS packages: discontinued
by Laszlo Budai 01 Jun '21

01 Jun '21

Hi, unofficial syslog-ng Debian/Ubuntu OBS[1] packages are discontinued. The previously built syslog-ng packages are still available (up to version 3.31.2). Some of you might know that the origin of the repository's name was a kind of joke : at that time I was told that 'we need syslog-ng binary packages', others said: 'we cannot ship binary packages for OSE'. I resolved this conflict by creating an OBS repository under my personal name in my free time... problem solved... at least until now. This was my personal project, under my personal name, working on it in my free time - and unfortunately I don't have the time for maintaining it anymore. I'd suggest to migrate to DBLD[2] packages from my OBS repository (if not possible for some reasons, just contact to me and I'm trying to help you). [1] https://build.opensuse.org/project/show/home:laszlo_budai:syslog-ng [2] https://www.syslog-ng.com/community/b/blog/posts/dbld-a-syslog-ng-developer… kind regards, Laszlo Budai [Twitter]<https://twitter.com/Budai_L> [LinkedIn] <https://www.linkedin.com/in/laszlo-budai-55243a3/> [Github] <https://github.com/lbudai>

1 0

Using custom parser with only a subset of udp traffic
by Faine, Mark R. (MSFC-IS40)[NICS] 27 May '21

27 May '21

Hopefully one of you can help me figure this out. All of my udp traffic is coming in through one source (network driver), some of it is firewall data but I have to filter it out based on where it is coming from and other fields in the log data. I want to use the csv_parser here since it would make it easier for me to get the data I need from the firewall data. Does this require splitting my one source into two sources, since I would need to use flags('no-parse') on a firewall data source? I also think this means that I can't use a single log path to process both sources? Also, how to prevent potential duplication since the non-firewall source will still receive the firewall traffic and try to process it with syslog-parser. I think the flow is something like this: firewall source -> custom parser -> filters ->rewrites / \ all_data -> \ -> destination \ / all udp source -> filters -> rewrites / I understand this is a bit complex to answer simply, I'm mostly looking for answers to the above questions as well as high level guidance for how to proceed. Thanks, -Mark

3 4

Slack or other
by Faine, Mark R. (MSFC-IS40)[NICS] 21 May '21

21 May '21

Have you considered or would you consider a slack or other real time based communication environment for syslog-ng? The mailing list is great but it's kind of slow asynchronous communication. It would be awesome to have a community where I could just fire off a quick question and get a quick answer from anyone who might be around. Thanks, -Mark

3 3

using VARARGS correctly
by Faine, Mark R. (MSFC-IS40)[NICS] 21 May '21

21 May '21

Syslog-ng 3.19 block destination d_default(basepath('/var/log/remote/backup') location("") app("") name("")) { file("`basepath`/`location`/`app`/${HOST}/${HOST}_`app``__VARARGS__`.log" persist-name(`name`) create_dirs(yes) flags("threaded", "no-multi-line")); }; However, when I call it like so: d_default(basepath(`BASEPATH`) location("$location") app("$app") name('d_default_udp') "$session"); I get a syntax error when checking with --syntax-only Error parsing block reference, syntax error, unexpected LL_STRING, expecting ')' in /etc/syslog-ng/conf.d/splunk.conf: 23 categorize_loc(); 24 categorize_app(); 25 }; 26 }; 27 destination { 28----> d_default(basepath(`BASEPATH`) location("$location") app("$app") name('d_default_udp') "$session"); 28----> ^^^^^^^^^^ >From looking at the documentation, it looks like it's a valid way to use it. $session here is just a number from 0-9 that is set from rewriting a user defined macro from the message's sessionid field. It's only going to exist for a certain kind of message. Thanks, -Mark

3 5

ACLs with syslog-ng
by Faine, Mark R. (MSFC-IS40)[NICS] 19 May '21

19 May '21

RHEL 7 and 8 syslog-ng 3.19 and 3.31 We have always set permissions on directories that we want the Splunk universal forwarder to be able to read as root:splunk 640, but now security doesn't like this and wants everything under /var/log to always be root:root except for some specific exceptions. We had tried to solve this with an ACL in the past, however, syslog-ng always seems to clobber the ACL, even when it's the default ACL on the folder. Is this a known issue, is there a way to get syslog-ng to play nice with ACLs. Thanks, -Mark Mark Faine System Administrator SAIC/NICS 215 Wynn Dr. 5065 Huntsville, AL 35805 256-961-1295 (Desk) 256-617-4861 (Work Cell)

2 4

Insider 2021-05: 3.32; Fortigate; Windows event collector; FreeBSD; Pi;
by Peter Czanik (pczanik) 13 May '21

13 May '21

Dear syslog-ng users, This is the 91st issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS syslog-ng 3.32 is now available ------------------------------- Highlights include multi-threaded connection pooling to MongoDB servers and template support for its collection() option. OpenBSD support is now fixed. For a complete list of changes, check the release notes at: https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-3.32.1 Parsing Fortigate logs and other syslog-ng 3.31 news ---------------------------------------------------- Version 3.31 of syslog-ng has been released recently. One of its most user-visible features is the parser for Fortigate logs, yet another networking vendor that produces log messages not conforming to syslog specifications. Parsing Fortigate logs builds upon the new no-header flag of syslog-ng combined with the key-value and date parsers. Other features include a new silent message option for the Telegram destination and automatic directory creation for disk-buffer files. https://www.syslog-ng.com/community/b/blog/posts/parsing-fortigate-logs-and… Collecting Windows EventLog without installing extra software on Windows -------------------------------------------- Talking to users at both IT security and operations related conferences, they confessed the same: the less software the better. Less software to learn, maintain and follow in bug trackers. The Windows Event Collector (WEC) component of syslog-ng Premium Edition (PE) brings this to the extremes: it enables Windows machines to act as log sources without installing any software. Just enable the WEC component of syslog-ng PE on your Linux server and enjoy the logs flowing in. From this blog you can learn how to set up a test environment for WEC. I will also show you an easier way to prepare the certificates used, help you avoid some of the failures, and point you to alternative ways, where necessary. https://www.syslog-ng.com/community/b/blog/posts/windows-event-collector-fo… syslog-ng on the FreeBSD wiki ----------------------------- My original blog about getting started with syslog-ng on FreeBSD became outdated. The content was updated and extended a bit, and with some help from the FreeBSD community, it is now available on the FreeBSD wiki at https://wiki.freebsd.org/Ports/sysutils/syslog-ng Syslog-ng & Pi day ------------------ We had March 14th recently, or as many geeks refer to it: Pi day. On this occasion, I would like to show you a syslog-ng configuration, which prints a huge π on the screen, and two recent articles that feature syslog-ng on the Raspberry Pi. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-pi-day WEBINARS * syslog-ng, Swiss Army Knife of Log Management: https://www.syslog-ng.com/event/syslogng-swiss-army-knife-of-log-management… * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Changing message transfer for rfc6587
by Hartmann Benedict - Maschinenfabrik Reinhausen 12 May '21

12 May '21

Hello, at the moment I am sending messages via destination d_syslog_visu_conf_IETF { syslog("`IPADRESS`" transport(TCP) port(`PORT`) `TLS_CERT`) ; }; This approach will lead to the rfc6587 standard. The messages are collected via visual syslog. Is it possible to change the message transfer mode from "octet counting" (leading message length) to "non-transparent-framing" (no leading message length) via config? Best regards Benedict Hartmann Maschinenfabrik Reinhausen GmbH General Manager / Geschäftsführer: Dr. Nicolas Maier-Scheubeck, Wilfried Breuer, Holger Michalka Chairman of the Board / Vors. des Aufsichtsrats: Hans-Jürgen Thaus Registered Office / Sitz der Gesellschaft: Regensburg Local Court Regensburg / Amtsgericht Regensburg HRB 3687 This e-mail and any attachments contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender and delete this message. Thank you. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden. This e-mail was scanned for viruses, vandals and malicious content.

