- syslog-ng - lists.balabit.hu

syslog-ng server monitoring with mobile app
by Prerit Garg 10 Mar '15

10 Mar '15

Hey, I am Prerit Garg. I would like to take up this project for Gsoc this year. I have a pretty good experience in android application development. I recently developed an android app for an organisation and published it on playstore. Please Help me get started with this project.

2 1

Mutual Authentication and Encryption With Rsyslog
by Michael Starks 09 Mar '15

09 Mar '15

I am trying to get mutual authentication working between a syslog-ng server and an Rsyslog client, using startssl.com issued certificates. The client does properly authenticate the server, but syslog-ng does not recognize the client as trusted. Server info: ------------ # cat /etc/redhat-release CentOS release 6.6 (Final) # /usr/local/syslog-ng/sbin/syslog-ng --version syslog-ng 3.2.4 Installer-Version: 3.2.4 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#ef7b91e4a1b1f9628c66138b4ae83de7e4c697c6 Compile-Date: Aug 18 2013 22:16:35 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: on Enable-Pcre: on Enable-Pacct: off source s_network_secure { tcp(flags(no-multi-line) ip(0.0.0.0) port(6514) tls( key-file("/usr/local/syslog-ng/etc/cert.d/cert.key") cert-file("/usr/local/syslog-ng/etc/cert.d/cert.pem") ca_dir("/usr/local/syslog-ng/etc/cert.d") peer_verify(required-untrusted)) ); }; And of course this is defined in a log statement. Here is the directory. Note that the symbolic link of the hash has been created. # ll /usr/local/syslog-ng/etc/cert.d/ total 204 lrwxrwxrwx. 1 root root 13 Mar 3 13:51 876f1e28.0 -> ca-bundle.pem -rw-r--r--. 1 root root 195587 Mar 3 13:08 ca-bundle.pem -r--------. 1 root root 1679 Feb 28 11:21 cert.key -r--------. 1 root root 2260 Feb 28 11:50 cert.pem -rw-r--r--. 1 root root 2281 Mar 3 13:58 client.key required-untrusted works, but required-trusted doesn't. So I figured maybe it was an SSL issue with the authority, but it seems to validate OK. # openssl verify -CAfile 876f1e28.0 -verbose client.key client.key: OK Client info: ------------ # cat /etc/lsb-release DISTRIB_ID=Ubuntu DISTRIB_RELEASE=14.04 DISTRIB_CODENAME=trusty DISTRIB_DESCRIPTION="Ubuntu 14.04.1 LTS" # rsyslogd -v rsyslogd 7.4.4, compiled with: FEATURE_REGEXP: Yes FEATURE_LARGEFILE: No GSSAPI Kerberos 5 support: Yes FEATURE_DEBUG (debug build, slow code): No 32bit Atomic operations supported: Yes 64bit Atomic operations supported: Yes Runtime Instrumentation (slow code): No uuid support: Yes See http://www.rsyslog.com for more information. I suppose there's no additional client info needed since I know it is presenting the certificate--the issue seems to be that the syslog-ng server simply doesn't trust it. All suggestions appreciated.

3 5

syslog-ng in Google Summer of Code 2015 (GSoC)
by Czanik, Péter 09 Mar '15

09 Mar '15

Hi, As you might have already noticed from the increased traffic: the syslog-ng project is participating again in GSoC! Our page at Google is available at https://www.google-melange.com/gsoc/org2/google/gsoc2015/syslog_ng We have many interesting project ideas to choose from. This years focus is on Java and Python language bindings and making configuration easier using a QT or web based GUI. If you are a student please check our ideas page at https://github.com/balabit/syslog-ng/wiki/GSoC2015-idea-&-project-list which of the projects suits you best. You can also help, if you are already not a student: please follow us on Twitter and re-tweet our GSoC tweets, so students among your followers have a chance to learn about the syslog-ng GSoC possibilities. We are @sngose on twitter: https://twitter.com/sngose Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Use receiving file name / path as a macro on the server
by Thanuje Ashwin Nallaperuma 09 Mar '15

09 Mar '15

Hi all, I have multiple files with the same content on the syslog-ng client These files are stored on different locations with the same file name and same content After receiving I want to store these files with different names on sysog-ng server Is there any way I could use the filepath or filename of the receiving file as a macro or any way to achieve this..?

