- syslog-ng - lists.balabit.hu

link
by Linn, William 27 Mar '25

27 Mar '25

I downloaded the RPM for RHEL 9 syslog-ng but getting a weird error. Can someone send the the link so I can make sure I have the right one? Thanks William ---------------------------------------------------------------------- This message, and any attachment(s), is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.bankofamerica.com/electronic-disclaimer. If you are not the intended recipient, please delete this message. For more information about how Bank of America protects your privacy, including specific rights that may apply, please visit the following pages: https://business.bofa.com/en-us/content/global-privacy-notices.html (which includes global privacy notices) and https://www.bankofamerica.com/security-center/privacy-overview/ (which includes US State specific privacy notices such as the http://www.bankofamerica.com/ccpa-notice)

2 1

The syslog-ng Insider 2025-03: EPEL 10; Elasticsearch; Active Roles
by Peter Czanik (pczanik) 12 Mar '25

12 Mar '25

Dear syslog-ng users, This is the 129th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Test syslog-ng on EPEL 10! -------------------------- CentOS Stream 10 and EPEL 10 just became available, and as usual, I tried to build syslog-ng as soon as possible. For now it is available in my git snapshot repository, but I am also planning to make it available in EPEL 10 soon. https://www.syslog-ng.com/community/b/blog/posts/test-syslog-ng-on-epel-10 Collecting Active Roles logs centrally using the syslog-ng Windows Agent -------------------------------- One Identity Active Roles allows you to easily and securely manage Active Directory (AD), Entra ID and M365 Identity objects. While Active Roles stores its log messages into Windows Event Log, most log management and log analytics applications expect to receive log messages over the syslog protocol. This is where syslog-ng Premium Edition (PE) can help you. The syslog-ng Windows Agent can collect and forward Active Roles log messages from Windows Event Log, while the syslog-ng server can collect, process, store and forward Active Roles log messages to multiple destinations. https://www.syslog-ng.com/community/b/blog/posts/collecting-active-roles-lo… syslog-ng OSE 4.8.1 is now in EPEL 10, quick fix for Elasticsearch --------------------------------- This blog is just a quick announcement that syslog-ng 4.8.1 is now available in EPEL 10, so you do not have to use the testing repository anymore. Thanks everyone for the feedback! However, support for Elasticsearch 7+ is broken in this release, as some of you reported. You can fix this problem as described in https://github.com/syslog-ng/syslog-ng/issues/5207 by removing references to “type”. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-ose-4-8-1-is-now… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

TCP orig_log_iw_size='3', why?
by claudio＠witel.it 02 Mar '25

02 Mar '25

Hello syslog-ng community, I get this warning at syslog-ng start (or restart) when running journalctl [...] Feb 27 02:46:57 xxxsplunksyslog1 syslog-ng[2998304]: [2025-02-27T02:46:57.330923] WARNING: window sizing for tcp sources were changed in syslog-ng 3.3, the configuration value was divided by the value of max-connections(). The result was too small, clamping to value of min_iw_size_per_reader. Ensure you have a proper log_fifo_size setting to avoid message loss.; orig_log_iw_size='3', new_log_iw_size='100', min_iw_size_per_reader='100', min_log_fifo_size='30000' Feb 27 02:46:57 xxxsplunksyslog1 systemd[1]: Started System Logger Daemon. I thought the orig_log_iw_size value was coming from the formula log_iw_size/max_connections which should be 100/300=1/3 What is this orig_log_iw_size='3' ? Thanks.

2 4

The syslog-ng Insider 2025-02: Prometheus; RHEL UBI; WSL
by Peter Czanik (pczanik) 19 Feb '25

19 Feb '25

Dear syslog-ng users, This is the 128th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Syslog-ng Prometheus exporter added to RPM syslog-ng container image ------------------------------------------------- Recently I introduced you to my latest project: a syslog-ng container based on Alma Linux. Now I also added a syslog-ng Prometheus exporter to the container, so you can monitor syslog-ng, if you enable it. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-prometheus-expor… Running syslog-ng PE in RHEL UBI -------------------------------- Recently I have posted a Dockerfile to run syslog-ng in an Alma Linux container. I got some encouraging feedback, so this week I experimented with syslog-ng Premium Edition (PE) in a RHEL UBI (Universal Base Image) container. While this is not officially supported by One Identity, we are really interested in your feedback. https://www.syslog-ng.com/community/b/blog/posts/running-syslog-ng-pe-in-rh… Running a syslog-ng server in WSL --------------------------------- Windows Subsystem for Linux (WSL) allows you to run Linux applications on a Windows host. While you can install and run syslog-ng on a default WSL installation, it is not really practical: there is no systemd and WSL is behind NAT. This blog gives you some pointers for working around these problems. https://www.syslog-ng.com/community/b/blog/posts/running-a-syslog-ng-server… WEBINARS * New webinar: “High Availability for syslog-ng Store Box”. You can register for it at https://www.syslog-ng.com/event/high-availability-for-syslog-ng-store-box-/ * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