2 1

syslog-ng mail list is fixed
by Attila Szakacs (aszakacs) 10 May '21

10 May '21

Hello fellow syslog-ng users, Apologies for the past few weeks' syslog-ng mail list outage. We have had some issues with our mail server, but everything seems to be resolved now. If you still cannot send mails to syslog-ng(a)lists.balabit.hu, please write a mail to me directly: attila.szakacs(a)oneidentity.com. Cheers, Attila

1 0

syslog-ng-3.32.1
by Peter Kokai (pkokai) 10 May '21

10 May '21

3.32.1 ====== ## Highlights * `mongodb()`: add `workers()` support (multi-threaded connection pooling) The MongoDB driver now supports the `workers()` option, which specifies the number of parallel workers to be used. Workers are based on the connection pooling feature of the MongoDB C library. This increases the throughput of the MongoDB destination driver. Example: ``` destination { mongodb( uri("mongodb://hostA,hostB/syslog?replicaSet=my_rs&wtimeoutMS=10000&socketTimeoutMS=10000&connectTimeoutMS=10000&serverSelectionTimeoutMS=5000") collection("messages") workers(8) ); }; ``` ([#3621](https://github.com/syslog-ng/syslog-ng/pull/3621)) * `mongodb()`: template support for the `collection()` option The `collection()` option of the MongoDB destination driver now accepts templates, for example: ``` destination { mongodb( uri("mongodb://host/syslog") collection("${HOST}_messages") ); }; ``` ([#3621](https://github.com/syslog-ng/syslog-ng/pull/3621)) ## Features * `time-reopen`: Support the `time-reopen()` option on the driver level for the following drivers: * sources: `example-diskq-source`, `python-fetcher` * destinations: `amqp`, `example-destination`, `file`, `http`, `mongodb`, `network`, `pipe`, `program`, `pseudofile`, `python`, `redis`, `riemann`, `smtp`, `sql`, `stomp`, `syslog`, `tcp`, `tcp6`, `udp`, `udp6`, `unix-dgram`, `unix-stream`, `usertty` ([#3585](https://github.com/syslog-ng/syslog-ng/pull/3585)) * `csv-parser()`: add drop-invalid() option along with the already existing flag with the same name. This is to improve the consistency of the configuration language. ([#3547](https://github.com/syslog-ng/syslog-ng/pull/3547)) * `usertty() destination`: Support changing the terminal disable timeout with the `time-reopen()` option. Default timeout change to 60 from 600. If you wish to use the old 600 timeout, add `time-reopen(600)` to your config in the `usertty()` driver. ([#3585](https://github.com/syslog-ng/syslog-ng/pull/3585)) * `syslog-parser()`: add a new drop-invalid() option that allows the use of syslog-parser() in if statements. Normally a syslog-parser() injects an error message instead of failing. ([#3565](https://github.com/syslog-ng/syslog-ng/pull/3565)) ## Bugfixes * date-parser: if the timestamp pattern did not covered a field (for example seconds) that field had undefined value The missing fields are initialized according to the following rules: 1) missing all fields -> use current date 2) only miss year -> guess year based on current year and month (current year, last year or next year) 3) the rest of the cases don't make much sense, so zero initialization of the missing field makes sense. And the year is initialized to the current one. ([#3615](https://github.com/syslog-ng/syslog-ng/pull/3615)) * Fix compilation issues on OpenBSD syslog-ng can now be compiled on OpenBSD. ([#3661](https://github.com/syslog-ng/syslog-ng/pull/3661)) * loggen: debug message printed wrong plugin name (ssl-plugin instead of socket_plugin) ([#3624](https://github.com/syslog-ng/syslog-ng/pull/3624)) * tls: fixup EOF detection issue in tls (before 3.0 version) syslog-ng error message: "I/O error occurred while reading; fd='13', error='Success (0)'" ([#3618](https://github.com/syslog-ng/syslog-ng/pull/3618)) * kafka: the config() block couldn't contain option that is already a keyword in syslog-ng (example: retries) ([#3658](https://github.com/syslog-ng/syslog-ng/pull/3658)) * templates: fixed error reporting when invalid templates were specified The `amqp()`, `file()` destination, `sql()`, `stomp()`, `pdbtool`, and `graphite()` plugins had template options that did not report errors at startup when invalid values were specified. ([#3660](https://github.com/syslog-ng/syslog-ng/pull/3660)) ## Packaging * bison: minimum version of bison is bumped to 3.7.6 ([#3547](https://github.com/syslog-ng/syslog-ng/pull/3547)) * java-modules: the minimum version of gradle changed from 2.2 to 3.4 ([#3645](https://github.com/syslog-ng/syslog-ng/pull/3645)) * light: add to the release tarball ([#3613](https://github.com/syslog-ng/syslog-ng/pull/3613)) ## Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Attila Szakacs, Balazs Scheidler, Gabor Nagy, Janos SZIGETVARI, Laszlo Budai, Laszlo Szemere, LittleFish33, László Várady, Ming Liu, Norbert Takacs, Peter Kokai, Todd C. Miller, Yi Fan Yu, Zoltan Pallagi

1 0

Syslog-ng + Consuming syslog alerts via FIFO: Alarms being lost, no logs related anywhere
by Richter Vitali Guedes 16 Apr '21

16 Apr '21

This is my first time posting here. I hope you can help me. We have 8 collector servers running syslog probes. They also run a collector application. Syslog-ng receives all alarms through UDP Ports, filter them, and write a fifo. It also forwards these alarms through UDP to another server. We are using this another server that receives these forwarded messages as a validation point. There are some filter rules for the pipe delivery, and no filters for UDP delivery. But we could see several not filtered alarms being received at the UDP receiver server, but not being received by the collector application, that reads from the fifo (/opt/solution/src1.pipe). Collector logs have no error lines. I tried rewrititng syslog-ng configuration file, in order to use flow-control, that, according to syslog-ng documentation, is necessary for high volume environments (as this is the case here, 500-1000 alarms per second). I applied it yesterday, together with net.core.rmem_max=1024000, and the scenario got even worst. We noticed missing messages on the UDP destination server and on the fifo. Dropped packets counter on ifconfig was increasing quickly. We rolled back to the previous syslog-ng configuration. Below, you will find the first version of the syslog-ng.conf file, without flow-control (several names , filters and addresses were changed in sake of privacy): @version:3.19 @include "scl.conf" # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # Note: it also sources additional configuration files (*.conf) # located in /etc/syslog-ng/conf.d/ options { flush_lines (0); time_reopen (10); log_fifo_size (1000); chain_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { system(); internal(); # udp(ip(0.0.0.0) port(514)); }; template t_customer { template("${DATE} ${SOURCEIP} ${HOST} ${MSGHDR} ${MESSAGE}\n"); }; # UDP Source destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" flush_lines(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_kern { file("/var/log/kern"); }; destination d_mlal { usertty("*"); }; filter f_kernel { facility(kern); }; filter f_default { level(info..emerg) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_auth { facility(authpriv); }; filter f_mail { facility(mail); }; filter f_emergency { level(emerg); }; filter f_news { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_boot { facility(local7); }; filter f_cron { facility(cron); }; #log { source(s_sys); filter(f_kernel); destination(d_cons); }; #log { source(s_sys); filter(f_kernel); destination(d_kern); }; log { source(s_sys); filter(f_default); destination(d_mesg); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_mail); destination(d_mail); }; log { source(s_sys); filter(f_emergency); destination(d_mlal); }; log { source(s_sys); filter(f_news); destination(d_spol); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; log { source(s_sys); filter(f_cron); destination(d_cron); }; #Debug filter f_debu_1 { not level(debug); }; #Information filter f_info_1 { not match("PROGRAM-" value("MESSAGE")) }; filter f_info_2 { not match("Multicast Client" value("MESSAGE")); }; filter f_info_3 { not match("executeCommand" value("MESSAGE")); }; filter f_info_4 { not match("has the privilege to execute" value("MESSAGE")); }; filter f_info_5 { not match("Telnet " value("MESSAGE")); }; #Warning filter f_warn_1 { not match("LSP went Up" value("MESSAGE")); }; filter f_warn_2 { not match("LSP went Down" value("MESSAGE")); }; filter f_warn_3 { not match("Subscriber created" value("MESSAGE")); }; filter f_warn_4 { not match("Subscriber deleted" value("MESSAGE")); }; filter f_warn_5 { not match("BGP-WARN" value("MESSAGE")); }; filter f_warn_6 { not match("DHCPS-WARNING" value("MESSAGE")); }; filter f_warn_7 { not match("DHCP-WARNING" value("MESSAGE")); }; #Notice filter f_noti_1 { not match("iCDR\[[0-9]+\]:"); }; #Error filter f_erro_1 { not match("FAN started working" value("MESSAGE")); }; filter f_erro_2 { not match("FAN is not working" value("MESSAGE")); }; #Alert filter f_aler_1 { not match("LDP virtual tunnel went" value("MESSAGE")); }; #Critical filter f_crit_1 { not match("traps dropped" value("MESSAGE")); }; filter f_crit_2 { not match("upstream E1 signals" value("MESSAGE")); }; filter f_crit_3 { not match(",ABCDE," value("MESSAGE")); }; filter f_crit_4 { not match(",XYZW," value("MESSAGE")); }; filter f_crit_5 { not match(" for ABCDE-[0-9]" value("MESSAGE")); }; source s_dummy{ udp(ip(0.0.0.0) port(5140)); }; source src1{ udp(ip(0.0.0.0) port(514)); }; source s_10514{ udp(ip(0.0.0.0) port(10514)); }; source src2{ udp(ip(0.0.0.0) port(515)); }; destination d_src1 { pipe("/opt/solution/src1.pipe" template(t_customer)); }; destination d_src2 { pipe("/opt/solution/src2.pipe" template(t_customer)); }; destination d_syslogCustom{ pipe("/opt/solution/syslog_custom.pipe" template(t_customer)); }; destination d_udp_dst{ syslog("192.168.1.151" transport("udp") port(514) spoof_source(no)); }; filter f_src2 { host("r(core|distribution|management).*") or host("^abcd.*") or host("^d2") or host("src2") or host("xyz1") or host("^jkl") or host("asddf") or host("zxcvb"); }; log { source(src1); source(s_10514); filter(f_debu_1); filter(f_info_1); filter(f_info_2); filter(f_info_3); filter(f_info_4); filter(f_info_5); filter(f_warn_1); filter(f_warn_2); filter(f_warn_3); filter(f_warn_4); filter(f_warn_5); filter(f_warn_6); filter(f_warn_7); filter(f_noti_1); filter(f_erro_1); filter(f_erro_2); filter(f_aler_1); filter(f_crit_1); filter(f_crit_2); filter(f_crit_3); filter(f_crit_4); filter(f_crit_5); destination(d_src1); }; log { source(src2); filter(f_src2); destination(d_src2); }; log { source(src1); destination(d_udp_dst); }; That's all. I Also tried using flow-control. The main achanges are below: source src1{ # udp( network( #new driver syntax transport("udp") #new driver syntax ip(0.0.0.0) port(514) max-connections(3000) ); }; source s_10514{ # udp( network( #new driver syntax transport("udp") #new driver syntax ip(0.0.0.0) port(10514) max_connections(3000) ); }; source src2{ # udp( network( #new driver syntax transport("udp") #new driver syntax ip(0.0.0.0) port(515) max_connections(3000) ); }; destination d_src1 { pipe( "/opt/solution/src1.pipe" template(t_customer) log_fifo_size(600000) ); }; destination d_src2 { pipe( "/opt/solution/src2.pipe" template(t_customer) log_fifo_size(300000) ); }; destination d_udp_dst{ syslog( "192.168.1.151" transport("udp") port(514) spoof_source(no) log_fifo_size(300000) ); }; And the situation got even worst. So, I would like to ask you: How can I fix it? I need to be sure that all data received is forwarded to their destinations, respecting the filters, and without any information loss. I'm quite sure all data is being received, I've checked it using tcpdump, no udp packet loss during transmission. The most important sessions are: log { source(src1); source(s_10514); filter(f_debu_1); filter(f_info_1); filter(f_info_2); filter(f_info_3); filter(f_info_4); filter(f_info_5); filter(f_warn_1); filter(f_warn_2); filter(f_warn_3); filter(f_warn_4); filter(f_warn_5); filter(f_warn_6); filter(f_warn_7); filter(f_noti_1); filter(f_erro_1); filter(f_erro_2); filter(f_aler_1); filter(f_crit_1); filter(f_crit_2); filter(f_crit_3); filter(f_crit_4); filter(f_crit_5); destination(d_src1); }; log { source(src1); destination(d_udp_dst); }; Thanks a lot, and sorry for the huge message, Richter <https://www.linkedin.com/company/icarotech>

