- syslog-ng - lists.balabit.hu

Unofficial Debian/Ubuntu packages for syslog-ng-3.8.1
by Laszlo Budai 19 Aug '16

19 Aug '16

Hi, syslog-ng 3.8.1[1] packages are available in OBS repo[2]. List of supported OSs (i386/amd64): * Debian 8.0 * Ubuntu 14.04 * Ubuntu 14.10 * Ubuntu 15.04 * Ubuntu 15.10 * Ubuntu 16.04 (Debian 7 is not supported by OBS anymore. Precise: I haven't created packages yet... I'm thinking about dropping precise support... if someone would need it, just send a mail to me.) Install ------- example: Debian 8.0 1. get release key wget -qO - http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… | sudo apt-key add - 2. add repo to APT sources eg.: /etc/apt/sources.list.d/syslog-ng-obs.list deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… ./ Then `apt-get update` and `apt-get install syslog-ng-core` You can replace Debian_8.0 to * xUbuntu_14.04 * xUbuntu_14.10 * xUbuntu_15.04 * xUbuntu_15.10 * xUbuntu 16.04 Available packages: syslog-ng syslog-ng-core syslog-ng-dbg syslog-ng-dev syslog-ng-mod-add-contextual-data syslog-ng-mod-amqp syslog-ng-mod-curl syslog-ng-mod-elastic syslog-ng-mod-geoip syslog-ng-mod-graphite syslog-ng-mod-hdfs syslog-ng-mod-http syslog-ng-mod-java-common-lib syslog-ng-mod-java syslog-ng-mod-journal syslog-ng-mod-json syslog-ng-mod-kafka syslog-ng-mod-kvformat syslog-ng-mod-mongodb syslog-ng-mod-python syslog-ng-mod-redis syslog-ng-mod-riemann syslog-ng-mod-smtp syslog-ng-mod-sql syslog-ng-mod-stomp Links -------- [1] https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.8.1 [2] https://build.opensuse.org/project/show/home:laszlo_budai:syslog-ng regards, Laszlo Budai

1 0

Syslog-ng client through a load balancer with SSL/TLS encryption
by Lupo, Joseph 18 Aug '16

18 Aug '16

I am trying to setup Syslog-ng to relay messages from one syslog server to another with a load balancer in between. I am also using TLS encryption. The issue I’m having right now is that when the client intiates the connection, it seems to lock on to a particular back end syslog server and send all of its messages there instead of switching off to another one. On its own this isn’t a big problem except that if that system goes down, the client doesn’t seem to be aware. I also haven’t found a good way to force syslog-ng to close and re-establish its connections without fully shutting down the relay system. We currently have no persistence setup on the load balancer. Is there a way to tell the relay server to periodically reconnect? Maybe send a certain amount of messages or data before reconnecting so that the data is balanced across the backend syslog-ng servers? Also, is there a better way to have the relay system learn about the remote server going offline so it can immediately reset its connection?

4 4

compression during tls
by thejaguar＠tutanota.de 17 Aug '16

17 Aug '16

Hi all, According to this https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-… Allow-compression() should be a working option under tls. I did google on this a lot and found no config snippetwhich shows allow-compress() to be working and to my surprise when I tried toinclude it in my config I get syntax error ___________________________________________________ 2016-08-11T15:27:19.538347] Registering candidate plugin;module='afsocket', context='source', name='systemd-syslog', preference='100' [2016-08-11T15:27:19.539190] Using /dev/log Unix socketwith systemd is not possible. Changing to systemd-syslog source, which supportssocket activation.; Error parsing afsocket, syntax error, unexpectedLL_IDENTIFIER, expecting ')' in /etc/syslog-ng/syslog-ng.conf at line 27,column 124: destination d_net_tls { network("syslog1.xxxxxxxxx.com" port(6514) transport("tls") tls(ca-dir("/etc/syslog-ng/ca") allow-compress(yes)peer-verify(required-trusted) ssl-options(no-sslv3,no-tlsv1) ) ^^^^^^^^^^^^^^ ___________________________________________________ I am using 3.8.0 on ubuntu 15.10. Is this even really supported as claimed in here https://www.balabit.com/network-security/syslog-ng/comparing/detailed # /usr/sbin/syslog-ng -V syslog-ng 3.8.0beta2 Installer-Version: 3.8.0beta2 Revision: 3.8.0beta2-1 Module-Directory: /usr/lib/syslog-ng/3.8 Module-Path: /usr/lib/syslog-ng/3.8 Available-Modules:affile,basicfuncs,system-source,cryptofuncs,pseudofile,afuser,csvparser,linux-kmsg-format,confgen,sdjournal,syslogformat,afprog,dbparser,afsocket Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: off

