- syslog-ng - lists.balabit.hu

syslog-ng GSoC IRC event
by Budai, László 20 Jul '15

20 Jul '15

Hi, after midterm, we will have an IRC meeting. Participants: mainly students and mentors, and of course anyone else who are interested in :-) Topics: * Where are we now? Status updates on projects. * Talking about on how to share your results with community. (online demos, blogs, whatever...) DATE: Tue 7/21/15 4:00 PM – 5:00 PM Time zone: Budapest regards, Laszlo Budai

1 0

Behaviour with unavailable TCP destination
by ZeroUno 20 Jul '15

20 Jul '15

Hello, I was wondering what happens when you define a tcp() destination in syslog-ng.conf and then the destination is temporarily not available. I was not able to find the answer in the docs. Are any messages lost? Or are they kept somewhere and sent again when the destination becomes available again? Thank you. -- 01

3 2

Re: [syslog-ng] Using FIPS complaint OpenSSL with syslog-ng OSE
by Laszlo Budai 17 Jul '15

17 Jul '15

Hi, FIPS compliant OpenSSL is an openssl compiled and linked with FIPS object module. If syslog-ng not using disabled crypto functions (eg. md5) then it should work. Give it a try and if you will have some problems, just open an issue on our github page. regards, Laszlo Budai Sent from my HTC ----- Reply message ----- From: "Saurabh Shukla" <saurabh(a)purestorage.com> To: <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] Using FIPS complaint OpenSSL with syslog-ng OSE Date: Thu, Jul 16, 2015 22:43 Hi, I see that syslog-ng OSE uses OpenSSL libraries for TLS support. If my system has FIPS complaint OpenSSL installed, will syslog-ng OSE use those FIPS compliant libraries for TLS support? Do I need any change in the syslog-ng OSE's configuration for this? Thanks, -- Saurabh Shukla ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

Using FIPS complaint OpenSSL with syslog-ng OSE
by Saurabh Shukla 17 Jul '15

17 Jul '15

Hi, I see that syslog-ng OSE uses OpenSSL libraries for TLS support. If my system has FIPS complaint OpenSSL installed, will syslog-ng OSE use those FIPS compliant libraries for TLS support? Do I need any change in the syslog-ng OSE's configuration for this? Thanks, -- Saurabh Shukla

3 2

Host/port from environment variables
by Peter Flood 15 Jul '15

15 Jul '15

Hi I'm trying configure syslog-ng, I'd like to be able to use environment variables for host & port. I've tried the ones that work in the template formatter but it's not working (not suprisingly). Is there another way? destination d_my_dest { tcp("$(env MY_HOST)" port($(env MY_PORT)) # this doesn't work as you can't get env vars unless in a template tls(peer-verify(required-untrusted) ca_dir("/etc/syslog-ng/cert.d")) template(myTemplate)); }; Thanks

2 2

Problems trying to compile syslog-ng 3.6.4 on Solaris 11.2 (SPARC)
by Arsenault, Adam 11 Jul '15

11 Jul '15

With this patch, syslog-ng 3.6.4 compiles on Solaris 11.2 (X86-64). It will work on SPARC as well. https://github.com/balabit/syslog-ng/pull/543 -Adam Arsenault

5 8

Trying to get json out of 3.7beta2
by Russell Fulton 08 Jul '15

08 Jul '15

Hi Thanks to various folks I managed to build 3.7b2 with json. I am now trying to convert my ELSA config to produce a parsed output in json that I can feed into Elastic Search. Having failed to make my full config work (I had to try ;) so I tried a basic one based on https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-… [ Aside: minor syntax error on this page — lnside log {} you can not name parser elements ] here is my conf: @version: 3.7 source s_json { network(port(1514) flags(no-parse)); }; destination d_json { file("/data/russell/test.json” template("$(format-json --scope dot-nv-pairs)\n")); }; log { source(s_json); parser { json-parser (prefix(".json.")); }; destination(d_json); }; I get no output and ‘stats’ shows: [rful011@secmgrprd01 ~]$ sudo /usr/local/syslog-ng/sbin/syslog-ng-ctl stats SourceName;SourceId;SourceInstance;State;Type;Number src.none;;;a;processed;0 src.none;;;a;stamp;0 source;s_json;;a;processed;19375 global;payload_reallocs;;a;processed;25710 global;msg_clones;;a;processed;0 destination;d_json;;a;processed;0 center;;queued;a;processed;0 global;sdata_updates;;a;processed;0 center;;received;a;processed;19375 global;internal_queue_length;;a;processed;19378 Which is the same as I get with my full config with lots of patterns. As usual am missing something basic!

