- syslog-ng - lists.balabit.hu

systemd syslog-ng does not start CentOS 7.2.1511
by Scot Needy 14 Apr '16

14 Apr '16

Hi, I need help setting up my control files for systemd I can’t figure out what I am doing wrong. If I make a SystemV start stop script it runs fine. From systemd I think there is something missing in the control files that lets syslog-ng report that is started successfully. When I add -F to SYSLOGNG_OPTS then systemctl start syslog-g.service never returns but syslog-ng does start. Compiled syslog-ng syslog-ng 3.8.0alpha0 no problems. On the command line syslog-ng will start fine. /opt/syslog-ng/sbin/syslog-ng -f /opt/syslog-ng/etc/syslog-ng.conf -p /var/run/syslogd.pid Using contrib/systemd/syslog-ng.service as an example I created /usr/lib/systemd/system/syslog-ng.service [Unit] Description=System Logger Daemon Documentation=man:syslog-ng(8) [Service] Type=notify ExecStart=/opt/syslog-ng/sbin/syslog-ng $SYSLOGNG_OPTS ExecReload=/bin/kill -HUP $MAINPID EnvironmentFile=-/opt/syslog-ng/etc/syslog-ng.env StandardOutput=journal StandardError=journal Restart=on-failure [Install] WantedBy=multi-user.target cat /opt/syslog-ng/etc/syslog-ng.env LD_LIBRARY_PATH=/usr/java/jdk1.8.0_77/jre/lib/amd64/server:$LD_LIBRARY_PATH SYSLOGNG_OPTS="-f /opt/syslog-ng/etc/syslog-ng.conf -p /var/run/syslogd.pid" systemctl daemon-reload systemctl restart systemd-journald systemctl start syslog-ng.service systemctl status syslog-ng.service ● syslog-ng.service - System Logger Daemon Loaded: loaded (/usr/lib/systemd/system/syslog-ng.service; enabled; vendor preset: enabled) Active: inactive (dead) since Tue 2016-04-12 14:51:04 EDT; 29s ago Docs: man:syslog-ng(8) Process: 2494 ExecStart=/opt/syslog-ng/sbin/syslog-ng $SYSLOGNG_OPTS (code=exited, status=0/SUCCESS) Main PID: 2494 (code=exited, status=0/SUCCESS) Apr 12 14:41:08 loghost systemd[1]: Unit syslog-ng.service entered failed state. Apr 12 14:41:08 loghost systemd[1]: syslog-ng.service failed. Apr 12 14:41:08 loghost systemd[1]: syslog-ng.service holdoff time over, scheduling restart. Apr 12 14:41:08 loghost systemd[1]: Starting System Logger Daemon... I can see syslog-ng starting and stoping over and over from /var/log/messages

5 17

Configuring syslog-ng on a computer with multiple ethernet interfaces
by Dave Florek 11 Apr '16

11 Apr '16

Hi, How do I configure syslog-ng to use a specific ethernet interface on a computer with multiple interfaces enabled? Sincerely,

2 1

CentOS configure failed from git clone
by Scot Needy 07 Apr '16

07 Apr '16

Hi Has anyone else seen this error from configure ? checking for JSON... yes checking for LIBMONGO... no checking for prop_get in -lsasl2... no checking for libESMTP... yes checking for HIREDIS... yes checking for RIEMANN_CLIENT... no checking for PYTHON... no checking for JAVA_VERSION... 1.8 checking for GRADLE_VERSION... 2 checking whether to enable Sun STREAMS support... no checking whether to enable IPv6 support... yes checking whether to enable Linux capability support... no checking whether to enable mongodb destination support... yes checking whether to enable amqp destination support... yes checking for UUID... no ./configure: line 19787: syntax error near unexpected token `syslog-ng-config.h,' ./configure: line 19787: `AX_PREFIX_CONFIG_H(syslog-ng-config.h, "SYSLOG_NG")'

