- syslog-ng - lists.balabit.hu

Can I use a string as a delimiter on csv-parser
by Thanuje Ashwin Nallaperuma 09 Mar '15

09 Mar '15

Hi everyone, I need to split a macro using a string as a delimiter, Is there any way I can do it ? -Ashwin

2 2

Incompatible Version Warnings
by Dan Mahoney 09 Mar '15

09 Mar '15

Hey there, We have a number of systems that we're trying to deploy syslog-ng on, with puppet, which means we're dealing with multiple versions out there -- so we're trying to stay compatible with 3.4. On a newer version (3.6), we get the following errors on startup: (snip) [2015-03-06T20:47:33.065077] WARNING: Configuration file format is too old, syslog-ng is running in compatibility mode Please update it to use the syslog-ng 3.6 format at your time of convinience, compatibility mode can operate less efficiently in some cases. To upgrade the configuration, please review the warnings about incompatible changes printed by syslog-ng, and once completed change the @version header at the top of the configuration file.; [2015-03-06T20:47:33.096433] WARNING: Starting with syslog-ng 3.6, the system() source performs JSON parsing of messages starting with the '@cim:' prefix. No additional action is needed; [2015-03-06T20:47:33.096495] WARNING: Your configuration uses a newly introduced reserved word as identifier, please use a different name or enclose it in quotes before upgrading; keyword='channel', config-version='3.3', version='3.4', filename='source confgen system', line='1:1' Error parsing source, source plugin channel not found in source confgen system at line 1, column 1: included from /usr/local/etc/syslog-ng.conf line 27, column 9 channel ^^^^^^^ (snip) I've found if I comment out the "system()" source it makes this error go away, but the requisiste lines are exactly what are referenced in the manual: source s_local { system(); internal(); }; I suppose what's most confusing here, is syslog-ng is trying to tell me exactly where it finds the error, in the word "channel" saying "here, change this, this is the bad word I'm tripping over", but I don't find that word anywhere -- nor does it say *which* included file it's tripping over. Maybe it's telling me that's the word it *needs* to find, but that's less clear. I'm not finding anything in the mailing lists for this. Finally, I should probably ask -- since syslog-ng has the ability to tag your config files with a given version, is there a way to say "use this config if you're on 3.4 and this version if you're on 3.6", so I can stay compatible with the various versions I've got deployed. One other little nit: "Convenience" -Dan Mahoney

4 4

syslog-ng for Python regarding
by Nishaanth Gunasekeran 08 Mar '15

08 Mar '15

Hey, This is Nishaanth. I have been searching for a project to work on for SoC. I found syslog-ng for Python interesting. I am familiar with Python and also C. Anyone can help me?

1 0

Interested in syslog-ng's :: command line tool
by Fongoh Martin 07 Mar '15

07 Mar '15

Good day. I wish to make know my interest in working with syslog-ng organisation in this 2015 session of gsoc, under the project "syslog-ng as a command line tool". My name is Fongoh Martin, a 3rd year Bachelor in Computer Engineering, software specialty in the University of Buea, Cameroon. I am a Linux user with great experience and am good with the command line and have an extensive knowlege in shell scripting. I have 4 year experience in C, and 2 years experience in java, with a great idea on object orientation. Currently, I have cloned the source code from git and am going through it to get myself familiar and prepare for bug fixing. I am always ready to learn new technologies and techniques, following instructions and asking questions where not understood. Thanks as i await your reply.

