- syslog-ng - lists.balabit.hu

Syslog proxy/relay encapsulates
by Michael Yacc 07 Sep '14

07 Sep '14

Dear all, I'm trying to configure syslog-ng as relay/proxy server. Seems to be simple, but syslog server recieves encapsulated original syslog messages within outgoing "syslog-relay" messages. Is there any way to configure syslog-ng (relay) to just forward orignal messages to syslog server? Syslog-ng version used: 3.3.9 *syslog-client$* logger "hello from syslog client" on syslog-relay I added the following configuration: ######## sources ############### source s_relay_port { udp(ip(0.0.0.0) port(514)); }; ######## destinations ############### destination d_syslog_server { syslog("syslog-server" transport("udp") port(514)); }; ######## logging ############### log { source(s_relay_port); destination(d_syslog_server); }; *syslog-server$* tail -F /var/log/syslog Sep 6 23:53:28 syslog-relay-ip 1 2014-09-06T23:53:28+03:00 syslog-client-ip 1 - - - 2014-09-06T23:53:28+03:00 syslog-client-hostname root - - [meta sequenceId="38"] hello from syslog client With best regards, Michael Yacc

2 1

Individual Logs Files to each Forward to Different server/port?
by wiskbroom＠hotmail.com 05 Sep '14

05 Sep '14

Greetings! Is is possible to configure a syslog-ng client to forward logs to a syslog-ng server based on file? I am thinking of the following as an example: destination named-LOGS { udp(ip(192.168.1.100) port(555)); }; source named { file("/var/log/named/bind.log" log_prefix("BIND-LOGS")); }; log { source(named); destination(named-LOGS); }; destination dhcpd-LOGS { udp(ip(192.168.1.100) port(556)); }; source dhcpd { file("/var/log/dhcpd/dhcp.log" log_prefix("DHCPD-LOGS")); }; log { source(dhcpd); destination(dhcpd-LOGS); }; In this example, I am sending each to the same destination IP address, although that is configurable, but each log file to a different port, and with a different log_prefix as well. Does this OK,or is their a simpler way? Many thanks, .vp Vadim Anatoly Pushkin -- The Ukranian Stallion --

1 0

syslog-ng 3.6.0beta1 has been released
by devel＠balabit.hu 05 Sep '14

05 Sep '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.6.0beta1 SUMMARY : new beta release DATE : Sep 5, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.6.0beta1) has been released. Being the first beta release, we would be very grateful for any feedback, to stabilize the release further. CHANGES: 3.6.0beta1 Wed, 3 Sep 2014 14:40:14 +0200 This is the first beta release of the upcoming syslog-ng OSE 3.6 branch. Compared to the alphas, this release contains a moderate amount of new functionality and bugfixes. Further releases will focus on stability and bugfixes. Features -------- * One can now use multiple elements in the `key()` and `exclude()` options of any value-pairs declaration. * A new source driver was added to the syslog-ng: `systemd-journal()`, which reads from the Journal directly, not via the syslog forwarding socket. The `system()` source defaults to using this source when systemd is detected. Bugfixes -------- * All the various crypto-related template functions now check that the desired length of the digest is not larger than the digest itself. If a larger value is requested, they will truncate it to the digest length. * The `$(geoip)` template function now works with `threaded(yes)` too. * The unix domain socket credentials code was changed to only build on Linux and FreeBSD. With this change, syslog-ng should compile again on platforms where the OS does not support this, with the feature disabled. Credits ------- syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessary to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Fabien Wernli, Gergely Nagy, Laszlo Budai, Michael Hocke, Tibor Benke, Viktor Juhasz, Viktor Tusa. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.6.0b… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

3.6beta1 packages for openSUSE
by Czanik, Péter 04 Sep '14

04 Sep '14

Hi, My initial 3.6beta1 pacages for openSUSE and SLES 11 are ready. There was a change in systemd packaging in Factory, that I still need to figure out. I tested the new package on openSUSE 13.1 and even tested it by disabling syslog compatibility in /etc/systemd/journald.conf, and the brand new journal source seems to work fine. If you run (open)SUSE, please give these packages a try, and let us know, if you run into any trouble! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

