- syslog-ng - lists.balabit.hu

The syslog-ng Insider 2025-10: values; BastilleBSD; Debian
by Peter Czanik (pczanik) 09 Oct '25

09 Oct '25

Dear syslog-ng users, This is the 135th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS The core values of syslog-ng ---------------------------- Whenever I present syslog-ng at a conference or I stand next to a booth, people often ask me why should they use syslog-ng instead of one of its competitors. So let me summarize what the users and developers of syslog-ng typically consider as its most important values. https://www.syslog-ng.com/community/b/blog/posts/the-core-values-of-syslog-… Running syslog-ng in BastilleBSD -------------------------------- Bastille, the lightweight jail (container) management system for FreeBSD, was already covered here. Recently, they released Bastille 1.0 and BastilleBSD, a hardened FreeBSD variant that comes with Bastille pre-installed. https://www.syslog-ng.com/community/b/blog/posts/running-syslog-ng-in-basti… Debian and Ubuntu blogs updated ------------------------------- Recent Debian and Ubuntu releases changed, how gpg keys of repositories can be added to a sytem. Related blogs are now updated: https://www.syslog-ng.com/community/b/blog/posts/nightly-syslog-ng-builds-f… https://www.syslog-ng.com/community/b/blog/posts/installing-the-latest-sysl… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

stats collection sometimes wrong
by Evan Rempel 08 Oct '25

08 Oct '25

We collect stats every 10 minutes via the command syslog-ng-ctl stats --control=$syslogSocket And we log the results back to syslog as well as generate alerts when things start queuing. Sometimes the queued numbers reported are extremely incorrect. 2025-09-16T21:15:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0 2025-09-16T21:25:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0 2025-09-16T21:35:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0 2025-09-16T21:35:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;processed;15568 2025-09-16T21:45:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;18446744073709551608 2025-09-16T21:45:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;processed;15773 2025-09-16T21:55:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;18446744073709551608 2025-09-16T21:55:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;processed;15972 2025-09-16T22:05:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0 2025-09-16T22:15:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0 It is not possible to queue more messages that the difference reported in the processed numbers. -- Evan

2 3

Version 4.10.1 of syslog-ng now available
by Peter Czanik (pczanik) 01 Oct '25

01 Oct '25

Hi, Version 4.10.1 is a bugfix release, not needed by most users. It fixes the syslog-ng container and platform support in some less common situations. Before you begin I assume that most people are lazy and/or overbooked, just like me. So, if you already have syslog-ng 4.10.0 up and running, and packaged for your platform, just skip this bugfix release. What is fixed? • You can now compile syslog-ng on FreeBSD 15 again. • The syslog-ng container has Python support working again. • Stackdump support compiles only on glibc Linux systems, but it also used to be enabled on others when libunwind was present. This problem affected embedded Linux systems using alternative libc implementations like OpenWRT and Gentoo in some cases. It is now turned off by default, therefore it needs to be explicitly enabled. What is next? If you are switching to 4.10.X now, using 4.10.1 might spare you some extra debugging. Especially if you are developing for an embedded system. Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng 4.10.0 packages, and spreading the news
by Peter Czanik (pczanik) 23 Sep '25

23 Sep '25

Hi, Let me collect you some more syslog-ng 4.10.0-related information. Release notes with all the new features, bug fixes and various other changes: https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.10.0 RPM packages for openSUSE / SLES, Fedora and RHEL are now available: https://www.syslog-ng.com/community/b/blog/posts/installing-latest-syslog-n… (blog updated, even if it still mentions RHEL 7 and a 2021 date 🙂) DEB packages for Debian and Ubuntu are available: https://www.syslog-ng.com/community/b/blog/posts/installing-the-latest-sysl… Starting with this release, RPM packages for RHEL 8, 9 and 10 on ARM and x86_64 are provided also on syslog-ng.com, just like DEB packages. More on this next week, but you can already test it based on the release notes 🙂 Help us to spread the word about this release. Write something using your own words, or simply share one of my posts about syslog-ng 4.10.0: LinkedIn: https://www.linkedin.com/posts/peterczanik_release-syslog-ng-4100-syslog-ng… Twitter: https://x.com/PCzanik/status/1970479911396589717 Mastodon: https://fosstodon.org/@PCzanik/115253846672000598 BlueSky: https://bsky.app/profile/pczanik.bsky.social/post/3lzizqcctnk22 Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng 4.10.0 released
by Peter Czanik (pczanik) 23 Sep '25

