- syslog-ng - lists.balabit.hu

[GSoC] Project: Kafka source
by md mehrab 10 Mar '16

10 Mar '16

Hi all, I am currently 4th year undergraduate student at Faculty of Engineering, Jamia Millia Islamia, New Delhi, India. I would like to contribute to a GSoC 2016 project with open source community of syslog-ng. In last summer vacation i worked (as intern )for a company where i was the part of data aggregator project (one of the core member of this project ). Main idea of this project is to build scalable system so that it can handle millions of request per minute. For this we used kafka messaging system. Producer simply produce message to particular topic and consumer get message from that topic and feed to async task (celery worker). I think I can contribute syslog-ng project kafka source. @Viktor Juhasz <https://github.com/juhaszviktor> (Mentor) kindly give me suggestions. -- Md Mehrab Alam https://www.linkedin.com/in/iammehrabalam https://github.com/iammehrabalam

2 3

Insider 2016-03: GSoC; disk buffer; Rust; blogs; DevConf.cz
by Czanik, Péter 10 Mar '16

10 Mar '16

Dear syslog-ng users, This is the 48th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Google Summer of Code (GSoC) ---------------------------- The syslog-ng project will participate GSoC this year again. We published our application form: https://syslog-ng.org/gsoc-2016-applicant-form-syslog-ng-project/ As you can see, we plan to publish a GsoC release once the coding period is over. Topics cover many different aspects of syslog-ng, from release engineering through database connections to message correlation. Disk-based buffering -------------------- Disk-based buffering is now merged to syslog-ng git master and will be part of syslog-ng 3.8. It can be used for storing messages on the local hard disk if the central log server or the network connection to the server becomes unavailable. The syslog-ng application automatically sends the stored messages to the server when the connection is reestablished. For details and information how to test it now read https://syslog-ng.org/493-2/ Rust: Filling the parse() method -------------------------------- Tibor Benke has posted an article about writing a parser that uses regular expressions in Rust. Read more at https://syslog-ng.org/filling-the-parse-method/ Parsers in syslog-ng: making sense of Zorp firewall logs -------------------------------------------------------- Figuring out how to parse your firewall logs is not always easy. This blogpost shows you some useful log-parsing techniques. For the examples, I use the logs of the Zorp proxy firewall. https://czanik.blogs.balabit.com/2016/03/making-sense-of-zorp-firewall-logs… Community driven blogging ------------------------- >From time to time, we publish blog posts about syslog-ng and we hope you find them interesting and useful. However, we would like to become better at this: we want to give you more and better content, more regularly. Also, we would like to be transparent about it, and give you the possibility to get involved. Read how you can participate: https://syslog-ng.org/525-2/ DevConf.cz ---------- This year it was even more difficult to decide how to spend my time at DevConf, the annual Fedora, Red Hat, JBoss developers’ conference in Brno. As a community manager for syslog-ng, I have tried to focus on community-related presentations and on technologies related to syslog-ng: containers, security and packaging. https://czanik.blogs.balabit.com/2016/02/devconf-2016-community-and-contain… NEW RELEASES syslog-ng PE 5 F6: https://istvanszabo.blogs.balabit.com/2016/03/syslog-ng-premium-edition-5f6… Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com . To read this newsletter on-line, visit: http://insider.blogs.balabit.com/ Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

NG License Usage
by Schoonover, Mark E HHHH 09 Mar '16

09 Mar '16

Thanks for reading, We had an issue today where a flood of new devices far exceeded our license count. Is there a way to monitor how many licenses are in use? We'd like to set up an alert to let us know we're close to running out of licenses. Thanks! Regards, Mark Schoonover Infrastructure Engineering Manager ENE : Tools, Instrumentation and Common Services Team Office: 32.8697° N, 116.9711° W Phone : 770-261-7934 Email : mark.schoonover(a)cigna.com<mailto:mark.schoonover@cigna.com> Confidential, unpublished property of Cigna Health & Life Insurance Co.. Do not duplicate or distribute. Use and distribution limited solely to authorized personnel. ©2016 CIGNA. ------------------------------------------------------------------------------ CONFIDENTIALITY NOTICE: If you have received this email in error, please immediately notify the sender by e-mail at the address shown. This email transmission may contain confidential information. This information is intended only for the use of the individual(s) or entity to whom it is intended even if addressed incorrectly. Please delete it from your files if you are not the intended recipient. Thank you for your compliance. Copyright (c) 2016 Cigna ==============================================================================

1 1

Syslog over TLS : Protocol is TCP and TLS
by Girish Kumar 09 Mar '16

09 Mar '16

Hi All, Finally I was able to setup syslog-ng client and server. Communicate over TLS. Thanks for all your help. In wireshark capture I am seeing all protocol as TCP and not as TLS. Please let me know whether my communication has happened over TLS. If yes how do I validate that. Can I enable additional logs in syslog-ng ? My tls part of conf file Client -------- destination d_destination { syslog("135.254.163.151" port(6514) transport("tls") tls( ca_dir("/etc/ca.d") key_file("/etc/cert.d/myCliPrivate.key") cert_file("/etc/cert.d/myCliCert.pem") ) ); }; Server --------- source d_source { syslog(ip("135.254.163.151") port(6514) transport("tls") tls( key_file("/etc/syslog-ng/cert.d/mySerPrivate.key") cert_file("/etc/syslog-ng/cert.d/mySerCert.pem") ca_dir("/etc/syslog-ng/ca.d")) ); }; Regards, Girish

