- syslog-ng - lists.balabit.hu

Syslog-ng + Consuming syslog alerts via FIFO: Alarms being lost, no logs related anywhere
by Richter Vitali Guedes 16 Apr '21

16 Apr '21

This is my first time posting here. I hope you can help me. We have 8 collector servers running syslog probes. They also run a collector application. Syslog-ng receives all alarms through UDP Ports, filter them, and write a fifo. It also forwards these alarms through UDP to another server. We are using this another server that receives these forwarded messages as a validation point. There are some filter rules for the pipe delivery, and no filters for UDP delivery. But we could see several not filtered alarms being received at the UDP receiver server, but not being received by the collector application, that reads from the fifo (/opt/solution/src1.pipe). Collector logs have no error lines. I tried rewrititng syslog-ng configuration file, in order to use flow-control, that, according to syslog-ng documentation, is necessary for high volume environments (as this is the case here, 500-1000 alarms per second). I applied it yesterday, together with net.core.rmem_max=1024000, and the scenario got even worst. We noticed missing messages on the UDP destination server and on the fifo. Dropped packets counter on ifconfig was increasing quickly. We rolled back to the previous syslog-ng configuration. Below, you will find the first version of the syslog-ng.conf file, without flow-control (several names , filters and addresses were changed in sake of privacy): @version:3.19 @include "scl.conf" # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # Note: it also sources additional configuration files (*.conf) # located in /etc/syslog-ng/conf.d/ options { flush_lines (0); time_reopen (10); log_fifo_size (1000); chain_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { system(); internal(); # udp(ip(0.0.0.0) port(514)); }; template t_customer { template("${DATE} ${SOURCEIP} ${HOST} ${MSGHDR} ${MESSAGE}\n"); }; # UDP Source destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" flush_lines(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_kern { file("/var/log/kern"); }; destination d_mlal { usertty("*"); }; filter f_kernel { facility(kern); }; filter f_default { level(info..emerg) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_auth { facility(authpriv); }; filter f_mail { facility(mail); }; filter f_emergency { level(emerg); }; filter f_news { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_boot { facility(local7); }; filter f_cron { facility(cron); }; #log { source(s_sys); filter(f_kernel); destination(d_cons); }; #log { source(s_sys); filter(f_kernel); destination(d_kern); }; log { source(s_sys); filter(f_default); destination(d_mesg); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_mail); destination(d_mail); }; log { source(s_sys); filter(f_emergency); destination(d_mlal); }; log { source(s_sys); filter(f_news); destination(d_spol); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; log { source(s_sys); filter(f_cron); destination(d_cron); }; #Debug filter f_debu_1 { not level(debug); }; #Information filter f_info_1 { not match("PROGRAM-" value("MESSAGE")) }; filter f_info_2 { not match("Multicast Client" value("MESSAGE")); }; filter f_info_3 { not match("executeCommand" value("MESSAGE")); }; filter f_info_4 { not match("has the privilege to execute" value("MESSAGE")); }; filter f_info_5 { not match("Telnet " value("MESSAGE")); }; #Warning filter f_warn_1 { not match("LSP went Up" value("MESSAGE")); }; filter f_warn_2 { not match("LSP went Down" value("MESSAGE")); }; filter f_warn_3 { not match("Subscriber created" value("MESSAGE")); }; filter f_warn_4 { not match("Subscriber deleted" value("MESSAGE")); }; filter f_warn_5 { not match("BGP-WARN" value("MESSAGE")); }; filter f_warn_6 { not match("DHCPS-WARNING" value("MESSAGE")); }; filter f_warn_7 { not match("DHCP-WARNING" value("MESSAGE")); }; #Notice filter f_noti_1 { not match("iCDR\[[0-9]+\]:"); }; #Error filter f_erro_1 { not match("FAN started working" value("MESSAGE")); }; filter f_erro_2 { not match("FAN is not working" value("MESSAGE")); }; #Alert filter f_aler_1 { not match("LDP virtual tunnel went" value("MESSAGE")); }; #Critical filter f_crit_1 { not match("traps dropped" value("MESSAGE")); }; filter f_crit_2 { not match("upstream E1 signals" value("MESSAGE")); }; filter f_crit_3 { not match(",ABCDE," value("MESSAGE")); }; filter f_crit_4 { not match(",XYZW," value("MESSAGE")); }; filter f_crit_5 { not match(" for ABCDE-[0-9]" value("MESSAGE")); }; source s_dummy{ udp(ip(0.0.0.0) port(5140)); }; source src1{ udp(ip(0.0.0.0) port(514)); }; source s_10514{ udp(ip(0.0.0.0) port(10514)); }; source src2{ udp(ip(0.0.0.0) port(515)); }; destination d_src1 { pipe("/opt/solution/src1.pipe" template(t_customer)); }; destination d_src2 { pipe("/opt/solution/src2.pipe" template(t_customer)); }; destination d_syslogCustom{ pipe("/opt/solution/syslog_custom.pipe" template(t_customer)); }; destination d_udp_dst{ syslog("192.168.1.151" transport("udp") port(514) spoof_source(no)); }; filter f_src2 { host("r(core|distribution|management).*") or host("^abcd.*") or host("^d2") or host("src2") or host("xyz1") or host("^jkl") or host("asddf") or host("zxcvb"); }; log { source(src1); source(s_10514); filter(f_debu_1); filter(f_info_1); filter(f_info_2); filter(f_info_3); filter(f_info_4); filter(f_info_5); filter(f_warn_1); filter(f_warn_2); filter(f_warn_3); filter(f_warn_4); filter(f_warn_5); filter(f_warn_6); filter(f_warn_7); filter(f_noti_1); filter(f_erro_1); filter(f_erro_2); filter(f_aler_1); filter(f_crit_1); filter(f_crit_2); filter(f_crit_3); filter(f_crit_4); filter(f_crit_5); destination(d_src1); }; log { source(src2); filter(f_src2); destination(d_src2); }; log { source(src1); destination(d_udp_dst); }; That's all. I Also tried using flow-control. The main achanges are below: source src1{ # udp( network( #new driver syntax transport("udp") #new driver syntax ip(0.0.0.0) port(514) max-connections(3000) ); }; source s_10514{ # udp( network( #new driver syntax transport("udp") #new driver syntax ip(0.0.0.0) port(10514) max_connections(3000) ); }; source src2{ # udp( network( #new driver syntax transport("udp") #new driver syntax ip(0.0.0.0) port(515) max_connections(3000) ); }; destination d_src1 { pipe( "/opt/solution/src1.pipe" template(t_customer) log_fifo_size(600000) ); }; destination d_src2 { pipe( "/opt/solution/src2.pipe" template(t_customer) log_fifo_size(300000) ); }; destination d_udp_dst{ syslog( "192.168.1.151" transport("udp") port(514) spoof_source(no) log_fifo_size(300000) ); }; And the situation got even worst. So, I would like to ask you: How can I fix it? I need to be sure that all data received is forwarded to their destinations, respecting the filters, and without any information loss. I'm quite sure all data is being received, I've checked it using tcpdump, no udp packet loss during transmission. The most important sessions are: log { source(src1); source(s_10514); filter(f_debu_1); filter(f_info_1); filter(f_info_2); filter(f_info_3); filter(f_info_4); filter(f_info_5); filter(f_warn_1); filter(f_warn_2); filter(f_warn_3); filter(f_warn_4); filter(f_warn_5); filter(f_warn_6); filter(f_warn_7); filter(f_noti_1); filter(f_erro_1); filter(f_erro_2); filter(f_aler_1); filter(f_crit_1); filter(f_crit_2); filter(f_crit_3); filter(f_crit_4); filter(f_crit_5); destination(d_src1); }; log { source(src1); destination(d_udp_dst); }; Thanks a lot, and sorry for the huge message, Richter <https://www.linkedin.com/company/icarotech>

