- syslog-ng - lists.balabit.hu

graylog2 plugin not found
by Daniel Estermann 03 Mar '22

03 Mar '22

Hi Fabien, that's it, thank you very much for the quick response! Kinda clairvoyant btw ;-) Best regards Daniel Am 03.03.22, 13:24 schrieb "syslog-ng im Auftrag von Fabien Wernli" <syslog-ng-bounces(a)lists.balabit.hu im Auftrag von wernli(a)in2p3.fr>: Hi Daniel, Could you show your full config ? I think you might be missing the following directive: @include "scl.conf" [http://www.ti8m.com/dam/jcr:59611d49-12ae-460f-b117-37384c0a05c7] <https://www.ti8m.com/insights/downloads/special-security>

1 0

graylog2 plugin not found
by Daniel Estermann 03 Mar '22

03 Mar '22

Hi everybody, I am running RHEL 8.5 ➜ ~ head -2 /etc/os-release NAME="Red Hat Enterprise Linux" VERSION="8.5 (Ootpa)" ➜ ~ uname -a Linux zhm-lm00 4.18.0-348.12.2.el8_5.x86_64 #1 SMP Mon Jan 17 07:06:06 EST 2022 x86_64 x86_64 x86_64 GNU/Linux The installation of syslog-ng was performed via DNF using EPEL repository: ➜ ~ dnf install -y syslog-ng >8.......8< Installing: syslog-ng x86_64 3.23.1-2.el8 epel 842 k Installing dependencies: ivykis x86_64 0.42.4-2.el8 epel 47 k libnet x86_64 1.1.6-15.el8 rhel-8-for-x86_64-appstream-rpms 67 k >8.......8< Now, I was trying to configure transport of syslog to graylog using the following documentation: https://www.syslog-ng.com/community/b/blog/posts/graylog-destination-syslog… However, I've received the following error message, when i tried to start syslog-ng with the new configuration: Error parsing destination statement, destination plugin graylog2 not found in /etc/syslog-ng/syslog-ng.conf:9:5-9:13: 4 }; 5 6 filter f_gitlab_runner {"${.SDATA.journald._SYSTEMD_UNIT}" eq "gitlab-runner.service"}; 7 8 destination d_graylog { 9-----> graylog2( 9-----> ^^^^^^^^ 10 host("[MASKED]") 11 port(12201) 12 transport(tcp) 13 ); 14 }; syslog-ng documentation: https://www.balabit.com/support/documentation?product=syslog-ng-ose contact: https://lists.balabit.hu/mailman/listinfo/syslog-ng Do I have to install that plugin separately? How to do that? Kind Regards Daniel Estermann [http://www.ti8m.com/dam/jcr:59611d49-12ae-460f-b117-37384c0a05c7] <https://www.ti8m.com/insights/downloads/special-security>

2 1

Syslog-ng v3.31 destination option not working
by Maurya, Shivani 25 Feb '22

25 Feb '22

Hi, I am referring the syslog-ng admin guide - https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edi… and using the snmp() destination option. The following is included in my syslog-ng.conf file as part of destination - destination d_snmpv2c{ snmp( version('v2c') host('192.168.1.1') trap-obj('.1.3.6.1.6.3.1.1.4.1.0', 'Objectid', '.1.3.6.1.4.1.18372.3.1.1.1.2.1') snmp-obj('.1.3.6.1.4.1.18372.3.1.1.1.1.1.0', 'Octetstring', 'Test SNMP trap') snmp-obj('.1.3.6.1.4.1.18372.3.1.1.1.1.2.0', 'Octetstring', 'admin') snmp-obj('.1.3.6.1.4.1.18372.3.1.1.1.1.3.0', 'Ipaddress', '192.168.1.1') ); }; But syslog-ng service/daemon is not starting & pointing error at snmp(). Can you please help on this? FYI - I am using RHEL7. Regards, Shivani Maurya

