- syslog-ng - lists.balabit.hu

Version 4.10.2 of syslog-ng is now available
by Peter Czanik (pczanik) 26 Nov '25

26 Nov '25

Hi, Version 4.10.2 of syslog-ng is now available. It's yet another bug fix release for 4.10 and fixes a number of problems reported after the release. If you use the webhook source, start syslog-ng directly from scripts or check stats values on a system with disk buffer, you should upgrade to 4.10.2. Otherwise, your current version should be OK. Peter 4.10.2 syslog-ng provides RPM<https://github.com/syslog-ng/syslog-ng#rhel> and DEB<https://github.com/syslog-ng/syslog-ng#debianubuntu> package repositories for Ubuntu, Debian, and RHEL, for both amd64 and arm64 architectures. We also provide ready-to-test binaries in Docker containers<https://hub.docker.com/r/balabit/syslog-ng/tags> based on the current stable Debian image. For more details, visit our Documentation Center<https://syslog-ng.github.io/> Version 4.10.2 is a bugfix release, and resolves the following issues. Bugfixes * Queued stats values of destinations could still contain weird values. (#5527<https://github.com/syslog-ng/syslog-ng/pull/5527>) * Unclosed standard file handlers could cause a hang when syslog-ng was started as a daemon. (#5532<https://github.com/syslog-ng/syslog-ng/pull/5532>) * The WebHook Python module could hang syslog-ng when started by systemd and systemctl stop syslog-ng was requested. (#5522<https://github.com/syslog-ng/syslog-ng/pull/5522>) * Our installer packages now include static index web pages and are browsable via RPM<https://ose-repo.syslog-ng.com/yum/> and DEB<https://ose-repo.syslog-ng.com/apt/>. (#5517<https://github.com/syslog-ng/syslog-ng/pull/5517>, #5518<https://github.com/syslog-ng/syslog-ng/pull/5518>, #5520<https://github.com/syslog-ng/syslog-ng/pull/5520>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Vivek Anand, Hofi, gotyaoi, Kovacs Gergo Ferenc, Tamas Pal, Tinkiter — This release has 3 assets: * syslog-ng-4.10.2.tar.gz * Source code (zip) * Source code (tar.gz) Visit the release page<https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.10.2> to download them. Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

4 9

issues with syslog facility "overflowing" to user facility?
by Ian Veach 19 Nov '25

19 Nov '25

Hi all - We're seeing some weird behavior on our central loghosts. Could be config, I suppose, but it seems unusual and I don't see config issue causing it. The summary is that we are using stats and dumping them into syslog.log, and that's fine. But we see weird "remnants" in user.log. It seems to contain syslog facility messages and is malformed as well. Bug? Or us? 🙂 This is a snip of the expected syslog.log: 2025-11-19T00:00:03.392632-08:00 redacted [syslog.info] syslog-ng[758325]: Log statistics; msg_size_avg='dst.file(d_log#0,/var/log/other/20251110/daemon.log)=111', truncated_bytes='dst.file(d_log#0,/var/log/other/20251006/daemon.log)=0', truncated_bytes='dst.file(d_log_systems#0,/var/log/other/20251002/syste..... This is a snip of user.log (same event/time looks like): 2025-11-19T00:00:03.392632-08:00 redacted [user.notice] var/log/other/20251022/daemon.log)=111',[]: eps_last_24h='dst.file(d_log#0,/var/log/other/20251022/daemon.log)=0', eps_last_1h='dst.file(d_log#0,/var/log/other/20250922/daemon.log)=0', eps_last_24h='dst.file(d_log#0,/var/log/other/20250922/daemon.log)=0',...... Here you can see for user.log that the format is actually messed up. $PROGRAM[$PID]: is missing/truncated (although look at the []: at the end of the first line), and the first part of the $MESSAGE is also missing/truncated. Some notes: * We're running syslog-ng as provided by Red Hat (syslog-ng-3.35.1-7.el9.x86_64) * endpoint is logging correctly (nothing in user.log). This is only centralized loghosts that we see this. * Stats level 1, freq 21600 Relevant configuration snips: log { source(s_local); source(s_net_unix_tcp); source(s_net_unix_udp); filter(f_catchall); destination(d_arc); }; filter f_catchall { not facility(local0, local1, local2, local3, local4, local5, local6, local7); }; destination d_arc { file("`LPTH`/$HOST_FROM/$YEAR/$MONTH/$DAY/$FACILITY.log" template(t_std) ); }; t_std: template("${ISODATE} $HOST_FROM [$FACILITY.$LEVEL] $PROGRAM[$PID]: $MESSAGE\n"); Thanks for any guidance! PUBLIC RECORDS NOTICE: In accordance with NRS Chapter 239, this email and responses, unless otherwise made confidential by law, may be subject to the Nevada Public Records laws and may be disclosed to the public upon request.

