- syslog-ng - lists.balabit.hu

Insider 2021-09: 3.34; OpenBSD; OpenSearch; http() destination;
by Peter Czanik (pczanik) 17 Sep '21

17 Sep '21

Dear syslog-ng users, This is the 94th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Version 3.34.1 available ------------------------ Version 3.34.1 of syslog-ng has been released with many interesting new features. There is now a new parser that can parse messages with regular expressions. The throughput of the Redis destination driver has increased drastically. TLS and WebSocket Secure support have been added to the MQTT destination. Performance of the disk-buffer has improved considerably. For a full list of changes and source code, check https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-3.34.1 Syslog-ng updated in OpenBSD ports ---------------------------------- Recently I have found that the number of syslog-ng users on OpenBSD is growing, even with an ancient syslog-ng version in OpenBSD ports that is unable to collect local log messages. Then I remembered that Todd Miller – maintainer of sudo, and my colleague at One Identity – is also an OpenBSD user and developer. I asked him for a little help, which turned out to be quite a lot in the end, but syslog-ng is now updated to the latest version in OpenBSD ports! https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-updated-in-openb… Opensearch and syslog-ng ------------------------ Opensearch is a fork of the Elastic stack code base, made right before the license change. The first release candidate (RC1) has been released recently. Next to plain text files, Elasticsearch is one of the most popular destinations in syslog-ng, but after the license change people started to look for alternatives. I did some quick tests and using the elasticsearch-http() destination, syslog-ng seems to work fine with Opensearch as well. You can learn from this blog how to get started with Opensearch, dashboards and syslog-ng. Another alternative that syslog-ng users explored is Grafana Loki. https://www.syslog-ng.com/community/b/blog/posts/opensearch-and-syslog-ng Creating a new http()-based syslog-ng destination: Seq ------------------------------------------------------ Recently, many services provide an HTTP-based API to send messages. With a bit of luck, the given service is already supported directly by syslog-ng, or by using the Apprise Python library from the syslog-ng Python destination. In other cases, you need to do the research yourself on how the given HTTP-based service works. It might be scary at first, but often, it just takes a bit of experimenting and reading the documentation. In this blog, I’m showing you how to send log messages to Seq, a container-based log management software for application logs. The focus of this blog is to understand what to look for in the documentation of software to create an http()-based destination in syslog-ng. You can install Seq in a container, it is easy, but not necessary. https://www.syslog-ng.com/community/b/blog/posts/creating-a-new-http--based… WEBINARS * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng on NetBSD
by Peter Czanik (pczanik) 14 Sep '21

14 Sep '21

Hi, I just published updated syslog-ng pkgsrc for NetBSD on GitHub for testing. From the README: " syslog-ng pkgsrc for testing Thanks to the syslog-ng team, syslog-ng now works fine on NetBSD. This is my attempt to update syslog-ng in pkgsrc from version 3.17 to 3.34. It works on my machine (AMD64, NetBSD 9.2), but before trying to submit it to pkgsrc I'd love to see, that it also works for others :-) Rename /usr/pkgsrc/sysutils/syslog-ng to something else, copy the syslog-ng directory from this repo to replace it. Now you are ready to compile syslog-ng. " It is available at: https://github.com/czanik/netbsd Any feedback is welcome! Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng-3.34.1
by Attila Szakacs (aszakacs) 14 Sep '21