23 Sep '25

Hi, I'm happy to announe hat syslog-ng 4.10.0 is now released. From the release notes: syslog-ng provides RPM<https://github.com/syslog-ng/syslog-ng#rhel> and DEB<https://github.com/syslog-ng/syslog-ng#debianubuntu> package repositories for Ubuntu, Debian, and RHEL, for both amd64 and arm64 architectures. We also provide ready-to-test binaries in Docker containers<https://hub.docker.com/r/balabit/syslog-ng/tags> based on the current stable Debian image. For more details, visit our Documentation Center<https://syslog-ng.github.io/> Highlights * affile: add support for filesize based logrotation Config file example: destination d_file_logrotate { file("/my-logfile.log", logrotate(enable(yes), size(30KB), rotations(5))); }; (#5191<https://github.com/syslog-ng/syslog-ng/pull/5191>) Features * filter: Add a blank filter that test if a value is blank. A value is considered blank if it is not set, is an empty string, is an empty list, is a string with only whitespace, or is boolean false. (#5425<https://github.com/syslog-ng/syslog-ng/pull/5425>) * http-destination: add msg_data_in_header option to be able to turn off sending message content-related data in the HTTP header (#5455<https://github.com/syslog-ng/syslog-ng/pull/5455>) * stats-exporter: Add stats-without-orphaned() and stats-with-legacy() options to further filter the stats output. (#5424<https://github.com/syslog-ng/syslog-ng/pull/5424>) * affile: Add ability to refine the wildcard-file() filename-pattern() option with exclude-pattern(), to exclude some matching files. For example, match all *.log but exclude *.?.log. (#5416<https://github.com/syslog-ng/syslog-ng/pull/5416>) Bugfixes * afprog: Fix invalid access of freed log-writer cfg. (#5445<https://github.com/syslog-ng/syslog-ng/pull/5445>) * s3: Fixed bug where in certain conditions finished object buffers would fail to upload. (#5447<https://github.com/syslog-ng/syslog-ng/pull/5447>) * stats-exporter: Fix leaks caused by missing "virtual destructor" calls. (#5441<https://github.com/syslog-ng/syslog-ng/pull/5441>) * wildcard-file: Fix possible act_tracker crash caused by duplicated file change notification handler invocation. (#5437<https://github.com/syslog-ng/syslog-ng/pull/5437>) Packaging * packaging: New package formats, platforms, and architectures! * the long-awaited RPM repository is here, we have RHEL-8, RHEL-9, and REHL-10 packages available, both for amd64 and arm64 architectures, just download and install the repository definition sudo curl -o /etc/yum.repos.d/syslog-ng-ose-stable.repo https://ose-repo.syslog-ng.com/yum/syslog-ng-ose-stable.repo * we fixed the publishing of our arm64 DEB packages * added new DEB packages for Debian Trixie, both for amd64 and arm64. * new DBLD docker images for Rocky-9, OpenSuse Tumbleweed, Ubuntu Plucky, and Debian Trixie (#5449<https://github.com/syslog-ng/syslog-ng/pull/5449>) Notes to developers * mongo-c: now we can build against both the v1 and v2 versions of the mongo-c driver automatically (#5442<https://github.com/syslog-ng/syslog-ng/pull/5442>) * manpages: Finally, we have added manpage generation to the CMake builds as well. The new single source of truth solution can either use the sometimes more up-to-date version from the documentation<https://syslog-ng.github.io/admin-guide/190_The_syslog-ng_manual_pages/READ…>, or, by default, the locally available ready-to-use instance (which is also synced from the online version, but may lag behind). This can be controlled via the --with-mapages=local|remote, or the -DWITH_MANPAGES=LOCAL|REMOTE configuration options. (#5459<https://github.com/syslog-ng/syslog-ng/pull/5459>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Alexander Zikulnig, Ben Ireland, Bálint Horváth, Gyula Kerekes, Hofi, Romain Tartière, Ross Williams, Tamas Pal Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

The syslog-ng Insider 2025-09: AI; syslog; FreeBSD
by Peter Czanik (pczanik) 11 Sep '25

