- syslog-ng - lists.balabit.hu

Is the option flush_lines valid now?
by 伊藤宏平 16 Oct '15

16 Oct '15

I tried to use syslog-ng. At first I used a syslog-ng 3.5.3 on ubuntu14.04.But I can not use flush_line option. I asked question in stack overflow.Mr.argus said that " There is a lack of condition"linux - syslog-ng の flush_lines　オプションが効かない - スタック・オーバーフロー Specifically function "log_writer_flush" should be like that. Before: gboolean log_writer_flush(LogWriter *self, LogWriterFlushMode flush_mode) { : if (flush_mode >= LW_FLUSH_BUFFER || count == 0) { if (log_proto_client_flush(proto) == LPS_ERROR) return FALSE; }After: LogProtoFileWriter *w = (LogProtoFileWriter *)proto; if ( (w->buf_count >= w->buf_size) && (flush_mode >= LW_FLUSH_BUFFER || count == 0) ) { if (log_proto_client_flush(proto) == LPS_ERROR) return FALSE; } And now I use a latest syslog-ng ose 3.7.1, hoping the bug has been fixed.But I can not use flush_line option either. Is the option flush_lines valid now? try (動) 試みる、努める、努力する、試す、挑む、見る、審理する tried (形) 検査済みの、証明済みの、試験済みの Powered by iKnow!

3 5

Upon syslog-ng reload /restart a flood of logs is received at a tcp port (destination)
by Shruthi Rao 14 Oct '15

14 Oct '15

I have configured a destination in syslog to a tcp port on localhost options { long_hostnames(off); sync(0); perm(0640); stats(3600); }; source src { internal(); unix-dgram("/dev/log"); udp(); }; destination mgagent{ tcp("127.0.0.1" port(5009) template("$TAG $HOST $PROGRAM $MSGONLY\n")); }; I have a tcp server n the localhost ,receiving logs on this port and it does further processing . Whenever syslog-ng is reloaded or restarted and te tcp server is running , a flood of the logs is sent on this tcp port ( which is handled by the tcp server) , but this is not wanted. The logs which were already sent before restart is sent repeatedly . Is there any way to stop or prevent this . syslog version is syslog-ng 2.0.9 on SLES 11 SP3 -Thanks

2 1

AMQP supported RPM for el5
by Pankaj Sain 09 Oct '15

09 Oct '15

Hi, Please could you help to know, if syslog-ng-2.1.4-9.el5 supports AMQP. If not, could you suggest me the AMQP supported version(*RPM*) for *el5 linux* variants. Regards, *Pankaj Sain** | Netprophets Cyberworks Pvt. Ltd.* Please do not print this mail unless it is necessary.

2 5

insider 2015-10: monitor syslog-ng with Android app; documentation; docker; big data; SUSECon;
by Czanik, Péter 08 Oct '15

08 Oct '15

Dear syslog-ng users, This is the 43th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Monitor syslog-ng with Android app ---------------------------------- During the last Google Summer of Code a new Android application was developed by Krishna Kannan, a student at National University of Singapore, which can monitor syslog-ng. It can check, if syslog-ng is alive and show its configuration and statistics on the screen of your Android device. For details, check https://pzolee.blogs.balabit.com/2015/09/monitor-syslog-ng-with-android-app/ Documentation on github ----------------------- We are pleased to announce that the source code of the syslog-ng Open Source Edition Administrator Guide (https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-… now publicly available on GitHub. This means that if you find an annoying typo, an error in a configuration example, or a bug in the documentation, you can help us correct it by submitting a pull request. Also, if you have a better example to illustrate a feature, or a clearer description about how an option works, let us know. For details about accessing the source XML files and on contributing, see our GitHub page at https://github.com/balabit/syslog-ng-ose-guides/ Docker images for syslog-ng --------------------------- There are three docker images available for syslog-ng OSE at https://hub.docker.com/u/balabit/ The “syslog-ng” image targets end users, the other two are for developers, who would like to set up an isolated development environment for syslog-ng quickly. If you would like to modify the images, the sources are available at https://github.com/balabit/syslog-ng-docker Big data -------- syslog-ng delivers log data directly to Hadoop, Elasticsearch, MongoDB and Kafka, so supports practically all major “big data” systems as a destination. Learn how this simplifies your data pipeline and makes your data routing more flexible and efficient: https://jluby.blogs.balabit.com/2015/09/17/got-big-data-ingestion-problems-… syslog-ng @ SUSECon ------------------- SUSE was one of the first major Linux distributions to include syslog-ng. For a long time syslog-ng was the default syslog implementation in both SLES (SUSE Linux Enterprise Server) and openSUSE, and many SLES and openSUSE users are still enthusiastic about syslog-ng. This year, BalaBit (the company behind syslog-ng) participates at the annual SUSE conference, SUSECon, in Amsterdam, during the first week of November. https://czanik.blogs.balabit.com/2015/09/balabits-syslog-ng-at-the-annual-s… Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com To read this newsletter on-line, visit: http://insider.blogs.balabit.com/ Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Question about compiling 3.7.1 on CentOS 7
by Tech Support 05 Oct '15

