- syslog-ng - lists.balabit.hu

insider 2014-09: 3.6 beta; eCSI; DevOps; anonymization; GSoC;
by Czanik, Péter 19 Sep '14

19 Sep '14

Dear syslog-ng users, This is the 37th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. FEATURED NEWS Beta testing of syslog-ng 3.6 started ------------------------------------- Beta testing period of syslog-ng 3.6 started two weeks ago with a beta1 release. It was quickly followed by a beta2 release, fixing mostly portability. Some of the new features are coming from the syslog-ng incubator, like Riemann support or the graphite template function. The journal source and many enhancements to existing features are coming from the syslog-ng PE team. Also, the @cim prefix can be used as a local "rich" log transport on /dev/log, and messages will be parsed by the JSON parser if available. Beta2 is already available in the FreeBSD ports in sysutils/syslog-ng-devel. For RPM distributions, check https://czanik.blogs.balabit.com/2014/09/journal-source-in-syslog-ng-3-6-be… BalaBit syslog-ng team takes over the syslog-ng OSE development --------------------------------------------------------------- algernon, the full-time syslog-ng OSE developer at BalaBit decided to look for new challenges. First of all, thank you very much for all your hard work, bugfixes nifty new features, and everything else you did for syslog-ng OSE! We all wish you the best, and hope you'll have a great time outside BalaBit as well :) To keep the development, maintenance, and releases of syslog-ng OSE on track, the developer team of syslog-ng Premium Edition will take over the tasks related to syslog-ng OSE: they will manage bugfixes, patches, pull requests, and also the general development of syslog-ng OSE. Naturally, this does not affect the current or future openness of syslog-ng OSE in any way: Your contribution is as welcome as ever. For more details about this change, see algernon's blog post at http://asylum.madhouse-project.org/blog/2014/09/15/looking-ahead/ eCSI training ------------- BalaBit provides now a free training, which provides a fresh insight on logmanagement. The first level introduces the listener to compliance, planning an infrastructure and logs in forensics situations. Once your knowledge is tested, you can go to the next level and learn about IT security and eCSI: http://www.balabit.com/lp/ecsi-training-camp syslog-ng, riemann, collectd-notifications, elasticsearch --------------------------------------------------------- How to build an event-based infrastructure to push structured messages to different subsystems for alerting, reporting and storage. Using syslog-ng, each message is normalized into a structured event, optionally correlated with other messages, and conditionally routed to systems. Read more at: http://devops.com/features/guide-modern-monitoring-alerting/ Data Privacy, Anonymization and Log Data ---------------------------------------- Strong data privacy laws are arriving slowly but surely in Europe, which also affects logging. Raw data contains too much information, on the other hand anonymized data does not have enough information to handle a security incident. Read about a possible solution and how syslog-ng can help at https://jluby.blogs.balabit.com/2014/09/10/data-privacy-anonymization-and-l… Google Summer of Code: success ------------------------------ Google Summer of Code ended a few weeks ago. All of our students successfully completed their projects. We would like to thank for the hard work of students and their mentors, and Google for the opportunity! You can read more about the completed projects at https://www.google-melange.com/gsoc/org2/google/gsoc2014/syslog_ng NEW RELEASES syslog-ng OSE 3.6 beta2: https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-September/000197… syslog-ng PE 5LTS (5.0.6a): https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-September/000196… Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com To read this newsletter on-line, visit: http://insider.blogs.balabit.com/ Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Re: [syslog-ng] classify/assign events to tenants/customers
by Jim Hendrick 18 Sep '14

18 Sep '14

I would try basic filters on host (or netmask) plus facility, priority and if necessary program or "match". Jim Sent from my Verizon Wireless 4G LTE smartphone -------- Original message -------- From: "Lucas, Sascha" <Sascha.Lucas(a)gisa.de> Date:09/18/2014 2:53 AM (GMT-05:00) To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Cc: Subject: [syslog-ng] classify/assign events to tenants/customers Hi, I'm looking for a way to "classify"/assign events to tenants/customers. A tenant/customer can be all events belonging to host or a combination of host/program. I thought patterndb can help doing this. However it seems there is no way? * classification: pattern is per program and limited to the message * correlation: context is limited to one host not many Do I miss something, or are there even better ways? Thanks, Sascha. Aufsichtsratsvorsitzender: Herbert Vogel Geschäftsführung: Michael Krüger Sitz der Gesellschaft: Halle/Saale Registergericht: Amtsgericht Stendal | Handelsregister-Nr. HRB 208414 UST-ID-Nr. DE 158253683 Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Empfänger sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail oder des Inhalts dieser Mail sind nicht gestattet. Diese Kommunikation per E-Mail ist nicht gegen den Zugriff durch Dritte geschützt. Die GISA GmbH haftet ausdrücklich nicht für den Inhalt und die Vollständigkeit von E-Mails und den gegebenenfalls daraus entstehenden Schaden. Sollte trotz der bestehenden Viren-Schutzprogramme durch diese E-Mail ein Virus in Ihr System gelangen, so haftet die GISA GmbH - soweit gesetzlich zulässig - nicht für die hieraus entstehenden Schäden. ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

