- syslog-ng - lists.balabit.hu

syslog-ng 3.01 compilation error on Solaris
by Rakesh Rajasekharan 20 Feb '11

20 Feb '11

Hi, I was trying to compile the syslog-ng 3.01 on Solaris 10 Opteron machine using the mixed linking option. In the configure stage I get the below error complaining about the glib . I have compiled glib with teh enable static flag and the libglib-2.0.a library is available under the path /usr/local/lib and my PKG_CONFIG_PATH environment variable has been set correctly too. Please help me solve this. * * Below is the configure error. checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking for pthread_create in -lpthread... yes checking for LIBNET... no checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking whether to enable TCP wrapper support... no checking whether to enable spoof source support... no checking whether to enable IPv6 support... yes checking whether to enable SQL support... no checking whether to enable Linux capability support... no checking whether to enable PCRE support... no checking for pkg-config... (cached) /usr/local/bin/pkg-config checking pkg-config is at least version 0.14... yes checking for GLIB - version >= 2.10.1... yes (version 2.16.5) checking for EVTLOG... yes checking for static GLib libraries... no checking sanity checking Glib headers... yes *configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib* * * * Thanks & Regards, Rakesh *

2 4

Invitation to connect on LinkedIn
by Janez Barbic 19 Feb '11

19 Feb '11

LinkedIn ------------ Syslog-ng, I'd like to add you to my professional network on LinkedIn. - Janez Janez Barbic Student at Univerza v Ljubljani Slovenia Confirm that you know Janez Barbic https://www.linkedin.com/e/-uz7o7o-gkcu3i8u-2k/isd/2362025712/_2EaqCuR/ -- (c) 2011, LinkedIn Corporation

1 0

patterndb project?
by Valentijn Sessink 18 Feb '11

18 Feb '11

Hi, http://www.balabit.com/wiki/patterndb mentions the "patterndb project", but there is hardly any information. I have a couple of additions to the sshd patterns, does anyone know where to put/send them? Best regards, Valentijn

2 3

[Bug 112] New: Problems when using encoding in 3.1.3 ose edition
by bugzilla＠bugzilla.balabit.com 17 Feb '11

17 Feb '11

https://bugzilla.balabit.com/show_bug.cgi?id=112 Summary: Problems when using encoding in 3.1.3 ose edition Product: syslog-ng Version: 3.1.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: aseques(a)gmail.com Type of the Report: --- Estimated Hours: 0.0 Good morning, I needed to reencode some windows logs emited by snare so they are stored ad UTF on the fly. After reading the documentation, I found what seems to be the solution. Instead of creating a single source of data. I create an extra one, called src_win. source src { udp(ip("192.168.1.200") port(514)); }; source src_win { udp(ip("192.168.1.200") port(514) encoding("WINDOWS-1252")); }; Whenever I want to use the filter encoding for the logs, I will use this source instead of the generic one. log { source(src_win); filter(f_host_name); filter(f_messages); destination(name_messages); }; The problem is that as soon as I enable the source src_win for any log, it just stop logging the rest of sources. Is that a known bug or something I should fix. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

patterndb single byte optional
by Jean F. Mousinho 17 Feb '11

17 Feb '11

Hello, I was wondering if there's any way of reducing two lines of pattern, which provide a way of matching when a optional byte is present or not, into a single line. Example: JAN @STRING:.day@ 2011 JAN @STRING:.day@ 2011 Notice that this is the case when day doesn't have the leading 0 and I don't want the .day to contain any space. Just asking, this would reduce my patterns to half :) but I can live with that... Maybe a new type of STRING, like @DSTRING:.day: @ (dirty string, with dirty chars inside the optional argument) would fix it? Thanks for your time. Jean-François Mousinho

2 1

Possible destination driver question
by Bill Anderson 15 Feb '11

15 Feb '11

I've had it in my "backlog" to write a couple destinations: redis and AMQP (specifically at the moment rabbitmq). I've done the Proof-of-Concept via program() already and of course it works. With all the recent announcements of people writing to various destinations such as SMTP and MongoDB, I thought I'd throw out an email to see if someone is already working on one before getting started on one sometime in the next couple sprints/weeks. Cheers, Bill -- Bill Anderson, RHCE Linux Systems Engineer bill.anderson(a)bodybuilding.com