2 3

Insider 2021-04: Grafana; Windows agent; BSD;
by Peter Czanik (pczanik) 15 Apr '21

15 Apr '21

Dear syslog-ng users, This is the 90th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Grafana, Loki, syslog-ng: jump-starting a new logging stack ----------------------------------------------------------- Talking to syslog-ng users, I found that many of them plan to take a closer look at Grafana, due to the upheaval around the change of licensing terms for Elastic. Luckily, it is now possible to jump-start the complete, new logging stack – including Grafana, Loki, syslog-ng and tools to monitor this stack – with a single command. All you need to do is to point a couple of syslog clients at the included syslog-ng server and open Grafana in your browser. Of course, this setup is far from being production-ready, but it can speed up preparing a test environment for you. From this blog, you can learn how to install Grafana, Loki, syslog-ng stack, how to forward your log messages there, and how to check the results in Grafana. https://www.syslog-ng.com/community/b/blog/posts/grafana-loki-syslog-ng-jum… When to use the syslog-ng agent for Windows? -------------------------------------------- You can collect log messages from a Windows host in multiple ways using syslog-ng. For large scale installations the easiest is to use the Windows Event Collector (WEC) component of syslog-ng Premium Edition (PE). This way you don’t have to install any new client software on the Windows side, just point the WEC to the destionation to send their log messages. Please note that WEC only works for Windows EventLog. If you need to collect log messages from text files, you need to install the syslog-ng agent for Windows on your hosts. For example, web servers often log to files instead of Windows EventLog. Let’s review how to do a standalone installation of syslog-ng agent for Windows and then see the differences between using the legacy (RFC3164) and the new (RFC5424) syslog protocol. https://www.syslog-ng.com/community/b/blog/posts/when-to-use-the-syslog-ng-… Syslog-ng on BSDs ----------------- My FOSDEM presentation in the BSD devroom showcased what is new in sudo and syslog-ng and explained how to install or compile these software yourself on FreeBSD. Not only am I a long time FreeBSD user (started with version 1.0 in 1994) I also work on keeping the syslog-ng port in FreeBSD up to date. But soon after my presentation I was asked what I knew about other BSDs. And – while I knew that all BSDs have syslog-ng in their ports system – I realized I had no idea about the shape of those ports. For this article I installed OpenBSD, DragonFlyBSD and NetBSD to check syslog-ng on them. Admittedly, they are not in the best shape: they contain old versions, some do not even start or are unable to collect local log messages. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-on-bsds WEBINARS * Scale log collection from Windows endpoints with WEC clustering in syslog-ng https://www.syslog-ng.com/event/scale-log-collection-from-windows-endpoints… * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Try again: What's wrong with my config?
by Dan Egli 13 Apr '21

13 Apr '21

Okay. I'm completely stumped on this, and just before the list went down I was hoping someone could help me with this. I'm trying to break everything out of the monolithic /var/log/messages and place each service in it's own log file. To that extent, I created the following config file: syslog-ng config: @version: 3.30 @include "scl.conf" options { threaded(yes); chain_hostnames(no); stats_freq(43200); mark_freq(3600); }; source src { system(); internal(); }; filter samba { program("samba") or program("nmbd") or program("smbd"); }; filter sshd { program("ssdhd"); }; filter syslog { not filter(sshd) and not filter(samba); }; destination console { file("/dev/tty12"); }; destination messages { file("/var/log/messages"); }; destination sshd_log { file("/var/log/sshd/sshd.log"); }; log { source(src); filter(sshd); destination(sshd_log); flags(final); }; log { source(src); filter(syslog); destination(console); }; log { source(src); filter(syslog); destination(messages); }; so, as I understand the logic. The three log { } lines do this: log { source(src); filter(sshd); destination(sshd_log); flags(final); }; Anything from sshd gets written to the /var/log/sshd/sshd.log. Nothing else goes here. log { source(src); filter(syslog); destination(console); }; Anything that is not from sshd, not from smbd, not from sabma and not from nmbd goes to the /dev/tty12 device log { source(src); filter(syslog); destination(messages); }; likewises for /var/log/messages. Is my understanding correct? If so, WHY do I see ssh log entries in /var/log/messages? And how do I stop it!? sshd messages should ONLY show up in /etc/sshd/sshd.log. jupiter ~ # grep sshd /var/log/messages | head -n 2 Apr 13 00:00:50 jupiter sshd[14721]: Received disconnect from <IP> port 18726:11: [preauth] Apr 13 00:00:50 jupiter sshd[14721]: Disconnected from <IP> port 18726 [preauth] Thanks!

3 3

Re: [syslog-ng] Try again: What's wrong with my config?
by Dan Egli 13 Apr '21

13 Apr '21

I wish I knew how is was happening. On 4/13/2021 12:26 AM, Dan Egli wrote: > > Okay. I'm completely stumped on this, and just before the list went > down I was hoping someone could help me with this. > > I'm trying to break everything out of the monolithic /var/log/messages > and place each service in it's own log file. To that extent, I created > the following config file: > >

1 0

Re: [syslog-ng] Try again: What's wrong with my config?
by Dan Egli 13 Apr '21

13 Apr '21

crap. Not that bug again. Ignore this, and watch for my completed message. Sorry. On 4/13/2021 12:12 AM, Dan Egli wrote: > > Okay. I'm completely stumped on this, and just before the list went > down I was hoping someone could help me with this. >

1 0

mail list works again
by Peter Kokai (pkokai) 13 Apr '21

13 Apr '21

Hello all, The previous week there were some issue with the mail list, and it was not possible to send mail to it (mailman likely reported dns unable to resolve). This issue have been resolved, and you should be able to send mail now. -- kokan

1 0

Socket too many open files (24)
by Faine, Mark R. (MSFC-IS40)[NICS] 09 Apr '21

09 Apr '21

syslog-ng 3 (3.19.1) Error Message: syslog-ng[50418]: Error accepting control socket connection; error='Too many open files (24)' I'm seeing this in the syslog-ng logs. However, I've done everything I can think of to increase the file handles and the number of open file handles does not seem to be anywhere close to the max. What else could be causing this? Thanks, -Mark