11 Sep '25

Dear syslog-ng users, This is the 134th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Syslog-ng development and AI ---------------------------- Recently, several people have asked me about the syslog-ng project’s view on AI. In short, there is cautious optimism: we embrace AI, but it does not take over any critical tasks from humans. But what does this mean for syslog-ng? https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-development-and-… Dealing with multiple syslog protocols in syslog-ng made easy ------------------------------------------------------------- There are multiple syslog protocols with multiple variants. The new transport(auto) option of the syslog() source allows you to support all TCP-based variants with a single source driver. https://www.syslog-ng.com/community/b/blog/posts/dealing-with-multiple-sysl… FreeBSD audit source is coming to syslog-ng ------------------------------------------- Last year, I wrote a small configuration snippet for syslog-ng: FreeBSD audit source. I published it in a previous blog, and based on feedback, it is already used in production. And soon, it will be available also as part of a syslog-ng release. https://www.syslog-ng.com/community/b/blog/posts/freebsd-audit-source-is-co… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng version 4.9.0 is now available
by Peter Czanik (pczanik) 26 Aug '25

26 Aug '25

Hi, I am happy to announce that version 4.9.0 of syslog-ng is now available. Thanks everyone who contributed code, documentation, testing, or in any other way. Peter 4.9.0 Highlights * stats-exporter: Added two new sources, stats-exporter() and stats-exporter-dont-log(), which directly serve the output of syslog-ng-ctl stats and syslog-ng-ctl query to a http scraper. The only difference is that stats-exporter-dont-log() suppresses log messages from incoming scraper requests, ensuring no messages appear in the log path. Meanwhile, stats-exporter() logs unparsed messages, storing incoming scraper HTTP requests in the MSG field. Example usage for a Prometheus Scraper which logs the HTTP request of the scraper to /var/log/scraper.log: @version: 4.9 @include "scl.conf" source s_prometheus_stat { stats-exporter( ip("0.0.0.0") port(8080) stat-type("query") stat-query("*") scrape-freq-limit(30) single-instance(yes) ); }; log { source(s_prometheus_stat); destination { file(/var/log/scraper.log); }; }; Example usage for a generic HTTP Scraper which sends e.g. the GET /stats HTTP/1.1 HTTP request to get statistics of syslog-ng, do not want to log or further process the HTTP requests in the log pipe, and needs the response in CSV format: @version: 4.9 @include "scl.conf" source s_scraper_stat { stats-exporter-dont-log( ip("0.0.0.0") port(8080) stat-type("stats") stat-format("csv") scrape-pattern("GET /stats*") scrape-freq-limit(30) single-instance(yes) ); }; log { source(s_scraper_stat); }; Note: A destination is not required for this to work; the stats-exporter() source will respond to the scraper regardless of whether a destination is present in the log path. Available options: stat-type(string) - query or stats, just like for the syslog-ng-ctl command line tool, see there for the details stat-query(string) - the query regex string that can be used to filter the output of a query type request stat-format(string) - the output format of the given stats request, like the -m option of the syslog-ng-ctl command line tool scrape-pattern(string) – the pattern used to match the HTTP header of incoming scraping requests. A stat response will be generated and sent only if the header matches the pattern string scrape-freq-limit(non-negative-int) - limits the frequency of repeated scraper requests to the specified number of seconds. Any repeated request within this period will be ignored. A value of 0 means no limit single-instance(yes/no) - if set to yes only one scraper connection and request will be allowed at once (#5259<https://github.com/syslog-ng/syslog-ng/pull/5259>) * syslog() source driver: add support for RFC6587 style auto-detection of octet-count based framing to avoid confusion that stems from the sender using a different protocol to the server. This behaviour can be enabled by using transport(auto) option for the syslog() source. (#5322<https://github.com/syslog-ng/syslog-ng/pull/5322>) * wildcard-file: Added inotify-based regular file change detection using the existing inotify-based directory monitor. This improves efficiency on OSes like Linux, where only polling was available before, significantly reducing CPU usage while enhancing change detection accuracy. To enable this feature, inotify kernel support is required, along with monitor-method() set to inotify or auto, and follow-freq() set to 0. (#5315<https://github.com/syslog-ng/syslog-ng/pull/5315>) Features * cisco: Added support for Cisco Nexus NXOS 9.3 syslog format. The parser now recognises NXOS 9.3 timestamps in YYYY MMM DD HH:MM:SS format and handles the different sequence number prefix (: instead of seqno: ) used by NXOS 9.3 compared to traditional IOS formats. Example Cisco configuration: Example syslog-ng configuration: @include "scl.conf" source s_cisco { network(ip(0.0.0.0) transport("udp") port(2000) flags(no-parse)); }; parser p_cisco { cisco-parser(); }; destination d_placeholder { # Define your destination here }; log { source(s_cisco); parser(p_cisco); destination(d_placeholder); }; (#5412<https://github.com/syslog-ng/syslog-ng/pull/5412>) * NXOS: (config)# logging server <syslog-ng-server-ip> port 2000 * IOS: (config)# logging host <syslog-ng-server-ip> transport udp port 2000 * bigquery(), google-pubsub-grpc(): Added service-account() authentication option. Example usage: destination { google-pubsub-grpc( project("test") topic("test") auth(service-account(key ("path_to_service_account_key.json"))) ); }; Note: In contrary to the http() destination's similar option, we do not need to manually set the audience here as it is automatically recognized by the underlying gRPC API. (#5270<https://github.com/syslog-ng/syslog-ng/pull/5270>) * gRPC based destinations: Added response-action() option With this option, it is possible to fine tune how syslog-ng behaves in case of different gRPC results. Supported by the following destination drivers: Supported gRPC results: Supported actions: Usage: google-pubsub-grpc( project("my-project") topic("my-topic") response-action( not-found => disconnect unavailable => drop ) ); (#5332<https://github.com/syslog-ng/syslog-ng/pull/5332>) * opentelemetry() * loki() * bigquery() * clickhouse() * google-pubsub-grpc() * ok * unavailable * cancelled * deadline-exceeded * aborted * out-of-range * data-loss * unknown * invalid-argument * not-found * already-exists * permission-denied * unauthenticated * failed-precondition * unimplemented * internal * resource-exhausted * disconnect * drop * retry * success * s3: Added two new options Example: s3( url("http://localhost:9000") bucket("testbucket") object_key("testobject") access_key("<ACCESS_KEY_ID>") secret_key("<SECRET_ACCESS_KEY>") content_type("text/plain") use_checksum("when_required") ); (#5286<https://github.com/syslog-ng/syslog-ng/pull/5286>) * content-type(): users now can change the content type of the objects uploaded by syslog-ng. * use_checksum(): This option allows the users to change the default checksum settings for S3 compatible solutions that don't support checksums. Requires botocore 1.36 or above. Acceptable values are when_supported (default) and when_required. * loki(): Added batch-bytes() and compression() options. (#5174<https://github.com/syslog-ng/syslog-ng/pull/5174>) * syslog-ng-ctl: Formatting the output of the syslog-ng-ctl stats and syslog-ng-ctl query commands is unified. Both commands got a new --format (-m) argument that can control the output format of the given stat or query. The following formats are supported: * kv - the legacy key-value-pairs e.g. center.queued.processed=0 (only for the query command yet) * csv - comma separated values e.g. center;;queued;a;processed;0 * prometheus - the prometheus scraper ready format e.g. syslogng_center_processed{stat_instance="queued"} 0 (#5248<https://github.com/syslog-ng/syslog-ng/pull/5248>) * network(), syslog() sources: add $PEERIP and $PEERPORT macros The $PEERIP and $PEERPORT macros always display the address and port of the direct sender. In most cases, these values are identical to $SOURCEIP and $SOURCEPORT. However, when dealing with proxied protocols, $PEERIP and $PEERPORT reflect the proxy's address and port, while $SOURCEIP and $SOURCEPORT indicate the original source of the message. (#5291<https://github.com/syslog-ng/syslog-ng/pull/5291>) * webhook(),opentelemetry() sources: support input_event_bytes metrics (#5324<https://github.com/syslog-ng/syslog-ng/pull/5324>) * freebsd-audit(): added a simple source SCL to collect FreeBSD audit logs using the built-in praudit program https://www.syslog-ng.com/community/b/blog/posts/freebsd-audit-source-for-s… (#5383<https://github.com/syslog-ng/syslog-ng/pull/5383>) * webhook(): headers support include-request-headers(yes) stores request headers under the ${webhook.headers} key, allowing further processing proxy-header("x-forwarded-for") helps retain the sender's original IP and the proxy's IP address ($SOURCEIP, $PEERIP). (#5333<https://github.com/syslog-ng/syslog-ng/pull/5333>) * check-program: Introduced as a flag for global or source options. By default, this flag is set to false. Enabling the check-program flag triggers program name validation for RFC3164 messages. Valid program names must adhere to the following criteria: Contain only these characters: [a-zA-Z0-9-_/().] Include at least one alphabetical character. If a program name fails validation, it will be considered part of the log message. Example: source { network(flags(check-hostname, check-program)); }; (#5264<https://github.com/syslog-ng/syslog-ng/pull/5264>) * syslog(transport(proxied-*)) and network(transport(proxied-*)): changed where HAProxy transport saved the original source and destination addresses. Instead of using dedicated PROXIED_* name-value pairs, use the usual $SOURCEIP, $SOURCEPORT, $DESTIP and $DESTPORT macros, making haproxy based connections just like native ones. $SOURCEPORT: added new macro which expands to the source port of the peer. (#5305<https://github.com/syslog-ng/syslog-ng/pull/5305>) * opentelemetry(), syslog-ng-otlp(): Added keep-alive() options. Keepalive can be configured with the time(), timeout() and max-pings-without-data() options of the keep-alive() block. opentelemetry( ... keep-alive(time(20000) timeout(10000) max-pings-without-data(0)) ); (#5174<https://github.com/syslog-ng/syslog-ng/pull/5174>) * bigquery(): Added auth() options. Similarly to other gRPC based destination drivers, the bigquery() destination now accepts different authentication methods, like adc(), alts(), insecure() and tls(). bigquery ( ... auth( tls( ca-file("/path/to/ca.pem") key-file("/path/to/key.pem") cert-file("/path/to/cert.pem") ) ) ); (#5174<https://github.com/syslog-ng/syslog-ng/pull/5174>) * cloud-auth: Added azure-monitor() destination Added oauth2 authentication for azure monitor destinations. Example usage: azure-monitor( dcr-id("dcr id") dce-uri("dce uri") stream_name("stream name") auth( tenant-id("tenant id") app-id("app id") app-secret("app secret") ) ) (#5293<https://github.com/syslog-ng/syslog-ng/pull/5293>) * multi-line-mode(): Added a new mutiline detection mode empty-line-separated that, as its name