- syslog-ng - lists.balabit.hu

Re: [syslog-ng] sylog-ng filters not working
by Christian Turner 03 Aug '16

03 Aug '16

Hi, I have the following filter configured; source src_devenv01 { udp(ip(0.0.0.0) port(514)); }; filter f_devenv01_04net { netmask(10.22.209.0/24); }; destination d_devenv_04net { file("/mnt/syslogng/p2alogs/DEVENV/04net-$HOST-$YEAR$MONTH$DAY.log"); }; log { source(src_devenv01); filter(f_devenv_04net); destination(d_devenv_04net); flags(final); }; However, the filter does not work, and the logs from this source all go to the generic logging destination. I perform an strace and I can see that the IP appears as expected, so I'm figuring I have a syntax error somewhere; [pid 28481] recvfrom(11, "<182>1 2016-08-03T10:27:50.645062-04:00 ::1 [[REDACTED]]..., 8192, 0, {sa_family=AF_INET, sin_port=htons(58785), sin_addr=inet_addr("10.22.209.10")}, [16]) = 265 Christian Turner

4 5

please test syslog-ng 3.8
by Czanik, Péter 03 Aug '16

03 Aug '16

Hi, The first beta of syslog-ng 3.8 was released last week. There are now unofficial packages for the Debian (Ubuntu) / Fedora (RHEL) / (open)SUSE family of Linux distributions. I collected some of the highlights of the new release and also the packaging related changes. You can read it at https://czanik.blogs.balabit.com/2016/08/syslog-ng-3-8-what-changed/ Please test syslog-ng 3.8 and let us know not only your problems but also your success stories! Thanks, bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Re: [syslog-ng] syslog-ng Digest, Vol 135, Issue 14
by Hollósi Botond 01 Aug '16

01 Aug '16

Hi Balázs, Thank you. The '$SOURCEIP' what i need, combined with 'flags(no-parse)'. With this i can separate the messages by the source address contained in the ip packet header. config example: source s_net_0 { network( ip(0.0.0.0) port(600) transport(udp) flags(no-parse) ); }; destination d_file_0 { file("/var/log/remote_log/$R_MONTH/$R_DAY/$SOURCEIP/100/$user.log" owner(root) group(root) create-dirs(yes) perm(0700) dir-perm(0700)); }; log { source(s_net_0); destination(d_file_0); }; -- Üdvözlettel: Hollósi Botond Opennetworks Kft. Tel.: 06-1-9996000 Mobil: 06-20-4362032 2016-07-31 12:00 keltezéssel, syslog-ng-request(a)lists.balabit.hu írta: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Re: Central netlog server for hosts behind NAT (Scheidler) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 30 Jul 2016 20:02:00 +0200 > From: Scheidler, Bal?zs <balazs.scheidler(a)balabit.com> > Subject: Re: [syslog-ng] Central netlog server for hosts behind NAT > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <CANWQT2OUDC7T-8FBrg2g3zdk9nPsBAOZj8Wq-vWmzUeywxOQ1Q(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > I am not sure I understand your usecase, and question. $HOST is populated > based on the host field within the message and senders are free to set that > to whatever they please. > > If that field is missing (which it might), syslog-ng fills that based on > the sender IP address. > > There are alternative macros (such as $SOURCEIP), which is the actual IP of > the datagram received by syslog-ng. But you can also play with $HOST > related syslog-ng options such as keep-hostname(). > > Could you try to rephrase your question? > Thanks > Bazsi > >

1 0

Central netlog server for hosts behind NAT
by Hollósi Botond 30 Jul '16

30 Jul '16

2 1

unofficial 3.8 beta1 openSUSE/Fedora/SLES/RHEL packages
by Czanik, Péter 28 Jul '16

28 Jul '16

Hi, My unofficial RPM packages for syslog-ng 3.8 beta1 are ready. Fedora / EPEL7: https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng38/ openSUSE / SLES12: https://build.opensuse.org/project/show/home:czanik:syslog-ng38 You can read more about what changed between 3.7 and 3.8 in the release announcement at https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.8.0beta1 Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

syslog-ng-3.8.0beta1 unofficial Debian/Ubuntu packages
by Budai, László 28 Jul '16

