- syslog-ng - lists.balabit.hu

syslog-ng OSE v3.30.1 - slowdown when using env variable in destination clause
by Wilson, Jonathan L 14 Feb '22

14 Feb '22

I have a pair of syslog-ng OSE servers on different LANs, which forward some of the log entries that they receive to separate collectors. In other words, Syslog-A -> collector-A Syslog-B -> collector-B I would like for the two syslog servers to use a common syslog-ng.conf for obvious reasons. I first built destination clauses with the separate IPs, like so: destination d_collector { udp( "192.168.1.23" port(514) template("${DATE} ${HOST} ${MSG}") ); }; This worked fine. But when I define an environment variable, COLLECTOR_IP, and then change my configuration to: destination d_collector { udp( "`COLLECTOR_IP`" port(514) template("${DATE} ${HOST} ${MSG}") ); }; Then syslog-ng's throughput slows down to a trickle (but does continue); CPU utilization (ordinarily substantial - this is a busy log handler) drops to near zero. Changing the configurations back to use the raw IP address restored previous throughput. There are no unusual messages in syslog-ng's own logfile. Anyone seen this puzzling behavior? Thanks, Jon Wilson jonathan.wilson(a)vumc.org<mailto:jonathan.wilson@vumc.org>

2 1

syslog-ng 3.35.1-2.el7
by Evan Rempel 10 Feb '22

10 Feb '22

The packaged syslog-ng RPM for RHEL7 from the stable copr repo https://copr-be.cloud.fedoraproject.org/results/czanik/syslog-ng-stable fails to have a dependency specified for glib library with a large enough version to satisfy the runtime requirements. The syslog-ng package has a requirement listed of "libglib-2.0.so.0()(64bit)" but if there is an older glib2 package installed that satisfies this requirement syslog-ng will fail to start with an error /usr/sbin/syslog-ng: symbol lookup error: /usr/lib64/libsyslog-ng-3.35.so.0: undefined symbol: g_ptr_array_find_with_equal_func Can the package maintainer add a >= version specification to the requirements so that the install of syslog-ng will automatically update to a version of glib2 that works with syslog-ng? -- Evan Rempel

4 5

Insider 2022-01: Reboot; Sequence; Monterey; CentOS 9;
by Peter Czanik (pczanik) 10 Feb '22

10 Feb '22

Dear syslog-ng users, This is the 98th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS syslog-ng relaunch ------------------ Balázs Scheidler, founder of the syslog-ng project, started a new blog where he details why and how he started to work on syslog-ng even more actively. He also asks for your feedback! “syslog-ng has been around for decades: I started coding the first version of syslog-ng in September 1998, circa 24 years ago. The adoption of syslog-ng skyrocketed soon after that: people installed it in place of the traditional syslogd across the globe. It was packaged for Debian, Gentoo, SUSE and even commercial UNIXes. It became a default logging daemon in some of these Linux distributions. Commercial products started embedding it as a system component. Over the years however I feel that syslog-ng has become a trusted piece of infrastructure, few people really care about. I set out to change that.” Read the rest of the blog at https://syslog-ng-future.blog/syslog-ng-relaunch/ Sequence – making PatternDB creation for syslog-ng easier --------------------------------------------------------- We are well into the 21st century, but most of the log messages still arrive in an unstructured format. For well over a decade, syslog-ng had a solution to turn unstructured messages into name-value pairs, called PatternDB. However, creating a pattern database for PatternDB from scratch is a source of major pain. Or rather, it was: sequence-rtg – a fork of the sequence log analyzer – provides a new hope! It can easily create ready-to-use patterns for your most frequent log messages. Sequence-rtg is still in beta phase, and therefore is a bit rough around the edges. However, once you deal with the initial struggles of creating the database, it works just fine. Especially if you have lots of log messages. My experience was that the more log messages and larger batch sizes I had, the better quality patterns were generated. https://www.syslog-ng.com/community/b/blog/posts/sequence-making-patterndb-… Syslog-ng on MacOS Monterey --------------------------- Each new MacOS release brings some surprises when it comes to compiling syslog-ng. Just a couple of months ago, I provided you with a couple of pointers on how to compile syslog-ng on MacOS. Since then, MacOS Monterey was released and Homebrew was updated. So, here are some updated instructions for MacOS Monterey. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-on-macos-monterey Installing syslog-ng on CentOS Stream 9 --------------------------------------- CentOS Stream 9 has been around for a while, but it was officially announced just a few days ago. I already tested some earlier snapshots and they had some rough edges. The current version installed without random crashes, has networking and runs smoothly. EPEL – the semi-official repository by Fedora maintainers – is already there, but practically empty, syslog-ng or it’s dependencies are not yet there. As someone asked about syslog-ng support, I had a first try at building it. https://www.syslog-ng.com/community/b/blog/posts/installing-syslog-ng-on-ce… WEBINARS * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Re: [syslog-ng] destination plugin syslog-ng not found
by Clayton Dukes 13 Jan '22