2 3

Syslog-NG 3.8 SSL Error
by Ivan Adji - Krstev 05 Apr '16

05 Apr '16

Hi all, I have install the syslog-ng v.3.8 on CentOS 7 and using selfsignature (SSL/TLS). I have done the same procedure but using syslog-ng v.3.7 on CentOS 6 and everything works perfect. Here i have some problems after i done everything and configuration i have the following errors about SSL. Can someone give me some hints ? Apr 5 20:13:20 localhost root: This is a test message Apr 5 20:13:25 DenLuGW syslog-ng[32145]: Syslog connection established; fd='12', server='AF_INET(5.144.33.25:6514)', local='AF_INET(0.0.0.0:0)' Apr 5 20:13:25 DenLuGW syslog-ng[32145]: SSL error while writing stream; tls_error='SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca' Apr 5 20:13:25 DenLuGW syslog-ng[32145]: I/O error occurred while writing; fd='12', error='Broken pipe (32)' Apr 5 20:13:25 DenLuGW syslog-ng[32145]: Syslog connection broken; fd='12', server='AF_INET(5.144.33.25:6514)', time_reopen='10' Apr 5 20:13:35 DenLuGW syslog-ng[32145]: Syslog connection established; fd='12', server='AF_INET(5.144.33.25:6514)', local='AF_INET(0.0.0.0:0)' Apr 5 20:13:35 DenLuGW syslog-ng[32145]: SSL error while writing stream; tls_error='SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca' Apr 5 20:13:35 DenLuGW syslog-ng[32145]: I/O error occurred while writing; fd='12', error='Broken pipe (32)' Apr 5 20:13:35 DenLuGW syslog-ng[32145]: Syslog connection broken; fd='12', server='AF_INET(5.144.33.25:6514)', time_reopen='10' [root@DenLuGW syslog-ng]# syslog-ng --version syslog-ng 3.8.0alpha0 Installer-Version: 3.8.0alpha0 Revision: DA BE DA Module-Directory: //usr/lib64/syslog-ng Module-Path: //usr/lib64/syslog-ng Available-Modules: afamqp,affile,afprog,afsocket,afstomp,afuser,basicfuncs,cef,confgen,cryptofuncs,csvparser,date,dbparser,disk-buffer,graphite,json-plugin,kvformat,linux-kmsg-format,pseudofile,sdjournal,syslogformat,system-source Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: off Any hints about it ? Kind regards Ivan

1 1

Re: [syslog-ng] syslog-ng Digest, Vol 131, Issue 30
by Munh-Erdene E 04 Apr '16

04 Apr '16

Unsubscribe On 24 Mar 2016 19:00, <syslog-ng-request(a)lists.balabit.hu> wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. 3.7.3 unofficial Fedora / RHEL7 packages (Czanik) > 2. Re: 3.7.3 unofficial Fedora / RHEL7 packages (Czanik) > 3. Re: Collecting messages from text files (Girish Kumar) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 23 Mar 2016 14:06:13 +0100 > From: Czanik, P?ter <peter.czanik(a)balabit.com> > Subject: [syslog-ng] 3.7.3 unofficial Fedora / RHEL7 packages > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <CANcUavuUC+jqFa3nEfhhJM0A6fni= > PLh6U74RmYh7zGeWDofSw(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Hi, > > My unofficial syslog-ng 3.7.3 Fedora / RHEL7 packages are available at > https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng37/ Packages > for RHEL6 will follow later this week. If you have any questions or > run into any problems, let me know! > > Bye, > > Peter Czanik (CzP) <peter.czanik(a)balabit.com> > Balabit / syslog-ng upstream > http://czanik.blogs.balabit.com/ > https://twitter.com/PCzanik > > > ------------------------------ > > Message: 2 > Date: Wed, 23 Mar 2016 14:54:27 +0100 > From: Czanik, P?ter <peter.czanik(a)balabit.com> > Subject: Re: [syslog-ng] 3.7.3 unofficial Fedora / RHEL7 packages > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > < > CANcUavtxXHKfyPMHjwDNoqa6XHKow3r+6MKgu5sE-1MJuSe-MA(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > And the RHEL6 repo is updated as well: > https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng37epel6/ As > usual, let me know if you have any problems! > Bye, > Peter Czanik (CzP) <peter.czanik(a)balabit.com> > Balabit / syslog-ng upstream > http://czanik.blogs.balabit.com/ > https://twitter.com/PCzanik > > > On Wed, Mar 23, 2016 at 2:06 PM, Czanik, P?ter <peter.czanik(a)balabit.com> > wrote: > > Hi, > > > > My unofficial syslog-ng 3.7.3 Fedora / RHEL7 packages are available at > > https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng37/ Packages > > for RHEL6 will follow later this week. If you have any questions or > > run into any problems, let me know! > > > > Bye, > > > > Peter Czanik (CzP) <peter.czanik(a)balabit.com> > > Balabit / syslog-ng upstream > > http://czanik.blogs.balabit.com/ > > https://twitter.com/PCzanik > > > ------------------------------ > > Message: 3 > Date: Thu, 24 Mar 2016 07:21:38 +0000 > From: Girish Kumar <girish.kumar(a)al-enterprise.com> > Subject: Re: [syslog-ng] Collecting messages from text files > To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> > Message-ID: > < > VI1PR08MB0959FE8ED5E7F227BEAA8170C0820(a)VI1PR08MB0959.eurprd08.prod.outlook.com > > > > Content-Type: text/plain; charset="us-ascii" > > Could you please update on the following. > > Regards, > Girish > > From: syslog-ng-bounces(a)lists.balabit.hu [mailto: > syslog-ng-bounces(a)lists.balabit.hu] On Behalf Of Girish Kumar > Sent: Tuesday, March 22, 2016 4:10 PM > To: Syslog-ng users' and developers' mailing list > Subject: [syslog-ng] Collecting messages from text files > > Hi All, > > I am using file(filename) option for source of log. The filename is the > log generated by my application. The scenario is explained below. > > Writes to Reads from > Application --- ---- >filename-----------> syslog-ng > > Since the application is continuously writing to file and syslog-ng is > reading from the file, is there any chance syslog-ng missing some logs from > the file. > I am telling in reader writer context > > I referred following link to understand and implement file(filename) option > > https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-… > > > Regards, > Girish >

