- syslog-ng - lists.balabit.hu

About unofficial Debian/Ubuntu packages
by Gergely Nagy 09 Sep '15

09 Sep '15

Hi! As some of you may remember, I used to build and host unofficial Debian and Ubuntu packages[1] for syslog-ng, but I stopped doing so for a number of reasons a while ago. [1]: https://asylum.madhouse-project.org/projects/debian/ Recently, I felt the need to use a more recent (3.7.1) syslog-ng, so I started to update the packaging. Right now, the results are on GitHub[2], but the package repositories are not updated. Before I do that, I'd like to evaluate if it is worth the effort, because there's a huge gap between building packages for my own use, and building them for others too. For one, I only care about Debian stable on armhf, which is, well, far from the most popular architecture. [2]: https://github.com/algernon/syslog-ng-debian So, if you or anyone you know would benefit from the continuation of my unofficial (but high quality, and supported) Debian/Ubuntu packages, please let me know off-list, I'd like to talk. Thanks in advance! -- |8]

1 0

Parsing message in unstructured rows
by Giovanni Mancuso 08 Sep '15

08 Sep '15

Hi, I have an application that log date in every rows. The problem is that the string isn't in specific part of MESSAGE, but it could be the first element or the last element, or in the middle :-) :-) For example (only MESSAGE): User: user1(a)example.com *Date: 12/12/2014* Status: OK User: user2(a)example.com ID: 1234 Status: DEL ....... *Date: 03/05/2014 Date: 05/08/2015 *User:**user3@example.com ....... Stauts: OK* *......... I want split the log in more files arranged in different path builded by the date information, for example /LOGS/YYYY/MM/DD/mylog.log. I do: Konsole output rewrite r_rewrite_set { set("$(python get_data)", value("APP.DATE")); }; python{ import re def get_data(logmsg): out=None vars(logmsg) out = re.findall(" Date: (\d\d/\d\d/\d\d\d\d) ", logmsg.MESSAGE) if len(out) == 1: return out[0] else: raise Exception("Invalid match") }; In this way i have in APP.DATE the date. Now i have a some questions: 1) Is there another way to do this without python? 2) In this way for every message, syslog-ng forks and exec a python interpreter? 3) Is there a way to add custom SDATA field from python? Or is there a way to create APP.DATE from python without rewrite rule? 4) Is there a documentation about python{}? I only found a post in a blog. Thanks

2 3

Re: [syslog-ng] Parsing message in unstructured rows
by Jim Hendrick 08 Sep '15

08 Sep '15

Would patterndb be an option?Thinking one to match each log line type each parsing out the date and whatever else you want. Jim Sent from my Verizon Wireless 4G LTE smartphone -------- Original message -------- From: Giovanni Mancuso <giovanni.mancuso(a)par-tec.it> Date: 09/07/2015 3:26 PM (GMT-05:00) To: "Scheidler, Balázs" <balazs.scheidler(a)balabit.com>, Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] Parsing message in unstructured rows Il 07 settembre 2015 21:10:59 "Scheidler, Balázs" <balazs.scheidler(a)balabit.com> ha scritto: > On Sep 7, 2015 6:11 PM, "Giovanni Mancuso" <giovanni.mancuso(a)par-tec.it> > wrote: > > > > Hi, > > > > I have an application that log date in every rows. The problem is that > the string isn't in specific part of MESSAGE, but it could be the first > element or the last element, or in the middle :-) :-) > > > > For example (only MESSAGE): > > User: user1(a)example.com Date: 12/12/2014 Status: OK > > User: user2(a)example.com ID: 1234 Status: DEL ....... Date: 03/05/2014 > > Date: 05/08/2015 User: user3(a)example.com ....... Stauts: OK > > ......... > > > > I want split the log in more files arranged in different path builded by > the date information, for example /LOGS/YYYY/MM/DD/mylog.log. > > > > I do: > > rewrite r_rewrite_set { > > set("$(python get_data)", value("APP.DATE")); > > }; > > > > python{ > > import re > > def get_data(logmsg): > > out=None > > vars(logmsg) > > out = re.findall(" Date: (\d\d/\d\d/\d\d\d\d) ", logmsg.MESSAGE) > > if len(out) == 1: > > return out[0] > > else: > > raise Exception("Invalid match") > > }; > > > > In this way i have in APP.DATE the date. > > Now i have a some questions: > > 1) Is there another way to do this without python? > > Well, this should be possible with a simple regexp filter. I try to use a filter regexp, but i don't find the solution. Have you an example? > > > 2) In this way for every message, syslog-ng forks and exec a python > interpreter? > > No, it embeds a Python interpreter. > > > 3) Is there a way to add custom SDATA field from python? Or is there a > way to create APP.DATE from python without rewrite rule? > > Not right now. > > > 4) Is there a documentation about python{}? I only found a post in a blog. > > It's being prepared by the tech writer team in BalaBit > > > > > Thanks > > > > > > > ______________________________________________________________________________ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > Inviato con AquaMail per Android http://www.aqua-mail.com

