- syslog-ng - lists.balabit.hu

CzP in Boston @ Red Hat Summit
by Czanik, Péter 22 Jun '15

22 Jun '15

Hi, This week I'm in Boston at the Red Hat Summit: https://czanik.blogs.balabit.com/2015/06/red-hat-summit-syslog-ng-docker-co… If you are at the Summit or just in the Boston area and would like to talk to a BalaBit engineer about syslog-ng, contact me by e-mail or twitter (@PCzanik)! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

my unofficial 3.6.4 packages for opensuse/sles/fedora/rhel7
by Czanik, Péter 22 Jun '15

22 Jun '15

Hi, Most of my unofficial syslog-ng packages are now ready: openSUSE/SLES: https://build.opensuse.org/project/show/home:czanik:syslog-ng36 Fedora/RHEL7: https://copr.fedoraproject.org/coprs/czanik/syslog-ng36/ RHEL6 and FreeBSD ports will hopefully follow later this week. As I'm off to the Red Hat Summit this week ( https://czanik.blogs.balabit.com/2015/06/red-hat-summit-syslog-ng-docker-co… ) my response time will be slower than usual. Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

insider 2015-06: Red Hat Summit; EU Data Security; GSoC IRC; syslog-ng 3.6.3
by Czanik, Péter 18 Jun '15

18 Jun '15

Dear syslog-ng users, This is the 42th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS syslog-ng @ Red Hat Summit -------------------------- Come to visit the BalaBit booth (#301) at the Red Hat Summit in Boston! We hare happy to discuss the latest trends in log management, new features of syslog-ng, talk about Docker integration and the new BigData destinations. For details, read https://czanik.blogs.balabit.com/2015/06/red-hat-summit-syslog-ng-docker-co… GSoC IRC meeting ---------------- On the 4th of June we had a successful IRC meeting, which involved GSoC students and mentors, syslog-ng developers and users. Based on this experience we plan to have regular IRC meetings in the future. If you have a question you don't need to wait for a dedicated meeting, just join the channel and ask! The syslog-ng IRC channel is available on the freenode network: #syslog-ng on irc.freenode.net You can also use http://webchat.freenode.net/ to join if you don't have a dedicated client. EU Data Security Requirements and log management ------------------------------------------------ As technology changes, data security requirements needs to be adopted to it. After almost 20 years the EU updates its related regulations. Read about the implications for log management: https://jluby.blogs.balabit.com/2015/06/03/data-security-requirements-in-eu… syslog-ng 3.6.3 released ------------------------ A long awaited maintenance release for the 3.6 series was made available last week. It fixes many issues, including some long standing problems reported also for earlier versions. It is recommended to update to this version. A list of fixes is available at https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.6.3 NEW RELEASES syslog-ng 3.6.3: https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.6.3 Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com To read this newsletter on-line, visit: http://insider.blogs.balabit.com/ Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

errors compiling 3.7.0-beta 1 on rhe6.4
by Russell Fulton 18 Jun '15

18 Jun '15

compiling on RHE 6.4, ./configure make .. . . . CC lib/template/lib_libsyslog_ng_la-templates.lo In file included from ./lib/template/repr.h:28, from lib/template/templates.c:25: ./lib/template/function.h:31: error: redefinition of typedef 'LogTemplateOptions' ./lib/template/common-template-typedefs.h:27: note: previous declaration of 'LogTemplateOptions' was here ./lib/template/function.h:32: error: redefinition of typedef 'LogTemplate' ./lib/template/templates.h:70: note: previous declaration of 'LogTemplate' was here In file included from lib/template/templates.c:26: ./lib/template/compiler.h:30: error: redefinition of typedef 'LogTemplate' ./lib/template/function.h:32: note: previous declaration of 'LogTemplate' was here make[2]: *** [lib/template/lib_libsyslog_ng_la-templates.lo] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2

3 3

syslogng-web
by Rick Silacci 17 Jun '15

17 Jun '15

I have a 450 G database. It looks like syslogng-web only has the most recent 40 pages available. How do you access the older data through syslogng-web? Rick Silacci Velociter Wireless 1525 Second Street Escalon, CA 95320 Phone: 209.838.1221

