- syslog-ng - lists.balabit.hu

Re: [syslog-ng] classify/assign events to tenants/customers
by Jim Hendrick 18 Sep '14

18 Sep '14

I would try basic filters on host (or netmask) plus facility, priority and if necessary program or "match". Jim Sent from my Verizon Wireless 4G LTE smartphone -------- Original message -------- From: "Lucas, Sascha" <Sascha.Lucas(a)gisa.de> Date:09/18/2014 2:53 AM (GMT-05:00) To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Cc: Subject: [syslog-ng] classify/assign events to tenants/customers Hi, I'm looking for a way to "classify"/assign events to tenants/customers. A tenant/customer can be all events belonging to host or a combination of host/program. I thought patterndb can help doing this. However it seems there is no way? * classification: pattern is per program and limited to the message * correlation: context is limited to one host not many Do I miss something, or are there even better ways? Thanks, Sascha. Aufsichtsratsvorsitzender: Herbert Vogel Geschäftsführung: Michael Krüger Sitz der Gesellschaft: Halle/Saale Registergericht: Amtsgericht Stendal | Handelsregister-Nr. HRB 208414 UST-ID-Nr. DE 158253683 Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Empfänger sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail oder des Inhalts dieser Mail sind nicht gestattet. Diese Kommunikation per E-Mail ist nicht gegen den Zugriff durch Dritte geschützt. Die GISA GmbH haftet ausdrücklich nicht für den Inhalt und die Vollständigkeit von E-Mails und den gegebenenfalls daraus entstehenden Schaden. Sollte trotz der bestehenden Viren-Schutzprogramme durch diese E-Mail ein Virus in Ihr System gelangen, so haftet die GISA GmbH - soweit gesetzlich zulässig - nicht für die hieraus entstehenden Schäden. ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

3.6 beta2 rpm packages, FreeBSD ports
by Czanik, Péter 16 Sep '14

16 Sep '14

Hi, A bit later than usual (I was on sick leave), but my 3.6 beta2 packages are ready for openSUSE/SLES and Fedora/EPEL7. They are available at the usual locations: openSUSE/SLES: https://build.opensuse.org/project/show/home:czanik:syslog-ng36 Fedora/EPEL7: http://copr.fedoraproject.org/coprs/czanik/syslog-ng36/ Thanks to Cy, the sysutils/syslog-ng-devel port in FreeBSD was also updated to the latest beta, while I was unavailable. And this version also works on earlier releases, including FreeBSD 8.4. As usual, these packages are not yet recommended for production use, but any testing and feedback are very welcome! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Help settings regarding Syslog NG
by Simon OBOUNOU 15 Sep '14

15 Sep '14

Hi I need helps regarding setting between syslog ng server and security solutions like checkpoint firewall, stormshield IDS and so one. -- Bien cordialement, Kind Regards HIFA, Chairman 32 rue de la République 92190 MEUDON - FRANCE Phone: +33 1 46 31 44 25 Mobile: +33 6 11 30 36 57 email: simon.obounou(a)hifa.biz

2 1

syslog-ng 3.6.0beta2 has been released
by devel＠balabit.hu 11 Sep '14

11 Sep '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.6.0beta2 SUMMARY : new beta release DATE : Sep 11, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new beta version of syslog-ng Open Source Edition (3.6.0beta2) has been released. Being the - hopefully - last beta release, we would be very grateful for any feedback, to stabilize the release further. CHANGES: 3.6.0beta2 ========== Thu, 11 Sep 2014 13:09:57 +0200 This is the second beta release of the upcoming syslog-ng OSE 3.6 branch. Compared to the previous beta, this release contains a few minor features and bugfixes. We expect the next release to be a release candidate, focusing on stability and bugfixes. Testing is most appreciated! Features -------- * It is now possible to load not only a single certificate when using TLS, but a certificate chain. * The `system()` source will not include `/dev/kmsg` (or `/proc/kmsg`) when running inside a Linux container. Bugfixes -------- * The `in-list()` filter was fixed to look at all elements of the list, instead of only the last one. * Fixed an assertion when using the `match()` filter under certain circumstances. * The `system()` source will not add `/dev/kmsg` (or `/proc/kmsg` on older kernels) to the default sources if using the systemd journal, because kernel logs are included in the journal. Credits ------- syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessary to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Balazs Scheidler, Gergely Nagy, Gyorgy Pasztor, Peter Czanik, Tibor Benke. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.6.0b… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

Re: [syslog-ng] Individual Logs Files to each Forward to Different server/port?
by Jim Hendrick 08 Sep '14