2 5

removing old versions of syslog-ng
by Tim Lavin 08 Mar '16

08 Mar '16

Hi All, I recently inherited some old syslog-ng relay servers and I'm wanting to find the best way to upgrade them to syslog-ng PE 5.0. The syslog-ng versions are · 3.0.3 · 2.1.4 The PE admin guide mentions that upgrading is supported from OSE version 3.2. This leads me to understand I'll need to remove any version I find that's lower than 3.2, yet I do not see an uninstall script or reference to uninstalling syslog-ng in any of the documentation. Is uninstalling as simple as just removing all files and directories? Thanks, Tim Tim Lavin, Security Engineer Apollo Education Group, Inc | Security Operations 4035 S. Riverpoint Parkway │ MS: AA-M002 | Phoenix, AZ 85040 phone: 602-557-6400 | email: tim.lavin(a)phoenix.edu<mailto:tim.lavin@phoenix.edu> "This message is intended only for the use of the addressee(s) and may contain information that is PRIVILEGED and CONFIDENTIAL. If you are not the intended recipient(s), you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please erase all copies of the message and its attachments and notify the sender immediately."

3 2

Does syslog-ng 3.5.6 read from /run/systemd/journal/syslog ?
by Per Jessen 08 Mar '16

08 Mar '16

On openSUSE 13.2 with syslog-ng 3.5.6, I'm seeing these messages frequently: Mar 08 14:15:01 piccard systemd-journal[367]: Forwarding to syslog missed 1 messages. Mar 08 14:15:43 piccard systemd-journal[367]: Forwarding to syslog missed 3 messages. Mar 08 14:20:01 piccard systemd-journal[367]: Forwarding to syslog missed 1 messages. Mar 08 14:20:43 piccard systemd-journal[367]: Forwarding to syslog missed 1 messages. journald by default has ForwardtoSyslog=yes, but # lsof /run/systemd/journal/syslog COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME systemd 1 root 27u unix 0xffff880013130400 0t0 13446 /run/systemd/journal/syslog syslog-ng 584 root 3u unix 0xffff880013130400 0t0 13446 /run/systemd/journal/syslog seems to suggest syslog-ng is reading from /run/systemd/journal/syslog ? syslog-ng.conf: source src { system(); internal(); }; -- Per Jessen, Zürich (2.4°C) http://www.dns24.ch/ - your free DNS host, made in Switzerland.

1 1

Community driven blogging
by Budai, László 07 Mar '16

07 Mar '16

Hi, from time to time, we publish blog posts about syslog-ng and we hope you find them interesting and useful. However, we would like to become better at this: we want to give you more and better content, more regularly. Also, we would like to be transparent about it, and give you the possibility to get involved. Continue reading : https://syslog-ng.org/525-2/ regards, Laszlo Budai

1 0

Re: [syslog-ng] Regarding GSoC16 Project: syslog-ng as a command line tool
by Scheidler, Balázs 07 Mar '16

07 Mar '16

Hi, I've Cced the syslog-ng list, so others can see this description as well. The goal here is to change syslog-ng to be able to process input from stdin and produce output to stdout and exit when the EOF is reached, while processing a "potentially" simplified syslog-ng configuration block. A bit similar to how awk works, but instead of the awk language, use syslog-ng's constructs. E.g. $ syslog-ng -P 'parser { kv-parser(); }; destination { stdout(template("$(format-json *"))); };' < log-file-with-keywords.log > log-file-in-json Where -P would be equivalent to --pipe, the next argument is a configuration snippet. This snippet would get all logs as read from stdin() and that would be default functionality provided by the --pipe construct. Probably --pipe would use a configuration file something like: log { source { stdin(); }; # program supplied by --pipe would be included here pipe-program(); }; This is the basic idea, some customization would be useful, like: - being able to specify the source as well (so the above wouldn't be hardwired, only used as a default) - maybe use a default for output as well, so I wouldn't have to include it in the actual language - examples: a few examples how to process existing log files from postfix, iptables, snort/suricata, etc to convert their logs into json. This would be both a set of examples and could also drive the functionality further, so we don't miss important options. Code wise, this would need something like: - stdin source: would probably only be an SCL wrapper around the existing file() driver; e.g. file("/dev/stdin"); check for portability on various UNIXes (freebsd, solaris, macosx) - stdout destination: would probably only be an SCL wrapper around the existing file driver, e.g. file("/dev/stdout"); - stderr destinatiion: would probably only be an SCL wrapper around the existing file driver, e.g. file("/dev/stderr"); - a means to construct the complete configuration as passed in by command line arguments; would probably need to register confgen blocks, and a larger configuration frame where they are inserted. - a means to terminate syslog-ng when we read the entire input and all outputs are finished. (would probably be the most difficult) - tests Hope this helps. Bazsi -- Bazsi On Mon, Mar 7, 2016 at 6:37 AM, Viraj Madhawa <emadhawa23(a)gmail.com> wrote: > Dear Sir, > > I'm a computer engineering undergraduate student of University of > Peradeniya Sri Lanka. During my internship period I done a log managment > system project to a bank (using syslog protocol) . I'm quite interested > about this project idea and I like to get more details about it (ask some > questions). > > -- > Thank you, > Viraj Premaratne > > >

1 0

GSoC'16 [Automated release generation for syslog-ng]
by Arpit Singla 06 Mar '16

06 Mar '16

Hi, I am Arpit Singla. I would love to contribute to "Automated release generation for syslog-ng" project. I am an active member of SDSLabs <https://sdslabs.co/> and have a good knowledge of python. Please help me get started. Arpit Singla B.Tech., 2nd year, Electrical Engineering IIT Roorkee

1 0

For GSoC students
by Budai, László 06 Mar '16

06 Mar '16

Hi, here is a nice chance for contributing to syslog-ng : https://github.com/balabit/syslog-ng/pull/952 regards, Laszlo Budai

2 1