5 7

configure for beta 2 not finding jsonc on RHEL 6
by Russell Fulton 05 Jul '15

05 Jul '15

Hi I have installed the libjson-devel package via yum but ./configure says: checking for JSON: no the library is in /lib64 and headers in /usr/include/json-c/ I can’t figure out what configure options I need to get this to work. Thanks, Russell

3 3

syslog-ng 3.6.4 Debian packages are available
by Budai, László 03 Jul '15

03 Jul '15

Hi, I've just created an OBS repo[1] for syslog-ng 3.6.x series (current version: 3.6.4 [2] ). This means that this is not an official Debian/Ubuntu APT repository but one hosted by OBS. List of supported OSs (i386/amd64): * Debian 7.0 * Debian 8.0 * Ubuntu 12.04 * Ubuntu 14.04 * Ubuntu 14.10 * Ubuntu 15.04 Install ------- 1. get release key wget -qO - http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng-3.6… | sudo apt-key add - 2. add repo to APT sources eg.: /etc/apt/sources.list.d/syslog-ng-obs.list deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng-3.6… ./ Then `apt-get update` and `apt-get install syslog-ng-core=3.6.4-1` You can replace Debian_8.0 to * Debian_7.0 * xUbuntu_12.04, * xUbuntu_14.04 * xUbuntu_14.10 * xUbuntu_15.04 (`x` before Ubuntu is not a typo ;-) ) Available packages: * syslog-ng-core * syslog-ng-dbg * syslog-ng-dev * syslog-ng-mod-amqp * syslog-ng-mod-geoip * syslog-ng-mod-graphite * syslog-ng-mod-json * syslog-ng-mod-mongodb * syslog-ng-mod-redis * syslog-ng-mod-riemann * syslog-ng-mod-smtp * syslog-ng-mod-sql * syslog-ng-mod-stomp Links -------- [1] https://build.opensuse.org/project/show/home:laszlo_budai:syslog-ng-3.6 [2] https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.6.4 regards, Laszlo Budai (lbudai)

3 6

Problems trying to compile syslog-ng 3.6.4 on Solaris 11.2 (SPARC)
by Cottington-Bray, Ian 01 Jul '15

01 Jul '15

Have compiled and installed eventlog-0.2.12 (into /usr/local/syslog-ng). Now trying to compile syslog-ng I'm hitting the error shown at the end. Following commands were used to configure the environment for the compile export PKG_CONFIG_PATH=/usr/local/syslog-ng/lib/pkgconfig ./configure --prefix=/usr/local/syslog-ng --enable-sun-streams --enable-tcp-wrapper --enable-ipv6 --enable-sql --enable-ssh --with-ld-library-path=/usr/local/syslog-ng/lib --disable-amqp --enable-sun-door Any suggestions ? Thanks Ian CC modules/afsocket/modules_afsocket_libafsocket_notls_la-transport-mapper-unix.lo CC modules/afsocket/modules_afsocket_libafsocket_notls_la-transport-unix-socket.lo modules/afsocket/transport-unix-socket.c: In function â_format_proc_file_nameâ: modules/afsocket/transport-unix-socket.c:50:3: warning: format â%dâ expects argument of type âintâ, but argument 4 has type âpid_tâ [-Wformat=] g_snprintf(buf, buflen, "/proc/%d/%s", pid, proc_file); ^ modules/afsocket/transport-unix-socket.c: In function â_unix_socket_readâ: modules/afsocket/transport-unix-socket.c:219:6: error: âstruct msghdrâ has no member named âmsg_controlâ msg.msg_control = ctlbuf; ^ modules/afsocket/transport-unix-socket.c:220:6: error: âstruct msghdrâ has no member named âmsg_controllenâ msg.msg_controllen = sizeof(ctlbuf); ^ modules/afsocket/transport-unix-socket.c: In function âlog_transport_unix_dgram_socket_newâ: modules/afsocket/transport-unix-socket.c:261:3: warning: implicit declaration of function âsocket_set_pass_credentialsâ [-Wimplicit-function-declaration] socket_set_pass_credentials(fd); ^ modules/afsocket/transport-unix-socket.c: At top level: modules/afsocket/transport-unix-socket.c:36:1: warning: â_add_nv_pair_intâ defined but not used [-Wunused-function] _add_nv_pair_int(LogTransportAuxData *aux, const gchar *name, gint value) ^ modules/afsocket/transport-unix-socket.c:102:1: warning: â_add_nv_pair_proc_read_unless_unsetâ defined but not used [-Wunused-function] _add_nv_pair_proc_read_unless_unset(LogTransportAuxData *aux, const gchar *name, pid_t pid, const gchar *proc_file, const gchar *unset_value) ^ modules/afsocket/transport-unix-socket.c:115:1: warning: â_add_nv_pair_proc_read_argvâ defined but not used [-Wunused-function] _add_nv_pair_proc_read_argv(LogTransportAuxData *aux, const gchar *name, pid_t pid, const gchar *proc_file) ^ modules/afsocket/transport-unix-socket.c:135:1: warning: â_add_nv_pair_proc_readlinkâ defined but not used [-Wunused-function] _add_nv_pair_proc_readlink(LogTransportAuxData *aux, const gchar *name, pid_t pid, const gchar *proc_file) ^ gmake[2]: *** [modules/afsocket/modules_afsocket_libafsocket_notls_la-transport-unix-socket.lo] Error 1 gmake[1]: *** [all-recursive] Error 1 gmake: *** [all] Error 2 The contents of this e-mail are confidential and for the exclusive use of the intended recipient. If you are not the intended recipient you should not read, copy, retransmit or disclose its contents. If you have received this email in error please delete it from your system immediately and notify us either by email or telephone. The views expressed in this communication may not necessarily be the views held by McLaren Technology Group Limited. McLaren Technology Group Limited | McLaren Technology Centre | Chertsey Road | Woking | Surrey | GU21 4YH | UK | Company Number: 01967715

4 8