- syslog-ng - lists.balabit.hu

Value is dropped or unset in resolved destination template
by Faine, Mark R. (MSFC-IS40)[NICS] 25 Mar '22

25 Mar '22

I have a destination template in my destination (d_default) that uses $location destination d_default { file("`BASEPATH`/$location/$(lowercase ${HOST})/$app/$(lowercase ${HOST})_$app.log" create_dirs(yes) flags("threaded", "no-multi-line")); }; That is set by a series of filters that look like this log { if { filter... rewrite { set("foo" value("location")); }; }; if { filter... rewrite { set("bar" value("location")); }; }; ... }; This appears to be working, I can see it in the logs: Setting value; name='location', value='unknown', msg='0x7f190c001e00' # Unknown is a default value that would be appropriate on this testing server Later additional log paths are applied like so: log { source(default); filter(f_asa); rewrite(r_asa); destination(d_default); flags(final ); }; ... log { source(default); filter(f_fw); rewrite(r_fw); destination(d_default); flags(final ); }; ... However, when I go to the destination on the filesystem the location is empty so the files are being written as though location was this: ("`BASEPATH`//$(lowercase ${HOST})/$app/$(lowercase ${HOST})_$app.log" Any ideas what could be causing this? Thanks, Mark

4 5

Help with embedded log paths
by Faine, Mark R. (MSFC-IS40)[NICS] 25 Mar '22

25 Mar '22

I need this configuration to do as the comments say but I can't figure out how to make it happen. Any pointers would be appreciated. Thanks, Mark log { source(default); # One of these first four should always match, if not $location=unknown log { filter(f_arc); rewrite(r_arc); }; log { filter(f_gsfc); rewrite(r_gsfc); }; log { filter(f_jsc); rewrite(r_jsc); }; log { filter(f_msfc); rewrite(r_msfc); }; ## The first one of these to match writes to disk and stops processing further log paths ## I don't know how this can be done since I can't add flags(final) inside of an embedded log path # Log Path for asa log { filter(f_asa); destination { file("/var/log/remote/data/${location:-unknown}/$(lowercase asa/${HOST}/${HOST}-asa.${UNIXTIME}.log)" create_dirs(yes) flags("threaded", "no-multi-line")); }; }; # Log Path for fmg log { filter(f_fmg); destination { file("/var/log/remote/data/${location:-unknown}/$(lowercase fmg/${HOST}/${HOST}-fmg.${UNIXTIME}.log)" create_dirs(yes) flags("threaded", "no-multi-line")); }; }; # Log Path for faz log { filter(f_faz); destination { file("/var/log/remote/data/${location:-unknown}/$(lowercase faz/${HOST}/${HOST}-faz.${UNIXTIME}.log)" create_dirs(yes) flags("threaded", "no-multi-line")); }; }; # Log Path for fw log { filter(f_fw); destination { file("/var/log/remote/data/${location:-unknown}/$(lowercase fw/${HOST}/${HOST}-fw.${UNIXTIME}.log)" create_dirs(yes) flags("threaded", "no-multi-line")); }; }; # Log Path for fw_block log { filter(f_fw_block); destination { file("/var/log/remote/data/${location:-unknown}/$(lowercase fw_block/${HOST}/${HOST}-fw_block.${UNIXTIME}.log)" create_dirs(yes) flags("threaded", "no-multi-line")); }; }; # Log Path for fortigate log { filter(f_fortigate); destination { file("/var/log/remote/data/${location:-unknown}/$(lowercase fortigate/${HOST}/${HOST}-fortigate.${UNIXTIME}.log)" create_dirs(yes) flags("threaded", "no-multi-line")); }; }; # Log Path for ips log { filter(f_ips); destination { file("/var/log/remote/data/${location:-unknown}/$(lowercase ips/${HOST}/${HOST}-ips.${UNIXTIME}.log)" create_dirs(yes) flags("threaded", "no-multi-line")); }; }; # Log Path for psa log { filter(f_psa); destination { file("/var/log/remote/data/${location:-unknown}/$(lowercase psa/${HOST}/${HOST}-psa.${UNIXTIME}.log)" create_dirs(yes) flags("threaded", "no-multi-line")); }; }; # Log Path for pubfw log { filter(f_pubfw); destination { file("/var/log/remote/data/${location:-unknown}/$(lowercase pubfw/${HOST}/${HOST}-pubfw.${UNIXTIME}.log)" create_dirs(yes) flags("threaded", "no-multi-line")); }; }; # Log Path for utm_other log { filter(f_utm_other); destination { file("/var/log/remote/data/${location:-unknown}/$(lowercase utm_other/${HOST}/${HOST}-utm_other.${UNIXTIME}.log)" create_dirs(yes) flags("threaded", "no-multi-line")); }; }; # Log Path for waf log { filter(f_waf); destination { file("/var/log/remote/data/${location:-unknown}/$(lowercase waf/${HOST}/${HOST}-waf.${UNIXTIME}.log)" create_dirs(yes) flags("threaded", "no-multi-line")); }; }; # Log Path for webfilter log { filter(f_webfilter); destination { file("/var/log/remote/data/${location:-unknown}/$(lowercase webfilter/${HOST}/${HOST}-webfilter.${UNIXTIME}.log)" create_dirs(yes) flags("threaded", "no-multi-line")); }; }; flags(final); };