3.6 beta2 rpm packages, FreeBSD ports
by Czanik, Péter 16 Sep '14

16 Sep '14

Hi, A bit later than usual (I was on sick leave), but my 3.6 beta2 packages are ready for openSUSE/SLES and Fedora/EPEL7. They are available at the usual locations: openSUSE/SLES: https://build.opensuse.org/project/show/home:czanik:syslog-ng36 Fedora/EPEL7: http://copr.fedoraproject.org/coprs/czanik/syslog-ng36/ Thanks to Cy, the sysutils/syslog-ng-devel port in FreeBSD was also updated to the latest beta, while I was unavailable. And this version also works on earlier releases, including FreeBSD 8.4. As usual, these packages are not yet recommended for production use, but any testing and feedback are very welcome! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Help settings regarding Syslog NG
by Simon OBOUNOU 15 Sep '14

15 Sep '14

Hi I need helps regarding setting between syslog ng server and security solutions like checkpoint firewall, stormshield IDS and so one. -- Bien cordialement, Kind Regards HIFA, Chairman 32 rue de la République 92190 MEUDON - FRANCE Phone: +33 1 46 31 44 25 Mobile: +33 6 11 30 36 57 email: simon.obounou(a)hifa.biz

2 1

syslog-ng 3.6.0beta2 has been released
by devel＠balabit.hu 11 Sep '14

11 Sep '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.6.0beta2 SUMMARY : new beta release DATE : Sep 11, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new beta version of syslog-ng Open Source Edition (3.6.0beta2) has been released. Being the - hopefully - last beta release, we would be very grateful for any feedback, to stabilize the release further. CHANGES: 3.6.0beta2 ========== Thu, 11 Sep 2014 13:09:57 +0200 This is the second beta release of the upcoming syslog-ng OSE 3.6 branch. Compared to the previous beta, this release contains a few minor features and bugfixes. We expect the next release to be a release candidate, focusing on stability and bugfixes. Testing is most appreciated! Features -------- * It is now possible to load not only a single certificate when using TLS, but a certificate chain. * The `system()` source will not include `/dev/kmsg` (or `/proc/kmsg`) when running inside a Linux container. Bugfixes -------- * The `in-list()` filter was fixed to look at all elements of the list, instead of only the last one. * Fixed an assertion when using the `match()` filter under certain circumstances. * The `system()` source will not add `/dev/kmsg` (or `/proc/kmsg` on older kernels) to the default sources if using the systemd journal, because kernel logs are included in the journal. Credits ------- syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessary to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Balazs Scheidler, Gergely Nagy, Gyorgy Pasztor, Peter Czanik, Tibor Benke. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.6.0b… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

Re: [syslog-ng] Individual Logs Files to each Forward to Different server/port?
by Jim Hendrick 08 Sep '14

08 Sep '14

Quick thought. Look at filters on the receiving end. Might be easier. Jim Sent from my Verizon Wireless 4G LTE smartphone -------- Original message -------- From: wiskbroom(a)hotmail.com Date:09/05/2014 5:42 PM (GMT-05:00) To: syslog-ng(a)lists.balabit.hu Cc: Subject: [syslog-ng] Individual Logs Files to each Forward to Different server/port? Greetings! Is is possible to configure a syslog-ng client to forward logs to a syslog-ng server based on file? I am thinking of the following as an example: destination named-LOGS { udp(ip(192.168.1.100) port(555)); }; source named { file("/var/log/named/bind.log" log_prefix("BIND-LOGS")); }; log { source(named); destination(named-LOGS); }; destination dhcpd-LOGS { udp(ip(192.168.1.100) port(556)); }; source dhcpd { file("/var/log/dhcpd/dhcp.log" log_prefix("DHCPD-LOGS")); }; log { source(dhcpd); destination(dhcpd-LOGS); }; In this example, I am sending each to the same destination IP address, although that is configurable, but each log file to a different port, and with a different log_prefix as well. Does this OK,or is their a simpler way? Many thanks, .vp Vadim Anatoly Pushkin -- The Ukranian Stallion --

