- syslog-ng - lists.balabit.hu

openSUSE/SLES packages for syslog-ng 3.6.3
by Czanik, Péter 10 Jun '15

10 Jun '15

Hi, syslog-ng 3.6.3 was released yesterday with a long list of bugfixes: https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.6.3 As usual, my unofficial openSUSE/SLES packages follow. This time without openSUSE 13.1 (due to a systemd problem to be fixed by the next release). Packages are available at https://build.opensuse.org/project/show/home:czanik:syslog-ng36 If you have any problems, please let me know! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Re: [syslog-ng] Integrating with snmp traps
by Jim Hendrick 09 Jun '15

09 Jun '15

Couldn't that be done using patterndb? Sent from my Verizon Wireless 4G LTE smartphone -------- Original message -------- From: Fabien Wernli <wernli(a)in2p3.fr> Date: 06/09/2015 10:29 AM (GMT-05:00) To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] Integrating with snmp traps Hi, On Tue, Jun 09, 2015 at 06:26:40AM -0700, Evan Rempel wrote: > When you say you "would actually like to parse all the key-values from > the original payload" what do you mean? > Do you want to process them with syslog-ng filters etc, or are you > feeding this to another type of structured worker thread? I'd like to basically have the structured SNMP message parsed in syslog-ng, in the same way json-parser() parses JSON payload, and makes the key-values available as macros in syslog-ng. ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

2 1

syslog() issue
by westlake 09 Jun '15

09 Jun '15

I'm not sure why i'm getting this error, output: syslog-ng --syntax-only Error parsing afsocket, syntax error, unexpected KW_IP, expecting LL_IDENTIFIER or LL_STRING in /etc/syslog-ng/syslog-ng.conf at line 31, column 9: syslog( ip(1.1.1.1) port(601) transport("tcp") ); mind me i'm new to syslog but i'm following the example from the online manual, not sure why this isn't working thanks

2 2

Solaris & Linux (RH6) Console and SSH Use Logging
by wiskbroom＠hotmail.com 08 Jun '15

08 Jun '15

Greetings; This is question is slightly OT, but I can't imagine a better place to ask; so please, no flames. I would like to begin logging all attempts (succesful, failed, no password given, etc) to login to Sparc/Solaris machines, as well as RedHat 6 Linux boxes. My clients are using stock syslog, but my server is running syslog-NG; my second goal is to redirect all login type logs to just one file for ALL of my Solaris & Linux servers. Does anyone have a known good syslog config file for both Solaris, and Linux? Also, a good syslog-NG entry to force just the console and ssh data into a separate file? Thank you! .vp

2 2

mongodb not found in /etc/syslog-ng/syslog-ng.conf at line 30, column 23:
by Rick Silacci 08 Jun '15

08 Jun '15

Hi, Can you tell what I'm doing wrong here? I entered destination mongodb { mongodb(); }; log { source(src); destination(mongodb); }; in syslogng.conf as in the directions and this is what happens: user@syslog:~/syslogng-web$ sudo service syslog-ng restart * Stopping system logging syslog-ng [ OK ] * Starting system logging syslog-ng Error parsing destination, destination plugin mongodb not found in /etc/syslog-ng/syslog-ng.conf at line 30, column 23: destination mongodb { mongodb() ; }; ^^^^^^^

2 2

Syslog-ng OSE with Juniper SIEM
by Muhammad Asim 08 Jun '15

08 Jun '15

Dear All I would like to know if there has been any integration done among syslog-ng OSE with Juniper Secure Analytics. Regards, Muhammad Asim | Senior Systems Engineer - ME, Pakistan | Juniper Networks, Inc. | (M) +923018510555 (O) +92518435204, +92518445530

3 3

Syslog-ng OSE with IBM Qradar
by Muhammad Asim 08 Jun '15

08 Jun '15

Dear All I would like to know if there has been any integration done among syslog-ng OSE with IBM Qradar?

2 1

odd configuration file
by craig bowser 05 Jun '15

05 Jun '15

Hi, I'm just learning about configuring syslog-ng. I'm using the latest version (info at end of email) and I've run into an error I can't figure out. I made a syntax error in my syslog-ng.conf that caused syslog-ng to fail to start. I corrected the error, but now when I try and start syslog-ng, it still fails. trying to start it with 'service syslog-ng start' or 'service syslog-ng restart' gets me: Job for syslog-ng.service failed. See "systemctl status syslog-ng.service" and "journalctl -xe" for details. But the error is buried in the systemd logs. Using '/usr/sbin/syslog-ng -F' gets me the following error: Error resolving reference; content='source', name='s_name', location='/etc/syslog-ng/syslog-ng.conf:132:7' What is that file? Can I safely delete it? Why can't I make it use the new .conf file? When I try '/usr/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf -F' I get the same error. syslog-ng 3.5.6 Installer-Version: 3.5.6 Revision: 3.5.6-2 [@416d315] (Ubuntu/15.04) Compile-Date: Oct 25 2014 14:14:32 Available-Modules: afuser,afsocket-notls,linux-kmsg-format,afprog,tfgeoip,csvparser,confgen,afamqp,json-plugin,redis,basicfuncs,afsmtp,affile,afsql,afmongodb,cryptofuncs,afsocket-tls,afsocket,syslogformat,afstomp,system-source,dbparser Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: on Enable-Pcre: on Craig L Bowser ____________________________ This email is measured by size. Bits and bytes may have settled during transport.

3 3

Reminder: GSoC students IRC meeting
by Czanik, Péter 02 Jun '15

02 Jun '15

This is a reminder, that we will have the IRC meeting in two days Hi, We organize an IRC meeting, where GSoC students and the broader syslog-ng community can meet. It would be about an hour long event, where students could talk about their projects and ideas with long time syslog-ng users and developers. It will be on the 4th of June, 17:00 CET (Budapest) time. It's 8AM in San Francisco and 20:30 in Delhi, so still day time for most of us. The event will take place on the freenode IRC servers, on channel #syslog-ng. If you don't have an IRC client, you can also use http://webchat.freenode.net/ to participate. I hope, many of you can participate! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

GSoC students IRC meeting
by Czanik, Péter 26 May '15

26 May '15

Hi, We organize an IRC meeting, where GSoC students and the broader syslog-ng community can meet. It would be about an hour long event, where students could talk about their projects and ideas with long time syslog-ng users and developers. It will be on the 4th of June, 17:00 CET (Budapest) time. It's 8AM in San Francisco and 20:30 in Delhi, so still day time for most of us. The event will take place on the freenode IRC servers, on channel #syslog-ng. If you don't have an IRC client, you can also use http://webchat.freenode.net/ to participate. I hope, many of you can participate! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0