1 0

yum repository not browsable
by Evan Rempel 31 Oct '25

31 Oct '25

From time to time we have some challenge with the installation of packages from a repository. To troubleshoot the issue we usually use a web browser to brows the repository to "see what is there" and to download and inspect individual packages to determine signing and dependencies. The repository at ose-repo.syslog-ng.com is not browsable. https://ose-repo.syslog-ng.com/yum/stable/ results in a 404 error. Can the repository be changed to allow it to be browsed? Is there some reason to disallow browsing that escapes me? -- Evan

4 4

Beware Debian 13 syslog-ng stats setting
by John Kristoff 28 Oct '25

28 Oct '25

If you use Debian's packaged syslog-ng beware that you may have this set in your Debian 13 /etc/syslog-ng/syslog-ng.conf: stats(freq(1)); This was briefly introduced and then removed. You probably don't want it if you have it - daemon stats would be logged every second. Debian does not install syslog-ng by default and many may be installing packages from elsewhere or from source, so hopefully this does not have a wide impact. Where it was added: <https://github.com/gcsideal/syslog-ng-debian/commit/319fd669944def7dbb1bc50…> Where it was removed: <https://github.com/gcsideal/syslog-ng-debian/commit/f7ee172d62009cc6b5e6a62…> John

1 0

The syslog-ng Insider 2025-10: values; BastilleBSD; Debian
by Peter Czanik (pczanik) 09 Oct '25

09 Oct '25

Dear syslog-ng users, This is the 135th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS The core values of syslog-ng ---------------------------- Whenever I present syslog-ng at a conference or I stand next to a booth, people often ask me why should they use syslog-ng instead of one of its competitors. So let me summarize what the users and developers of syslog-ng typically consider as its most important values. https://www.syslog-ng.com/community/b/blog/posts/the-core-values-of-syslog-… Running syslog-ng in BastilleBSD -------------------------------- Bastille, the lightweight jail (container) management system for FreeBSD, was already covered here. Recently, they released Bastille 1.0 and BastilleBSD, a hardened FreeBSD variant that comes with Bastille pre-installed. https://www.syslog-ng.com/community/b/blog/posts/running-syslog-ng-in-basti… Debian and Ubuntu blogs updated ------------------------------- Recent Debian and Ubuntu releases changed, how gpg keys of repositories can be added to a sytem. Related blogs are now updated: https://www.syslog-ng.com/community/b/blog/posts/nightly-syslog-ng-builds-f… https://www.syslog-ng.com/community/b/blog/posts/installing-the-latest-sysl… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

stats collection sometimes wrong
by Evan Rempel 08 Oct '25

08 Oct '25

We collect stats every 10 minutes via the command syslog-ng-ctl stats --control=$syslogSocket And we log the results back to syslog as well as generate alerts when things start queuing. Sometimes the queued numbers reported are extremely incorrect. 2025-09-16T21:15:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0 2025-09-16T21:25:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0 2025-09-16T21:35:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0 2025-09-16T21:35:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;processed;15568 2025-09-16T21:45:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;18446744073709551608 2025-09-16T21:45:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;processed;15773 2025-09-16T21:55:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;18446744073709551608 2025-09-16T21:55:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;processed;15972 2025-09-16T22:05:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0 2025-09-16T22:15:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0 It is not possible to queue more messages that the difference reported in the processed numbers. -- Evan

