- syslog-ng - lists.balabit.hu

Dependency on default-jre for Debian package
by Marc Falzon 22 Jan '16

22 Jan '16

Hi I'm trying to install the unofficial syslog-ng 3.7.2 Debian packages from http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… however I have a problem with the Java-related packages, since they have a package dependency on `default-jre`, and I'm using an Oracle JRE packaged using the `make-jpkg` utility which generates a Debian package providing `java-browser-plugin, java-runtime, java-runtime-headless, java-virtual-machine, java2-runtime, java2-runtime-headless, java6-runtime, java6-runtime-headless, java7-runtime, java7-runtime-headless, java8-runtime, java8-runtime-headless`, but not `default-jre`. Is it possible to modify those packages so that they depend on `java-runtime` instead? The `default-jre` packages also provide `java-runtime`. Thank you, m.

1 0

"Syslog connection closed" but socket not closed
by Patrick Hemmer 21 Jan '16

21 Jan '16

We recently saw an issue where syslog-ng (version 3.6.4 on FreeBSD 10.1) was configured with a `syslog()` source, received an invalid frame, shut down the connection, but the socket remained open. I was looking through the documented fixes in the versions since the one we're using (3.6.4), but nothing looks related. 2016-01-21T07:44:21-05:00 iad1gweb01.ecom.chewy.com ERR syslog-ng[27090]: - Invalid frame header; header='' [meta sequenceId="389"] 2016-01-21T07:44:21-05:00 iad1gweb01.ecom.chewy.com NOTICE syslog-ng[27090]: - Syslog connection closed; fd='19', client='AF_INET(127.0.0.1:59317)', local='AF_INET(127.0.0.1:601)' [meta sequenceId="390"] # netstat -an|grep 59317 tcp4 81660 0 127.0.0.1.601 127.0.0.1.59317 ESTABLISHED tcp4 0 48923 127.0.0.1.59317 127.0.0.1.601 ESTABLISHED From the netstat output (the buffer sizes), it looks like syslog-ng stopped reading from the socket, but didn't close it, and the application on the other end kept trying to write to it. This is just my theory anyway. I can open a bug on github, but I wanted to bring it up here first. Thanks -Patrick

1 0

RFC5425 framing and log_msg_size
by Blake Day 21 Jan '16

21 Jan '16

Hi all, I’m wondering why syslog-ng disconnects clients that try to send log messages exceeding log_msg_size instead of just gracefully accepting and truncating the message? I took a quick glance at the code, and it appears to only affect clients using RFC5425 framing. Here is the relevant code: if (self->frame_len > self->super.options->max_msg_size) { msg_error("Incoming frame larger than log_msg_size()", evt_tag_int("log_msg_size", self->super.options->max_msg_size), evt_tag_int("frame_length", self->frame_len), NULL); return LPS_ERROR; } Here are excerpts from my logs showing the problem: 2016-01-20T11:27:28-05:00 [HOST] ERR syslog-ng[87462]: - Incoming frame larger than log_msg_size(); log_msg_size='16384', frame_length='76218' [meta sequenceId="6560"] 2016-01-20T11:27:28-05:00 [HOST] NOTICE syslog-ng[87462]: - Syslog connection closed; fd='26', client='AF_INET(127.0.0.1:52627)', local='AF_INET(127.0.0.1:601)' [meta sequenceId="6561"]

2 1

Re: [syslog-ng] patterndb and smtp to() issue
by Laszlo Budai 21 Jan '16

21 Jan '16

Hi, templateable afsmtp to() is available from version 3.7.1 . Sent from my HTC ----- Reply message ----- From: "Fabien Wernli" <wernli(a)in2p3.fr> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] patterndb and smtp to() issue Date: Thu, Jan 21, 2016 06:55 Hi Alexandre, Templateable smtp/to() and co. was added only recently. I'll check later in the day on which version it appeared. ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

