- syslog-ng - lists.balabit.hu

syslog-ng OSE: wildcards in source file path status
by Wout Peeters 27 Oct '15

27 Oct '15

Hi list, After some searching, I've noticed this question has been asked a few times before. The most recent answer I saw was from October 2014. Are there any updates regarding the implementation of wildcards in source file paths in syslog-ng OSE? Thanks!

3 2

unofficial syslog-ng 3.7.2 Debian packages
by Budai, László 27 Oct '15

27 Oct '15

Hi, I've just created my unofficial OBS repo[1] for syslog-ng 3.7.2 (latest revision: 3.7.2-2). List of supported OSs (i386/amd64): * Debian 7.0 * Debian 8.0 * Ubuntu 12.04 * Ubuntu 14.04 * Ubuntu 14.10 * Ubuntu 15.04 Install ------- example: Debian 8.0 1. get release key wget -qO - http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… | sudo apt-key add - 2. add repo to APT sources eg.: /etc/apt/sources.list.d/syslog-ng-obs.list deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… ./ Then `apt-get update` and `apt-get install syslog-ng-core=3.7.2-2` You can replace Debian_8.0 to * Debian_7.0 * xUbuntu_12.04, * xUbuntu_14.04 * xUbuntu_14.10 * xUbuntu_15.04 Available packages: * syslog-ng-core * syslog-ng-dbg * syslog-ng-dev * syslog-ng-mod-stomp * syslog-ng-mod-amqp * syslog-ng-mod-elastic * syslog-ng-mod-geoip * syslog-ng-mod-graphite * syslog-ng-mod-hdfs * syslog-ng-mod-http * syslog-ng-mod-java * syslog-ng-mod-java-common-lib * syslog-ng-mod-journal * syslog-ng-mod-json * syslog-ng-mod-kafka * syslog-ng-mod-mongodb * syslog-ng-mod-python * syslog-ng-mod-redis * syslog-ng-mod-riemann * syslog-ng-mod-smtp * syslog-ng-mod-sql * syslog-ng-mod-stomp Notes to the java destinations ------------------------------ About the ``` Error opening plugin module; module='mod-java', error='libjvm.so: cannot open shared object file: No such file or directory' ``` problem. libmod-java.so is linked to the libjvm.so library. If your java installation doesn't create a symlink in /usr/lib directory to libjvm.so then you have to modify your ld.so.conf or expand your LD_LIBRARY_PATH with the containing library before starting syslog-ng. eg.: LD_LIBRARY_PATH=/usr/lib/jvm/java-7-openjdk-amd64/jre/lib/amd64/server:$LD_LIBRARY_PATH Links -------- [1] https://build.opensuse.org/project/show/home:laszlo_budai:syslog-ng [2] https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.7.2 regards, Laszlo Budai