3 4

Customizing syslog-ng snmp() destination option
by Maurya, Shivani 23 Mar '22

23 Mar '22

Hi All, I am using syslog-ng v3.30 and forwarding snmp traps from this server using snmp() destination option - [cid:image001.png@01D839F6.A0D8F220] I wanted to add a field "agent-addr" as part of the trap & not in the variable-binding. This field "agent-addr" will contain the IP address of the device which is sending the syslog message to the syslog server. How can I add a customized filed as part of the trap? Regards, Shivani Maurya

4 9

Gsoc preparation
by Kavinda Shehan Rajapakshe 22 Mar '22

22 Mar '22

Hello, I’m Kavinda Rajapakse, an undergraduate at the University of Moratuwa, Sri Lanka. Currently, I'm studying Computer Science and Engineering. This is my first time contributing to open source. I have some experience working in Rsyslog and Elastic stack. I would like to contribute to the "Support Elastic's beats protocol” project in GSOC 2022. I would be highly obliged if someone could provide me with an introduction as to how to get started. Thank you.

2 1

Insider 2022-03: syslog-ng 4; MQTT source; Zinc; Elastic Cloud; 3.36;
by Peter Czanik (pczanik) 17 Mar '22

17 Mar '22

Dear syslog-ng users, This is the 99th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS syslog-ng future: the path to syslog-ng 4 ----------------------------------------- Balázs Scheidler, founder of the syslog-ng project, describes the path to syslog-ng version 4.0: “It is very important to state that syslog-ng 4 is not the revolutionary, break-everything kind of release that we see too often in the software world. Rather it is an evolutionary change that will be produced similarly to previous releases” Read the rest of the blog at https://syslog-ng-future.blog/syslog-ng-future-the-path-to-syslog-ng-4/ MQTT source ----------- Version 3.35.1 of syslog-ng introduced an MQTT source. Just for some fun in the last syslog-ng blog post of the year, I created an endless loop using syslog-ng and the Mosquitto MQTT broker. Of course, it does not have much practical value other than possibly a bit of stress testing, but hopefully provides a fun introduction to MQTT-related technologies in syslog-ng. https://www.syslog-ng.com/community/b/blog/posts/creating-an-endless-loop-u… Another use for the syslog-ng elasticsearch-http destination: Zinc --------------------------- There is a new drop-in replacement for Elasticsearch, at least if you don’t mind the limitations and the alpha status. However, it definitely lives up to the promise that it provides an Elasticsearch-compatible API for data ingestion. I tested it with the elasticsearch-http() destination of syslog-ng, and it worked perfectly after I modified the URL in the configuration example I found. https://www.syslog-ng.com/community/b/blog/posts/another-use-for-the-syslog… Sending logs to Elastic Cloud using syslog-ng --------------------------------------------- The Elastic Cloud is a service by Elastic providing Elasticsearch and related services in an easy-to-use package. Last year someone reported an issue that it does not work properly with syslog-ng. I did not have time to investigate at that time. Now I started a free trial and soon my log messages from syslog-ng started to appear in Kibana in Elastic Cloud. >From this blog you can learn how to configure syslog-ng for the Elastic Cloud. I go with the most basic settings: exploring Elastic Cloud and syslog-ng Elasticsearch features are both out of scope, as both are very well documented on their respective websites. NEW RELEASES * syslog-ng 3.36: https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-3-36-news-better… WEBINARS * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

my syslog-ng-stable repos are updated to 3.36.1
by Peter Czanik (pczanik) 16 Mar '22