2 1

patterndb and smtp to() issue
by Alexandre DEPREZ 21 Jan '16

21 Jan '16

Hi all, I'm using the pattern-db to extract values from a firewall's log. This far, everything's working great. The log looks something like this: Jan 20 2016 21:48:45: %ASA-7-746012: user-identity: Add IP-User mapping 10.10.99.7 - LOCAL\alex Succeeded - VPN user Using pdbtool and matching the log against the xml pattern file, this is showing me good results : :$pdbtool match -P "%ASA-7-746012" -M "user-identity: Add IP-User mapping 10.10.99.7 - LOCAL\alex Succeeded - VPN user" -p /etc/syslog-ng/patterndb.d/vpn-parser-up.xml -D -c Pattern matching part: user-identity: Add IP-User mapping @IPv4:VPN_IP=10.10.99.7@ - LOCAL\ @STRING:VPN_USER=alex@ Succeeded - VPN user Matching part: user-identity: Add IP-User mapping 10.10.99.7 - LOCAL\alex Succeeded - VPN user Values: MESSAGE=user-identity: Add IP-User mapping 10.10.99.7 - LOCAL\alex Succeeded - VPN user PROGRAM=%ASA-7-746012 .classifier.class=vpn.access_log .classifier.rule_id=019045a7383c252e57c20435ae5bf86c VPN_IP=10.10.99.7 VPN_USER=alex TAGS= Here's the xml file <patterndb version='4' pub_date='2015-12-22'> <ruleset id='04ba26e756011614c57cf469fed7b5c0' name='%ASA-7-746012'> <pattern>%ASA-7-746012</pattern> <rules> <rule class='vpn.access_log' id='019045a7383c252e57c20435ae5bf86c' provider='alex'> <patterns> <pattern>user-identity: Add IP-User mapping @IPv4:VPN_IP@ - LOCAL\@STRING:VPN_USER@ Succeeded - VPN user</pattern> </patterns> </rule> </rules> </ruleset> </patterndb> Now, the problem lies on the destination which is using the smtp driver. destination vpn_mail_up { smtp( host("x.x.x.x") port(25) from("alex(a)x.y" "alex(a)x.y") to("${VPN_USER}(a)x.y") subject("vpn connection") body("vpn connection from ${VPN_USER} with IP: ${VPN_IP}\n") ); }; The variable is functional inside the body() but not in the to() field. Here's a dump I extracted directly from the server on the tcp session to the mail server: RCPT.TO:<${VPN_USER}(a)x.y>.. BDAT.411.. X-Mailer:.syslog-ng.3.5.6.. Date:.Wed,.20.Jan.2016.21:51:51.+0100.. From:.alex@x.y.. Message-Id:.<1453323111.149975.19608@debian>.. To:."${VPN_USER}(a)x.y".<${VPN_USER}(a)x.y>.. Subject:.vpn.connection.. .BDAT.68..vpn.connection.from.alex..with.IP:.10.10.99.7.BDAT.2.LAST.. The variable is being populated in the body message but not the recipient. Is there any chance the variable could only be used once (!?) or not being able to be used inside the to() ? Regards, Alex