2 1

[PATCH] systemd integration, take two
by Gergely Nagy 15 Feb '11

15 Feb '11

Hi! After a short session with Bazsi the other day, the earlier systemd integration patches were reworked slightly. Bazsi refactored the patch, I cleaned it up a little afterwards, and tested it to the best of my knowledge (also thanks to Peter Czanik for testing the new patches aswell). The patches are available on the integration/systemd branch of my repositories: git://git.balabit.hu/algernon/syslog-ng-3.3.git and git://git.balabit.hu/algernon/syslog-ng-3.2.git (for 3.3 and 3.2, respectively). The change in this patchset is that the way systemd sockets are recognised has been reworked, which made my previous GSockAddr changes unnecessary (and thus, those changes were dropped). As a side effect, unix-stream sockets should be working too, alongside of unix-dgram, and extending this to other socket types should be a lot easier than before. I'd like to call for some more testing, and if all goes well, then this version could be merged to the official tree. -- |8]

2 1

syslog-ng Insider - February 2011
by Peter Czanik 11 Feb '11

11 Feb '11

Dear syslog-ng users, This is the first issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com FEATURED NEWS BalaBit has been invited to the CEE Board ----------------------------------------- Common Event Expression (CEE) for Event Interoperability is a US govermental task force aiming to standardize the way computer events are described, logged, and exchanged. A part of CEE will define a generic dictionary for event fields, which will be handy for the syslog-ng patterndb project. More information on CEE: http://cee.mitre.org/about.html Current members of CEE Board: http://cee.mitre.org/board.html Related blog posts: * http://bazsi.blogs.balabit.com/2010/11/patterndb-goes-cee/ * http://czanik.blogs.balabit.com/2010/11/cee/ FOSDEM - Free and Open Source Developers European Meeting ---------------------------------------------------------- Peter Czanik from the syslog-ng upstream attended the conference to help include the most recent syslog-ng versions into the main distributions. Read his blog post at http://czanik.blogs.balabit.com/2011/02/fosdem/ Support the syslog-ng project with your testimonial! ---------------------------------------------------- We have launched a public site for collecting user feedbacks and testimonials. Please help us to improve syslog-ng and tell us your opinion (both negative and positive), experience, feature request, or why you use syslog-ng at http://www.balabit.com/testimonials/send OTHER SHORT NEWS * A new syslog-ng driver for the mongodb() NOSQL database is available in 3.3 alpha1: http://asylum.madhouse-project.org/projects/syslog-ng/mongodb/ * systemd support for recent operating systems: https://lists.balabit.hu/pipermail/syslog-ng/2011-February/015876.html * Debian 6.0 repositories include syslog-ng OSE 3.1: http://packages.debian.org/search?keywords=syslog-ng&searchon=names&suite=s… NEW RELEASES OF THE SYSLOG-NG PRODUCT FAMILY * syslog-ng OSE 3.3 alpha1 - http://bazsi.blogs.balabit.com/2010/12/threading-epoll-on-3-3-mainline/ * syslog-ng PE 4.0 - http://attila.blogs.balabit.com/2011/02/balabit%e2%80%99s-syslog-ng-premium… RECENT WHITEPAPERS * Message Classification with syslog-ng (Free download) http://www.balabit.com/whitepapers/log-classification * Performance measurements of syslog-ng Premium Edition 4.0 (Requires registration at balabit.com) http://www.balabit.com/support/documentation/syslog-ng-pe-v4.0-whitepaper-p… * PCI compliance and forensics in auditing remote server access (Free download) http://www.balabit.com/sites/default/files/scb-v3.0-whitepaper-pci-complian…

2 1

Syslog-ng Windows Agent & WIN2008 Event Forwarding Subscription
by Szilárd Szabó 08 Feb '11

08 Feb '11

Üdv mindenkinek, Van egy kis problémám. Adott egy Windows Server 2008 melyen Event Forwarding Subscription van beállítva a következőek szerint: http://blogs.technet.com/b/wincat/archive/2008/08/11/quick-and-dirty-large-… Az hozzáadtam pár klienst. Az események megérkeznek a Windows Server 2008-ra hiba nélkül a ForwardedEvents -be. A Problémám a következő: A Windows Server 2008-ra telepítettem egy Syslog-ng Windows Agent 3.2.1 verziót, és beállítottam a log továbbítást egy Syslog-ng PE-felé. Az események megérkeznek, de felettéb érdekesen :) Jan 20 16:06:34 COMPUTER1 NT: AUTHORITY\ANONYMOUS LOGON: ForwardedEvents Security: [] (EventID 538) Jan 20 16:06:34 COMPUTER2 NT: AUTHORITY\ANONYMOUS LOGON: ForwardedEvents Security: [] (EventID 538) Jan 20 16:06:34 COMPUTER3 NT: AUTHORITY\ANONYMOUS LOGON: ForwardedEvents Security: [] (EventID 538) A Windows 2008 továbbá 64bites, tehát AD-ból van menedzselve. Ez most Agent probléma lehet, vagy a Event Forwarding Subscription-nal van a baj? Üdv Szilárd