16 Mar '22

Hi, Version 3.36.1 of syslog-ng was released almost two weeks ago. Hundreds of people already installed it, nobody reported any problems, so my syslog-ng-stable RPM repos for openSUSE / SLES and Fedora / RHEL and compatibles are now updated to syslog-ng 3.36.1 See https://www.syslog-ng.com/community/b/blog/posts/introducing-the-syslog-ng-… Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

where did you switch from CentOS 8 Linux?
by Peter Czanik (pczanik) 16 Mar '22

16 Mar '22

Hi, By now I hope anyone who used CentOS 8 Linux proper previously switched to something else. If the question in the subject of my e-mail surprises you, please read the announcement about making CentOS 8 Linux End of Life by the end of 2021: https://blog.centos.org/2020/12/future-is-centos-stream/ By now all repositories are removed as well. Question: Where did you switch? RHEL or a compatible release by Rocky Linux, AlmaLinux? CentOS 8 Stream, the rolling pre-release of RHEL? Or something completely different, like openSUSE or FreeBSD? You can answer here or on my Twitter poll: https://twitter.com/PCzanik/status/1504034771944493056 Background: For years roughly 80% of syslog-ng users ran RHEL / CentOS & compatibles. This is expected to change now. Some stay on traditional RHEL (& compatible) releases, some move to Stream, some to something completely different. Your answer helps me to decide where to focus my effort as a syslog-ng packager. Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

a question about the elasticsearch-http driver
by Risto Vaarandi 12 Mar '22

12 Mar '22

hi all, I have a question about the elasticsearch-http driver. Is it possible to send events to a specific Elasticsearch ingest pipeline with this driver? Also, if sending events to ingest pipeline is possible, can the ingest pipeline name contain macros, so that the pipeline name can be set based on the data extracted from incoming events? Such functionality is implemented in rsyslog, and I was wondering if the same thing can be accomplished with syslog-ng. kind regards, risto

2 3

parsing cisco firepower logs problem with 3.33
by Stoffel, John (TAI) 09 Mar '22

09 Mar '22

Hi, I'm trying to parse some cisco logs from a Cisco firepower firewall, using syslog-ng v3.33 on a CentOS 7 system. After pounding my head against the wall a few times to realize that you can't just re-start syslog-ng and have it re-read a source file from scratch... that instead I need to just push the data using netcat, it's now in a state where I think I can try to debug things. My logs look like this: <166>2022-02-16T15:31:53Z na-zy-int-fp1140-p02 : %FTD-6-305012: Teardown dynamic UDP translation fr om TAI-INSIDE:1.2.3.110/51288 to FOO-OUTSIDE:6.7.8.18/33333 duration 0:00:00 <166>2022-02-16T15:31:53Z na-zy-int-fp1140-p02 : %FTD-6-305012: Teardown dynamic TCP translation fr om FOO-WAN_IN:10.92.60.80/59877 to FOO-OUTSIDE:6.7.8.18/59877 duration 0:01:01 <166>2022-02-16T15:31:53Z na-zy-int-fp1140-p02 : %FTD-6-305011: Built dynamic UDP translation from FOO-INSIDE:1.2.3.110/51288 to FOO-OUTSIDE:6.7.8.18/5632 Looking at this log, vs the examples given in the /usr/share/syslog-ng/include/scl/cisco/plugin.conf file, I think the problem is that my logs shows the: sequence, date: origin, %MSG instead of sequence, origin, date: %MSG and it's not clear to me how I would hack the plugin.conf file to handle this issue. My end goal is to be able to parse the message enough by log level so I can forward only a subset of messages to another remote syslog system. Thanks, John Sr. Storage Architect TOSHIBA AMERICA, INC. 1251 6th, Ave 41st flr, New York, NY 10020 508-736-5499 (mobile) E-Mail: john.stoffel(a)toshiba.com<mailto:john.stoffel@toshiba.com> Website: Service Now Self Service Portal<https://nassc.service-now.com/ess/navpage.do>

