- syslog-ng - lists.balabit.hu

Parsing more than MSG macro
by Thomas Straubinger 12 Mar '15

12 Mar '15

Hello, is there a way to process more than the $MSG macro with a syslog-ng parse filter? We are forwarding our syslogs via rsyslog in this format (client config): $template tmpl_forward,"%hostname% %syslogtag% \"%msg%\"\n" *.* @@syslog:514;tmpl_forward I have created the following parser rule in syslog-ng: parser p_INTERNAL { csv-parser(columns("INTERNAL.TIME_LOGGED", "INTERNAL.TIME_RECEIVED", "INTERNAL.RELAY_HOST", "INTERNAL.LOGGING_HOST", "INTERNAL.PROGRAM", "INTERNAL.MESSAGE") flags(escape-double-char,strip-whitespace) delimiters(" ") quote-pairs('""[]') ); }; I want to create the logfile in this format: destination d_intern2 { file("/log-local/__OPS__/$YEAR-$MONTH/xxx-${INTERN.LOGGING_HOST}.log" ); }; Unfortunately, syslog-ng does not fill up the $MSG macro with the hole content provided by the client via "%hostname% %syslogtag% \"%msg%\"\n". So it's not possible to fill (parse) the desired 'INTERNAL.LOGGING_HOST' variable. How could i achieve, to, get the content of %hostname% (sent by rsyslog) into the 'INTERNAL.LOGGING_HOST' variable of syslog-ng? Thank you! Thomas

2 2

[GSOC'15 Intro] Python Language Binding
by Akash Gangil 11 Mar '15

11 Mar '15

Hi, I am applying to the "Python Language Binding" project for syslog-ng in this years GSOC' 15. I am going through the incubator code which has basic implementations. I wanted to know what level of detail are you guys expecting in the proposal? Or if there is any specific task you would want to screen applicants? As for myself, I am a second years Masters student at Georgia Tech. And have interfaced with quite a few things that are needed for this project. - I, in a team of 3, led <https://github.com/akashgangil/Tiger/graphs/contributors> the development of a compiler for a toy programming language as a part of the class project. https://github.com/akashgangil/Tiger - As a part of my research work, which deals with designing a data management and analytics system for scientific "big" data, I have also used <https://github.com/akashgangil/khanEVPath/blob/master/src/fileprocessor.cpp…> Python/C Api, to allow writing plugins in python, which can be consumed by the system. https://github.com/akashgangil/khanEVPath <https://github.com/akashgangil/khanEVPath> - I was also a GSOC student in 2009 for Tux4kids and a mentor in 2010 for the same. So I am pretty familiar with the program, - Beside I have extensively used tools like logstash, elasticsearch in the past and appreciate the problems that are associated with log data management and processing. This is also one of the reasons the project interests me. I am still going through the code and trying to get in more details for the proposal. Hoping to get something ready soon. Thanks! -- Akash

2 1

make error in syslog-ng version 3.6.1 with FC20
by Sivadas.M.P 11 Mar '15

11 Mar '15

Hi! I have tried the version syslog-ng-3.4.7-1.fc20.x86_64 and succeeded to log the messages to MySQL DB. Later found from web that there are some bugs which are solved in 3.6.1. When trying out the syslog-ng version 3.6.1 with FC20 (source code) I am getting the following error during make. ------------------------------------------------------------------------------------------------------ In file included from modules/afsql/afsql.c:24:0: modules/afsql/afsql.h:28:21: fatal error: dbi/dbi.h: No such file or directory #include <dbi/dbi.h> ^ compilation terminated. make[2]: *** [modules/afsql/modules_afsql_libafsql_la-afsql.lo] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 ----------------------------------------------------------------------------------------------------- Kindly suggest any remedy for this issue. regards -- SIVADAS.M.P VAL&FS2, C-DOT, Electronics City Phase - I Bangalore - 560100 Karnataka Phone : 080-25119001 Ext: 9143 ===================================================================================== Disclaimer: ---------- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. The sender does not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission.

2 1

GSoC Introduction, syslog-ng as a command line tool
by Bagossy Attila 10 Mar '15

10 Mar '15

Hi, I'd like to introduce myself to the community. I am Attila Bagossy, undergraduate student at the University of Debrecen, Faculty of Informatics. I've been writing programs since I was a child and when I read the letter of Mr László Budai (received through the Neptun system, forwarded by Mr Norbert Bátfai), I couldn't resist to take a chance. I've been coding in C for nearly four years, but I also have experience with OO languages such as C++ or C#. I'm interested in the following project: syslog-ng as a command line tool. I found this project the most interesting and I'm really excited about developing a new tool and making syslog-ng more powerful. Currently, I'm examining the code and getting familiar with it. This is a great opportunity and I want to give my best. Regards, Attila Bagossy University of Debrecen

1 0

Introduction. Interested in Android App to monitor syslog-ng servers for GSoC 2015
by karan grover 10 Mar '15

10 Mar '15

Hello there, I am Karan Grover. I am currently pursuing BTech in Computer Science at IIIT Delhi. I am an android developer, and I wish to contribute to syslog-ng by developing an android app to monitor syslog-ng server. I will be working on a project involving SNMP with my professor in the future, and I plan to use syslog-ng to manage the logs then. I think the android app, would come handy. I want to work on this project, as I want it to be solved for myself too. I will be learning about syslog-ng in the coming week. Except this, I have all the skills desirable for the project. A little bit about me: I have been an android developer at 2 startups - Backpack Labs <https://www.usebackpack.com/> and LEAF Wearables <http://www.leafwearables.com/>. I also keep working on a couple of side projects. A big one is near release. I look forward to start my open source journey by contributing to syslog-ng, and learn how to write beautiful, readable and well documented code. I have already mailed my introduction to Zoltan Pallagi. I am posting here to introduce myself to the community. Thank you.

