- syslog-ng - lists.balabit.hu

3.7beta2 packages for openSUSE / SLES
by Czanik, Péter 26 Jun '15

26 Jun '15

Hi, My unofficial syslog-ng 3.7 beta2 packages for openSUSE / SLES are now available, at this time completely untested (I'm sitting at a conference right now... :-) ). They are available at the usual location: https://build.opensuse.org/package/show/home:czanik:syslog-ng37/syslog-ng Python support failed to build on SLES11 (most likely missing pkg-config information for python) and java failed in post build checks... Have a nice weekend! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Migrating from syslog-ng v 3.2.5 to 3.6.4
by Tech Support 26 Jun '15

26 Jun '15

All; I am currently migrating a CentOS 6.6 server running syslog-ng 3.2.5 to a CentOS 7.1 system running syslog-ng 3.6.4. I'm trying to use the same configuration file, but I'm getting the following message: /usr/sbin/syslog-ng -v -s -f /etc/syslog-ng/syslog-ng.conf [2015-06-25T09:05:16.796854] Using /dev/log Unix socket with systemd is not possible. Changing to systemd-syslog source, which supports socket activation.; I know one problem is that I'm just not up to speed yet with systemd, but I was hoping that someone could shed some light on this error. Any help at all would be greatly appreciated. Thanks; John V. Tech Support Tech Support VoIP Business Solutions 240-215-3479 x325 <mailto:fsd@voipbusiness.us> support(a)voipbusiness.us

2 2

syslog-ng with http
by westlake 26 Jun '15

26 Jun '15

is it possible to send http-put traffic as a destination with syslog-ng? thanks

3 2

snmp traps from network devices
by Ranganathan Kanagarajan 25 Jun '15

25 Jun '15

Hi All, I have setup a syslog-ng version 3.6.3 in Suse linux. I am able to configure and get the logs from linux servers. I am trying to collect the snmp traps for the follwing logging snmp-trap emergencies logging snmp-trap alerts logging snmp-trap critical logging snmp-trap errors logging snmp-trap warnings logging snmp-trap informational logging host 10.10.10.10 snmp-server enable traps syslog PLease provide me a existing configuration file which will help me. Thanks, Ranga

2 1

CentOS7 syslog-ng 3.5.6: TLS: SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca
by Schulte, Klaus (Nokia - DE/Ulm) 25 Jun '15

25 Jun '15

Dear all, I've this source settings for TLS: source s_tcp_tls { network( transport("tls") ip(10.46.130.65) port(6514) tls( peer-verify("optional-untrusted") key-file("/etc/syslog-ng/key.d/syslog-ng.key") cert-file("/etc/syslog-ng/cert.d/syslog-ng.cert") ) ); }; But when a client connects via TCP/TLS to the syslog-ng service.. In syslog-ng these messages are showing up: syslog-ng starting up; version='3.5.6' Syslog connection accepted; fd='12', client='AF_INET(10.46.160.78:48075)', local='AF_INET(10.46.130.65:6514)' SSL error while reading stream; tls_error='SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca' I/O error occurred while reading; fd='12', error='Connection reset by peer (104)' Syslog connection closed; fd='12', client='AF_INET(10.46.160.78:48075)', local='AF_INET(10.46.130.65:6514)' Closing log transport fd; fd='12' I don't know why syslog-ng is proving the CA? As far as I know the configuration is a non-mutual authentication - so the CA shouldn't play a role in this - is this correct? The client sends messages in RFC5424 format. Any help is appriciated - I've no clue what's going wrong. Best regards Klaus ____________________________________________

2 3

Re: [syslog-ng] Problems trying to compile syslog-ng 3.6.4 on Solaris 11.2 (SPARC)
by Cottington-Bray, Ian 25 Jun '15