05 Oct '15

All; I'm trying to compile 3.7.1 on CentOS 7 with Elasticsearch support which I'm *assuming* requires Java support. However, when I run 'configure', it doesn't enable the Java support. I must be missing a Java dependency somewhere. Does anyone know what dependencies I need for this? Any insight at all would be greatly appreciated. Thanks; John

2 1

Elasticsearch destination and time-zone info
by Evan Rempel 05 Oct '15

05 Oct '15

We are in the process of integrating our logging infrastructure into elasticsearch with Kibana, but have a slight challenge regarding time zones. Some of our equipment will only log in UTC time. This is not an issue because Kibana does time presentation in localtime. Most of our hosts log with our local timezone. This all works out fine due to the way kibana displays the logs - localtime. The problem is that the elasticsearch indexes roll over based on some template (XXXX-YYYY-MM-DD) or such, and this template will an incorrect set of messages. For example, I live in time zone -7:00. This means that any messages after 17:00 (17:00 + 7:00 = 00:00 the next day) that were logged with UTC will go into the index for the next day. So, is there any way to set the time-zone option for the elasticsearch destination? Alternatively, are there any date templates where I could do something like $(timezone UTC $ISODATE) $(timezone UTC $HOUR) in my template? Any help would be appreciated. -- Evan Rempel erempel(a)uvic.ca Senior Systems Administrator 250.721.7691 Data Centre Services, University Systems, University of Victoria

4 9

Re: [syslog-ng] How to unsubscribe from this mailers
by Mayur Saxena (maysaxen) 02 Oct '15