1 0

Weird issue with remote syslog-ng setup
by Dave Florek 29 Mar '16

29 Mar '16

Hi, I'm running into a weird issue where I have syslog-ng running on a client and server. Both are correctly configured to push log files from the client to the server and they're both Linux boxes. A netstat command on the client shows an established connection from the client to the server, however on the server, a netstat command does not show a connection from the server to the client or client to server. I checked firewall settings in iptables, however nothing seems to be working. Any ideas on how I can troubleshoot this? Sincerely,

3 2

Collecting messages from text files
by Girish Kumar 24 Mar '16

24 Mar '16

Hi All, I am using file(filename) option for source of log. The filename is the log generated by my application. The scenario is explained below. Writes to Reads from Application --- ---- >filename-----------> syslog-ng Since the application is continuously writing to file and syslog-ng is reading from the file, is there any chance syslog-ng missing some logs from the file. I am telling in reader writer context I referred following link to understand and implement file(filename) option https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-… Regards, Girish

1 1

3.7.3 unofficial Fedora / RHEL7 packages
by Czanik, Péter 23 Mar '16

23 Mar '16

Hi, My unofficial syslog-ng 3.7.3 Fedora / RHEL7 packages are available at https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng37/ Packages for RHEL6 will follow later this week. If you have any questions or run into any problems, let me know! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 1