1 0

syslog-ng server monitoring with mobile app
by Prerit Garg 10 Mar '15

10 Mar '15

Hey, I am Prerit Garg. I would like to take up this project for Gsoc this year. I have a pretty good experience in android application development. I recently developed an android app for an organisation and published it on playstore. Please Help me get started with this project.

2 1

Mutual Authentication and Encryption With Rsyslog
by Michael Starks 09 Mar '15

09 Mar '15

I am trying to get mutual authentication working between a syslog-ng server and an Rsyslog client, using startssl.com issued certificates. The client does properly authenticate the server, but syslog-ng does not recognize the client as trusted. Server info: ------------ # cat /etc/redhat-release CentOS release 6.6 (Final) # /usr/local/syslog-ng/sbin/syslog-ng --version syslog-ng 3.2.4 Installer-Version: 3.2.4 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#ef7b91e4a1b1f9628c66138b4ae83de7e4c697c6 Compile-Date: Aug 18 2013 22:16:35 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: on Enable-Pcre: on Enable-Pacct: off source s_network_secure { tcp(flags(no-multi-line) ip(0.0.0.0) port(6514) tls( key-file("/usr/local/syslog-ng/etc/cert.d/cert.key") cert-file("/usr/local/syslog-ng/etc/cert.d/cert.pem") ca_dir("/usr/local/syslog-ng/etc/cert.d") peer_verify(required-untrusted)) ); }; And of course this is defined in a log statement. Here is the directory. Note that the symbolic link of the hash has been created. # ll /usr/local/syslog-ng/etc/cert.d/ total 204 lrwxrwxrwx. 1 root root 13 Mar 3 13:51 876f1e28.0 -> ca-bundle.pem -rw-r--r--. 1 root root 195587 Mar 3 13:08 ca-bundle.pem -r--------. 1 root root 1679 Feb 28 11:21 cert.key -r--------. 1 root root 2260 Feb 28 11:50 cert.pem -rw-r--r--. 1 root root 2281 Mar 3 13:58 client.key required-untrusted works, but required-trusted doesn't. So I figured maybe it was an SSL issue with the authority, but it seems to validate OK. # openssl verify -CAfile 876f1e28.0 -verbose client.key client.key: OK Client info: ------------ # cat /etc/lsb-release DISTRIB_ID=Ubuntu DISTRIB_RELEASE=14.04 DISTRIB_CODENAME=trusty DISTRIB_DESCRIPTION="Ubuntu 14.04.1 LTS" # rsyslogd -v rsyslogd 7.4.4, compiled with: FEATURE_REGEXP: Yes FEATURE_LARGEFILE: No GSSAPI Kerberos 5 support: Yes FEATURE_DEBUG (debug build, slow code): No 32bit Atomic operations supported: Yes 64bit Atomic operations supported: Yes Runtime Instrumentation (slow code): No uuid support: Yes See http://www.rsyslog.com for more information. I suppose there's no additional client info needed since I know it is presenting the certificate--the issue seems to be that the syslog-ng server simply doesn't trust it. All suggestions appreciated.

3 5

syslog-ng in Google Summer of Code 2015 (GSoC)
by Czanik, Péter 09 Mar '15

09 Mar '15

Hi, As you might have already noticed from the increased traffic: the syslog-ng project is participating again in GSoC! Our page at Google is available at https://www.google-melange.com/gsoc/org2/google/gsoc2015/syslog_ng We have many interesting project ideas to choose from. This years focus is on Java and Python language bindings and making configuration easier using a QT or web based GUI. If you are a student please check our ideas page at https://github.com/balabit/syslog-ng/wiki/GSoC2015-idea-&-project-list which of the projects suits you best. You can also help, if you are already not a student: please follow us on Twitter and re-tweet our GSoC tweets, so students among your followers have a chance to learn about the syslog-ng GSoC possibilities. We are @sngose on twitter: https://twitter.com/sngose Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Use receiving file name / path as a macro on the server
by Thanuje Ashwin Nallaperuma 09 Mar '15

09 Mar '15

Hi all, I have multiple files with the same content on the syslog-ng client These files are stored on different locations with the same file name and same content After receiving I want to store these files with different names on sysog-ng server Is there any way I could use the filepath or filename of the receiving file as a macro or any way to achieve this..?

4 6

Can I use a string as a delimiter on csv-parser
by Thanuje Ashwin Nallaperuma 09 Mar '15

09 Mar '15

Hi everyone, I need to split a macro using a string as a delimiter, Is there any way I can do it ? -Ashwin

2 2