- syslog-ng - lists.balabit.hu

Re: [syslog-ng] Local sources seem not to be working
by Szilard Parrag (sparrag) 16 May '22

16 May '22

Hi Alex, After checking the stats, you have sent we can see that there had been some writes: from dst.program;d_localfile_linecard#0;/opt/machine/local/bin/write_with_rotation.sh /var/log/linecard.log 10 10;a;written;4518 to dst.program;d_localfile_linecard#0;/opt/machine/local/bin/write_with_rotation.sh /var/log/linecard.log 10 10;a;written;4549 * we do not see increase in the counters of /var/log destinatons, but only on one destination * we could only see an increase in syslog-udp processed counters * there are no dropped/queued counters We would guess this could be due to flow-control, but for that we would need to see non-zero queued counter values, which is not the case. It could happen that one destination hangs/can't send messages out, which leads to suspended sources due to flow-control, but the syslog() source is not affected since it doesn't send messages to the hanged destination(s). Based on the stats, only "d_localfile_linecard" is active (~30 messages in 15 minutes), maybe the syslog() source would be affected too without the filtering. We should see more internal logs, which is problematic, since internal() source seems to be stopped too. For that I would recommend extracting internal() source from the s_src statement and putting it in a separate log path with a simple file destination. Also, if possible, could you please share your `write_with_rotation.sh` script? It is unlikely that it interferes with syslog-ng, but a double check would be nice. 🙂

2 2

Not logging postfix logs in mail.info mail.warn
by SysAdmin EM 16 May '22

16 May '22

I cannot configure Postfix logs correctly, the mail.warn and mail.info logs are empty. Any helps?? Here is my configuration: options { chain_hostnames(off); flush_lines(0); use_dns(no); use_fqdn(no); owner("root"); group("adm"); perm(0640); stats_freq(0); bad_hostname("^gconfd$"); }; source s_src { system(); internal(); }; destination d_auth { file("/var/log/auth.log"); }; destination d_cron { file("/var/log/cron.log"); }; destination d_daemon { file("/var/log/daemon.log"); }; destination d_kern { file("/var/log/kern.log"); }; destination d_lpr { file("/var/log/lpr.log"); }; destination d_mail { file("/var/log/mail.log"); }; destination d_syslog { file("/var/log/syslog"); }; destination d_user { file("/var/log/user.log"); }; destination d_uucp { file("/var/log/uucp.log"); }; destination d_mailinfo { file("/var/log/mail.info"); }; destination d_mailwarn { file("/var/log/mail.warn"); }; destination d_mailerr { file("/var/log/mail.err"); }; destination d_newscrit { file("/var/log/news/news.crit"); }; destination d_newserr { file("/var/log/news/news.err"); }; destination d_newsnotice { file("/var/log/news/news.notice"); }; destination d_debug { file("/var/log/debug"); }; destination d_error { file("/var/log/error"); }; destination d_messages { file("/var/log/messages"); }; destination d_console { usertty("root"); }; destination d_console_all { file(`tty10`); }; destination d_xconsole { pipe("/dev/xconsole"); }; log_fifo_size(1000)); }; destination d_ppp { file("/var/log/ppp.log"); }; filter f_dbg { level(debug); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_err { level(err); }; filter f_crit { level(crit .. emerg); }; filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); }; filter f_error { level(err .. emerg) ; }; filter f_messages { level(info,notice,warn) and not facility(auth,authpriv,cron,daemon,mail,news); }; filter f_auth { facility(auth, authpriv) and not filter(f_debug); }; filter f_cron { facility(cron) and not filter(f_debug); }; filter f_daemon { facility(daemon) and not filter(f_debug); }; filter f_kern { facility(kern) and not filter(f_debug); }; filter f_lpr { facility(lpr) and not filter(f_debug); }; filter f_local { facility(local0, local1, local3, local4, local5, local6, local7) and not filter(f_debug); }; filter f_mail { facility(mail) and not filter(f_debug); }; filter f_news { facility(news) and not filter(f_debug); }; filter f_syslog3 { not facility(auth, authpriv, mail) and not filter(f_debug); }; filter f_user { facility(user) and not filter(f_debug); }; filter f_uucp { facility(uucp) and not filter(f_debug); }; filter f_cnews { level(notice, err, crit) and facility(news); }; filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; filter f_ppp { facility(local2) and not filter(f_debug); }; filter f_console { level(warn .. emerg); }; ######################## # Log paths ######################## log { source(s_src); filter(f_auth); destination(d_auth); }; log { source(s_src); filter(f_cron); destination(d_cron); }; log { source(s_src); filter(f_daemon); destination(d_daemon); }; log { source(s_src); filter(f_kern); destination(d_kern); }; log { source(s_src); filter(f_lpr); destination(d_lpr); }; log { source(s_src); filter(f_syslog3); destination(d_syslog); }; log { source(s_src); filter(f_user); destination(d_user); }; log { source(s_src); filter(f_uucp); destination(d_uucp); }; log { source(s_src); filter(f_mail); destination(d_mail); }; log { source(s_src); filter(f_news); filter(f_crit); destination(d_newscrit); }; log { source(s_src); filter(f_news); filter(f_err); destination(d_newserr); }; log { source(s_src); filter(f_news); filter(f_notice); destination(d_newsnotice); }; log { source(s_src); filter(f_debug); destination(d_debug); }; log { source(s_src); filter(f_error); destination(d_error); }; log { source(s_src); filter(f_messages); destination(d_messages); }; log { source(s_src); filter(f_console); destination(d_console_all); destination(d_xconsole); }; log { source(s_src); filter(f_crit); destination(d_console); };