2 3

Insider 2021-04: Grafana; Windows agent; BSD;
by Peter Czanik (pczanik) 15 Apr '21

15 Apr '21

Dear syslog-ng users, This is the 90th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Grafana, Loki, syslog-ng: jump-starting a new logging stack ----------------------------------------------------------- Talking to syslog-ng users, I found that many of them plan to take a closer look at Grafana, due to the upheaval around the change of licensing terms for Elastic. Luckily, it is now possible to jump-start the complete, new logging stack – including Grafana, Loki, syslog-ng and tools to monitor this stack – with a single command. All you need to do is to point a couple of syslog clients at the included syslog-ng server and open Grafana in your browser. Of course, this setup is far from being production-ready, but it can speed up preparing a test environment for you. From this blog, you can learn how to install Grafana, Loki, syslog-ng stack, how to forward your log messages there, and how to check the results in Grafana. https://www.syslog-ng.com/community/b/blog/posts/grafana-loki-syslog-ng-jum… When to use the syslog-ng agent for Windows? -------------------------------------------- You can collect log messages from a Windows host in multiple ways using syslog-ng. For large scale installations the easiest is to use the Windows Event Collector (WEC) component of syslog-ng Premium Edition (PE). This way you don’t have to install any new client software on the Windows side, just point the WEC to the destionation to send their log messages. Please note that WEC only works for Windows EventLog. If you need to collect log messages from text files, you need to install the syslog-ng agent for Windows on your hosts. For example, web servers often log to files instead of Windows EventLog. Let’s review how to do a standalone installation of syslog-ng agent for Windows and then see the differences between using the legacy (RFC3164) and the new (RFC5424) syslog protocol. https://www.syslog-ng.com/community/b/blog/posts/when-to-use-the-syslog-ng-… Syslog-ng on BSDs ----------------- My FOSDEM presentation in the BSD devroom showcased what is new in sudo and syslog-ng and explained how to install or compile these software yourself on FreeBSD. Not only am I a long time FreeBSD user (started with version 1.0 in 1994) I also work on keeping the syslog-ng port in FreeBSD up to date. But soon after my presentation I was asked what I knew about other BSDs. And – while I knew that all BSDs have syslog-ng in their ports system – I realized I had no idea about the shape of those ports. For this article I installed OpenBSD, DragonFlyBSD and NetBSD to check syslog-ng on them. Admittedly, they are not in the best shape: they contain old versions, some do not even start or are unable to collect local log messages. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-on-bsds WEBINARS * Scale log collection from Windows endpoints with WEC clustering in syslog-ng https://www.syslog-ng.com/event/scale-log-collection-from-windows-endpoints… * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Try again: What's wrong with my config?
by Dan Egli 13 Apr '21

13 Apr '21

Okay. I'm completely stumped on this, and just before the list went down I was hoping someone could help me with this. I'm trying to break everything out of the monolithic /var/log/messages and place each service in it's own log file. To that extent, I created the following config file: syslog-ng config: @version: 3.30 @include "scl.conf" options { threaded(yes); chain_hostnames(no); stats_freq(43200); mark_freq(3600); }; source src { system(); internal(); }; filter samba { program("samba") or program("nmbd") or program("smbd"); }; filter sshd { program("ssdhd"); }; filter syslog { not filter(sshd) and not filter(samba); }; destination console { file("/dev/tty12"); }; destination messages { file("/var/log/messages"); }; destination sshd_log { file("/var/log/sshd/sshd.log"); }; log { source(src); filter(sshd); destination(sshd_log); flags(final); }; log { source(src); filter(syslog); destination(console); }; log { source(src); filter(syslog); destination(messages); }; so, as I understand the logic. The three log { } lines do this: log { source(src); filter(sshd); destination(sshd_log); flags(final); }; Anything from sshd gets written to the /var/log/sshd/sshd.log. Nothing else goes here. log { source(src); filter(syslog); destination(console); }; Anything that is not from sshd, not from smbd, not from sabma and not from nmbd goes to the /dev/tty12 device log { source(src); filter(syslog); destination(messages); }; likewises for /var/log/messages. Is my understanding correct? If so, WHY do I see ssh log entries in /var/log/messages? And how do I stop it!? sshd messages should ONLY show up in /etc/sshd/sshd.log. jupiter ~ # grep sshd /var/log/messages | head -n 2 Apr 13 00:00:50 jupiter sshd[14721]: Received disconnect from <IP> port 18726:11: [preauth] Apr 13 00:00:50 jupiter sshd[14721]: Disconnected from <IP> port 18726 [preauth] Thanks!