1 0

(no subject)
by Nikhil Ramesh 06 Mar '15

06 Mar '15

1 0

Re: [syslog-ng] Single host logs aren't being written
by Jim Hendrick 06 Mar '15

06 Mar '15

I would look at the macro parsing. Is HOST correctly being parsed, etc. You could create a separate file destination using one macro at a time to narrow it down. Also you could check the syslog-ng logs themselves to look at drops. Jim Sent from my Verizon Wireless 4G LTE smartphone -------- Original message -------- From: Brandon Kendall <brandon.kendall(a)gmail.com> Date: 03/06/2015 11:56 AM (GMT-05:00) To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Single host logs aren't being written Hello everyone. I have a centralized syslog-ng server running that collect syslog messages from Cisco firewalls. The .conf file is very straightforward and contains the following: options {use_fqdn(no);use_dns(yes);dns_cache(yes);dns_cache_size(2000);dns_cache_expire(87600);keep_hostname(no);long_hostnames(no);flush_lines(0);normalize_hostnames(yes);create_dirs(yes);dir_group(group_name);dir_perm(0751);stats_freq(600);stats_level(1);group(group_name);perm(0640);}; source s_network_1 {udp();}; destination d_network_1 {file ("/var/syslog/$R_YEAR-$R_MONTH-$R_DAY/$HOST/$R_YEAR-$R_MONTH-$R_DAY-$HOST-$R_HOUR.log");}; log {source(s_network_1);destination(d_network_1);}; The goal is to have the logs from each device arranged in a hierarchy that is as follows (simplified):Date/device_name/hour-1.logDate/device/name/hour2.logetc This has been working great. Recently I configured another network device to send syslog messages to this server, and they aren't being logged. Using tcpdump on the syslog-ng box, I've verified the messages are making it to the server from the network device. They are UDP and using the correct port. I've compared the message format in the pcap to other devices that are still logging and everything matches. I have no errors in /var/log/syslog files, nor do I have errors in /var/log/messages. I've hit a dead end in troubleshooting, since all other devices sending logs to this server are being correctly written to log files. Can someone point me to anything else to check? This is syslog-ng 3.1.2 running on RHEL 5.8. Thanks!

1 0

GSoC 2015 Language binding project
by Kata Jóna 06 Mar '15

06 Mar '15

Hey, I was looking through the GSoC projects and I really liked the syslog-ng 's language binding project. I wonder if it would be good in C++ language or do you want it in a different language. I would really like to do it, but I only know C and C++ languages. Kacsa

1 0

GSOC : syslog-ng as a command line tool
by Anshul Kushwaha 05 Mar '15

05 Mar '15

Hi, I am a final year undergraduate student of Computer Science from India, I love linux, C and the Open Source community. I coded for The Linux Foundation in GSOC 2013 and would love to code for syslog-ng this year. I've been using linux since school and throughout college. I'm quite experienced with C and love how simple yet incredibly powerful it is. Here are my profiles: LinkedIn: https://www.linkedin.com/in/anshulkushwaha GitHub: http://github.com/anshulk For this summer, I'd like to implement "syslog-ng as a command line tool". I match the requirements well and this project will help me sharpen my skills. It would be great if I can get some pointers to start this. Thank You, Sincerely, Anshul Kushwaha

1 0

GSoC - 2015
by Laszlo Budai 05 Mar '15

05 Mar '15

Dear GSoC aspirants, first of all thank you for answering our GSoC call. Some of you asking how could start with the project. First, you have to choose a project. After that it is highly recommended to contact with the project's mentor. You should get enough information from your mentor to create your proposal. Ask all the questions you need to be answered. After you sent your proposal, you will get a small task. I suggest you to try to be as independent as you can: if you have a concrete idea, want to change something, just tell it to your mentor. (eg.: if you don't know c++ but know python and want to create a gui config editor: it is OK, the target is to have a nice GUI tool and not writing softwares in c++ :-) ) br, Laszlo Budai Sent from my HTC

1 0

GSoC Introduction
by Bence Gedai 05 Mar '15

05 Mar '15

Hi everyone, My name is Bence Tamás Gedai, and I am an undergraduate student at Budapest University of Technology and Economics. I'm interested in the "Configuration visualization" project. I have been coding in C for about a year, but I think I have got the fundamental skills needed for this project. I am familiar with C# and c++ as well. The thing that caught my attention about this project is graph theory, I am really interested in his field and in algorithms related to that. I have alredy worked on a small issue at syslog-ng, so I know the basics of the code. I tried to contact the mentioned mentor, Viktor Tusa via tusa(a)balabit.com, but my mails were sent back. I have got a few questions about the project so can you direct me to the proper place? Thanks in advance, Bence Tamás Gedai

2 1