2 1

Re: [syslog-ng] date parser
by Scheidler, Balázs 25 Oct '15

25 Oct '15

Hi, I am basically done with cleaning up the stuff. You can find my latest version at https://github.com/balabit/syslog-ng/tree/f/date-parser I still have to clean up the branch, it is currently just a dump of patches, but the final state should be pretty close that I'd try to push for integration. There's one issue that is still open: strptime() at least as implemented in various libc versions is unusable, so we should probably roll our own implementation. Reasons: 1) tm_gmtoff is not portable 2) %z as a parsing format is not portable 3) %z doesn't accept ISO8601 standard zone offsets when there's a colon between hours and minutes Also, it can be affected by locale settings (which is not good for the syslog-ng case) and is probably very slow. (at one point syslog-ng used strptime for normal log traffic and I remember replacing it with hand-coded routines increased performance a lot). I'll try to get an strptime implementation from somewhere and tailor it to our needs. Any feedback is appreciated. Bazsi -- Bazsi On Sun, Oct 25, 2015 at 4:44 PM, Scheidler, Balázs < balazs.scheidler(a)balabit.com> wrote: > Hi, > > As I see you assume a date is from UTC if there's no timezone information. > I would think that using the local timezone is more intuitive in this case: > > testcase("Tue, 27 Jan 2015 11:48:46", NULL, "%a, %d %b %Y %T", > "2015-01-27T11:48:46+00:00"); > > What do you think? > > > -- > Bazsi > > On Sun, Oct 25, 2015 at 12:36 PM, Scheidler, Balázs < > balazs.scheidler(a)balabit.com> wrote: > >> thanks for the quick reply. >> >> >> -- >> Bazsi >> >> On Sun, Oct 25, 2015 at 12:35 PM, Vincent Bernat <vincent(a)bernat.im> >> wrote: >> >>> ❦ 25 octobre 2015 12:32 +0100, "Scheidler, Balázs" < >>> balazs.scheidler(a)balabit.com> : >>> >>> > I'd have a question though: I can see the date-offset() option for >>> > date parser, which seems to skip the specified number of characters in >>> > the input. >>> > >>> > Can you please describe the usecase behind that? I'd be reluctant to >>> > add such an option to a parser (as none of the other have such an >>> > option), and it should be possible to do the same using template >>> > functions, e.g. something like this: >>> > >>> > date-parser(template("$(substr $MSG 5)")); >>> > >>> > This would similarly skip the first 5 characters. >>> > >>> > If this addresses your original use-case, I'd drop the date-offset() >>> > option. >>> >>> Yes, this would cover my use case. >>> -- >>> Use library functions. >>> - The Elements of Programming Style (Kernighan & Plauger) >>> >> >> >

2 1

date parser
by Scheidler, Balázs 25 Oct '15

25 Oct '15

Hi Vincent, I am working on your date-parser() stuff that was integrated to syslog-ng-incubator recently. It is great stuff, so I'd like to make it part of the main syslog-ng codebase. I am doing some cleanups, which you can follow at the f/date-parser branch in github.com/balabit/syslog-ng I'd have a question though: I can see the date-offset() option for date parser, which seems to skip the specified number of characters in the input. Can you please describe the usecase behind that? I'd be reluctant to add such an option to a parser (as none of the other have such an option), and it should be possible to do the same using template functions, e.g. something like this: date-parser(template("$(substr $MSG 5)")); This would similarly skip the first 5 characters. If this addresses your original use-case, I'd drop the date-offset() option. Thanks in advance, -- Bazsi

1 0

Python external program destination and line buffer
by Giovanni Mancuso 21 Oct '15

21 Oct '15

Hi, i wrote a program destination (in python) that parse a message and insert data in redis. My code is: import re import fileinput import redis r = redis.Redis(host="127.0.0.1", port=6379, db=0) for line in fileinput.input(): tid = re.search('X-TransactionId: (.+?) ', line) #print tid.group(1) regexp_result = re.findall(" Recipient: ([A-z0-9._%+-]+(a)[A-z0-9.-]+)", line) for email in regexp_result: r.sadd(tid.group(1)+"_recs", email) I configure my destination in this way: destination python_to_file { program("/usr/bin/python /etc/syslog-ng/python/Ric_acc_dest.py" flush-lines(1)); }; It works only if i send many message. If i send only one message it doesn't insert nothing in redis. Any ideas? --