4 6

Can I use a string as a delimiter on csv-parser
by Thanuje Ashwin Nallaperuma 09 Mar '15

09 Mar '15

Hi everyone, I need to split a macro using a string as a delimiter, Is there any way I can do it ? -Ashwin

2 2

Incompatible Version Warnings
by Dan Mahoney 09 Mar '15

09 Mar '15

Hey there, We have a number of systems that we're trying to deploy syslog-ng on, with puppet, which means we're dealing with multiple versions out there -- so we're trying to stay compatible with 3.4. On a newer version (3.6), we get the following errors on startup: (snip) [2015-03-06T20:47:33.065077] WARNING: Configuration file format is too old, syslog-ng is running in compatibility mode Please update it to use the syslog-ng 3.6 format at your time of convinience, compatibility mode can operate less efficiently in some cases. To upgrade the configuration, please review the warnings about incompatible changes printed by syslog-ng, and once completed change the @version header at the top of the configuration file.; [2015-03-06T20:47:33.096433] WARNING: Starting with syslog-ng 3.6, the system() source performs JSON parsing of messages starting with the '@cim:' prefix. No additional action is needed; [2015-03-06T20:47:33.096495] WARNING: Your configuration uses a newly introduced reserved word as identifier, please use a different name or enclose it in quotes before upgrading; keyword='channel', config-version='3.3', version='3.4', filename='source confgen system', line='1:1' Error parsing source, source plugin channel not found in source confgen system at line 1, column 1: included from /usr/local/etc/syslog-ng.conf line 27, column 9 channel ^^^^^^^ (snip) I've found if I comment out the "system()" source it makes this error go away, but the requisiste lines are exactly what are referenced in the manual: source s_local { system(); internal(); }; I suppose what's most confusing here, is syslog-ng is trying to tell me exactly where it finds the error, in the word "channel" saying "here, change this, this is the bad word I'm tripping over", but I don't find that word anywhere -- nor does it say *which* included file it's tripping over. Maybe it's telling me that's the word it *needs* to find, but that's less clear. I'm not finding anything in the mailing lists for this. Finally, I should probably ask -- since syslog-ng has the ability to tag your config files with a given version, is there a way to say "use this config if you're on 3.4 and this version if you're on 3.6", so I can stay compatible with the various versions I've got deployed. One other little nit: "Convenience" -Dan Mahoney

4 4

syslog-ng for Python regarding
by Nishaanth Gunasekeran 08 Mar '15

08 Mar '15

Hey, This is Nishaanth. I have been searching for a project to work on for SoC. I found syslog-ng for Python interesting. I am familiar with Python and also C. Anyone can help me?

1 0

Interested in syslog-ng's :: command line tool
by Fongoh Martin 07 Mar '15

07 Mar '15

Good day. I wish to make know my interest in working with syslog-ng organisation in this 2015 session of gsoc, under the project "syslog-ng as a command line tool". My name is Fongoh Martin, a 3rd year Bachelor in Computer Engineering, software specialty in the University of Buea, Cameroon. I am a Linux user with great experience and am good with the command line and have an extensive knowlege in shell scripting. I have 4 year experience in C, and 2 years experience in java, with a great idea on object orientation. Currently, I have cloned the source code from git and am going through it to get myself familiar and prepare for bug fixing. I am always ready to learn new technologies and techniques, following instructions and asking questions where not understood. Thanks as i await your reply.

1 0

(no subject)
by Nikhil Ramesh 06 Mar '15

06 Mar '15

1 0

Re: [syslog-ng] Single host logs aren't being written
by Jim Hendrick 06 Mar '15

06 Mar '15

I would look at the macro parsing. Is HOST correctly being parsed, etc. You could create a separate file destination using one macro at a time to narrow it down. Also you could check the syslog-ng logs themselves to look at drops. Jim Sent from my Verizon Wireless 4G LTE smartphone -------- Original message -------- From: Brandon Kendall <brandon.kendall(a)gmail.com> Date: 03/06/2015 11:56 AM (GMT-05:00) To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Single host logs aren't being written Hello everyone. I have a centralized syslog-ng server running that collect syslog messages from Cisco firewalls. The .conf file is very straightforward and contains the following: options {use_fqdn(no);use_dns(yes);dns_cache(yes);dns_cache_size(2000);dns_cache_expire(87600);keep_hostname(no);long_hostnames(no);flush_lines(0);normalize_hostnames(yes);create_dirs(yes);dir_group(group_name);dir_perm(0751);stats_freq(600);stats_level(1);group(group_name);perm(0640);}; source s_network_1 {udp();}; destination d_network_1 {file ("/var/syslog/$R_YEAR-$R_MONTH-$R_DAY/$HOST/$R_YEAR-$R_MONTH-$R_DAY-$HOST-$R_HOUR.log");}; log {source(s_network_1);destination(d_network_1);}; The goal is to have the logs from each device arranged in a hierarchy that is as follows (simplified):Date/device_name/hour-1.logDate/device/name/hour2.logetc This has been working great. Recently I configured another network device to send syslog messages to this server, and they aren't being logged. Using tcpdump on the syslog-ng box, I've verified the messages are making it to the server from the network device. They are UDP and using the correct port. I've compared the message format in the pcap to other devices that are still logging and everything matches. I have no errors in /var/log/syslog files, nor do I have errors in /var/log/messages. I've hit a dead end in troubleshooting, since all other devices sending logs to this server are being correctly written to log files. Can someone point me to anything else to check? This is syslog-ng 3.1.2 running on RHEL 5.8. Thanks!

1 0