2 1

3.6beta1 packages for Fedora/EPEL
by Czanik, Péter 04 Sep '14

04 Sep '14

Hi, http://copr.fedoraproject.org/coprs/czanik/syslog-ng36/ I prepared packages from 3.6beta1 for all recent Fedora releases and for EPEL7. I only tested on rawhide, as there syslog compatibility is disabled in journal by default and beta1 already has a journal source. I did some basic tests, and it worked fine. Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

[Bug 275] New: lib/filter/filter-in-list. c does not compile under Solaris 10
by bugzilla＠bugzilla.balabit.com 28 Aug '14

28 Aug '14

https://bugzilla.balabit.com/show_bug.cgi?id=275 Summary: lib/filter/filter-in-list.c does not compile under Solaris 10 Product: syslog-ng Version: 3.5.x Platform: PC OS/Version: Solaris Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: michael.hocke(a)nyu.edu Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=93) --> (https://bugzilla.balabit.com/attachment.cgi?id=93) diff for misc.c and misc.h lib/filter/filter-in-list.c uses getline() that is not available in Solaris 10. I worked around it by adding code snippets to lib/misc.h and lib/misc.c that implement getdelim and getline that I took from another project. I was ablt to make it work but I assume it wasn't the most elegant solution and should be integrated into autoconfig etc. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