13 Jan '22

Interesting. I didn't work until I added syslog-ng-mod-extra Clayton Dukes CEO, LogZilla Corporation <http://www.linkedin.com/in/lzcdukes/> <http://twitter.com/logzilla> (855) LogZilla <tel:(855)%20LogZilla> 9106.CDUKES <tel:(910)%20623-8537> cdukes(a)logzilla.net <mailto:cdukes@logzilla.net> logzilla.net <http://logzilla.net/> 4819 Emperor Blvd., Suite 400, Raleigh, NC, 27703 <https://calendly.com/teamneo/logzilla-neo-discovery> Schedule a 15 minute demo <https://calendly.com/teamneo/logzilla-neo-discovery> <https://youtu.be/yGQqkXegdoo> LZ in 4 Minutes <https://youtu.be/yGQqkXegdoo> LogZilla Corporation delivers a Centralized Log Management (CLM) platform, designed for IT Operations, Security, and Risk Management leaders who want to gain better incident investigation capabilities by capturing all network and security related logs into a single log collection platform. On 1/12/22, 2:24 AM, "syslog-ng on behalf of Peter Kokai (pkokai)" <syslog-ng-bounces(a)lists.balabit.hu on behalf of Peter.Kokai(a)oneidentity.com> wrote: Hello, The syslog-ng-core should contain both syslog and syslog-ng destination plugin. -- Kokan ________________________________________ From: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of Clayton Dukes <cdukes(a)logzilla.net> Sent: 12 January 2022 01:36 To: Syslog-ng users' and developers' mailing list Subject: [syslog-ng] destination plugin syslog-ng not found CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe. Hi All, Which Debian/apt module do I need for the `syslog-ng` destination plugin? # apt-cache search syslog-ng syslog-ng - Enhanced system logging daemon (metapackage) syslog-ng-core - Enhanced system logging daemon (core) syslog-ng-dbg - Enhanced system logging daemon (debug symbols) syslog-ng-dev - Enhanced system logging daemon (development files) syslog-ng-mod-add-contextual-data - Enhanced system logging daemon (add-contextual-data plugin) syslog-ng-mod-amqp - Enhanced system logging daemon (AMQP plugin) syslog-ng-mod-examples - Enhanced system logging daemon (example plugins) syslog-ng-mod-extra - Enhanced system logging daemon (extra plugins) syslog-ng-mod-geoip2 - Enhanced system logging daemon (GeoIP2 plugin) syslog-ng-mod-getent - Enhanced system logging daemon (getent plugin) syslog-ng-mod-graphite - Enhanced system logging daemon (graphite plugin) syslog-ng-mod-http - Enhanced system logging daemon (HTTP destination) syslog-ng-mod-map-value-pairs - Enhanced system logging daemon (map-value-pairs plugin) syslog-ng-mod-mongodb - Enhanced system logging daemon (MongoDB plugin) syslog-ng-mod-python - Enhanced system logging daemon (Python plugin) syslog-ng-mod-rdkafka - Enhanced system logging daemon (Kafka destination, based on librdkafka) syslog-ng-mod-redis - Enhanced system logging daemon (Redis plugin) syslog-ng-mod-riemann - Enhanced system logging daemon (Riemann