- syslog-ng - lists.balabit.hu

Re: [syslog-ng] Remote tags
by Nikolay P 25 Nov '14

25 Nov '14

Thank you, Sascha for sharing your example of config. That is exactly how I set it up after Fabian's answer. I used .SDATA.meta(a)11111.tags to store my tags and on the server they were seen as a string of comma separated values, so to match particular ones I used filters like this filter f_example { match( "example" value( ".SDATA.meta(a)11111.tags" ) ); } Later I realized that I am trying to invent my own wheel because what I was trying to achieve is to separate logs generated by system programs from the logs generated by userland programs. Now I am filtering them based on facility. But I am still using .SDATA.meta. On every computer I set this rewrite r_is_computer { set( "true" value( ".SDATA.meta(a)11111.is_computer" ) ); }; In this way on server end I can easily distinguish logs generated by computers from logs generated by different network equipment and I do not have to use IP based filtering. Nikolay. ----- Original Message ----- From: "Sascha Lucas" <Sascha.Lucas(a)gisa.de> To: syslog-ng(a)lists.balabit.hu Sent: Tuesday, November 25, 2014 2:34:00 AM GMT -05:00 US/Canada Eastern Subject: Re: [syslog-ng] Remote tags Hi Nikolay, > Could anyone here advice me if it is possible to set a tags() on a log > entry on one machine, send this log message to a remote syslog-ng and > use this tags() in a filter on the remote machine? As Fabien pointed out, it is possible. I'm doing something similar using rfc5424 protocol: The first thing I do is rewriting the log to append local scoped macro data into the sdata structure (here I'm using $SOURCEIP, where you want $tags). When I read rfc5424 I remember, that there are custom data-structures where you can store your tags (I decided to abuse .SDATA.origin.ip for my purpose): rewrite r_sdata { set("$SOURCEIP" value(".SDATA.origin.ip")); }; The second thing is to use the syslog-driver (capable of sending and receiving rfc5424): destination d_logserver { syslog("X.X.X.X" transport("udp")); }; And finely the log line log { source(s_network); source(src); rewrite(r_sdata); destination(d_logserver); }; On the server I have a source capable of rfc5424: source s_network { syslog( transport("udp") flags(validate-utf8) so-rcvbuf(2097152)); }; The transferred Information is directly available on the server in the macro ${.SDATA.origin.ip}. Your tags may be a bit special, because multiple tags would be transferred as a comma separated string. Matching on a single tag would probably mean to rewrite the log again. This time with something like set("${.SDATA.your.structure}. " value("tags"));. HTH, Sascha. Aufsichtsratsvorsitzender: Herbert Vogel Geschäftsführung: Michael Krüger Sitz der Gesellschaft: Halle/Saale Registergericht: Amtsgericht Stendal | Handelsregister-Nr. HRB 208414 UST-ID-Nr. DE 158253683 Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Empfänger sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail oder des Inhalts dieser Mail sind nicht gestattet. Diese Kommunikation per E-Mail ist nicht gegen den Zugriff durch Dritte geschützt. Die GISA GmbH haftet ausdrücklich nicht für den Inhalt und die Vollständigkeit von E-Mails und den gegebenenfalls daraus entstehenden Schaden. Sollte trotz der bestehenden Viren-Schutzprogramme durch diese E-Mail ein Virus in Ihr System gelangen, so haftet die GISA GmbH - soweit gesetzlich zulässig - nicht für die hieraus entstehenden Schäden. ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

Remote tags
by Nikolay P 25 Nov '14

25 Nov '14

Hi, list. Could anyone here advice me if it is possible to set a tags() on a log entry on one machine, send this log message to a remote syslog-ng and use this tags() in a filter on the remote machine? So that on machine 1: source src { internal( tags("computer", "test") ) }; destination rem { udp("example.org" port(514)); }; log { source(src); destination(rem) }; And on machine 2 (example.org) source rem { udp(ip("0.0.0.0") port(514)); }; filter f_tag_test{ tags("test") }; destination test_dest { file("/var/log/test.log"); }; log { source(rem); filter(f_tag_test); destination(test_dest) }; So, should I be able to read tags ("computer" and "test") set by machine 1 on machine 2?

3 2

SQL escaping
by Nikolay P 24 Nov '14

24 Nov '14

Hello. My syslog-ng (version 3.4.8) logs some messages into the PostgreSQL database. I am going to setup a web page which will display those logs. I submitted log entry "alert('123')" surrounded by "script" html tags and displayed content of the database table on a web page. Javascript alerted "123" which means it is a XSS vulnerability. I am not in control of incoming log messages and they can containt anything, so I have no trust to them. Is there anything I can do from the syslog-ng side of things to close this XSS vulnerability or I have to deal with it in my Web application?

