- syslog-ng - lists.balabit.hu

Fedora 44, CentOS 7 and Amazon Linux syslog-ng questions
by Peter Czanik (pczanik) 19 May '26

19 May '26

Hi, This is a repost of my blog from last week, here on the mailing list. I need your feedback on CentOS 7 and Amazon Linux 2023 packages. You can respond here, or even better: at the URL at the end of my e-mail. Peter Fedora 44 was announced last week: syslog-ng 4.11 is part of it. While checking the Fedora Copr build service for Fedora 44, I realized that CentOS 7 and Amazon Linux 2023 packages are also there. I have a few questions about those for you! Fedora 44 The availability of the Fedora 44 release was announced last week. Vesion 4.11 of syslog-ng, the current latest release, is part of it. As usual, I did a quick test: everything works as expected. RHEL 6 The removal of RHEL 6 packages from Copr was announced many years ago. Then, the countdown was silently canceled. I have just checked: RHEL 6 packages are no longer available, so I deleted all my related repositories. Also, I deleted a couple of temporary test repos along the way. CentOS 7 When talking to product manager friends around the world, I realized that syslog-ng is not an “enterprise” application. “Enterprise” developers are still actively maintaining packages for RHEL 6, when even RHEL 7 has reached end of life a long time ago. Of course, this is just a satirical definition of “enterprise”, at least in my view… Support for RHEL 7 / CentOS 7 was dropped in syslog-ng a month before the distro became end-of-life. Copr announced the deletion of CentOS 7 packages, but after a while, the countdown suddenly disappeared. Packages built 10+ years ago are still here, and CentOS 7 is still a valid build target. Question: is there anyone still using my syslog-ng packages on RHEL 7 / CentOS 7? Otherwise, I would be happy to delete anything related from my Copr repositories. I could delete many repositories, save storage, and I would not have to deselect them as a build target during package builds. Amazon Linux 2023 Another question mark in my mind is Amazon Linux 2023 support. If we can believe the download statistics provided by Copr, then this is one of the most popular syslog-ng repos on Copr. However, over the years, I only received a single feedback about it, which was on Twitter years ago: “Thanks, I use it.” That is all. While there were regular requests to create these packages, nobody asked for features, updates, whatever. The repo is still stuck at syslog-ng version 4.8. Question: should I update syslog-ng to a more recent version, as time permits? What is next? Share your thoughts with us in this syslog-ng GitHub discussion: https://github.com/syslog-ng/syslog-ng/discussions/5691 or reach out to me on Twitter / Mastodon / LinkedIn. Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> One Identity (Balabit) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

The syslog-ng Insider 2026-05: OTEL; central log collection; old Mac
by Peter Czanik (pczanik) 14 May '26

14 May '26

Dear syslog-ng users, This is the 140th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Streaming syslog-ng data to your lakehouse using OTEL Version 4.11.0 of syslog-ng contains contributions from Databricks related to OAuth2 authentication. Recently, they published a blog about how this enables their customers to send logs to their data lake using syslog-ng and the OpenTelemetry protocol. https://www.syslog-ng.com/community/b/blog/posts/streaming-syslog-ng-data-t… Central log collection - more than just compliance I often hear, even at security conferences that “no central log collection here” or “we have something due to compliance”. Central logging is more than just compliance. It makes logs easier to use, available and secure, thus making your life easier in operations, security, development, but also in marketing, sales, and so on. https://www.syslog-ng.com/community/b/blog/posts/central-log-collection---m… Compiling syslog-ng on an old Mac I have an aging, but fully functional MacBook. I bought it for syslog-ng testing, but I also use for watching movies. Homebrew no more fully supports old, Intel-based Macs. This blog helps to compile the latest syslog-ng release on these old, but otherwise functional machines. https://www.syslog-ng.com/community/b/blog/posts/compiling-syslog-ng-on-an-… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> One Identity (Balabit) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

The syslog-ng Insider 2026-04: wildcard-file; fix; UDP
by Peter Czanik (pczanik) 08 Apr '26