3 5

allowed concurrent connections - bug?
by Evan Rempel 18 Feb '22

18 Feb '22

I am having an issue that is a little difficult to reproduce so I wanted some input from others. I have a syslog-ng 3.35.1 that has a TLS source defined with max-connections(10000) After some time the server starts logging a lot of messages syslog-ng[12802]: Number of allowed concurrent connections reached, rejecting connection; client='AF_INET(XXXX:61062)', local='AF_INET(YYYY:6514)', group_name='client_network_tcp', location='/etc/syslog-ng/syslog-ng.server.conf:61:9', max='10000' To the best of my ability I can only find about 2500 actual connections. Both lsof and netstat report around the 2500 connections. I had to restart syslog-ng to stop this situation. Has anyone seen this behavior before? I get a lot of TLS connections without a certificate. Error reading RFC6587 style framed data Pperhaps the counters are not decremented for those timed out connections? -- Evan Rempel

2 5

Yocto: build syslog-ng with Python support
by Christian Hollermann 16 Feb '22

16 Feb '22

Hi, in our project we use a Yocto based build system (branch dunfell, Linux Kernel 5.10) for a while. At the next step, we plan to capture log messages from different sources with the help of syslog-ng (3.24.1). For some sources we will use a Python script that implements an interface to another system. Our problem is now, that we cannot build syslog-ng with a working Python support. Our build completes successfully, but the newly generated library 'libmod-python.so' seems to be broken as we get an error message when we use the following command to verify the installation. syslog-ng --module-registry | grep python Error opening plugin module; module='mod-python', error='/usr/lib/syslog-ng/libmod-python.so: undefined symbol: PyExc_ValueError' Module: mod-python Status: Unable to dlopen shared object, probably not a syslog-ng module Below you can see our current syslog recipe. syslog-ng_%.bbappend: FILESEXTRAPATHS_append := ":${THISDIR}/${PN}" DEPENDS += " python3 " # Override of default config file SRC_URI += "file://syslog-ng.conf.systemd" # Just to be sure EXTRA_OECONF_remove = "--disable-python" # Enable Python Support EXTRA_OECONF += "--enable-python --with-python=3" Can you give us hint, how to to fix this behavior? Thanks and Regards, Christian

1 0

syslog-ng OSE v3.30.1 - slowdown when using env variable in destination clause
by Wilson, Jonathan L 14 Feb '22

14 Feb '22

I have a pair of syslog-ng OSE servers on different LANs, which forward some of the log entries that they receive to separate collectors. In other words, Syslog-A -> collector-A Syslog-B -> collector-B I would like for the two syslog servers to use a common syslog-ng.conf for obvious reasons. I first built destination clauses with the separate IPs, like so: destination d_collector { udp( "192.168.1.23" port(514) template("${DATE} ${HOST} ${MSG}") ); }; This worked fine. But when I define an environment variable, COLLECTOR_IP, and then change my configuration to: destination d_collector { udp( "`COLLECTOR_IP`" port(514) template("${DATE} ${HOST} ${MSG}") ); }; Then syslog-ng's throughput slows down to a trickle (but does continue); CPU utilization (ordinarily substantial - this is a busy log handler) drops to near zero. Changing the configurations back to use the raw IP address restored previous throughput. There are no unusual messages in syslog-ng's own logfile. Anyone seen this puzzling behavior? Thanks, Jon Wilson jonathan.wilson(a)vumc.org<mailto:jonathan.wilson@vumc.org>

2 1

syslog-ng 3.35.1-2.el7
by Evan Rempel 10 Feb '22

10 Feb '22

The packaged syslog-ng RPM for RHEL7 from the stable copr repo https://copr-be.cloud.fedoraproject.org/results/czanik/syslog-ng-stable fails to have a dependency specified for glib library with a large enough version to satisfy the runtime requirements. The syslog-ng package has a requirement listed of "libglib-2.0.so.0()(64bit)" but if there is an older glib2 package installed that satisfies this requirement syslog-ng will fail to start with an error /usr/sbin/syslog-ng: symbol lookup error: /usr/lib64/libsyslog-ng-3.35.so.0: undefined symbol: g_ptr_array_find_with_equal_func Can the package maintainer add a >= version specification to the requirements so that the install of syslog-ng will automatically update to a version of glib2 that works with syslog-ng? -- Evan Rempel