2 2

Re: [syslog-ng] syslog-ng 3.7.1 OSE compile error
by Ho, Ming 21 Oct '15

21 Oct '15

Hi Tibor, Below is the output. It seems only the last few lines related to eventlog # pkg-config --debug eventlog Option --debug seen Error printing disabled by default, value of --print-errors: 0 Error printing disabled Adding virtual 'pkg-config' package to list of known packages Scanning directory '/usr/lib64/pkgconfig' File 'xpyb.pc' appears to be a .pc file Will find package 'xpyb' in file '/usr/lib64/pkgconfig/xpyb.pc' File 'pangox.pc' appears to be a .pc file Will find package 'pangox' in file '/usr/lib64/pkgconfig/pangox.pc' File 'atk.pc' appears to be a .pc file Will find package 'atk' in file '/usr/lib64/pkgconfig/atk.pc' File 'gdk-pixbuf-xlib-2.0.pc' appears to be a .pc file Will find package 'gdk-pixbuf-xlib-2.0' in file '/usr/lib64/pkgconfig/gdk-pixbuf-xlib-2.0.pc' File 'gtk+-x11-2.0.pc' appears to be a .pc file Will find package 'gtk+-x11-2.0' in file '/usr/lib64/pkgconfig/gtk+-x11-2.0.pc' File 'xcomposite.pc' appears to be a .pc file Will find package 'xcomposite' in file '/usr/lib64/pkgconfig/xcomposite.pc' File 'xcb-shm.pc' appears to be a .pc file Will find package 'xcb-shm' in file '/usr/lib64/pkgconfig/xcb-shm.pc' File 'gail.pc' appears to be a .pc file Will find package 'gail' in file '/usr/lib64/pkgconfig/gail.pc' File 'cairo-ft.pc' appears to be a .pc file Will find package 'cairo-ft' in file '/usr/lib64/pkgconfig/cairo-ft.pc' File 'xcb-xprint.pc' appears to be a .pc file Will find package 'xcb-xprint' in file '/usr/lib64/pkgconfig/xcb-xprint.pc' File 'gmodule-export-2.0.pc' appears to be a .pc file Will find package 'gmodule-export-2.0' in file '/usr/lib64/pkgconfig/gmodule-export-2.0.pc' File 'cairo-xlib-xrender.pc' appears to be a .pc file Will find package 'cairo-xlib-xrender' in file '/usr/lib64/pkgconfig/cairo-xlib-xrender.pc' File 'xcb-xvmc.pc' appears to be a .pc file Will find package 'xcb-xvmc' in file '/usr/lib64/pkgconfig/xcb-xvmc.pc' File 'gio-unix-2.0.pc' appears to be a .pc file Will find package 'gio-unix-2.0' in file '/usr/lib64/pkgconfig/gio-unix-2.0.pc' File 'gmodule-no-export-2.0.pc' appears to be a .pc file Will find package 'gmodule-no-export-2.0' in file '/usr/lib64/pkgconfig/gmodule-no-export-2.0.pc' File 'xcb-xfixes.pc' appears to be a .pc file Will find package 'xcb-xfixes' in file '/usr/lib64/pkgconfig/xcb-xfixes.pc' File 'xft.pc' appears to be a .pc file Will find package 'xft' in file '/usr/lib64/pkgconfig/xft.pc' File 'gtk+-unix-print-2.0.pc' appears to be a .pc file Will find package 'gtk+-unix-print-2.0' in file '/usr/lib64/pkgconfig/gtk+-unix-print-2.0.pc' File 'xau.pc' appears to be a .pc file Will find package 'xau' in file '/usr/lib64/pkgconfig/xau.pc' File 'xcb-screensaver.pc' appears to be a .pc file Will find package 'xcb-screensaver' in file '/usr/lib64/pkgconfig/xcb-screensaver.pc' File 'libpng12.pc' appears to be a .pc file Will find package 'libpng12' in file '/usr/lib64/pkgconfig/libpng12.pc' File 'fontconfig.pc' appears to be a .pc file Will find package 'fontconfig' in file '/usr/lib64/pkgconfig/fontconfig.pc' File 'freetype2.pc' appears to be a .pc file Will find package 'freetype2' in file '/usr/lib64/pkgconfig/freetype2.pc' File 'xcb-damage.pc' appears to be a .pc file Will find package 'xcb-damage' in file '/usr/lib64/pkgconfig/xcb-damage.pc' File 'x11-xcb.pc' appears to be a .pc file Will find package 'x11-xcb' in file '/usr/lib64/pkgconfig/x11-xcb.pc' File 'xrandr.pc' appears to be a .pc file Will find package 'xrandr' in file '/usr/lib64/pkgconfig/xrandr.pc' File 'xcb-xevie.pc' appears to be a .pc file Will find package 'xcb-xevie' in file '/usr/lib64/pkgconfig/xcb-xevie.pc' File 'gtk+-2.0.pc' appears to be a .pc file Will find package 'gtk+-2.0' in file '/usr/lib64/pkgconfig/gtk+-2.0.pc' File 'xcb-shape.pc' appears to be a .pc file