- syslog-ng - lists.balabit.hu

Program stop/start bug in 3.3.x
by Martin Holste 22 Dec '11

22 Dec '11

I'm getting a weird bug with the program destination in which on shutdown it sends TERM and then sends a start: <snip> Sending destination program a TERM signal; cmdline='perl /usr/local/elsa/node/elsa.pl -c /etc/elsa_node.conf', child_pid='21421' Starting destination program; cmdline='perl /usr/local/elsa/node/elsa.pl -c /etc/elsa_node.conf' </snip> 3.2.4 is fine.

2 1

[PATCH (3.4)] afsql: Add support for specifying custom SQL backend options.
by Gergely Nagy 22 Dec '11

22 Dec '11

When one is using an SQL backend that supports a set of options that syslog-ng does not set itself, yet, one does want these options set, there was previously no way to accomplish that without changing the source. This patch adds a new option: dbd-option(OPTION_NAME VALUE) (where OPTION_NAME is always a string, and value can be either a string, or a number). The options specified this way will always be set with libdbi whenever we (re)connect to the database. A simple use-case: destination d_slow_sql_test { sql(type("null") dbd-option("null.sleep.connect" 1) dbd-option("null.sleep.query" 5) columns("dummy") values("1") ); }; Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/afsql/afsql-grammar.ym | 3 +++ modules/afsql/afsql-parser.c | 2 ++ modules/afsql/afsql.c | 40 ++++++++++++++++++++++++++++++++++++++++ modules/afsql/afsql.h | 4 ++++ 4 files changed, 49 insertions(+), 0 deletions(-) diff --git a/modules/afsql/afsql-grammar.ym b/modules/afsql/afsql-grammar.ym index 580fb80..d21a3bf 100644 --- a/modules/afsql/afsql-grammar.ym +++ b/modules/afsql/afsql-grammar.ym @@ -54,6 +54,7 @@ extern LogDriver *last_driver; %token KW_DEFAULT %token KW_RETRIES +%token KW_DBD_OPTION %type <ptr> dest_afsql %type <ptr> dest_afsql_params @@ -100,6 +101,8 @@ dest_afsql_option free($3); } | KW_USERNAME '(' string ')' { afsql_dd_set_user(last_driver, $3); free($3); } + | KW_DBD_OPTION '(' string LL_NUMBER ')' { afsql_dd_add_dbd_option_numeric(last_driver, $3, $4); free($3); } + | KW_DBD_OPTION '(' string string ')' { afsql_dd_add_dbd_option(last_driver, $3, $4); free($3); free($4); } | KW_PASSWORD '(' string ')' { afsql_dd_set_password(last_driver, $3); free($3); } | KW_DATABASE '(' string ')' { afsql_dd_set_database(last_driver, $3); free($3); } | KW_TABLE '(' string ')' { afsql_dd_set_table(last_driver, $3); free($3); } diff --git a/modules/afsql/afsql-parser.c b/modules/afsql/afsql-parser.c index 877389a..291e495 100644 --- a/modules/afsql/afsql-parser.c +++ b/modules/afsql/afsql-parser.c @@ -55,6 +55,8 @@ static CfgLexerKeyword afsql_keywords[] = { { "flush_lines", KW_FLUSH_LINES }, { "flush_timeout", KW_FLUSH_TIMEOUT }, { "flags", KW_FLAGS }, + + { "dbd_option", KW_DBD_OPTION }, { NULL } }; diff --git a/modules/afsql/afsql.c b/modules/afsql/afsql.c index b3fec86..a327cdd 100644 --- a/modules/afsql/afsql.c +++ b/modules/afsql/afsql.c @@ -103,6 +103,9 @@ typedef struct _AFSqlDestDriver StatsCounterItem *dropped_messages; StatsCounterItem *stored_messages; + GHashTable *dbd_options; + GHashTable *dbd_options_numeric; + /* shared by the main/db thread */ GThread *db_thread; GMutex *db_thread_mutex; @@ -127,6 +130,22 @@ static const char *s_freetds = "freetds"; #define MAX_FAILED_ATTEMPTS 3 void +afsql_dd_add_dbd_option(LogDriver *s, const gchar *name, const gchar *value) +{ + AFSqlDestDriver *self = (AFSqlDestDriver *) s; + + g_hash_table_insert(self->dbd_options, g_strdup(name), g_strdup(value)); +} + +void +afsql_dd_add_dbd_option_numeric(LogDriver *s, const gchar *name, gint value) +{ + AFSqlDestDriver *self = (AFSqlDestDriver *) s; + + g_hash_table_insert(self->dbd_options_numeric, g_strdup(name), GINT_TO_POINTER(value)); +} + +void afsql_dd_set_type(LogDriver *s, const gchar *type) { AFSqlDestDriver *self = (AFSqlDestDriver *) s; @@ -608,6 +627,19 @@ afsql_dd_disconnect(AFSqlDestDriver *self) g_hash_table_remove_all(self->validated_tables); } +static void +afsql_dd_set_dbd_opt(gpointer key, gpointer value, gpointer user_data) +{ + dbi_conn_set_option((dbi_conn)user_data, (gchar *)key, (gchar *)value); +} + +static void +afsql_dd_set_dbd_opt_numeric(gpointer key, gpointer value, gpointer user_data) +{ + dbi_conn_set_option_numeric((dbi_conn)user_data, (gchar *)key, + GPOINTER_TO_INT(value)); +} + /** * afsql_dd_insert_db: * @@ -645,6 +677,10 @@ afsql_dd_insert_db(AFSqlDestDriver *self) dbi_conn_set_option(self->dbi_ctx, "sqlite_dbdir", ""); dbi_conn_set_option(self->dbi_ctx, "sqlite3_dbdir", ""); + /* Set user-specified options */ + g_hash_table_foreach(self->dbd_options, afsql_dd_set_dbd_opt, self->dbi_ctx); + g_hash_table_foreach(self->dbd_options_numeric, afsql_dd_set_dbd_opt_numeric, self->dbi_ctx); + if (dbi_conn_connect(self->dbi_ctx) < 0) { const gchar *dbi_error; @@ -1200,6 +1236,8 @@ afsql_dd_free(LogPipe *s) string_list_free(self->values); log_template_unref(self->table); g_hash_table_destroy(self->validated_tables); + g_hash_table_destroy(self->dbd_options); + g_hash_table_destroy(self->dbd_options_numeric); if(self->session_statements) string_list_free(self->session_statements); log_dest_driver_free(s); @@ -1235,6 +1273,8 @@ afsql_dd_new(void) self->num_retries = MAX_FAILED_ATTEMPTS; self->validated_tables = g_hash_table_new_full(g_str_hash, g_str_equal, g_free, NULL); + self->dbd_options = g_hash_table_new_full(g_str_hash, g_str_equal, g_free, g_free); + self->dbd_options_numeric = g_hash_table_new_full(g_str_hash, g_int_equal, g_free, NULL); log_template_options_defaults(&self->template_options); init_sequence_number(&self->seq_num); diff --git a/modules/afsql/afsql.h b/modules/afsql/afsql.h index ee2ae68..ce2e18a 100644 --- a/modules/afsql/afsql.h +++ b/modules/afsql/afsql.h @@ -56,6 +56,8 @@ void afsql_dd_set_flags(LogDriver *s, gint flags); LogDriver *afsql_dd_new(); gint afsql_dd_lookup_flag(const gchar *flag); void afsql_dd_set_retries(LogDriver *s, gint num_retries); +void afsql_dd_add_dbd_option(LogDriver *s, const gchar *name, const gchar *value); +void afsql_dd_add_dbd_option_numeric(LogDriver *s, const gchar *name, gint value); #else @@ -69,6 +71,8 @@ void afsql_dd_set_retries(LogDriver *s, gint num_retries); #define afsql_dd_set_columns(s, c) #define afsql_dd_set_values(s, v) #define afsql_dd_set_null_value(s, v) +#define afsql_dd_add_dbd_option(s, n, v) +#define afsql_dd_add_dbd_option_numeric(s, n, v) #define afsql_dd_new() 0 -- 1.7.7.3

2 4

Minimum Syslog Message Length
by vincent＠ragosta.net 22 Dec '11

22 Dec '11

Is it possible to specify a restriction on the minimum length of a syslog message? We often receive small, malformed messages that we do not want to transmit. Thanks, Vincent