08 Apr '26

Dear syslog-ng users, This is the 138th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Automatic configuration of the syslog-ng wildcard-file() source Reading files and monitoring directories became a lot more efficient in recent syslog-ng releases. However, it is also needed manual configuration. Version 4.11 of syslog-ng can automatically configure the optimal setting for both. https://www.syslog-ng.com/community/b/blog/posts/automatic-configuration-of… What to fix next in syslog-ng? Version 4.11 of syslog-ng will feature a brand-new Kafka source. While it is being tested and reviewed, we are working on reducing the number of open issues. What should be fixed next? https://www.syslog-ng.com/community/b/blog/posts/what-to-fix-next-in-syslog… UDP reliability improved in syslog-ng Debian packaging UDP log collection is a legacy feature that does not provide any security or reliability, but is still in wide use. You can improve its reliability using eBPF on Linux in recent syslog-ng versions. Support for eBPF was added to Debian packages while preparing for the 4.11.0 syslog-ng release. https://www.syslog-ng.com/community/b/blog/posts/udp-reliability-improved-i… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> One Identity (Balabit) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Syslogd in pfSense Community Edition Firewall version 2.8.1 Stops Sending Firewall Logs to Kiwi Syslog Server Every 7-8 days
by Turritopsis Dohrnii Teo En Ming 31 Mar '26

31 Mar '26

Subject: Syslogd in pfSense Community Edition Firewall version 2.8.1 Stops Sending Firewall Logs to Kiwi Syslog Server Every 7-8 days Good day from Singapore, I have a pfSense Community Edition Firewall version 2.8.1 at home. It is based on FreeBSD 15.0-CURRENT. My firewall hardware appliance has Intel Celeron J4125 CPU, 8 GB RAM and 64 GB of SSD. Now, every 7-8 days, syslogd in my pfsense firewall will stop sending firewall logs to Kiwi Syslog Server. I have already done my due diligence checks. There is nothing wrong with the Kiwi Syslog Server on my Windows 11 Home edition computer. Syslogd in my pfsense firewall will simply stop sending firewall logs to Kiwi Syslog Server every 7-8 days. I have to manually restart syslogd in pfsense firewall before it will send firewall logs to Kiwi Syslog Server again. How can I troubleshoot the problem in such a situation given there are no logging? Thank you in advance for your advice. Regards, Mr. Turritopsis Dohrnii Teo En Ming Extremely Democratic People's Republic of Singapore 31 Mar 2026 Tuesday 11.30 pm Singapore Time

1 0

The syslog-ng Insider 2026-03: 4.11.0 release; OpenSearch; ElasticSearch
by Peter Czanik (pczanik) 11 Mar '26

11 Mar '26

Dear syslog-ng users, This is the 138th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Version 4.11.0 of syslog-ng is now available Version 4.11.0 of syslog-ng is now available. The main attraction is the brand new Kafka source, but there are many other smaller features and improvements, as well. https://www.syslog-ng.com/community/b/blog/posts/version-4-11-0-of-syslog-n… Using OpenSearch data streams in syslog-ng Recently, one of our power users contributed OpenSearch data streams support to syslog-ng, which reminded me to also do some minimal testing on the latest OpenSearch release with syslog-ng. TL;DR: both worked just fine. https://www.syslog-ng.com/community/b/blog/posts/using-opensearch-data-stre…<https://www.syslog-ng.com/community/b/blog/posts/using-the-blank-filter-of-…> Changes in the syslog-ng Elasticsearch destination While testing the latest Elasticsearch release with syslog-ng, I realized that there was already a not fully documented elasticsearch-datastream() driver. Instead of fixing the docs, I reworked the elasticsearch-http() destination to support data streams. So, what was the problem? The driver follows a different logic in multiple places than the base elasticsearch-http() destination driver. Some of the descriptions were too general, others were missing completely. You had to read the configuration file in the syslog-ng configuration library (SCL) to configure the destination properly. While preparing for syslog-ng 4.11.0, the OpenSearch destination received a change that allows support for data streams. I applied these changes to the elasticsearch-http() destination, and did a small compatibility change along the way, so old configurations and samples from blogs work. https://www.syslog-ng.com/community/b/blog/posts/changes-in-the-syslog-ng-e… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> One Identity (Balabit) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng version 4.11.0 is now available
by Peter Czanik (pczanik) 25 Feb '26

