- syslog-ng - lists.balabit.hu

syslog-ng-ctl stats -> EOF on control channel
by Lucas, Sascha 03 Apr '13

03 Apr '13

Hi, I regularly run "syslog-ng-ctl stats" for monitoring purpose. My log-analyses shows that following messages is logged to priority err: EOF on control channel, closing connection; I would expect this with priority info. Or is there an error calling the above command? My syslog-ng version is 3.4.1. Thanks, Sascha. Vorsitzender des Aufsichtsrates: Ralf Hiltenkamp Geschäftsführung: Michael Krüger (Sprecher), Stephan Drescher Sitz der Gesellschaft: Halle/Saale Registergericht: Amtsgericht Stendal | Handelsregister-Nr. HRB 208414 UST-ID-Nr. DE 158253683 Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Empfänger sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail oder des Inhalts dieser Mail sind nicht gestattet. Diese Kommunikation per E-Mail ist nicht gegen den Zugriff durch Dritte geschützt. Die GISA GmbH haftet ausdrücklich nicht für den Inhalt und die Vollständigkeit von E-Mails und den gegebenenfalls daraus entstehenden Schaden. Sollte trotz der bestehenden Viren-Schutzprogramme durch diese E-Mail ein Virus in Ihr System gelangen, so haftet die GISA GmbH - soweit gesetzlich zulässig - nicht für die hieraus entstehenden Schäden.

2 1

OSE 3.4(.1) block() argument parse issue
by Eric Berggren 30 Mar '13

30 Mar '13

syslog-ng OSE 3.4.1 is unable to parse the "Example 5.8: Passing arguments to blocks" excerpt in the v3.4 admin guide, which exemplifies a common construct used in our current 3.2 config : @version: 3.4 block source s_logfile (filename("messages")) { file("/var/log/`filename`" ); }; source s_example { s_logfile(filename("logfile.log")); }; host# ./syslog-ng -s -f ./s2.conf : Error parsing affile, syntax error, unexpected LL_IDENTIFIER in source block s_logfile at line 2, column 19: included from /home/eberggren/proj/syslog-ng/config/s2.conf line 7, column 36 file("/var/log/"logfile.log ^^^^^^^^^^^ 3.3.8 appears to be okay with it, however (and our existing 3.2 config). thanks, -eric

2 2

[Bug 225] New: patterndb can not use HOST as variable in pattern
by bugzilla＠bugzilla.balabit.com 30 Mar '13

30 Mar '13

https://bugzilla.balabit.com/show_bug.cgi?id=225 Summary: patterndb can not use HOST as variable in pattern Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 This fails in the patterndb test --validate with the error ERROR:logmsg.c:540:log_msg_set_value_indirect: assertion failed: (handle >= LM_V_MAX) <rule id="50b9250d-2191-43af-8008-089c50224dc2" class="erempel" provider="UVic"> <patterns> <pattern>replace HOST with @ANYSTRING:HOST@</pattern> </patterns> <examples> <example> <test_message program="something">replace HOST with some.host.here</test_message> <test_values> <test_value name="HOST">some.host.here</test_value> </test_values> </example> </examples> </rule> but this succeeds and replaces the HOST macro <rule id="50b9250d-2191-43af-8008-089c50224dc2" class="erempel" provider="UVic"> <patterns> <pattern>replace HOST with @ANYSTRING:tempHost@</pattern> </patterns> <values> <value name="HOST">$tempHost</value> </values> <examples> <example> <test_message program="something">replace HOST with some.host.here</test_message> <test_values> <test_value name="tempHost">some.host.here</test_value> </test_values> </example> </examples> </rule> I would expect the both to work. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 7

How to build a filter where one message from one host not logged
by Niels Graupe 29 Mar '13

29 Mar '13

Hi ! I want to filter with syslog-ng that a message from a special host with a special message was not filtered and everything else goes to the logfile filter f_cisco_switches_knownerrors1 { host ("hostxy") and match("ENVIRONMENT-3-RPS_FAILED"); }; The Log-Message : Mar 29 12:29:19 hostxy err 20979: Mar 29 12:29:18: %ENVIRONMENT-3-RPS_FAILED: Faulty internal power supply detected Thanks, Niels

