- syslog-ng - lists.balabit.hu

3.7.3 unofficial openSUSE / SLES packages
by Czanik, Péter 22 Mar '16

22 Mar '16

Hi, My unofficial syslog-ng 3.7.3 openSUSE / SLES packages are available at https://build.opensuse.org/project/show/home:czanik:syslog-ng37 I'll fix the Tumbleweed build later this week. If you have any questions or run into any problems, let me know! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

syslog-ng-3.7.3 unofficial Debian/Ubuntu packages
by Budai, László 22 Mar '16

22 Mar '16

Hi, I've just created my unofficial OBS repo[1] for syslog-ng 3.7.3 (latest revision: 3.7.3-2). List of supported OSs (i386/amd64): * Debian 7.0 * Debian 8.0 * Ubuntu 12.04 * Ubuntu 14.04 * Ubuntu 14.10 * Ubuntu 15.04 * Ubuntu 15.10 [newly added] Install ------- example: Debian 8.0 1. get release key wget -qO - http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… | sudo apt-key add - 2. add repo to APT sources eg.: /etc/apt/sources.list.d/syslog-ng-obs.list deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… ./ Then `apt-get update` and `apt-get install syslog-ng-core` You can replace Debian_8.0 to * Debian_7.0 * xUbuntu_12.04, * xUbuntu_14.04 * xUbuntu_14.10 * xUbuntu_15.04 * xUbuntu_15.10 Available packages: * syslog-ng-core * syslog-ng-dbg * syslog-ng-dev * syslog-ng-mod-stomp * syslog-ng-mod-amqp * syslog-ng-mod-elastic * syslog-ng-mod-geoip * syslog-ng-mod-graphite * syslog-ng-mod-hdfs * syslog-ng-mod-http * syslog-ng-mod-java * syslog-ng-mod-java-common-lib * syslog-ng-mod-journal * syslog-ng-mod-json * syslog-ng-mod-kafka * syslog-ng-mod-mongodb * syslog-ng-mod-python * syslog-ng-mod-redis * syslog-ng-mod-riemann * syslog-ng-mod-smtp * syslog-ng-mod-sql * syslog-ng-mod-stomp Notes to the java destinations ------------------------------ About the ``` Error opening plugin module; module='mod-java', error='libjvm.so: cannot open shared object file: No such file or directory' ``` problem. libmod-java.so is linked to the libjvm.so library. If your java installation doesn't create a symlink in /usr/lib directory to libjvm.so then you have to modify your ld.so.conf or expand your LD_LIBRARY_PATH with the containing library before starting syslog-ng. eg.: LD_LIBRARY_PATH=/usr/lib/jvm/java-7-openjdk-amd64/jre/lib/amd64/server:$LD_LIBRARY_PATH Links -------- [1] https://build.opensuse.org/project/show/home:laszlo_budai:syslog-ng [2] https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.7.3 regards, Laszlo Budai

1 0

syslog-ng-3.7.3
by Budai, László 22 Mar '16

22 Mar '16

3.7.3 Changes compared to 3.7.2: Improvements - Updated Python package requirements. - Can now compile without MongoDB. - Added eventlog to the list of required pkg-config packages. - Basic FreeBSD and HP-UX support of syslog debug bundle generator by improving POSIX shell compatibility. - Keep the program destination open between configuration reloads. - system-source now uses keep-timestamp(no) for Linux kernel log. The time source used by /dev/kmsg is not updated after system SUSPEND/RESUME. Fixes - Fix a SIGSEGV when a Redis command returns an error. - Resolve deadlock in logwriter triggered by suppress() - Mitigate possible deadlock in patterndb - Fixed global inheritance of pass-unix-credentials() and create-dirs(). - Certain compilers complained about an undefined symbol when setting keep-alive(yes). - For certain use cases, afsocket would not handle procfs read errors due to an integer underflow. - Enhanced Java version check and the handling of SyslogNgInternalLogger (used by Kafka), the FATAL loglevel and getLocationInformation(). - When a big amount of kernel log was produced in a very short time, the syslog-ng process sometimes entered into a spin and stop processing messages. Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: András Mitzki, Avleen Vig, Balázs Scheidler, Ben Kibbey, Christian Herzig, David Schweikert, Douglas Carmichael, Dezso Endre Molnar, Fabien Wernli, Gergely Czuczy, Gergely Nagy, Gergo Nagy, Hanno Böck, Herzig, Christian, Laszlo Budai, László Várady, MÓZES Ádám István, PÁSZTOR György, Péter Czanik, Robert Fekete, Saurabh Shukla, Tamás Nagy, Tibor Benke, Viktor Juhász, Vincent Bernat, Wang Long, Zdenek Styblik, Zoltán FRIED, Zoltán Pallagi — You are receiving this because you are subscribed to this thread. View it on GitHub <https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.7.3>