destination) syslog-ng-mod-slog - Enhanced system logging daemon (secure logging plugin) syslog-ng-mod-smtp - Enhanced system logging daemon (SMTP plugin) syslog-ng-mod-snmp - Enhanced system logging daemon (SNMP plugin) syslog-ng-mod-sql - Enhanced system logging daemon (SQL plugin) syslog-ng-mod-stardate - Enhanced system logging daemon (stardate plugin) syslog-ng-mod-stomp - Enhanced system logging daemon (STOMP plugin) syslog-ng-mod-xml-parser - Enhanced system logging daemon (xml parser plugin) [photo] [signature_870575490] Clayton Dukes CEO, LogZilla Corporation [signature_1853374605]<https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.linked…> [signature_1525617044]<https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Ftwitter.co…> [signature_470467322] (855) LogZilla<tel:(855)%20LogZilla> [signature_1064870479] 9106.CDUKES<tel:(910)%20623-8537> [signature_288996986] cdukes(a)logzilla.net<mailto:cdukes@logzilla.net> [signature_2057347955] logzilla.net<https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Flogzilla.n…> [signature_518161642] 4819 Emperor Blvd., Suite 400, Raleigh, NC, 27703 [signature_1426204243]<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcalendly.…> Schedule a 15 minute demo<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcalendly.…> [signature_1135219367]<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fyoutu.be%…> [signature_1977302009]LZ in 4 Minutes<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fyoutu.be%…> LogZilla Corporation delivers a Centralized Log Management (CLM) platform, designed for IT Operations, Security, and Risk Management leaders who want to gain better incident investigation capabilities by capturing all network and security related logs into a single log collection platform. [Logo Description automatically generated] IMPORTANT NOTICE: This e-mail message is intended to be received only by persons entitled to receive the confidential information it may contain. E-mail messages to clients of Logzilla Corporation may contain information that is confidential and legally privileged. Please do not read, copy, forward, or store this message unless you are an intended recipient of it. If you have received this message in error, please forward it to the sender and delete it completely from your computer system. ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq IMPORTANT NOTICE: This e-mail message is intended to be received only by persons entitled to receive the confidential information it may contain. E-mail messages to clients of Logzilla Corporation may contain information that is confidential and legally privileged. Please do not read, copy, forward, or store this message unless you are an intended recipient of it. If you have received this message in error, please forward it to the sender and delete it completely from your computer system.

