- syslog-ng - lists.balabit.hu

race condition causes copytruncate log rotation problems
by Jim Segrave 04 May '16

04 May '16

On a set of very busy Usenet servers, we are seeing problems with using syslog-ng together with copytruncate in logrotation. I am not sure why, but syslog-ng opens log files without having O_APPEND set, and appends log mesages with separate syscalls - an lseek to SEEK_END, followed by a write. On a busy server- perhaps 300 logs/sec each about 120 bytes long, we sometimes find that logrotate, which is configured to do a copy-truncate, actually produces a sparse file which begins with blocks of zeroes up to the pre-rotate log file size, followed by logs written after the copytruncate completes. Looking at the Linux /proc/PID/fdinfo information, I see that the logfiles are not opened in append mode, although they are opened O_WR. I haven't begun looking through the source to see if syslog-ng ever tries to overwrite data it's already logged by seeking backwards in the file - I must confess I can't think of any reason to do so. The only other reason for not having O_APPEND set would be to avoid problems for people using NFS to collect logs centrally by having different servers all writing to one NFS file. As I see it, the sequence leading to this problem is: syslog-ng logrotate copytruncate function ------------- ------------------------------------------- ,,, begin copytruncate, reach EOF on the copy lseek(fd, SEEK_END) <------------------------------------------------------------- the end of the file before logrotate ftruncates() it ftruncate(fd, 0) write(fd, log_msg, log_msg_size) <----------------------------------------- the write takes place at the old EOF, so the kernel considers the file to have empty blocks from 0 to that point If there is a reason that some users need the logfile opened without O_APPEND mode, then making that choice a configuration option would be helpful. For those using O_APPEND, the lseek() calls are harmless and won't add any more resource usage than is already present, but file truncation will prevent a zero filled pad being prefixed to the file.

3 2

Re: [syslog-ng] syslog-ng 3.7.3 with Java enable Can't find class when startup
by Ho, Ming 04 May '16

04 May '16

Hi, I use the following conf file to start syslog-ng 3.7.3 complied with Java supported version and got the following error: # syslog-ng -f /opt/syslog-ng/syslog-ng.conf [2016-05-03T23:13:54.191256] Can't find class; class_name='org/syslog_ng/SyslogNgClassLoader' ** ERROR:modules/java/native/java_machine.c:126:java_machine_get_class_loader: assertion failed: (self->loader) syslog-ng.conf: @version: 3.7 @include "scl.conf" @module mod-java source s_syslog { syslog(); }; destination d_elastic { java( class_path("/usr/lib64/syslog-ng/java-modules/*.jar:/usr/share/elasticsearch/lib/*.jar") class_name("org.syslog_ng.elasticsearch.ElasticSearchDestination") option("index", "syslog-ng_${YEAR}.${MONTH}.${DAY}") option("type", "test") option("client-mode", "transport") option("server", "sl73ovnapd018") option("port", "9200") option("flush-limit", "10") ); }; log { source(s_syslog); destination(d_elastic); flags(flow-control); }; I found previous post from last year with the exact same error: https://github.com/balabit/syslog-ng/issues/620 According to the post the problem was make install fail to copy "syslog-ng-core.jar" and/or "syslog-ng-common.jar" to target directory. Including these two files in the directory referenced by the class_path should solve the problem. I have these two files included in my class_path already but still got the same error: -rw-r--r-- 1 root root 11411 May 2 06:50 /usr/lib64/syslog-ng/java-modules/syslog-ng-core.jar -rw-r--r-- 1 root root 12536 May 2 06:51 /usr/lib64/syslog-ng/java-modules/syslog-ng-common.jar Any help is highly appreciated. Ming Ho

1 0

Compile time error
by Vithulan MV 03 May '16

03 May '16

Hi all, I added required dependencies and tried to build syslog-ng from the source, there was an error saying, ${syslog-ng_HOME}/modules/afmongodb/mongo-c-driver/src/mongoc/mongoc-scram.c: In function '_mongoc_scram_sha1': storage size of 'digest_ctx' isn't known (EVP_MD_CTX digest_ctx) I confirmed OpenSSL [1] headers are included in the file.Can you please point out whats wrong? [1] https://github.com/mongodb/mongo-c-driver/blob/7415d3468de0c500fd6e630f7b52… Thanks. Regards, Vithulan