3 3

trap divide error
by Dmitry Gilev 22 Dec '11

22 Dec '11

Hi, I've started to get the following messages since upgrade to 3.3.3 (from 3.0.7: >From dmesg logs: syslog-ng[30744] trap divide error ip:7fa0f8ed5a56 sp:7fa0f64423a0 error:0 in libsyslog-ng-3.3.3.so[7fa0f8ea3000+7b000] syslog-ng[30798] trap divide error ip:7fa0f8ed5a56 sp:7fa0df5fb3a0 error:0 in libsyslog-ng-3.3.3.so[7fa0f8ea3000+7b000] syslog-ng[31043] trap divide error ip:7fa0f8ed5a56 sp:7fa0d2bfa3a0 error:0 in libsyslog-ng-3.3.3.so[7fa0f8ea3000+7b000] syslog-ng[31059] trap divide error ip:7fa0f8ed5a56 sp:7fa0e6bfa3a0 error:0 in libsyslog-ng-3.3.3.so[7fa0f8ea3000+7b000] syslog-ng[31087] trap divide error ip:7fa0f8ed5a56 sp:7fa0de1f93a0 error:0 in libsyslog-ng-3.3.3.so[7fa0f8ea3000+7b000] syslog-ng[31145] trap divide error ip:7fa0f8ed5a56 sp:7fa0f64423a0 error:0 in libsyslog-ng-3.3.3.so[7fa0f8ea3000+7b000] syslog-ng[32733] trap divide error ip:7fa0f8ed5a56 sp:7fa0f64423a0 error:0 in libsyslog-ng-3.3.3.so[7fa0f8ea3000+7b000] syslog-ng[1404] trap divide error ip:7fa0f8ed5a56 sp:7fa0f6e433a0 error:0 in libsyslog-ng-3.3.3.so[7fa0f8ea3000+7b000] syslog-ng[1531] trap divide error ip:7fa0f8ed5a56 sp:7fa0f64423a0 error:0 in libsyslog-ng-3.3.3.so[7fa0f8ea3000+7b000] syslog-ng[1688] trap divide error ip:7fa0f8ed5a56 sp:7fa0e7ffc3a0 error:0 in libsyslog-ng-3.3.3.so[7fa0f8ea3000+7b000] syslog-ng[2013] trap divide error ip:7fa0f8ed5a56 sp:7fa0f4c2c3a0 error:0 in libsyslog-ng-3.3.3.so[7fa0f8ea3000+7b000] syslog-ng[2019] trap divide error ip:7fa0f8ed5a56 sp:7fa0f6e433a0 error:0 in libsyslog-ng-3.3.3.so[7fa0f8ea3000+7b000] Does anybody know what is wrong here? Is it known bug? # syslog-ng -V syslog-ng 3.3.3 Installer-Version: 3.3.3 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.3#master#d199a1980be6b23fe24189e86a882812288e292c Compile-Date: Dec 20 2011 15:17:13 Default-Modules: affile,afprog,afsocket,afuser,basicfuncs,csvparser,dbparser,syslogformat Available-Modules: basicfuncs,confgen,affile,csvparser,dbparser,afsocket,dummy,afsocket-notls,syslogformat,afprog,convertfuncs,afuser Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-Linux-Caps: off Enable-Pcre: off # ldd libsyslog-ng-3.3.3.so linux-vdso.so.1 => (0x00007fffc41fc000) libnsl.so.1 => /lib64/libnsl.so.1 (0x00007f42f3d64000) libgmodule-2.0.so.0 => /lib64/libgmodule-2.0.so.0 (0x00007f42f3b61000) libgthread-2.0.so.0 => /lib64/libgthread-2.0.so.0 (0x00007f42f395c000) librt.so.1 => /lib64/librt.so.1 (0x00007f42f3754000) libglib-2.0.so.0 => /lib64/libglib-2.0.so.0 (0x00007f42f346e000) libevtlog.so.0 => /lib64/libevtlog.so.0 (0x00007f42f3269000) libdl.so.2 => /lib64/libdl.so.2 (0x00007f42f3065000) libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f42f2e49000) libc.so.6 => /lib64/libc.so.6 (0x00007f42f2aa7000) /lib64/ld-linux-x86-64.so.2 (0x00000035d0200000) # uname -a Linux xxx.xxx.com 2.6.32-220.el6.x86_64 #1 SMP Tue Dec 6 19:48:22 GMT 2011 x86_64 x86_64 x86_64 GNU/Linux (CentOS 6.2) Thanks! Dmitry