2 1

Syslog-ng not honoring negative flag
by Dan Egli 09 Apr '21

09 Apr '21

I'm having a bit of a problem and hope someone here can help. I'm trying to separate individual items into specific logs, i.e. ssh events in sshd.log, samba messages in samba.log, etc... I managed to come up with filters that pull out the events I started with, and they are going into the correct log files. But they are ALSO going into /var/log/messages even though I specifically have a filter on that one that says not to include samba or sshd events. I'll copy my config file here. Hopefully someone can tell me what I did wrong. Thanks! --------------------------------------------- @version: 3.30 @include "scl.conf" options { threaded(yes); chain_hostnames(no); stats_freq(43200); mark_freq(3600); }; source src { system(); internal(); }; filter samba { program("samba"); }; filter ssh_messages { facility("AUTH") and level("INFO"); }; filter syslog { not filter("ssh_messages") and not filter("samba"); }; destination console { file("/dev/tty12"); }; destination messages { file("/var/log/messages"); }; destination sshd_log { file("/var/log/sshd/sshd.log"); }; destination smb_logs { file("/var/log/samba/samba.log"); }; log { source(src); destination(smb_logs); filter(samba); flags(final); ); log { source(src); destination(sshd_log); filter(ssh_messages); flags(final); }; log { source(src); destination(console); filter(syslog); }; log { source(src); destination(messages); filter(syslog); };

6 15

Re: [syslog-ng] Syslog-ng not honoring negative flag
by Dan Egli 09 Apr '21

09 Apr '21

I don't know how that keeps happening, but ignore that one. It's incomplete. The NEXT message is complete. Sorry. On 4/8/2021 6:02 PM, Dan Egli wrote: > I'm still hoping someone on this list can help me out. My syslog-ng > configuration seems to be mixing things up. I am TRYING to separate > things, so that anything from sshd goes to /var/log/sshd/sshd.log, > anything from samba goes to /var/log/samba/log.samba, and anything > ELSE hitting the syslog is going to /var/log/messages. My problem is, > the sshd log seems to be picking up samba messsages, and the main log > (/var/log/messages) is picking up them BOTH. But I have filters in my > config to say this one, not that one. > > If anyone is willing to help me out, the following files are live on > my web server: > https://www.newideatest.site/syslog-conf The current > syslog-ng.conf > https://www.newideatest.site/system_log Current /var/log/messages > https://www.newideatest.site/syslog-

