- syslog-ng - lists.balabit.hu

Upcoming changes in unofficial packaging
by Gergely Nagy 23 Feb '15

23 Feb '15

Hi! I started packaging syslog-ng 3.6.1 for Debian and Ubuntu, to provide binaries at the usual[0] location. In the process, I intend to simplify and clean up the packaging considerably. This also means dropping support for a few older platforms. [0]: http://asylum.madhouse-project.org/projects/debian/ So beginning with 3.6.1, powerpc is going to be dropped, along with Debian Squeeze, and anything prior to Ubuntu Trusty (14.04) (mind you, I may need to add back Precise (12.04), for Travis CI). Furthermore, for Debian Wheezy, one will likely need to use the Debian backports repository[1] along with mine. [1]: http://backports.debian.org/Instructions/ I expect packages to be ready in a few days. -- |8]

3 4

PatternDB for a10?
by Daniel Neubacher 20 Feb '15

20 Feb '15

Hey there, I've really become a fan of patterndb and I'm migrating almost all of my grok filters to it. My next log devices to migrate are our a10 ax loadbalancer so I wanted to ask if anyone done this work before me :P Daniel -- Daniel Neubacher, Senior Network Engineer daniel.neubacher(a)xing.com<mailto:daniel.neubacher@xing.com> XING AG Dammtorstraße 30, 20354 Hamburg, Germany Tel. +49 40 419131-28, Fax +49 40 419131-11 Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 98807 Exec. Board (Vorstand): Dr. Thomas Vollmoeller (Vorsitzender), Ingo Chu, Jens Pape, Timm Richter Chairman of the Supervisory Board (Aufsichtsratsvorsitzender): Stefan Winners This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorised copying, disclosure or distribution of the material in this e-mail is strictly forbidden and may be unlawful.

2 2

Setting log destination using the MAC address
by Tech Support 16 Feb '15

16 Feb '15

All; I am using syslog-ng to log both the local server and remote clients. Right now I log the clients like so and it works the way it should: destination d_remotehosts { file( "/var/log/HOSTS/$YEAR/$MONTH/$DAY/$HOST/$FACILITY.log" perm( 0644 ) create_dirs( yes ) dir_perm( 0755 ) ); }; However, it is not as helpful when multiple remote clients get recognized as $HOST = 192.168.x.x. Since most remote clients are IP phones, logging using the MAC address instead of the IP address would be much more valuable, but I don't see in the manual where that's possible. Is it possible to log using the MAC address? Any insight at all would be greatly appreciated. Thanks; John Tech Support Tech Support VoIP Business Solutions 240-215-3479 x325 <mailto:fsd@voipbusiness.us> support(a)voipbusiness.us

2 1

Send Apache log to a separate loghost
by Manning, Lee 13 Feb '15

13 Feb '15

In version 1.6.11 of syslog-ng, I need to send Apache logs to a different loghost than the rest of the system logs. Is that possible? If so, how? Our syslog-ng was set up quite some time ago by an admin who is no longer around. I've spent more time than I can afford trying to decipher and attempt to modify his syslog-ng.conf. Assistance from some experts would be greatly appreciated. Thanks, Lee

3 2

syslog-ng at Scale
by Czanik, Péter 10 Feb '15

10 Feb '15

Hi, Two of us from the syslog-ng team will be at Scale this year: http://www.socallinuxexpo.org/scale/13x and I'll also give a presentation about syslog-ng: https://www.socallinuxexpo.org/scale/13x/presentations/syslog-ng-log-collec… To receive a code for a 40% discount at Scale and a free syslog-ng t-shirt at our booth, please register at https://pages.balabit.com/SCALE_discount.html Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

time jumps in logs
by Czanik, Péter 06 Feb '15

06 Feb '15

Hi, I was pointed to a Gentoo syslog-ng bugreport, which shows some interesting time travel: https://bugs.gentoo.org/show_bug.cgi?id=533328 My guess is, that it's something virtualisation related, but even if so, the report says that downgrading to 3.4 solved the problem. Anybody ran into something similar? Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Securing Communications Between syslog-NG Server and syslog Clients
by wiskbroom＠hotmail.com 05 Feb '15

05 Feb '15

Hello; I have several thousand Linux and Solaris clients, some using syslog, some using rsyslog. I intend to use stock syslog client on all of these, this is the easiest approach for my Solaris clients. My server will be syslog-NG, and I was wondering if it is possible, without another app, i.e. stunnel, to secure communications between syslog client and my syslog-NG server; i.e. TLS or SSL? Otherwise, I would have to compile syslog-NG for several platforms, x86, Sparc, three different Linux. My timeframe is quite short. Thank you all!