1 0

Filtering all systemd user service logs
by Thomas Preisner 02 May '22

02 May '22

Hello all, I've been using syslog-ng for quite a while now to centrally collect logs of a few computers running debian and it worked great. However, a few weeks ago I enabled systemd user services on those machines and since then, my 'daemon' logs have been basically completely flooded with (in my opinion) useless log messages created by the aforementioned user services. So far, I've been using the following source configuration: source src { internal(); system(); udp(); udp6(); }; Until now, I've been filtering out the user service logs with my log-analysis tool using some regexes but due to the logs being 'user-controlled' (users can create arbitrary logs by simply creating and starting custom systemd user services) this is obviously no permanent solution. Even worse, the user-created logs end up in the 'daemon'-facility and not in the 'user'-facility as mentioned before. Therefore, here my question: Is there any clean way to detect/filter out these user service logs? I couldn't find anything relevant in the documentation so far. After all, these logs are collected separately by systemd-journald and then merged with the remaining system logs by syslog-ng (at least as far as I see it). Thank you for your response in advance! Best regards, Thomas Preisner

2 1

Local sources seem not to be working
by Alexandre Santos 28 Apr '22

28 Apr '22

Hi, I have syslog-ng 3.32.1 running in a Debian GNU/Linux 10 (buster) with the configuration in the attachement. After sometime running, syslog-ng seems be unable to read from system() and internal() sources. Log messages from syslog(ip(10.20.30.40) transport("udp") port(514) keep-alive(no)); are seen in the output folders. Also journald logs are working fine. After a reload of configuration in which what changes is this line: rewrite r_host { set("MACHINE-${HOST}", value("HOST")); }; logging is resumed. Here is the time gap for logs: <43>1 2022-03-11T11:55:23.802+00:00 xmm4-1-1 syslog-ng 8283 - [meta sequenceId="767"] Last message 'Destination reliable' repeated 8933 times, suppressed by syslog-ng on xmm4-1-1 <46>1 2022-03-14T07:19:01.817+00:00 xmm4-1-1 syslog-ng 8283 - [meta sequenceId="1"] Module loaded and initialized successfully; module='syslogformat' Do you know why this is happening? Thanks & Regards, Alex