4 6

filtering vs. keeping all logs
by Czanik, Péter 29 Apr '16

29 Apr '16

Hi, One of the major strengths of syslog-ng is message filtering, which facilitates message routing and discarding useless log messages. OTOH I often read, that we have now all the technologies and storage to keep all logs. What do you think? Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

5 7

Re: [syslog-ng] [GSoC] Project: Kafka source
by Vithulan MV 27 Apr '16

27 Apr '16

Hi all, First of all, I'd like to thank you Syslog-ng community and my mentor Viktor Juhasz for accepting my proposal to implement Kafka source in Java!. Some of you may already know me but for others, I'll introduce myself again. I'm Vithulan, 3rd year undergraduate at University of Moratuwa, Sri lanka. My areas of interests are, Data analytics, Machine Learning, Networking and Security. As a first step into this GSoC program I already started following the documentation [1], and going through the code base of syslog-ng (I'm curious what IDE you all are using?). What are the other areas that you want me to know to polish my knowledge before we get into the coding period? I guess, this is going to be very interesting 4 months with good new experiences :) Thank you! [1] https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-… Best regards, Vithulan. On 23 April 2016 at 08:42, Vithulan MV <vithulanmv.12(a)cse.mrt.ac.lk> wrote: > Hi Viktor, > > I am very excited and happy after seeing my morning mail from Google > summer of code! Thank you very much for accepting my proposal! :) > How shall we proceed into this project? and any tips before going deep > into the project? :) > > Thank you. > > Best regards, > Vithulan. > > On 26 March 2016 at 10:52, Vithulan MV <vithulanmv.12(a)cse.mrt.ac.lk> > wrote: > >> Hi Viktor, >> >> I have submitted my proposal in GSoC page and Syslog-ng wiki page aswell. >> >> Thanks. >> Best regards, >> Vithulan >> On Mar 10, 2016 8:42 PM, "Vithulan MV" <vithulanmv.12(a)cse.mrt.ac.lk> >> wrote: >> >>> Hi Viktor, >>> >>> Thanks for the link :) I'll check that. >>> >>> Regards, >>> Vithulan. >>> >>> On 10 March 2016 at 20:22, Juhász, Viktor <viktor.juhasz(a)balabit.com> >>> wrote: >>> >>>> Hi, >>>> >>>> Sorry I missed the link :) >>>> https://syslog-ng.org/gsoc-2016/ >>>> >>>> BR, >>>> Viktor >>>> >>>> On Thu, Mar 10, 2016 at 3:46 PM, Vithulan MV < >>>> vithulanmv.12(a)cse.mrt.ac.lk> wrote: >>>> >>>>> Hi Viktor, >>>>> >>>>> Do you mean creating proposals for GSOC 2016 page [1] ? If not please >>>>> kindly share the page link with me? >>>>> >>>>> [1] >>>>> https://github.com/balabit/syslog-ng/wiki/Creating-a-proposal-for-GSoC-2016 >>>>> >>>>> Thanks. >>>>> Regards, >>>>> Vithulan. >>>>> >>>>> On 10 March 2016 at 19:40, Juhász, Viktor <viktor.juhasz(a)balabit.com> >>>>> wrote: >>>>> >>>>>> Hi Vithulan, >>>>>> >>>>>> We've finished our GSoC process