3 6

destination plugin syslog-ng not found
by Clayton Dukes 12 Jan '22

12 Jan '22

Hi All, Which Debian/apt module do I need for the `syslog-ng` destination plugin? # apt-cache search syslog-ng syslog-ng - Enhanced system logging daemon (metapackage) syslog-ng-core - Enhanced system logging daemon (core) syslog-ng-dbg - Enhanced system logging daemon (debug symbols) syslog-ng-dev - Enhanced system logging daemon (development files) syslog-ng-mod-add-contextual-data - Enhanced system logging daemon (add-contextual-data plugin) syslog-ng-mod-amqp - Enhanced system logging daemon (AMQP plugin) syslog-ng-mod-examples - Enhanced system logging daemon (example plugins) syslog-ng-mod-extra - Enhanced system logging daemon (extra plugins) syslog-ng-mod-geoip2 - Enhanced system logging daemon (GeoIP2 plugin) syslog-ng-mod-getent - Enhanced system logging daemon (getent plugin) syslog-ng-mod-graphite - Enhanced system logging daemon (graphite plugin) syslog-ng-mod-http - Enhanced system logging daemon (HTTP destination) syslog-ng-mod-map-value-pairs - Enhanced system logging daemon (map-value-pairs plugin) syslog-ng-mod-mongodb - Enhanced system logging daemon (MongoDB plugin) syslog-ng-mod-python - Enhanced system logging daemon (Python plugin) syslog-ng-mod-rdkafka - Enhanced system logging daemon (Kafka destination, based on librdkafka) syslog-ng-mod-redis - Enhanced system logging daemon (Redis plugin) syslog-ng-mod-riemann - Enhanced system logging daemon (Riemann destination) syslog-ng-mod-slog - Enhanced system logging daemon (secure logging plugin) syslog-ng-mod-smtp - Enhanced system logging daemon (SMTP plugin) syslog-ng-mod-snmp - Enhanced system logging daemon (SNMP plugin) syslog-ng-mod-sql - Enhanced system logging daemon (SQL plugin) syslog-ng-mod-stardate - Enhanced system logging daemon (stardate plugin) syslog-ng-mod-stomp - Enhanced system logging daemon (STOMP plugin) syslog-ng-mod-xml-parser - Enhanced system logging daemon (xml parser plugin) [photo] [signature_870575490] Clayton Dukes CEO, LogZilla Corporation [signature_1853374605]<http://www.linkedin.com/in/lzcdukes/> [signature_1525617044]<http://twitter.com/logzilla> [signature_470467322] (855) LogZilla<tel:(855)%20LogZilla> [signature_1064870479] 9106.CDUKES<tel:(910)%20623-8537> [signature_288996986] cdukes(a)logzilla.net<mailto:cdukes@logzilla.net> [signature_2057347955] logzilla.net<http://logzilla.net/> [signature_518161642] 4819 Emperor Blvd., Suite 400, Raleigh, NC, 27703 [signature_1426204243]<https://calendly.com/teamneo/logzilla-neo-discovery> Schedule a 15 minute demo<https://calendly.com/teamneo/logzilla-neo-discovery> [signature_1135219367]<https://youtu.be/yGQqkXegdoo> [signature_1977302009]LZ in 4 Minutes<https://youtu.be/yGQqkXegdoo> LogZilla Corporation delivers a Centralized Log Management (CLM) platform, designed for IT Operations, Security, and Risk Management leaders who want to gain better incident investigation capabilities by capturing all network and security related logs into a single log collection platform. [Logo Description automatically generated] IMPORTANT NOTICE: This e-mail message is intended to be received only by persons entitled to receive the confidential information it may contain. E-mail messages to clients of Logzilla Corporation may contain information that is confidential and legally privileged. Please do not read, copy, forward, or store this message unless you are an intended recipient of it. If you have received this message in error, please forward it to the sender and delete it completely from your computer system.

2 1

laszlo_budai's GPG key expired
by Szmytka, Piotr 03 Jan '22

03 Jan '22

Hi, It seems the GPG key used to sign Debian 10 packages has expired. The deb repository is therefore unusable. Can this be fixed please? $ curl -s http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… | gpg - gpg: WARNING: no command supplied. Trying to guess what you mean ... pub rsa2048 2017-08-25 [SC] [expired: 2021-12-31] F20F51628D04901AD01175013B92A8D27CFDAEDD uid home:laszlo_budai:syslog-ng OBS Project <home:laszlo_budai:syslog-ng@build.opensuse.org> Thanks! --- PIOTR SZMYTKA Senior Systems Engineer, Cloud Engineering piotr.szmytka(a)vimn.com<mailto:piotr.szmytka@vimn.com> VIMN Poland sp. z o.o. ul. Mokotowska 19, 00-560 Warsaw, POLAND [signature_1140942668]

2 1

Insider 2021-12: Humio; Log Management; Panther;
by Peter Czanik (pczanik) 16 Dec '21

