- syslog-ng - lists.balabit.hu

Recommended db for syslog?
by victorsugo 26 Oct '20

26 Oct '20

Hi, I'd like to store my logs in a database, instead of text files. Many years ago I thought a mysql or postgresql can be excellent for that purpose, but today... I'm a little bit confused. Should I use an RDBMS? Or should I turn to noSQL databases? (mongoDB?) The only thing I'm sure, I don't want to use any other log manager(??) software (like Graylog, elasticsearch etc.) I'd like to use only a syslog-ng server with a database. Could you help me? Victor :)

1 0

Insider 2020-10: Cisco; Signal Messenger; PCRE dupnames;
by Peter Czanik (pczanik) 08 Oct '20

08 Oct '20

Dear syslog-ng users, This is the 85th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Parsing Cisco logs in syslog-ng -------------------------------- Log messages generated by Cisco devices look like syslog messages at first glance, but on a closer inspection you will see that there are many smaller differences. By default, syslog-ng treats all incoming messages as syslog messages, however, Cisco logs do not conform. Log messages collected over the network from Cisco devices and saved to a file look broken. There are many Cisco log variants but luckily a good part of them are covered by the cisco-parser() of syslog-ng.From this blog you can learn how the Cisco parser in syslog-ng works and how you can check if it really works with your Cisco log messages. https://www.syslog-ng.com/community/b/blog/posts/parsing-cisco-logs-in-sysl… Sending alerts to Signal Messenger from syslog-ng ------------------------------------------------- Signal Messenger is becoming the instant messaging platform of choice for privacy-minded individuals, including many sysadmins. No wonder that some of them would like to see alerts from syslog-ng in this IM platform. Developing a new destination for syslog-ng from scratch in the C programming language is a considerable effort. As a result, this first implementation is utilizing an already existing command line application. Below, you can learn about an initial implementation, and why it is not part of syslog-ng. https://www.syslog-ng.com/community/b/blog/posts/sending-alerts-to-signal-m… Enabling PCRE dupnames in syslog-ng ----------------------------------- One of the major syslog-ng features is that it can parse log messages and create name-value pairs from them. Until now the PCRE parser could not handle duplicate names for named subpatterns. Version 3.29 of syslog-ng resolves this issue by adding the “dupnames” flag. From this blog you can learn why the dupnames flag is important and how you can enable and test it. https://www.syslog-ng.com/community/b/blog/posts/enabling-pcre-dupnames-in-… WEBINARS * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

squid access.log to syslog-ng - how?
by victorsugo 06 Oct '20

06 Oct '20

Hi, I'd like to send all of my squid proxy's log to a syslog-ng server. But it doesn't work as I want, because when syslog-ng parses the lines from access.log, it interprets the first field (actually UTC timestamp) as a program. (I get the timestamp value in the PROGRAM field). But... if I put an rsyslog (installed locally on squid's container) between the squid and syslog-ng servers, I can get correct results. Could you help me, how can I omit the rsyslog from the logging and get a usable log? Is there a standard way to do it? Or do I need to create an own template in squid.conf for this log? regards, Victor --------------------- What's the vector Victor? :) ---------------------------------------------------

2 1

rewrite error
by operacoes - mls wireless 05 Oct '20

05 Oct '20

Hello there, I am runing syslog-ng 3.2.5 on a centos 6.10 server, the log server. Here we have 30 clients sending log via rsyslog to the log server. At the log server each one of them have its own log according to the host name. This operation works just fine. Now my manager ask me to remove some parts of the log, so the final log size will be smaller. At the log server I tried use rewrite and unset to suppress some parts of the log but it does not work, with the error : Plugin module not found in 'module-path'; module-path='/lib64/syslog-ng', module='rewrite' This is the config on log server for each one of the clients. filter f_client_serv01 { host( "client_serv01" ); }; destination d_client_serv01 { file("/var/log/client_serv01.log" perm(0644) owner(root) group(root) ); }; log { source(s_net); filter(f_client_serv01); destination(d_client_serv01); }; This is the log Oct 2 19:07:04 client_serv01 kernel: IN=rdc1 OUT= MAC=00:50:da:6f:0a:54:ec:08:6b:7f:d5:cb:08:00 SRC=10.1.16.35 DST=xxx.xxx.xxx.xxx LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=27903 DF PROTO=TCP SPT=40917 DPT=443 WINDOW=65535 RES=0x00 SYN URGP=0 rewrite r_rewrite_unset{ unset(value("WINDOW")); }; rewrite r_rewrite_subst{ subst("WINDOW", " ", value("MESSAGE"), flags("global")); }; Does anyone have a tip to try to solve this? Thanks for help. Have a nice day! -- Para contato ou solicitações utilize nosso canal de atendimento via Suporte Técnico através de nossa central 24H via tel.:(21) 2538-8400 ou através do email: suporte(a)mls.com.br Atenciosamente, *João Tiago Braz*| Aux. Sistemas Operação 21 2538-8400 | 21 3923-5000 operacoes(a)mls.com.br

