- syslog-ng - lists.balabit.hu

syslog-ng and dependency libraries for sending log messages for remote log server with TLS support
by Girish Kumar 04 Feb '16

04 Feb '16

Hi All, My requirement is to send the log messages to remote log server securely (with TLS). The project which I am implementing is on embedded systems. So the space is very important. Please let me know the latest stable version of syslog-ng which can be used for this. Also please let me know the mandatory dependency libraries required. Whether I can use openssl library for TLS support Thanks in advance. Regards, Girish

1 0

Module development guide
by Marc Falzon 30 Jan '16

30 Jan '16

Hi Is there any documentation on how to develop new syslog-ng module using the native C API, besides reading the incubator modules source code? Cheers, m.

5 17

License check failure
by Juhász, Viktor 25 Jan '16

25 Jan '16

Hi, I really want to keep the license policy, but I don't know, and can't find any description, what if I just moved files to one directory to another directory without any modifications? For example I just moved the logmsg.c from lib to lib/logmsg directory, and the license check fails in travis. What should I do in this case? BR, Viktor Juhász

2 2

Re: [syslog-ng] Dependency on default-jre for Debian package
by Laszlo Budai 22 Jan '16

22 Jan '16

Hi, thank you for sharing this issue(and for suggesting a solution to it). In the next two weeks I'm going to work on the packaging a little bit and I'll fix it. regards, Laszlo Budai Sent from my HTC ----- Reply message ----- From: "Marc Falzon" <m(a)baha.mu> To: <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] Dependency on default-jre for Debian package Date: Fri, Jan 22, 2016 10:22 Hi I'm trying to install the unofficial syslog-ng 3.7.2 Debian packages from http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… however I have a problem with the Java-related packages, since they have a package dependency on `default-jre`, and I'm using an Oracle JRE packaged using the `make-jpkg` utility which generates a Debian package providing `java-browser-plugin, java-runtime, java-runtime-headless, java-virtual-machine, java2-runtime, java2-runtime-headless, java6-runtime, java6-runtime-headless, java7-runtime, java7-runtime-headless, java8-runtime, java8-runtime-headless`, but not `default-jre`. Is it possible to modify those packages so that they depend on `java-runtime` instead? The `default-jre` packages also provide `java-runtime`. Thank you, m. ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

2 1

Re: [syslog-ng] Module development guide
by Laszlo Budai 22 Jan '16

22 Jan '16

Hi, and we have an unmerged PR that could help implementing a threaded dst. : https://github.com/balabit/syslog-ng-gitbook/pull/52 We should unify these contents... L. Sent from my HTC ----- Reply message ----- From: "Marc Falzon" <m(a)baha.mu> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] Module development guide Date: Fri, Jan 22, 2016 11:42 On Friday 22 January 2016 at 11:35, Tibor Benke wrote: > There is also a shell script which generates a basic destination skeleton. You can find its source on this brach: https://github.com/juhaszviktor/syslog-ng/tree/f/plugin-creator . Check the dev-utils/plugin_skeleton_creator directory and this commit for the usage: https://github.com/juhaszviktor/syslog-ng/commit/89361d4d1817560ce8c9062093… Awesome, thank you! m. > > 2016-01-22 11:33 GMT+01:00 Marc Falzon <m(a)baha.mu (mailto:m@baha.mu)>: > > Hi Bazsi, > > > > > > On Friday 22 January 2016 at 11:28, Scheidler, Balázs wrote: > > > > > not really, but maybe I would read the "official" modules source code instead. and of course you can ask questions on the mailing list. :) > > > > > > Yes that's what I've started to do, but a proper documentation is preferable, saves time and avoid confusion ;) > > > > > if you want to create a destination, the easiest is to create a threaded destination, where the output is an independent thread, that can use a synchronous API. Of course this is going to be slower than using an asynchronous implementation, but that usually is good enough, > > > > Thank you for the hint. Given my use case (HTTP destination) I think I'm safe to go with an asynchronous implementation since each request is stateless, no connections/locks involved. > > > > m. > > > > > > > > On Fri, Jan 22, 2016 at 11:03 AM, Marc Falzon <m(a)baha.mu (mailto:m@baha.mu) (mailto:m@baha.mu)> wrote: > > > > Hi > > > > > > > > Is there any documentation on how to develop new syslog-ng module using the native C API, besides reading the incubator modules source code? > > > > > > > > Cheers, > > > > > > > > m. > > > > > > > > > > > > ______________________________________________________________________________ > > > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > > > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > > > > ______________________________________________________________________________ > > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > > ______________________________________________________________________________ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

Dependency on default-jre for Debian package
by Marc Falzon 22 Jan '16

22 Jan '16

Hi I'm trying to install the unofficial syslog-ng 3.7.2 Debian packages from http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… however I have a problem with the Java-related packages, since they have a package dependency on `default-jre`, and I'm using an Oracle JRE packaged using the `make-jpkg` utility which generates a Debian package providing `java-browser-plugin, java-runtime, java-runtime-headless, java-virtual-machine, java2-runtime, java2-runtime-headless, java6-runtime, java6-runtime-headless, java7-runtime, java7-runtime-headless, java8-runtime, java8-runtime-headless`, but not `default-jre`. Is it possible to modify those packages so that they depend on `java-runtime` instead? The `default-jre` packages also provide `java-runtime`. Thank you, m.