Will find package 'xcb-shape' in file '/usr/lib64/pkgconfig/xcb-shape.pc' File 'cairo-png.pc' appears to be a .pc file Will find package 'cairo-png' in file '/usr/lib64/pkgconfig/cairo-png.pc' File 'xcb-randr.pc' appears to be a .pc file Will find package 'xcb-randr' in file '/usr/lib64/pkgconfig/xcb-randr.pc' File 'xcb-dri2.pc' appears to be a .pc file Will find package 'xcb-dri2' in file '/usr/lib64/pkgconfig/xcb-dri2.pc' File 'xfixes.pc' appears to be a .pc file Will find package 'xfixes' in file '/usr/lib64/pkgconfig/xfixes.pc' File 'pangocairo.pc' appears to be a .pc file Will find package 'pangocairo' in file '/usr/lib64/pkgconfig/pangocairo.pc' File 'xcb-render.pc' appears to be a .pc file Will find package 'xcb-render' in file '/usr/lib64/pkgconfig/xcb-render.pc' File 'xcb-sync.pc' appears to be a .pc file Will find package 'xcb-sync' in file '/usr/lib64/pkgconfig/xcb-sync.pc' File 'xcb-xtest.pc' appears to be a .pc file Will find package 'xcb-xtest' in file '/usr/lib64/pkgconfig/xcb-xtest.pc' File 'xinerama.pc' appears to be a .pc file Will find package 'xinerama' in file '/usr/lib64/pkgconfig/xinerama.pc' File 'xcb-record.pc' appears to be a .pc file Will find package 'xcb-record' in file '/usr/lib64/pkgconfig/xcb-record.pc' File 'gdk-2.0.pc' appears to be a .pc file Will find package 'gdk-2.0' in file '/usr/lib64/pkgconfig/gdk-2.0.pc' File 'xcb.pc' appears to be a .pc file Will find package 'xcb' in file '/usr/lib64/pkgconfig/xcb.pc' File 'pixman-1.pc' appears to be a .pc file Will find package 'pixman-1' in file '/usr/lib64/pkgconfig/pixman-1.pc' File 'pangoxft.pc' appears to be a .pc file Will find package 'pangoxft' in file '/usr/lib64/pkgconfig/pangoxft.pc' File 'gmodule-2.0.pc' appears to be a .pc file Will find package 'gmodule-2.0' in file '/usr/lib64/pkgconfig/gmodule-2.0.pc' File 'xcursor.pc' appears to be a .pc file Will find package 'xcursor' in file '/usr/lib64/pkgconfig/xcursor.pc' File 'xcb-res.pc' appears to be a .pc file Will find package 'xcb-res' in file '/usr/lib64/pkgconfig/xcb-res.pc' File 'xcb-glx.pc' appears to be a .pc file Will find package 'xcb-glx' in file '/usr/lib64/pkgconfig/xcb-glx.pc' File 'libpng.pc' appears to be a .pc file Will find package 'libpng' in file '/usr/lib64/pkgconfig/libpng.pc' File 'cairo-svg.pc' appears to be a .pc file Will find package 'cairo-svg' in file '/usr/lib64/pkgconfig/cairo-svg.pc' File 'zlib.pc' appears to be a .pc file Will find package 'zlib' in file '/usr/lib64/pkgconfig/zlib.pc' File 'gobject-2.0.pc' appears to be a .pc file Will find package 'gobject-2.0' in file '/usr/lib64/pkgconfig/gobject-2.0.pc' File 'xcb-xv.pc' appears to be a .pc file Will find package 'xcb-xv' in file '/usr/lib64/pkgconfig/xcb-xv.pc' File 'xcb-composite.pc' appears to be a .pc file Will find package 'xcb-composite' in file '/usr/lib64/pkgconfig/xcb-composite.pc' Ignoring file '..' in search directory; not a .pc file File 'xcb-xf86dri.pc' appears to be a .pc file Will find package 'xcb-xf86dri' in file '/usr/lib64/pkgconfig/xcb-xf86dri.pc' File 'cairo-xlib.pc' appears to be a .pc file Will find package 'cairo-xlib' in file '/usr/lib64/pkgconfig/cairo-xlib.pc' File 'glib-2.0.pc' appears to be a .pc file Will find package 'glib-2.0' in file '/usr/lib64/pkgconfig/glib-2.0.pc' Ignoring file '.' in search directory; not a .pc file File 'gdk-x11-2.0.pc' appears to be a .pc file Will find package 'gdk-x11-2.0' in file '/usr/lib64/pkgconfig/gdk-x11-2.0.pc' File 'pthread-stubs.pc' appears to be a .pc file Will find package 'pthread-stubs' in file '/usr/lib64/pkgconfig/pthread-stubs.pc' File 'xcb-dpms.pc' appears to be a .pc file Will find package 'xcb-dpms' in file '/usr/lib64/pkgconfig/xcb-dpms.pc' File 'gio-2.0.pc' appears to be a .pc file Will find package 'gio-2.0' in file '/usr/lib64/pkgconfig/gio-2.0.pc' File 'gdk-pixbuf-2.0.pc' appears to be a .pc file