2 2

Rewrite JSON field without re-formating via custom template
by Nirgil 29 Sep '20

29 Sep '20

Hello all, sorry to bother you, but I'm bit lost ;] Trying to accomplish the following: Have a JSON inside syslog message and I need to rewrite, or better to remove, one selected particular field, it contains lot of data and I just want to drop this one field before forwarding to different destination. I have created a parser for JSON: parser p_json { channel { parser { json-parser (prefix(".json.")); }; }; }; Now I need remove or change a JSON field, lets say payload. So I created the following rewrite rule and tried multiple options to remove or change the content rewrite { unset(value("${.json.payload}")); unset(value(".json.payload")); groupunset(values("${.json.payload}")); set("TEST", value(".json.payload")); }; This is working on default fields ${HOST}, etc, but not for JSON fields. Message can be reformatted via template ie: template json_template { template("${DATE} ${HOST} $PROGRAM: {\"payload\"\:\""${.json.payload}"\"}") }; In that case, json.payload can be affected by appropriate rewrite rule. But I'd like to affect the json.payload field inside the original ${MSG} without re-formatting whole message via custom template, because the original message has lot of optional fields, other inner JSON's and it is not so simple to made an universal template for this. template json_template { template("${DATE} ${HOST} $PROGRAM: ${MSG}") }; Is there a way how to remove JSON field from original message (${MSG}) without reformatting the whole message via custom template ? Thanks for any thoughts ! Sample of Message: Sep 23 15:22:48 hostname myapplication: {"payload":"verylongpayload","field1":"value",.."lot of other fields, included inner JSON"...}

3 4

Syslog-NG within Kubernetes
by Allen Olivas 22 Sep '20

22 Sep '20

Hello all, I've been working on a containerized and orchestrated environment for a little while now (learning how it all works and slowly implementing it). One step I need to add is Syslog-NG. I"ve copied down the Syslog-NG Docker files and attempted adding these to a deployment in Kubernetes. Syslog-NG appears to be running successfully in Docker but in Kubernetes the logs I get say: syslog-ng: Error setting capabilities, capability management disabled; error='Operation not permitted' I'm not entirely sure where to turn too from this point. I've looked online for any ideas or resolution to this issue but so far non seem to work for my use case. I figured maybe someone on the mailing list might have an Idea? Specifically I'm trying to find out what that error means, and how best to orchestrate a containerized Syslog-NG. Thanks!

2 1

Can I manually setup a Syslog server?
by Turritopsis Dohrnii Teo En Ming 20 Sep '20

20 Sep '20

Subject: Can I manually setup a Syslog server? Good day from Singapore, I have just implemented and setup the following for an investment company (company name is confidential) in Singapore on 12 Sep 2020 Saturday Singapore Time. (1) Installed and configured Kiwi Free Syslog Server 9.7.0 (by Solarwinds) on the Active Directory Domain Controller (Windows Server 2016 Standard). (2) Configured Cisco ASA 5506-X Firewall's Logging to send and transmit syslog messages to Kiwi Free Syslog Server 9.7.0 on the Windows Server. (3) Added a firewall rule to open UDP port 514 on the Symantec Endpoint Protection Manager (SEPM) on Windows Server 2016. So the question I have is, can I manually setup and configure a Syslog Server with GUI using open source syslog daemon, open source tools and any Linux distro? Thank you very much. -- -----BEGIN EMAIL SIGNATURE----- The Gospel for all Targeted Individuals (TIs): [The New York Times] Microwave Weapons Are Prime Suspect in Ills of U.S. Embassy Workers Link: https://www.nytimes.com/2018/09/01/science/sonic-attack-cuba-microwave.html ******************************************************************************************** Singaporean Targeted Individual Mr. Turritopsis Dohrnii Teo En Ming's Academic Qualifications as at 14 Feb 2019 and refugee seeking attempts at the United Nations Refugee Agency Bangkok (21 Mar 2017), in Taiwan (5 Aug 2019) and Australia (25 Dec 2019 to 9 Jan 2020): [1] https://tdtemcerts.wordpress.com/ [2] https://tdtemcerts.blogspot.sg/ [3] https://www.scribd.com/user/270125049/Teo-En-Ming -----END EMAIL SIGNATURE-----