description. Please read it >>>>>> carefully, and fill our Student Application Form. >>>>>> >>>>>> BR, >>>>>> Viktor >>>>>> >>>>>> On Thu, Mar 10, 2016 at 3:06 PM, Vithulan MV < >>>>>> vithulanmv.12(a)cse.mrt.ac.lk> wrote: >>>>>> >>>>>>> HI Viktor, >>>>>>> >>>>>>> Thanks for the overview and giving the overall idea. I'm working on >>>>>>> this and report you back on the progress. >>>>>>> >>>>>>> Thanks. >>>>>>> Regards, >>>>>>> Vithulan. >>>>>>> >>>>>>> On 8 March 2016 at 18:05, Juhász, Viktor <viktor.juhasz(a)balabit.com> >>>>>>> wrote: >>>>>>> >>>>>>>> Hi Vithulan, >>>>>>>> >>>>>>>> Yes, this should be plugin (you can find the plugins in the modules >>>>>>>> directory in syslog-ng source). >>>>>>>> >>>>>>>> Just a very briefly overview: >>>>>>>> >>>>>>>> syslog-ng read messages from the sources, process them with >>>>>>>> filters, rewrite rules, parsers, etc, and finally send messages to the >>>>>>>> destinations. >>>>>>>> We have a Kafka destination, it is implemented in java. The kafka >>>>>>>> source also should be implemented in java, but we our java source base is >>>>>>>> under construction, so till I can't give you an exact API, it is comming in >>>>>>>> the next 2-3 weeks. >>>>>>>> >>>>>>>> The ovarall idea is the following. >>>>>>>> - We should implement a Kafka consumer which uses the high level >>>>>>>> kafka group consuming API ( >>>>>>>> https://cwiki.apache.org/confluence/display/KAFKA/Consumer+Group+Example >>>>>>>> ) >>>>>>>> - We have to process data read from the Kafka (create LogMessage >>>>>>>> from this. LogMessage is an internal struct in syslog-ng representing the >>>>>>>> in the software) >>>>>>>> - After reload or restart syslog-ng have to be able to continue >>>>>>>> reading messages from the last read message. >>>>>>>> - If there are more syslog-ng's reading the same Kafka input >>>>>>>> (these syslog-ng's have the same group name) avoid message loosing or >>>>>>>> message duplication as much as possible >>>>>>>> >>>>>>>> Regards, >>>>>>>> Viktor >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On Mon, Mar 7, 2016 at 6:43 PM, Vithulan MV < >>>>>>>> vithulanmv.12(a)cse.mrt.ac.lk> wrote: >>>>>>>> >>>>>>>>> Hi Viktor, >>>>>>>>> >>>>>>>>> Oh I see! I've sent a mail to the mail list. Can you kindly give >>>>>>>>> me an overall idea of project Kafka source please? (Architecture of >>>>>>>>> syslog-ng/ current APIs) Is this is going to be an extension of syslog-ng? >>>>>>>>> >>>>>>>>> Thank you. >>>>>>>>> >>>>>>>>> Regards, >>>>>>>>> Vithulan. >>>>>>>>> Hi Vithulan, >>>>>>>>> >>>>>>>>> I've never faced with this problem, during compiling syslog-ng. >>>>>>>>> I suggest, that ask about your problem in the mail list of >>>>>>>>> syslog-ng ;) >>>>>>>>> >>>>>>>>> Best Regards, >>>>>>>>> Viktor >>>>>>>>> >>>>>>>>> >>>>>>>>> On Mon, Mar 7, 2016 at 12:46 PM, Vithulan MV < >>>>>>>>> vithulanmv.12(a)cse.mrt.ac.lk> wrote: >>>>>>>>> >>>>>>>>>> Hi, >>>>>>>>>> >>>>>>>>>> I've been going through the git book that you referred. It was >>>>>>>>>> helpful. Can you please explain a bit about the project structure and >>>>>>>>>> deliverables of Kafka-source project? >>>>>>>>>> >>>>>>>>>> I added required dependencies and tried to build syslog-ng from >>>>>>>>>> the source, there was an error saying, >>>>>>>>>> *${syslog-ng_HOME}/modules/afmongodb/mongo-c-driver/src/mongoc/mongoc-scram.c: >>>>>>>>>> In function '_mongoc_scram_sha1':* *storage size of 'digest_ctx' >>>>>>>>>> isn't known** (EVP_MD_CTX digest_ctx)* >>>>>>>>>> I confirmed OpenSSL [1] headers are included in the file.Can you >>>>>>>>>> please point out whats wrong? >>>>>>>>>> >>>>>>>>>> In the meantime I'm going through the syslog-ng documentation >>>>>>>>>> [2]. Can you give me directives on what I can be doing while preparing my >>>>>>>>>> proposals? >>>>>>>>>> >>>>>>>>>> [1] >>>>>>>>>> https://github.com/mongodb/mongo-c-driver/blob/7415d3468de0c500fd6e630f7b52… >>>>>>>>>> [2] >>>>>>>>>> https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-… >>>>>>>>>> >>>>>>>>>> Thank you. >>>>>>>>>> Regards, >>>>>>>>>> Vithulan. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On 4 March 2016 at 18:56, Vithulan MV < >>>>>>>>>> vithulanmv.12(a)cse.mrt.ac.lk> wrote: >>>>>>>>>> >>>>>>>>>>> Hi, >>>>>>>>>>> >>>>>>>>>>> Thanks for the reference, I will go through it and report you >>>>>>>>>>> back on the progress. >>>>>>>>>>> >>>>>>>>>>> Thanks, >>>>>>>>>>> Regards, >>>>>>>>>>> Vithulan. >>>>>>>>>>> >>>>>>>>>>> On 4 March 2016 at 18:45, Juhász, Viktor < >>>>>>>>>>> viktor.juhasz(a)balabit.com> wrote: >>>>>>>>>>> >>>>>>>>>>>> Hello, >>>>>>>>>>>> >>>>>>>>>>>> Sorry for the long response time. We are working on a wiki >>>>>>>>>>>> page, this page will describe all the required information. Till please >>>>>>>>>>>> read our documentation (getting started) >>>>>>>>>>>> https://www.gitbook.com/book/syslog-ng/getting-started/details >>>>>>>>>>>> >>>>>>>>>>>> Best Regards, >>>>>>>>>>>> Viktor Juhasz >>>>>>>>>>>> >>>>>>>>>>>> On Fri, Mar 4, 2016 at 2:09 PM, Vithulan MV < >>>>>>>>>>>> vithulanmv.12(a)cse.mrt.ac.lk> wrote: >>>>>>>>>>>> >>>>>>>>>>>>> Hello, >>>>>>>>>>>>> >>>>>>>>>>>>> I sent the following mail to the syslog-ng mailing list, but >>>>>>>>>>>>> didn't get any responses. So I thought it didn't reach to you. I'm highly >>>>>>>>>>>>> motivated on contributing for syslog-ng in GSoC 2016. I also have prior >>>>>>>>>>>>> experience in syslog-ng domain so I feel like this project is going to be >>>>>>>>>>>>> very interesting. Please kindly guide me on how I should start? >>>>>>>>>>>>> >>>>>>>>>>>>> Thank you. >>>>>>>>>>>>> >>>>>>>>>>>>> Regards, >>>>>>>>>>>>> Vithulan. >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> ---------- Forwarded message ---------- >>>>>>>>>>>>> From: Vithulan MV <vithulanmv.12(a)cse.mrt.ac.lk> >>>>>>>>>>>>> Date: 3 March 2016 at 15:33 >>>>>>>>>>>>> Subject: [GSoC] Project: Kafka source >>>>>>>>>>>>> To: syslog-ng(a)lists.balabit.hu >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> Hi all, >>>>>>>>>>>>> >>>>>>>>>>>>> I'm currently a 3rd year undergraduate at University of >>>>>>>>>>>>> Moratuwa, Sri lanka. I have attached my Linkedin profile with this mail >>>>>>>>>>>>> [1]. I'd like to contribute to a GSoC 2016 project with the open source >>>>>>>>>>>>> community of syslog-ng. >>>>>>>>>>>>> >>>>>>>>>>>>> I have contributed in log analyzing project LogAnalyzer [2] >>>>>>>>>>>>> and also worked with logstash, kafka. Therefore, I think I can contribute >>>>>>>>>>>>> syslog-ng project kafka source as I'm much interested in that. >>>>>>>>>>>>> >>>>>>>>>>>>> Please kindly make any suggestions on how I should proceed on >>>>>>>>>>>>> this? >>>>>>>>>>>>> >>>>>>>>>>>>> [1] https://lk.linkedin.com/in/vithulamv >>>>>>>>>>>>> [2] https://github.com/VIthulan/product-la >>>>>>>>>>>>> >>>>>>>>>>>>> Thank you. >>>>>>>>>>>>> Regards, >>>>>>>>>>>>> Vithulan >>>>>>>>>>>>> >>>>>>>>>>>>> -- >>>>>>>>>>>>> Vithulan MV. >>>>>>>>>>>>> >>>>>>>>>>>>> Undergraduate, >>>>>>>>>>>>> Department of Computer Science & Engineering, >>>>>>>>>>>>> University of Moratuwa, >>>>>>>>>>>>> Sri lanka. >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> -- >>>>>>>>>>>>> Vithulan MV. >>>>>>>>>>>>> >>>>>>>>>>>>> Undergraduate, >>>>>>>>>>>>> Department of Computer Science & Engineering, >>>>>>>>>>>>> University of Moratuwa, >>>>>>>>>>>>> Sri lanka. >>>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> -- >>>>>>>>>>> Vithulan MV. >>>>>>>>>>> >>>>>>>>>>> Undergraduate, >>>>>>>>>>> Department of Computer Science & Engineering, >>>>>>>>>>> University of Moratuwa, >>>>>>>>>>> Sri lanka. >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> -- >>>>>>>>>> Vithulan MV. >>>>>>>>>> >>>>>>>>>> Undergraduate, >>>>>>>>>> Department of Computer Science & Engineering, >>>>>>>>>> University of Moratuwa, >>>>>>>>>> Sri lanka. >>>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>> >>>>>>> >>>>>>> -- >>>>>>> Vithulan MV. >>>>>>> >>>>>>> Undergraduate, >>>>>>> Department of Computer Science & Engineering, >>>>>>> University of Moratuwa, >>>>>>> Sri lanka. >>>>>>> >>>>>> >>>>>> >>>>> >>>>> >>>>> -- >>>>> Vithulan MV. >>>>> >>>>> Undergraduate, >>>>> Department of Computer Science & Engineering, >>>>> University of Moratuwa, >>>>> Sri lanka. >>>>> >>>> >>>> >>> >>> >>> -- >>> Vithulan MV. >>> >>> Undergraduate, >>> Department of Computer Science & Engineering, >>> University of Moratuwa, >>> Sri lanka. >>> >> > > > -- > Vithulan MV. > > Undergraduate, > Department of Computer Science & Engineering, > University of Moratuwa, > Sri lanka. > -- Vithulan MV. Undergraduate, Department of Computer Science & Engineering, University of Moratuwa, Sri lanka.