3 3

Re: [syslog-ng] Try again: What's wrong with my config?
by Dan Egli 13 Apr '21

13 Apr '21

I wish I knew how is was happening. On 4/13/2021 12:26 AM, Dan Egli wrote: > > Okay. I'm completely stumped on this, and just before the list went > down I was hoping someone could help me with this. > > I'm trying to break everything out of the monolithic /var/log/messages > and place each service in it's own log file. To that extent, I created > the following config file: > >

1 0

Re: [syslog-ng] Try again: What's wrong with my config?
by Dan Egli 13 Apr '21

13 Apr '21

crap. Not that bug again. Ignore this, and watch for my completed message. Sorry. On 4/13/2021 12:12 AM, Dan Egli wrote: > > Okay. I'm completely stumped on this, and just before the list went > down I was hoping someone could help me with this. >

1 0

mail list works again
by Peter Kokai (pkokai) 13 Apr '21

13 Apr '21

Hello all, The previous week there were some issue with the mail list, and it was not possible to send mail to it (mailman likely reported dns unable to resolve). This issue have been resolved, and you should be able to send mail now. -- kokan

1 0

Socket too many open files (24)
by Faine, Mark R. (MSFC-IS40)[NICS] 09 Apr '21

09 Apr '21

syslog-ng 3 (3.19.1) Error Message: syslog-ng[50418]: Error accepting control socket connection; error='Too many open files (24)' I'm seeing this in the syslog-ng logs. However, I've done everything I can think of to increase the file handles and the number of open file handles does not seem to be anywhere close to the max. What else could be causing this? Thanks, -Mark

2 1

Syslog-ng not honoring negative flag
by Dan Egli 09 Apr '21

09 Apr '21

I'm having a bit of a problem and hope someone here can help. I'm trying to separate individual items into specific logs, i.e. ssh events in sshd.log, samba messages in samba.log, etc... I managed to come up with filters that pull out the events I started with, and they are going into the correct log files. But they are ALSO going into /var/log/messages even though I specifically have a filter on that one that says not to include samba or sshd events. I'll copy my config file here. Hopefully someone can tell me what I did wrong. Thanks! --------------------------------------------- @version: 3.30 @include "scl.conf" options { threaded(yes); chain_hostnames(no); stats_freq(43200); mark_freq(3600); }; source src { system(); internal(); }; filter samba { program("samba"); }; filter ssh_messages { facility("AUTH") and level("INFO"); }; filter syslog { not filter("ssh_messages") and not filter("samba"); }; destination console { file("/dev/tty12"); }; destination messages { file("/var/log/messages"); }; destination sshd_log { file("/var/log/sshd/sshd.log"); }; destination smb_logs { file("/var/log/samba/samba.log"); }; log { source(src); destination(smb_logs); filter(samba); flags(final); ); log { source(src); destination(sshd_log); filter(ssh_messages); flags(final); }; log { source(src); destination(console); filter(syslog); }; log { source(src); destination(messages); filter(syslog); };

6 15

Re: [syslog-ng] Syslog-ng not honoring negative flag
by Dan Egli 09 Apr '21

09 Apr '21

I don't know how that keeps happening, but ignore that one. It's incomplete. The NEXT message is complete. Sorry. On 4/8/2021 6:02 PM, Dan Egli wrote: > I'm still hoping someone on this list can help me out. My syslog-ng > configuration seems to be mixing things up. I am TRYING to separate > things, so that anything from sshd goes to /var/log/sshd/sshd.log, > anything from samba goes to /var/log/samba/log.samba, and anything > ELSE hitting the syslog is going to /var/log/messages. My problem is, > the sshd log seems to be picking up samba messsages, and the main log > (/var/log/messages) is picking up them BOTH. But I have filters in my > config to say this one, not that one. > > If anyone is willing to help me out, the following files are live on > my web server: > https://www.newideatest.site/syslog-conf The current > syslog-ng.conf > https://www.newideatest.site/system_log Current /var/log/messages > https://www.newideatest.site/syslog-

