- syslog-ng - lists.balabit.hu

Re: [syslog-ng] trouble using kubernetes source
by Evan Rempel 22 May '25

22 May '25

Thanks. I had to install all auxiliary syslog-ng packages and do a recursive grep to find it. Then trace the found file back to the rpm needed. Finally remove all of the auxiliary packages and install just the one I needed. syslog-ng-python-modules Which had a dependency on syslog-ng-python I have what I need now. Thanks. -- Evan ________________________________ From: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of Balazs Scheidler <bazsi77(a)gmail.com> Sent: May 22, 2025 2:05 PM To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] trouble using kubernetes source You don't often get email from bazsi77(a)gmail.com. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification> Kubernetes used Python under the hood, so the kubernetes source might be packaged along with the python package. On Thu, May 22, 2025, 22:30 Evan Rempel <erempel(a)uvic.ca<mailto:erempel@uvic.ca>> wrote: I'm running syslog-ng-4.8.1-2.el8.x86_64 from the copr stable repository. I'm trying to configure the kubernetes() source. By compete configuration file is @version: 4.8 @include 'scl.conf' source s_k8s { kubernetes(); }; When I check this syntax Error parsing config, syntax error, unexpected LL_IDENTIFIER, expecting '}' in /etc/syslog-ng/kubernetes.conf:7:5-7:15: 2 3 @include 'scl.conf' 4 5 6 source s_k8s { 7-----> kubernetes(); 7-----> ^^^^^^^^^^ 8 }; I can't find any information on where the kubernets source is defined. Is this defined in a scl include? Do I need another rpm package? Do I need to load a module? What is my next step? -- Evan ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

trouble using kubernetes source
by Evan Rempel 22 May '25

22 May '25

I'm running syslog-ng-4.8.1-2.el8.x86_64 from the copr stable repository. I'm trying to configure the kubernetes() source. By compete configuration file is @version: 4.8 @include 'scl.conf' source s_k8s { kubernetes(); }; When I check this syntax Error parsing config, syntax error, unexpected LL_IDENTIFIER, expecting '}' in /etc/syslog-ng/kubernetes.conf:7:5-7:15: 2 3 @include 'scl.conf' 4 5 6 source s_k8s { 7-----> kubernetes(); 7-----> ^^^^^^^^^^ 8 }; I can't find any information on where the kubernets source is defined. Is this defined in a scl include? Do I need another rpm package? Do I need to load a module? What is my next step? -- Evan

2 1

The syslog-ng Insider 2025-05: develop branch; Active Roles; ARM container
by Peter Czanik (pczanik) 15 May '25

15 May '25

Dear syslog-ng users, This is the 131st issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Introducing the develop branch of the syslog-ng git repo -------------------------------------------------------- For many years, the development of syslog-ng happened on the master branch in Git. However, if you follow that branch, you might have noticed that there has not been much activity on it lately. That is because we introduced a new branch in git called “develop”. https://www.syslog-ng.com/community/b/blog/posts/introducing-the-develop-br… Working with Active Roles debug logs in syslog-ng ------------------------------------------------- >From my previous Active Roles blogs, you could learn how to forward regular Active Roles logs from Windows Event Log to a central syslog-ng server, where it parses, filters, stores and forwards the logs. In this blog, I show you how to work with Active Roles debug logs, that is reading them using syslog-ng Agent for Windows and forwarding them to a central syslog-ng server for long(er) term storage. https://www.syslog-ng.com/community/b/blog/posts/working-with-active-roles-… Nightly arm64 syslog-ng container builds are now available ---------------------------------------------------------- Recently we enabled nightly syslog-ng builds and container builds for arm64. It means that from now on, you can run the latest syslog-ng on 64bit ARM platforms. https://www.syslog-ng.com/community/b/blog/posts/nightly-arm64-syslog-ng-co… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng version 4.8.2 is available
by Peter Czanik (pczanik) 07 May '25

07 May '25

Hi, Sources for syslog-ng version 4.8.2 are now available. Packages, container images, FreeBSD ports, etc. will follow in the coming hours and days. Peter Bugfixes * CVE-2024-47619 fixed: When using a wildcard syntax in the configuration file to specify the tls certificate name, syslog-ng would match the wildcard too loosely, accepting more than the intended certificate name. This could be exploited by knowing the original certificate name(s) and guessing the wildcard string used to match the correct certificate(s) and then creating fake certificates also satisfying the guessed wildcard sting using g_pattern_match_simple(). Since this exploit needs inside information, and does not lead to data loss or privileged access, it was deemed low impact. * s3: Bugfixes and general stability improvements for the s3 destination driver Refactored the python s3 destination driver to fix a major bug causing data loss if multithreaded upload was enabled via the upload-threads option. This pull request also Important: * Fixes another bug generic to all python drivers, causing syslog-ng to intermittently crash if stopped by SIGINT. * Adds a new suffix option to the s3 destination driver. The default suffix is .log, denoting file extension. * Removes more than 600 lines of superfluous code. * Brings major stability improvements to the s3 driver. * This change affects the naming of multipart objects, as the sequence index is moved in front of the suffix. * The upload-threads option is changed to act on a per-object basis, changing the maximum thread count dependent on max-pending-uploads * upload-threads. (#5257<https://github.com/syslog-ng/syslog-ng/pull/5257>) * We forgot to update all the scl files we have after a bug fix in 4.8.1. Also adds a more detailed HTTP error response logging of compressed error response data. Fixes elasticsearch-http() and other destinations. (#5232<https://github.com/syslog-ng/syslog-ng/pull/5232>) * cfg: Fixed syslog-ng crashing on startup when using certain scl drivers without some options defined. (#5163<https://github.com/syslog-ng/syslog-ng/pull/5163>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Bálint Horváth, David Mcanulty, Franco Fichtner, Hofi, Kovács Gergő Ferenc, László Várady, Romain Tartière, Tamas Pal, sulpher Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