CRL handling in syslog
by Shankar Pramanik 18 Feb '25

18 Feb '25

I've configured syslog-ng 3.35.1 to use CRLs but things aren't working as expected. This is what I've done : 1. Create a self-signed CA and use it to sign a server certificate. The server certificate has a CRL distribution point in it. 2. Revoke the server certificate. Generate the revoked CRL and put it on the syslog client under /etc/syslog-ng/crl in PEM format. There's a <issuer hash>.r0 link to the CRL in this directory. 3. Configure ca-dir and crl-dir in the client's syslog config. Configure the client to connect to the remote syslog server. With this setup, I' d expect the syslog client to reject the server certificate since it's revoked, but that doesn't happen. The TLS handshake and subsequent communication is successful. Is there anything that I'm missing ? Any pointers will be appreciated. I can provide additional details of my setup if needed. Thanks! Shankar.

3 3

syslog-ng 3.38 UDP errors and missing messages
by Taavi Ansper 11 Feb '25

11 Feb '25

Hi I am running a syslog server that is having problems getting all of the data via UDP. I have gone through most of the tips for making the performance better, but something is still amiss. 1. The syslog-ng server is running in an VM. 8vcpu and 8gb RAM. Debian 12. 2. After restarting or starting the server the UDP errors are tamed. nstat -asz | grep Error UdpInErrors 0 0.0 UdpRcvbufErrors 0 0.0 After 15 minutes or so the errors start to appear. (This amount of errors is after some time.) UdpInErrors 6734175 0.0 UdpRcvbufErrors 6734175 0.0 After some time it starts to receive the packets again. I can see all of this clearly in my graylog graphics that sucks that log data in. (added picture) https://imgur.com/a/eeRpovh It goes like a sinewave up and down every 15 minutes or so. My config looks like this. options { ts-format(iso); frac-digits(6); keep-timestamp(no); chain-hostnames(no); keep-hostname(no); use-dns(yes); use-fqdn(yes); create-dirs(yes); dir-owner(root); dir-group(adm); dir-perm(0750); owner(root); group(adm); perm(0640); log-fifo-size(100000); }; source clients { network( transport(udp) so-rcvbuf(32MiB) log-iw-size(250k) log-fetch-limit(10k) ); network( transport(tcp) max-connections(100) so-rcvbuf(32MiB) log-iw-size(250k) log-fetch-limit(10k) ); }; source forward { network( port(6514) transport(tcp) keep-timestamp(yes) keep-hostname(yes) ); }; destination file { file("/srv/log/${HOST}/${FACILITY}.log"); }; destination forward { network( "192.168.X.X" port(6514) transport(tcp) so-keepalive(yes) disk-buffer( mem-buf-size(512M) disk-buf-size(2048M) reliable(yes) ) ); }; destination graylog { network( "192.168.X.X" port(5140) flags(syslog-protocol) transport(tcp) so-keepalive(yes) disk-buffer( mem-buf-size(512M) disk-buf-size(2048M) reliable(yes) ) ); }; filter graylog { host("^gw-example-") }; log { source(clients); destination(file); destination(forward); flags(flow-control); }; log { source(forward); destination(file); flags(flow-control); }; log { source(clients); filter(graylog); destination(graylog); flags(flow-control); }; My rmem_max is set like so: sysctl net.core.rmem_max net.core.rmem_max = 33445532 Any suggestions? Best regards -- Taavi Ansper taavi.ansper(a)cyber.ee

2 1

The syslog-ng Insider 2025-01: Alpine Linux; Leap 16.0; Alma Linux
by Peter Czanik (pczanik) 16 Jan '25

16 Jan '25

Dear syslog-ng users, This is the 127th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS A syslog-ng container image based on Alpine Linux ------------------------------------------------- Recently, someone suggested I should check out Alpine Linux and prepare a syslog-ng container image based on it. While not supported by the syslog-ng project, an Alpine-based syslog-ng container image already exist as part of the Linuxserver project. https://www.syslog-ng.com/community/b/blog/posts/a-syslog-ng-container-imag… Call for testing: syslog-ng in openSUSE Leap 16.0 ------------------------------------------------- Last week, I submitted syslog-ng to openSUSE Leap 16.0. While the distro is still in a pre-alpha stage, everything already works for me as expected. Well, except for syslog-ng, where I found a number of smaller problems. As such, this blog is a call for testing, both for syslog-ng on openSUSE Leap 16.0 and also for the distribution itself.https://www.syslog-ng.com/community/b/blog/posts/call-for-testing-sy… Experimental syslog-ng container image based on Alma Linux ---------------------------------------------------------- The official syslog-ng container image is based on Debian Stable. However, we’ve been getting requests for an RPM-based image for many years. So, I made an initial version available based on Alma Linux and now I need your feedback about it! https://www.syslog-ng.com/community/b/blog/posts/experimental-syslog-ng-con… WEBINARS * New webinar: “Performance tuning for syslog-ng deployments”. You can register for it at https://www.syslog-ng.com/event/performance-tuning-for-syslog-ng-deployment… * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Creation of manual pages
by Generic Secure-Logging 03 Jan '25