2 13

Insider 2022-04: typing; sudo; Zinc; Elastic Cloud; 3.36;
by Peter Czanik (pczanik) 21 Apr '22

21 Apr '22

Dear syslog-ng users, This is the 100th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS syslog-ng 4 theme: typing ------------------------- Balázs Scheidler, founder of the syslog-ng project, describes a major new syslog-ng version 4.0 feature: typing. “syslog-ng traditionally assumes that log data, even if it comes in a structured form (like RFC5424 structured data or JSON) is primarily textual in nature. For this reason, name-value pairs in syslog-ng are text values just as the log message as a whole.” Read the rest of the blog to learn how typing helps not just when forwarding logs to Elasticsearch and others, but also when doing routing decisions: https://syslog-ng-future.blog/syslog-ng-4-theme-typing/ Working with JSON logs from sudo in syslog-ng --------------------------------------------- >From this blog you will learn how to work with JSON formatted logs in syslog-ng and also about new sudo features along the way: JSON logging in sudo, chroot support, logging sub-commands, and how to work with these logs in syslog-ng. https://www.syslog-ng.com/community/b/blog/posts/working-with-json-logs-fro… Elasticsearch 8 and syslog-ng ----------------------------- General availability of Elasticsearch 8 was announced recently. There were quite a few rumors that it will break compatibility with third party tools. I tested it as soon as I had a little time: I am happy to share that anything I tested with the elasticsearch-http() destination of syslog-ng still seems to work perfectly well with the latest version of Elasticsearch. https://www.syslog-ng.com/community/b/blog/posts/elasticsearch-8-and-syslog… Contacting the syslog-ng team: reporting problems, asking questions --------------------------------------------- Recently I got some complaints that it is difficult to figure out how to contact the syslog-ng team to get help or report problems. Most of this information is available both on the syslog-ng website and at the syslog-ng repository on GitHub, but collecting here all information might be still useful for some people. https://www.syslog-ng.com/community/b/blog/posts/contacting-the-syslog-ng-t… WEBINARS * Register for our latest webinars at https://www.syslog-ng.com/event/syslogng-webcast-series-2022/ * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

[GSoC] Rotate log files based on size
by Devharsh Trivedi 13 Apr '22

13 Apr '22

Hi @all, I am a PhD student and would like to apply to the Google Summer of Code. The proposal "Rotate log files based on size” seems interesting to me. Please advise. Regards, Devharsh.

3 2

3.36.1 new log format of some internal messages
by Evan Rempel 06 Apr '22

06 Apr '22

syslog-ng version 3.36.1 has introduced an additional time stamp in some of its internally generated log messages. [2022-04-05T07:10:27.574110] WARNING: Configuration file format is too old, syslog-ng is running in compatibility mode. Please update it to use the syslog-ng 3.36 format at your time of convenience. To upgrade the configuration, please review the warnings about incompatible changes printed by syslog-ng, and once completed change the @version header at the top of the configuration file; config-version='3.34' In the past this log message would have been formatted as WARNING: Configuration file format is too old, syslog-ng is running in compatibility mode. Please update it to use the syslog-ng 3.36 format at your time of convenience. To upgrade the configuration, please review the warnings about incompatible changes printed by syslog-ng, and once completed change the @version header at the top of the configuration file; config-version='3.34' Is this intentional? Why is it not consistent with other internal messages such as syslog-ng starting up; version='3.36.1' Another thing of note is that the configuration warning is actually logged via journald while all other internal messages are only available in the syslog-ng log streams sourcing "internal()" -- Evan