2 1

Re: [syslog-ng] Switching the syslog-ng central server - client messages go missing
by jrhendri 27 Apr '16

27 Apr '16

Can you test manually using logger? That way you can see if it behaves differently with different combinations of facility and priority. Also capture those with tcpdump or whatever. I seem to recall that Solaris uses different mappings than other operating systems. You might look at the sending and receiving system header files. I forget the exact name or location but something like /usr/include/sys/syslog.h I think... Good luck Jim Sent from my Verizon, Samsung Galaxy smartphone -------- Original message --------From: "Cottington-Bray, Ian" <ian.cottington-bray(a)mclaren.com> Date: 4/27/16 7:06 AM (GMT-05:00) To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] Switching the syslog-ng central server - client messages go missing Thanks for the feedback – had to wait for a period to test again. Comments below Ian Cottington-Bray | Senior Infrastructure Engineer – Linux/Unix | McLaren Technology Group Limited McLaren Technology Centre, Chertsey Road, Woking, Surrey GU21 4YH, UK T: +44 (0) 1483 261 900 D: +44 (0) 1483 262 357 E: ian.cottington-bray(a)mclaren.com W: www.mclaren.com From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Scheidler, Balázs Sent: 21 April 2016 10:33 To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] Switching the syslog-ng central server - client messages go missing hmm... couple of things come to mind, not all syslog-ng related: 1) are those messages actually arriving on the host (check with tcpdump) Sometimes – I see network packets being sent some of the time (by the client) but not always 2) is the local firewall letting them through? There is no firewall on this network 3) is syslog-ng bound to a specific ip/port or it is bound to 0.0.0.0? (check that with netstat) Specific IP/port (514) – several IPs in fact 4) you should be able to use telnet/netcat on the client host to check if the port on the solaris11 box is open The port is open 5) if all else fails, check the syslog-ng config, but that shouldn't be a problem It looks OK to me .. It almost looks like the client systems don’t send all the time – which is VERY strange and I’m struggling to understand why. The client systems seem to send a few messages immediately after syslog-ng starts on the central server and then stop sending … If I shutdown the new server and bring up the old one the messages start appearing in the logs as I would expect. Any suggestions ? Bazsi -- Bazsi On Wed, Apr 20, 2016 at 4:51 PM, Cottington-Bray, Ian <ian.cottington-bray(a)mclaren.com> wrote: Hi I have a Solaris 10 server running version 3.0 of syslog-ng. I have built a new server running Solaris 11 with version 3.6 of syslog-ng installed. I have tested the new server by pointing another client at it and messages appear in the configured files as expected. I then shut down the Solaris 10 server – change the Solaris 11 server IP configuration to match the details for the Solaris 10 server – restart syslog-ng on the Solaris 11 server. Things seem to be working ok – except for the (Solaris and Linux) clients using syslog-ng (and referencing the central syslog-ng server by IP) their messages do not arrive at the expected files. Any suggestions ? Ian Ian Cottington-Bray | Senior Infrastructure Engineer – Linux/Unix | McLaren Technology Group Limited McLaren Technology Centre, Chertsey Road, Woking, Surrey GU21 4YH, UK T: +44 (0) 1483 261 900 D: +44 (0) 1483 262 357 E: ian.cottington-bray(a)mclaren.com W: www.mclaren.com The contents of this e-mail are confidential and for the exclusive use of the intended recipient. If you are not the intended recipient you should not read, copy, retransmit or disclose its contents. If you have received this email in error please delete it from your system immediately and notify us either by email or telephone. The views expressed in this communication may not necessarily be the views held by McLaren Technology Group Limited. McLaren Technology Group Limited | McLaren Technology Centre | Chertsey Road | Woking | Surrey | GU21 4YH | UK | Company Number: 01967715 ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq The contents of this e-mail are confidential and for the exclusive use of the intended recipient. If you are not the intended recipient you should not read, copy, retransmit or disclose its contents. If you have received this email in error please delete it from your system immediately and notify us either by email or telephone. The views expressed in this communication may not necessarily be the views held by McLaren Technology Group Limited. McLaren Technology Group Limited | McLaren Technology Centre | Chertsey Road | Woking | Surrey | GU21 4YH | UK | Company Number: 01967715

1 0

Switching the syslog-ng central server - client messages go missing
by Cottington-Bray, Ian 27 Apr '16

27 Apr '16

Hi I have a Solaris 10 server running version 3.0 of syslog-ng. I have built a new server running Solaris 11 with version 3.6 of syslog-ng installed. I have tested the new server by pointing another client at it and messages appear in the configured files as expected. I then shut down the Solaris 10 server - change the Solaris 11 server IP configuration to match the details for the Solaris 10 server - restart syslog-ng on the Solaris 11 server. Things seem to be working ok - except for the (Solaris and Linux) clients using syslog-ng (and referencing the central syslog-ng server by IP) their messages do not arrive at the expected files. Any suggestions ? Ian Ian Cottington-Bray | Senior Infrastructure Engineer - Linux/Unix | McLaren Technology Group Limited McLaren Technology Centre, Chertsey Road, Woking, Surrey GU21 4YH, UK T: +44 (0) 1483 261 900 D: +44 (0) 1483 262 357 E: ian.cottington-bray(a)mclaren.com W: www.mclaren.com<http://www.mclaren.com/> The contents of this e-mail are confidential and for the exclusive use of the intended recipient. If you are not the intended recipient you should not read, copy, retransmit or disclose its contents. If you have received this email in error please delete it from your system immediately and notify us either by email or telephone. The views expressed in this communication may not necessarily be the views held by McLaren Technology Group Limited. McLaren Technology Group Limited | McLaren Technology Centre | Chertsey Road | Woking | Surrey | GU21 4YH | UK | Company Number: 01967715

3 5

Re: [syslog-ng] GSoC 2016: we are looking for Featuer Owners.
by Laszlo Budai 26 Apr '16