03 Jan '25

syslog-ng features manual pages for the Unix manual system in the doc/ subdirectory. However, these pages are not created when configuring, building and installing syslog-ng with CMake. The autotools config system creates a Makefile with a target manpages when calling configure with the option --enable-manpages. However, the autotools build is broken. The call of make manpages results in the following error ./configure: line 7001: syntax error near unexpected token `newline' ./configure: line 7001: `yes:' make: *** [Makefile:13726: config.status] Error 2 Does anyone know how to create the manual pages in the current version? The information in this e-mail is confidential. The contents may not be disclosed or used by anyone other than the addressee. Access to this e-mail by anyone else is unauthorised. If you are not the intended recipient, please notify Airbus immediately and delete this e-mail. Airbus cannot accept any responsibility for the accuracy or completeness of this e-mail as it has been sent over public networks. If you have any concerns over the content of this message or its Accuracy or Integrity, please contact Airbus immediately. All outgoing e-mails from Airbus are checked using regularly updated virus scanning software but you should take whatever measures you deem to be appropriate to ensure that this message and any attachments are virus free.

1 0

Syslog server chaining issue
by Maurya, Shivani 12 Dec '24

12 Dec '24

Hi All, I am using 2 syslog servers on version 3.31. The devices are sending syslog message to 1st syslog server. The 1st syslog server is forwarding the same message to 2nd syslog server. Device --> Syslog Server 1 --> Syslog Server 2 The configurations of 1st syslog server - Options - keep-hostname(yes); use-dns(yes); use-fqdn(yes); Destination - destination d_sec { udp("IP_of_second_syslog" port(514) template("${ISODATE} ${HOST} ${PRIORITY} ${MSG}\n") template-escape(no)); }; The configuration of 2nd syslog server - destination d_syslogFile { file("/var/log/syslog.log" template("${R_ISODATE} ${HOST} ${PRIORITY} ${FACILITY} ${PROGRAM} ${MSG}\n") template-escape(no)); }; Problem - When the syslog message is getting logged at 2nd Syslog server, the ${PRIORITY} of the message is always "notice". And the original severity/priotity of the message is getting captured in the ${PROGRAM} macro. How to capture the priority of the forwarded message on 2nd Syslog server in the ${PRIORITY} macro instead of ${PROGRAM} macro? Regards, Shivani Maurya

3 3

The syslog-ng Insider 2024-12: FreeBSD audit; 4.8.1; conferences
by Peter Czanik (pczanik) 05 Dec '24

05 Dec '24

Dear syslog-ng users, This is the 126th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS FreeBSD audit source for syslog-ng ---------------------------------- Two weeks ago, I was at EuroBSDcon and received a feature request for syslog-ng. The user wanted to collect FreeBSD audit logs together with other logs using syslog-ng. Writing a native driver in C is time consuming. However, creating an integration based on the program() source of syslog-ng is not that difficult. This blog shows you the current state of the FreeBSD audit source, how it works, and its limitations. It is also a request for feedback. https://www.syslog-ng.com/community/b/blog/posts/freebsd-audit-source-for-s… Version 4.8.1 of syslog-ng is now available ------------------------------------------- Version 4.8.1 was released recently. As you could guess from the version number change, it is primarily a bug fix release, but some minor features also slipped in. From this blog, you can learn what changed in syslog-ng 4.8.1 and where you can get its latest stable version. https://www.syslog-ng.com/community/b/blog/posts/version-4-8-1-of-syslog-ng… Where should I present syslog-ng and sudo? ------------------------------------------ Recently I was asked the same question both at my workplace and at EuroBSDCon, the conference where I was presenting: where do you talk next? I had no definite answer. Of course, I am looking forward to the FOSDEM CfP, but I am also looking for new conferences to present syslog-ng and sudo. Do you have any recommendations? https://www.syslog-ng.com/community/b/blog/posts/where-should-i-present-sys… WEBINARS * New webinar: “Performance tuning for syslog-ng deployments”. You can register for it at https://www.syslog-ng.com/event/performance-tuning-for-syslog-ng-deployment… * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0