2 2

Insider 2020-09: Prometheus; proxy; ESK;
by Peter Czanik (pczanik) 09 Sep '20

09 Sep '20

Dear syslog-ng users, This is the 84th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Using a proxy with the http() destination ----------------------------------------- The http() destination is quickly becoming one of the most often used destinations within syslog-ng. You might already be using it even if you are not aware of it. Quite a few syslog-ng destination drivers are actually just configuration snippets in the syslog-ng configuration library (SCL), utilizing the http() destination in the background. Just think about elasticsearch-http(), different Logging as a Service (LasS) providers, or slack(). Starting with syslog-ng version 3.28.1 you can also reach these services when there is a proxy server between syslog-ng and your destination. https://www.syslog-ng.com/community/b/blog/posts/using-a-proxy-with-the-htt… Prometheus: syslog-ng exporter ------------------------------ Recently Prometheus became one of the most used open source monitoring solutions. Quite a few people asked if a syslog-ng exporter is available. It is not part of syslog-ng, but there are numerous implementations available on GitHub. Now that Prometheus is part of the openSUSE Leap 15.2 release, which is the Linux distribution running on my laptop, I gave it a try. From this blog, you can learn how to compile the syslog-ng exporter for Prometheus yourself and get it working with Prometheus. https://www.syslog-ng.com/community/b/blog/posts/prometheus-syslog-ng-expor… Jump-starting ESK: Elasticsearch, syslog-ng and Kibana ------------------------------------------------------ If you want to test drive syslog-ng or just want to learn something new, I recommend you checking out the BLACK ESK project. By running a single script, you can set up a containerized test environment, complete with Elasticsearch, Kibana and a syslog-ng server. All network connections among them are encrypted and the syslog-ng configuration showcases many interesting syslog-ng features, including PatternDB and JSON parsing, GeoIP, in-list filtering and the new Elasticsearch destination. Once it is installed, all you need are some logs directed at this server and a browser to reach Kibana. You can learn a lot from reading through the setup scripts and the different configuration files. https://www.syslog-ng.com/community/b/blog/posts/jump-starting-esk-elastics… NEW RELEASES * Version 3.29.1 released: https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-3.29.1 WEBINARS * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Multi-line messages across socket
by Alexandre Santos 07 Sep '20