25 Feb '26

Hi, I'm happy to share that syslog-ng version 4.11.0 is now available. 4.11.0 syslog-ng provides RPM<https://github.com/syslog-ng/syslog-ng#rhel> and DEB<https://github.com/syslog-ng/syslog-ng#debianubuntu> package repositories for Ubuntu, Debian, and RHEL, for both amd64 and arm64 architectures. We also provide ready-to-test binaries in Docker containers<https://hub.docker.com/r/balabit/syslog-ng/tags> based on the current stable Debian image. For more details, visit our Documentation Center<https://syslog-ng.github.io/> Highlights * kafka-source(): The new kafka() source can directly fetch log messages from the Apache Kafka message bus using the librdkafka client. It can fetch messages from explicitly named or wildcard-matching Kafka topics, and from a single partition, explicitly listed partitions, or all partitions of the selected topic(s). It supports the two main strategies — assign and subscribe — providing the flexibility to adapt to a wide range of Kafka setups and practical use cases, instead of forcing a single approach that may not fit all scenarios. It can fetch and process messages from the Kafka broker using multiple workers(), which may further improve throughput, especially when the main worker can fetch messages at high speed. For more details<https://syslog-ng.github.io/admin-guide/060_Sources/038_Kafka/README> and for all available options<https://syslog-ng.github.io/admin-guide/060_Sources/038_Kafka/001_Kafka_opt…>, please see our documentation. (#5564<https://github.com/syslog-ng/syslog-ng/pull/5564>) Features * cloud-auth: Add generic OAuth2 authentication module A generic OAuth2 authentication module supporting client credentials flow with configurable authentication methods (HTTP Basic Auth or POST body credentials) has been added. The module is extensible via virtual methods, allowing future authenticators to inherit common OAuth2 token management logic. (#5571<https://github.com/syslog-ng/syslog-ng/pull/5571>) * cloud-auth, grpc: Add OAuth2 support for gRPC destinations The cloud-auth() plugin now supports gRPC destinations in addition to HTTP destinations. This enables OAuth2 token management for any gRPC-based destination driver (such as bigquery(), opentelemetry(), loki(), etc.). The implementation uses the same signal/slot pattern as HTTP. Example configuration: destination d_grpc { opentelemetry( url("example.com:443") cloud-auth( oauth2( client_id("client-id") client_secret("client-secret") token_url("https://auth.example.com/token") scope("api-scope") ) ) ); } (#5584<https://github.com/syslog-ng/syslog-ng/pull/5584>) * darwinosl(): Added (fixed in an alternative way and enabled) the log-fetch-limit() option, which allows batched message forwarding in the log path. The fetch-delay() and fetch-retry-delay() options have both been renamed with the log- prefix; the old keywords are still supported but marked as deprecated. The enhanced internal loop for OSLog message processing now uses fewer resources during both processing and idle time. (#5547<https://github.com/syslog-ng/syslog-ng/pull/5547>) * network-load-balancer: add support for failover The confgen script for network-load-balancer now supports failover, generating the list of failover servers for each destination automatically. (#5562<https://github.com/syslog-ng/syslog-ng/pull/5562>) * file(), wildcard-file() source: Add auto follow-method() option A new follow-method() option, auto, has been added. In this automatic mode, syslog-ng OSE uses the following sequence to decide which method to use: Unfortunately, for backward compatibility reasons, the new auto option could not become the default at this time, but for new configurations, we recommend using monitor-method("auto") and follow-method("auto") to achieve the best available performance on the given platform. (#5602<https://github.com/syslog-ng/syslog-ng/pull/5602>) * the inotify method is used automatically if the system supports it (and none of the IV_SELECT_POLL_METHOD or IV_EXCLUDE_POLL_METHOD environment variables are set); otherwise * the best available (or the IV_SELECT_POLL_METHOD or IV_EXCLUDE_POLL_METHOD forced) system (ivykis) poll method of the platform is used; if none is available, * the old poll method is used * network()/syslog(): Add extended-key-usage-verify() option to TLS sources and destinations (#5588<https://github.com/syslog-ng/syslog-ng/pull/5588>) * Number parsing: Improve @NUMBER@ / @DOUBLE@ support for signed numbers When parsing numbers using the @NUMBER@ or @DOUBLE@ pattern parsers, certain signs were not allowed, causing PatternDB to reject properly formatted numbers. Explicit + signs at the beginning of a number or in the exponent part were rejected, and a - sign before a hexadecimal value was also not accepted. (#5620<https://github.com/syslog-ng/syslog-ng/pull/5620>) * elasticsearch, opensearch: Update SCL to support data streams (#5586<https://github.com/syslog-ng/syslog-ng/pull/5586>) * elasticsearch-http() and opensearch() now support data streams when using the op_type("create") parameter * the type("") parameter can now be omitted, and its value is silently ignored Bugfixes * json-parser: Fixed quoting of JSON array elements containing commas. (#5604<https://github.com/syslog-ng/syslog-ng/pull/5604>) * transport(proxied-tcp): Fixed an internal assertion–caused crash when a Proxy Protocol v2 message was received with a LOCAL command that was not handled previously. LOCAL commands are now treated as health check messages for both v1 and v2 proxy messages — accepted but dropped — as the protocol definition<https://github.com/syslog-ng/syslog-ng/blob/syslog-ng-4.11.0/www.haproxy.or…> specifies. (#5608<https://github.com/syslog-ng/syslog-ng/pull/5608>) * afsocket-source: Fixed two keep-alive() configuration reload–related issues. First, when a reload switched from keep-alive(yes) to keep-alive(no) with so-reuseport(no), the newly loaded configuration’s socket instance could fail to open. Second, in case of an error in the new configuration, the reload could fail to properly restore the previous connection state. (#5552<https://github.com/syslog-ng/syslog-ng/pull/5552>) * log-transport-tls: TLS-related macros, such as ${tls.x509_cn}, were not set in the first log message. (#5603<https://github.com/syslog-ng/syslog-ng/pull/5603>) * stats: Fixed stats reset memory counter underflow. (#5563<https://github.com/syslog-ng/syslog-ng/pull/5563>) * afsocket-source: Added a workaround for an issue where a reload switches from keep-alive(yes) to keep-alive(no) with so-reuseport(no), causing the newly loaded configuration’s socket instance to fail to open. (#5552<https://github.com/syslog-ng/syslog-ng/pull/5552>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: AshFungor, Bálint Horváth, Peter Czanik (CzP), davidtosovic-db, egglessness, Daniele Ferla, Hofi, Tamas Pal, Romain Tartière, Fᴀʙɪᴇɴ Wᴇʀɴʟɪ — This release has 3 assets: * syslog-ng-4.11.0.tar.gz * Source code (zip) * Source code (tar.gz) Visit the release page<https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.11.0> to download them. Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Plans for next release?
by David Tosovic 24 Feb '26