08 Sep '14

Quick thought. Look at filters on the receiving end. Might be easier. Jim Sent from my Verizon Wireless 4G LTE smartphone -------- Original message -------- From: wiskbroom(a)hotmail.com Date:09/05/2014 5:42 PM (GMT-05:00) To: syslog-ng(a)lists.balabit.hu Cc: Subject: [syslog-ng] Individual Logs Files to each Forward to Different server/port? Greetings! Is is possible to configure a syslog-ng client to forward logs to a syslog-ng server based on file? I am thinking of the following as an example: destination named-LOGS { udp(ip(192.168.1.100) port(555)); }; source named { file("/var/log/named/bind.log" log_prefix("BIND-LOGS")); }; log { source(named); destination(named-LOGS); }; destination dhcpd-LOGS { udp(ip(192.168.1.100) port(556)); }; source dhcpd { file("/var/log/dhcpd/dhcp.log" log_prefix("DHCPD-LOGS")); }; log { source(dhcpd); destination(dhcpd-LOGS); }; In this example, I am sending each to the same destination IP address, although that is configurable, but each log file to a different port, and with a different log_prefix as well. Does this OK,or is their a simpler way? Many thanks, .vp Vadim Anatoly Pushkin -- The Ukranian Stallion --

2 2

Syslog proxy/relay encapsulates
by Michael Yacc 07 Sep '14

07 Sep '14

Dear all, I'm trying to configure syslog-ng as relay/proxy server. Seems to be simple, but syslog server recieves encapsulated original syslog messages within outgoing "syslog-relay" messages. Is there any way to configure syslog-ng (relay) to just forward orignal messages to syslog server? Syslog-ng version used: 3.3.9 *syslog-client$* logger "hello from syslog client" on syslog-relay I added the following configuration: ######## sources ############### source s_relay_port { udp(ip(0.0.0.0) port(514)); }; ######## destinations ############### destination d_syslog_server { syslog("syslog-server" transport("udp") port(514)); }; ######## logging ############### log { source(s_relay_port); destination(d_syslog_server); }; *syslog-server$* tail -F /var/log/syslog Sep 6 23:53:28 syslog-relay-ip 1 2014-09-06T23:53:28+03:00 syslog-client-ip 1 - - - 2014-09-06T23:53:28+03:00 syslog-client-hostname root - - [meta sequenceId="38"] hello from syslog client With best regards, Michael Yacc

2 1

Individual Logs Files to each Forward to Different server/port?
by wiskbroom＠hotmail.com 05 Sep '14

05 Sep '14

Greetings! Is is possible to configure a syslog-ng client to forward logs to a syslog-ng server based on file? I am thinking of the following as an example: destination named-LOGS { udp(ip(192.168.1.100) port(555)); }; source named { file("/var/log/named/bind.log" log_prefix("BIND-LOGS")); }; log { source(named); destination(named-LOGS); }; destination dhcpd-LOGS { udp(ip(192.168.1.100) port(556)); }; source dhcpd { file("/var/log/dhcpd/dhcp.log" log_prefix("DHCPD-LOGS")); }; log { source(dhcpd); destination(dhcpd-LOGS); }; In this example, I am sending each to the same destination IP address, although that is configurable, but each log file to a different port, and with a different log_prefix as well. Does this OK,or is their a simpler way? Many thanks, .vp Vadim Anatoly Pushkin -- The Ukranian Stallion --

1 0

syslog-ng 3.6.0beta1 has been released
by devel＠balabit.hu 05 Sep '14

05 Sep '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.6.0beta1 SUMMARY : new beta release DATE : Sep 5, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.6.0beta1) has been released. Being the first beta release, we would be very grateful for any feedback, to stabilize the release further. CHANGES: 3.6.0beta1 Wed, 3 Sep 2014 14:40:14 +0200 This is the first beta release of the upcoming syslog-ng OSE 3.6 branch. Compared to the alphas, this release contains a moderate amount of new functionality and bugfixes. Further releases will focus on stability and bugfixes. Features -------- * One can now use multiple elements in the `key()` and `exclude()` options of any value-pairs declaration. * A new source driver was added to the syslog-ng: `systemd-journal()`, which reads from the Journal directly, not via the syslog forwarding socket. The `system()` source defaults to using this source when systemd is detected. Bugfixes -------- * All the various crypto-related template functions now check that the desired length of the digest is not larger than the digest itself. If a larger value is requested, they will truncate it to the digest length. * The `$(geoip)` template function now works with `threaded(yes)` too. * The unix domain socket credentials code was changed to only build on Linux and FreeBSD. With this change, syslog-ng should compile again on platforms where the OS does not support this, with the feature disabled. Credits ------- syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessary to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Fabien Wernli, Gergely Nagy, Laszlo Budai, Michael Hocke, Tibor Benke, Viktor Juhasz, Viktor Tusa. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.6.0b… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

3.6beta1 packages for openSUSE
by Czanik, Péter 04 Sep '14

04 Sep '14

Hi, My initial 3.6beta1 pacages for openSUSE and SLES 11 are ready. There was a change in systemd packaging in Factory, that I still need to figure out. I tested the new package on openSUSE 13.1 and even tested it by disabling syslog compatibility in /etc/systemd/journald.conf, and the brand new journal source seems to work fine. If you run (open)SUSE, please give these packages a try, and let us know, if you run into any trouble! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

2 1

3.6beta1 packages for Fedora/EPEL
by Czanik, Péter 04 Sep '14

04 Sep '14

Hi, http://copr.fedoraproject.org/coprs/czanik/syslog-ng36/ I prepared packages from 3.6beta1 for all recent Fedora releases and for EPEL7. I only tested on rawhide, as there syslog compatibility is disabled in journal by default and beta1 already has a journal source. I did some basic tests, and it worked fine. Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0