3 4

patterndb & not describing the entire log message
by Christophe Brocas 22 Dec '11

22 Dec '11

Hello As I said before in other message, I currently work with patterndb to write a pattern file describing Windows log messages related to file system. These messages are sent to Syslog-NG through Snare software. Example : Aug 12 15:08:48 10.0.0.1 MSWinEventLog 1 Security 541 ven. août 12 15:08:46 201 4656 Microsoft-Windows-Security-Auditing D00000001\accout1 N/A Success Audit hostname.d00000001.subdom1.dom1.fr Système de fichiers Un handle vers un objet a été demandé. Sujet : ID de sécurité : S-1-5-21-514083418-1667312537-733111063-1179 Nom du compte : account1 Domaine du compte : D00000001 ID d’ouverture de session : 0x8e90858 Objet : Serveur de l’objet : Security Type d’objet : File Nom de l’objet : E:\xxx\yyyy\filename.doc.doc ID du handle : 0x2b0 Informations sur le processus : ID du processus : 0xeb0 Nom du processus : C:\Windows\System32\inetsrv\w3wp.exe Informations sur la demande d’accès : ID de la transaction : {00000000-0000-0000-0000-000000000000} Accès : DELETE SYNCHRONIZE ReadAttributes Masque d’accès : 0x110080 Privilèges utilisés pour les vérifications d’accès : - Nombre de SID restreints : 0 540 Question : That kind of messages are extremely long and some areas seem empty in my example but may be not in the future. Is there a way with pattern to not describe the entire message but only the relevant part for us (the equivalent of wildcard in regexp) ? Thanks Christophe ***************************************************** "Le contenu de ce courriel et ses éventuelles pièces jointes sont confidentiels. Ils s'adressent exclusivement à la personne destinataire. Si cet envoi ne vous est pas destiné, ou si vous l'avez reçu par erreur, et afin de ne pas violer le secret des correspondances, vous ne devez pas le transmettre à d'autres personnes ni le reproduire. Merci de le renvoyer à l'émetteur et de le détruire. Attention : L'organisme de l'émetteur du message ne pourra être tenu responsable de l'altération du présent courriel. Il appartient au destinataire de vérifier que les messages et pièces jointes reçus ne contiennent pas de virus. Les opinions contenues dans ce courriel et ses éventuelles pièces jointes sont celles de l'émetteur. Elles ne reflètent pas la position de l'organisme sauf s'il en est disposé autrement dans le présent courriel." ******************************************************

4 7

Message parameter substitution
by Anup Shetty 21 Dec '11

21 Dec '11

I am new to syslog-ng and would like some help on the pattern matching and the substitution option. Currently the requirement is to substitute a parameter in the message with a random value in order to anonymize it. *For example:* Dec 31 23:13:25 servername sshd[25218]: Failed keyboard-interactive/pam for *user1* from 10.x.x.x port 47325 ssh2 If I create a pattern database for this message and pick out the username using the string and substitute it user1 to say anon1, will I be able to store the original-substituted value pair for this user and use it repeatedly? Would I be able to do it for all the subsequent logs? To be more clear, an example substitution process that must happen as the logs arrive and the patterns are matched. log with user1 arrives and is substituted by anon1 log with user2 arrives and is substituted by anon2 again log with user1 arrives and is again substituted by anon1 log with user3 arrives and is substituted by anon3 again log with user2 arrives and is again substituted by anon2 . . . . This is required so that once the usernames are substituted for attaining anonymity, there must be a way to reverse them for audit purposes. -- Thanks and regards, AS

3 5

Can I put all the parsed fields into a destination template?
by VÁMOS Balázs 21 Dec '11

21 Dec '11

Hi, I would like to forward the parsed fields to LOGalyze in an unstructured way. Is it possible to create a serialized object (JSON or something like that) after parsing message with patterndb? -- VÁMOS Balázs LOGalyze