1 0

syslog-ng 3.6.2 using stomp
by Ole Jørgensen 30 Jan '15

30 Jan '15

Hi, I'm testing the stomp destination using syslog-ng ose 3.6.2, and as the process starts it logs: # /opt/syslog-ng-3.6.2/sbin/syslog-ng -f /opt/syslog-ng-3.6.2/etc/syslog-ng.conf -F -d -v -t 2>&1 | grep -i stomp [2015-01-29T18:29:45.323518] Reading shared object for a candidate module; path='/opt/syslog-ng-3.6.2/lib/syslog-ng', fname='afstomp.so', module='afstomp' [2015-01-29T18:29:45.323629] Registering candidate plugin; module='afstomp', context='destination', name='stomp', preference='0' [2015-01-29T18:29:45.343833] Module loaded and initialized successfully; module='afstomp' [2015-01-29T18:29:45.344725] Compiling d_stomp reference [destination] at [/opt/syslog-ng-3.6.2/etc/syslog-ng.conf:70:2] [2015-01-29T18:29:45.344728] Compiling d_stomp sequence [destination] at [/opt/syslog-ng-3.6.2/etc/syslog-ng.conf:32:1] [2015-01-29T18:29:45.345092] Initializing STOMP destination; host='localhost', port='61613', destination='/topic/syslog' [2015-01-29T18:29:45.345368] Worker thread started; driver='d_stomp#0' [2015-01-29T18:29:45.346854] Stomp connection failed; host='localhost' Relevant parts of my configuration: destination d_stomp { stomp( host("localhost") port(61613) body("testing") ack(yes) retries(9) value-pairs(scope(everything)) ); }; The strange thing is that when I'm starting syslog-ng I am running tcpdump -i lo -s0 -nn -v port 61613, and cannot see any packets. I would expect at least a syn connection since it claims to fail. SELinux does not log any denies during the startup, so I suspect the problem to be elsewhere. If i do a tcpdump -i lo -s0 -nn -v -X and start syslog-ng this is captured: 18:33:26.833330 IP (tos 0x0, ttl 64, id 5652, offset 0, flags [DF], proto TCP (6), length 60) 127.0.0.1.35340 > 127.0.0.1.0: Flags [S], cksum 0xd601 (correct), seq 801587243, win 65495, options [mss 65495,sackOK,TS val 700601919 ecr 0,nop,wscale 7], length 0 0x0000: 4500 003c 1614 4000 4006 26a6 7f00 0001 E..<..@.@.&..... 0x0010: 7f00 0001 8a0c 0000 2fc7 402b 0000 0000 ......../.@+.... 0x0020: a002 ffd7 d601 0000 0204 ffd7 0402 080a ................ 0x0030: 29c2 563f 0000 0000 0103 0307 ).V?........ 18:33:26.833412 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40) 127.0.0.1.0 > 127.0.0.1.35340: Flags [R.], cksum 0xb7ce (correct), seq 0, ack 801587244, win 0, length 0 0x0000: 4500 0028 0000 4000 4006 3cce 7f00 0001 E..(..@.@.<..... 0x0010: 7f00 0001 0000 8a0c 0000 0000 2fc7 402c ............/.@, 0x0020: 5014 0000 b7ce 0000 P....... So we get a syn to port 0 and answer with reset. Could there be a port parsing error for stomp in syslog-ng OSE 3.6.2? Any suggestions? Also: syslog-ng spawns another thread to do the stomp connection, any suggestions on how I can strace this thread during startup to see what is actually going on? Would love to know if in fact this connection is made to port 0. Thanks, Ole

4 4

Change JSON Format
by Daniel Neubacher 29 Jan '15

29 Jan '15

Hey there, right now I'm playing around with different json shippers for log files and I'm a bit lost with syslog-ng. I've read the docs but I still don't know how to change the json Fields syslog-ng sends out. In order to get my new Installation approved I have to keep the old field names in mind, for example syslog sends out HOST_FROM but I need source_host. Right now logstash/mutate does the renaming but I don't like to waste performance there. My destination: destination d_logstash_syslog_syslog_new {tcp("consumer.foo.bar" port(6002) template("$(format-json --scope selected_macros --scope nv_pairs)\n") );}; Thanks in advance Daniel

3 3

t-shirt for code: FOSDEM, devconf.cz, scale
by Czanik, Péter 28 Jan '15

28 Jan '15

Hi, Some of you might have already read my blog at https://czanik.blogs.balabit.com/2015/01/syslog-ng-at-fosdem-t-shirt-for-co… I'll be at FOSDEM ( http://fosdem.org ) this weekend and I'd be happy to meet you there and talk about syslog-ng. And if you also happen to send a pull request related to syslog-ng using one of the language bindings (perl/python/lua/java) or in C, I'm also happy to provide you with a syslog-ng t-shirt! If you have a good idea what to code, but can't make it to FOSDEM: don't worry. I'll be in Brno for devconf.cz next week and at Scale in Los Angeles by the end of February. And in a worst case scenario (I'd really prefer to talk to you in person) we can also post the t-shirt for you. The deadline is the 1st of March! See you at one of the conferences! Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0