Will find package 'gdk-pixbuf-2.0' in file '/usr/lib64/pkgconfig/gdk-pixbuf-2.0.pc' File 'xext.pc' appears to be a .pc file Will find package 'xext' in file '/usr/lib64/pkgconfig/xext.pc' File 'xrender.pc' appears to be a .pc file Will find package 'xrender' in file '/usr/lib64/pkgconfig/xrender.pc' File 'xcb-xselinux.pc' appears to be a .pc file Will find package 'xcb-xselinux' in file '/usr/lib64/pkgconfig/xcb-xselinux.pc' File 'pangoft2.pc' appears to be a .pc file Will find package 'pangoft2' in file '/usr/lib64/pkgconfig/pangoft2.pc' File 'pango.pc' appears to be a .pc file Will find package 'pango' in file '/usr/lib64/pkgconfig/pango.pc' File 'cairo-pdf.pc' appears to be a .pc file Will find package 'cairo-pdf' in file '/usr/lib64/pkgconfig/cairo-pdf.pc' File 'cairo-ps.pc' appears to be a .pc file Will find package 'cairo-ps' in file '/usr/lib64/pkgconfig/cairo-ps.pc' File 'xcb-xinerama.pc' appears to be a .pc file Will find package 'xcb-xinerama' in file '/usr/lib64/pkgconfig/xcb-xinerama.pc' File 'gthread-2.0.pc' appears to be a .pc file Will find package 'gthread-2.0' in file '/usr/lib64/pkgconfig/gthread-2.0.pc' File 'x11.pc' appears to be a .pc file Will find package 'x11' in file '/usr/lib64/pkgconfig/x11.pc' File 'cairo.pc' appears to be a .pc file Will find package 'cairo' in file '/usr/lib64/pkgconfig/cairo.pc' File 'xi.pc' appears to be a .pc file Will find package 'xi' in file '/usr/lib64/pkgconfig/xi.pc' Scanning directory '/usr/share/pkgconfig' File 'fontsproto.pc' appears to be a .pc file Will find package 'fontsproto' in file '/usr/share/pkgconfig/fontsproto.pc' File 'bigreqsproto.pc' appears to be a .pc file Will find package 'bigreqsproto' in file '/usr/share/pkgconfig/bigreqsproto.pc' File 'xcmiscproto.pc' appears to be a .pc file Will find package 'xcmiscproto' in file '/usr/share/pkgconfig/xcmiscproto.pc' File 'compositeproto.pc' appears to be a .pc file Will find package 'compositeproto' in file '/usr/share/pkgconfig/compositeproto.pc' File 'xf86vidmodeproto.pc' appears to be a .pc file Will find package 'xf86vidmodeproto' in file '/usr/share/pkgconfig/xf86vidmodeproto.pc' File 'glproto.pc' appears to be a .pc file Will find package 'glproto' in file '/usr/share/pkgconfig/glproto.pc' File 'xf86miscproto.pc' appears to be a .pc file Will find package 'xf86miscproto' in file '/usr/share/pkgconfig/xf86miscproto.pc' File 'randrproto.pc' appears to be a .pc file Will find package 'randrproto' in file '/usr/share/pkgconfig/randrproto.pc' File 'resourceproto.pc' appears to be a .pc file Will find package 'resourceproto' in file '/usr/share/pkgconfig/resourceproto.pc' File 'dri3proto.pc' appears to be a .pc file Will find package 'dri3proto' in file '/usr/share/pkgconfig/dri3proto.pc' File 'kbproto.pc' appears to be a .pc file Will find package 'kbproto' in file '/usr/share/pkgconfig/kbproto.pc' File 'renderproto.pc' appears to be a .pc file Will find package 'renderproto' in file '/usr/share/pkgconfig/renderproto.pc' File 'dmxproto.pc' appears to be a .pc file Will find package 'dmxproto' in file '/usr/share/pkgconfig/dmxproto.pc' File 'xextproto.pc' appears to be a .pc file Will find package 'xextproto' in file '/usr/share/pkgconfig/xextproto.pc' File 'xf86driproto.pc' appears to be a .pc file Will find package 'xf86driproto' in file '/usr/share/pkgconfig/xf86driproto.pc' File 'inputproto.pc' appears to be a .pc file Will find package 'inputproto' in file '/usr/share/pkgconfig/inputproto.pc' File 'xineramaproto.pc' appears to be a .pc file Will find package 'xineramaproto' in file '/usr/share/pkgconfig/xineramaproto.pc' File 'recordproto.pc' appears to be a .pc file Will find package 'recordproto' in file '/usr/share/pkgconfig/recordproto.pc' File 'xf86bigfontproto.pc' appears to be a .pc file Will find package 'xf86bigfontproto' in file '/usr/share/pkgconfig/xf86bigfontproto.pc' Ignoring