02 Oct '15

2 1

TCP Resets
by Michael Starks 02 Oct '15

02 Oct '15

I am running syslog-ng 3.4.7 as distributed by ELSA. I have a problem whereby nxlog agents (v2.9.1347) making a new TCP connection to the syslog-ng server repeatedly show lines like this in nxlog.log: 2015-09-28 14:28:25 INFO reconnecting in 1 seconds Many connections are working, but it especially has a problem with new agents coming online. Sometimes when I restart syslog-ng it helps, but not always. Other than the standard ELSA config, I am simply also writing to a filesystem destination. If I remove the elsa.pl destination, I still have problems. The problem isn't necessarily related to just nxlog agents. I also have a Cisco proxy that is using TCP to send logs, and that is also getting RSTs sent to it. I tried v3.6.3 and that didn't seem to help. A packet capture shows the SYN from the agent, a SYN ACK, another SYN, then a FIN *prior* to the data packet being received. Immediately after the data packet, the log server sends a RST. As a result, I have a bunch of TIME_WAITs open. No host firewall is running. I am currently only bursting to about 350 EPS and I have syslog-ng running in the foreground looking for dropped packets like so (there haven't been any): /usr/local/syslog-ng-3.4.7/sbin/syslog-ng -Ftvd 2>&1 | grep "dropping messages" Any assistance would be greatly appreciated! Currently loaded syslog-ng.conf: # cat /usr/local/syslog-ng/etc/syslog-ng.conf @version: 3.2 options { log_fifo_size(30000); #threaded(yes); # enable if using Syslog-NG 3.3.x use_dns (no); # IMPORTANT! A busy syslog server can become unresponsive if DNS lookups fail, so we disable them. use_fqdn (no); keep_hostname (yes); }; source s_network { # no-multi-line means parse message as-is, newlines included, to allow for multi-line messages tcp(flags(no-multi-line)); udp(flags(no-multi-line)); }; source s_internal { internal(); }; source s_realtime { pipe("/data/elsa/tmp/realtime" flags(expect-hostname)); }; source s_import { pipe("/data/elsa/tmp/import" flags(expect-hostname syslog-protocol)); }; source s_ops { unix-dgram("/data/elsa/tmp/ops" flags(expect-hostname syslog-protocol no-multi-line)); }; parser p_db { db-parser(file("/usr/local/elsa/node/conf/merged.xml")); }; filter f_rewrite_cisco_program { match('^(%[A-Z\_]+\-\d\-[0-9A-Z\_]+): ([^\n]+)' value("MSGONLY") type("pcre") flags("store-matches" "nobackref")); }; filter f_rewrite_cisco_program_2 { match('^[\*\.]?(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+\d{1,2}\s\d{1,2}:\d{1,2}:\d{1,2}(?:\.\d+)?(?: [A-Z]{3})?: (%[^:]+): ([^\n]+)' value("MSGONLY") type("pcre") flags("store-matches" "nobackref")); }; filter f_rewrite_cisco_program_3 { match('^\d+[ywdh]\d+[ywdh]: (%[^:]+): ([^\n]+)' value("MSGONLY") type("pcre") flags("store-matches" "nobackref")); }; filter f_rewrite_cisco_program_4 { match('^\d{6}: [\*\.]?(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+\d{1,2}\s\d{1,2}:\d{1,2}:\d{1,2}(?:\.\d+)?(?: [A-Z]{3})?: (%[^:]+): ([^\n]+)' value("MSGONLY") type("pcre") flags("store-matches" "nobackref")); }; filter f_unclassified { "${.classifier.class}" eq "unknown" }; rewrite r_unparsed { set("98", value("MSGID")); }; rewrite r_cisco_program { set("$1", value("PROGRAM") condition(filter(f_rewrite_cisco_program) or filter(f_rewrite_cisco_program_2) or filter(f_rewrite_cisco_program_3) or filter(f_rewrite_cisco_program_4))); set("$2", value("MESSAGE") condition(filter(f_rewrite_cisco_program) or filter(f_rewrite_cisco_program_2) or filter(f_rewrite_cisco_program_3) or filter(f_rewrite_cisco_program_4))); }; rewrite r_snare { subst("MSWinEventLog.+(Security|Application|System).+", "$1", value("PROGRAM") flags(global)); }; # URL encode any literal pipes so the tab rewriter doesn't introduce ambiguity rewrite r_from_pipes { subst('\|', "%7C", value("MESSAGE") flags(global) condition(program("bro_*" type(glob)))); }; #rewrite r_from_pipes { subst('\|', "%7C", value("MESSAGE") flags(global)); }; rewrite r_pipes { subst("\t", "|", value("MESSAGE") flags(global)); }; rewrite r_host { set("$SOURCEIP", value("HOST")); }; rewrite r_extracted_host { set("$pdb_extracted_sourceip", value("HOST") condition("$pdb_extracted_sourceip" != "")); }; rewrite r_extracted_timestamp { set("$S_UNIXTIME", value("SOURCE")); set("$pdb_extracted_timestamp", value("SOURCE") condition("$pdb_extracted_timestamp" != "")); }; template t_db_parsed { template("$R_UNIXTIME\t$HOST\t$PROGRAM\t${.classifier.class}\t$MSGONLY\t${i0}\t${i1}\t${i2}\t${i3}\t${i4}\t${i5}\t${s0}\t${s1}\t${s2}\t${s3}\t${s4}\t${s5}\n"); }; template