2 3

Version 4.10.1 of syslog-ng now available
by Peter Czanik (pczanik) 01 Oct '25

01 Oct '25

Hi, Version 4.10.1 is a bugfix release, not needed by most users. It fixes the syslog-ng container and platform support in some less common situations. Before you begin I assume that most people are lazy and/or overbooked, just like me. So, if you already have syslog-ng 4.10.0 up and running, and packaged for your platform, just skip this bugfix release. What is fixed? • You can now compile syslog-ng on FreeBSD 15 again. • The syslog-ng container has Python support working again. • Stackdump support compiles only on glibc Linux systems, but it also used to be enabled on others when libunwind was present. This problem affected embedded Linux systems using alternative libc implementations like OpenWRT and Gentoo in some cases. It is now turned off by default, therefore it needs to be explicitly enabled. What is next? If you are switching to 4.10.X now, using 4.10.1 might spare you some extra debugging. Especially if you are developing for an embedded system. Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng 4.10.0 packages, and spreading the news
by Peter Czanik (pczanik) 23 Sep '25

23 Sep '25

Hi, Let me collect you some more syslog-ng 4.10.0-related information. Release notes with all the new features, bug fixes and various other changes: https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.10.0 RPM packages for openSUSE / SLES, Fedora and RHEL are now available: https://www.syslog-ng.com/community/b/blog/posts/installing-latest-syslog-n… (blog updated, even if it still mentions RHEL 7 and a 2021 date 🙂) DEB packages for Debian and Ubuntu are available: https://www.syslog-ng.com/community/b/blog/posts/installing-the-latest-sysl… Starting with this release, RPM packages for RHEL 8, 9 and 10 on ARM and x86_64 are provided also on syslog-ng.com, just like DEB packages. More on this next week, but you can already test it based on the release notes 🙂 Help us to spread the word about this release. Write something using your own words, or simply share one of my posts about syslog-ng 4.10.0: LinkedIn: https://www.linkedin.com/posts/peterczanik_release-syslog-ng-4100-syslog-ng… Twitter: https://x.com/PCzanik/status/1970479911396589717 Mastodon: https://fosstodon.org/@PCzanik/115253846672000598 BlueSky: https://bsky.app/profile/pczanik.bsky.social/post/3lzizqcctnk22 Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng 4.10.0 released
by Peter Czanik (pczanik) 23 Sep '25