2 1

Syslog-ng mutual self cert authentication
by Ivan Adji - Krstev 18 Jan '16

18 Jan '16

Hi all, I'm truing to make mutual self cert authentication with Syslog-NG and using LogAnalyzer to see the logs. I have done the following: *Server configuration:* Creating a CA making directory and put the openssl.cnf file in the directory etc. do the following command: 1. openssl req -new -x509 -keyout private/cakey.pem -out cacert.pem -days 365 -config openssl.cnf 2. openssl req -nodes -new -x509 -keyout serverkey.pem -out serverreq.pem -days 365 -config openssl.cnf 3. openssl x509 -x509toreq -in serverreq.pem -signkey serverkey.pem -out tmp.pem 4. openssl ca -config openssl.cnf -policy policy_anything -out servercert.pem -infiles tmp.pem 5. In */etc/syslog-ng/* create directory *cert.d* and *ca.d* copy the *serverkey.pem* and *servercert.pem* to *cert.d* and copy *cacert.pem* to *ca.d*. Go to *ca.d* and issue the following command *"openssl x509 -noout -hash -in cacert.pem"* and do the link *"ln -s cacert.pem 6d2962a8.0" *6. On the syslog-ng.conf file i put the following changes: *************************************** source s_sys { system(); internal(); network( port(6514) file("/proc/kmsg" log_prefix("kernel: ")); transport("tls") tls( key_file("/etc/syslog-ng/cert.d/serverkey.pem") cert_file("/etc/syslog-ng/cert.d/servercert.pem") ca_dir("/etc/syslog-ng/ca.d")) ); }; ******************************************** And restart the service ================== *Client Configuration* Creating CA making directory and put the openssl.cnf file in the directory etc. do the following command 1. openssl req -new -x509 -keyout private/cakey.pem -out cacert.pem -days 365 -config openssl.cnf 2. openssl req -nodes -new -x509 -keyout clientkey.pem -out clientreq.pem -days 365 -config openssl.cnf 3. openssl x509 -x509toreq -in clientreq.pem -signkey clientkey.pem -out tmp.pem 4. openssl ca -config openssl.cnf -policy policy_anything -out clientcert.pem -infiles tmp.pem 5. In */etc/syslog-ng/* create directory *cert.d* and *ca.d* copy the *"clientkey.pem" *and *"clientcert.pem" *to *"cert.d" *and copy *"cacert.pem" *to *"ca.d" *and issue the following command in the *ca.d* directory. *openssl x509 -noout -hash -in cacert.pem *and *ln -s cacert.pem 6d2962a8.0 *6. add the following to the *syslog-ng.conf* file ****************************************************** destination d_tcp { tcp("192.168.111.176" port(6514) tls( ca_dir("/etc/syslog-ng/ca.d") key_file("/etc/syslog-ng/cert.d/clientkey.pem") cert_file("/etc/syslog-ng/cert.d/clientcert.pem") ) ); }; *************************************************************** And finally i have the following errors :) Jan 12 11:58:02 syslogserver syslog-ng[5507]: Syslog connection accepted; fd='16', client='AF_INET(192.168.111.104:45631)', local='AF_INET(0.0.0.0:6514)' Jan 12 11:58:02 syslogserver syslog-ng[5507]: SSL error while reading stream; tls_error='SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca' Jan 12 11:58:02 syslogserver syslog-ng[5507]: I/O error occurred while reading; fd='16', error='Connection reset by peer (104)' Jan 12 11:58:02 syslogserver syslog-ng[5507]: Syslog connection closed; fd='16', client='AF_INET(192.168.111.104:45631)', local='AF_INET(0.0.0.0:6514)' Jan 12 11:58:12 syslogserver syslog-ng[5507]: Syslog connection accepted; fd='16', client='AF_INET(192.168.111.104:58937)', local='AF_INET(0.0.0.0:6514)' Jan 12 11:58:12 syslogserver syslog-ng[5507]: SSL error while reading stream; tls_error='SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca' Jan 12 11:58:12 syslogserver syslog-ng[5507]: I/O error occurred while reading; fd='16', error='Connection reset by peer (104)' Jan 12 11:58:12 syslogserver syslog-ng[5507]: Syslog connection closed; fd='16', client='AF_INET(192.168.111.104:58937)', local='AF_INET(0.0.0.0:6514)' Can someone help me with this and tell me what im doing wrong ? Thanks in advanced !