Re: [syslog-ng] syslog-ng Digest, Vol 131, Issue 27
by amey jain 23 Mar '16

23 Mar '16

Hi, Girish can you tell why you think that messages are being dropped. Can you tell exact configuration of your syslog-ng. I didn't understand what exactly is the problem is. Can you be more detailed in it. Regards On Tue, Mar 22, 2016 at 4:30 PM, <syslog-ng-request(a)lists.balabit.hu> wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Re: Compile time error (Nagy) > 2. Re: syslog-ng 3.8 how to get configure script (Czanik) > 3. Collecting messages from text files (Girish Kumar) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 21 Mar 2016 16:45:51 +0100 > From: Nagy, Tam?s <tamas.nagy(a)balabit.com> > Subject: Re: [syslog-ng] Compile time error > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <CAJ3S0CmF75i=xWUxP=E_nr= > repNrHNrVA4tYqrZasi9W0vkaZQ(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > 1. Could you try with a newer mongo-c-driver version? You can edit the > respective section in .gitmodules and try branch=master (or some other > tag). You need to do this right after a clean checkout, although > running autogen.sh again before configure might also be enough. > > 2. Could you try after configuring with --disable-mongodb? > > On Thu, Mar 10, 2016 at 3:03 PM, Vithulan MV > <vithulanmv.12(a)cse.mrt.ac.lk> wrote: > > Hi, > > > > Yes it seems so, as per > > https://www.openssl.org/docs/manmaster/crypto/EVP_DigestInit.html > > > > Thanks for pointing that out. > > I tried installing openssl 1.0.1 but still the openssl version command > shows > > the version 1.1, How do I compile syslog-ng with OpenSSL 1.0.1? > > > > Thanks. > > > > Best regards, > > Vithulan > > > > On 7 March 2016 at 23:15, Tibor Benke <ihrwein(a)gmail.com> wrote: > >> > >> Hi, > >> > >> You probably use OpenSSL 1.1 (scroll down to the bottom of the page to > >> "History"): > >> https://www.openssl.org/docs/manmaster/crypto/EVP_DigestInit.html > >> > >> Please verify this. > >> > >> Could you try to compile syslog-ng with OpenSSL 1.0.1? > >> > >> Regards, > >> Tibor > >> > >> 2016-03-07 18:32 GMT+01:00 Vithulan MV <vithulanmv.12(a)cse.mrt.ac.lk>: > >>> > >>> Hi all, > >>> > >>> I added required dependencies and tried to build syslog-ng from the > >>> source, there was an error saying, > >>> > >>> > ${syslog-ng_HOME}/modules/afmongodb/mongo-c-driver/src/mongoc/mongoc-scram.c: > >>> In function '_mongoc_scram_sha1': storage size of 'digest_ctx' isn't > known > >>> (EVP_MD_CTX digest_ctx) > >>> I confirmed OpenSSL [1] headers are included in the file.Can you please > >>> point out whats wrong? > >>> > >>> [1] > >>> > https://github.com/mongodb/mongo-c-driver/blob/7415d3468de0c500fd6e630f7b52… > >>> > >>> Thanks. > >>> Regards, > >>> Vithulan > >>> > >>> > >>> > >>> > ______________________________________________________________________________ > >>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > >>> Documentation: > >>> http://www.balabit.com/support/documentation/?product=syslog-ng > >>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >>> > >>> > >> > >> > >> > >> > ______________________________________________________________________________ > >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > >> Documentation: > >> http://www.balabit.com/support/documentation/?product=syslog-ng > >> FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >> > >> > > > > > > > > -- > > Vithulan MV. > > > > Undergraduate, > > Department of Computer Science & Engineering, > > University of Moratuwa, > > Sri lanka. > > > > > ______________________________________________________________________________ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > ------------------------------ > > Message: 2 > Date: Tue, 22 Mar 2016 11:22:21 +0100 > From: Czanik, P?ter <peter.czanik(a)balabit.com> > Subject: Re: [syslog-ng] syslog-ng 3.8 how to get configure script > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <CANcUavt4iOerSVbJdSnJM= > Zg-fw1eSjwDwydLdz+MFM3jjdj0Q(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hi, > > I have now a completely untested rhel7 package available at > https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng38/ I'll try to > build also for rhel6 later this week. It includes Java modules, but not the > JAR dependencies. > > Bye, > > Peter Czanik (CzP) <peter.czanik(a)balabit.com> > Balabit / syslog-ng upstream > http://czanik.blogs.balabit.com/ > https://twitter.com/PCzanik > > On Sun, Mar 20, 2016 at 7:06 PM, Tibor Benke <ihrwein(a)gmail.com> wrote: > > > Hi Evan, > > > > I think you need to install the autoconf-archive package, then run > > ./autogen.sh. Everything else should be the same. > > > > Tibor > > > > 2016-03-20 17:52 GMT+01:00 Evan Rempel <erempel(a)uvic.ca>: > > > >> I wanted to start using elasticsearch 2.2 so need to start using > >> syslog-ng 3.8 but there is no > >> configure script in the master branch. > >> > >> autoconf returns a bunch of "possibly undefined macro" errors and leaves > >> a non-working configure script. > >> autoreconf does similar things. > >> > >> Can anyone give me some help on getting a working configure/make setup > >> for syslog-ng 3.8 > >> > >> I am attempting this on Redhat 6. > >> > >> Evan. > >> > >> > >> > ______________________________________________________________________________ > >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > >> Documentation: > >> http://www.balabit.com/support/documentation/?product=syslog-ng > >> FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >> > >> > > > > > > > ______________________________________________________________________________ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > > > >

2 1

Gsoc 2016 Introduction: Radcliffe
by Radcliffe Robinson 22 Mar '16

22 Mar '16

Hi there. My name is Radcliffe Robinson. I am a second year computer science student at the University of the West Indies, Jamaica. I actually first became interested interested in syslog-ng as a potential user while searching for a more palatable logging and log processing solution (something for sophisticated than ctrl+f) for a billing system a partner and I built in C to accompany the Asterisk pbx system at our internship. I had some time ago read about a company that logged all messages and controlled all their systems through a web server (localhost/product/restart to restart a service, localhost/product/logs?query=query to view logsm etc) and was searching for a similar way to send log messages from the billing software directly to the web-server i built to interfaces with customer database, where i would then do filtering and grouping etc of the log messages. It is for this reason that i am particularly interested in your project idea to create a websocket destination for syslog-ng. Syslog-ng already possess the filtering and grouping functionality, leaving only the act of implementing the websocket source. This something i could directly apply to an existing product of mine. However my passion for user interface design and extensive experience with web development draws my interest towards your idea for a drag and drop web interface for creating syslog-ng configuration files, purely because of the novelty of the idea and the opportunity to supersize some creative and aesthetic competency, a relatively rare experience in my short professional life as a developer. The more consideration i give to this idea, and the further i read through the admin guide, the more difficult a task it reveals itself to be but i have already devised a few possible solutions and began designing the database schema to facilitate it, and am confident that it is within the scope of my competency to create a useful and well designed web solution. I will be running these ideas by the project's mentor to seek feedback. I expect to end up sending in applications for multiple of the gsoc ideas the syslog-ng team has posted as they are the most interesting set of ideas which align well with my skill set that i have found. Thus, if given the opportunity, i look forward to working with the team this summer. Best regards, Radcliffe.

1 0