14 Sep '21

3.34.1 Highlights * regexp-parser(): new parser that can parse messages with regular expressions Example: regexp-parser( template("${MESSAGE}") prefix(".regexp.") patterns("(?<DN>foo)", "(?<DN>ball)") ); regexp-parser() can be used as an intuitive replacement for regexp filters that had their store-matches flag set in order to save those matches. (#3702<https://github.com/syslog-ng/syslog-ng/pull/3702>) * redis(): workers() and batching support The Redis driver now support the workers() option, which specifies the number of parallel workers, and the batch-lines() option. This could drastically increase the throughput of the Redis destination driver. Example: redis( host("localhost") port(6379) command("HINCRBY", "hosts", "$HOST", "1") workers(8) batch-lines(100) batch-timeout(10000) log-fifo-size(100000) ); (#3732<https://github.com/syslog-ng/syslog-ng/pull/3732>, #3745<https://github.com/syslog-ng/syslog-ng/pull/3745>) * mqtt(): TLS and WebSocket Secure support The MQTT destination now supports TLS and WSS. Example config: mqtt( address("ssl://localhost:8883") topic("syslog/$HOST") fallback-topic("syslog/fallback") tls( ca-file("/path/to/ca.crt") key-file("/path/to/client.key") cert-file("/path/to/client.crt") peer-verify(yes) ) ); (#3747<https://github.com/syslog-ng/syslog-ng/pull/3747>) Features * system() source: added support for NetBSD (#3761<https://github.com/syslog-ng/syslog-ng/pull/3761>) * stats: new statistics counter The following statistics are now available for the HTTP destination, and other file and network based sources/destinations: * msg_size_max/msg_size_avg: Shows the largest/average message size of the given source/destination that has been measured so far. * batch_size_max/batch_size_avg: When batching is enabled, then this shows the largest/average batch size of the given source/destination that has been measured so far. * eps_last_1h, eps_last_24h, eps_since_start: Events per second, measured for the last hour, for the last 24 hours, and since syslog-ng startup, respectively. Notes: * Message sizes are calculated from the incoming raw message length on the source side, and from the outgoing formatted message length on the destination side. * EPS counters are just approximate values, they are updated every minute. (#3753<https://github.com/syslog-ng/syslog-ng/pull/3753>) * mqtt(): username/password authentication Example config: mqtt( address("tcp://localhost:1883") topic("syslog/messages") username("user") password("passwd") ); Note: The password is transmitted in cleartext without using ssl:// or wss://. (#3747<https://github.com/syslog-ng/syslog-ng/pull/3747>) * mqtt(): new option http-proxy() for specifying HTTP/HTTPS proxy for WebSocket connections (#3747<https://github.com/syslog-ng/syslog-ng/pull/3747>) * syslog-ng-ctl: new flag for pruning statistics syslog-ng-ctl stats --remove-orphans can be used to remove "orphaned" statistic counters. It is useful when, for example, a templated file destination ($YEAR.$MONTH.$DAY) produces a lot of stats, and one wants to remove those abandoned counters occasionally/conditionally. (#3760<https://github.com/syslog-ng/syslog-ng/pull/3760>) * disk-buffer(): added a new option to reliable disk-buffer: qout-size(). This option sets the number of messages that are stored in the memory in addition to storing them on disk. The default value is 1000. This serves performance purposes and offers the same no-message-loss guarantees as before. It can be used to maintain a higher throughput when only a small number of messages are waiting in the disk-buffer. (#3754<https://github.com/syslog-ng/syslog-ng/pull/3754>) Bugfixes * network(), syslog(): fixed network sources on NetBSD On NetBSD, TCP-based network sources closed their listeners shortly after startup due to a non-portable TCP keepalive setting. This has been fixed. (#3751<https://github.com/syslog-ng/syslog-ng/pull/3751>) * disk-buffer(): fixed a very rare case, where the reliable disk-buffer never resumed after triggering flow-control. (#3752<https://github.com/syslog-ng/syslog-ng/pull/3752>) * disk-buffer(): fixed a rare memory leak that occurred when mem-buf-length() or mem-buf-size() was configured incorrectly (#3750<https://github.com/syslog-ng/syslog-ng/pull/3750>) * redis(): fixed command errors that were not detected and marked as successful delivery (#3748<https://github.com/syslog-ng/syslog-ng/pull/3748>) Notes to developers * Light framework: new proxy-related options are supported with loggen: --proxy-src-ip, --proxy-dst-ip, --proxy-src-port, --proxy-dst-port (#3766<https://github.com/syslog-ng/syslog-ng/pull/3766>) * log-threaded-dest: descendant drivers from LogThreadedDest no longer inherit batch-lines() and batch-timeout() automatically. Each driver have to opt-in for these options with log_threaded_dest_driver_batch_option. log_threaded_dest_driver_option has been renamed to log_threaded_dest_driver_general_option, and log_threaded_dest_driver_workers_option have been added similarly to the batch-related options. (#3741<https://github.com/syslog-ng/syslog-ng/pull/3741>) Other changes * disk-buffer(): performance improvements Based on our measurements, the following can be expected compared to the previous syslog-ng release (v3.33.1): * non-reliable disk buffer: up to 50% performance gain; * reliable disk buffer: up to 80% increase in performance. (#3743<https://github.com/syslog-ng/syslog-ng/pull/3743>, #3746<https://github.com/syslog-ng/syslog-ng/pull/3746>, #3754<https://github.com/syslog-ng/syslog-ng/pull/3754>, #3756<https://github.com/syslog-ng/syslog-ng/pull/3756>, #3757<https://github.com/syslog-ng/syslog-ng/pull/3757>) * disk-buffer(): the default value of the following options has been changed for performance reasons: * truncate-size-ratio(): from 0.01 to 0.1 (from 1% to 10%) * qout-size(): from 64 to 1000 (this affects only the non-reliable disk buffer) (#3757<https://github.com/syslog-ng/syslog-ng/pull/3757>) * kafka-c(): properties-file() option is removed Please list librdkafka properties in the config() option in syslog-ng's configuration. See librdkafka configuration here<https://github.com/edenhill/librdkafka/blob/master/CONFIGURATION.md>. (#3704<https://github.com/syslog-ng/syslog-ng/pull/3704>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Attila Szakacs, Balazs Scheidler, Balázs Barkó, Benedek Cserhati, Fabrice Fontaine, Gabor Nagy, Laszlo Szemere, LittleFish33, László Várady, Norbert Takacs, Parrag Szilárd, Peter Czanik, Peter Kokai, Zoltan Pallagi