2 1

unsubscribe
by Simão Mata 20 Nov '14

20 Nov '14

unsubscribe On 20/11/14 12:00, syslog-ng-request(a)lists.balabit.hu wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. syslog-ng 3.6.1 packages (Czanik) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 19 Nov 2014 15:23:03 +0100 > From: Czanik, P?ter <peter.czanik(a)balabit.com> > Subject: [syslog-ng] syslog-ng 3.6.1 packages > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <CANcUavu8PeuFqC+u81vTc1Agf2=_Cee1+1hYoSjWv0eOR+AJtw(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Hi, > Recently many people asked me in public and private about syslog-ng > 3.6.1 packages. To make my life easier, I put together a blog about > the current situation. It's available at > https://czanik.blogs.balabit.com/2014/11/syslog-ng-ose-3-6-1-packages/ > Bye, > Peter Czanik (CzP) <peter.czanik(a)balabit.com> > BalaBit IT Security / syslog-ng upstream > http://czanik.blogs.balabit.com/ > https://twitter.com/PCzanik > > > ------------------------------ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > End of syslog-ng Digest, Vol 115, Issue 11 > ****************************************** > -- <http://www.wimdu.com>*Wimdu GmbH - * Voltastraße 5, 13355 Berlin, Germany *Managing Directors -* Arne Bleckwenn, Hinrich Dreiling *Commercial Register Number -* 129773 B Berlin <http://www.facebook.com/wimdu> <http://www.twitter.com/wimdu> <http://www.google.com/+wimdu> <http://www.youtube.com/wimtubechannel> <http://www.linkedin.com/company/wimdu-gmbh>

1 0

syslog-ng 3.6.1 packages
by Czanik, Péter 19 Nov '14

19 Nov '14

Hi, Recently many people asked me in public and private about syslog-ng 3.6.1 packages. To make my life easier, I put together a blog about the current situation. It's available at https://czanik.blogs.balabit.com/2014/11/syslog-ng-ose-3-6-1-packages/ Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Re: [syslog-ng] How can I add multi server in my Syslog-ng Configuration?
by Jim Hendrick 18 Nov '14

18 Nov '14

Sorry to ask such a basic question, but are you sure the access point is *sending* logs? Sent from my Verizon Wireless 4G LTE smartphone -------- Original message -------- From: Jason Long <hack3rcon(a)yahoo.com> Date:11/18/2014 6:27 AM (GMT-05:00) To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] How can I add multi server in my Syslog-ng Configuration? Hello all. How are you? I have a windows sever with Syslog agent installed on it and it forward all logs to my Linux box. My Syslog-NG collected it very well but I want to forward my Access point log to syslog-ng too. My Syslog-NG configuration is : # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # options { flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_netsyslog { udp(ip(0.0.0.0) port(514) flags(no-hostname)); tcp(ip(0.0.0.0) port(514) flags(no-hostname)); }; destination d_netsyslog { file("/var/log/network.log" owner("root") group("root") perm(0644)); }; log { source(s_netsyslog); destination(d_netsyslog); }; as you see it collect Syslog from any IP address but why my Syslog-ng can't receive Access point log? Cheers.

2 1

How can I add multi server in my Syslog-ng Configuration?
by Jason Long 18 Nov '14

18 Nov '14

Hello all.How are you?I have a windows sever with Syslog agent installed on it and it forward all logs to my Linux box. My Syslog-NG collected it very well but I want to forward my Access point log to syslog-ng too. My Syslog-NG configuration is : # syslog-ng configuration file.## This should behave pretty much like the original syslog on RedHat. But# it could be configured a lot smarter.## See syslog-ng(8) and syslog-ng.conf(5) for more information.# options { flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes);}; source s_netsyslog { udp(ip(0.0.0.0) port(514) flags(no-hostname)); tcp(ip(0.0.0.0) port(514) flags(no-hostname));}; destination d_netsyslog { file("/var/log/network.log" owner("root") group("root") perm(0644)); }; log { source(s_netsyslog); destination(d_netsyslog); }; as you see it collect Syslog from any IP address but why my Syslog-ng can't receive Access point log? Cheers.

1 0

syslog-ng 3.7.0alpha1 is released
by Czanik, Péter 17 Nov '14

17 Nov '14

Hi, We are proud to announce that syslog-ng 3.7.0alpha1 is released. This is the first alpha release of the syslog-ng OSE 3.7 branch. Changes compared to the latest stable release (3.6.1): Features It is possible to create templates without braces. User defined template-function support added. User can define template functions in her/his configuration the same way she/he would define a template. $(format-cim) template function added into an SCL module. A new choice for inherit-properties implemented that will merge all name-value pairs into the new synthetic message, with the most recent being beferred over older values. Developer notes Added implementation for user-defined template functions. A new API added, user_template_function_register() that allows registering a LogTemplate instance as a template function, dynamically. Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Balazs Scheidler, Fabien Wernli, Gergely Nagy, Laszlo Budai, Peter Czanik, Viktor Juhasz, Viktor Tusa Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

3 2

What is the main reason for forward Windows Logs to Linux Box?
by Jason Long 14 Nov '14

14 Nov '14

Hello Folks.How are you?I have a question and Please accept my apology if it is silly. I forward Windows Log via Snare into my Linux box, But Can I ask why a network admin do it? Why some people don't use Windows Log program? I received all Windows Logs in Linux with Windows Audit and I don't know how can I analysis it easily!!! Cheers.

2 1

Syslog-ng Drops Logs
by Yalin Aksoy 07 Nov '14

07 Nov '14

We have lots of traffic going through syslog-ng in our system (5000 logs per second), so some logs are dropped because of 'log_fifo_size()'. I've look around the web and found flush-lines and flush-timeout methods, but also it failed in every configuration. Related parts of my syslog-ng conf looks like that at the moment. " log_fifo_size(4096); flush_lines(100); flush_timeout(1000); " If I increase fifo size to ~ 16000 ,syslog-ng consumes too much memory for my system to operate. Is there any other way to stop that leak and what is the best practice to use? Thanks in advance. -Yalin

3 3