4 5

Insider 2022-01: Reboot; Sequence; Monterey; CentOS 9;
by Peter Czanik (pczanik) 10 Feb '22

10 Feb '22

Dear syslog-ng users, This is the 98th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS syslog-ng relaunch ------------------ Balázs Scheidler, founder of the syslog-ng project, started a new blog where he details why and how he started to work on syslog-ng even more actively. He also asks for your feedback! “syslog-ng has been around for decades: I started coding the first version of syslog-ng in September 1998, circa 24 years ago. The adoption of syslog-ng skyrocketed soon after that: people installed it in place of the traditional syslogd across the globe. It was packaged for Debian, Gentoo, SUSE and even commercial UNIXes. It became a default logging daemon in some of these Linux distributions. Commercial products started embedding it as a system component. Over the years however I feel that syslog-ng has become a trusted piece of infrastructure, few people really care about. I set out to change that.” Read the rest of the blog at https://syslog-ng-future.blog/syslog-ng-relaunch/ Sequence – making PatternDB creation for syslog-ng easier --------------------------------------------------------- We are well into the 21st century, but most of the log messages still arrive in an unstructured format. For well over a decade, syslog-ng had a solution to turn unstructured messages into name-value pairs, called PatternDB. However, creating a pattern database for PatternDB from scratch is a source of major pain. Or rather, it was: sequence-rtg – a fork of the sequence log analyzer – provides a new hope! It can easily create ready-to-use patterns for your most frequent log messages. Sequence-rtg is still in beta phase, and therefore is a bit rough around the edges. However, once you deal with the initial struggles of creating the database, it works just fine. Especially if you have lots of log messages. My experience was that the more log messages and larger batch sizes I had, the better quality patterns were generated. https://www.syslog-ng.com/community/b/blog/posts/sequence-making-patterndb-… Syslog-ng on MacOS Monterey --------------------------- Each new MacOS release brings some surprises when it comes to compiling syslog-ng. Just a couple of months ago, I provided you with a couple of pointers on how to compile syslog-ng on MacOS. Since then, MacOS Monterey was released and Homebrew was updated. So, here are some updated instructions for MacOS Monterey. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-on-macos-monterey Installing syslog-ng on CentOS Stream 9 --------------------------------------- CentOS Stream 9 has been around for a while, but it was officially announced just a few days ago. I already tested some earlier snapshots and they had some rough edges. The current version installed without random crashes, has networking and runs smoothly. EPEL – the semi-official repository by Fedora maintainers – is already there, but practically empty, syslog-ng or it’s dependencies are not yet there. As someone asked about syslog-ng support, I had a first try at building it. https://www.syslog-ng.com/community/b/blog/posts/installing-syslog-ng-on-ce… WEBINARS * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Re: [syslog-ng] destination plugin syslog-ng not found
by Clayton Dukes 13 Jan '22