23 Sep '25

Hi, I'm happy to announe hat syslog-ng 4.10.0 is now released. From the release notes: syslog-ng provides RPM<https://github.com/syslog-ng/syslog-ng#rhel> and DEB<https://github.com/syslog-ng/syslog-ng#debianubuntu> package repositories for Ubuntu, Debian, and RHEL, for both amd64 and arm64 architectures. We also provide ready-to-test binaries in Docker containers<https://hub.docker.com/r/balabit/syslog-ng/tags> based on the current stable Debian image. For more details, visit our Documentation Center<https://syslog-ng.github.io/> Highlights * affile: add support for filesize based logrotation Config file example: destination d_file_logrotate { file("/my-logfile.log", logrotate(enable(yes), size(30KB), rotations(5))); }; (#5191<https://github.com/syslog-ng/syslog-ng/pull/5191>) Features * filter: Add a blank filter that test if a value is blank. A value is considered blank if it is not set, is an empty string, is an empty list, is a string with only whitespace, or is boolean false. (#5425<https://github.com/syslog-ng/syslog-ng/pull/5425>) * http-destination: add msg_data_in_header option to be able to turn off sending message content-related data in the HTTP header (#5455<https://github.com/syslog-ng/syslog-ng/pull/5455>) * stats-exporter: Add stats-without-orphaned() and stats-with-legacy() options to further filter the stats output. (#5424<https://github.com/syslog-ng/syslog-ng/pull/5424>) * affile: Add ability to refine the wildcard-file() filename-pattern() option with exclude-pattern(), to exclude some matching files. For example, match all *.log but exclude *.?.log. (#5416<https://github.com/syslog-ng/syslog-ng/pull/5416>) Bugfixes * afprog: Fix invalid access of freed log-writer cfg. (#5445<https://github.com/syslog-ng/syslog-ng/pull/5445>) * s3: Fixed bug where in certain conditions finished object buffers would fail to upload. (#5447<https://github.com/syslog-ng/syslog-ng/pull/5447>) * stats-exporter: Fix leaks caused by missing "virtual destructor" calls. (#5441<https://github.com/syslog-ng/syslog-ng/pull/5441>) * wildcard-file: Fix possible act_tracker crash caused by duplicated file change notification handler invocation. (#5437<https://github.com/syslog-ng/syslog-ng/pull/5437>) Packaging * packaging: New package formats, platforms, and architectures! * the long-awaited RPM repository is here, we have RHEL-8, RHEL-9, and REHL-10 packages available, both for amd64 and arm64 architectures, just download and install the repository definition sudo curl -o /etc/yum.repos.d/syslog-ng-ose-stable.repo https://ose-repo.syslog-ng.com/yum/syslog-ng-ose-stable.repo * we fixed the publishing of our arm64 DEB packages * added new DEB packages for Debian Trixie, both for amd64 and arm64. * new DBLD docker images for Rocky-9, OpenSuse Tumbleweed, Ubuntu Plucky, and Debian Trixie (#5449<https://github.com/syslog-ng/syslog-ng/pull/5449>) Notes to developers * mongo-c: now we can build against both the v1 and v2 versions of the mongo-c driver automatically (#5442<https://github.com/syslog-ng/syslog-ng/pull/5442>) * manpages: Finally, we have added manpage generation to the CMake builds as well. The new single source of truth solution can either use the sometimes more up-to-date version from the documentation<https://syslog-ng.github.io/admin-guide/190_The_syslog-ng_manual_pages/READ…>, or, by default, the locally available ready-to-use instance (which is also synced from the online version, but may lag behind). This can be controlled via the --with-mapages=local|remote, or the -DWITH_MANPAGES=LOCAL|REMOTE configuration options. (#5459<https://github.com/syslog-ng/syslog-ng/pull/5459>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Alexander Zikulnig, Ben Ireland, Bálint Horváth, Gyula Kerekes, Hofi, Romain Tartière, Ross Williams, Tamas Pal Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

The syslog-ng Insider 2025-09: AI; syslog; FreeBSD
by Peter Czanik (pczanik) 11 Sep '25

11 Sep '25

Dear syslog-ng users, This is the 134th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Syslog-ng development and AI ---------------------------- Recently, several people have asked me about the syslog-ng project’s view on AI. In short, there is cautious optimism: we embrace AI, but it does not take over any critical tasks from humans. But what does this mean for syslog-ng? https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-development-and-… Dealing with multiple syslog protocols in syslog-ng made easy ------------------------------------------------------------- There are multiple syslog protocols with multiple variants. The new transport(auto) option of the syslog() source allows you to support all TCP-based variants with a single source driver. https://www.syslog-ng.com/community/b/blog/posts/dealing-with-multiple-sysl… FreeBSD audit source is coming to syslog-ng ------------------------------------------- Last year, I wrote a small configuration snippet for syslog-ng: FreeBSD audit source. I published it in a previous blog, and based on feedback, it is already used in production. And soon, it will be available also as part of a syslog-ng release. https://www.syslog-ng.com/community/b/blog/posts/freebsd-audit-source-is-co… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0