16 Dec '21

Dear syslog-ng users, This is the 97th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Sending logs to Panther using syslog-ng --------------------------------------- Panther is an open-source log management system, which is also available as a service for a time-limited trial. It is still in beta phase, but it looks promising. You can see the “beta” sign on its opening page: https://app.panther.support/ I tested the time-limited cloud service version, but you can also install it locally, either from Dockerhub, or you can build the containers locally from the source. Even if it is still in beta phase, Panther comes with detailed documentation. There is a notable exception: while syslog-ng is shown on some of the figures, documenting it is still to be done. This blog helps you to get started with sending logs to Panther, using syslog-ng. You can use either legacy syslog with TLS encryption (still a bit problematic) or the http() destination to send logs to the Panther HTTP API. https://www.syslog-ng.com/community/b/blog/posts/sending-logs-to-panther-us… Reducing the complexity of log management ----------------------------------------- It is easy to over-complicate log management. Almost all departments in a company need to log messages for their daily activities. However, installing several different log management and analysis systems in parallel is a nightmare both from a security and an operations perspective and wastes many resources. You cannot always reduce the number of log analysis systems, but you can reduce the complexity of log management. Let me show you, how. https://www.syslog-ng.com/community/b/blog/posts/reducing-the-complexity-of… Sending logs to Humio using the elasticsearch-http() destination of syslog-ng ------------- One of the most popular syslog-ng destinations is Elasticsearch. Humio, a log management provider, supports a broad range of ingest options and interfaces, including an Elasticsearch-compatible API. Last week, Humio announced Humio Community Edition, which provides the full Humio experience for free, with some limitations on daily ingestion and retention time. I tested the Community Edition, and it works perfectly well with syslog-ng. If you come from the Humio side, you might wonder what syslog-ng is. It is an application for high performance central log collection. Traditionally, syslog messages were collected centrally and saved to text files. Nowadays, syslog-ng acts more like a log management layer: collects log messages from hosts, saves them for long term storage, but also forwards them to multiple destinations, like SIEMs and other log analysis solutions. This way, it is enough to collect log messages only once, and syslog-ng delivers the right log messages to the right destinations in the right format, after some initial processing. Humio is available as a cloud service or self-hosted, where you can send all your logs for storage and analysis. It has an easy-to-use interface to query log messages which can be extended with further analytics possibilities from the Humio marketplace. >From this blog, you can learn how to get started with Humio and syslog-ng. While Humio provides many other APIs for log ingestion, I focus on the elasticsearch-http() destination of syslog-ng, demonstrating that there is no vendor lock-in: the same driver works equally well for Elastic’s Elasticsearch, AWS’s OpenSearch and for Humio. https://www.syslog-ng.com/community/b/blog/posts/sending-logs-to-humio-usin… WEBINARS * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng no longer receiving kernel messages
by John Covici 13 Dec '21