2 1

substr function issues
by westlake 17 Jun '15

17 Jun '15

I'm stumped on a little problem with syslog-ng, basically what I'm trying to do is extract text from a string and place that into a new macro, eg -> set($(substr ${MSG} 7 12), value("${MACRO"); here the syntax checker stops short around the first dollar sign and i'm not sure how else I can apply this. thanks

2 4

TOS value updating from afinet_setup_socket
by Dilip Basavaraju 12 Jun '15

12 Jun '15

Dear All, I am facing issue in updating TOS value using setsockopt in the function afinet_setup_socket. //syslog_ng_dscp_val = 40; setsockopt(fd, SOL_IP, IP_TOS, &syslog_ng_dscp_val, sizeof(syslog_ng_dscp_val)); below is the function definition. I am not getting any print messages. I think this function is not being called. Please suggest me how to update the TOS value. I am waiting for your responses please. static gboolean afinet_setup_socket(gint fd, GSockAddr *addr, InetSocketOptions *sock_options, AFSocketDirection dir) { gint off = 0; if (!afsocket_setup_socket(fd, &sock_options->super, dir)) return FALSE; switch (addr->sa.sa_family) { case AF_INET: { struct ip_mreq mreq; if (dir & AFSOCKET_DIR_RECV) { memset(&mreq, 0, sizeof(mreq)); setsockopt(fd, SOL_IP, IP_ADD_MEMBERSHIP, &mreq, sizeof(mreq)); if (dir & AFSOCKET_DIR_SEND) setsockopt(fd, SOL_IP, IP_MULTICAST_TTL, &sock_options->ttl, sizeof(sock_options->ttl)); } else { if (sock_options->ttl && (dir & AFSOCKET_DIR_SEND)) setsockopt(fd, SOL_IP, IP_TTL, &sock_options->ttl, sizeof(sock_options->ttl)); } #if CONFIG_CP_DSCP //setsockopt(fd, SOL_IP, IP_TOS, &syslog_ng_dscp_val, sizeof(syslog_ng_dscp_val)); int tmpSouravVal = 40; //dilipu setsockopt(fd, SOL_IP, IP_TOS, &tmpSouravVal, sizeof(syslog_ng_dscp_val)); #if (CONFIG_CP_IPV6 && CONFIG_CP_DSCP) setsockopt(fd, IPPROTO_IPV6, IPV6_TCLASS, &syslog_ng_dscp_val, sizeof(syslog_ng_dscp_val)); #endif #else if (sock_options->tos && (dir & AFSOCKET_DIR_SEND)) setsockopt(fd, SOL_IP, IP_TOS, &sock_options->tos, sizeof(sock_options->tos)); #endif break; } } return TRUE; } Thanks and regards Dilip Kumar B [https://relayq.larsentoubro.com/DigitalSignature2015.jpg] L&T Technology Services Ltd www.LntTechservices.com<http://www.lnttechservices.com/> This Email may contain confidential or privileged information for the intended recipient (s). If you are not the intended recipient, please do not use or disseminate the information, notify the sender and delete it from your system.

2 3

Integrating with snmp traps
by Fabien Wernli 11 Jun '15

11 Jun '15

Hi, Does anybody on this fine list handle SNMP traps using syslog-ng? We used to just forward logs using syslog and snmptrapd as suggested on an old blog post from Baszi. The problem with this approach is that the messages are flat. We would actually like to parse all the key-values from the original payload, anyone done that before? Thanks!

2 6

organizing logs over network
by westlake 11 Jun '15

11 Jun '15

if i use source-> system(facility(local0)); and use an application that sends to local0, what's the most effective way of categorizing this into a special log file if the destination is over network? I'm using two dns machines and they both send output to one logging machine. So far I'm using the host() directive with filter{} and two log{} entries on the recipient, this way I can create a log depending on the ip. Is there a better way to organize the logs instead of using host() with filter{} ? thanks

2 1

Fedora packages for syslog-ng 3.6.3
by Czanik, Péter 10 Jun '15

10 Jun '15

Hi, syslog-ng 3.6.3 was released yesterday with a long list of bugfixes: https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.6.3 As usual, my unofficial Fedora packages follow. This time without Fedora 20 and EPEL7 (due to a systemd problem to be fixed by the next release). Packages are available at https://copr.fedoraproject.org/coprs/czanik/syslog-ng36/ Fedora 22 syslog-ng packages is added, but no incubator yet (one of the dependencies fails to compile). If you have any problems, please let me know! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0