07 Sep '20

Hi, I have some multi-line messages that are being broken, into single log messages, when they are sent over some remote host. In my configuration, I have one syslog-ng sending messages to other syslog-ng over unix-domain-socket. (check configurations in attachment). My goal is to have content of "/tmp/test1_udp_file.log" equal to the content of "/var/log/netconf-commands.log". Do know what am I missing? Any help is appreciated. Thanks in advance. Alex *</usr/sbin/syslog-ng -Fvde>* [2020-09-07T15:57:17.711583] Incoming log entry from journal; message='AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Test at 2020-09-07T15:57:17,448482284+00:00 \x0awith newline BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB' [2020-09-07T15:57:17.711760] json-parser(): no marker at the beginning of the message, skipping JSON parsing ; input='AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Test at 2020-09-07T15:57:17,448482284+00:00 \x0awith newline BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB', marker='@cim:' [2020-09-07T15:57:17.712016] Reliable disk-buffer state saved; filename='/tmp/syslog-ng-00002.rqf', qdisk_length='0' [2020-09-07T15:57:17.712046] Initializing destination file writer; template='/var/log/netconf-command.log', filename='/var/log/netconf-command.log' [2020-09-07T15:57:17.712150] Outgoing message; message='<158>1 2020-09-07T15:57:17.449+00:00 localhost root 25947 - - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Test at 2020-09-07T15:57:17,448482284+00:00 \x0awith newline BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB\x0a' [2020-09-07T15:57:17.712299] Outgoing message; message='<158>1 2020-09-07T15:57:17.449+00:00 MYHOSTNAME root 25947 - - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Test at 2020-09-07T15:57:17,448482284+00:00 \x0awith newline BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB\x0a' *</var/log/netconf-commands.log>* <158>1 2020-09-07T15:57:17.449+00:00 localhost root 25947 - - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Test at 2020-09-07T15:57:17,448482284+00:00 with newline BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB *<ip vrf exec MGMT /usr/sbin/syslog-ng -Fvde --cfgfile=/etc/syslog-ng/mgmt-syslog-ng.conf --pidfile=/var/lib/syslog-ng/mgmt-syslog-ng.pid --persist-file=/var/lib/syslog-ng/mgmt-syslog-ng.persist --control=/var/lib/syslog-ng/mgmt-syslog-ng.ctl>* [2020-09-07T15:57:17.712514] Incoming log entry; line='<158>1 2020-09-07T15:57:17.449+00:00 MYHOSTNAME root 25947 - - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Test at 2020-09-07T15:57:17,448482284+00:00 ' [2020-09-07T15:57:17.712762] Incoming log entry; line='with newline BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB' [2020-09-07T15:57:17.712997] Outgoing message; message='<158>1 2020-09-07T15:57:17.449+00:00 MYHOSTNAME root 25947 - [meta sequenceId="2"] AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Test at 2020-09-07T15:57:17,448482284+00:00 \x0a' [2020-09-07T15:57:17.713250] Outgoing message; message='<158>1 2020-09-07T15:57:17.449+00:00 MYHOSTNAME root 25947 - [meta sequenceId="2"] AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Test at 2020-09-07T15:57:17,448482284+00:00 \x0a' *</tmp/test1_udp_file.log>* <158>1 2020-09-07T15:57:17.449+00:00 MYHOSTNAME root 25947 - [meta sequenceId="2"] AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Test at 2020-09-07T15:57:17,448482284+00:00

2 1

Re: [syslog-ng] message being consistently dropped
by Gabor Nagy (gnagy) 01 Sep '20

01 Sep '20

Hi, Your logs get dropped by the filter "facility(local1)". The filter does not match on the above log because it cannot be parsed by the syslog-protocol (RFC5424) due to the unescaped brackets in the SDATA. Due to the failed parsing, your log message has been altered to visualize the parsing errors location: <43>1 2020-09-01T18:28:24+02:00 localhost syslog-ng 2514 - - Error processing log message: <141>1 2020-08-04T08:10:58.769127-05:00 fqdn.example.com apmd 12374 01490113:5: [F5@12276 hostname="fqdn" errdefs_msgno="01490113:5:" partition_name="Common" session_id="1c95e1e7" Access_Profile="/Common/blah" Partition="Common" Session_Id="1c95e1e6" Session_Variable_Name="session.machine_info.last.net_adapter.list.[0>@<].mac_address" Session_Variable_Value="3C:D9:2B:33:9A:8E"] /Common/<blah>:Common:1c95e1e6: session.machine_info.last.net_adapter.list.[0].mac_address is 3C:D9:2B:33:9A:8E The question is, do you need to parse the message before storing it into a log file? Because we can disable parsing on the source side and the whole message is put into the $MESSAGE macro. I guess you need some basic parsing, as you filter the messages based on facility. Do you use this source in other log paths as well? I'm thinking in a workaround currently, as so far I didn't found a way to overcome this issue. I would like to emphasize that F5 log format violates the RFC5424 described protocol. This should be reported to them. Regards, Gabor ________________________________ From: Wilson, Jonathan <jonathan.wilson(a)vumc.org> Sent: Tuesday, September 1, 2020 14:39 To: Gabor Nagy (gnagy) <Gabor.Nagy(a)oneidentity.com> Subject: Re: [syslog-ng] message being consistently dropped CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe. Good morning Gabor, thank you for the info on my syslog-ng issue. Unfortunately the device in question is “canned” (an F5) and I am pretty sure I cannot change the format it logs with. Is there a simple way to pre-process them so that they don’t get dropped by syslog-ng? Thanks, Jon Jon Wilson | Principal System Engineer, IT Service Management | Information Technology | Vanderbilt University Medical Center jonathan.wilson(a)vumc.org<mailto:jonathan.wilson@vumc.org> | phone: 615-440-7895 | fax: 615-323-2181

1 0