1 0

Re: [syslog-ng] Syslog-ng not honoring negative flag
by Dan Egli 08 Apr '21

08 Apr '21

Looks like there's a bug in the lastest version of Thunderbird or something, because I see three messages that are incomplete copies of what I am about to send. I will look further into that while I wait for more advice from you guys. On 4/7/2021 7:19 PM, Dan Egli wrote: > > Those are the only ones I'm seeing in either log. Let me test it a > bit, see if startup/shutdown messages occur too. > > Not only that, I am seeing samba messages in the sshd log, and I > should not. When I do lsof, it seems the samba daemon is writing it's > own logs, so it's not surprising that there's no errors in that log. > But why am I seeing samba messages in sshd.log, and why am I seeing > samba and sshd in /var/log/messages. > > And if what you say about the security/auth is correct, then something > else is screwy here because I ONLY have auth/info listed. NOT > authpriv. Frankly, i'd say that it sounds like I need to just change > to program("sshd") but I'm not sure if that will fix anything. I'll do > that, just to see. > > On 4/7/2021 12:48 PM, SZALAY Attila wrote: >> Hi Dan, >> >> The next important question is that do you see all sshd log messages >> in /var/log/messages or just some of them. I see two kind of sshd >> related log message: >> >> [2021-04-07T12:29:43.875056] Incoming log entry; line='<38>Apr 7 >> 12:29:43 sshd[30745]: Accepted keyboard-interactive/pam for dan from >> XXXX port 40747 ssh2' >> [2021-04-07T12:29:43.878136] Incoming log entry; line='<86>Apr 7 >> 12:29:43 sshd[30745]: pam_unix(sshd:session): session opened for user >> dan(uid=1001) by (uid=0)' >> >> As the two has different values in <>, at least one of them is differ >> from auth/info. >> >> By the way <38> is security(4)/info and <86> is security(10)/info. So >> both are security/auth message in some way but still different >> facilities (4 and 6) which is called as auth(4) and authpriv(10) >> within syslog-ng. >> >> On Wed, 2021-04-07 at 12:35 -0600, Dan Egli wrote: >>> Okay. I captured a couple of minutes worth of syslog-ng running. >>> It's too big to post (1.5MB) so I put it up on my web server. You >>> can see it at: https://www.newideatest.site/syslog-out >>> On 4/7/2021 12:07 PM, SZIGETVÁRI János wrote: >>> Hello Dan, >>> >>> I believe that Bazsi (Balázs) wasn't really looking for the startup >>> messages about the config being parsed, but instead about the >>> debug/trace output of the log processing pipeline. >>> There he would be able to check which filters were run against a >>> certain message (its actual content too), and what result those >>> filters returned. >>> I think that's what he's primarily after. >>> >>> Best Regards, >>> János >>> -- >>> Janos SZIGETVARI >>> RHCE, License no. 150-053-692 >>> <https://www.redhat.com/rhtapps/verify/?certId=150-053-692> >>> >>> LinkedIn: linkedin.com/in/janosszigetvari >>> <http://linkedin.com/in/janosszigetvari> >>> Web: janos.szigetvari.com <https://janos.szigetvari.com> >>> >>> __@__˚V˚ >>> Make the switch to open (source) applications, protocols, formats now: >>> - windows -> Linux, iexplore -> Firefox, msoffice -> LibreOffice >>> - msn -> jabber protocol (Pidgin, Google Talk) >>> - mp3 -> ogg, wmv -> ogg, jpg -> png, doc/xls/ppt -> odt/ods/odp >>> >>> >>> Dan Egli <dan(a)newideatest.site> ezt írta (időpont: 2021. ápr. 7., >>> Sze, 20:02): >>> >>>> Syslog-ng is NOT complaining about my config at all. I've included >>>> the output from the -Fedv below. Other than what I would call >>>> "routine" errors in the scl section, no complaints. >>>> >>>> --------------------------------- >>>> [2021-04-07T11:52:21.151347] Processing @include statement; >>>> filename='scl.conf', >>>> include-path='/etc/syslog-ng:/usr/share/syslog-ng/include' >>>> [2021-04-07T11:52:21.151420] Starting to read include file; >>>> filename='/etc/syslog-ng/scl.conf', depth='1' >>>> [2021-04-07T11:52:21.151596] Module loaded and initialized >>>> successfully; module='appmodel' >>>> [2021-04-07T11:52:21.151612] Processing @include statement; >>>> filename='scl/*/*.conf', >>>> include-path='/etc/syslog-ng:/usr/share/syslog-ng/include' >>>> [2021-04-07T11:52:21.151782] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/apache/apache.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151787] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/checkpoint/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151790] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/cisco/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151792] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/collectd/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151794] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/default-network-drivers/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151797] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/graphite/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151799] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/hdfs/plugin.conf', depth='2' >>>> [2021-04-07T11:52:21.151802] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/iptables/iptables.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151804] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/junos/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151807] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/kafka/kafka-java.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151809] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/kafka/kafka.conf', depth='2' >>>> [2021-04-07T11:52:21.151811] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/linux-audit/linux-audit.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151814] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/loadbalancer/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151816] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/mbox/mbox.conf', depth='2' >>>> [2021-04-07T11:52:21.151819] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151821] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/paloalto/panos.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151824] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/rewrite/cc-mask.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151826] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/snmptrap/snmptrapd-source.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151906] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/solaris/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151912] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/sudo/sudo.conf', depth='2' >>>> [2021-04-07T11:52:21.151915] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/sumologic/sumologic.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151917] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151920] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151922] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/websense/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151925] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/windowseventlog/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151933] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/apache/apache.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151993] Reading path for candidate modules; >>>> path='/usr/lib64/syslog-ng' >>>> [2021-04-07T11:52:21.152064] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libxml.so', module='xml' >>>> [2021-04-07T11:52:21.152174] Registering candidate plugin; >>>> module='xml', context='parser', name='xml' >>>> [2021-04-07T11:52:21.152200] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libtags-parser.so', >>>> module='tags-parser' >>>> [2021-04-07T11:52:21.152263] Registering candidate plugin; >>>> module='tags-parser', context='parser', name='tags-parser' >>>> [2021-04-07T11:52:21.152277] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libsystem-source.so', >>>> module='system-source' >>>> [2021-04-07T11:52:21.152336] Registering candidate plugin; >>>> module='system-source', context='source', name='system' >>>> [2021-04-07T11:52:21.152349] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libsyslogformat.so', >>>> module='syslogformat' >>>> [2021-04-07T11:52:21.152414] Registering candidate plugin; >>>> module='syslogformat', context='format', name='syslog' >>>> [2021-04-07T11:52:21.152417] Registering candidate plugin; >>>> module='syslogformat', context='parser', name='syslog-parser' >>>> [2021-04-07T11:52:21.152428] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libstardate.so', >>>> module='stardate' >>>> [2021-04-07T11:52:21.152619] Registering candidate plugin; >>>> module='stardate', context='template-func', name='stardate' >>>> [2021-04-07T11:52:21.152661] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libsecure-logging.so', >>>> module='secure-logging' >>>> [2021-04-07T11:52:21.152746] Registering candidate plugin; >>>> module='secure-logging', context='template-func', name='slog' >>>> [2021-04-07T11:52:21.152760] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libpseudofile.so', >>>> module='pseudofile' >>>> [2021-04-07T11:52:21.152832] Registering candidate plugin; >>>> module='pseudofile', context='destination', name='pseudofile' >>>> [2021-04-07T11:52:21.152904] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libmap-value-pairs.so', >>>> module='map-value-pairs' >>>> [2021-04-07T11:52:21.152989] Registering candidate plugin; >>>> module='map-value-pairs', context='parser', name='map_value_pairs' >>>> [2021-04-07T11:52:21.153005] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', >>>> fname='liblinux-kmsg-format.so', module='linux-kmsg-format' >>>> [2021-04-07T11:52:21.153170] Registering candidate plugin; >>>> module='linux-kmsg-format', context='format', name='linux-kmsg' >>>> [2021-04-07T11:52:21.153191] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libkvformat.so', >>>> module='kvformat' >>>> [2021-04-07T11:52:21.153261] Registering candidate plugin; >>>> module='kvformat', context='parser', name='kv-parser' >>>> [2021-04-07T11:52:21.153265] Registering candidate plugin; >>>> module='kvformat', context='parser', name='linux-audit-parser' >>>> [2021-04-07T11:52:21.153268] Registering candidate plugin; >>>> module='kvformat', context='template-func', name='format-welf' >>>> [2021-04-07T11:52:21.153279] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libhook-commands.so', >>>> module='hook-commands' >>>> [2021-04-07T11:52:21.153339] Registering candidate plugin; >>>> module='hook-commands', context='inner-dest', name='hook-commands' >>>> [2021-04-07T11:52:21.153343] Registering candidate plugin; >>>> module='hook-commands', context='inner-src', name='hook-commands' >>>> [2021-04-07T11:52:21.153355] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libgraphite.so', >>>> module='graphite' >>>> [2021-04-07T11:52:21.153408] Registering candidate plugin; >>>> module='graphite', context='template-func', name='graphite_output' >>>> [2021-04-07T11:52:21.153418] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libtfgetent.so', >>>> module='tfgetent' >>>> [2021-04-07T11:52:21.153468] Registering candidate plugin; >>>> module='tfgetent', context='template-func', name='getent' >>>> [2021-04-07T11:52:21.153479] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libexamples.so', >>>> module='examples' >>>> [2021-04-07T11:52:21.153646] Registering candidate plugin; >>>> module='examples', context='source', name='example_msg_generator' >>>> [2021-04-07T11:52:21.153654] Registering candidate plugin; >>>> module='examples', context='source', name='example_random_generator' >>>> [2021-04-07T11:52:21.153660] Registering candidate plugin; >>>> module='examples', context='source', name='example_diskq_source' >>>> [2021-04-07T11:52:21.153670] Registering candidate plugin; >>>> module='examples', context='inner-dest', name='http_test_slots' >>>> [2021-04-07T11:52:21.153677] Registering candidate plugin; >>>> module='examples', context='destination', name='example_destination' >>>> [2021-04-07T11:52:21.153722] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libdisk-buffer.so', >>>> module='disk-buffer' >>>> [2021-04-07T11:52:21.153825] Registering candidate plugin; >>>> module='disk-buffer', context='inner-dest', name='disk_buffer' >>>> [2021-04-07T11:52:21.153846] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libdbparser.so', >>>> module='dbparser' >>>> [2021-04-07T11:52:21.154065] Registering candidate plugin; >>>> module='dbparser', context='parser', name='db-parser' >>>> [2021-04-07T11:52:21.154076] Registering candidate plugin; >>>> module='dbparser', context='parser', name='grouping-by' >>>> [2021-04-07T11:52:21.154100] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libtimestamp.so', >>>> module='timestamp' >>>> [2021-04-07T11:52:21.154260] Registering candidate plugin; >>>> module='timestamp', context='parser', name='date-parser' >>>> [2021-04-07T11:52:21.154267] Registering candidate plugin; >>>> module='timestamp', context='rewrite', name='fix-time-zone' >>>> [2021-04-07T11:52:21.154270] Registering candidate plugin; >>>> module='timestamp', context='rewrite', name='set-time-zone' >>>> [2021-04-07T11:52:21.154279] Registering candidate plugin; >>>> module='timestamp', context='rewrite', name='guess-time-zone' >>>> [2021-04-07T11:52:21.154296] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libcsvparser.so', >>>> module='csvparser' >>>> [2021-04-07T11:52:21.154366] Registering candidate plugin; >>>> module='csvparser', context='parser', name='csv-parser' >>>> [2021-04-07T11:52:21.154381] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libcryptofuncs.so', >>>> module='cryptofuncs' >>>> [2021-04-07T11:52:21.154452] Registering candidate plugin; >>>> module='cryptofuncs', context='template-func', name='uuid' >>>> [2021-04-07T11:52:21.154459] Registering candidate plugin; >>>> module='cryptofuncs', context='template-func', name='hash' >>>> [2021-04-07T11:52:21.154657] Registering candidate plugin; >>>> module='cryptofuncs', context='template-func', name='sha1' >>>> [2021-04-07T11:52:21.154662] Registering candidate plugin; >>>> module='cryptofuncs', context='template-func', name='sha256' >>>> [2021-04-07T11:52:21.154665] Registering candidate plugin; >>>> module='cryptofuncs', context='template-func', name='sha512' >>>> [2021-04-07T11:52:21.154667] Registering candidate plugin; >>>> module='cryptofuncs', context='template-func', name='md4' >>>> [2021-04-07T11:52:21.154673] Registering candidate