- syslog-ng - lists.balabit.hu

file("/proc/kmsg" program_override("kernel: "));
by Tom 29 May '12

29 May '12

Dear all, I just started using syslog-ng to pipe log files to Loggly.com. I have a couple of questions. First of all, why is there a `: ` after kernel here? file("/proc/kmsg" program_override("kernel: ")); I have seen people do it differently, like so: file("/proc/kmsg" program_override("kernel)); Does this matter? And more general, what does the entire rule do exactly? The following is my syslog-ng.conf file: https://gist.github.com/2819768 As you can see, I have a lot of log files. Is this the proper way of doing this? Doesn't it cost a lot of resources for syslog-ng to check all these files for changes? Finally, where can I find the documentation? Eg. I would like to learn about the specifics of follow_freq and what the parameter actually implies. Thanks a lot for your help. Kind regards, Tom

3 2

Writing JSON message to a MongoDB destination
by Rajalakshmi Iyer 29 May '12

29 May '12

Hello, I have a log message in JSON format that needs to be written to the MongoDB database, such that I should be able to later query the database based on fields in the JSON record. However, when I try to use the syslog-ng mongodb destination driver using : destination d_mongodb { mongodb( servers("localhost:27017") database("syslog") collection("messages") value-pairs(key("MESSAGE")) ); }; The record appears in the mongodb database as: {"MESSAGE":<My JSON formatted message>} I do not want the MESSAGE macro to be part of the record in the database, I only want to it's JSON-encoded value to be entered in the database. Is this possible? Thanks in advance for your help. Regards, Raj -- Twitter: @Blismedia <http://twitter.com/#%21/blismobile> BlisMedia 32 Percy Street, London W1T 2DE www.blismedia.com <http://www.blismobile.com/> <http://www.blismobile.com/> [image: Follow on Twitter] <http://twitter.com/#%21/blismobile>[image: Blis Website] <http://www.blismobile.com/> This communication is from BlisMedia, which is a trading name of Breeze Tech (UK) Ltd, a company registered in England and Wales with registered number 06455773. Its registered office is 32 Percy Street, London W1T 2DE, United Kingdom. This communication contains information that is confidential and may also be privileged. It is for the exclusive use of the intended recipient(s). If you are not the intended recipient(s), please (1) notify info(a)blismedia.com<info(a)blismobile.com> by forwarding this email and delete all copies from your system and (2) note that disclosure, distribution, copying or use of this communication is strictly prohibited. Email communications cannot be guaranteed to be secure or free from error or viruses. All emails sent to or from a Blismobile email account are securely archived and stored by an external supplier. This email does not constitute a contractual agreement; such agreements are in specified contractual or Insertion Order (IO) form only and exclusively contain all the terms to which Breeze Tech )UK) Ltd will be bound. To the extent permitted by law, Breeze Tech (UK) Ltd does not accept any liability for use of or reliance on the contents of this email by any person save by the intended recipient(s) to the extent agreed in a contract or Insertion Order. Opinions, conclusions and other information in this email which have not been delivered by way of the business of Breeze Tech (UK) Ltd are neither given nor endorsed by it.

2 1

(no subject)
by pedro castro 28 May '12

28 May '12

http://cabinetbianchi.re/tenyun.php?top=288 Learn h0w t0 turn successful fr0m h0me ___ Indestructibility.Not capable of being injured or destroyed. damita aekerman

1 0

Connection pooling in syslog-ng for database destinations
by Rajalakshmi Iyer 28 May '12

28 May '12

Hello, I want to know if the syslog-ng destination plug-ins for writing logs directly into SQL databases or MongoDB use any connection pooling mechanism for connections to the back-end database? Regards, Raj -- Twitter: @Blismedia <http://twitter.com/#%21/blismobile> BlisMedia 32 Percy Street, London W1T 2DE www.blismedia.com <http://www.blismobile.com/> <http://www.blismobile.com/> [image: Follow on Twitter] <http://twitter.com/#%21/blismobile>[image: Blis Website] <http://www.blismobile.com/> This communication is from BlisMedia, which is a trading name of Breeze Tech (UK) Ltd, a company registered in England and Wales with registered number 06455773. Its registered office is 32 Percy Street, London W1T 2DE, United Kingdom. This communication contains information that is confidential and may also be privileged. It is for the exclusive use of the intended recipient(s). If you are not the intended recipient(s), please (1) notify info(a)blismedia.com<info(a)blismobile.com> by forwarding this email and delete all copies from your system and (2) note that disclosure, distribution, copying or use of this communication is strictly prohibited. Email communications cannot be guaranteed to be secure or free from error or viruses. All emails sent to or from a Blismobile email account are securely archived and stored by an external supplier. This email does not constitute a contractual agreement; such agreements are in specified contractual or Insertion Order (IO) form only and exclusively contain all the terms to which Breeze Tech )UK) Ltd will be bound. To the extent permitted by law, Breeze Tech (UK) Ltd does not accept any liability for use of or reliance on the contents of this email by any person save by the intended recipient(s) to the extent agreed in a contract or Insertion Order. Opinions, conclusions and other information in this email which have not been delivered by way of the business of Breeze Tech (UK) Ltd are neither given nor endorsed by it.

