- syslog-ng - lists.balabit.hu

is it possible to normalize the jSON keys to lowercase?
by Jorge Pereira 11 Jan '17

11 Jan '17

Hi, I am using the 'format-json' as my below snip. template t_raw2json { template("$(format-json --scope selected_macros \ --exclude TAGS \ --exclude DATE \ --exclude PRIORITY \ --exclude FACILITY \ --exclude PROGRAM )\n"); }; but, the problem is because sometimes I receive a jSON packet as { "Key": "value" } or {"key": "value}".... this has been a problem to my filter. e.g: destination d_nginx_modsec_log { file("/var/logs/myapp//${j.key:-invalid_key}.log" template(t_raw2json) ); }; Question: is it possible to normalize the jSON keys to lowercase? or someone has other approaches? -- Jorge Pereira

4 5

udp tuning - where to look.
by Jim Hendrick 11 Jan '17

11 Jan '17

Hi, I am working an issue with UDP drops in a high EPS rate environment (several thousand steady) and struggling with making any changes in the loss rate. (according to netstat -su | grep error). This is happening on two nodes, (one running an older syslog-ng 3.2 OSE, the other running a splunk forwarder) but I don't actually think it is making it out of the kernel to either application. On the syslog-ng side syslog-ng-ctl stats shows *no* drops at all. Increasing net.core.rmem_max and so_rcvbuf together all the way to 64 MB did not seem to make any significant difference. This is a RHEL 6 box with 16 GB and 4 cores (virtual - running in an ESX environment) Are there other parameters, things I should be looking at? Thanks, Jim

4 4

CentOS 7.2 // Syslog-ng (syslog-ng_3.6.4)
by vijay amruth 10 Jan '17

10 Jan '17

Hello guys, Happy new year!! Hope you are doing great. I've installed (compiled ) syslog-ng on CentOS Linux 7 (Core) but after I got through the install which is all good, I cant get it to start, all it says is : systemctl status syslog-ng ● syslog-ng.service Loaded: not-found (Reason: No such file or directory) Active: inactive (dead) [vch@slc ~]$ sudo systemctl enable syslog-ng Failed to execute operation: No such file or directory [vch@slc ~]$ sudo systemctl start syslog-ng Failed to start syslog-ng.service: Unit syslog-ng.service failed to load: No such file or directory. Rsyslog is not running, I can't think of any, I am I missing some simple ?????? Any help is appreciated. -- Thanks, Vijay Amrut.

5 6

Enable TLS encryption
by Sathish Sundaravel 09 Jan '17

09 Jan '17

Hi Team I have a Syslog Ng server running on Solaris and receiving events from native Solaris syslog clients. How do I enable UDP traffic pass through via TLS and how to configure client certificate for native Solaris syslog agent. We don't have rsyslog.

6 10

Adding specific information from Syslog-ng to Redis
by johnsc301＠gmail.com 07 Jan '17

07 Jan '17

I am trying to send information from Syslog-ng to Redis. In /etc/syslog-ng/syslog-ng.conf I added this: destination d_redis { redis( host("127.0.0.1") port(6379) command("RPUSH", "sensor_name", "${sensor_name}")); }; I am trying to create a list of variables, hopefully one being timestamp. Here is an example of my syslog that I am trying to pull: http://pastebin.com/Hx5vW4VA Here's is syslog-ng.conf, for reference: http://pastebin.com/2VQFBNmK Those are logs being sent from Snort to Syslog-ng through Snort. I want to connect to Redis. I saw that the command parameters are: comma-separated list of strings ("<redis-command>", "<first-command-parameter>", "<second-command-parameter>", "<third-command-parameter>") from: https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-… I'm assuming I'd say RPUSH <something>... However, I am unsure of how to find the correct parameters. Specifically, for now, I want to create a list (RPUSH) of timestamps, IP addresses (to and from), and event type (ICMP, for example). I did find this list of parameters: https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-… A good first try, I'd like to make a list of timestamps. How can I set the d_redis(command()) within syslog-ng.conf to do this? Sent from Mail for Windows 10

4 3

v3.9: Core dump on python module
by Clayton Dukes 04 Jan '17

04 Jan '17

Hey guys, just want you to know Ubuntu16 is dumping core on loading the python module. Ubuntu14 does not do this. [2017-01-01T19:54:52.576749] Module loaded and initialized successfully; module='mod-python' Segmentation fault (core dumped) -Clayton Dukes

4 16

Re: [syslog-ng] Host variable substitution in syslog-ng.conf include statement
by Broome, John P - OASAM OCIO CTR 03 Jan '17

03 Jan '17

Robert, Thanks for your reply, but we are constrained to version 3.2 for now (has to be in the RHEL EPEL). I did not see this feature discussed in the 3.2 admin guide. Is it an undocumented feature of version 3.2, or did support for system environment variables come in a later version? Thank you, JB

2 1

Host variable substitution in syslog-ng.conf include statement
by Broome, John P - OASAM OCIO CTR 03 Jan '17

