- syslog-ng - lists.balabit.hu

Create a Log file for Each server.
by Jason Long 10 Dec '14

10 Dec '14

Hello all. How are you? I have a windows sever with Syslog agent installed on it and it forward all logs to my Linux box. My Syslog-NG collected it very well but I want to Forward another Windows Events into my Syslog server but How can I modify my current config file for create another file for this new server? I use Logstash and Kibana on my Linux Box, Can it detect my new Log file automatically? # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # options { flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_netsyslog { udp(ip(0.0.0.0) port(514) flags(no-hostname)); tcp(ip(0.0.0.0) port(514) flags(no-hostname)); }; destination d_netsyslog { file("/var/log/network.log" owner("root") group("root") perm(0644)); }; log { source(s_netsyslog); destination(d_netsyslog); }; as you see it collect Syslog from any IP address. Cheers.

2 3

Re: [syslog-ng] [syslog-ng 3.6.1] booting with openrc, but syslog-ng thinks i boot with sytemd
by Balazs Scheidler 08 Dec '14

08 Dec '14

Hi Lone_Wolf, Could you pls give the patch a try? Should fix your issue. Thanks. On Thu, Dec 4, 2014 at 12:43 PM, Juhász, Viktor <viktor.juhasz(a)balabit.com> wrote: > Hi, > > There is a pull request on to 3.6/master: > > https://github.com/balabit/syslog-ng/pull/327 > > I created it on morning, but it is not listed in the pull requests list > > Viktor > > > On Thu, Dec 4, 2014 at 12:27 PM, Balazs Scheidler <bazsi77(a)gmail.com> > wrote: > >> Hi, >> >> Viktor could you pls share the fix for this? I know I promised to port >> it, but got distracted. >> >> Thanks. >> On Dec 4, 2014 11:36 AM, "LoneVVolf" <lonewolf(a)xs4all.nl> wrote: >> >>> On 04-12-14 09:58, Tibor Benke wrote: >>> >>> I think you've found a bug in service-management.c: >>> >>> >>> https://github.com/balabit/syslog-ng/blob/master/lib/service-management.c#L… >>> >>> If you have syslog-ng compiled with --enable-systemd, it will always >>> be the active service-management unit. I thought we addressed this in a >>> patch by jviktor. >>> >>> Tibor, >>> >>> Is that code run during compiling/building or at run-time ? >>> Archlinux developers build packages on machines with an archlinux base >>> installation with systemd installed & active . >>> If service-management.c is executed at build-time, that would explain >>> why syslog-ng tries to use systemd on my system. >>> >>> Given the multi-platform support of syslog-ng i would expect such checks >>> to be executed at run-time . >>> >>> >>> >>> >>> 2014-12-04 0:04 GMT+01:00 Balazs Scheidler <bazsi77(a)gmail.com>: >>> >>>> Also, you might want to use the system() source, which tries to >>>> determine the optimal setup to fetch local messages. So no need to use I >>>> unix-dgram or internal directly. >>>> >>> Balazs, thanks for the tip. After the problem is fixed, i'll look >>> into using that. >>> >>> >>> ______________________________________________________________________________ >>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>> Documentation: >>> http://www.balabit.com/support/documentation/?product=syslog-ng >>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>> >>> >>> > -- Bazsi

3 2

Sorry, it is just a test
by Juhász, Viktor 05 Dec '14

05 Dec '14

Test

1 0

[syslog-ng 3.6.1] booting with openrc, but syslog-ng thinks i boot with sytemd
by LoneVVolf 04 Dec '14