plugin; >>>> module='cryptofuncs', context='template-func', name='md5' >>>> [2021-04-07T11:52:21.154689] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libconfgen.so', >>>> module='confgen' >>>> [2021-04-07T11:52:21.154788] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libcef.so', module='cef' >>>> [2021-04-07T11:52:21.154912] Registering candidate plugin; >>>> module='cef', context='template-func', name='format-cef-extension' >>>> [2021-04-07T11:52:21.154935] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libbasicfuncs.so', >>>> module='basicfuncs' >>>> [2021-04-07T11:52:21.155134] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='grep' >>>> [2021-04-07T11:52:21.155142] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='if' >>>> [2021-04-07T11:52:21.155145] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='or' >>>> [2021-04-07T11:52:21.155148] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='context-lookup' >>>> [2021-04-07T11:52:21.155150] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='context-length' >>>> [2021-04-07T11:52:21.155156] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='context-values' >>>> [2021-04-07T11:52:21.155158] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='echo' >>>> [2021-04-07T11:52:21.155165] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='length' >>>> [2021-04-07T11:52:21.155171] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='substr' >>>> [2021-04-07T11:52:21.155173] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='strip' >>>> [2021-04-07T11:52:21.155176] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='sanitize' >>>> [2021-04-07T11:52:21.155178] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='lowercase' >>>> [2021-04-07T11:52:21.155180] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='uppercase' >>>> [2021-04-07T11:52:21.155183] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='replace-delimiter' >>>> [2021-04-07T11:52:21.155185] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='padding' >>>> [2021-04-07T11:52:21.155201] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='binary' >>>> [2021-04-07T11:52:21.155204] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='implode' >>>> [2021-04-07T11:52:21.155207] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='explode' >>>> [2021-04-07T11:52:21.155209] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='dirname' >>>> [2021-04-07T11:52:21.155214] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='basename' >>>> [2021-04-07T11:52:21.155217] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='list-concat' >>>> [2021-04-07T11:52:21.155219] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='list-head' >>>> [2021-04-07T11:52:21.155222] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='list-nth' >>>> [2021-04-07T11:52:21.155224] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='list-tail' >>>> [2021-04-07T11:52:21.155227] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='list-slice' >>>> [2021-04-07T11:52:21.155230] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='list-count' >>>> [2021-04-07T11:52:21.155232] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='list-append' >>>> [2021-04-07T11:52:21.155234] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='list-search' >>>> [2021-04-07T11:52:21.155237] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='+' >>>> [2021-04-07T11:52:21.155239] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='-' >>>> [2021-04-07T11:52:21.155241] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='*' >>>> [2021-04-07T11:52:21.155243] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='/' >>>> [2021-04-07T11:52:21.155245] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='%' >>>> [2021-04-07T11:52:21.155248] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='sum' >>>> [2021-04-07T11:52:21.155255] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='min' >>>> [2021-04-07T11:52:21.155257] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='max' >>>> [2021-04-07T11:52:21.155259] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='average' >>>> [2021-04-07T11:52:21.155261] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='round' >>>> [2021-04-07T11:52:21.155267] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='ceil' >>>> [2021-04-07T11:52:21.155272] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='floor' >>>> [2021-04-07T11:52:21.155275] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='ipv4-to-int' >>>> [2021-04-07T11:52:21.155277] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='indent-multi-line' >>>> [2021-04-07T11:52:21.155279] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='dns-resolve-ip' >>>> [2021-04-07T11:52:21.155281] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='env' >>>> [2021-04-07T11:52:21.155284] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='template' >>>> [2021-04-07T11:52:21.155286] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='url-encode' >>>> [2021-04-07T11:52:21.155288] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='url-decode' >>>> [2021-04-07T11:52:21.155291] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='base64-encode' >>>> [2021-04-07T11:52:21.155294] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='iterate' >>>> [2021-04-07T11:52:21.155297] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='map' >>>> [2021-04-07T11:52:21.155300] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='filter' >>>> [2021-04-07T11:52:21.155330] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', >>>> fname='libazure-auth-header.so', module='azure-auth-header' >>>> [2021-04-07T11:52:21.155422] Registering candidate plugin; >>>> module='azure-auth-header', context='inner-dest', >>>> name='azure-auth-header' >>>> [2021-04-07T11:52:21.155440] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libappmodel.so', >>>> module='appmodel' >>>> [2021-04-07T11:52:21.155445] Registering candidate plugin; >>>> module='appmodel', context='root', name='application' >>>> [2021-04-07T11:52:21.155448] Registering candidate plugin; >>>> module='appmodel', context='parser', name='app-parser' >>>> [2021-04-07T11:52:21.155450] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libafuser.so', >>>> module='afuser' >>>> [2021-04-07T11:52:21.155549] Registering candidate plugin; >>>> module='afuser', context='destination', name='usertty' >>>> [2021-04-07T11:52:21.155565] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libafstomp.so', >>>> module='afstomp' >>>> [2021-04-07T11:52:21.155641] Registering candidate plugin; >>>> module='afstomp', context='destination', name='stomp' >>>> [2021-04-07T11:52:21.155653] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libafsocket.so', >>>> module='afsocket' >>>> [2021-04-07T11:52:21.155816] Registering candidate plugin; >>>> module='afsocket', context='source', name='unix-stream' >>>> [2021-04-07T11:52:21.155821] Registering candidate plugin; >>>> module='afsocket', context='destination', name='unix-stream' >>>> [2021-04-07T11:52:21.155824] Registering candidate plugin; >>>> module='afsocket', context='source', name='unix-dgram' >>>> [2021-04-07T11:52:21.155827] Registering candidate plugin; >>>> module='afsocket', context='destination', name='unix-dgram' >>>> [2021-04-07T11:52:21.155829] Registering candidate plugin; >>>> module='afsocket', context='source', name='tcp' >>>> [2021-04-07T11:52:21.155832] Registering candidate plugin; >>>> module='afsocket', context='destination', name='tcp' >>>> [2021-04-07T11:52:21.155834] Registering candidate plugin; >>>> module='afsocket', context='source', name='tcp6' >>>> [2021-04-07T11:52:21.155837] Registering candidate plugin; >>>> module='afsocket', context='destination', name='tcp6' >>>> [2021-04-07T11:52:21.155839] Registering candidate plugin; >>>> module='afsocket', context='source', name='udp' >>>> [2021-04-07T11:52:21.155841] Registering candidate plugin; >>>> module='afsocket', context='destination', name='udp' >>>> [2021-04-07T11:52:21.155844] Registering candidate plugin; >>>> module='afsocket', context='source', name='udp6' >>>> [2021-04-07T11:52:21.155846] Registering candidate plugin; >>>> module='afsocket', context='destination', name='udp6' >>>> [2021-04-07T11:52:21.155857] Registering candidate plugin; >>>> module='afsocket', context='source', name='syslog' >>>> [2021-04-07T11:52:21.155860] Registering candidate plugin; >>>> module='afsocket', context='destination', name='syslog' >>>> [2021-04-07T11:52:21.155863] Registering candidate plugin; >>>> module='afsocket', context='source', name='network' >>>> [2021-04-07T11:52:21.155865] Registering candidate plugin; >>>> module='afsocket', context='destination', name='network' >>>> [2021-04-07T11:52:21.155867] Registering candidate plugin; >>>> module='afsocket', context='source', name='systemd-syslog' >>>> [2021-04-07T11:52:21.155886] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libafprog.so', >>>> module='afprog' >>>> [2021-04-07T11:52:21.155979] Registering candidate plugin; >>>> module='afprog', context='source', name='program' >>>> [2021-04-07T11:52:21.155986] Registering candidate plugin; >>>> module='afprog', context='destination', name='program' >>>> [2021-04-07T11:52:21.156000] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libaffile.so', >>>> module='affile' >>>> [2021-04-07T11:52:21.156140] Registering candidate plugin; >>>> module='affile', context='source', name='file' >>>> [2021-04-07T11:52:21.156176] Registering candidate plugin; >>>> module='affile', context='source', name='pipe' >>>> [2021-04-07T11:52:21.156181] Registering candidate plugin; >>>> module='affile', context='source', name='wildcard_file' >>>> [2021-04-07T11:52:21.156184] Registering candidate plugin; >>>> module='affile', context='source', name='stdin' >>>> [2021-04-07T11:52:21.156187] Registering candidate plugin; >>>> module='affile', context='destination', name='file' >>>> [2021-04-07T11:52:21.156189] Registering candidate plugin; >>>> module='affile', context='destination', name='pipe' >>>> [2021-04-07T11:52:21.156209] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', >>>> fname='libadd-contextual-data.so', module='add-contextual-data' >>>> [2021-04-07T11:52:21.156308] Registering candidate plugin; >>>> module='add-contextual-data', context='parser', >>>> name='add_contextual_data' >>>> [2021-04-07T11:52:21.156434] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/apache/apache.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.156450] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/checkpoint/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.156674] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/checkpoint/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.156687] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/cisco/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.156832] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/cisco/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.156841] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/collectd/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.156931] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/collectd/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.156943] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/default-network-drivers/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157022] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/default-network-drivers/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157029] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/graphite/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157074] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/graphite/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157078] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/hdfs/plugin.conf', depth='2' >>>> [2021-04-07T11:52:21.157107] Included file was skipped because of a >>>> missing module; module='mod-java', >>>> location='/usr/share/syslog-ng/include/scl/hdfs/plugin.conf:24:1' >>>> [2021-04-07T11:52:21.157109] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/hdfs/plugin.conf', depth='2' >>>> [2021-04-07T11:52:21.157114] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/iptables/iptables.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157173] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/iptables/iptables.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157179] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/junos/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157232] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/junos/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157236] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/kafka/kafka-java.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157262] Included file was skipped because of a >>>> missing module; module='mod-java', >>>> location='/usr/share/syslog-ng/include/scl/kafka/kafka-java.conf:24:1' >>>> [2021-04-07T11:52:21.157264] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/kafka/kafka-java.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157269] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/kafka/kafka.conf', depth='2' >>>> [2021-04-07T11:52:21.157309] Global value changed; >>>> define='kafka-implementation', value='kafka-java' >>>> [2021-04-07T11:52:21.157328] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/kafka/kafka.conf', depth='2' >>>> [2021-04-07T11:52:21.157336] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/linux-audit/linux-audit.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157375] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/linux-audit/linux-audit.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157379] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/loadbalancer/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157493] Module loaded and initialized >>>> successfully; module='confgen' >>>> [2021-04-07T11:52:21.157512] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/loadbalancer/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157519] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/mbox/mbox.conf', depth='2' >>>> [2021-04-07T11:52:21.157559] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/mbox/mbox.conf', depth='2' >>>> [2021-04-07T11:52:21.157565] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157597] Included file was skipped because of a >>>> missing module; module='pacctformat', >>>> location='/usr/share/syslog-ng/include/scl/pacct/plugin.conf:24:1' >>>> [2021-04-07T11:52:21.157600] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157605] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/paloalto/panos.