25 Jun '15

Any suggestions ?? From: Cottington-Bray, Ian Sent: 23 June 2015 11:28 To: 'syslog-ng(a)lists.balabit.hu' Subject: Problems trying to compile syslog-ng 3.6.4 on Solaris 11.2 (SPARC) Have compiled and installed eventlog-0.2.12 (into /usr/local/syslog-ng). Now trying to compile syslog-ng I'm hitting the error shown at the end. Following commands were used to configure the environment for the compile export PKG_CONFIG_PATH=/usr/local/syslog-ng/lib/pkgconfig ./configure --prefix=/usr/local/syslog-ng --enable-sun-streams --enable-tcp-wrapper --enable-ipv6 --enable-sql --enable-ssh --with-ld-library-path=/usr/local/syslog-ng/lib --disable-amqp --enable-sun-door Any suggestions ? Thanks Ian CC modules/afsocket/modules_afsocket_libafsocket_notls_la-transport-mapper-unix.lo CC modules/afsocket/modules_afsocket_libafsocket_notls_la-transport-unix-socket.lo modules/afsocket/transport-unix-socket.c: In function â_format_proc_file_nameâ: modules/afsocket/transport-unix-socket.c:50:3: warning: format â%dâ expects argument of type âintâ, but argument 4 has type âpid_tâ [-Wformat=] g_snprintf(buf, buflen, "/proc/%d/%s", pid, proc_file); ^ modules/afsocket/transport-unix-socket.c: In function â_unix_socket_readâ: modules/afsocket/transport-unix-socket.c:219:6: error: âstruct msghdrâ has no member named âmsg_controlâ msg.msg_control = ctlbuf; ^ modules/afsocket/transport-unix-socket.c:220:6: error: âstruct msghdrâ has no member named âmsg_controllenâ msg.msg_controllen = sizeof(ctlbuf); ^ modules/afsocket/transport-unix-socket.c: In function âlog_transport_unix_dgram_socket_newâ: modules/afsocket/transport-unix-socket.c:261:3: warning: implicit declaration of function âsocket_set_pass_credentialsâ [-Wimplicit-function-declaration] socket_set_pass_credentials(fd); ^ modules/afsocket/transport-unix-socket.c: At top level: modules/afsocket/transport-unix-socket.c:36:1: warning: â_add_nv_pair_intâ defined but not used [-Wunused-function] _add_nv_pair_int(LogTransportAuxData *aux, const gchar *name, gint value) ^ modules/afsocket/transport-unix-socket.c:102:1: warning: â_add_nv_pair_proc_read_unless_unsetâ defined but not used [-Wunused-function] _add_nv_pair_proc_read_unless_unset(LogTransportAuxData *aux, const gchar *name, pid_t pid, const gchar *proc_file, const gchar *unset_value) ^ modules/afsocket/transport-unix-socket.c:115:1: warning: â_add_nv_pair_proc_read_argvâ defined but not used [-Wunused-function] _add_nv_pair_proc_read_argv(LogTransportAuxData *aux, const gchar *name, pid_t pid, const gchar *proc_file) ^ modules/afsocket/transport-unix-socket.c:135:1: warning: â_add_nv_pair_proc_readlinkâ defined but not used [-Wunused-function] _add_nv_pair_proc_readlink(LogTransportAuxData *aux, const gchar *name, pid_t pid, const gchar *proc_file) ^ gmake[2]: *** [modules/afsocket/modules_afsocket_libafsocket_notls_la-transport-unix-socket.lo] Error 1 gmake[1]: *** [all-recursive] Error 1 gmake: *** [all] Error 2 The contents of this e-mail are confidential and for the exclusive use of the intended recipient. If you are not the intended recipient you should not read, copy, retransmit or disclose its contents. If you have received this email in error please delete it from your system immediately and notify us either by email or telephone. The views expressed in this communication may not necessarily be the views held by McLaren Technology Group Limited. McLaren Technology Group Limited | McLaren Technology Centre | Chertsey Road | Woking | Surrey | GU21 4YH | UK | Company Number: 01967715

1 0

Re: [syslog-ng] I need assistance converting a syslog-ng.conf file from V 1.5.16 to 3.2.4...
by Mason, Tron 25 Jun '15

25 Jun '15

Hello... I'm getting the following errors. Please help. Thanks. bash-3.2# /usr/local/sbin/syslog-ng -v -s -f /usr/local/etc/syslog-ng/syslog-ng.conf WARNING: the match() filter without the use of the value() option is deprecated and hinders performance, please update your configuration; bash-3.2# /usr/local/etc/syslog-ng/syslog-ng.conf -a -f /usr/local/sbin/syslog-ng /usr/local/etc/syslog-ng/syslog-ng.conf: line 10: @version:: command not found /usr/local/etc/syslog-ng/syslog-ng.conf: line 12: syntax error near unexpected token `(' /usr/local/etc/syslog-ng/syslog-ng.conf: line 12: `options { use_dns(yes); ' Tron G Mason

2 1

mark-freq() and mark-mode() understanding
by Sergey Y. Afonin 24 Jun '15

24 Jun '15

Hello. I need an explanation of mark-freq() and mark-mode() works. === a part of syslog-ng.conf === options { ... mark-freq(300); ... } destination mesg { file("/var/log/syslog/messages" mark-mode(periodical)); }; === === a part of /var/log/syslog/messages === Jun 24 08:26:35 -- MARK -- Jun 24 08:30:01 crond[10512]: (root) CMD ( /usr/bin/freshclam --quiet --daemon-notify) Jun 24 08:31:30 -- MARK -- Jun 24 09:01:01 crond[10544]: (root) CMD (run-parts /etc/cron.hourly) Jun 24 09:25:30 syslog-ng[9983]: Log statistics ... === "MARK" label absent between 08:31:30 and 09:01:01 for example. Does it turns out that "idle" is checked for all file() globally ? Can I setup it for one file() ? -- Regards, Sergey.

1 0

3.6.4 in FreeBSD ports and for EPEL6
by Czanik, Péter 23 Jun '15

23 Jun '15

Hi, As promised: - FreeBSD ports now has 3.6.4: http://www.freshports.org/sysutils/syslog-ng/ - my unofficial EPEL6 (RHEL/CentOS/etc.) repo is also updated: https://copr.fedoraproject.org/coprs/czanik/syslog-ng36epel6/ Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

CzP in Boston @ Red Hat Summit
by Czanik, Péter 22 Jun '15

22 Jun '15

Hi, This week I'm in Boston at the Red Hat Summit: https://czanik.blogs.balabit.com/2015/06/red-hat-summit-syslog-ng-docker-co… If you are at the Summit or just in the Boston area and would like to talk to a BalaBit engineer about syslog-ng, contact me by e-mail or twitter (@PCzanik)! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0