13 Jan '22

Interesting. I didn't work until I added syslog-ng-mod-extra Clayton Dukes CEO, LogZilla Corporation <http://www.linkedin.com/in/lzcdukes/> <http://twitter.com/logzilla> (855) LogZilla <tel:(855)%20LogZilla> 9106.CDUKES <tel:(910)%20623-8537> cdukes(a)logzilla.net <mailto:cdukes@logzilla.net> logzilla.net <http://logzilla.net/> 4819 Emperor Blvd., Suite 400, Raleigh, NC, 27703 <https://calendly.com/teamneo/logzilla-neo-discovery> Schedule a 15 minute demo <https://calendly.com/teamneo/logzilla-neo-discovery> <https://youtu.be/yGQqkXegdoo> LZ in 4 Minutes <https://youtu.be/yGQqkXegdoo> LogZilla Corporation delivers a Centralized Log Management (CLM) platform, designed for IT Operations, Security, and Risk Management leaders who want to gain better incident investigation capabilities by capturing all network and security related logs into a single log collection platform. On 1/12/22, 2:24 AM, "syslog-ng on behalf of Peter Kokai (pkokai)" <syslog-ng-bounces(a)lists.balabit.hu on behalf of Peter.Kokai(a)oneidentity.com> wrote: Hello, The syslog-ng-core should contain both syslog and syslog-ng destination plugin. -- Kokan ________________________________________ From: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of Clayton Dukes <cdukes(a)logzilla.net> Sent: 12 January 2022 01:36 To: Syslog-ng users' and developers' mailing list Subject: [syslog-ng] destination plugin syslog-ng not found CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe. Hi All, Which Debian/apt module do I need for the `syslog-ng` destination plugin? # apt-cache search syslog-ng syslog-ng - Enhanced system logging daemon (metapackage) syslog-ng-core - Enhanced system logging daemon (core) syslog-ng-dbg - Enhanced system logging daemon (debug symbols) syslog-ng-dev - Enhanced system logging daemon (development files) syslog-ng-mod-add-contextual-data - Enhanced system logging daemon (add-contextual-data plugin) syslog-ng-mod-amqp - Enhanced system logging daemon (AMQP plugin) syslog-ng-mod-examples - Enhanced system logging daemon (example plugins) syslog-ng-mod-extra - Enhanced system logging daemon (extra plugins) syslog-ng-mod-geoip2 - Enhanced system logging daemon (GeoIP2 plugin) syslog-ng-mod-getent - Enhanced system logging daemon (getent plugin) syslog-ng-mod-graphite - Enhanced system logging daemon (graphite plugin) syslog-ng-mod-http - Enhanced system logging daemon (HTTP destination) syslog-ng-mod-map-value-pairs - Enhanced system logging daemon (map-value-pairs plugin) syslog-ng-mod-mongodb - Enhanced system logging daemon (MongoDB plugin) syslog-ng-mod-python - Enhanced system logging daemon (Python plugin) syslog-ng-mod-rdkafka - Enhanced system logging daemon (Kafka destination, based on librdkafka) syslog-ng-mod-redis - Enhanced system logging daemon (Redis plugin) syslog-ng-mod-riemann - Enhanced system logging daemon (Riemann destination) syslog-ng-mod-slog - Enhanced system logging daemon (secure logging plugin) syslog-ng-mod-smtp - Enhanced system logging daemon (SMTP plugin) syslog-ng-mod-snmp - Enhanced system logging daemon (SNMP plugin) syslog-ng-mod-sql - Enhanced system logging daemon (SQL plugin) syslog-ng-mod-stardate - Enhanced system logging daemon (stardate plugin) syslog-ng-mod-stomp - Enhanced system logging daemon (STOMP plugin) syslog-ng-mod-xml-parser - Enhanced system logging daemon (xml parser plugin) [photo] [signature_870575490] Clayton Dukes CEO, LogZilla Corporation [signature_1853374605]<https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.linked…> [signature_1525617044]<https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Ftwitter.co…> [signature_470467322] (855) LogZilla<tel:(855)%20LogZilla> [signature_1064870479] 9106.CDUKES<tel:(910)%20623-8537> [signature_288996986] cdukes(a)logzilla.net<mailto:cdukes@logzilla.net> [signature_2057347955] logzilla.net<https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Flogzilla.n…> [signature_518161642] 4819 Emperor Blvd., Suite 400, Raleigh, NC, 27703 [signature_1426204243]<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcalendly.…> Schedule a 15 minute demo<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcalendly.…> [signature_1135219367]<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fyoutu.be%…> [signature_1977302009]LZ in 4 Minutes<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fyoutu.be%…> LogZilla Corporation delivers a Centralized Log Management (CLM) platform, designed for IT Operations, Security, and Risk Management leaders who want to gain better incident investigation capabilities by capturing all network and security related logs into a single log collection platform. [Logo Description automatically generated] IMPORTANT NOTICE: This e-mail message is intended to be received only by persons entitled to receive the confidential information it may contain. E-mail messages to clients of Logzilla Corporation may contain information that is confidential and legally privileged. Please do not read, copy, forward, or store this message unless you are an intended recipient of it. If you have received this message in error, please forward it to the sender and delete it completely from your computer system. ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq IMPORTANT NOTICE: This e-mail message is intended to be received only by persons entitled to receive the confidential information it may contain. E-mail messages to clients of Logzilla Corporation may contain information that is confidential and legally privileged. Please do not read, copy, forward, or store this message unless you are an intended recipient of it. If you have received this message in error, please forward it to the sender and delete it completely from your computer system.