2 1

Problem with a pattern in 3.6.4
by C. L. Martinez 04 Sep '15

04 Sep '15

Hi all, I am trying to configure a pattern for the following log entry in syslog-ng 3.6.4: idpsnort01 09/03-13:18:41.935109 [**] [3:19187:6] PROTOCOL-DNS TMG Firewall Client long host entry exploit attempt [**] [Classification: Attempted User Privilege Gain] [Priority: 1] [AppID: dns] {UDP} 80.58.61.250:53 -> 10.196.0.67:60941 My pattern is: <pattern>@ESTRING:s3: @@ESTRING:: @@ESTRING:: [**]@ @QSTRING:s0:[]@ @ESTRING:s1: [**] [@Classification:@QSTRING:s2: ]@ [Priority : @NUMBER:i0:@] @@[AppID: @QSTRING:s4: ] @QSTRING:i1:{}@ @IPv4:i2:@:@NUMBER:i3:@ -> @IPv4:i4:@:@NUMBER:i5:@</pattern> If you try it, you can see it doesn't works. Problem is with the following part of the message: [Priority: 1] [AppID: dns] I need to escape "] [AppID:" and catch "dns" field, but I have tried some configs withut luck. Any idea?? Many thanks.

2 2

insider 2015-09: syslog-ng 3.7.1 released; ARM; configuring Java; Python trick;
by Czanik, Péter 03 Sep '15

03 Sep '15

Dear syslog-ng users, This is the 43th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS syslog-ng Open Source Edition 3.7.1 released -------------------------------------------- The first syslog-ng 3.7 release is now available together with a matching incubator 0.5 release. Major new features include Java and Python destinations migrated from the incubator, and a collection of Java based “big data” destinations: Elasticsearch, Hadoop and Kafka. For a complete list of new features, check the release notes available at https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.7.1 syslog-ng on ARM ---------------------- As syslog-ng is in many Linux distributions, it is also available on ARM. Recently we had a chance to evaluate syslog-ng on a 64bit ARM machine. The results are mixed, but very promising. If you already use syslog-ng on ARM or plan to use it, contact me and share your use case and experiences! https://czanik.blogs.balabit.com/2015/07/syslog-ng-on-64bit-arm/ Getting started with the new Java based destinations ---------------------------------------------------- Installing the new Java based destination drivers requires a bit more preparation than installing the syslog-ng package and writing syslog-ng.conf, as was previously. This “HowTo” helps you to get started with Java based destinations on popular Linux distributions and FreeBSD: https://czanik.blogs.balabit.com/2015/08/getting-started-with-syslog-ng-3-7… A nice Python trick ------------------- syslog-ng Open Source Edition 3.7 allows you to process your log messages in Python, making it easy to solve a thousand use-cases. Here is one of the many possibilities: https://guest.blogs.balabit.com/2015/09/processing-log-messages-with-python… NEW RELEASES syslog-ng OSE 3.7.1: https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.7.1 syslog-ng PE 5F4: https://jluby.blogs.balabit.com/2015/07/23/syslog-ng-premium-edition-5f4-re… syslog-ng Store Box 4F2: https://jluby.blogs.balabit.com/2015/08/10/syslog-ng-store-box-4f2-released/ Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com To read this newsletter on-line, visit: http://insider.blogs.balabit.com/ Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Advice on the right destination
by Giovanni Mancuso 31 Aug '15

31 Aug '15

Hi, I am writing to ask your advice on a solution I'm thinking. I have 12 servers with postfix, amavisd-new and other custom software that manage the e-mail system and I was working in a web interface to analysis the logs and correlation with the ability to search for certain fields (from, to, message-id , date). All applications send the logs to a centralized syslog-ng, and I was trying to understand which type of "destination" is better to use to ensure the rapid search. I was analyzing the possibility of using elasticsearch, but I don't know neither it or its performances. The quantity of data is very high, about 3TB of data monthly or each machine, with 2 years of retention. What do you think about? Have you any suggestions? Thanks -- *Giovanni Mancuso* System Architect *T* 06.9826.9600 *M* +39.340.65.80.739 *F* 06.9826.9680 P.zza S.Benedetto da Norcia, 33 - 00071 Pomezia (RM) Par-Tec S.p.A. <http://www.par-tec.it> Web Site <http://www.par-tec.it> info(a)par-tec.it <mailto:info@par-tec.it> Pagina Facebook <https://www.facebook.com/ParTecSpA> Profilo Twitter <https://twitter.com/partecspa> Pagina LinkedIn <https://www.linkedin.com/company/par-tec/> Canale YouTube <https://www.youtube.com/user/ParTecSpA> CONFIDENZIALE: Questo messaggio ed i suoi allegati sono di carattere confidenziale per i destinatari in indirizzo. È vietato l'inoltro non autorizzato a destinatari diversi da quelli indicati nel messaggio originale. Se ricevuto per errore, l'uso del contenuto è proibito; si prega di comunicarlo al mittente e cancellarlo immediatamente.