2 7

syslog-ng-3.36.1
by Laszlo Varady (lvarady) 04 Mar '22

04 Mar '22

3.36.1 Highlights * system() source: added basic support for reading macOS system logs The current implementation processes the output of the original macOS syslogd: /var/log/system.log. (#3710<https://github.com/syslog-ng/syslog-ng/pull/3710>) * $(values) and $(names): these new template functions can be used to query a list of name-value pairs in the current message. The list of name value pairs queried are specified by a value-pairs expression, just like with $(format-json). Examples: This expression sets the JSON array values to contain the list of SDATA values, while the JSON array names would contain the associated names, in the same order. $(format-json values=list($(values .SDATA.*)) names=list($(names .SDATA.*))) The resulting name-value pairs are always sorted by their key, regardless of the argument order. (#3911<https://github.com/syslog-ng/syslog-ng/pull/3911>) * rename(): added a new rewrite rule, called rename() Example usage: rewrite { rename( "renamed-from" "renamed-to" ); }; (#3841<https://github.com/syslog-ng/syslog-ng/pull/3841>) Features * network() drivers: added TLS keylog support syslog-ng dumps TLS secrets for a given source/destination, which can be used for debugging purposes to decrypt data with, for example, Wireshark. This should be used for debugging purposes only! Example usage: source tls_source{ network( port(1234) transport("tls"), tls( key-file("/path/to/server_key.pem"), cert-file("/path/to/server_cert.pem"), ca-dir("/path/to/ca/") keylog-file("/path/to/keylog_file") ) ); }; (#3792<https://github.com/syslog-ng/syslog-ng/pull/3792>) * tls() block: added option for restricting TLS 1.3 ciphers The network(), syslog(), and the http() modules now support specifying TLS 1.3 cipher suites, Example usage: network( transport("tls") tls( pkcs12-file("test.p12") cipher-suite( tls12-and-older("ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"), tls13("TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384") ) ) ); tls12-and-older() can be used to specify TLS v1.2-and-older ciphers, tls13() can be used for TLS v1.3 ciphers only. Note: The old cipher-suite("list:of:ciphers") option restricts only the TLS v1.2-and-older cipher suite for backward compatibility. (#3907<https://github.com/syslog-ng/syslog-ng/pull/3907>) * file() destination: added a new option: symlink-as() This feature allows one to maintain a persistent symlink to a log file when a template is used (for example: /var/log/cron -> /var/log/cron.${YEAR}${MONTH}). Example usage: destination d_file_cron { file("/var/log/cron.${YEAR}${MONTH}" symlink-as("/var/log/cron")); }; >From a functional perspective, the symlink-as file inherits both create-dirs and file ownership from its file destination (permissions are not applicable to symlinks, at least on linux). The symlink is adjusted at the time a new destination file is opened (in the example above, if ${YEAR} or ${MONTH} changes). Although not specific to time macros, that's where the usefulness is. If the template contains something like ${PROGRAM} or ${HOST}, the configuration wouldn't necessarily be invalid, but you'd get an ever-changing symlink of dubious usefulness. (#3855<https://github.com/syslog-ng/syslog-ng/pull/3855>) * flags(no-rfc3164-fallback): added a new flag to sources that parse incoming syslog data and operate in RFC5424 mode (e.g. syslog-protocol is also set). With the new flag the automatic fallback to RFC3164 format is disabled. In this case if the parsing in RFC5424 fails, the syslog parser would result in an error message. In the case of syslog-parser(drop-invalid(yes)), the message would be dropped. (#3891<https://github.com/syslog-ng/syslog-ng/pull/3891>) * syslog-format: accept ISO timestamps that incorrectly use a space instead of a 'T' to delimit the date from the time portion. For example, a "2021-01-01T12:12:12" timestamp is well formed according to RFC5424 (which uses a subset of ISO8601, see https://datatracker.ietf.org/doc/html/rfc5424#section-6.2.3) Some systems simply use a space instead of a 'T'. The same format is accepted for both RFC3164 (e.g. udp(), tcp() and network() sources) and RFC5424 (e.g. syslog() source). (#3893<https://github.com/syslog-ng/syslog-ng/pull/3893>) * transport(text-with-nuls): added a new transport