file '..' in search directory; not a .pc file File 'fixesproto.pc' appears to be a .pc file Will find package 'fixesproto' in file '/usr/share/pkgconfig/fixesproto.pc' File 'videoproto.pc' appears to be a .pc file Will find package 'videoproto' in file '/usr/share/pkgconfig/videoproto.pc' Ignoring file '.' in search directory; not a .pc file File 'xproxymngproto.pc' appears to be a .pc file Will find package 'xproxymngproto' in file '/usr/share/pkgconfig/xproxymngproto.pc' File 'presentproto.pc' appears to be a .pc file Will find package 'presentproto' in file '/usr/share/pkgconfig/presentproto.pc' File 'shared-mime-info.pc' appears to be a .pc file Will find package 'shared-mime-info' in file '/usr/share/pkgconfig/shared-mime-info.pc' File 'scrnsaverproto.pc' appears to be a .pc file Will find package 'scrnsaverproto' in file '/usr/share/pkgconfig/scrnsaverproto.pc' File 'xf86dgaproto.pc' appears to be a .pc file Will find package 'xf86dgaproto' in file '/usr/share/pkgconfig/xf86dgaproto.pc' File 'evieproto.pc' appears to be a .pc file Will find package 'evieproto' in file '/usr/share/pkgconfig/evieproto.pc' File 'xproto.pc' appears to be a .pc file Will find package 'xproto' in file '/usr/share/pkgconfig/xproto.pc' File 'usbutils.pc' appears to be a .pc file Will find package 'usbutils' in file '/usr/share/pkgconfig/usbutils.pc' File 'damageproto.pc' appears to be a .pc file Will find package 'damageproto' in file '/usr/share/pkgconfig/damageproto.pc' File 'dri2proto.pc' appears to be a .pc file Will find package 'dri2proto' in file '/usr/share/pkgconfig/dri2proto.pc' Looking for package 'eventlog' Looking for package 'eventlog-uninstalled' Looking for 'eventlog' using legacy -config scripts Calling gnome-config Thanks. Ming From: Benke, Tibor [mailto:tibor.benke@balabit.com] Sent: Wednesday, October 21, 2015 7:19 AM To: Syslog-ng users' and developers' mailing list; Ho, Ming Subject: Re: [syslog-ng] syslog-ng 3.7.1 OSE compile error Hi, What's the output of the following command? pkg-config --debug eventlog Once I saw that autotools didn't find a package but the command line pkg-config did. Tibor On Tue, Oct 20, 2015 at 11:48 PM, Ho, Ming <Mingho(a)visa.com<mailto:Mingho@visa.com>> wrote: Hello, I followed syslog-ng 3.7 admin guide to compile eventlog-0.2.12+20120504+1700 on a Redhat 6.5 server and it created the following directory: # pwd /usr/local/lib # ll total 152 -rw-r–r– 1 root root 91250 Oct 16 21:55 libevtlog.a -rwxr-xr-x 1 root root 957 Oct 16 21:55 libevtlog.la<http://libevtlog.la> lrwxrwxrwx 1 root root 18 Oct 16 21:55 libevtlog.so -> libevtlog.so.0.0.0 lrwxrwxrwx 1 root root 18 Oct 16 21:55 libevtlog.so.0 -> libevtlog.so.0.0.0 -rwxr-xr-x 1 root root 51128 Oct 16 21:55 libevtlog.so.0.0.0 drwxr-x— 2 root root 4096 Oct 16 21:55 pkgconfig I also set PKG_CONFIG_PATH # echo $PKG_CONFIG_PATH /usr/local/lib/pkgconfig But when I ran “./configure” in the syslog-ng-3.7.1 directory, I got the following error: checking for clock_gettime… yes checking for EVTLOG… no configure: error: Package requirements (eventlog >= 0.2.12) were not met: No package ‘eventlog’ found Consider adjusting the PKG_CONFIG_PATH environment variable if you installed software in a non-standard prefix. Alternatively, you may set the environment variables EVTLOG_CFLAGS and EVTLOG_LIBS to avoid the need to call pkg-config. See the pkg-config man page for more details. # pwd /usr/local/lib/pkgconfig # ll total 4 -rw-r–r– 1 root root 238 Oct 16 21:55 eventlog.pc # cat eventlog.pc prefix=/usr/local exec_prefix=${prefix} libdir=${exec_prefix}/lib includedir=${prefix}/include/eventlog Name: EventLog Description: General system logging format library Version: 0.2.12 Cflags: -I${includedir} Libs: -L${libdir} -levtlog Appreciate anyone who can tell me what’s wrong Ming ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