2 3

Re: [syslog-ng] sylog-ng filters not working
by Christian Turner 03 Aug '16

03 Aug '16

@version: 3.2 #Default configuration file for syslog-ng. # # For a description of syslog-ng configuration file directives, please read # the syslog-ng Administrator's guide at: # # https://www.balabit.com/support/documentation # @include "scl.conf" options { flush_lines (0); time_reopen (10); log_fifo_size (2048); chain_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (no); stats_freq(86400); }; source s_sys { file ("/proc/kmsg" program_override("kernel: ")); unix-stream ("/dev/log"); internal(); }; ### MYAPP Dev Logs ### ## DEVENV ## source src_devenv { udp(ip(0.0.0.0) port(514)); }; filter f_devenv_01ui { netmask(10.22.206.0/24); }; filter f_devenv_02gw { netmask(10.22.207.0/24); }; filter f_devenv_03api { netmask(10.22.208.0/24); }; filter f_devenv_04net { netmask( "10.22.209.0/24" ); }; filter f_devenv_05bat { netmask(10.22.210.0/24); }; destination d_devenv_01ui { file("/mnt/syslogng/MYAPPlogs/DEVENV/01ui-$HOST-$YEAR$MONTH$DAY.log"); }; destination d_devenv_02gw { file("/mnt/syslogng/MYAPPlogs/DEVENV/02gw-$HOST-$YEAR$MONTH$DAY.log"); }; destination d_devenv_03api { file("/mnt/syslogng/MYAPPlogs/DEVENV/03api-$HOST-$YEAR$MONTH$DAY.log"); }; destination d_devenv_04net { file("/mnt/syslogng/MYAPPlogs/DEVENV/04net-$HOST-$YEAR$MONTH$DAY.log"); }; destination d_devenv_05bat { file("/mnt/syslogng/MYAPPlogs/DEVENV/05bat-$HOST-$YEAR$MONTH$DAY.log"); }; log { source(src_devenv); filter(f_devenv_01ui); destination(d_devenv_01ui); }; log { source(src_devenv); filter(f_devenv_02gw); destination(d_devenv_02gw); }; log { source(src_devenv); filter(f_devenv_03api); destination(d_devenv_03api); }; log { source(src_devenv); filter(f_devenv_04net); destination(d_devenv_04net); flags(final); }; log { source(src_devenv); filter(f_devenv_05bat); destination(d_devenv_05bat); }; ## MYAPP ALL ## source src_MYAPP { udp(ip(0.0.0.0) port(514)); }; destination d_MYAPP { file("/mnt/syslogng/MYAPPlogs/$HOST/$HOST-$YEAR$MONTH$DAY.log"); }; log { source(src_MYAPP); destination(d_MYAPP); }; #source external { tcp(); }; #source external { udp(); }; #destination d_hosts { file("/home/syslog/$HOST/application.log" owner("syslog") group("syslog") perm(0600)); }; destination d_mesg { file("/var/log/messages"); }; #destination d_cons { file("/dev/console"); }; #destination d_auth { file("/var/log/secure"); }; #destination d_mail { file("/var/log/maillog" flush_lines(10)); }; #destination d_spol { file("/var/log/spooler"); }; #destination d_boot { file("/var/log/boot.log"); }; #destination d_cron { file("/var/log/cron"); }; #destination d_kern { file("/var/log/kern"); }; #destination d_mlal { usertty("*"); }; #destination d_all { file("/var/log/splunk"); }; log { source(s_sys); destination(d_mesg); }; #log { source(external); destination(d_hosts); }; From: Christian Turner Sent: Wednesday, August 3, 2016 11:53 AM To: 'syslog-ng(a)lists.balabit.hu' <syslog-ng(a)lists.balabit.hu> Subject: RE: sylog-ng filters not working Hi, I have the following filter configured; source src_devenv01 { udp(ip(0.0.0.0) port(514)); }; filter f_devenv01_04net { netmask(10.22.209.0/24); }; destination d_devenv_04net { file("/mnt/syslogng/p2alogs/DEVENV/04net-$HOST-$YEAR$MONTH$DAY.log"); }; log { source(src_devenv01); filter(f_devenv_04net); destination(d_devenv_04net); flags(final); }; However, the filter does not work, and the logs from this source all go to the generic logging destination. I perform an strace and I can see that the IP appears as expected, so I'm figuring I have a syntax error somewhere; [pid 28481] recvfrom(11, "<182>1 2016-08-03T10:27:50.645062-04:00 ::1 [[REDACTED]]..., 8192, 0, {sa_family=AF_INET, sin_port=htons(58785), sin_addr=inet_addr("10.22.209.10")}, [16]) = 265 Christian Turner

2 1

Re: [syslog-ng] sylog-ng filters not working
by Christian Turner 03 Aug '16

03 Aug '16

Hi, I have the following filter configured; source src_devenv01 { udp(ip(0.0.0.0) port(514)); }; filter f_devenv01_04net { netmask(10.22.209.0/24); }; destination d_devenv_04net { file("/mnt/syslogng/p2alogs/DEVENV/04net-$HOST-$YEAR$MONTH$DAY.log"); }; log { source(src_devenv01); filter(f_devenv_04net); destination(d_devenv_04net); flags(final); }; However, the filter does not work, and the logs from this source all go to the generic logging destination. I perform an strace and I can see that the IP appears as expected, so I'm figuring I have a syntax error somewhere; [pid 28481] recvfrom(11, "<182>1 2016-08-03T10:27:50.645062-04:00 ::1 [[REDACTED]]..., 8192, 0, {sa_family=AF_INET, sin_port=htons(58785), sin_addr=inet_addr("10.22.209.10")}, [16]) = 265 Christian Turner