1 0

"Syslog connection closed" but socket not closed
by Patrick Hemmer 21 Jan '16

21 Jan '16

We recently saw an issue where syslog-ng (version 3.6.4 on FreeBSD 10.1) was configured with a `syslog()` source, received an invalid frame, shut down the connection, but the socket remained open. I was looking through the documented fixes in the versions since the one we're using (3.6.4), but nothing looks related. 2016-01-21T07:44:21-05:00 iad1gweb01.ecom.chewy.com ERR syslog-ng[27090]: - Invalid frame header; header='' [meta sequenceId="389"] 2016-01-21T07:44:21-05:00 iad1gweb01.ecom.chewy.com NOTICE syslog-ng[27090]: - Syslog connection closed; fd='19', client='AF_INET(127.0.0.1:59317)', local='AF_INET(127.0.0.1:601)' [meta sequenceId="390"] # netstat -an|grep 59317 tcp4 81660 0 127.0.0.1.601 127.0.0.1.59317 ESTABLISHED tcp4 0 48923 127.0.0.1.59317 127.0.0.1.601 ESTABLISHED From the netstat output (the buffer sizes), it looks like syslog-ng stopped reading from the socket, but didn't close it, and the application on the other end kept trying to write to it. This is just my theory anyway. I can open a bug on github, but I wanted to bring it up here first. Thanks -Patrick

1 0

RFC5425 framing and log_msg_size
by Blake Day 21 Jan '16

21 Jan '16

Hi all, I’m wondering why syslog-ng disconnects clients that try to send log messages exceeding log_msg_size instead of just gracefully accepting and truncating the message? I took a quick glance at the code, and it appears to only affect clients using RFC5425 framing. Here is the relevant code: if (self->frame_len > self->super.options->max_msg_size) { msg_error("Incoming frame larger than log_msg_size()", evt_tag_int("log_msg_size", self->super.options->max_msg_size), evt_tag_int("frame_length", self->frame_len), NULL); return LPS_ERROR; } Here are excerpts from my logs showing the problem: 2016-01-20T11:27:28-05:00 [HOST] ERR syslog-ng[87462]: - Incoming frame larger than log_msg_size(); log_msg_size='16384', frame_length='76218' [meta sequenceId="6560"] 2016-01-20T11:27:28-05:00 [HOST] NOTICE syslog-ng[87462]: - Syslog connection closed; fd='26', client='AF_INET(127.0.0.1:52627)', local='AF_INET(127.0.0.1:601)' [meta sequenceId="6561"]

2 1

Re: [syslog-ng] patterndb and smtp to() issue
by Laszlo Budai 21 Jan '16

21 Jan '16

Hi, templateable afsmtp to() is available from version 3.7.1 . Sent from my HTC ----- Reply message ----- From: "Fabien Wernli" <wernli(a)in2p3.fr> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] patterndb and smtp to() issue Date: Thu, Jan 21, 2016 06:55 Hi Alexandre, Templateable smtp/to() and co. was added only recently. I'll check later in the day on which version it appeared. ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

2 1

patterndb and smtp to() issue
by Alexandre DEPREZ 21 Jan '16

21 Jan '16

Hi all, I'm using the pattern-db to extract values from a firewall's log. This far, everything's working great. The log looks something like this: Jan 20 2016 21:48:45: %ASA-7-746012: user-identity: Add IP-User mapping 10.10.99.7 - LOCAL\alex Succeeded - VPN user Using pdbtool and matching the log against the xml pattern file, this is showing me good results : :$pdbtool match -P "%ASA-7-746012" -M "user-identity: Add IP-User mapping 10.10.99.7 - LOCAL\alex Succeeded - VPN user" -p /etc/syslog-ng/patterndb.d/vpn-parser-up.xml -D -c Pattern matching part: user-identity: Add IP-User mapping @IPv4:VPN_IP=10.10.99.7@ - LOCAL\ @STRING:VPN_USER=alex@ Succeeded - VPN user Matching part: user-identity: Add IP-User mapping 10.10.99.7 - LOCAL\alex Succeeded - VPN user Values: MESSAGE=user-identity: Add IP-User mapping 10.10.99.7 - LOCAL\alex Succeeded - VPN user PROGRAM=%ASA-7-746012 .classifier.class=vpn.access_log .classifier.rule_id=019045a7383c252e57c20435ae5bf86c VPN_IP=10.10.99.7 VPN_USER=alex TAGS= Here's the xml file <patterndb version='4' pub_date='2015-12-22'> <ruleset id='04ba26e756011614c57cf469fed7b5c0' name='%ASA-7-746012'> <pattern>%ASA-7-746012</pattern> <rules> <rule class='vpn.access_log' id='019045a7383c252e57c20435ae5bf86c' provider='alex'> <patterns> <pattern>user-identity: Add IP-User mapping @IPv4:VPN_IP@ - LOCAL\@STRING:VPN_USER@ Succeeded - VPN user</pattern> </patterns> </rule> </rules> </ruleset> </patterndb> Now, the problem lies on the destination which is using the smtp driver. destination vpn_mail_up { smtp( host("x.x.x.x") port(25) from("alex(a)x.y" "alex(a)x.y") to("${VPN_USER}(a)x.y") subject("vpn connection") body("vpn connection from ${VPN_USER} with IP: ${VPN_IP}\n") ); }; The variable is functional inside the body() but not in the to() field. Here's a dump I extracted directly from the server on the tcp session to the mail server: RCPT.TO:<${VPN_USER}(a)x.y>.. BDAT.411.. X-Mailer:.syslog-ng.3.5.6.. Date:.Wed,.20.Jan.2016.21:51:51.+0100.. From:.alex@x.y.. Message-Id:.<1453323111.149975.19608@debian>.. To:."${VPN_USER}(a)x.y".<${VPN_USER}(a)x.y>.. Subject:.vpn.connection.. .BDAT.68..vpn.connection.from.alex..with.IP:.10.10.99.7.BDAT.2.LAST.. The variable is being populated in the body message but not the recipient. Is there any chance the variable could only be used once (!?) or not being able to be used inside the to() ? Regards, Alex

2 1