2 1

librdkafka config property error on startup
by Sanjay Patel 09 Sep '21

09 Sep '21

I am trying to use Kafka-c with Syslog-ng. I have version Kafka 3.31 of Kafka installed, and I have syslog-ng-mod-rdkafka installed. When I start Syslog-ng, I get the following error. I can't figure out where it is getting this setting from. Syslog starts, but it does not send any logs to Kafka. kafka: error setting librdkafka config property; name='topic.partitioner', value='murmur2_random', error='No such configuration property: My Kafka config looks as follows: @include "scl.conf" destination d_kafka { kafka-c( bootstrap-servers("10.254.164.15:9092") topic("incoming") ); }; log { source(s_network); destination(d_kafka); }; Any help will be deeply appreciated. SKP <https://t.sidekickopen07.com/s3t/o/5/f18dQhb0S7n28cFBYDW5xwfpz2zGCvGW40Fv_6 2SXRqbW4NBnl23Lrg1WW5vbH2n1cd60nf197v5Y04?si=7000000000968799&pi=6743fafd-f6 76-41ef-ba50-d690c0278659>

3 3

Re: [syslog-ng] FW: Resource temporarily unavailable while reading from system.journal
by Alexandre Santos 02 Sep '21

02 Sep '21

Hi Laszlo, I am running a debian10 with syslog-ng 3.32. If using the default syslog-ng configuration for Debian 10, the error is reproducible. It happened to me when stimulating the syslog-ng using logger command. Sorry for the delay in reply. Thanks and regards, Alex On Wed, Aug 18, 2021 at 9:39 AM Alexandre Santos <ASantos(a)infinera.com> wrote: > > > > > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> * On Behalf Of *Laszlo > Szemere (lszemere) > *Sent:* 17 de agosto de 2021 15:20 > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Resource temporarily unavailable while reading > from system.journal > > > > Hello Alex, > > > > sorry for not responding sooner. > > > > From my experience, the most common reasons behind this error messages are: > > > > 1) Syslog-ng do not have the proper permissions to read /dev/log > > 2) /dev/log is already opened by an another process. (Maybe Syslog-ng > started multiple times.) > > > > > > If the problem still exists, please share the details of your platform and > I will try to reproduce your problem with the attached configuration. > > > > > > Best regards, > > Laszlo > > > ------------------------------ > > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Alexandre Santos <alexandre.rosas.santos(a)gmail.com> > *Sent:* Thursday, August 12, 2021 15:40 > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* [syslog-ng] Resource temporarily unavailable while reading > from system.journal > > > > Hi, > > > > I am seeing the following strace log when running the syslog-ng 3.32 with > the configuration in the attachment: > > root@myhost:/home/shared# sudo strace -f -yyy -s 256 -e trace=read -p 2539 > strace: Process 2539 attached with 4 threads > [pid 2539] read(48<anon_inode:[timerfd]>, "\1\0\0\0\0\0\0\0", 8) = 8 > [pid 2539] read(11<anon_inode:inotify>, > "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 > [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN > (Resource temporarily unavailable) > [pid 2539] read(11<anon_inode:inotify>, > "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 > [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN > (Resource temporarily unavailable) > [pid 2539] read(11<anon_inode:inotify>, > "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 > [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN > (Resource temporarily unavailable) > [pid 2539] read(11<anon_inode:inotify>, > "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 > [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN > (Resource temporarily unavailable) > [pid 2539] read(11<anon_inode:inotify>, > "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 > [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN > (Resource temporarily unavailable) > [pid 2539] read(11<anon_inode:inotify>, > "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 > [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN > (Resource temporarily unavailable) > [pid 2539] read(11<anon_inode:inotify>, > "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 > [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN > (Resource temporarily unavailable) > [pid 2539] read(11<anon_inode:inotify>, > "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 > [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN > (Resource temporarily unavailable) > [pid 2539] read(11<anon_inode:inotify>, > "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 > [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN > (Resource temporarily unavailable) > ^Cstrace: Process 2539 detached > strace: Process 11623 detached > strace: Process 20518 detached > strace: Process 22517 detached > > > > This normal behaviour? > > > > Thanks & Regards, > > Alex >