Parse client IP out of Proxy Protocol Line in TCP syslog->ELB->syslog-ng
by Nadine Miller 21 Oct '15

21 Oct '15

I've searched through the archives and spent some time trying to find possible answers on the web, but haven't found a definitive answer. I'm in a situation where I need to parse syslog streams being forwarded through an AWS ELB. The normal configuration of the ELB resets the source IP to be the ELB's IP address. Logs are coming from multiple AWS VPCs, and we've already discovered duplicate hostnames across different VPCs, which has mingled logs from different hosts into one receiving log file. The ELB has another mode, referred to as "Proxy Protocol" which adds a single line to the TCP stream in the form: PROXY_STRING + single space + INET_PROTOCOL + single space + CLIENT_IP + single space + PROXY_IP + single space + CLIENT_PORT + single space + PROXY_PORT + "\r\n" Example: PROXY TCP4 198.51.100.22 203.0.113.7 35646 80\r\n Is it possible to use this proxy line in syslog-ng to properly segregate the log messages? If so, what would be the best method to use? I've done a lot of filtering/templating with normal UDP syslog and syslog-ng, but this is the first time I've had to consider something crazy like this. Currently there is no option at this time to change configurations at endpoints sending the syslog messages, nor can we remove the ELB. For reference: http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/enabl… Thanks in advance-- =N=