1 0

[GSoC] Interested in Python support for Correlation Library
by Akshay Aurora 22 Mar '16

22 Mar '16

Hi, I'm Akshay, computer science student from India. I have decent experience with Python and system programming. Being a Mozillian, I have always been a big fan of Rust and Servo project. I have previously dabbled with Rust – and think of it as next system programming language. I hope to improve my Rust skills as part of this project and write production quality code. I have also been Google Summer of Code student at Inclusive Design Institute in 2013 and Mozilla in 2014. Few questions and ideas related to the project - - While the reason to switch away from handlebars makes sense - Why do we want to using Python as templating language? What are some of the use cases, where Python could be beneficial over any other templating language? - Are there any existing projects using Python as templating language? How is this going to be different than passing the context data to a Python script? - For the SQL-like syntax mentioned in project description - Can we design it as Python library using Rust via CFFI [0]. I have filled the student application form. I'm already trying to understand the correlation library and playing around with existing tests. How can I get more involved and better understand the requirements of the project? [0] - https://github.com/tremolo/rust_python_integration -- - Akshay Aurora ᐧ

2 3

syslog-ng 3.7.2
by Budai, László 22 Mar '16

22 Mar '16

3.7.2 This is the first maintenance release for the 3.7.x series. Changes compared to 3.7.1: Improvements - Added mbox() source. This source can be used to fetch emails from local mbox files: source { mbox("/var/spool/mail/root"); }; This will fetch root emails and parse them into a multiline $MSG. Original implementation by Fabien Wernli, I only converted it into an SCL. - It is possible to append dynamically options into SCL blocks from now. - concurrent_request option added to ElasticSearch with default value 1. - In elasticsearch destinaton, message_template() argument renamed to template(). - SCL added to every Java module (ElasticSearch, Kafka, HDFS). - Linux Audit Parser added for parsing key-value pairs produced by the Linux Audit subsystem. - HTTP destination is now able to receive HTTP method as an option. All the supported methods are available (POST, PUT, HEAD, OPTIONS, DELETE, TRACE, GET). Fixes - In some circumstances syslog-ng mod-journal re-read every already processed messages. - When syslog-ng got a reload and the reload process done within 1 second then mafter the reload, syslog-ng stop generating mark-messages. - When initialization of a network destination in syslog-ng failed (eg. due to DNS resolution failure) we didn't create a queue which caused message loss. - syslog-ng segfaulted on TLS errors when wrong certs was provided (eg.: CA cert with the cert-file directive instead of the server cert). - Fixed a continuous spinning case in the file driver, when the destination file is a device (e.g. /dev/stdout). - A memory leak in around template functions in grammar fixed. - Fixed Python3 support. - Fixed Python GIL issue in python destination. - From now, instead of skipping doc/ alltogether when ENABLE_MANPAGES is not set, only skip the actual man pages, but handle the rest properly. - Allow overriding the python setup.py options. When installing the python modules, allow overriding the options. This is useful for distributions that want to pass extra options. For example, on Debian, we want --install-layout="deb" instead of the --prefix and --root options. With this change, the previous behaviour remains the default, but one can supply PYSETUP_OPTIONS on the make command-line to override it. - The systemd service file read /etc/default/syslog-ng and /etc/sysconfig/syslog-ng, but didn't do anything with their contents. $SYSLOGNG_OPTS added to ExecStart, so that the EnvironmentFiles have an effect (at least on Debian). - Java support checking fixed (not only jdk is required but also gradle). - Memory leak around ping() in Redis fixed. - A crash in pdbtool fixed around r_parser_email(). - Removed cygwin fdlimit statement. Make the default for RLIMIT_NOFILE equal to the current system limits. --fd-limit can still override this, but the default will be configured based on existing system limits. - Fixed BSD year inference. Fixed logic and made clearer the inference of year from bsd-style rfc3164 syslog-messages, which do not include a year. - Handle correctly the epoch 0 timestamp. (Previously, syslog-ng cached the zero timestamp and treated 1970 as it was 1900.) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Adam Arsenault, Adam Istvan Mozes, Andras Mitzki, Avleen Vig, Balazs Scheidler, Fabien Wernli, Gergely Czuczy, Gergely Nagy, Gergo Nagy, Laszlo Budai, Peter Czanik, Robert Fekete, Saurabh Shukla, Tamas Nagy, Tibor Benke, Viktor Juhasz, Vincent Bernat, Wang Long, Zdenek Styblik, Zoltan Pallagi. — View it on GitHub <https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.7.2>.