03 Jan '17

I am supporting a large number of syslog-ng hosts and we manage the configuration files with gitlab. I have been trying to figure out how to reference a variable based on hostname in the syslog-ng.conf file on each machine. For example, I would like to be able to have an include statement based on hostname - this would allow our common repository to have an exception set of filters/rules for each host but to use the exact same syslog-ng.conf file everywhere: ################################## syslog-ng.conf ########################################### @version: 3.2 Include "`hostname`.conf" ... Is there a way to accomplish this in version 3.2 (if not, does it appear in a later version)? We are restricted to EPEL6 included versions of syslog-ng, so that's why we're at version 3.2 - JB

2 1

Re: [syslog-ng] When is 3.8.2 scheduled?
by Balazs Scheidler 23 Dec '16

23 Dec '16

Well, you would want to backport 3.8.2 into existing distro releases? Because openssl 1.1 is I thought relevant to the bleeding edge. On Dec 23, 2016 08:06, "Czanik, Péter" <peter.czanik(a)balabit.com> wrote: Hi, Which is problematic in Linux distributions, where I have 3.8.1 (openSUSE, Fedora). There are tons of bugfixes, but while I can easily push 3.8.2 as an update, 3.9.1 is not an option as it also requires a config file modification. Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik On Fri, Dec 23, 2016 at 8:01 AM, Balazs Scheidler <bazsi77(a)gmail.com> wrote: > We decided to skip 3.8.2 and go straight for 3.9.1. > > On Dec 21, 2016 08:19, "Czanik, Péter" <peter.czanik(a)balabit.com> wrote: > >> Hi, >> >> Looking at the 3.8/master branch I see, that openssl 1.1 support is >> not included. I'd need that for Fedora 26 support. Could you add it? >> >> Thanks, >> Peter Czanik (CzP) <peter.czanik(a)balabit.com> >> Balabit / syslog-ng upstream >> https://www.balabit.com/blog/author/peterczanik/ >> https://twitter.com/PCzanik >> >> >> On Tue, Dec 20, 2016 at 8:54 AM, Laszlo Budai <laszlo.budai(a)outlook.com> >> wrote: >> > hi, >> > >> > well... searchguard could be part of 3.8.2, >> > so we can continue with this state. >> > >> > >> > >> > >> > _____________________________ >> > From: Scheidler, Balázs <balazs.scheidler(a)balabit.com> >> > Sent: Tuesday, December 20, 2016 8:48 AM >> > Subject: Re: [syslog-ng] When is 3.8.2 scheduled? >> > To: Syslog-ng users' and developers' mailing list >> > <syslog-ng(a)lists.balabit.hu> >> > >> > >> > I have just pushed a preliminary NEWS.md update on the 3.8/master >> branch. >> > Note that as it currently stands SearchGuard is part of 3.8/master. >> > >> > @lbudai: what do you think, shall we continue with this state, or reset >> the >> > branch to an earlier point and push these changes to 3.9 instead? >> > >> > -- >> > Bazsi >> > >> > On Mon, Dec 19, 2016 at 5:39 PM, Laszlo Budai <laszlo.budai(a)outlook.com >> > >> > wrote: >> >> >> >> Hi, >> >> >> >> I think it won't be part of 3.8.2 , but 3.9. >> >> >> >> Our plan is to release both versions in this year. >> >> >> >> regards, >> >> Laszlo Budai >> >> >> >> >> >> >> >> >> >> On Mon, Dec 19, 2016 at 5:36 PM +0100, "Fabien Wernli" < >> wernli(a)in2p3.fr> >> >> wrote: >> >> >> >>> Dear list,Are there plans for a 3.8.2 release?The reason I'm asking is >> >>> that I'm writing a blog post on Searchguardintegration, and this >> relies on >> >>> unreleased >> >>> features.Thanks!____________________________________________ >> __________________________________Member >> >>> info: https://lists.balabit.hu/mailman/listinfo/syslog-ngDocumenta >> tion: >> >>> http://www.balabit.com/support/documentation/?product=syslog-ngFAQ: >> >>> http://www.balabit.com/wiki/syslog-ng-faq >> >> >> >> >> >> >> >> ____________________________________________________________ >> __________________ >> >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> >> Documentation: >> >> http://www.balabit.com/support/documentation/?product=syslog-ng >> >> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >> >> >> >> >> > >> > >> > >> > >> > ____________________________________________________________ >> __________________ >> > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> > Documentation: >> > http://www.balabit.com/support/documentation/?product=syslog-ng >> > FAQ: http://www.balabit.com/wiki/syslog-ng-faq >> > >> > >> ____________________________________________________________ >> __________________ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: http://www.balabit.com/support >> /documentation/?product=syslog-ng >> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >> >> > ____________________________________________________________ > __________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product= > syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > ____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

3 3

When is 3.8.2 scheduled?
by Fabien Wernli 23 Dec '16

23 Dec '16

Dear list, Are there plans for a 3.8.2 release? The reason I'm asking is that I'm writing a blog post on Searchguard integration, and this relies on unreleased features. Thanks!

5 6