1 0

FW: librdkafka config property error on startup
by Sanjay Patel 02 Sep '21

02 Sep '21

I am trying to use Kafka-c with Syslog-ng. I have version Kafka 3.31 of Kafka installed, and I have syslog-ng-mod-rdkafka installed. When I start Syslog-ng, I get the following error. I can't figure out where it is getting this setting from. Syslog starts, but it does not send any logs to Kafka. kafka: error setting librdkafka config property; name='topic.partitioner', value='murmur2_random', error='No such configuration property: My Kafka config looks as follows: @include "scl.conf" destination d_kafka { kafka-c( bootstrap-servers("10.254.164.15:9092") topic("incoming") ); }; log { source(s_network); destination(d_kafka); }; Any help will be deeply appreciated. SKP <https://t.sidekickopen07.com/s3t/o/5/f18dQhb0S7n28cFBYDW5xwfpz2zGCvGW40Fv_6 2SXRqbW4NBnl23Lrg1WW5vbH2n1cd60nf197v5Y04?si=7000000000968799&pi=e03e7148-99 d8-470a-8205-9df1e2d92622>

1 0

No remote logging
by Alexandre Santos 01 Sep '21

01 Sep '21

Hi, I tying to do some remote logging from a Debian10 with syslog-ng 3.19. I have 2 syslog-ng's running, one in the default VRF which receives the logs from the applications, and another syslog-ng in an EXTERNAL VRF which send the logs to log-servers. The default VRF sends the logs to the EXTERNAL VRF via a unix domain. The problem is that sometimes is not streaming anything to remote log servers after configuring it. I have to restart the syslog-ng processes to start the remote logging. Local logging is working fine. Have you come across this issue before? Thanks and Regards, Alex

1 0

Resource temporarily unavailable while reading from system.journal
by Alexandre Santos 17 Aug '21

17 Aug '21

Hi, I am seeing the following strace log when running the syslog-ng 3.32 with the configuration in the attachment: root@myhost:/home/shared# sudo strace -f -yyy -s 256 -e trace=read -p 2539 strace: Process 2539 attached with 4 threads [pid 2539] read(48<anon_inode:[timerfd]>, "\1\0\0\0\0\0\0\0", 8) = 8 [pid 2539] read(11<anon_inode:inotify>, "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN (Resource temporarily unavailable) [pid 2539] read(11<anon_inode:inotify>, "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN (Resource temporarily unavailable) [pid 2539] read(11<anon_inode:inotify>, "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN (Resource temporarily unavailable) [pid 2539] read(11<anon_inode:inotify>, "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN (Resource temporarily unavailable) [pid 2539] read(11<anon_inode:inotify>, "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN (Resource temporarily unavailable) [pid 2539] read(11<anon_inode:inotify>, "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN (Resource temporarily unavailable) [pid 2539] read(11<anon_inode:inotify>, "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN (Resource temporarily unavailable) [pid 2539] read(11<anon_inode:inotify>, "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN (Resource temporarily unavailable) [pid 2539] read(11<anon_inode:inotify>, "\2\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0system.journal\0\0", 272) = 32 [pid 2539] read(11<anon_inode:inotify>, 0x7ffda019f930, 272) = -1 EAGAIN (Resource temporarily unavailable) ^Cstrace: Process 2539 detached strace: Process 11623 detached strace: Process 20518 detached strace: Process 22517 detached This normal behaviour? Thanks & Regards, Alex

2 1

syslong-ng-ctl stats
by Faine, Mark R. (MSFC-IS40)[NICS] 16 Aug '21

16 Aug '21

Can syslog-ng-ctl stats show me the not just the number of messages processed but size transferred and/or on disk? Thanks, -Mark