13 Dec '21

Hi folks. I am having a problem that syslog-ng no longer gets any kernel messages. It seems to get other messages, but not kernel messages. Here is what happened. In an update from kernel 5.10.70 to 5.10.82, I enabled the kernel race condition sanitizer. I looked at its output and decided that it would not do me any good, so I took that out and recompiled the kernel. However after rebooting the system, syslog-ng only gives me a few messages from when the kernel sanitizer was active in my /var/log/messages and the same for /var/log/kernel. I am using systemd, so I have the jernal and it is OK, all messages are posted correctly there. Here is my /etc/syslog-ng/syslog-ng.conf . @version: 3.34 # $Header: /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/3.4/syslog-ng.conf.gentoo,v 1.2 2013/06/02 01:18:35 mr_bones_ Exp $ # # Syslog-ng default configuration file for Gentoo Linux # https://bugs.gentoo.org/show_bug.cgi?id=426814 @include "scl.conf" options { dir_perm(0755); perm(0644); chain_hostnames(no); threaded(yes); chain_hostnames(no); # The default action of syslog-ng is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats_freq(43200); # The default action of syslog-ng is to log a MARK line # to the file every 20 minutes. That's seems high for most # people so turn it down to once an hour. Set it to zero # if you don't want the functionality at all. mark_freq(0); keep_hostname(yes); }; source local { system() ; internal(); }; # *.emerg * filter f_9 { level(emerg); }; destination d_6 { usertty("*"); }; log { source(local); filter(f_9); destination(d_6); }; # kern.=debug /var/log/kernel filter f_1 { facility(kern) and level(debug..emerg); }; destination d_1 { file("/var/log/kernel" create_dirs(yes)); }; log { source(local); filter(f_1); destination(d_1); }; # kern.err /dev/console filter f_2 { facility(kern) and level(err..emerg); }; destination d_2 { file("/dev/console" create_dirs(yes)); }; log { source(local); filter(f_2); destination(d_2); }; # *.debug;mail.none;news.none;authpriv.none /var/log/messages filter f_3 { level(debug..emerg); }; filter f_4 { not facility(mail); }; filter f_5 { not facility(news); }; filter f_6 { not facility(authpriv); }; destination d_3 { file("/var/log/messages" create_dirs(yes)); }; log { source(local); filter(f_3); filter(f_4); filter(f_5); filter(f_6); destination(d_3); flags(final flow-control); }; # authpriv.* /var/log/secure filter f_7 { facility(authpriv) and level(debug..emerg); }; destination d_4 { file("/var/log/secure" create_dirs(yes)); }; log { source(local); filter(f_7); destination(d_4); }; # mail.* /var/log/maillog filter f_8 { facility(mail) and level(debug..emerg); }; destination d_5 { file("/var/log/maillog" create_dirs(yes)); }; log { source(local); filter(f_8); destination(d_5); }; # news.=crit /var/log/news/news.crit filter f_10 { facility(news) and level(crit..emerg); }; destination d_7 { file("/var/log/news/news.crit" create_dirs(yes)); }; log { source(local); filter(f_10); destination(d_7); }; # news.=err /var/log/news/news.err filter f_11 { facility(news) and level(err..emerg); }; destination d_8 { file("/var/log/news/news.err" create_dirs(yes)); }; log { source(local); filter(f_11); destination(d_8); }; # news.notice /var/log/news/news.notice filter f_12 { facility(news) and level(notice..emerg); }; destination d_9 { file("/var/log/news/news.notice" create_dirs(yes)); }; log { source(local); filter(f_12); destination(d_9); }; # local7.* /var/log/boot.log filter f_13 { facility(local7) and level(debug..emerg); }; destination d_10 { file("/var/log/boot.log" create_dirs(yes)); }; log { source(local); filter(f_13); destination(d_10); }; # local0.* /var/log/dhcpcd.log filter f_14 { facility(local0) and level(debug..emerg); }; So, what have I been doing wrong, or is it something else? Thanks in advance for any suggestions. destination d_11 { file("/var/log/dhcpcd.log" create_dirs(yes)); }; log { source(local); filter(f_14); destination(d_11); }; -- Your life is like a penny. You're going to lose it. The question is: How do you spend it? John Covici wb2una covici(a)ccs.covici.com

2 4

[patch] new feature for file destination: persistent symlinks
by a.biardi＠tiscali.it 07 Dec '21

07 Dec '21

Hi all, I'm new here. I love syslog-ng: it's well written and documented and each time I need some new feature, I dig up the documentation and I find it's already implemented! Like many others, I use macros in file destinations (say, "/var/log/cron.${YEAR}${MONTH}"), but I also want to maintain a persistent symlink to the current logfile (that would be something like "/var/log/cron") in order to have "easier" access if I'm grepping for something manually. I couldn't find this feature in syslog-ng, so I wrote the code myself; in the configuration file, it looks like this: destination d_file_cron { file("/var/log/cron.${YEAR}${MONTH}" symlink_as("/var/log/cron")); }; It works for me on my Slackware boxes. I'm sharing the patch I put together, hoping that it may be useful to others and perhaps even considered for inclusion in mainstream. From a functional perspective, the "symlink_as" file inherits both "create-dirs" and file ownership from its file destination (permissions are not applicable to symlinks, at least on linux). Patch applies cleanly to latest production release (3.33). I tried to keep the original coding style for easier review (admittedly, the code could have gone into the function that opens the file destination, but I didn't want to change too much). Thanks for the good work and happy logging! Andrea.