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157905] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/paloalto/panos.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157919] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/rewrite/cc-mask.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157969] Global value changed; >>>> define='balabit.credit-card-regexp', >>>> value='(:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|6(?:011|5[0-9][0-9])[0-9]{12}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|(?:2131|1800|35d{3})d{11})' >>>> [2021-04-07T11:52:21.157998] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/rewrite/cc-mask.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.158007] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/snmptrap/snmptrapd-source.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.158073] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/snmptrap/snmptrapd-source.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.158079] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/solaris/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.158120] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/solaris/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.158131] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/sudo/sudo.conf', depth='2' >>>> [2021-04-07T11:52:21.161593] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/sudo/sudo.conf', depth='2' >>>> [2021-04-07T11:52:21.161620] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/sumologic/sumologic.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.161724] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/sumologic/sumologic.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.161729] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.161803] Module loaded and initialized >>>> successfully; module='confgen' >>>> [2021-04-07T11:52:21.161808] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.161815] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.161853] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.161860] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/websense/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.161951] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/websense/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.161964] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/windowseventlog/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.162008] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/windowseventlog/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.162024] Global value changed; >>>> define='java-module-dir', value='/usr/lib64/syslog-ng/java-modules' >>>> [2021-04-07T11:52:21.162028] Finishing include; >>>> filename='/etc/syslog-ng/scl.conf', depth='1' >>>> [2021-04-07T11:52:21.162157] Module loaded and initialized >>>> successfully; module='system-source' >>>> [2021-04-07T11:52:21.162188] system(): Enabling Linux kernel log >>>> device; device='/dev/kmsg', format='linux-kmsg' >>>> [2021-04-07T11:52:21.162403] Module loaded and initialized >>>> successfully; module='afsocket' >>>> [2021-04-07T11:52:21.162936] Module loaded and initialized >>>> successfully; module='affile' >>>> [2021-04-07T11:52:21.163175] Module loaded and initialized >>>> successfully; module='kvformat' >>>> [2021-04-07T11:52:21.163192] Finishing include; content='block >>>> parser iptables-parser() at >>>> /usr/share/syslog-ng/include/scl/iptables/iptables.conf:23', depth='3' >>>> [2021-04-07T11:52:21.163568] Module loaded and initialized >>>> successfully; module='csvparser' >>>> [2021-04-07T11:52:21.164457] Finishing include; content='block >>>> parser panos-parser() at >>>> /usr/share/syslog-ng/include/scl/paloalto/panos.conf:29', depth='3' >>>> [2021-04-07T11:52:21.164880] Module loaded and initialized >>>> successfully; module='basicfuncs' >>>> [2021-04-07T11:52:21.164936] Finishing include; content='block >>>> parser sudo-parser() at >>>> /usr/share/syslog-ng/include/scl/sudo/sudo.conf:23', depth='3' >>>> [2021-04-07T11:52:21.164995] Finishing include; content='parser >>>> generator app-parser', depth='2' >>>> [2021-04-07T11:52:21.165016] Finishing include; content='source >>>> generator system', depth='1' >>>> [2021-04-07T11:52:21.165525] Module loaded and initialized >>>> successfully; module='syslogformat' >>>> [2021-04-07T11:52:21.165711] Module loaded and initialized >>>> successfully; module='linux-kmsg-format' >>>> [2021-04-07T11:52:21.165966] Running application hooks; hook='1' >>>> [2021-04-07T11:52:21.165971] Running application hooks; hook='6' >>>> [2021-04-07T11:52:21.165984] syslog-ng starting up; version='3.30.1' >>>> [2021-04-07T11:52:21.165989] Running application hooks; hook='2' >>>> [2021-04-07T11:52:39.961046] Running application hooks; hook='3' >>>> [2021-04-07T11:52:39.961090] syslog-ng shutting down; version='3.30.1' >>>> [2021-04-07T11:52:40.061679] Running application hooks; hook='4' >>>> ----------------------------------------------------------------------------- >>>> >>>> On 4/7/2021 4:51 AM, Balazs Scheidler wrote: >>>> >>>>> can you start syslog-ng in the foreground and look at the startup >>>>> messages? >>>>> >>>>> e.g. stop the background process (via systemd or your init >>>>> system), and run syslog-ng from a root prompt: >>>>> >>>>> # /usr/sbin/syslog-ng -Fedv >>>>> >>>>> This should start syslog-ng in the foreground (-F), direct >>>>> internal messages to stderr (-e), and enable debug/verbose >>>>> messages. Then look at the messages to see if syslog-ng is >>>>> complaining about your configuration or not. >>>>> >>>>> Cheers, >>>>> Bazsi >>>>> >>>>> >>>>> On Wed, Apr 7, 2021 at 9:08 AM Dan Egli <dan(a)newideatest.site> >>>>> <mailto:dan@newideatest.site> wrote: >>>>> >>>>>> Don't know how that slipped in there. And syslog-ng never >>>>>> mentioned it. It's fixed now, and the behavior is unchanged. sshd >>>>>> messages still appear in /var/log/messages. >>>>>> >>>>>> >>>>>> On 4/7/2021 12:55 AM, Balazs Scheidler wrote: >>>>>> >>>>>>> >>>>>>> >>>>>>> On Wed, Apr 7, 2021, 08:06 Dan Egli <dan(a)newideatest.site> >>>>>>> <mailto:dan@newideatest.site> wrote: >>>>>>> >>>>>>>> No joy. I tried swapping it different ways. >>>>>>>> >>>>>>>> filter -> source -> destination = combined >>>>>>>> source -> filter -> destination = combined >>>>>>>> >>>>>>>> Here's what my config looks like now, after the second variant: >>>>>>>> >>>>>>>> @version: 3.30 >>>>>>>> >>>>>>>> @include "scl.conf" >>>>>>>> >>>>>>>> options { >>>>>>>> threaded(yes); >>>>>>>> chain_hostnames(no); >>>>>>>> stats_freq(43200); >>>>>>>> mark_freq(3600); >>>>>>>> }; >>>>>>>> >>>>>>>> source src { system(); internal(); }; >>>>>>>> >>>>>>>> filter samba { program("samba"); }; >>>>>>>> filter ssh_messages { facility("AUTH") and level("INFO"); }; >>>>>>>> filter syslog { not filter("ssh_messages") and not >>>>>>>> filter("samba"); }; >>>>>>>> >>>>>>>> destination console { file("/dev/tty12"); }; >>>>>>>> destination messages { file("/var/log/messages"); }; >>>>>>>> destination sshd_log { file("/var/log/sshd/sshd.log"); }; >>>>>>>> destination smb_logs { file("/var/log/samba/samba.log"); }; >>>>>>>> >>>>>>>> log { source(src); filter(samba); destination(smb_logs); >>>>>>>> flags(final); ); >>>>>>>> >>>>>>> >>>>>>> You are using a closing paren instead of a brace. This config >>>>>>> has a syntax error. Possibly syslog-ng falled back to the >>>>>>> original config, once it reported a syntax error. >>>>>>> >>>>>>> >>>>>>> >>>>>>>> log { source(src); filter(ssh_messages); destination(sshd_log); >>>>>>>> flags(final); }; >>>>>>>> log { source(src); filter(syslog); destination(console); }; >>>>>>>> log { source(src); filter(syslog); destination(messages); }; >>>>>>>> >>>>>>>> >>>>>>>> Still, sshd messages are appearing in /var/log/messages. >>>>>>>> >>>>>>>> On 4/6/2021 11:51 PM, Peter Kokai (pkokai) wrote: >>>>>>>> > Hello, >>>>>>>> > >>>>>>>> > The order in the configuration matters. >>>>>>>> > log { source(src); destination(console); filter(syslog); }; >>>>>>>> > The message flow is the following in your example source(src) >>>>>>>> -> destination(console) -> filter(syslog) -> void >>>>>>>> > The filter recieves messages only after destination, if you >>>>>>>> switch filter and destination it should be fine. >>>>>>>> > >>>>>>>> > -- >>>>>>>> > kokan >>>>>>>> > >>>>>>>> > ________________________________________ >>>>>>>> > From: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu >>>>>>>> <mailto:syslog-ng-bounces@lists.balabit.hu>> on behalf of Dan >>>>>>>> Egli <dan(a)newideatest.site> <mailto:dan@newideatest.site> >>>>>>>> > Sent: 07 April 2021 07:17 >>>>>>>> > To: syslog-ng(a)lists.balabit.hu >>>>>>>> <mailto:syslog-ng@lists.balabit.hu> >>>>>>>> > Subject: [syslog-ng] Syslog-ng not honoring negative flag >>>>>>>> > >>>>>>>> > CAUTION: This email originated from outside of the >>>>>>>> organization. Do not follow guidance, click links, or open >>>>>>>> attachments unless you recognize the sender and know the >>>>>>>> content is safe. >>>>>>>> > >>>>>>>> > >>>>>>>> > I'm having a bit of a problem and hope someone here can help. >>>>>>>> I'm trying >>>>>>>> > to separate individual items into specific logs, i.e. ssh >>>>>>>> events in >>>>>>>> > sshd.log, samba messages in samba.log, etc... >>>>>>>> > >>>>>>>> > I managed to come up with filters that pull out the events I >>>>>>>> started >>>>>>>> > with, and they are going into the correct log files. But they >>>>>>>> are ALSO >>>>>>>> > going into /var/log/messages even though I specifically have >>>>>>>> a filter on >>>>>>>> > that one that says not to include samba or sshd events. I'll >>>>>>>> copy my >>>>>>>> > config file here. Hopefully someone can tell me what I did wrong. >>>>>>>> > >>>>>>>> > Thanks! >>>>>>>> > >>>>>>>> > --------------------------------------------- >>>>>>>> > @version: 3.30 >>>>>>>> > >>>>>>>> > @include "scl.conf" >>>>>>>> > >>>>>>>> > options { >>>>>>>> > threaded(yes); >>>>>>>> > chain_hostnames(no); >>>>>>>> > stats_freq(43200); >>>>>>>> > mark_freq(3600); >>>>>>>> > }; >>>>>>>> > >>>>>>>> > source src { system(); internal(); }; >>>>>>>> > >>>>>>>> > filter samba { program("samba"); }; >>>>>>>> > filter ssh_messages { facility("AUTH") and level("INFO"); }; >>>>>>>> > filter syslog { not filter("ssh_messages") and not >>>>>>>> filter("samba"); }; >>>>>>>> > >>>>>>>> > destination console { file("/dev/tty12"); }; >>>>>>>> > destination messages { file("/var/log/messages"); }; >>>>>>>> > destination sshd_log { file("/var/log/sshd/sshd.log"); }; >>>>>>>> > destination smb_logs { file("/var/log/samba/samba.log"); }; >>>>>>>> > >>>>>>>> > log { source(src); destination(smb_logs); filter(samba); >>>>>>>> flags(final); ); >>>>>>>> > log { source(src); destination(sshd_log); filter(ssh_messages); >>>>>>>> > flags(final); }; >>>>>>>> > log { source(src); destination(console); filter(syslog); }; >>>>>>>> > log { source(src); destination(messages); filter(syslog); }; >>>>>>>> > >>>>>>>> > >>>>>>>> ______________________________________________________________________________ >>>>>>>> > Member info: >>>>>>>> https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.bal… >>>>>>>> <https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.bal…> >>>>>>>> > Documentation: >>>>>>>> https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabi… >>>>>>>> <https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabi…> >>>>>>>> > FAQ: >>>>>>>> https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabi… >>>>>>>> <https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabi…> >>>>>>>> > >>>>>>>> > >>>>>>>> ______________________________________________________________________________ >>>>>>>> > Member info: >>>>>>>> https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>>>>>> <https://lists.balabit.hu/mailman/listinfo/syslog-ng> >>>>>>>> > Documentation: >>>>>>>> http://www.balabit.com/support/documentation/?product=syslog-ng >>>>>>>> <http://www.balabit.com/support/documentation/?product=syslog-ng> >>>>>>>> > FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>>>>>>> <http://www.balabit.com/wiki/syslog-ng-faq> >>>>>>>> > >>>>>>>> ______________________________________________________________________________ >>>>>>>> Member info: >>>>>>>> https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>>>>>> <https://lists.balabit.hu/mailman/listinfo/syslog-ng> >>>>>>>> Documentation: >>>>>>>> http://www.balabit.com/support/documentation/?product=syslog-ng >>>>>>>> <http://www.balabit.com/support/documentation/?product=syslog-ng> >>>>>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>>>>>>> <http://www.balabit.com/wiki/syslog-ng-faq> >>>>>>>> >>>>>>>> >>>>>>> >>>>>>> ______________________________________________________________________________ >>>>>>> Member info:https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> >>>>>>> Documentation:http://www.balabit.com/support/documentation/?product=syslog-… <http://www.balabit.com/support/documentation/?product=syslog-ng> >>>>>>> FAQ:http://www.balabit.com/wiki/syslog-ng-faq <http://www.balabit.com/wiki/syslog-ng-faq> >>>>>>> >>>>>> >>>>> >>>>> >>>>> -- >>>>> Bazsi >>>> ______________________________________________________________________________ >>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>> <https://lists.balabit.hu/mailman/listinfo/syslog-ng> >>>> Documentation: >>>> http://www.balabit.com/support/documentation/?product=syslog-ng >>>> <http://www.balabit.com/support/documentation/?product=syslog-ng> >>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>>> <http://www.balabit.com/wiki/syslog-ng-faq> >>>> >>>> >>> >>> ______________________________________________________________________________ >>> Member info:https://lists.balabit.hu/mailman/listinfo/syslog-ng >>> Documentation:http://www.balabit.com/support/documentation/?product=syslog-… >>> FAQ:http://www.balabit.com/wiki/syslog-ng-faq >>> ______________________________________________________________________________ >>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>> <https://lists.balabit.hu/mailman/listinfo/syslog-ng> >>> Documentation: >>> http://www.balabit.com/support/documentation/?product=syslog-ng >>> <http://www.balabit.com/support/documentation/?product=syslog-ng> >>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>> <http://www.balabit.com/wiki/syslog-ng-faq> >>> >> >> >> ______________________________________________________________________________ >> Member info:https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation:http://www.balabit.com/support/documentation/?product=syslog-… >> FAQ:http://www.balabit.com/wiki/syslog-ng-faq >>