really need help...not writing files
by Frank Wilkinson 26 Aug '14

26 Aug '14

Please forgive me if this has already been addressed. If so will you point me to it? Syslog-ng will all of a sudden, stop writing files. I'm running syslog-ng 3.5.3 Installer-Version: 3.5.3 Revision: ssh+git://algernon@git.balabit/var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.5#master#ccb05a22408ba4c837d998b2538854d994f845a5 Compile-Date: Jan 8 2014 13:35:02 Available-Modules: afsocket,afprog,dbparser,system-source,affile,syslogformat,linux-kmsg-format,csvparser,afmongodb,afsocket-tls,confgen,afuser,afstomp,afsocket-notls,basicfuncs,cryptofuncs,afamqp Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: on Enable-Linux-Caps: off Enable-Pcre: on The service status is showing running but not writing log files. We are logging udp from about 2400 devices When it dies strace shows: epoll_ctl(3, EPOLL_CTL_DEL, 10, {0, {u32=19726648, u64=19726648}}) = 0 write(110, "\1\0\0\0\0\0\0\0", 8) = 8 epoll_wait(3, {{EPOLLIN, {u32=19641320, u64=19641320}}}, 11, 3414) = 1 read(6, "\1\0\0\0\0\0\0\0", 8) = 8 futex(0x7fe1b000bd34, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7fe1b000bd30, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1 futex(0x7fe21cfaad68, FUTEX_WAKE_PRIVATE, 1) = 1 fcntl(10, F_GETFD) = 0x1 (flags FD_CLOEXEC) fcntl(10, F_GETFL) = 0x802 (flags O_RDWR|O_NONBLOCK) setsockopt(10, SOL_SOCKET, SO_OOBINLINE, [1], 4) = 0 write(110, "\1\0\0\0\0\0\0\0", 8) = 8 epoll_ctl(3, EPOLL_CTL_ADD, 10, {0, {u32=19726648, u64=19726648}}) = 0 epoll_wait(3, {{EPOLLIN, {u32=19641320, u64=19641320}}}, 12, 3413) = 1 read(6, "\1\0\0\0\0\0\0\0", 8) = 8 futex(0x7fe1b000bd34, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7fe1b000bd30, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1 futex(0x7fe21cfaad68, FUTEX_WAKE_PRIVATE, 1) = 1 futex(0x14e25a0, FUTEX_WAKE_PRIVATE, 1) = 1 epoll_wait(3, {{EPOLLIN, {u32=19641320, u64=19641320}}}, 12, 0) = 1 read(6, "\1\0\0\0\0\0\0\0", 8) = 8 futex(0x7fe1b000bd34, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7fe1b000bd30, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1 futex(0x7fe21cfaad68, FUTEX_WAKE_PRIVATE, 1) = 1 write(110, "\1\0\0\0\0\0\0\0", 8) = 8 futex(0x12d02c0, FUTEX_WAIT_PRIVATE, 2, NULL) = ? ERESTARTSYS (To be restarted) --- SIGTERM (Terminated) @ 0 (0) --- write(17, "\1\0\0\0\0\0\0\0", 8) = 8 rt_sigreturn(0x7fe21cfab740) = 202 futex(0x12d02c0, FUTEX_WAIT_PRIVATE, 2, NULL <unfinished ...> here is where I did a restart +++ killed by SIGKILL +++ top - 12:45:56 up 133 days, 23:11, 13 users, load average: 1.06, 1.13, 1.14 Tasks: 634 total, 2 running, 632 sleeping, 0 stopped, 0 zombie Cpu(s): 4.2%us, 2.0%sy, 0.0%ni, 93.6%id, 0.0%wa, 0.0%hi, 0.2%si, 0.0%s Mem: 32898840k total, 31285296k used, 1613544k free, 128188k buffers Swap: 16777212k total, 684800k used, 16092412k free, 29249028k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 1631 root 20 0 1725m 104m 2892 S 28.4 0.3 10:38.46 syslog-ng 2843 root 20 0 1725m 104m 2892 S 17.5 0.3 0:04.35 syslog-ng 2795 root 20 0 1725m 104m 2892 S 15.8 0.3 0:11.99 syslog-ng 2842 root 20 0 1725m 104m 2892 S 13.9 0.3 0:02.68 syslog-ng 2793 root 20 0 1725m 104m 2892 S 13.5 0.3 0:14.54 syslog-ng 2855 root 20 0 1725m 104m 2892 R 13.5 0.3 0:00.41 syslog-ng 2776 root 20 0 1725m 104m 2892 S 12.2 0.3 0:18.57 syslog-ng 43203 root 20 0 359m 101m 10m S 11.9 0.3 15:35.10 splunkd 2794 root 20 0 1725m 104m 2892 S 9.6 0.3 0:14.62 syslog-ng 2791 root 20 0 1725m 104m 2892 S 9.2 0.3 0:11.89 syslog-ng 2697 root 20 0 1725m 104m 2892 S 6.3 0.3 0:31.74 syslog-ng 43204 root 20 0 359m 101m 10m S 4.9 0.3 8:01.72 splunkd 2825 root 20 0 1725m 104m 2892 S 2.3 0.3 0:07.73 syslog-ng 2841 root 20 0 1725m 104m 2892 S 1.6 0.3 0:03.30 syslog-ng ... Also, one other problem I have is the syslog-ng log file says: Aug 26 11:48:49 sopher1 syslog-ng[488]: Input is valid utf8, but the log message is not tagged as such, this performs worse than enabling validate-utf8 flag on input; value='758AARULOCAL01' My config specifies flags(validate-utf8): source s_udp { udp( port(514) so_rcvbuf(15000000) log_iw_size(50000) log_msg_size(65535) log_fetch_limit(50000) flags(validate-utf8));}; Frank Wilkinson (205)934-3540 w