28 Jul '16

Hi, syslog-ng 3.8.0beta1[1] packages are available in OBS repo[2]. List of supported OSs (i386/amd64): * Debian 8.0 * Ubuntu 14.04 * Ubuntu 14.10 * Ubuntu 15.04 * Ubuntu 15.10 * Ubuntu 16.04 (Debian 7 is not supported by OBS anymore. Precise: I haven't created packages yet... I'm thinking about dropping precise support... if someone would need it, just send a mail to me.) Install ------- example: Debian 8.0 1. get release key wget -qO - http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… | sudo apt-key add - 2. add repo to APT sources eg.: /etc/apt/sources.list.d/syslog-ng-obs.list deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… ./ Then `apt-get update` and `apt-get install syslog-ng-core` You can replace Debian_8.0 to * xUbuntu_14.04 * xUbuntu_14.10 * xUbuntu_15.04 * xUbuntu_15.10 * Ubuntu 16.04 Available packages: syslog-ng syslog-ng-core syslog-ng-dbg syslog-ng-dev syslog-ng-mod-add-contextual-data syslog-ng-mod-amqp syslog-ng-mod-curl syslog-ng-mod-elastic syslog-ng-mod-geoip syslog-ng-mod-graphite syslog-ng-mod-hdfs syslog-ng-mod-http syslog-ng-mod-java syslog-ng-mod-java-common-lib syslog-ng-mod-journal syslog-ng-mod-json syslog-ng-mod-kafka syslog-ng-mod-kvformat syslog-ng-mod-mongodb syslog-ng-mod-python syslog-ng-mod-redis syslog-ng-mod-riemann syslog-ng-mod-smtp syslog-ng-mod-sql syslog-ng-mod-stomp Links -------- [1] https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.8.0beta1 [2] https://build.opensuse.org/project/show/home:laszlo_budai:syslog-ng regards, Laszlo Budai

1 0

Coming from Graylog to Syslog-NG
by Roberto Carna 27 Jul '16

27 Jul '16

Dear, I've implemented Graylog to receive around 5000-6000 logs/sec, but I have several problems: INPUT greater than OUTPUT so the journal increase a lot and the system crash, mainly. Now I want to use Syslog-NG, because I used it in the past but for 100-200 logs/sec. Here is my questions: 1) If I use Syslog-NG with a flat text file to receive 5000-6000 logs/sec, using s fast disk from my storage, do you recommneded to me this option ??? 2) As an extra benefit, what is the best and simple way to have a graphical view of all the logs ??? Thanks a lot, and maybe I'll ask you again about this topic in accordance with your comments. Roberto

4 5

How to make auto archive
by Harsha S Aryan 26 Jul '16

26 Jul '16

Hi, Can any one let me know how to make auto archive for my logs using syslog-ng Regards, Aryan

1 0

[Syslog-ng] Log particular actions and send specific files to a remote server
by Savakh S 26 Jul '16

26 Jul '16

Hello everyone, I have two questions about syslog-ng: 1 - Is it possible to send to a remote syslog-ng server a particular log file, for example the following /var/log/network.log, and how we can do this? iface eth1 inet dhcp ... up echo $IFACE up $(date) >> /var/log/network.log down echo $IFACE down $(date) >> /var/log/network.log 2 - Is it possible to log in real time a change occured a network interface ? For example a new open port. More generally, how can we log actions naturally not covered by syslog-ng in order to send to a remote server? Thank you for any help.

3 2

initial rpm packaging of syslog-ng rust parser modules
by Czanik, Péter 21 Jul '16

21 Jul '16

Hi, As you might be aware, syslog-ng 3.8 -- which is still under development -- introduced the possibility of writing parser modules in Rust ( https://www.rust-lang.org/) There are some ready to use modules available at https://github.com/ihrwein/syslog-ng-rust-modules Three of these received now initial RPM packaging: regex-parser, actiondb-parser and correlation-parser. My packages are mostly untested, version numbers are messed up, documentation is not yet bundled, etc., but still in good enough shape for initial testing. You can find some documentation in the github repo under https://github.com/ihrwein/syslog-ng-rust-modules Packages are built from the latest git head syslog-ng and rust-modules sources. You can download the rpm packaged rust modules and syslog-ng from: Fedora / EPEL7 (x86_64): https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng38/ openSUSE Leap / Tumbleweed: https://build.opensuse.org/project/show/home:czanik:syslog-ng38 Note: syslog-ng 3.8 is not yet released, so use of these packages in a production environment is not recommended. Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0