2 1

System Requirements for Syslog-ng
by Jerome Yanga 25 May '12

25 May '12

What are the system requirements for each mode? I have been trying to look for this piece of information in the site but I have not found it. Regards, j

2 1

remove header
by Richard F. Hart II 23 May '12

23 May '12

I have a juniper srx that is sending its syslogs to a syslog-ng server. Then I am having the syslog-ng server forward those juniper syslog messages to NItroSecurity ESM. However, I am having some difficutly. The syslog-ng server is appending a header to the beginning of the juniper syslog message when it sends it to the NitroSecurity ESM. How can I tell syslog-ng not to append its header to the beginning of the message? Here is a sample: *<14>May 22 08:31:03 syslog-ng.example.com* 2012-05-22T08:28:48.548 Juniper-SRX RT_FLOW - RT_FLOW_SESSION_CREATE [junos(a)2636.1.1.1.2.34source-address="192.168.1.34" source-port="40944" destination-address="4.2.2.2" destination-port="1984" service-name="None" nat-source-address="192.168.1.34" nat-source-port="40944" nat-destination-address="4.2.2.2" nat-destination-port="1984" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="6" policy-name="175008" source-zone-name="legacy" destination-zone-name="t-a" session-id-32="220372159" username="N/A" roles="N/A" packet-incoming-interface="reth4.0"] How do I stop syslog-ng from appending the underlined section? Thank you, Richard

3 2

.
by pedro castro 22 May '12

22 May '12

You can earn today money using your computer http://www.lekhajokha.in/hfdno.php?iriIDCid=855 Tue, 22 May 2012 13:59:18 ______________ That birds which fly with flapping wings derivetheir support from the air, is undoubtedly true,and that the lift produced is due, not to the form,or shape, or area of the wing, is also beyond question. jalyne aescleah

1 0

...
by pedro castro 20 May '12

20 May '12

Make aIot of money right from your PC http://kacchemicals.com/uuioino.php?ynenumberID=309 _______________ 126 86 36. emmett winefrith Sun, 20 May 2012 23:37:06

1 0

Rewriting CEF messages
by carlopmart 18 May '12

18 May '12

Hi all, I am trying to rewrite CEF messages that arrives to a syslog-ng instance. I am using the following rewrite rule: rewrite r_cef_logs { set("mydevice_logs", value("PROGRAM") condition(message("Device"))); }; Test message is: CEF:0|Device|Firewall|0|.... What am I doing wrong?? -- CL Martinez carlopmart {at} gmail {d0t} com

1 0

Introducing myself and GSoC syslog-ng MongoDB driver project
by Eun Kyung 18 May '12

18 May '12

Greetings, fellow developers. I recently joined the syslog-ng community because of Google Summer of Code, and I thought this would be a good time to briefly introduce myself. I am studying Information Technology in Dublin, Ireland, and I got accepted for GSoC 2012 to work on the MongoDB destination driver project. Syslog-ng, the leading logging platform for log collection and management, has been storing logs in MongoDB for over a year, but the technical documentation on the implementation is rudimentary, which impedes the improvement of the driver's functionality and speed. The goal of this project is to enhance the MongoDB destination driver for syslog-ng, to make it more robust, scalable and performant. Specific tasks and deliverables will include: - modifying syslog-ng's internal value pairs subsystem so that it will be able to emit a tree of values, instead of just a flat name:value list; - teaching the mongodb driver to walk the tree, and constructing BSON objects out of it, and using 'insert' instead of 'upsert'; - adding support for bulk inserts into a MongoDB, instead of inserting one by one My GSoC project proposal can be found at https://google-melange.appspot.com/gsoc/proposal/review/google/gsoc2012/eky… This is my first time working on an open source project, and I've liked a lot so far. My mentor has been tremendously friendly and helpful. I'm looking forward to a great summer of code with the syslog-ng community, and I would certainly like to keep you posted on the discussions and patches I will be making. Meanwhile, your comments and feedback would always be helpful. Best regards, Eun Kyung

1 0