suggests, reads and treats all messages as one till it receives an empty line (which contains only a \r, \n or \r\n sequence). (#5259<https://github.com/syslog-ng/syslog-ng/pull/5259>) * google-pubsub-grpc(): Added a new destination that sends logs to Google Pub/Sub via the gRPC interface. Example config: google-pubsub-grpc( project("my_project") topic($topic) data($MESSAGE) attributes( timestamp => $S_ISODATE, host => $HOST, ) workers(4) batch-timeout(1000) # ms batch-lines(1000) ); The project() and topic() options are templatable. The default service endpoint can be changed with the service_endpoint() option. (#5266<https://github.com/syslog-ng/syslog-ng/pull/5266>) * ivykis: We have switched to our own fork<https://github.com/balabit/ivykis> of ivykis as the source for builds when using syslog-ng’s internal ivykis option (--with-ivykis=internal in autotools or -DIVYKIS_SOURCE=internal in CMake). We recommend switching to this internal version, as it includes new features not available in the original version<https://github.com/buytenh/ivykis> and likely never will be. (#5307<https://github.com/syslog-ng/syslog-ng/pull/5307>) * ivykis: Fixed and merged the in development phase io_uring based polling method solution to our ivykis fork<https://github.com/balabit/ivykis>. This is am experimental integration and not selected by default, you must activate it directly either using the IV_EXCLUDE_POLL_METHOD or IV_SELECT_POLL_METHOD as described here<https://syslog-ng.github.io/admin-guide/060_Sources/020_File/001_File_follo…>. (#5312<https://github.com/syslog-ng/syslog-ng/pull/5312>) * file(), wildcard-file(): Added follow-method() option. |Accepted values:| legacy | inotify | poll | system | This option controls how syslog-ng will follow file changes. The default legacy mode preserves the pre-4.9 version file follow-mode behavior of syslog-ng, which is based on the value of follow-freq(). The poll value forces syslog-ng to poll for file changes at the interval specified by the monitor-freq() option, even if a more efficient method (such as inotify or kqueue) is available. If inotify is selected and supported by the platform, syslog-ng uses it to detect changes in source files. This is the most efficient and least resource-consuming option available on Linux for regular files. The system value will use system poll methods (via ivykis) like port-timer port dev_poll epoll-timerfd epoll kqueue ppoll poll and uring. For more information about how to control the system polling methods used, see How content changes are followed in file() and wildcard-file() sources<https://syslog-ng.github.io/admin-guide/060_Sources/020_File/001_File_follo…>. (#5338<https://github.com/syslog-ng/syslog-ng/pull/5338>) * opentelemetry(), loki() destination: Add support for templated header() values (#5184<https://github.com/syslog-ng/syslog-ng/pull/5184>) Bugfixes * syslog-ng-otlp() destination: Fixed a crash. (#5267<https://github.com/syslog-ng/syslog-ng/pull/5267>) * Fixed some time parsing and time formatting issues. (#5386<https://github.com/syslog-ng/syslog-ng/pull/5386>) * syslogformat: Fix integer overflow on set pri (#5254<https://github.com/syslog-ng/syslog-ng/pull/5254>) * network(), syslog(): Fixed a potential crash for TLS destinations during reload In case of a TLS connection, if the handshake didn't happen before reloading syslog-ng, it crashed on the first message sent to that destination. (#5303<https://github.com/syslog-ng/syslog-ng/pull/5303>) * collectd(): fix not reading server responses (#5390<https://github.com/syslog-ng/syslog-ng/pull/5390>) * metrics: syslog-ng-ctl --reset will no longer reset Prometheus metrics (#5261<https://github.com/syslog-ng/syslog-ng/pull/5261>) * rate-limit(): fix precision issue that could occur at a very low message rate (#5346<https://github.com/syslog-ng/syslog-ng/pull/5346>) * network(), syslog() sources and destinations: fix TCP/TLS shutdown (#5271<https://github.com/syslog-ng/syslog-ng/pull/5271>) * http: Fixed a batching related bug that happened with templated URLs and a single worker. (#5281<https://github.com/syslog-ng/syslog-ng/pull/5281>) * network(), syslog() destinations: handle async TLS messages (KeyUpdate, etc.) (#5390<https://github.com/syslog-ng/syslog-ng/pull/5390>) Notes to developers * editorconfig: configure supported editors for the project's style (#5331<https://github.com/syslog-ng/syslog-ng/pull/5331>) Other changes * java-modules: Upgrade java common and hdfs dependencies. (#5366<https://github.com/syslog-ng/syslog-ng/pull/5366>) * java-modules: Remove depricated java destinations: elasticsearch2, kafka-java and the java-http. The following destinations can be used instead: * elasticsearch2 - Both elastic-datastream()<https://syslog-ng.github.io/admin-guide/070_Destinations/035_elasticsearch-…> or the elastic-http()<https://syslog-ng.github.io/admin-guide/070_Destinations/030_Elasticsearch-…> can be used. * kafka-java - The C based kafka-c()<https://syslog-ng.github.io/admin-guide/070_Destinations/100_Kafka-c/README> destination can be used instead. To help with migration check out the Shifting from Java implementation to C implementation<https://syslog-ng.github.io/admin-guide/070_Destinations/100_Kafka-c/001_Sh…> page. * java-http - the C based http()<https://syslog-ng.github.io/admin-guide/070_Destinations/081_http/README> destination can be used. (#5366<https://github.com/syslog-ng/syslog-ng/pull/5366>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Alex Becker, Attila Szakacs, Balazs Scheidler, Bálint Horváth, David Mandelberg, Eli Schwartz, Hofi, Kovács Gergő Ferenc, László Várady, Peter Czanik (CzP), Petr Vaganov, Shiraz, Szilard Parrag, Tamas Pal, Tamás Kosztyu, shifter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