2 1

Re: [syslog-ng] syslog-ng Digest, Vol 195, Issue 9
by Linn, William 23 Jul '21

23 Jul '21

Laci, Thanks for your response, I figured out my problem. Thanks again -----Original Message----- From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: Friday, July 23, 2021 4:08 AM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 195, Issue 9 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://urldefense.com/v3/__https://lists.balabit.hu/mailman/listinfo/syslo… or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: syslog-ng Digest, Vol 195, Issue 7 (Laszlo Szemere (lszemere)) ---------------------------------------------------------------------- Message: 1 Date: Fri, 23 Jul 2021 08:08:10 +0000 From: "Laszlo Szemere (lszemere)" <Laszlo.Szemere(a)oneidentity.com> To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] syslog-ng Digest, Vol 195, Issue 7 Message-ID: <DM6PR19MB346532CA52F4D51920BFFC529DE59(a)DM6PR19MB3465.namprd19.prod.outlook.com> Content-Type: text/plain; charset="iso-8859-1" Hello Linn, I am sorry, but I haven't noticed your message before. (My email client mixed it because of the subject.) Could you please elaborate on the statement "fails to work"? What are the symptoms? Syslog-ng fails to start, or it is working differently than what you expect? Starting Syslog-ng with debugging enabled, might help to pinpoint the problem. ./syslog-ng -Fdevt -F, --foreground Do not go into the background after initialization -v, --verbose Be a bit more verbose -d, --debug Enable debug messages -t, --trace Enable trace messages -e, --stderr Log messages to stderr Best regards, Laci ________________________________ From: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of Linn, William <wlinn(a)bofa.com> Sent: Tuesday, July 20, 2021 16:08 To: syslog-ng(a)lists.balabit.hu <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] syslog-ng Digest, Vol 195, Issue 7 CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe. I am having issues with a previous configuration set up in 2012. How to re-write it to work, here is the configuration that fails to work. destination d_apps { file("/syslog-ng/app/${HOST}/${HOST}-application.log.${DAY}" owner("root") group("root") perm(0644) dir_perm(0755) create_dirs(yes) overwrite_if_older(604800) ); }; destination d_systems {file("/syslog-ng/sys/${HOST}/${HOST}-system.log.${DAY}" owner("root") group("root") perm(0644) dir_perm(0755) create_dirs(yes) overwrite_if_older(604800) ); }; destination d_auth {file("/syslog-ng/auth/auth.log.${MONTH}" owner("root") group("root") perm(0640) dir_perm(0750) create_dirs(yes) overwrite_if_older(604800) ); }; -----Original Message----- From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: Tuesday, July 20, 2021 8:00 AM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 195, Issue 7 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://urldefense.com/v3/__https://nam12.safelinks.protection.outlook.com/… or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. syslog-ng-3.33.2 (Laszlo Szemere (lszemere)) ---------------------------------------------------------------------- Message: 1 Date: Mon, 19 Jul 2021 13:38:23 +0000 From: "Laszlo Szemere (lszemere)" <Laszlo.Szemere(a)oneidentity.com> To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] syslog-ng-3.33.2 Message-ID: <DM6PR19MB346594FBE1EDA3F73ACFEB699DE19(a)DM6PR19MB3465.namprd19.prod.outlook.com> Content-Type: text/plain; charset="iso-8859-1" 3.33.2 Bugfixes * disk-buffer: fixed a bug, which was introduced in 3.33.1, where we sometimes corrupted the disk-buffer file when it reached full size. (#3726<https://urldefense.com/v3/__https://nam12.safelinks.protection.outlook.com/… >) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Antal Nemes, Attila Szakacs, Balázs Barkó, Balazs Scheidler, Benedek Cserhati, Gabor Nagy, Josef Schlehofer, Laszlo Budai, Laszlo Szemere, László Várady, Norbert Takacs, Parrag Szilárd, Peter Kokai, Zoltan Pallagi -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://urldefense.com/v3/__https://nam12.safelinks.protection.outlook.com/… > ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://urldefense.com/v3/__https://nam12.safelinks.protection.outlook.com/… ------------------------------ End of syslog-ng Digest, Vol 195, Issue 7 ***************************************** ---------------------------------------------------------------------- This message, and any attachments, is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at https://urldefense.com/v3/__https://nam12.safelinks.protection.outlook.com/… . If you are not the intended recipient, please delete this message. ______________________________________________________________________________ Member info: https://urldefense.com/v3/__https://nam12.safelinks.protection.outlook.com/… Documentation: https://urldefense.com/v3/__https://nam12.safelinks.protection.outlook.com/… FAQ: https://urldefense.com/v3/__https://nam12.safelinks.protection.outlook.com/… -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://urldefense.com/v3/__http://lists.balabit.hu/pipermail/syslog-ng/att… > ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://urldefense.com/v3/__https://lists.balabit.hu/mailman/listinfo/syslo… ------------------------------ End of syslog-ng Digest, Vol 195, Issue 9 ***************************************** ---------------------------------------------------------------------- This message, and any attachments, is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.bankofamerica.com/emaildisclaimer. If you are not the intended recipient, please delete this message.

1 0