2 1

Closing destination file when date changes.
by andrea.meconi＠libero.it 23 Mar '13

23 Mar '13

Hello. I'm using a very simple configuration on Ubuntu 12.04.2 LTS @version: 3.3 @include "scl.conf" source from-network { udp(ip("0.0.0.0") port(514)); }; destination local-file { file("/var/log/temporary-encrypted/$YEAR-$MONTH-$DAY.log"); }; log { source(from-network); destination(local-file);}; Log on a destination file using date as filename. I need to close this file when date changes at 00:00. How? Thanks. Andrea

4 3

R: Re: Closing destination file when date changes.
by andrea.meconi＠libero.it 22 Mar '13

22 Mar '13

Thank. I'm reconfiguring syslog-ng using macro and sending HUP. Regards. Andrea >----Messaggio originale---- >Da: algernon(a)balabit.hu >Data: 22/03/2013 15.44 >A: "Syslog-ng users' and developers' mailing list"<syslog-ng(a)lists.balabit. hu> >Ogg: Re: [syslog-ng] Closing destination file when date changes. > >Sandor Geller <Sandor.Geller(a)morganstanley.com> writes: > >> On Fri, Mar 22, 2013 at 9:37 AM, andrea.meconi(a)libero.it >> <andrea.meconi(a)libero.it> wrote: >>> Hello. >>> I'm using a very simple configuration on Ubuntu 12.04.2 LTS >>> >>> >>> @version: 3.3 >>> @include "scl.conf" >>> source from-network { udp(ip("0.0.0.0") port(514)); }; >>> destination local-file { >>> file("/var/log/temporary-encrypted/$YEAR-$MONTH-$DAY.log"); }; >>> log { source(from-network); destination(local-file);}; >>> >>> >>> Log on a destination file using date as filename. >>> I need to close this file when date changes at 00:00. How? >> >> Unused file destinations could get reaped, see time_reap(). However >> you should take into account that the macros you used in the filename >> are dependent of keep_timestamp() and by default use the timestamp in >> the log message so the destination file could get opened when further >> logs arrive with timestamps referring to the given date... If you want >> to use files based on the receiver's time then I suggest using the R_ >> macros. > >That, and you can force syslog-ng to reinitialize the destinations by >sending it a HUP signal. So using the R_* family of macros, and sending >a SIGHUP shortly after 00:00 will result in syslog-ng closing the old >files. > >-- >|8] > >______________________________________________________________________________ >Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >Documentation: http://www.balabit.com/support/documentation/?product=syslog- ng >FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >

1 0

R: Re: Closing destination file when date changes.
by andrea.meconi＠libero.it 22 Mar '13

22 Mar '13

Thank. I'm reconfiguring syslog-ng using macro and sending HUP. Regards. Andrea >----Messaggio originale---- >Da: algernon(a)balabit.hu >Data: 22/03/2013 15.44 >A: "Syslog-ng users' and developers' mailing list"<syslog-ng(a)lists.balabit. hu> >Ogg: Re: [syslog-ng] Closing destination file when date changes. > >Sandor Geller <Sandor.Geller(a)morganstanley.com> writes: > >> On Fri, Mar 22, 2013 at 9:37 AM, andrea.meconi(a)libero.it >> <andrea.meconi(a)libero.it> wrote: >>> Hello. >>> I'm using a very simple configuration on Ubuntu 12.04.2 LTS >>> >>> >>> @version: 3.3 >>> @include "scl.conf" >>> source from-network { udp(ip("0.0.0.0") port(514)); }; >>> destination local-file { >>> file("/var/log/temporary-encrypted/$YEAR-$MONTH-$DAY.log"); }; >>> log { source(from-network); destination(local-file);}; >>> >>> >>> Log on a destination file using date as filename. >>> I need to close this file when date changes at 00:00. How? >> >> Unused file destinations could get reaped, see time_reap(). However >> you should take into account that the macros you used in the filename >> are dependent of keep_timestamp() and by default use the timestamp in >> the log message so the destination file could get opened when further >> logs arrive with timestamps referring to the given date... If you want >> to use files based on the receiver's time then I suggest using the R_ >> macros. > >That, and you can force syslog-ng to reinitialize the destinations by >sending it a HUP signal. So using the R_* family of macros, and sending >a SIGHUP shortly after 00:00 will result in syslog-ng closing the old >files. > >-- >|8] > >______________________________________________________________________________ >Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >Documentation: http://www.balabit.com/support/documentation/?product=syslog- ng >FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >

1 0

AUTO: James B Horwath is out of the office (returning 03/25/2013)
by James B Horwath 22 Mar '13

22 Mar '13

I am out of the office until 03/25/2013. I will be out of the office until 03/25/2013 with limited access to e-mail. If you have an urgent issue please contact Sunil Gupta at (610)-807-6710 or Dylan Yoder at (610)-807-7230. Regards Jim Horwath IT Security Services & Governance, Corporate BTS and IT Security/Risk Tel 610-807-8795 Mobile 610-533-6972 3900 Burgess Place, Bethlehem, Pa. 18017 Jim_Horwath(a)glic.com Note: This is an automated response to your message "syslog-ng Digest, Vol 95, Issue 14" sent on 3/22/2013 7:00:02. This is the only notification you will receive while this person is away. ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

1 0

flags(final) in version 3.4
by Fanselow, William 22 Mar '13

22 Mar '13

According to this report, the flags(final) does not work in 3.4 as one got used to in prior versions. https://lists.balabit.hu/pipermail/syslog-ng/2013-February/020039.html In version 3.3 I used flags(final) in each of my log{ } statements so that a message was not unnecessarily processed by anything beyond a matching filter. My last entry in the config used flags(fallback) so that any message not previously sent to a destination was caught by this final stanza. With version 3.4, the same syntax does not work, and all messages appear to be passing through every filter and getting duplicated in the first match and my final log destination. Surely, there must be another way to handle this sort of thing. Not only is it useful for processing efficiency, but it is also a useful way to identify "unmatched" filters in the config. Any suggestions for replicating the 3.3 behavior would be appreciated. Thanks Bill Fanselow

5 4

syslog-ng Insider - March 2013
by Peter Czanik 14 Mar '13

14 Mar '13

Dear syslog-ng users, This is the 22th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com <mailto:documentation@balabit.com> FEATURED NEWS Video: networking scenarios and filters --------------------------------------- There is a video series in the work to introduce the basics of syslog-ng. The third video is online now, which explains networking scenarios and filters. You can watch it at https://www.youtube.com/watch?v=VR3t7p04GUI Masking credit card numbers in log messages with syslog-ng ---------------------------------------------------------- Compliance with different regulations is becoming more and more important recently also in logging. One of these, PCI-DSS requires credit card numbers to be masked in logs. Our CTO describes, how it can be achieved using the freshly released syslog-ng 3.4 at http://marci.blogs.balabit.com/2013/02/masking-credit-card-numbers-in-log-m… Brand new syslog-ng Superhero T-shirt available ----------------------------------------------- The syslog-ng Superhero T-shirt was designed for open source fan geeks. Can't wait more to get one? Simply tell us which version of syslog-ng (OSE, PE or SSB) you use, and be our public syslog-ng reference. Please send an email to Peter Czanik for more information and don't forget to include your t-shirt size.;-) T-shirt pictures on Facebook: http://www.facebook.com/media/set/?set=a.10151698258059867.609510.124671654… T-shirt pictures on the web: http://bit.ly/ZFmmVq SHORT NEWS: * openSUSE 12.3 was released yesterday and is the first Linux distribution to include syslog-ng 3.4.1 NEW RELEASES: * SSB 3F1: http://gyp.blogs.balabit.com/2013/03/introducing-syslog-ng-store-box-3f1/ ARCHIVE http://insider.blogs.balabit.com/ -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0