3 3

The syslog-ng Insider 2025-08: HDFS; configuration; Prometheus
by Peter Czanik (pczanik) 14 Aug '25

14 Aug '25

Dear syslog-ng users, This is the 133rd issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Deprecating Java-based drivers from syslog-ng: Is HDFS next? ------------------------------------------------------------ While most Java-based drivers have been deprecated in syslog-ng years ago, we have recently removed all of them in preparation to syslog-ng 4.9.0. Right now, the only Java-based driver remaining is HDFS, so we want to ask the syslog-ng community if the HDFS destination is still needed for them. https://www.syslog-ng.com/community/b/blog/posts/deprecating-java-based-dri… Your first steps configuring syslog-ng -------------------------------------- Some of our most active users chose syslog-ng because of its detailed and accurate documentation (https://syslog-ng.github.io/) Later I received complaints that it is too detailed, and we need a tutorial: https://peter.czanik.hu/posts/syslog-ng-tutorial-toc/. This time, I was asked for something even shorter. Here you are! https://www.syslog-ng.com/community/b/blog/posts/your-first-steps-configuri… Prometheus exporter in syslog-ng -------------------------------- Last year, we published a Prometheus exporter for syslog-ng, implemented in Python. However, syslog-ng 4.9.0 will include one that runs as part of syslog-ng. Needless to say, testing and feedback are very welcome! https://www.syslog-ng.com/community/b/blog/posts/prometheus-exporter-in-sys… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