26 Apr '16

Hi, in the past we did not have feature owners, so we don't have any experiences. This is actually a new role that I want to initiate to our GSoC projects (and later I want to share the experiences with Google). Feature owners are those community members who are highly interested in a specific feature so they can represents the users. Of course they can also check the code :) I think FOs will also keep an eye on the GSoC release timeline. >From the blogpost I posted few months ago: Feature owners:Feature owners represent the community during the development phase.Feature owners send feedback to the students.Feature owners write blogpost(s) about the feature.L. Sent from my HTC ----- Reply message ----- From: "Scheidler, Balázs" <balazs.scheidler(a)balabit.com> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] GSoC 2016: we are looking for Featuer Owners. Date: Tue, Apr 26, 2016 14:27 What kind of commitment do you need from these feature owners? I know it can be difficult to judge, but what are your past experiences? On Apr 26, 2016 1:18 PM, "Laszlo Budai" <laszlo.budai(a)outlook.com> wrote: > > Hi, > > > Students have sent proposals to the following five projects (other project > ideas, such as wildcard file source, were not so popular :-) ) : > > > - Automated release generation for syslog-ng > > > https://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-list#proj… > > The selected proposal: > https://drive.google.com/open?id=0B5rOtg14cnD0UDJFcnFBLWhXMVUby Ankush > Sharma. > > > - Websocket for syslog-ng > https://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-list#proj… > > > The selected proposal: > https://drive.google.com/open?id=0B5rOtg14cnD0MG1yX3NPNmFoMTAby Yilin Li. > > > - Kafka source > https://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-list#proj… > > > The selected proposal: > https://drive.google.com/open?id=0B5rOtg14cnD0VXQyYncxaTliaXM by Vithulan > MV. > > > - syslog-ng as a command line tool > https://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-list#proj… > > > The selected proposal : > https://drive.google.com/open?id=0B5rOtg14cnD0ek9TSklPSnZ4YWM by Noemi > Vanyi. > > > - Web based syslog-ng configuration editor > > > https://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-list#proj… > > The selected proposal: > https://drive.google.com/open?id=0B5rOtg14cnD0cm9DaEtUVmZGT1U by Raymund > Acs. > > > > As we have already mentioned https://syslog-ng.org/gsoc-2016/ , we will > ask you to join us and help students in their work. > > Our goal is to build a syslog-ng-GSoC release after the program is > finished. > > > Join us! We need Feature Owners who are members of our community. > > If you are interested in one of the projects and want to be a Feature > Owner, just contact to us at ( gitter https://gitter.im/balabit/syslog-ng , > this mailing list ). > > > Regards, > Laszlo Budai > > Sent from my HTC > > > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

GSoC 2016: we are looking for Featuer Owners.
by Laszlo Budai 26 Apr '16

26 Apr '16

Hi, Students have sent proposals to the following five projects (other project ideas, such as wildcard file source, were not so popular :-) ) : Automated release generation for syslog-nghttps://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-… The selected proposal: https://drive.google.com/open?id=0B5rOtg14cnD0UDJFcnFBLWhXMVUby Ankush Sharma. Websocket for syslog-nghttps://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-… The selected proposal: https://drive.google.com/open?id=0B5rOtg14cnD0MG1yX3NPNmFoMTAby Yilin Li. Kafka sourcehttps://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-lis… The selected proposal: https://drive.google.com/open?id=0B5rOtg14cnD0VXQyYncxaTliaXM by Vithulan MV. syslog-ng as a command line toolhttps://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-list#… The selected proposal : https://drive.google.com/open?id=0B5rOtg14cnD0ek9TSklPSnZ4YWM by Noemi Vanyi. Web based syslog-ng configuration editor https://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-list#proj… The selected proposal: https://drive.google.com/open?id=0B5rOtg14cnD0cm9DaEtUVmZGT1U by Raymund Acs. As we have already mentioned https://syslog-ng.org/gsoc-2016/ , we will ask you to join us and help students in their work. Our goal is to build a syslog-ng-GSoC release after the program is finished. Join us! We need Feature Owners who are members of our community. If you are interested in one of the projects and want to be a Feature Owner, just contact to us at ( gitter https://gitter.im/balabit/syslog-ng , this mailing list ). Regards, Laszlo Budai Sent from my HTC

2 1

ELK herd to scale
by Scot Needy 25 Apr '16

25 Apr '16

Hi, Does anyone have links or care to share notes on making a syslog-ng -> ELK scale for enterprise ? I have some ideas and will gladly share my solution but also don’t want to spend days figuring these things out that have already been built. There are many ELK specific references but I also want to make sure the model fits the syslog workload. Thanks

8 18