4 3

error='self signed certificate in certificate chain'
by Girish Kumar 17 Mar '16

17 Mar '16

Hi All, I am getting following error while starting syslog-ng with tls option. Could you please help me on this Mar 12 18:14:24 (none) syslog-ng[6136]: Syslog connection established; fd='5', server='AF_INET(10.135.83.103:6514)', local='AF_INET(0.0.0.0:0)' Mar 12 18:14:24 (none) syslog-ng[6136]: Certificate validation failed; subject='emailAddress=giri(a)gmail.com, CN=girish kumar, OU=esd, O=enterprise, L=BAN, ST=KA, C=IN', issuer='emailAddress=giri(a)gmail.com, CN=girish kumar, OU=esd, O=enterprise, L=BAN, ST=KA, C=IN', error='self signed certificate in certificate chain', depth='1' Mar 12 18:14:24 (none) syslog-ng[6136]: SSL error while writing stream; tls_error='SSL routines:ssl3_get_server_certificate:certificate verify failed' Mar 12 18:14:24 (none) syslog-ng[6136]: I/O error occurred while writing; fd='5', error='Broken pipe (32)' Mar 12 18:14:24 (none) syslog-ng[6136]: Syslog connection broken; fd='5', server='AF_INET(10.135.83.103:6514)', time_reopen='60' //server conf source d_source { #syslog(ip("mysyslog.server.com") port(6514) syslog(ip("10.135.83.103") port(6514) transport("tls") tls( key_file("/etc/cert.d/mySerPrivate.key") cert_file("/etc/cert.d/mySerCert.pem") ca_dir("/etc/ca.d") ssl-options(no-sslv2, no-sslv3, no-tlsv1, no-tlsv11) ) ); }; //Client conf destination d_destination { #syslog("mysyslog.server.com" port(6514) syslog("10.135.83.103" port(6514) transport("tls") tls( ca_dir("/etc/ca.d") key_file("/etc/cert.d/myCliPrivate.key") cert_file("/etc/cert.d/myCliCert.pem") ssl-options(no-sslv2, no-sslv3, no-tlsv1, no-tlsv11) ) ); }; Regard, Girish

2 5

[GSOC]Some questions about the project:WebSocket for syslog-ng
by Yilin Li 17 Mar '16

17 Mar '16

Hi, I got some questions about GSOC Project: WebSocket for syslog-ng 1) WebSocket support two-way communication. However, I found only one-way communication will be used in the project Idea. If this destination will be used for alerting, what are the advantages of using Websocket? Is it mainly for supporting another new protocol or better performance of WebSocket ? 2) It says we need a sample webserver to receive and handle messages coming from syslog-ng. Can this sample webserver written in python ? Does "handle" just mean recieve messages and display them to prove the destination is working properly? Need the webserver do anything else such as writing them to files or sending emails for altering? Thanks :) -- Thanks, Yiln Li -- Institute of Software Chinese Academy of Sciences

3 5

[GSoC]
by Juhász, Viktor 16 Mar '16

16 Mar '16

Dear GSoC Student Applicant, We would like to thank you for filling the Student Application Form. To finish your application process, do not forget to write your proposal Best Regards, Viktor Juhasz The syslog-ng project

1 0

Re: [syslog-ng] syslog-ng GSoC 2016
by Laszlo Budai 11 Mar '16

11 Mar '16

Hi, please read the GSoC docs provided by Google: https://developers.google.com/open-source/gsoc/rules They say that : Each Student may submit up to five (5) Project Proposals; however, only one (1) Project Proposal may be accepted per Student. So the short answer is yes, you can :) L. Sent from my HTC ----- Reply message ----- From: "Yilin Li" <liyilin1214(a)gmail.com> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] syslog-ng GSoC 2016 Date: Thu, Mar 10, 2016 17:06 Hi, Really grateful for your guidance. I've got some questions. If I'm interested in more than one projects. Can I submit more than one proposals? Thanks! 2016-03-10 23:24 GMT+08:00 Budai, László <laszlo.budai(a)balabit.com>: > Hi, > > the syslog-ng team invites you to join GSoC with us : > http://youtu.be/hCLOGU8OooM . > > If you are interested in GSoC, visit our homepage where we share some > useful information with you: https://syslog-ng.org/gsoc-2016/ . > > > regards, > Laszlo Budai > > > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > -- Thanks, Yiln Li -- Institute of Software Chinese Academy of Sciences ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

2 1

syslog-ng GSoC 2016
by Budai, László 10 Mar '16

10 Mar '16

Hi, the syslog-ng team invites you to join GSoC with us : http://youtu.be/hCLOGU8OooM . If you are interested in GSoC, visit our homepage where we share some useful information with you: https://syslog-ng.org/gsoc-2016/ . regards, Laszlo Budai

2 1