- syslog-ng - lists.balabit.hu

Coming from Graylog to Syslog-NG
by Roberto Carna 27 Jul '16

27 Jul '16

Dear, I've implemented Graylog to receive around 5000-6000 logs/sec, but I have several problems: INPUT greater than OUTPUT so the journal increase a lot and the system crash, mainly. Now I want to use Syslog-NG, because I used it in the past but for 100-200 logs/sec. Here is my questions: 1) If I use Syslog-NG with a flat text file to receive 5000-6000 logs/sec, using s fast disk from my storage, do you recommneded to me this option ??? 2) As an extra benefit, what is the best and simple way to have a graphical view of all the logs ??? Thanks a lot, and maybe I'll ask you again about this topic in accordance with your comments. Roberto

4 5

How to make auto archive
by Harsha S Aryan 26 Jul '16

26 Jul '16

Hi, Can any one let me know how to make auto archive for my logs using syslog-ng Regards, Aryan

1 0

[Syslog-ng] Log particular actions and send specific files to a remote server
by Savakh S 26 Jul '16

26 Jul '16

Hello everyone, I have two questions about syslog-ng: 1 - Is it possible to send to a remote syslog-ng server a particular log file, for example the following /var/log/network.log, and how we can do this? iface eth1 inet dhcp ... up echo $IFACE up $(date) >> /var/log/network.log down echo $IFACE down $(date) >> /var/log/network.log 2 - Is it possible to log in real time a change occured a network interface ? For example a new open port. More generally, how can we log actions naturally not covered by syslog-ng in order to send to a remote server? Thank you for any help.

3 2

initial rpm packaging of syslog-ng rust parser modules
by Czanik, Péter 21 Jul '16

21 Jul '16

Hi, As you might be aware, syslog-ng 3.8 -- which is still under development -- introduced the possibility of writing parser modules in Rust ( https://www.rust-lang.org/) There are some ready to use modules available at https://github.com/ihrwein/syslog-ng-rust-modules Three of these received now initial RPM packaging: regex-parser, actiondb-parser and correlation-parser. My packages are mostly untested, version numbers are messed up, documentation is not yet bundled, etc., but still in good enough shape for initial testing. You can find some documentation in the github repo under https://github.com/ihrwein/syslog-ng-rust-modules Packages are built from the latest git head syslog-ng and rust-modules sources. You can download the rpm packaged rust modules and syslog-ng from: Fedora / EPEL7 (x86_64): https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng38/ openSUSE Leap / Tumbleweed: https://build.opensuse.org/project/show/home:czanik:syslog-ng38 Note: syslog-ng 3.8 is not yet released, so use of these packages in a production environment is not recommended. Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

powered by syslog-ng
by Czanik, Péter 19 Jul '16

19 Jul '16

Hi, We have now a "Powered by syslog-ng" page on our website. It's available at https://syslog-ng.org/powered-by-syslog-ng/ If your project / company / product / etc. uses syslog-ng, we are happy to include you on the list too, just e-mail me directly! Some of the more interesting names from the list are Facebook, Kindle, FreeNAS and of course all the major Linux distributions. Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

2 1

NG Rewrite Capabilities on a Relay
by Schoonover, Mark E HHHH 18 Jul '16

18 Jul '16

Hello, I've run into a situation where I need to rewrite messages before sending them to our central NG server. When NG is used as a relay, is the rewrite functionality available? I've been through the manual but there isn't a mention of what functionality is available - other than writing logs to disk. Regards, Mark Schoonover Infrastructure Engineering Manager ENE : Tools, Instrumentation and Common Services Team Office: 32.8697° N, 116.9711° W Phone : 770-261-7934 Email : mark.schoonover(a)cigna.com<mailto:mark.schoonover@cigna.com> Confidential, unpublished property of Cigna Health & Life Insurance Co.. Do not duplicate or distribute. Use and distribution limited solely to authorized personnel. ©2016 CIGNA. ------------------------------------------------------------------------------ CONFIDENTIALITY NOTICE: If you have received this email in error, please immediately notify the sender by e-mail at the address shown. This email transmission may contain confidential information. This information is intended only for the use of the individual(s) or entity to whom it is intended even if addressed incorrectly. Please delete it from your files if you are not the intended recipient. Thank you for your compliance. Copyright (c) 2016 Cigna ==============================================================================

2 2

New ETPLC project with Syslog-NG for checking >9000 Threats on your logs!
by rmkml 13 Jul '16

13 Jul '16

Hello, I am pround to announce the new http://etplc.org open source project update with Syslog-NG for checking more than 9000 Threats on your webserver/proxy logs! It's a open source project, all feedbacks / informations are welcome. Easy to use since 3 years ago ;) 1) add ETPLC on your Syslog-NG configuration like that: (of course check before perl+etplc PATH and source/filter/destination configurations...) destination d_prog { program("/usr/bin/perl /var/tmp/etplc_12jul2016a.pl -f /var/tmp/emergingall_sigs11jul2016a_snort290b.rules -s"); }; log { source(s_src); destination(d_prog); }; 2) ETPLC send alert to localhost:514/udp with "-s" option 3) See All options with "-h" 4) Already supported format is Squid, Apache, Nginx, ForeFront, BlueCoat, McAfee Web Gateway, IIS logs... 5) ETPLC exist on Perl and Python versions ETPLC available on: -main http://etplc.org -http://sourceforge.net/projects/etplc/ -https://github.com/rmkml/etplc -https://hub.docker.com/r/rmkml/etplc/ -http://twitter.com/rmkml Special THX to InfoSec community and @EmergingThreats team! Best Regards @Rmkml

2 1

Need mvn repository info for syslog-ng-core.jar
by Kiran Doddi 12 Jul '16

12 Jul '16

Hi, We are using syslog-ng server for receiving logs from different sources & we need to configure Java Destination for writing those logs into local file. For this, While implementing, I found syslog-ng-core.jar file, but I could not found the same anywhere in maven repo, so that I can add its dependency in my pom.xml & avoid putting it manually in jar bundling. Kindly need your assistance to solve my issues. Thanks & Regards, Kiran

3 2

Re: [syslog-ng] Transport aux data overflow
by Scheidler, Balázs 07 Jul '16

07 Jul '16

We get various data points on the process connecting via /dev/log via recvmsg() that returns this in an aux buffer, statically sized to 1024. It's interesting that you have more. If you can reproduce it, can you strace syslog-ng to see what is coming aux data? This can be resized but that needs a recompilation. On Jul 6, 2016 11:18 PM, "Noémi Ványi" <sitbackandwait(a)gmail.com> wrote: Hi! It seems to me that aux buffer size is a hard-coded value. So it cannot be configured using the config file. I guess the size could be increased, but I am curious what the devs of syslog-ng would say. :) On 6 July 2016 at 22:09, Evan Rempel <erempel(a)uvic.ca> wrote: > I got this log line out of syslog-ng, but I'm not sure what it really > means. > > Can anyone shed some slight on it and let me know how I can increase the > aux buffer size? > > syslog-ng[29712]: Transport aux data overflow, some fields may not be > associated with the message, please increase aux buffer size; > aux_size='1024' > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

Transport aux data overflow
by Evan Rempel 06 Jul '16

06 Jul '16

I got this log line out of syslog-ng, but I'm not sure what it really means. Can anyone shed some slight on it and let me know how I can increase the aux buffer size? syslog-ng[29712]: Transport aux data overflow, some fields may not be associated with the message, please increase aux buffer size; aux_size='1024'

2 1