2 2

Syslog proxy/relay encapsulates
by Michael Yacc 07 Sep '14

07 Sep '14

Dear all, I'm trying to configure syslog-ng as relay/proxy server. Seems to be simple, but syslog server recieves encapsulated original syslog messages within outgoing "syslog-relay" messages. Is there any way to configure syslog-ng (relay) to just forward orignal messages to syslog server? Syslog-ng version used: 3.3.9 *syslog-client$* logger "hello from syslog client" on syslog-relay I added the following configuration: ######## sources ############### source s_relay_port { udp(ip(0.0.0.0) port(514)); }; ######## destinations ############### destination d_syslog_server { syslog("syslog-server" transport("udp") port(514)); }; ######## logging ############### log { source(s_relay_port); destination(d_syslog_server); }; *syslog-server$* tail -F /var/log/syslog Sep 6 23:53:28 syslog-relay-ip 1 2014-09-06T23:53:28+03:00 syslog-client-ip 1 - - - 2014-09-06T23:53:28+03:00 syslog-client-hostname root - - [meta sequenceId="38"] hello from syslog client With best regards, Michael Yacc

2 1

Individual Logs Files to each Forward to Different server/port?
by wiskbroom＠hotmail.com 05 Sep '14

05 Sep '14

Greetings! Is is possible to configure a syslog-ng client to forward logs to a syslog-ng server based on file? I am thinking of the following as an example: destination named-LOGS { udp(ip(192.168.1.100) port(555)); }; source named { file("/var/log/named/bind.log" log_prefix("BIND-LOGS")); }; log { source(named); destination(named-LOGS); }; destination dhcpd-LOGS { udp(ip(192.168.1.100) port(556)); }; source dhcpd { file("/var/log/dhcpd/dhcp.log" log_prefix("DHCPD-LOGS")); }; log { source(dhcpd); destination(dhcpd-LOGS); }; In this example, I am sending each to the same destination IP address, although that is configurable, but each log file to a different port, and with a different log_prefix as well. Does this OK,or is their a simpler way? Many thanks, .vp Vadim Anatoly Pushkin -- The Ukranian Stallion --

1 0

syslog-ng 3.6.0beta1 has been released
by devel＠balabit.hu 05 Sep '14

05 Sep '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.6.0beta1 SUMMARY : new beta release DATE : Sep 5, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.6.0beta1) has been released. Being the first beta release, we would be very grateful for any feedback, to stabilize the release further. CHANGES: 3.6.0beta1 Wed, 3 Sep 2014 14:40:14 +0200 This is the first beta release of the upcoming syslog-ng OSE 3.6 branch. Compared to the alphas, this release contains a moderate amount of new functionality and bugfixes. Further releases will focus on stability and bugfixes. Features -------- * One can now use multiple elements in the `key()` and `exclude()` options of any value-pairs declaration. * A new source driver was added to the syslog-ng: `systemd-journal()`, which reads from the Journal directly, not via the syslog forwarding socket. The `system()` source defaults to using this source when systemd is detected. Bugfixes -------- * All the various crypto-related template functions now check that the desired length of the digest is not larger than the digest itself. If a larger value is requested, they will truncate it to the digest length. * The `$(geoip)` template function now works with `threaded(yes)` too. * The unix domain socket credentials code was changed to only build on Linux and FreeBSD. With this change, syslog-ng should compile again on platforms where the OS does not support this, with the feature disabled. Credits ------- syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessary to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Fabien Wernli, Gergely Nagy, Laszlo Budai, Michael Hocke, Tibor Benke, Viktor Juhasz, Viktor Tusa. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.6.0b… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

3.6beta1 packages for openSUSE
by Czanik, Péter 04 Sep '14

04 Sep '14

Hi, My initial 3.6beta1 pacages for openSUSE and SLES 11 are ready. There was a change in systemd packaging in Factory, that I still need to figure out. I tested the new package on openSUSE 13.1 and even tested it by disabling syslog compatibility in /etc/systemd/journald.conf, and the brand new journal source seems to work fine. If you run (open)SUSE, please give these packages a try, and let us know, if you run into any trouble! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

2 1