04 Dec '14

Hi, First i'd like to say i have been using syslog-ng for years and am very pleased with it. Thank you for a reliable and stable product. I'm running archlinux x86_64 and boot with openrc 0.13.5 . I do have systemd installed so i can use udev functionality. Today I updated from syslog-ng 3.5.6 to 3.6.1 and found this in rc.log : [2014-12-03T13:27:21.835298] Using /dev/log Unix socket with systemd is not possible. Changing to systemd-syslog source, which supports socket activation.; * Starting syslog-ng ... [2014-12-03T13:27:21.890729] Using /dev/log Unix socket with systemd is not possible. Changing to systemd-syslog source, which supports socket activation.; [2014-12-03T13:27:21.902289] Failed to acquire /run/systemd/journal/syslog socket, disabling systemd-syslog source; [ ok ] This is the source part of my /etc/syslog-ng/syslog-ng.conf source src { unix-dgram("/dev/log"); internal(); file("/proc/kmsg"); }; I use the official archlinux syslog-ng package, https://www.archlinux.org/packages/extra/x86_64/syslog-ng/ . It uses these build flags : | ./configure--prefix=/usr--sysconfdir=/etc/syslog-ng--libexecdir=/usr/lib \ --sbindir=/usr/bin--localstatedir=/var/lib/syslog-ng--datadir=/usr/share/syslog-ng \ --with-pidfile-dir=/run--disable-spoof-source--enable-ipv6--enable-sql \ --enable-systemd--with-systemdsystemunitdir=/usr/lib/systemd/system| syslog-ng does appear to work normally, but i'd like to get rid of the incorrect error message. Lone_Wolf (full rc.log & syslog-ng.conf attached)

3 6

How can I have Persian and Arabic names in Syslog?
by Jason Long 26 Nov '14

26 Nov '14

Hello Folks.How are you?I installed a Syslog agent on Windows server and some of directories on Windows server are Persian. In Linux box I installed Logstash,Syslog-ng and Kibana but when my Linux receive Logs from Windows server the name shown as "????". How can I solve it? Cheers.

1 0

Re: [syslog-ng] Remote tags
by Nikolay P 25 Nov '14

25 Nov '14

Thank you, Sascha for sharing your example of config. That is exactly how I set it up after Fabian's answer. I used .SDATA.meta(a)11111.tags to store my tags and on the server they were seen as a string of comma separated values, so to match particular ones I used filters like this filter f_example { match( "example" value( ".SDATA.meta(a)11111.tags" ) ); } Later I realized that I am trying to invent my own wheel because what I was trying to achieve is to separate logs generated by system programs from the logs generated by userland programs. Now I am filtering them based on facility. But I am still using .SDATA.meta. On every computer I set this rewrite r_is_computer { set( "true" value( ".SDATA.meta(a)11111.is_computer" ) ); }; In this way on server end I can easily distinguish logs generated by computers from logs generated by different network equipment and I do not have to use IP based filtering. Nikolay. ----- Original Message ----- From: "Sascha Lucas" <Sascha.Lucas(a)gisa.de> To: syslog-ng(a)lists.balabit.hu Sent: Tuesday, November 25, 2014 2:34:00 AM GMT -05:00 US/Canada Eastern Subject: Re: [syslog-ng] Remote tags Hi Nikolay, > Could anyone here advice me if it is possible to set a tags() on a log > entry on one machine, send this log message to a remote syslog-ng and > use this tags() in a filter on the remote machine? As Fabien pointed out, it is possible. I'm doing something similar using rfc5424 protocol: The first thing I do is rewriting the log to append local scoped macro data into the sdata structure (here I'm using $SOURCEIP, where you want $tags). When I read rfc5424 I remember, that there are custom data-structures where you can store your tags (I decided to abuse .SDATA.origin.ip for my purpose): rewrite r_sdata { set("$SOURCEIP" value(".SDATA.origin.ip")); }; The second thing is to use the syslog-driver (capable of sending and receiving rfc5424): destination d_logserver { syslog("X.X.X.X" transport("udp")); }; And finely the log line log { source(s_network); source(src); rewrite(r_sdata); destination(d_logserver); }; On the server I have a source capable of rfc5424: source s_network { syslog( transport("udp") flags(validate-utf8) so-rcvbuf(2097152)); }; The transferred Information is directly available on the server in the macro ${.SDATA.origin.ip}. Your tags may be a bit special, because multiple tags would be transferred as a comma separated string. Matching on a single tag would probably mean to rewrite the log again. This time with something like set("${.SDATA.your.structure}. " value("tags"));. HTH, Sascha. Aufsichtsratsvorsitzender: Herbert Vogel Geschäftsführung: Michael Krüger Sitz der Gesellschaft: Halle/Saale Registergericht: Amtsgericht Stendal | Handelsregister-Nr. HRB 208414 UST-ID-Nr. DE 158253683 Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Empfänger sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail oder des Inhalts dieser Mail sind nicht gestattet. Diese Kommunikation per E-Mail ist nicht gegen den Zugriff durch Dritte geschützt. Die GISA GmbH haftet ausdrücklich nicht für den Inhalt und die Vollständigkeit von E-Mails und den gegebenenfalls daraus entstehenden Schaden. Sollte trotz der bestehenden Viren-Schutzprogramme durch diese E-Mail ein Virus in Ihr System gelangen, so haftet die GISA GmbH - soweit gesetzlich zulässig - nicht für die hieraus entstehenden Schäden. ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