6 12

syslog-ng 3.7.1 OSE compile error
by Ho, Ming 21 Oct '15

21 Oct '15

Hello, I followed syslog-ng 3.7 admin guide to compile eventlog-0.2.12+20120504+1700 on a Redhat 6.5 server and it created the following directory: # pwd /usr/local/lib # ll total 152 -rw-r-r- 1 root root 91250 Oct 16 21:55 libevtlog.a -rwxr-xr-x 1 root root 957 Oct 16 21:55 libevtlog.la lrwxrwxrwx 1 root root 18 Oct 16 21:55 libevtlog.so -> libevtlog.so.0.0.0 lrwxrwxrwx 1 root root 18 Oct 16 21:55 libevtlog.so.0 -> libevtlog.so.0.0.0 -rwxr-xr-x 1 root root 51128 Oct 16 21:55 libevtlog.so.0.0.0 drwxr-x- 2 root root 4096 Oct 16 21:55 pkgconfig I also set PKG_CONFIG_PATH # echo $PKG_CONFIG_PATH /usr/local/lib/pkgconfig But when I ran "./configure" in the syslog-ng-3.7.1 directory, I got the following error: checking for clock_gettime... yes checking for EVTLOG... no configure: error: Package requirements (eventlog >= 0.2.12) were not met: No package 'eventlog' found Consider adjusting the PKG_CONFIG_PATH environment variable if you installed software in a non-standard prefix. Alternatively, you may set the environment variables EVTLOG_CFLAGS and EVTLOG_LIBS to avoid the need to call pkg-config. See the pkg-config man page for more details. # pwd /usr/local/lib/pkgconfig # ll total 4 -rw-r-r- 1 root root 238 Oct 16 21:55 eventlog.pc # cat eventlog.pc prefix=/usr/local exec_prefix=${prefix} libdir=${exec_prefix}/lib includedir=${prefix}/include/eventlog Name: EventLog Description: General system logging format library Version: 0.2.12 Cflags: -I${includedir} Libs: -L${libdir} -levtlog Appreciate anyone who can tell me what's wrong Ming

2 1

Create Pattern-DB rules
by Justin Kala 20 Oct '15

20 Oct '15

Hello I am trying to create Pattern-DB for the following Authorization messages coming from O/S. Can you help on creating a matching rule . Note: I do not have PATTERN-DB parser utility.I am going to create the db-parser.xml manually and put this rules inside the file. 2014-09-28T14:12:44-04:00 abcdef01-app/abcdef01-app sshd[11019]: [ID 800047 auth.notice] Failed password for root from 100.200.255.01 port 54438 ssh2 2014-09-28T14:03:46-04:00 abcdef01-app/abcdef01-app sshd[27420]: [ID 800047 auth.notice] Failed publickey for root from 100.200.255.02 port 59219 ssh2 2014-09-28T14:08:28-04:00 abcdef01-app/abcdef01-app sshd[3954]: [ID 800047 auth.notice] Failed keyboard-interactive for root from 100.200.255.03 port 65410 ssh2 2014-09-28T14:10:11-04:00 abcdef01-app/abcdef01-app sshd[5222]: [ID 293258 auth.error] libsldap: Status: 49 Mesg: openConnection: simple bind failed - Invalid credentials Thanks & Regards Kaladhar

4 16

Parsing multifield lines
by Giovanni Mancuso 20 Oct '15

20 Oct '15

Hi, i'm writing a parser for lines having a repeated field on the same line eg(Recipient is repeated 3 times): ID: 123AABB456 Sender: user1(a)example.com Recipient: user2(a)example.com Recipient: user3(a)example.com Recipient: user3(a)example.com Status: Sent I would like to have a CUSTOM MACRO with all recipients. Is there a way to do this? Thanks --

3 5