1 0

Re: [syslog-ng] Syslog-ng not honoring negative flag
by Dan Egli 08 Apr '21

08 Apr '21

Looks like there's a bug in the lastest version of Thunderbird or something, because I see three messages that are incomplete copies of what I am about to send. I will look further into that while I wait for more advice from you guys. On 4/7/2021 7:19 PM, Dan Egli wrote: > > Those are the only ones I'm seeing in either log. Let me test it a > bit, see if startup/shutdown messages occur too. > > Not only that, I am seeing samba messages in the sshd log, and I > should not. When I do lsof, it seems the samba daemon is writing it's > own logs, so it's not surprising that there's no errors in that log. > But why am I seeing samba messages in sshd.log, and why am I seeing > samba and sshd in /var/log/messages. > > And if what you say about the security/auth is correct, then something > else is screwy here because I ONLY have auth/info listed. NOT > authpriv. Frankly, i'd say that it sounds like I need to just change > to program("sshd") but I'm not sure if that will fix anything. I'll do > that, just to see. > > On 4/7/2021 12:48 PM, SZALAY Attila wrote: >> Hi Dan, >> >> The next important question is that do you see all sshd log messages >> in /var/log/messages or just some of them. I see two kind of sshd >> related log message: >> >> [2021-04-07T12:29:43.875056] Incoming log entry; line='<38>Apr 7 >> 12:29:43 sshd[30745]: Accepted keyboard-interactive/pam for dan from >> XXXX port 40747 ssh2' >> [2021-04-07T12:29:43.878136] Incoming log entry; line='<86>Apr 7 >> 12:29:43 sshd[30745]: pam_unix(sshd:session): session opened for user >> dan(uid=1001) by (uid=0)' >> >> As the two has different values in <>, at least one of them is differ >> from auth/info. >> >> By the way <38> is security(4)/info and <86> is security(10)/info. So >> both are security/auth message in some way but still different >> facilities (4 and 6) which is called as auth(4) and authpriv(10) >> within syslog-ng. >> >> On Wed, 2021-04-07 at 12:35 -0600, Dan Egli wrote: >>> Okay. I captured a couple of minutes worth of syslog-ng running. >>> It's too big to post (1.5MB) so I put it up on my web server. You >>> can see it at: https://www.newideatest.site/syslog-out >>> On 4/7/2021 12:07 PM, SZIGETVÁRI János wrote: >>> Hello Dan, >>> >>> I believe that Bazsi (Balázs) wasn't really looking for the startup >>> messages about the config being parsed, but instead about the >>> debug/trace output of the log processing pipeline. >>> There he would be able to check which filters were run against a >>> certain message (its actual content too), and what result those >>> filters returned. >>> I think that's what he's primarily after. >>> >>> Best Regards, >>> János >>> -- >>> Janos SZIGETVARI >>> RHCE, License no. 150-053-692 >>> <https://www.redhat.com/rhtapps/verify/?certId=150-053-692> >>> >>> LinkedIn: linkedin.com/in/janosszigetvari >>> <http://linkedin.com/in/janosszigetvari> >>> Web: janos.szigetvari.com <https://janos.szigetvari.com> >>> >>> __@__˚V˚ >>> Make the switch to open (source) applications, protocols, formats now: >>> - windows -> Linux, iexplore -> Firefox, msoffice -> LibreOffice >>> - msn -> jabber protocol (Pidgin, Google Talk) >>> - mp3 -> ogg, wmv -> ogg, jpg -> png, doc/xls/ppt -> odt/ods/odp >>> >>> >>> Dan Egli <dan(a)newideatest.site> ezt írta (időpont: 2021. ápr. 7., >>> Sze, 20:02): >>> >>>> Syslog-ng is NOT complaining about my config at all. I've included >>>> the output from the -Fedv below. Other than what I would call >>>> "routine" errors in the scl section, no complaints. >>>> >>>> --------------------------------- >>>> [2021-04-07T11:52:21.151347] Processing @include statement; >>>> filename='scl.conf', >>>> include-path='/etc/syslog-ng:/usr/share/syslog-ng/include' >>>> [2021-04-07T11:52:21.151420] Starting to read include file; >>>> filename='/etc/syslog-ng/scl.conf', depth='1' >>>> [2021-04-07T11:52:21.151596] Module loaded and initialized >>>> successfully; module='appmodel' >>>> [2021-04-07T11:52:21.151612] Processing @include statement; >>>> filename='scl/*/*.conf', >>>> include-path='/etc/syslog-ng:/usr/share/syslog-ng/include' >>>> [2021-04-07T11:52:21.151782] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/apache/apache.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151787] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/checkpoint/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151790] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/cisco/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151792] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/collectd/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151794] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/default-network-drivers/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151797] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/graphite/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151799] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/hdfs/plugin.conf', depth='2' >>>> [2021-04-07T11:52:21.151802] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/iptables/iptables.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151804] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/junos/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151807] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/kafka/kafka-java.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151809] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/kafka/kafka.conf', depth='2' >>>> [2021-04-07T11:52:21.151811] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/linux-audit/linux-audit.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151814] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/loadbalancer/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151816] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/mbox/mbox.conf', depth='2' >>>> [2021-04-07T11:52:21.151819] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151821] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/paloalto/panos.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151824] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/rewrite/cc-mask.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151826] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/snmptrap/snmptrapd-source.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151906] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/solaris/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151912] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/sudo/sudo.conf', depth='2' >>>> [2021-04-07T11:52:21.151915] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/sumologic/sumologic.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151917] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151920] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151922] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/websense/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151925] Adding include file; >>>> filename='/usr/share/syslog-ng/include/scl/windowseventlog/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151933] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/apache/apache.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.151993] Reading path for candidate modules; >>>> path='/usr/lib64/syslog-ng' >>>> [2021-04-07T11:52:21.152064] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libxml.so', module='xml' >>>> [2021-04-07T11:52:21.152174] Registering candidate plugin; >>>> module='xml', context='parser', name='xml' >>>> [2021-04-07T11:52:21.152200] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libtags-parser.so', >>>> module='tags-parser' >>>> [2021-04-07T11:52:21.152263] Registering candidate plugin; >>>> module='tags-parser', context='parser', name='tags-parser' >>>> [2021-04-07T11:52:21.152277] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libsystem-source.so', >>>> module='system-source' >>>> [2021-04-07T11:52:21.152336] Registering candidate plugin; >>>> module='system-source', context='source', name='system' >>>> [2021-04-07T11:52:21.152349] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libsyslogformat.so', >>>> module='syslogformat' >>>> [2021-04-07T11:52:21.152414] Registering candidate plugin; >>>> module='syslogformat', context='format', name='syslog' >>>> [2021-04-07T11:52:21.152417] Registering candidate plugin; >>>> module='syslogformat', context='parser', name='syslog-parser' >>>> [2021-04-07T11:52:21.152428] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libstardate.so', >>>> module='stardate' >>>> [2021-04-07T11:52:21.152619] Registering candidate plugin; >>>> module='stardate', context='template-func', name='stardate' >>>> [2021-04-07T11:52:21.152661] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libsecure-logging.so', >>>> module='secure-logging' >>>> [2021-04-07T11:52:21.152746] Registering