Remote tags
by Nikolay P 25 Nov '14

25 Nov '14

Hi, list. Could anyone here advice me if it is possible to set a tags() on a log entry on one machine, send this log message to a remote syslog-ng and use this tags() in a filter on the remote machine? So that on machine 1: source src { internal( tags("computer", "test") ) }; destination rem { udp("example.org" port(514)); }; log { source(src); destination(rem) }; And on machine 2 (example.org) source rem { udp(ip("0.0.0.0") port(514)); }; filter f_tag_test{ tags("test") }; destination test_dest { file("/var/log/test.log"); }; log { source(rem); filter(f_tag_test); destination(test_dest) }; So, should I be able to read tags ("computer" and "test") set by machine 1 on machine 2?

3 2

SQL escaping
by Nikolay P 24 Nov '14

24 Nov '14

Hello. My syslog-ng (version 3.4.8) logs some messages into the PostgreSQL database. I am going to setup a web page which will display those logs. I submitted log entry "alert('123')" surrounded by "script" html tags and displayed content of the database table on a web page. Javascript alerted "123" which means it is a XSS vulnerability. I am not in control of incoming log messages and they can containt anything, so I have no trust to them. Is there anything I can do from the syslog-ng side of things to close this XSS vulnerability or I have to deal with it in my Web application?

2 1

unsubscribe
by Simão Mata 20 Nov '14

20 Nov '14

unsubscribe On 20/11/14 12:00, syslog-ng-request(a)lists.balabit.hu wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. syslog-ng 3.6.1 packages (Czanik) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 19 Nov 2014 15:23:03 +0100 > From: Czanik, P?ter <peter.czanik(a)balabit.com> > Subject: [syslog-ng] syslog-ng 3.6.1 packages > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <CANcUavu8PeuFqC+u81vTc1Agf2=_Cee1+1hYoSjWv0eOR+AJtw(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Hi, > Recently many people asked me in public and private about syslog-ng > 3.6.1 packages. To make my life easier, I put together a blog about > the current situation. It's available at > https://czanik.blogs.balabit.com/2014/11/syslog-ng-ose-3-6-1-packages/ > Bye, > Peter Czanik (CzP) <peter.czanik(a)balabit.com> > BalaBit IT Security / syslog-ng upstream > http://czanik.blogs.balabit.com/ > https://twitter.com/PCzanik > > > ------------------------------ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > End of syslog-ng Digest, Vol 115, Issue 11 > ****************************************** > -- <http://www.wimdu.com>*Wimdu GmbH - * Voltastraße 5, 13355 Berlin, Germany *Managing Directors -* Arne Bleckwenn, Hinrich Dreiling *Commercial Register Number -* 129773 B Berlin <http://www.facebook.com/wimdu> <http://www.twitter.com/wimdu> <http://www.google.com/+wimdu> <http://www.youtube.com/wimtubechannel> <http://www.linkedin.com/company/wimdu-gmbh>

1 0

syslog-ng 3.6.1 packages
by Czanik, Péter 19 Nov '14

19 Nov '14

Hi, Recently many people asked me in public and private about syslog-ng 3.6.1 packages. To make my life easier, I put together a blog about the current situation. It's available at https://czanik.blogs.balabit.com/2014/11/syslog-ng-ose-3-6-1-packages/ Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0