5 11

[RFC] value-pairs(), take #3
by Gergely Nagy 07 Feb '11

07 Feb '11

Hi! Based on the feedback from this list, we've had a little discussion with Bazsi on how to improve value-pairs(), and we came up with something that is hopefully more consistent and easier to use than my last proposal. The Syntax ========== We'd have two syntaxes, one for the configuration file itself (usable by the drivers), and one for template functions (eg, tfjson): they'll share most properties, the difference will be in how they appear. See the example below: config file: ------------ value-pairs( scope(nv_pairs core syslog all_macros selected_macros everything) exclude("R_*") exclude("S_*") key(".SDATA.meta.sequenceId") pair("MSGHDR" "$PROGRAM[$PID]: ") ) template function: ------------------ $(format-json --scope nv_pairs,core,syslog,all_macros,selected_macros,everything \ --exclude R_* --exclude S_* --key .SDATA.meta.sequenceId \ --pair MSGHDR="$PROGRAM[$PID]: ") Explanation ----------- The above examples would start with a full set of name-value pairs (due to having "everything" in the scope; we could start with selected_macros instead [see below]). The scope can only be extended by subsequent calls to scope(), but even then, the set will be built only once, at the beginning. We'll likely end up with throwing a syntax error during parse if more than one scope() statement is seen, or if it's not the first statement within value-pairs(). However, explicitly specifying a key-value pair (either via key() or pairs()) will use the full set, regardless what scope() was selected. This, however, might change, if people find this too confusing. But changing this will complicate the code quite a lot, and remove some of the flexibility. >From this set, we exclude every pair where the key begins with "R_" or "S_", then we explicitly include .SDATA.meta.sequenceId (though, in this example, this is useless, as it's already included due to the scope, and wasn't excluded). Then add a custom key-value pair. Syntax Details -------------- The starting name-value pair set will be defined by the scope() statement, which can have the following values: * nv_pairs: The name-value pair database, including some frequently used builtins (currently: HOST, HOST_FROM, MESSAGE, PROGRAM, PID, MSGID, SOURCE and LEGACY_MSGHDR) * rfc3164, alias core, alias base: The basic pairs from RFC3164: $FACILITY, $SEVERITY (= $LEVEL), $DATE(=$S_DATE), $HOST, $PROGRAM, $PID, and $MSG. * rfc5424, alias syslog: The pairs from rfc3164 plus $SDATA and $MSGID. * all_macros: All macros known to syslog-ng (including all of the above, pretty much) * selected_macros: rfc5424 + $TAGS, $SOURCEIP, $SEQNUM * everything: all of the above, combined Each key is added to the set only once, naturally. scope() was introduced as a replacement for builtins(), which was unclear and inflexible. scope() does the job far better, and is - in my opinion - a lot clearer too. Apart from scope(), we have a few more statements: * select() / exclude(): We wanted to rename select() to include(), but syslog-ng already has an include() statement, and I ran into problems during the rename. It's undecided whether we'll remain with select() or adjust the parser to treat the two include statements differently (I'd opt for select()). The difference between the previous implementation's select()/exclude() is that in the new implementation, the first match will matter. This gets rid of the confusing priority stuff, and is still flexible enough (especially with the introduction of scope()) for all cases we could come up with. * key(): One can list macros with this statement. It does the same thing "$HOST" and friends did in the previous implementation, one just needs to use a statement this time, for clarity's sake. * pairs(): Same thing as the previous implementation's ("key" "value") construct. Current shortcomings: * List separation: at the moment, list values need to be space separated, and the key-value pairs (see pairs()) need a space separator too. In the long run, we'd like to allow commas as separators too. Another example --------------- value-pairs( scope(selected_macros nv_pairs) select(.*) select("usracct.*") select("secevt.*") select(".SDATA.*") exclude("*") key("SEVERITY") key("HOST") key("PROGRAM") key("PID") key("MSG") key("TAGS") pair("timestamp" "$UNIXTIME") ); This will start with a base set of selected_macros and nv_pairs, select a few specified patterns, and exclude everything else. Then it will explicitly add a few keys (which does not need to be part of the original set!), and a custom key-value pair. I hope this was understandable, and better than the previous proposal. As soon as I start working on implementing this proposal, the code will be available from the work/value-pairs/base branch of my git tree: git://git.madhouse-project.org/syslog-ng/syslog-ng-3.3.git (or browsable on the web at: http://git.madhouse-project.org/syslog-ng/syslog-ng-3.3/log/?h=work/value-p…) And as always, Your feedback is most appreciated! Nothing is set in stone yet, and I'd love to hear your opinion. -- |8]

3 4