2 1

Can't get syslog-ng to start...
by Mason, Tron 31 Aug '15

31 Aug '15

All, I keep getting the following when attempting to start syslog-ng: /usr/local/etc/syslog-ng/syslog-ng.conf: line 10: @version:: command not found /usr/local/etc/syslog-ng/syslog-ng.conf: line 12: syntax error near unexpected token `(' /usr/local/etc/syslog-ng/syslog-ng.conf: line 12: `options { use_dns(yes);' Not sure why I'm getting these messages when I'm running a later version: bash-3.2# /usr/local/sbin/syslog-ng -V syslog-ng 3.2.4 Installer-Version: 3.2.4 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#ef7b91e4a1b1f9628c66138b4ae83de7e4c697c6 Compile-Date: Jun 9 2011 05:24:53 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: on Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: on Enable-Pacct: off bash-3.2# more /usr/local/etc/syslog-ng/syslog-ng.conf # Syslog-ng example configuration file for Solaris # # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.solaris,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # Current syslog-ng binary version 1.5.16 # # Solaris 2.5.1 and below uses the STREAMS driver, above extends it # with doors. For 2.5.1 remove the door() option from the source declaration. # @version: 3.2.4 options { use_dns(yes); # use_time_recvd(yes); chain_hostnames(off); log_fifo_size(1000); }; #source local { sun-streams("/dev/log" door("/var/run/syslog_door")); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; #source s_tcp { tcp(port(5014) max-connections(100); }; #source s_tcp { tcp(ip(0.0.0.0) port(5014)); }; source s_udp { udp(); }; # source s_udp { udp(ip(0.0.0.0) port(514)); }; ..........

3 3

Some development notes on 3.7
by Budai, László 26 Aug '15

26 Aug '15

Hi, after the 3.7 is out we would had to create a new 3.7/master branch, but I would postpone this step at a later point. Why? Because I know that there are some fixes in the queue what we would have to forward port to 3.8 and some of them to 3.6. This branching will be a lazy one: we will branch it when we have to, but not earlier. L.

1 0

Forwarding system startup messages
by Saurabh Shukla 25 Aug '15

25 Aug '15

I am running syslog-ng 3.6.4 and I have the following destination and log path configured that forwards all messages to the destination: destination remote { network("remote.example.com" port(514) transport(tcp) log_fifo_size(2048)); }; log { source(s_all); destination(remote); flags(flow-control);}; When the system reboots, I see that startup messages from the kernel are logged into /var/log/syslog. syslog-ng establishes a connection to the remote destination around 10 sec after the first message was logged into /var/log/syslog. However, it fails to forward any message that was logged into /var/log/syslog during the first 10 seconds even though I have the output buffer and flow control configured. Is this a bug in syslog-ng or am I missing some configuration steps? Thanks, -- Saurabh

2 8

"Error resolving hostname" for UDP Destination
by David Hauck 24 Aug '15

24 Aug '15

Hi, I've experienced problems starting syslog-ng related to hostname lookup on UDP destinations for a while now and am finally getting back to looking into some kind of mitigation for the exceptions. Here's what I see: if I have a destination configured with an endpoint that requires name lookup and the name lookup fails, I see the following error when attempting to start (or reload) syslog-ng: Starting syslog-ng: Error resolving hostname; host='test.nacc.netacquire.dom' Error initializing message pipeline; Unfortunately, this results in the entire process failing to start. If syslog-ng is otherwise running and I attempt to reload the configuration (with the problematic name present) I don't see any errors logged, but I do see that the process is now defunct (and is no longer running): root 18674 1 0 10:03 ? 00:00:00 supervising syslog-ng root 18701 18674 0 10:04 ? 00:00:00 [syslog-ng] <defunct> Here's the simple destination in question: destination d_NAaudit_Prio { file("/var/log/netacquire/audit_log" template(t_NAFormat_Prio)); udp("test.nacc.netacquire.dom" port(514) template(t_NAFormat_Prio)); }; I'm wondering if there might be some way to mitigate this exception. For example: 1. Log the error and allow syslog-ng to otherwise continue to start/function without the destination being configured/used. 2. As above, and suspend the destination but allow it to continue to attempt to probe the name lookup so that if the resolution does eventually succeed the destination can be resumed. Are either of the above options feasible/available? Are there any other ideas for how to mitigate this exception so that syslog-ng can be started/reloaded successfully (other than detecting this event a priori and removing the destination from the configuration before attempts to start/reload)? Thanks in advance! -David PS: Here's my version information: # syslog-ng --version syslog-ng 3.5.4.1 Installer-Version: 3.5.4.1 Revision: ssh+git://algernon@git.balabit/var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.5#master#4090ee62163780ae68a0c83cfdc23998c904fe97 Compile-Date: May 19 2015 17:04:36 Available-Modules: confgen,afstomp,afmongodb,linux-kmsg-format,cryptofuncs,afsocket,csvparser,dbparser,afamqp,afsocket-tls,syslogformat,afsocket-notls,afprog,basicfuncs,afuser,affile,system-source Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: on Enable-Linux-Caps: off Enable-Pcre: on

3 13