24 Feb '26

Hi all, I'm currently building syslog-ng from source as I'm utilizing some recent changes that are not in 4.10.2. I'm wondering if the next release is scheduled soon? Thanks, David

2 4

The syslog-ng Insider 2026-02: stats-exporter; blank filter; Kafka source
by Peter Czanik (pczanik) 12 Feb '26

12 Feb '26

Dear syslog-ng users, This is the 137th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS The syslog-ng stats-exporter() now has all functionality of syslog-ng-ctl The syslog-ng stats-exporter() allows you to collect syslog-ng statistics using Prometheus. Version 4.10 of syslog-ng added options to ensure that all related options of syslog-ng-ctl are now available in stats-exporter() too. https://www.syslog-ng.com/community/b/blog/posts/the-syslog-ng-stats-export… Using the blank() filter of syslog-ng The blank() filter is a filter function with a descriptive name: it selects empty or undefined name-value pairs. While most of the functionalities that blank filter provides are available long time ago, using this new filter makes configurations easier to understand. https://www.syslog-ng.com/community/b/blog/posts/using-the-blank-filter-of-… How to test the syslog-ng Kafka source by building the package yourself? A long-waited feature for syslog-ng, the Kafka source, is getting ready soon. The development is still in progress, but you can already try it, and it is worth the effort. How? Using the very same tool the syslog-ng testing and release process relies on. https://www.syslog-ng.com/community/b/blog/posts/how-to-test-the-syslog-ng-… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

iptables.log
by A 28 Dec '25

28 Dec '25

How to exclude such lines from logging? IN=net0 OUT= SRC=xxx.xxx.xxx.xxx DST=xxx.xxx.xxx.xxx LEN=xx TOS=0xxx PREC=0xxx TTL=xx ID=xxxx DF PROTO=xxx SPT=xxxx DPT=137 WINDOW=xxxxx RES=0xxx XXX URGP=X --

3 6

The syslog-ng Insider 2025-12: logrotation; release RPM; nightly RPM
by Peter Czanik (pczanik) 11 Dec '25

11 Dec '25

Dear syslog-ng users, This is the 136th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS File size-based log rotation in syslog-ng ----------------------------------------- Version 4.10 of syslog-ng introduced file size-based log rotation. Thanks to this, storage space is no longer filled with logs with the risk that you might not see older logs if the message rate is higher than expected. https://www.syslog-ng.com/community/b/blog/posts/file-size-based-log-rotati… Syslog-ng release packages for RHEL & Co. ----------------------------------------- I’ve been providing syslog-ng users release RPM packages for almost a decade now. However, from now on, RHEL & Co users can use packages provided directly by the syslog-ng team from a lot less obscure location. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-release-packages… Nightly syslog-ng RPM packages for RHEL & Co. --------------------------------------------- I have been providing syslog-ng users with weekly git snapshot RPM packages for almost a decade. From now on, RHEL & Co users can use nightly packages provided by the syslog-ng team, and from a lot less obscure location. As usual, these packages are for testing, not for production. https://www.syslog-ng.com/community/b/blog/posts/nightly-syslog-ng-rpm-pack… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0