candidate plugin; >>>> module='secure-logging', context='template-func', name='slog' >>>> [2021-04-07T11:52:21.152760] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libpseudofile.so', >>>> module='pseudofile' >>>> [2021-04-07T11:52:21.152832] Registering candidate plugin; >>>> module='pseudofile', context='destination', name='pseudofile' >>>> [2021-04-07T11:52:21.152904] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libmap-value-pairs.so', >>>> module='map-value-pairs' >>>> [2021-04-07T11:52:21.152989] Registering candidate plugin; >>>> module='map-value-pairs', context='parser', name='map_value_pairs' >>>> [2021-04-07T11:52:21.153005] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', >>>> fname='liblinux-kmsg-format.so', module='linux-kmsg-format' >>>> [2021-04-07T11:52:21.153170] Registering candidate plugin; >>>> module='linux-kmsg-format', context='format', name='linux-kmsg' >>>> [2021-04-07T11:52:21.153191] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libkvformat.so', >>>> module='kvformat' >>>> [2021-04-07T11:52:21.153261] Registering candidate plugin; >>>> module='kvformat', context='parser', name='kv-parser' >>>> [2021-04-07T11:52:21.153265] Registering candidate plugin; >>>> module='kvformat', context='parser', name='linux-audit-parser' >>>> [2021-04-07T11:52:21.153268] Registering candidate plugin; >>>> module='kvformat', context='template-func', name='format-welf' >>>> [2021-04-07T11:52:21.153279] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libhook-commands.so', >>>> module='hook-commands' >>>> [2021-04-07T11:52:21.153339] Registering candidate plugin; >>>> module='hook-commands', context='inner-dest', name='hook-commands' >>>> [2021-04-07T11:52:21.153343] Registering candidate plugin; >>>> module='hook-commands', context='inner-src', name='hook-commands' >>>> [2021-04-07T11:52:21.153355] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libgraphite.so', >>>> module='graphite' >>>> [2021-04-07T11:52:21.153408] Registering candidate plugin; >>>> module='graphite', context='template-func', name='graphite_output' >>>> [2021-04-07T11:52:21.153418] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libtfgetent.so', >>>> module='tfgetent' >>>> [2021-04-07T11:52:21.153468] Registering candidate plugin; >>>> module='tfgetent', context='template-func', name='getent' >>>> [2021-04-07T11:52:21.153479] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libexamples.so', >>>> module='examples' >>>> [2021-04-07T11:52:21.153646] Registering candidate plugin; >>>> module='examples', context='source', name='example_msg_generator' >>>> [2021-04-07T11:52:21.153654] Registering candidate plugin; >>>> module='examples', context='source', name='example_random_generator' >>>> [2021-04-07T11:52:21.153660] Registering candidate plugin; >>>> module='examples', context='source', name='example_diskq_source' >>>> [2021-04-07T11:52:21.153670] Registering candidate plugin; >>>> module='examples', context='inner-dest', name='http_test_slots' >>>> [2021-04-07T11:52:21.153677] Registering candidate plugin; >>>> module='examples', context='destination', name='example_destination' >>>> [2021-04-07T11:52:21.153722] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libdisk-buffer.so', >>>> module='disk-buffer' >>>> [2021-04-07T11:52:21.153825] Registering candidate plugin; >>>> module='disk-buffer', context='inner-dest', name='disk_buffer' >>>> [2021-04-07T11:52:21.153846] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libdbparser.so', >>>> module='dbparser' >>>> [2021-04-07T11:52:21.154065] Registering candidate plugin; >>>> module='dbparser', context='parser', name='db-parser' >>>> [2021-04-07T11:52:21.154076] Registering candidate plugin; >>>> module='dbparser', context='parser', name='grouping-by' >>>> [2021-04-07T11:52:21.154100] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libtimestamp.so', >>>> module='timestamp' >>>> [2021-04-07T11:52:21.154260] Registering candidate plugin; >>>> module='timestamp', context='parser', name='date-parser' >>>> [2021-04-07T11:52:21.154267] Registering candidate plugin; >>>> module='timestamp', context='rewrite', name='fix-time-zone' >>>> [2021-04-07T11:52:21.154270] Registering candidate plugin; >>>> module='timestamp', context='rewrite', name='set-time-zone' >>>> [2021-04-07T11:52:21.154279] Registering candidate plugin; >>>> module='timestamp', context='rewrite', name='guess-time-zone' >>>> [2021-04-07T11:52:21.154296] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libcsvparser.so', >>>> module='csvparser' >>>> [2021-04-07T11:52:21.154366] Registering candidate plugin; >>>> module='csvparser', context='parser', name='csv-parser' >>>> [2021-04-07T11:52:21.154381] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libcryptofuncs.so', >>>> module='cryptofuncs' >>>> [2021-04-07T11:52:21.154452] Registering candidate plugin; >>>> module='cryptofuncs', context='template-func', name='uuid' >>>> [2021-04-07T11:52:21.154459] Registering candidate plugin; >>>> module='cryptofuncs', context='template-func', name='hash' >>>> [2021-04-07T11:52:21.154657] Registering candidate plugin; >>>> module='cryptofuncs', context='template-func', name='sha1' >>>> [2021-04-07T11:52:21.154662] Registering candidate plugin; >>>> module='cryptofuncs', context='template-func', name='sha256' >>>> [2021-04-07T11:52:21.154665] Registering candidate plugin; >>>> module='cryptofuncs', context='template-func', name='sha512' >>>> [2021-04-07T11:52:21.154667] Registering candidate plugin; >>>> module='cryptofuncs', context='template-func', name='md4' >>>> [2021-04-07T11:52:21.154673] Registering candidate plugin; >>>> module='cryptofuncs', context='template-func', name='md5' >>>> [2021-04-07T11:52:21.154689] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libconfgen.so', >>>> module='confgen' >>>> [2021-04-07T11:52:21.154788] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libcef.so', module='cef' >>>> [2021-04-07T11:52:21.154912] Registering candidate plugin; >>>> module='cef', context='template-func', name='format-cef-extension' >>>> [2021-04-07T11:52:21.154935] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libbasicfuncs.so', >>>> module='basicfuncs' >>>> [2021-04-07T11:52:21.155134] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='grep' >>>> [2021-04-07T11:52:21.155142] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='if' >>>> [2021-04-07T11:52:21.155145] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='or' >>>> [2021-04-07T11:52:21.155148] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='context-lookup' >>>> [2021-04-07T11:52:21.155150] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='context-length' >>>> [2021-04-07T11:52:21.155156] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='context-values' >>>> [2021-04-07T11:52:21.155158] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='echo' >>>> [2021-04-07T11:52:21.155165] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='length' >>>> [2021-04-07T11:52:21.155171] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='substr' >>>> [2021-04-07T11:52:21.155173] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='strip' >>>> [2021-04-07T11:52:21.155176] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='sanitize' >>>> [2021-04-07T11:52:21.155178] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='lowercase' >>>> [2021-04-07T11:52:21.155180] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='uppercase' >>>> [2021-04-07T11:52:21.155183] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='replace-delimiter' >>>> [2021-04-07T11:52:21.155185] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='padding' >>>> [2021-04-07T11:52:21.155201] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='binary' >>>> [2021-04-07T11:52:21.155204] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='implode' >>>> [2021-04-07T11:52:21.155207] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='explode' >>>> [2021-04-07T11:52:21.155209] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='dirname' >>>> [2021-04-07T11:52:21.155214] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='basename' >>>> [2021-04-07T11:52:21.155217] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='list-concat' >>>> [2021-04-07T11:52:21.155219] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='list-head' >>>> [2021-04-07T11:52:21.155222] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='list-nth' >>>> [2021-04-07T11:52:21.155224] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='list-tail' >>>> [2021-04-07T11:52:21.155227] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='list-slice' >>>> [2021-04-07T11:52:21.155230] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='list-count' >>>> [2021-04-07T11:52:21.155232] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='list-append' >>>> [2021-04-07T11:52:21.155234] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='list-search' >>>> [2021-04-07T11:52:21.155237] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='+' >>>> [2021-04-07T11:52:21.155239] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='-' >>>> [2021-04-07T11:52:21.155241] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='*' >>>> [2021-04-07T11:52:21.155243] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='/' >>>> [2021-04-07T11:52:21.155245] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='%' >>>> [2021-04-07T11:52:21.155248] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='sum' >>>> [2021-04-07T11:52:21.155255] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='min' >>>> [2021-04-07T11:52:21.155257] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='max' >>>> [2021-04-07T11:52:21.155259] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='average' >>>> [2021-04-07T11:52:21.155261] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='round' >>>> [2021-04-07T11:52:21.155267] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='ceil' >>>> [2021-04-07T11:52:21.155272] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='floor' >>>> [2021-04-07T11:52:21.155275] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='ipv4-to-int' >>>> [2021-04-07T11:52:21.155277] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='indent-multi-line' >>>> [2021-04-07T11:52:21.155279] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='dns-resolve-ip' >>>> [2021-04-07T11:52:21.155281] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='env' >>>> [2021-04-07T11:52:21.155284] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='template' >>>> [2021-04-07T11:52:21.155286] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='url-encode' >>>> [2021-04-07T11:52:21.155288] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='url-decode' >>>> [2021-04-07T11:52:21.155291] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='base64-encode' >>>> [2021-04-07T11:52:21.155294] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='iterate' >>>> [2021-04-07T11:52:21.155297] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='map' >>>> [2021-04-07T11:52:21.155300] Registering candidate plugin; >>>> module='basicfuncs', context='template-func', name='filter' >>>> [2021-04-07T11:52:21.155330] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', >>>> fname='libazure-auth-header.so', module='azure-auth-header' >>>> [2021-04-07T11:52:21.155422] Registering candidate plugin; >>>> module='azure-auth-header', context='inner-dest', >>>> name='azure-auth-header' >>>> [2021-04-07T11:52:21.155440] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libappmodel.so', >>>> module='appmodel' >>>> [2021-04-07T11:52:21.155445] Registering candidate plugin; >>>> module='appmodel', context='root', name='application' >>>> [2021-04-07T11:52:21.155448] Registering candidate plugin; >>>> module='appmodel', context='parser', name='app-parser' >>>> [2021-04-07T11:52:21.155450] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libafuser.so', >>>> module='afuser' >>>> [2021-04-07T11:52:21.155549] Registering candidate plugin; >>>> module='afuser', context='destination', name='usertty' >>>> [2021-04-07T11:52:21.155565] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libafstomp.so', >>>> module='afstomp' >>>> [2021-04-07T11:52:21.155641] Registering candidate plugin; >>>> module='afstomp', context='destination', name='stomp' >>>> [2021-04-07T11:52:21.155653] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libafsocket.so', >>>> module='afsocket' >>>> [2021-04-07T11:52:21.155816] Registering candidate plugin; >>>> module='afsocket', context='source', name='unix-stream' >>>> [2021-04-07T11:52:21.155821] Registering candidate plugin; >>>> module='afsocket', context='destination', name='unix-stream' >>>> [2021-04-07T11:52:21.155824] Registering candidate plugin; >>>> module='afsocket', context='source', name='unix-dgram' >>>> [2021-04-07T11:52:21.155827] Registering candidate plugin; >>>> module='afsocket', context='destination', name='unix-dgram' >>>> [2021-04-07T11:52:21.155829] Registering candidate plugin; >>>> module='afsocket', context='source', name='tcp' >>>> [2021-04-07T11:52:21.155832] Registering candidate plugin; >>>> module='afsocket', context='destination', name='tcp' >>>> [2021-04-07T11:52:21.155834] Registering candidate plugin; >>>> module='afsocket', context='source', name='tcp6' >>>> [2021-04-07T11:52:21.155837] Registering candidate plugin; >>>> module='afsocket', context='destination', name='tcp6' >>>> [2021-04-07T11:52:21.155839] Registering candidate plugin; >>>> module='afsocket', context='source', name='udp' >>>> [2021-04-07T11:52:21.155841] Registering candidate plugin; >>>> module='afsocket', context='destination', name='udp' >>>> [2021-04-07T11:52:21.155844] Registering candidate plugin; >>>> module='afsocket', context='source', name='udp6' >>>> [2021-04-07T11:52:21.155846] Registering candidate plugin; >>>> module='afsocket', context='destination', name='udp6' >>>> [2021-04-07T11:52:21.155857] Registering candidate plugin; >>>> module='afsocket', context='source', name='syslog' >>>> [2021-04-07T11:52:21.155860] Registering candidate plugin; >>>> module='afsocket', context='destination', name='syslog' >>>> [2021-04-07T11:52:21.155863] Registering candidate plugin; >>>> module='afsocket', context='source', name='network' >>>> [2021-04-07T11:52:21.155865] Registering candidate plugin; >>>> module='afsocket', context='destination', name='network' >>>> [2021-04-07T11:52:21.155867] Registering candidate plugin; >>>> module='afsocket', context='source', name='systemd-syslog' >>>> [2021-04-07T11:52:21.155886] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libafprog.so', >>>> module='afprog' >>>> [2021-04-07T11:52:21.155979] Registering candidate plugin; >>>> module='afprog', context='source', name='program' >>>> [2021-04-07T11:52:21.155986] Registering candidate plugin; >>>> module='afprog', context='destination', name='program' >>>> [2021-04-07T11:52:21.156000] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', fname='libaffile.so', >>>> module='affile' >>>> [2021-04-07T11:52:21.156140] Registering candidate plugin; >>>> module='affile', context='source', name='file' >>>> [2021-04-07T11:52:21.156176] Registering candidate plugin; >>>> module='affile', context='source', name='pipe' >>>> [2021-04-07T11:52:21.156181] Registering candidate plugin; >>>> module='affile', context='source', name='wildcard_file' >>>> [2021-04-07T11:52:21.156184] Registering candidate plugin; >>>> module='affile', context='source', name='stdin' >>>> [2021-04-07T11:52:21.156187] Registering candidate plugin; >>>> module='affile', context='destination', name='file' >>>> [2021-04-07T11:52:21.156189] Registering candidate plugin; >>>> module='affile', context='destination', name='pipe' >>>> [2021-04-07T11:52:21.156209] Reading shared object for a candidate >>>> module; path='/usr/lib64/syslog-ng', >>>> fname='libadd-contextual-data.so', module='add-contextual-data' >>>> [2021-04-07T11:52:21.156308] Registering candidate plugin; >>>> module='add-contextual-data', context='parser', >>>> name='add_contextual_data' >>>> [2021-04-07T11:52:21.156434] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/apache/apache.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.156450] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/checkpoint/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.156674] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/checkpoint/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.156687] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/cisco/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.156832] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/cisco/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.156841] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/collectd/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.156931] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/collectd/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.156943] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/default-network-drivers/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157022] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/default-network-drivers/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157029] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/graphite/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157074] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/graphite/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157078] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/hdfs/plugin.conf', depth='2' >>>> [2021-04-07T11:52:21.157107] Included file was skipped because of a >>>> missing module; module='mod-java', >>>> location='/usr/share/syslog-ng/include/scl/hdfs/plugin.conf:24:1' >>>> [2021-04-07T11:52:21.157109] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/hdfs/plugin.conf', depth='2' >>>> [2021-04-07T11:52:21.157114] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/iptables/iptables.