The syslog-ng Insider 2025-06: arm64; PAM; testing
by Peter Czanik (pczanik) 18 Jun '25

18 Jun '25

Dear syslog-ng users, This is the 132nd issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Installing nightly syslog-ng arm64 packages on a Raspberry Pi -------------------------------------------------------- Last week, I posted about running nightly syslog-ng container images on arm64. However, you can also install syslog-ng directly on the host (in my case, a Raspberry Pi 3), running the latest Raspberry OS. https://www.syslog-ng.com/community/b/blog/posts/installing-nightly-syslog-… Working with One Identity Cloud PAM Linux agent logs in syslog-ng ------------------------------------------------- One Identity Cloud PAM is one of the latest security products by One Identity. It provides asset management as well as secure and monitored remote access for One Identity Cloud users to hosts on their local network. Last year, I showed you how collect One Identity Cloud PAM Network Agent log messages on Windows and create alerts when somebody connects to a host on your local network using PAM Essentials. This time, I will show you how to work with the Linux version of the Network Agent. https://www.syslog-ng.com/community/b/blog/posts/working-with-one-identity-… Testing the new syslog-ng wildcard-file() source options on Linux ---------------------------------------------------------- Last year, syslog-ng 4.8.0 improved the wildcard-file() source on FreeBSD and MacOS. Version 4.9.0 will do the same for Linux by using inotify for file and directory monitoring, resulting in faster performance while using significantly less resources. This blog is a call for testing the new wildcard-file() source options before release. https://www.syslog-ng.com/community/b/blog/posts/testing-the-new-syslog-ng-… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng to Azure Sentinel
by David Jones 23 May '25

23 May '25

I am dealing with the known Cisco bug for Excessive logging of "vpn:vpn [INFO] device" messages in /var/log/messages file. It is filling our ingestion cap. I have tried numerous ways to block this from being ingested but nothing has worked(adding filter and log). Below is my syslog-ng.conf and I am looking for any advice to stop the "vpn:vpn [INFO] device" messages from being sent. There are no syslog ids for this either so blocking it from FMC also isn't working source s_sys { system(); internal(); # udp(ip(0.0.0.0) port(514)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" flush_lines(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_kern { file("/var/log/kern"); }; destination d_mlal { usertty("*"); }; filter f_kernel { facility(kern); }; filter f_default { level(info..emerg) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_auth { facility(authpriv); }; filter f_mail { facility(mail); }; filter f_emergency { level(emerg); }; filter f_news { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_boot { facility(local7); }; filter f_cron { facility(cron); }; #log { source(s_sys); filter(f_kernel); destination(d_cons); }; log { source(s_sys); filter(f_kernel); destination(d_kern); }; log { source(s_sys); filter(f_default); destination(d_mesg); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_mail); destination(d_mail); }; log { source(s_sys); filter(f_emergency); destination(d_mlal); }; log { source(s_sys); filter(f_news); destination(d_spol); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; log { source(s_sys); filter(f_cron); destination(d_cron); }; # Source additional configuration files (.conf extension only) @include "/etc/syslog-ng/conf.d/*.conf" # vim:ft=syslog-ng:ai:si:ts=4:sw=4:et: # # source s_src { udp( port(514)); tcp( port(514));}; Confidentiality Notice: This message is confidential, intended only for the named recipient(s) and may contain information that is privileged, attorney work product or exempt from disclosure under applicable law. If you are not the intended recipient(s), you are notified that the dissemination, distribution or copying of this message is strictly prohibited. If you receive this message in error, or are not the named recipient(s), please notify the sender at the email address or Becket & Lee, LLP at 610-644-7800 and delete this email from your computer. Receipt by anyone other than the named recipient(s) is not a waiver of any attorney-client, work product, or other applicable privilege. Thank you.

2 1