2 2

syslog-ng and ELK integration
by Park, Ethan 04 Apr '22

04 Apr '22

Greetings, I don't know this is the right place to ask about this question but I will give it a shot. We are running a syslog-ng server and we want to use Kibana as a visualization tool. I got stuck in at this point when configuring conf.d file. source s_tcp { tcp(ip("0.0.0.0") port("514")); udp(ip("0.0.0.0") port("514")); }; destination d_el { elasticsearch2( client-mode("http") index("syslog-ng") type("test") cluster-url(http://10.1.3.222:9200) ); #file("/var/log/networks/$HOST/$YEAR/$MONTH/$HOST-$YEAR-$MONTH-$DAY.log"); }; log { source(s_tcp); destination(d_el); flags(flow-control); }; If I start syslog-ng daemon, I got the below error. Apr 04 11:54:42 syslog-ng syslog-ng[22294]: [2022-04-04T11:54:42.443764] Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng/3.13', module='mod-java' Apr 04 11:54:42 syslog-ng syslog-ng[22294]: Error parsing destination, destination plugin elasticsearch2 not found in /etc/syslog-ng/conf.d/firewals.conf at line 10, column Apr 04 11:54:42 syslog-ng syslog-ng[22294]: included from /etc/syslog-ng/syslog-ng.conf line 163, column 1 Apr 04 11:54:42 syslog-ng syslog-ng[22294]: elasticsearch2( Apr 04 11:54:42 syslog-ng syslog-ng[22294]: ^^^^^^^^^^^^^^ Apr 04 11:54:42 syslog-ng syslog-ng[22294]: syslog-ng documentation: https://www.balabit.com/support/documentation?product=syslog-ng-ose Apr 04 11:54:42 syslog-ng syslog-ng[22294]: contact: https://lists.balabit.hu/mailman/listinfo/syslog-ng Apr 04 11:54:42 syslog-ng systemd[1]: syslog-ng.service: Main process exited, code=exited, status=1/FAILURE Apr 04 11:54:42 syslog-ng systemd[1]: syslog-ng.service: Failed with result 'exit-code'. Apr 04 11:54:42 syslog-ng systemd[1]: Failed to start System Logger Daemon. -- Subject: Unit syslog-ng.service has failed I am running 3.13 (syslog-ng) and what did I miss? PRIVILEGED AND CONFIDENTIAL COMMUNICATION This message is privileged and confidential under state and federal law. It is intended for the exclusive use of the named recipient. If the reader of this message is not the named or intended recipient, or the employee or agent responsible for delivering the message to its intended recipient, you are hereby notified that any use, copying, disclosure or dissemination of this message is strictly prohibited. If you are not the named or intended recipient and have received this communication in error, please notify us immediately by replying to the sender of this e-mail or at the address and phone number listed below, and take all steps necessary to delete this communication. Exactech, Inc. 2320 NW 66th Ct. Gainesville, FL. 32653 352-377-1140 An Equal Opportunity Employer

2 1

Multiple options blocks
by Faine, Mark R. (MSFC-IS40)[NICS] 02 Apr '22

02 Apr '22

Can I have an options block in syslog-ng.conf that is for default configuration such as for /var/log and another options block in an include file that is specific to those destinations?

2 1

Permissions are not set correctly on created directories
by Faine, Mark R. (MSFC-IS40)[NICS] 28 Mar '22

28 Mar '22

I have the following in my syslog-ng.conf for options: options { stats_freq(60); flush_lines(500); #flush_timeout(10000); time_reopen(10); time_reap(5); log_fifo_size(536870912); chain_hostnames(off); log-msg-size(65536); use_dns(no); keep_hostname(yes); use_fqdn(yes); dns_cache(off); dns-cache-size(2000); dns-cache-expire(87600); create_dirs(yes); perm(0640); owner(root); group(splunk); dir-perm(2750); dir-owner(root); dir-group(splunk); threaded(yes); }; However, instead of 2750 for the directory permissions, I'm seeing d-wSrwxrwT. 10 root splunk 4096 Mar 28 14:07 ise [root@molecule8-mfaine data]# stat -c '%a' ise 5276 I would expect: drwxr-s---. 2 root splunk 4096 Mar 28 14:11 ise Where are these permissions coming from? Thanks, Mark

2 2