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157173] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/iptables/iptables.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157179] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/junos/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157232] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/junos/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157236] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/kafka/kafka-java.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157262] Included file was skipped because of a >>>> missing module; module='mod-java', >>>> location='/usr/share/syslog-ng/include/scl/kafka/kafka-java.conf:24:1' >>>> [2021-04-07T11:52:21.157264] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/kafka/kafka-java.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157269] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/kafka/kafka.conf', depth='2' >>>> [2021-04-07T11:52:21.157309] Global value changed; >>>> define='kafka-implementation', value='kafka-java' >>>> [2021-04-07T11:52:21.157328] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/kafka/kafka.conf', depth='2' >>>> [2021-04-07T11:52:21.157336] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/linux-audit/linux-audit.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157375] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/linux-audit/linux-audit.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157379] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/loadbalancer/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157493] Module loaded and initialized >>>> successfully; module='confgen' >>>> [2021-04-07T11:52:21.157512] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/loadbalancer/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157519] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/mbox/mbox.conf', depth='2' >>>> [2021-04-07T11:52:21.157559] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/mbox/mbox.conf', depth='2' >>>> [2021-04-07T11:52:21.157565] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157597] Included file was skipped because of a >>>> missing module; module='pacctformat', >>>> location='/usr/share/syslog-ng/include/scl/pacct/plugin.conf:24:1' >>>> [2021-04-07T11:52:21.157600] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157605] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/paloalto/panos.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157905] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/paloalto/panos.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157919] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/rewrite/cc-mask.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.157969] Global value changed; >>>> define='balabit.credit-card-regexp', >>>> value='(:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|6(?:011|5[0-9][0-9])[0-9]{12}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|(?:2131|1800|35d{3})d{11})' >>>> [2021-04-07T11:52:21.157998] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/rewrite/cc-mask.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.158007] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/snmptrap/snmptrapd-source.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.158073] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/snmptrap/snmptrapd-source.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.158079] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/solaris/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.158120] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/solaris/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.158131] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/sudo/sudo.conf', depth='2' >>>> [2021-04-07T11:52:21.161593] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/sudo/sudo.conf', depth='2' >>>> [2021-04-07T11:52:21.161620] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/sumologic/sumologic.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.161724] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/sumologic/sumologic.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.161729] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.161803] Module loaded and initialized >>>> successfully; module='confgen' >>>> [2021-04-07T11:52:21.161808] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.161815] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.161853] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.161860] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/websense/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.161951] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/websense/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.161964] Starting to read include file; >>>> filename='/usr/share/syslog-ng/include/scl/windowseventlog/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.162008] Finishing include; >>>> filename='/usr/share/syslog-ng/include/scl/windowseventlog/plugin.conf', >>>> depth='2' >>>> [2021-04-07T11:52:21.162024] Global value changed; >>>> define='java-module-dir', value='/usr/lib64/syslog-ng/java-modules' >>>> [2021-04-07T11:52:21.162028] Finishing include; >>>> filename='/etc/syslog-ng/scl.conf', depth='1' >>>> [2021-04-07T11:52:21.162157] Module loaded and initialized >>>> successfully; module='system-source' >>>> [2021-04-07T11:52:21.162188] system(): Enabling Linux kernel log >>>> device; device='/dev/kmsg', format='linux-kmsg' >>>> [2021-04-07T11:52:21.162403] Module loaded and initialized >>>> successfully; module='afsocket' >>>> [2021-04-07T11:52:21.162936] Module loaded and initialized >>>> successfully; module='affile' >>>> [2021-04-07T11:52:21.163175] Module loaded and initialized >>>> successfully; module='kvformat' >>>> [2021-04-07T11:52:21.163192] Finishing include; content='block >>>> parser iptables-parser() at >>>> /usr/share/syslog-ng/include/scl/iptables/iptables.conf:23', depth='3' >>>> [2021-04-07T11:52:21.163568] Module loaded and initialized >>>> successfully; module='csvparser' >>>> [2021-04-07T11:52:21.164457] Finishing include; content='block >>>> parser panos-parser() at >>>> /usr/share/syslog-ng/include/scl/paloalto/panos.conf:29', depth='3' >>>> [2021-04-07T11:52:21.164880] Module loaded and initialized >>>> successfully; module='basicfuncs' >>>> [2021-04-07T11:52:21.164936] Finishing include; content='block >>>> parser sudo-parser() at >>>> /usr/share/syslog-ng/include/scl/sudo/sudo.conf:23', depth='3' >>>> [2021-04-07T11:52:21.164995] Finishing include; content='parser >>>> generator app-parser', depth='2' >>>> [2021-04-07T11:52:21.165016] Finishing include; content='source >>>> generator system', depth='1' >>>> [2021-04-07T11:52:21.165525] Module loaded and initialized >>>> successfully; module='syslogformat' >>>> [2021-04-07T11:52:21.165711] Module loaded and initialized >>>> successfully; module='linux-kmsg-format' >>>> [2021-04-07T11:52:21.165966] Running application hooks; hook='1' >>>> [2021-04-07T11:52:21.165971] Running application hooks; hook='6' >>>> [2021-04-07T11:52:21.165984] syslog-ng starting up; version='3.30.1' >>>> [2021-04-07T11:52:21.165989] Running application hooks; hook='2' >>>> [2021-04-07T11:52:39.961046] Running application hooks; hook='3' >>>> [2021-04-07T11:52:39.961090] syslog-ng shutting down; version='3.30.1' >>>> [2021-04-07T11:52:40.061679] Running application hooks; hook='4' >>>> ----------------------------------------------------------------------------- >>>> >>>> On 4/7/2021 4:51 AM, Balazs Scheidler wrote: >>>> >>>>> can you start syslog-ng in the foreground and look at the startup >>>>> messages? >>>>> >>>>> e.g. stop the background process (via systemd or your init >>>>> system), and run syslog-ng from a root prompt: >>>>> >>>>> # /usr/sbin/syslog-ng -Fedv >>>>> >>>>> This should start syslog-ng in the foreground (-F), direct >>>>> internal messages to stderr (-e), and enable debug/verbose >>>>> messages. Then look at the messages to see if syslog-ng is >>>>> complaining about your configuration or not. >>>>> >>>>> Cheers, >>>>> Bazsi >>>>> >>>>> >>>>> On Wed, Apr 7, 2021 at 9:08 AM Dan Egli <dan(a)newideatest.site> >>>>> <mailto:dan@newideatest.site> wrote: >>>>> >>>>>> Don't know how that slipped in there. And syslog-ng never >>>>>> mentioned it. It's fixed now, and the behavior is unchanged. sshd >>>>>> messages still appear in /var/log/messages. >>>>>> >>>>>> >>>>>> On 4/7/2021 12:55 AM, Balazs Scheidler wrote: >>>>>> >>>>>>> >>>>>>> >>>>>>> On Wed, Apr 7, 2021, 08:06 Dan Egli <dan(a)newideatest.site> >>>>>>> <mailto:dan@newideatest.site> wrote: >>>>>>> >>>>>>>> No joy. I tried swapping it different ways. >>>>>>>> >>>>>>>> filter -> source -> destination = combined >>>>>>>> source -> filter -> destination = combined >>>>>>>> >>>>>>>> Here's what my config looks like now, after the second variant: >>>>>>>> >>>>>>>> @version: 3.30 >>>>>>>> >>>>>>>> @include "scl.conf" >>>>>>>> >>>>>>>> options { >>>>>>>> threaded(yes); >>>>>>>> chain_hostnames(no); >>>>>>>> stats_freq(43200); >>>>>>>> mark_freq(3600); >>>>>>>> }; >>>>>>>> >>>>>>>> source src { system(); internal(); }; >>>>>>>> >>>>>>>> filter samba { program("samba"); }; >>>>>>>> filter ssh_messages { facility("AUTH") and level("INFO"); }; >>>>>>>> filter syslog { not filter("ssh_messages") and not >>>>>>>> filter("samba"); }; >>>>>>>> >>>>>>>> destination console { file("/dev/tty12"); }; >>>>>>>> destination messages { file("/var/log/messages"); }; >>>>>>>> destination sshd_log { file("/var/log/sshd/sshd.log"); }; >>>>>>>> destination smb_logs { file("/var/log/samba/samba.log"); }; >>>>>>>> >>>>>>>> log { source(src); filter(samba); destination(smb_logs); >>>>>>>> flags(final); ); >>>>>>>> >>>>>>> >>>>>>> You are using a closing paren instead of a brace. This config >>>>>>> has a syntax error. Possibly syslog-ng falled back to the >>>>>>> original config, once it reported a syntax error. >>>>>>> >>>>>>> >>>>>>> >>>>>>>> log { source(src); filter(ssh_messages); destination(sshd_log); >>>>>>>> flags(final); }; >>>>>>>> log { source(src); filter(syslog); destination(console); }; >>>>>>>> log { source(src); filter(syslog); destination(messages); }; >>>>>>>> >>>>>>>> >>>>>>>> Still, sshd messages are appearing in /var/log/messages. >>>>>>>> >>>>>>>> On 4/6/2021 11:51 PM, Peter Kokai (pkokai) wrote: >>>>>>>> > Hello, >>>>>>>> > >>>>>>>> > The order in the configuration matters. >>>>>>>> > log { source(src); destination(console); filter(syslog); }; >>>>>>>> > The message flow is the following in your example source(src) >>>>>>>> -> destination(console) -> filter(syslog) -> void >>>>>>>> > The filter recieves messages only after destination, if you >>>>>>>> switch filter and destination it should be fine. >>>>>>>> > >>>>>>>> > -- >>>>>>>> > kokan >>>>>>>> > >>>>>>>> > ________________________________________ >>>>>>>> > From: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu >>>>>>>> <mailto:syslog-ng-bounces@lists.balabit.hu>> on behalf of Dan >>>>>>>> Egli <dan(a)newideatest.site> <mailto:dan@newideatest.site> >>>>>>>> > Sent: 07 April 2021 07:17 >>>>>>>> > To: syslog-ng(a)lists.balabit.hu >>>>>>>> <mailto:syslog-ng@lists.balabit.hu> >>>>>>>> > Subject: [syslog-ng] Syslog-ng not honoring negative flag >>>>>>>> > >>>>>>>> > CAUTION: This email originated from outside of the >>>>>>>> organization. Do not follow guidance, click links, or open >>>>>>>> attachments unless you recognize the sender and know the >>>>>>>> content is safe. >>>>>>>> > >>>>>>>> > >>>>>>>> > I'm having a bit of a problem and hope someone here can help. >>>>>>>> I'm trying >>>>>>>> > to separate individual items into specific logs, i.e. ssh >>>>>>>> events in >>>>>>>> > sshd.log, samba messages in samba.log, etc... >>>>>>>> > >>>>>>>> > I managed to come up with filters that pull out the events I >>>>>>>> started >>>>>>>> > with, and they are going into the correct log files. But they >>>>>>>> are ALSO >>>>>>>> > going into /var/log/messages even though I specifically have >>>>>>>> a filter on >>>>>>>> > that one that says not to include samba or sshd events. I'll >>>>>>>> copy my >>>>>>>> > config file here. Hopefully someone can tell me what I did wrong. >>>>>>>> > >>>>>>>> > Thanks! >>>>>>>> > >>>>>>>> > --------------------------------------------- >>>>>>>> > @version: 3.30 >>>>>>>> > >>>>>>>> > @include "scl.conf" >>>>>>>> > >>>>>>>> > options { >>>>>>>> > threaded(yes); >>>>>>>> > chain_hostnames(no); >>>>>>>> > stats_freq(43200); >>>>>>>> > mark_freq(3600); >>>>>>>> > }; >>>>>>>> > >>>>>>>> > source src { system(); internal(); }; >>>>>>>> > >>>>>>>> > filter samba { program("samba"); }; >>>>>>>> > filter ssh_messages { facility("AUTH") and level("INFO"); }; >>>>>>>> > filter syslog { not filter("ssh_messages") and not >>>>>>>> filter("samba"); }; >>>>>>>> > >>>>>>>> > destination console { file("/dev/tty12"); }; >>>>>>>> > destination messages { file("/var/log/messages"); }; >>>>>>>> > destination sshd_log { file("/var/log/sshd/sshd.log"); }; >>>>>>>> > destination smb_logs { file("/var/log/samba/samba.log"); }; >>>>>>>> > >>>>>>>> > log { source(src); destination(smb_logs); filter(samba); >>>>>>>> flags(final); ); >>>>>>>> > log { source(src); destination(sshd_log); filter(ssh_messages); >>>>>>>> > flags(final); }; >>>>>>>> > log { source(src); destination(console); filter(syslog); }; >>>>>>>> > log { source(src); destination(messages); filter(syslog); }; >>>>>>>> > >>>>>>>> > >>>>>>>> ______________________________________________________________________________ >>>>>>>> > Member info: >>>>>>>> https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.bal… >>>>>>>> <https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.bal…> >>>>>>>> > Documentation: >>>>>>>> https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabi… >>>>>>>> <https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabi…> >>>>>>>> > FAQ: >>>>>>>> https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabi… >>>>>>>> <https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabi…> >>>>>>>> > >>>>>>>> > >>>>>>>> ______________________________________________________________________________ >>>>>>>> > Member info: >>>>>>>> https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>>>>>> <https://lists.balabit.hu/mailman/listinfo/syslog-ng> >>>>>>>> > Documentation: >>>>>>>> http://www.balabit.com/support/documentation/?product=syslog-ng >>>>>>>> <http://www.balabit.com/support/documentation/?product=syslog-ng> >>>>>>>> > FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>>>>>>> <http://www.balabit.com/wiki/syslog-ng-faq> >>>>>>>> > >>>>>>>> ______________________________________________________________________________ >>>>>>>> Member info: >>>>>>>> https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>>>>>> <https://lists.balabit.hu/mailman/listinfo/syslog-ng> >>>>>>>> Documentation: >>>>>>>> http://www.balabit.com/support/documentation/?product=syslog-ng >>>>>>>> <http://www.balabit.com/support/documentation/?product=syslog-ng> >>>>>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>>>>>>> <http://www.balabit.com/wiki/syslog-ng-faq> >>>>>>>> >>>>>>>> >>>>>>> >>>>>>> ______________________________________________________________________________ >>>>>>> Member info:https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> >>>>>>> Documentation:http://www.balabit.com/support/documentation/?product=syslog-… <http://www.balabit.com/support/documentation/?product=syslog-ng> >>>>>>> FAQ:http://www.balabit.com/wiki/syslog-ng-faq <http://www.balabit.com/wiki/syslog-ng-faq> >>>>>>> >>>>>> >>>>> >>>>> >>>>> -- >>>>> Bazsi >>>> ______________________________________________________________________________ >>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>> <https://lists.balabit.hu/mailman/listinfo/syslog-ng> >>>> Documentation: >>>> http://www.balabit.com/support/documentation/?product=syslog-ng >>>> <http://www.balabit.com/support/documentation/?product=syslog-ng> >>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>>> <http://www.balabit.com/wiki/syslog-ng-faq> >>>> >>>> >>> >>> ______________________________________________________________________________ >>> Member info:https://lists.balabit.hu/mailman/listinfo/syslog-ng >>> Documentation:http://www.balabit.com/support/documentation/?product=syslog-… >>> FAQ:http://www.balabit.com/wiki/syslog-ng-faq >>> ______________________________________________________________________________ >>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>> <https://lists.balabit.hu/mailman/listinfo/syslog-ng> >>> Documentation: >>> http://www.balabit.com/support/documentation/?product=syslog-ng >>> <http://www.balabit.com/support/documentation/?product=syslog-ng> >>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>> <http://www.balabit.com/wiki/syslog-ng-faq> >>> >> >> >> ______________________________________________________________________________ >> Member info:https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation:http://www.balabit.com/support/documentation/?product=syslog-… >> FAQ:http://www.balabit.com/wiki/syslog-ng-faq >>

1 0