1 0

closing inactive or idle incoming connections
by Evan Rempel 07 Apr '21

07 Apr '21

Using syslog-ng 3.26 at the moment but can use the latest if the options are available or easier. Is there a way to configure the idle timeout for incoming connections. I have a use case where we want to log from a mobile work force, which can be anywhere on the internet. This means that our syslog server needs to be open to the internet. The bad guys are connecting to our port and not sending anything, just tying up the port. The port requires a certificate so is "safe", however, the connection is consumed for approx 2 hours before syslog-ng dropes the connection with syslog-ng[22490]: Error reading RFC6587 style framed data; fd='3769', error='Connection timed out (110)' syslog-ng[22490]: Syslog connection closed; fd='4509', client='AF_INET()', local='AF_INET()' Is there a way to configure syslog-ng to drop the connection if it does not receive the certificate in 60 seconds? Is there a way to configure syslog-ng to drop the connection if no syslog messages are received in 10 minutes? Thanks, -- Evan

2 1

syslog-ng has add extra field
by Ivan Nepryahin - Bercut 26 Mar '21

26 Mar '21

Hi all! I think I have a stupid question, but I really dont know how this make. Situation: When I send syslog message with timestamp in format "1Mar 25 2021 16:35:49" everything works great, but when I send message with timestamp in format "1Mar 25 2021 16:35:49+03:00", syslog-ng adding two extra fields with timestamp and IP address and due that break down file naming. Question: How can I say to syslog-ng server do not add extra fields when he get message with +03:00 in timestamp? message without +03:00 Mar 25 13:11:57 HUAWEI-CORE-OFFICE-1 <bla bla bal> mesage with +03:00 Mar 25 13:46:45 192.168.100.34 Mar 25 2021 16:46:45+03:00 HUAWEI-CORE-OFFICE-1 <bla bla bla> I will be appreciate for any advice! P.s sorry for bad english it is not my native language best regards, Nepryahin Ivan IT Department Phone: +7 812 327 32 33 Mobile: +7 911 291 81 68

3 8

how syslog-ng users handle sflow in their environmen
by Ali Okan Yuksel 25 Mar '21

25 Mar '21

Hi team, How we can collect sflow messages and feed to syslog-ng? I found a project but I am not sure that if this project can be used for feeding syslog-ng https://github.com/sflow/sflowtool/ I want to get sflow traffic from A10 cgnat solution and feed it as syslog. What are your suggestions? I want to use open-source tools. -- http://www.siyahsapka.org

2 1