4 4

syslog-ng 3.3.1 quits at reload
by Michael Hocke 21 Dec '11

21 Dec '11

-----BEGIN PGP SIGNED MESSAGE----- Hi there, I am having a problem with syslog-ng 3.3.1. Once in a while syslog-ng quits with a QUIT signal after it was asked to reload the configuration through a HUP signal. I have two instances of it running in separate Solaris 10 zones. Both are extremely busy and both crashed once within the last two weeks. By looking at the code in lib/mainloop.c I found the place where syslog-ng quits. It is within main_loop_reload_config_apply caused by a corrupt old configuration. Here is the backtrace with dbx: - ------< SNIP >------- (dbx) where current thread: t@1 =>[1] _kill(0x347f, 0x3, 0x0, 0xfef557d2, 0x80ef41c, 0xfed6217c), at 0xfeb7af85 [2] main_loop_reload_config_apply(0x8047920, 0xfefad000, 0x8047908, 0xfef707f9, 0x80ef368, 0xfef92934, 0x0, 0x0, 0xfef706c9), at 0xfef70595 [3] main_loop_io_worker_sync_call(0x0, 0x8047920, 0x0, 0x0, 0x0, 0x0), at 0xfef70742 [4] iv_signal_event(0xfefad000, 0x8047960, 0x400, 0x796c746e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0), at 0xfef8d958 [5] iv_event_raw_got_event(0xfefad018, 0x8047db0, 0xfe9, 0xfefaa468, 0x2, 0x1), at 0xfef8d54a [6] iv_main(0xfefad180, 0xfef9291e, 0x804c2e8, 0x0, 0x804c7b0, 0x8047e1c), at 0xfef8ac82 [7] main_loop_run(0x8049cd7, 0x8047e44, 0x8047e48, 0x8047e2c, 0x8047e30, 0x8049390), at 0xfef71259 [8] main(0x1, 0x8047e60, 0x8047e70), at 0x80490fa - ------< SNIP >------- I used to run 3.0.6 before without a problem. The configuration of the server that crashed last night is pretty vanilla: - ------< SNIP >------- @version: 3.3 @include "scl.conf" options { time_reopen (10); chain_hostnames (no); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); perm (0644); }; # syslog-ng internal logging source s_local { internal (); }; # local syslogging only source s_sys { system (); }; destination d_sysmsg { file ("/dev/sysmsg"); }; destination d_local { file ("/var/log/syslog-ng.log"); }; destination d_messages { file ("/var/adm/messages"); }; destination d_mail { file ("/var/log/mail.log"); }; destination d_daemon { file ("/var/log/daemon.log"); }; destination d_auth { file ("/var/log/auth.log"); }; destination d_cron { file ("/var/log/cron.log"); }; destination d_user { file ("/var/log/user.log"); }; destination d_lpr { file ("/var/log/lpr.log"); }; destination d_news { file ("/var/log/news.log"); }; destination d_uucp { file ("/var/log/uucp.log"); }; destination d_local0 { file ("/var/log/ipfilter.log"); }; destination d_local1 { file ("/var/log/tcpwrapper.log"); }; destination d_local2 { file ("/var/log/tripwire.log"); }; destination d_local3 { file ("/var/log/local3.log"); }; destination d_local4 { file ("/var/log/local4.log"); }; destination d_local5 { file ("/var/log/local5.log"); }; destination d_local6 { file ("/var/log/local6.log"); }; destination d_local7 { file ("/var/log/local7.log"); }; destination d_snmptraps { file ("/usr/local/var/log/snmptrapd.${R_YEAR}${R_MONTH}${R_DAY}${R_HOUR}.log" group ("snmptrap") perm (416)); }; # this syslog config send a copy of every message to a Splunk server destination d_archive { udp ("x.x.x.x"); }; filter f_sysmsg { level (notice) and facility (kern); }; filter f_messages { facility (kern); }; filter f_mail { facility (mail); }; filter f_daemon { facility (daemon); }; filter f_auth { facility (auth); }; filter f_cron { facility (cron); }; filter f_user { facility (user); }; filter f_lpr { facility (lpr); }; filter f_news { facility (news); }; filter f_uucp { facility (uucp); }; filter f_local0 { facility (local0); }; filter f_local1 { facility (local1); }; filter f_local2 { facility (local2); }; filter f_local3 { facility (local3); }; filter