1 0

Re: [syslog-ng] Quick set of eyeballs on this
by James Lay 25 Aug '14

25 Aug '14

On 2014-08-25 15:39, Balint Kovacs wrote: > Hi, > > just a guess, but as far as i can remember, the ASA-* part is > usually > in the program field, try the program() filter instead of message() > in > f_firewall. > > Balint > > On 2014. augusztus 25. 22:48:05 CEST, James Lay > <jlay(a)slave-tothe-box.net> wrote: > >> Can anyone see anything blatantly wrong with this? The goal is to >> syslog as usual, but to forward firewall messages to a different >> server. >> Thanks for looking all. >> >> James >> >> @version:3.3.5 >> options { >> use_dns(no); >> flush_lines(0); >> stats_freq(43200); >> }; >> >> source s_local { >> unix-stream("/dev/log"); >> udp(ip(0.0.0.0) port(514)); >> tcp(ip(0.0.0.0) port(514)); >> file("/proc/kmsg"); >> }; >> >> destination d_file { >> file("/var/log/messages"); >> }; >> >> destination d_syslogserver { udp ("x.x.x.x", port(7514)); }; >> >> filter f_syslogfilter { >> not ( >> message("0x0004") >> or message("169.254.") >> or message("192.168.") >> ); >> }; >> >> filter f_firewall { >> message("ASA-4-71005") >> >> or >> message("ASA-2-106100") >> }; >> >> log { >> source(s_local); >> filter(f_syslogfilter); >> destination(d_file); >> }; >> >> log { >> source(s_local); >> filter(f_firewall); >> destination(d_syslogserver); >> }; >> >> ------------------------- Ah thank you...I've just been testing using logger. I'll adjust and try this with program(). Thanks again. James

1 0

Quick set of eyeballs on this
by James Lay 25 Aug '14

25 Aug '14

Can anyone see anything blatantly wrong with this? The goal is to syslog as usual, but to forward firewall messages to a different server. Thanks for looking all. James @version:3.3.5 options { use_dns(no); flush_lines(0); stats_freq(43200); }; source s_local { unix-stream("/dev/log"); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); file("/proc/kmsg"); }; destination d_file { file("/var/log/messages"); }; destination d_syslogserver { udp ("x.x.x.x", port(7514)); }; filter f_syslogfilter { not ( message("0x0004") or message("169\.254\.") or message("192\.168\.") ); }; filter f_firewall { message("ASA-4-71005") or message("ASA-2-106100") }; log { source(s_local); filter(f_syslogfilter); destination(d_file); }; log { source(s_local); filter(f_firewall); destination(d_syslogserver); };

1 0

Re: [syslog-ng] create_dir and "dynamic" destinations.
by Jim Hendrick 22 Aug '14

22 Aug '14

I would check doing a manual mkdir -p </some/long/path> as the user specified in the config. Then try as root if different. Also look at how that file system is mounted. Is it local disk or NFS ? NFS treats root differently. Also I have seen the permissions of the underlying mount point also cause problems. That is rwxr-x--- for the directory on which the NFS is mounted can cause problems for the mounted filesystem. And you won't see it unless you unmount the NFS piece. Anyway that's what I can think of right off. Jim Sent from my Verizon Wireless 4G LTE smartphone -------- Original message -------- From: "AVELING, BEN (BEN)" <ben.aveling(a)alcatel-lucent.com> Date:08/21/2014 6:33 PM (GMT-05:00) To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Cc: Subject: Re: [syslog-ng] create_dir and "dynamic" destinations. Permissions problem? Is anything reported in syslog-ng’s own logs? Regards, Ben From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Renato Bezerra Sent: Friday, 22 August 2014 05:51 To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] create_dir and "dynamic" destinations. I use this same config and work very well. Em 21/08/2014 16:44, "Balazs Scheidler" <bazsi77(a)gmail.com> escreveu: Hmm it should create the entire path. On Aug 20, 2014 5:16 PM, "Scot Needy" <scotrn(a)gmail.com> wrote: Yes, I have the create-dies() option enabled but that does not seem to work for upper level directories. Example: Only works if the 192_168_9_0 directory is pre-created. destination d_192_168_9_0 { file(/opt/syslog-ng/logs/192_168_9_0/$YEAR/$MONTH/$DAY/$HOST.log);}; On Aug 20, 2014, at 7:24 AM, Fabien Wernli <wernli(a)in2p3.fr> wrote: > Hi Scot, > > You have the `create-dirs()` option for that: > > http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.5-guid… > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

3 2