2 8

syslog-ng @ Southern California Linux Expo
by Czanik, Péter 18 Jan '16

18 Jan '16

Hi, This week I'll be at the Southern California Linux Expo in Los Angeles. If you want to talk or hear about syslog-ng, you have many chances: - Balabit booth #426 during Expo hours - syslog-ng BoF in room 104 at 7:00pm on Saturday - "syslog-ng: from raw data to Big Data" presentation in room 211, Sunday 11:30 You can also request an appointment at https://www.balabit.com/scale-trade-show-meeting and I'm happy to meet you if you are in LA also outside of Scale. Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Issue with syslog-ng and Windows Server 2012
by Artyom Gavrichenkov 15 Jan '16

15 Jan '16

Hi all, Since Windows Vista (and Server 2012), in NTFS, file size is updated not when its contents are being flushed to disk, but when the last handle to the corresponding file object is closed. More on that here: https://blogs.msdn.microsoft.com/oldnewthing/20111226-00/?p=8813 What this means in practice is that an application log file might already be quite large, but its reported file size will still be zero unless some other application will open(), read() and then close() it. And seems like it breaks syslog-ng’s source() file() handler in case the filename in file() arguments contains wildcards. Could anyone please look into it? | Artyom Gavrichenkov | gpg: fa1c670e | mailto: ximaera(a)gmail.com | xmpp: ximaera(a)gmail.com | tel. no: +7 916 515 49 58

3 2

syslog-ng ose push to master
by Scheidler, Balázs 14 Jan '16

14 Jan '16

Hi, there were some fallouts from the recent merger of #842, which I've quickly fixed up by pushing two trivial patches to master bypassing review on github. My patches compile without warnings and make check is passed, but please review them. Cheers, -- Bazsi

2 1

Insider 2016-01: syslog-ng web GUIs; Scale; GSoC; Raspberry Pi 2; SSB 4 F3
by Czanik, Péter 14 Jan '16

14 Jan '16

Dear syslog-ng users, This is the 46th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS syslog-ng web GUIs ------------------ The number and importance of logging solutions with a web interface is growing, luckily many of these are syslog-ng based. Using the Elasticsearch destination, Kibana provides an easy-to-use web interface for log messages. Read more about feeding log messages to Elasticsearch with syslog-ng with at https://czanik.blogs.balabit.com/2015/12/web-interfaces-for-your-syslog-ser… Southern California Linux Expo ------------------------------ Next week, Peter Czanik will present “syslog-ng: from raw data to Big Data” at the Southern California Linux Expo. There will be also a booth (#426) where you can talk about syslog-ng, and we also plan a syslog-ng BoF where you can share your experiences or ask your questions about syslog-ng. https://www.balabit.com/scale-trade-show-meeting Google Summer of Code --------------------- In the past four years syslog-ng participated in Google Summer of Code, where talented students spent their summers coding syslog-ng instead doing some less intellectually challenging summer jobs. Some of their results include the Redis destination or configuration management modules. Read more about our experiences and the upcoming “syslog-ng Universe” at https://syslog-ng.org/gsoc-2015-summary/ syslog-ng on the Raspberry Pi 2 ------------------------------- The performance of syslog-ng on the original Raspberry Pi was not that great. A quick test of the Raspberry Pi 2 revealed, that performance increased drastically, now you can use this $35 machine as a central log server: https://czanik.blogs.balabit.com/2016/01/syslog-ng-on-the-raspberry-pi-2/ syslog-ng Store Box 4F3 released -------------------------------- The latest version of syslog-ng Store Box (SSB), a turnkey appliance built around syslog-ng has been released. You can now search across multiple logspaces and across multiple SSB boxes from one search interface, while maintaining user profile-based access control. Read the full announcement at https://jluby.blogs.balabit.com/2015/12/15/syslog-ng-store-box-4-f3-release… Monitoring serial consoles -------------------------- The January issue of the Linux Journal contains an article from Fabien Wernli about using syslog-ng to monitor serial consoles. This month it is only available for subscribers: http://www.linuxjournal.com/content/january-2016-issue-linux-journal NEW RELEASES SSB 4 F3: https://jluby.blogs.balabit.com/2015/12/15/syslog-ng-store-box-4-f3-release… Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com . To read this newsletter on-line, visit: http://insider.blogs.balabit.com/ Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0