f_local4 { facility (local4); }; filter f_local5 { facility (local5); }; filter f_local6 { facility (local6); }; filter f_local7 { facility (local7); }; log { source (s_local); destination (d_local); }; log { source (s_sys); filter (f_sysmsg); destination (d_sysmsg); destination (d_archive); }; log { source (s_sys); filter (f_messages); destination (d_messages); destination (d_archive); }; log { source (s_sys); filter (f_mail); destination (d_mail); destination (d_archive); }; log { source (s_sys); filter (f_daemon); destination (d_daemon); destination (d_archive); }; log { source (s_sys); filter (f_auth); destination (d_auth); destination (d_archive); }; log { source (s_sys); filter (f_cron); destination (d_cron); destination (d_archive); }; log { source (s_sys); filter (f_user); destination (d_snmptraps); }; log { source (s_sys); filter (f_lpr); destination (d_lpr); destination (d_archive); }; log { source (s_sys); filter (f_news); destination (d_news); destination (d_archive); }; log { source (s_sys); filter (f_uucp); destination (d_uucp); destination (d_archive); }; log { source (s_sys); filter (f_user); destination (d_snmptraps); }; log { source (s_sys); filter (f_lpr); destination (d_lpr); destination (d_archive); }; log { source (s_sys); filter (f_news); destination (d_news); destination (d_archive); }; log { source (s_sys); filter (f_uucp); destination (d_uucp); destination (d_archive); }; log { source (s_sys); filter (f_local0); destination (d_local0); destination (d_archive); }; log { source (s_sys); filter (f_local1); destination (d_local1); destination (d_archive); }; log { source (s_sys); filter (f_local2); destination (d_local2); destination (d_archive); }; log { source (s_sys); filter (f_local3); destination (d_local3); destination (d_archive); }; log { source (s_sys); filter (f_local4); destination (d_local4); destination (d_archive); }; log { source (s_sys); filter (f_local5); destination (d_local5); destination (d_archive); }; log { source (s_sys); filter (f_local6); destination (d_local6); destination (d_archive); }; log { source (s_sys); filter (f_local7); destination (d_local7); destination (d_archive); }; - ------< SNIP >------- Anybody else having this problem? Any hope we can nail this down? - - Michael -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 10.0.3 (Build 1) Charset: us-ascii wsBVAwUBTrmaT5bfnpCg64TVAQE3JAf+KCFVzUL/MGWTgMqRLowtYRDhT8NtThnL p4bRqDqggXjJR8eQhY8dRKyi7zSN+T59WnGunCA2WD98hX5+bUWtyR3yVs5GH4KK XplVrpoPzJNOQFnPrjnrg0VGahO83XMO0nIcS5HdgId8hsGgKKknkWosDTFl97J+ IPxQeqoVuj92DT9MSm00z6SLrX9XtD4dK762zcQ2Tsvz9j9KW21jiWo9sUor6Lpe Dh4Mle0V/dGJOBi7j7UiQOSQCRikl20zTZtId7wsFqsDVGSFlOKTvW+l3XLok0KU ufVnI46N8mrnUWFqDU5SQ952gelIsIAdj6UUwKioZQMafeZvvRLwFA== =9NxF -----END PGP SIGNATURE-----

3 7

Syslog-ng Message Statistics
by vincent＠ragosta.net 21 Dec '11

21 Dec '11

Some of our older systems are utilizing syslog-ng 1.6.12 and I am interested in gathering log counts for each unique source that is reporting. I don't believe there is any mechanism in this version of syslog-ng for performing such analysis, correct? Thanks.

2 1

syslog-ng remote MSSQL databases
by Bely Silva Junior 21 Dec '11

21 Dec '11

dear Srs I need configure syslog-ng insert data on remote MSSQL database, it's possible ? my conf: destination d_mssql { sql(type(mssql) host("ipaddres") port("1433") username("syslogng") password("password") database("syslogng") table("logs") columns("datetime varchar(16)","host varchar(32)" ,"program varchar(32)","pid varchar(8)","message varchar(4096)") values("$R_DATE", "$HOST", "$PROGRAM", "$PID", "$MSGONLY") indexes() ); }; I had error when restart syslog-ng say : syntax erro -- Bely Silva Junior

2 1