mechanism for the network() driver that allows NUL characters within the message. Note: syslog-ng does not support embedded NUL characters everywhere, so it is recommended that you also use flags(no-multi-line) that causes NUL characters to be replaced by space. (#3913<https://github.com/syslog-ng/syslog-ng/pull/3913>) Bugfixes * filter: fixed the not operator in filter expressions (regression in v3.35.1) Reusing a filter that contains the not operator more than once, or referencing a complex expression containing not might have caused invalid results in the previous syslog-ng version (v3.35.1). This has been fixed. (#3863<https://github.com/syslog-ng/syslog-ng/pull/3863>) * throttle() filter: support negation (#3863<https://github.com/syslog-ng/syslog-ng/pull/3863>) * disk-buffer(): fixed a crash which could happen in very rare cases, while a corrupted disk-buffer was getting replaced (#3845<https://github.com/syslog-ng/syslog-ng/pull/3845>) * disk-buffer(): fixed a memory leak issue and inconsistent buffer handling in rare cases (#3887<https://github.com/syslog-ng/syslog-ng/pull/3887>) * disk-buffer(): fixed underflowing queued stats counter (#3887<https://github.com/syslog-ng/syslog-ng/pull/3887>) * disk-buffer(): fixed queued stats were not adjusted when a disk-buffer became corrupt (#3851<https://github.com/syslog-ng/syslog-ng/pull/3851>) * disk-buffer(): fixed a disk-buffer corruption issue A completely filled and then emptied disk-buffer may have been recognised as corrupt. (#3874<https://github.com/syslog-ng/syslog-ng/pull/3874>) * amqp(): fixed a minor error reporting problem. (#3869<https://github.com/syslog-ng/syslog-ng/pull/3869>) * amqp(): syslog-ng now drops messages that are too large to send (#3869<https://github.com/syslog-ng/syslog-ng/pull/3869>) * amqp(): fixed a crash, which happened with librabbitmq v0.9.0 or v0.10.0, while using the tls() block. (#3929<https://github.com/syslog-ng/syslog-ng/pull/3929>) * file() source: fixed invalid buffer handling when encoding() is used A bug has been fixed that - under rare circumstances - could cause message duplication or partial message loss when non-fixed length or less known fixed-length encodings are used. (#3892<https://github.com/syslog-ng/syslog-ng/pull/3892>) * syslog-ng: fixed a SIGSEGV triggered by an incorrectly formatted "CONFIG" command, received on the syslog-ng control socket. The only known implementation of the control protocol is syslog-ng-ctl itself, which always sends a correct command, but anyone with access to the UNIX domain socket syslog-ng.ctl (root only by default) can trigger a crash. (#3900<https://github.com/syslog-ng/syslog-ng/pull/3900>) * credit-card-mask(): fixed visa, mastercard and jcb card regex pattern (#3853<https://github.com/syslog-ng/syslog-ng/pull/3853>) * cisco-parser(): allow a leading dot in the timestamp (not synced clocks) (#3843<https://github.com/syslog-ng/syslog-ng/pull/3843>) Notes to developers * plugins: we have made it easier to implement filter plugins An example can be found under modules/rate-limit-filter. (#3866<https://github.com/syslog-ng/syslog-ng/pull/3866>) * dev-utils: various fixes for the plugin skeleton generator script (#3866<https://github.com/syslog-ng/syslog-ng/pull/3866>) Other changes * The syslog-ng Docker image<https://hub.docker.com/r/balabit/syslog-ng/> is now automatically tagged and pushed to Docker Hub after each release (#3870<https://github.com/syslog-ng/syslog-ng/pull/3870>) * throttle() filter: renamed to rate-limit() (#3866<https://github.com/syslog-ng/syslog-ng/pull/3866>) * python: support Python 3.10 (#3865<https://github.com/syslog-ng/syslog-ng/pull/3865>) * java: upgraded from old log4j v1.x line to log4j v2.17.2 (#3861<https://github.com/syslog-ng/syslog-ng/pull/3861>) (#3927<https://github.com/syslog-ng/syslog-ng/pull/3927>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Andrea Biardi, Attila Szakacs, Balazs Scheidler, Balázs Barkó, Benedek Cserhati, Gabor Nagy, Janos SZIGETVARI, Laszlo Budai, Laszlo Szemere, László Várady, Mikel Olasagasti Uranga, Norbert Takacs, Parrag Szilárd, Peter Kokai, Szilárd Parrag, Zoltan Pallagi, Stanislav Osipov, Yash Mathne <https://github.com/syslog-ng/syslog-ng#installation-from-binaries>Installation from binaries https://github.com/syslog-ng/syslog-ng#installation-from-binaries

1 0