4 5

please test syslog-ng 3.8
by Czanik, Péter 03 Aug '16

03 Aug '16

Hi, The first beta of syslog-ng 3.8 was released last week. There are now unofficial packages for the Debian (Ubuntu) / Fedora (RHEL) / (open)SUSE family of Linux distributions. I collected some of the highlights of the new release and also the packaging related changes. You can read it at https://czanik.blogs.balabit.com/2016/08/syslog-ng-3-8-what-changed/ Please test syslog-ng 3.8 and let us know not only your problems but also your success stories! Thanks, bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Re: [syslog-ng] syslog-ng Digest, Vol 135, Issue 14
by Hollósi Botond 01 Aug '16

01 Aug '16

Hi Balázs, Thank you. The '$SOURCEIP' what i need, combined with 'flags(no-parse)'. With this i can separate the messages by the source address contained in the ip packet header. config example: source s_net_0 { network( ip(0.0.0.0) port(600) transport(udp) flags(no-parse) ); }; destination d_file_0 { file("/var/log/remote_log/$R_MONTH/$R_DAY/$SOURCEIP/100/$user.log" owner(root) group(root) create-dirs(yes) perm(0700) dir-perm(0700)); }; log { source(s_net_0); destination(d_file_0); }; -- Üdvözlettel: Hollósi Botond Opennetworks Kft. Tel.: 06-1-9996000 Mobil: 06-20-4362032 2016-07-31 12:00 keltezéssel, syslog-ng-request(a)lists.balabit.hu írta: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Re: Central netlog server for hosts behind NAT (Scheidler) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 30 Jul 2016 20:02:00 +0200 > From: Scheidler, Bal?zs <balazs.scheidler(a)balabit.com> > Subject: Re: [syslog-ng] Central netlog server for hosts behind NAT > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <CANWQT2OUDC7T-8FBrg2g3zdk9nPsBAOZj8Wq-vWmzUeywxOQ1Q(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > I am not sure I understand your usecase, and question. $HOST is populated > based on the host field within the message and senders are free to set that > to whatever they please. > > If that field is missing (which it might), syslog-ng fills that based on > the sender IP address. > > There are alternative macros (such as $SOURCEIP), which is the actual IP of > the datagram received by syslog-ng. But you can also play with $HOST > related syslog-ng options such as keep-hostname(). > > Could you try to rephrase your question? > Thanks > Bazsi > >

1 0

Central netlog server for hosts behind NAT
by Hollósi Botond 30 Jul '16

30 Jul '16

2 1

unofficial 3.8 beta1 openSUSE/Fedora/SLES/RHEL packages
by Czanik, Péter 28 Jul '16

28 Jul '16

Hi, My unofficial RPM packages for syslog-ng 3.8 beta1 are ready. Fedora / EPEL7: https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng38/ openSUSE / SLES12: https://build.opensuse.org/project/show/home:czanik:syslog-ng38 You can read more about what changed between 3.7 and 3.8 in the release announcement at https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.8.0beta1 Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

syslog-ng-3.8.0beta1 unofficial Debian/Ubuntu packages
by Budai, László 28 Jul '16

28 Jul '16

Hi, syslog-ng 3.8.0beta1[1] packages are available in OBS repo[2]. List of supported OSs (i386/amd64): * Debian 8.0 * Ubuntu 14.04 * Ubuntu 14.10 * Ubuntu 15.04 * Ubuntu 15.10 * Ubuntu 16.04 (Debian 7 is not supported by OBS anymore. Precise: I haven't created packages yet... I'm thinking about dropping precise support... if someone would need it, just send a mail to me.) Install ------- example: Debian 8.0 1. get release key wget -qO - http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… | sudo apt-key add - 2. add repo to APT sources eg.: /etc/apt/sources.list.d/syslog-ng-obs.list deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… ./ Then `apt-get update` and `apt-get install syslog-ng-core` You can replace Debian_8.0 to * xUbuntu_14.04 * xUbuntu_14.10 * xUbuntu_15.04 * xUbuntu_15.10 * Ubuntu 16.04 Available packages: syslog-ng syslog-ng-core syslog-ng-dbg syslog-ng-dev syslog-ng-mod-add-contextual-data syslog-ng-mod-amqp syslog-ng-mod-curl syslog-ng-mod-elastic syslog-ng-mod-geoip syslog-ng-mod-graphite syslog-ng-mod-hdfs syslog-ng-mod-http syslog-ng-mod-java syslog-ng-mod-java-common-lib syslog-ng-mod-journal syslog-ng-mod-json syslog-ng-mod-kafka syslog-ng-mod-kvformat syslog-ng-mod-mongodb syslog-ng-mod-python syslog-ng-mod-redis syslog-ng-mod-riemann syslog-ng-mod-smtp syslog-ng-mod-sql syslog-ng-mod-stomp Links -------- [1] https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.8.0beta1 [2] https://build.opensuse.org/project/show/home:laszlo_budai:syslog-ng regards, Laszlo Budai

1 0