t_db_parsed_import { template("$MSGID\t$SOURCE\t$HOST\t$PROGRAM\t${.classifier.class}\t$MSGONLY\t${i0}\t${i1}\t${i2}\t${i3}\t${i4}\t${i5}\t${s0}\t${s1}\t${s2}\t${s3}\t${s4}\t${s5}\n"); }; template t_ops { template("$S_UNIXTIME\t$HOST\t$PROGRAM\t$MSGID\t$MSGONLY\t${.SDATA.elsa@32473.line_number}\t${.SDATA.elsa@32473.pid}\t${.SDATA.elsa@32473.client}\t${.SDATA.elsa@32473.qid}\t\t\t${.SDATA.elsa@32473.priority}\t${.SDATA.elsa@32473.file}\t${.SDATA.elsa@32473.method}\t${.SDATA.elsa@32473.hostname}\t\t\n"); }; template t_unparsed { template("Unparsed host=$HOST program=$PROGRAM msg=$MSGONLY\n"); }; destination d_elsa { program("perl /usr/local/elsa/node/elsa.pl -c /etc/elsa_node.conf" template(t_db_parsed)); }; destination d_elsa_import { program("perl /usr/local/elsa/node/elsa.pl -c /etc/elsa_node.conf -f __IMPORT__" template(t_db_parsed_import)); }; destination d_elsa_ops { program("perl /usr/local/elsa/node/elsa.pl -c /etc/elsa_node.conf -f __OPS__" template(t_ops)); }; destination d_unclassified { unix-dgram("/data/elsa/tmp/ops" flags(syslog-protocol) template(t_unparsed)); }; destination d_debug { unix-dgram("/data/elsa/tmp/debug" template(t_db_parsed)); }; # Custom destination -Mike destination d_hosts { file("/data/logs/$HOST/$HOST.log"); }; include /etc/elsa_syslog-ng.conf; #log { # source(s_ops); # destination(d_elsa_ops); # flags(final); #}; #log { # source(s_network); # source(s_realtime); # rewrite(r_host); # rewrite(r_cisco_program); # rewrite(r_snare); # rewrite(r_from_pipes); # rewrite(r_pipes); # parser(p_db); # rewrite(r_extracted_host); # ###FILTER_UNPARSED###log { filter(f_unclassified); rewrite(r_unparsed); destination(d_unclassified); flags(final); }; # log { destination(d_elsa); }; # log { destination(d_debug); }; #}; #log { # source(s_import); # rewrite(r_cisco_program); # rewrite(r_snare); # rewrite(r_from_pipes); # rewrite(r_pipes); # parser(p_db); # rewrite(r_extracted_host); # rewrite(r_extracted_timestamp); # destination(d_elsa_import); #}; # cat /etc/elsa_syslog-ng.conf ################################## #### Global Options ######### ################################## options { check_hostname(yes); create_dirs(yes); dir_group(log_analyst); dir_owner(root); dir_perm(0550); group(log_analyst); owner(root); perm(0640); # Let's not be vulnerable to DNS attacks and general problems dns_cache(no); use_dns(no); # Keep the original hostname (good for relay servers) keep_hostname(yes); # Keep original timestamp (not received time) - this could be forged, so use caution during forensincs examinations keep_timestamp(yes); }; ################################## ########### Sources ######### ################################## # Source for local system logs source s_local { # message generated by Syslog-NG internal(); # standard Linux log source (this is the default place for the syslog() # function to send logs to) unix-stream("/dev/log"); # messages from the kernel file("/proc/kmsg" program_override("kernel: ")); }; ################################## ######### Destinations ########## ################################## # This is the directory structure that will be automatically created as logs come in destination d_hosts { file("/data/logs/$HOST/$HOST.log"); };

2 2

Syslog ng and Mysql
by Arash Shams 01 Oct '15

01 Oct '15

Hello ELK solution is not suitable for us to collect all logs in one server . i prefer to use syslog-ng to collect all logs in Mysql database. is there possible to send all servers log to one syslog-ng server and that collect them to database ? anyone can give me a good configuration file or some examples in this case ? thank you

7 20

Issues with lowercase hostname on 3.2.5
by Kay N. Avila 25 Sep '15

25 Sep '15

Hello, I'm running syslog-ng 3.2.5 from EPEL on RHEL and having an issue with the $HOST variable. My destination is destination device_log { file("/<snipped>/$HOST.log"); }; and that is working, except the file is created with an uppercase name if the host reports it that way. I'd like them to all be consistently lowercase. I can't use a DNS look up instead since not all of the hosts have reverse DNS set for their IPs. I've tried normalize-hostnames(yes); in the global options but it doesn't seem to make a difference. Also I don't believe $(lowercase ...) is available to me in 3.2.5. I've read through the documentation and have come up empty. What am I missing? Apologies if this has been asked before; I searched the list but couldn't find anything. Thanks for any pointers, Kay Avila

3 4