3 4

Re: [syslog-ng] [patch] new feature for file destination: persistent symlinks
by a.biardi＠tiscali.it 06 Dec '21

06 Dec '21

On Mon, 6 Dec 2021 15:28:18 +0000, "Gabor Nagy (gnagy)" <Gabor.Nagy(a)oneidentity.com> wrote: > Dear Andrea! > > I'm forwarding my answer to make sure you get it anyway. > Looking forward to hearing from you! > > Best Regards, > Gábor > ________________________________ > From: Gabor Nagy (gnagy) <Gabor.Nagy(a)oneidentity.com> > Sent: Sunday, December 5, 2021 17:49 > To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] [patch] new > feature for file destination: persistent symlinks > > Hello Andrea! > > Thank you for your contribution! We always welcome feedback and > contribution from the community! > > I've quickly checked your patch, and it looks good. Maybe minor > things could be changed, but we will see this during a thorough > review. > > We integrate patches via pull requests on GitHub. [1] > How would you like to continue this contribution? > Would you like to open a pull request on GitHub? > > I see a corner case of the feature: if the filename template is not > time-based, like e.g. $PROGRAM or $HOST, it can happen that the > symlink is changed several times in a short time. This is not an > argument against the feature, it's just a behaviour that should be > considered and documented. As I see, the feature in general creates a > symlink with the name given in "symlink_as" option when a new file is > opened. In other words: the configured symlink always points to the > latest file that were opened. > > > Best Regards, > Gábor > > [1] https://github.com/syslog-ng/syslog-ng > > ________________________________ > From: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > a.biardi(a)tiscali.it <a.biardi(a)tiscali.it> Sent: Saturday, December 4, > 2021 15:29 To: syslog-ng(a)lists.balabit.hu <syslog-ng(a)lists.balabit.hu> > Subject: [syslog-ng] [patch] new feature for file destination: > persistent symlinks > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > > Hi all, > > I'm new here. I love syslog-ng: it's well written and documented and > each time I need some new feature, I dig up the documentation and I > find it's already implemented! > > Like many others, I use macros in file destinations (say, > "/var/log/cron.${YEAR}${MONTH}"), but I also want to maintain a > persistent symlink to the current logfile (that would be > something like "/var/log/cron") in order to have "easier" access if > I'm grepping for something manually. > > I couldn't find this feature in syslog-ng, so I wrote the code myself; > in the configuration file, it looks like this: > > destination d_file_cron { > file("/var/log/cron.${YEAR}${MONTH}" symlink_as("/var/log/cron")); > }; > > It works for me on my Slackware boxes. I'm sharing the patch I put > together, hoping that it may be useful to others and perhaps even > considered for inclusion in mainstream. > > From a functional perspective, the "symlink_as" file inherits both > "create-dirs" and file ownership from its file destination > (permissions are not applicable to symlinks, at least on linux). > > Patch applies cleanly to latest production release (3.33). I tried to > keep the original coding style for easier review (admittedly, the code > could have gone into the function that opens the file destination, but > I didn't want to change too much). > > Thanks for the good work and happy logging! > > Andrea. Hi Gábor, Sorry for the delay, daytime job keeps me busy :) Will submit a PR through github asap. I did not consider the case where the template contains something like $PROGRAM or $HOST. As you point out, the code wouldn't fail but you'd get an ever-changing symlink of dubious usefulness. Worth documenting. Cheers, Andrea.

1 0