3 6

destination plugin syslog-ng not found
by Clayton Dukes 12 Jan '22

12 Jan '22

Hi All, Which Debian/apt module do I need for the `syslog-ng` destination plugin? # apt-cache search syslog-ng syslog-ng - Enhanced system logging daemon (metapackage) syslog-ng-core - Enhanced system logging daemon (core) syslog-ng-dbg - Enhanced system logging daemon (debug symbols) syslog-ng-dev - Enhanced system logging daemon (development files) syslog-ng-mod-add-contextual-data - Enhanced system logging daemon (add-contextual-data plugin) syslog-ng-mod-amqp - Enhanced system logging daemon (AMQP plugin) syslog-ng-mod-examples - Enhanced system logging daemon (example plugins) syslog-ng-mod-extra - Enhanced system logging daemon (extra plugins) syslog-ng-mod-geoip2 - Enhanced system logging daemon (GeoIP2 plugin) syslog-ng-mod-getent - Enhanced system logging daemon (getent plugin) syslog-ng-mod-graphite - Enhanced system logging daemon (graphite plugin) syslog-ng-mod-http - Enhanced system logging daemon (HTTP destination) syslog-ng-mod-map-value-pairs - Enhanced system logging daemon (map-value-pairs plugin) syslog-ng-mod-mongodb - Enhanced system logging daemon (MongoDB plugin) syslog-ng-mod-python - Enhanced system logging daemon (Python plugin) syslog-ng-mod-rdkafka - Enhanced system logging daemon (Kafka destination, based on librdkafka) syslog-ng-mod-redis - Enhanced system logging daemon (Redis plugin) syslog-ng-mod-riemann - Enhanced system logging daemon (Riemann destination) syslog-ng-mod-slog - Enhanced system logging daemon (secure logging plugin) syslog-ng-mod-smtp - Enhanced system logging daemon (SMTP plugin) syslog-ng-mod-snmp - Enhanced system logging daemon (SNMP plugin) syslog-ng-mod-sql - Enhanced system logging daemon (SQL plugin) syslog-ng-mod-stardate - Enhanced system logging daemon (stardate plugin) syslog-ng-mod-stomp - Enhanced system logging daemon (STOMP plugin) syslog-ng-mod-xml-parser - Enhanced system logging daemon (xml parser plugin) [photo] [signature_870575490] Clayton Dukes CEO, LogZilla Corporation [signature_1853374605]<http://www.linkedin.com/in/lzcdukes/> [signature_1525617044]<http://twitter.com/logzilla> [signature_470467322] (855) LogZilla<tel:(855)%20LogZilla> [signature_1064870479] 9106.CDUKES<tel:(910)%20623-8537> [signature_288996986] cdukes(a)logzilla.net<mailto:cdukes@logzilla.net> [signature_2057347955] logzilla.net<http://logzilla.net/> [signature_518161642] 4819 Emperor Blvd., Suite 400, Raleigh, NC, 27703 [signature_1426204243]<https://calendly.com/teamneo/logzilla-neo-discovery> Schedule a 15 minute demo<https://calendly.com/teamneo/logzilla-neo-discovery> [signature_1135219367]<https://youtu.be/yGQqkXegdoo> [signature_1977302009]LZ in 4 Minutes<https://youtu.be/yGQqkXegdoo> LogZilla Corporation delivers a Centralized Log Management (CLM) platform, designed for IT Operations, Security, and Risk Management leaders who want to gain better incident investigation capabilities by capturing all network and security related logs into a single log collection platform. [Logo Description automatically generated] IMPORTANT NOTICE: This e-mail message is intended to be received only by persons entitled to receive the confidential information it may contain. E-mail messages to clients of Logzilla Corporation may contain information that is confidential and legally privileged. Please do not read, copy, forward, or store this message unless you are an intended recipient of it. If you have received this message in error, please forward it to the sender and delete it completely from your computer system.

2 1