stats frequency
by Peter Czanik (pczanik) 07 May '25

07 May '25

Hi, By default, syslog-ng saves statistics data every ten minutes. Nowadays there are much better methods to monitor syslog-ng (hello Prometheus). However, there are people who use it as a kind of mark message. Question: should we keep the 10 minutes default, or disable it completely? It can be set using stats(freq()); Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

2 1

Sending logs to Loki
by Alexey Vlasov 06 May '25

06 May '25

Hi, in accordance with: https://syslog-ng.github.io/admin-guide/070_Destinations/125_Loki/001_Loki_… I try to send logs to my loki server @version: 4.8 @include "scl.conf" options { chain_hostnames(off); use_fqdn(no); keep_hostname(yes); dns-cache-expire(87600); }; source s_internal { internal(); }; destination d_loki { loki( url("my.loki.ip.here:13100") port(13100) labels( "server" => "my-syslog-server", ) template("${MESSAGE}") auth(insecure()) ); }; log { source(s_internal); destination(d_loki); flags(final); }; but always get: 2025-05-06 15:00:50.373 Error establishing connection to server; driver='d_loki#0', worker_index='0', location= Test requests through curl pass well (from syslog host). Dump from tcpdump: - from syslog-ng: .U.Q...5PRI * HTTP/2.0 SM ..$.....................?.....?...... .................?.. - response from loki ...-.U.QHTTP/1.1 301 Moved Permanently Location: /%2A Date: Tue, 06 May 2025 11:56:42 GMT Content-Length: 0 Connection: close what could be wrong with my conf? Thanks in advance.

1 0

is multi-line support available?
by David Beecher 24 Apr '25

24 Apr '25

Hello, The available packages for linux do not seem to include "multi-line" and I downloaded the repository from git and tried to build with multi-line and it won't build completely. I need multiline to support tomcat logs, etc... am I going in the wrong direction? Thanks, David -- *David Beecher, President and CEO 720.729.0404 x8101* TekOps, Inc. <http://www.tekops.com> <http://www.tekops.com> We solve SoHo business needs! We bring enterprise solutions to SoHo business Websites, Email, Telephone Integration, CRM, Helpdesk, Intranet, and more /This email may contain data that is confidential, proprietary or "non-public personal information," as that term is defined in the Gramm-Leach-Bliley Act (collectively, "Confidential Information"). The Confidential Information is disclosed conditioned upon your agreement that you will treat it confidentially and in accordance with applicable law, ensure that such data is nto used or disclosed except for the limited purpose for which it's being provided and will ntoify and cooperate with us regarding any requested or unauthorized disclosure or use of any Confidential Information. By accepting and reviewing the Confidential Information you agree to indemnify us against any losses or expenses, including attorney's fees that we may incur as a result of any unauthorized use or disclosure of this data due to your acts or omissions. If a party other than the intended recipient receives this e-mail you are requested to instantly notify us of the erroneous delivery and return to us all dat so delivered./

2 1

Breaking changes between versions
by Faine, Mark R. (MSFC-IS64)[AEGIS] 22 Apr '25

22 Apr '25

I need to go from 3.31.2 to 3.37.1. Should I expect any breaking changes? Also, Redhat Insights is reporting that syslog-ng and syslog-ng-logrotate are signed with SHA1, are the newer packages signed with SHA2? Red Hat recommends that you adopt any of the options below: * Contact vendors of the packages to ask for new builds signed with supported signatures and re-install the new packages, * Resign packages with your own SHA-2 key or completely remove packages until a new build with SHA-2 signature is available from the 3rd-party vendor Thanks, Mark

2 2

The syslog-ng Insider 2025-04: Elasticsearch beta; Active Roles; RHEL UBI
by Peter Czanik (pczanik) 10 Apr '25

10 Apr '25

Dear syslog-ng users, This is the 130th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Testing Elasticsearch 9.0.0 beta1 with syslog-ng ------------------------------------------------ Each time a new major Elasticsearch version is released, someone asks if it works with syslog-ng. So I gave it a quick test and based on that, it works fine. But of course, some terms and conditions apply… :-) https://www.syslog-ng.com/community/b/blog/posts/testing-elasticsearch-9-0-… Working with parsed Active Roles logs in syslog-ng -------------------------------------------------- In my previous Active Roles blog, you learned how to forward Active Roles logs to a central syslog-ng server to parse and store the logs. In this blog, I’ll show you how to: - Work with parsed Active Roles logs. - Store logs to various document stores. - Prepare long-term storage. - Send alerts for some critical events. https://www.syslog-ng.com/community/b/blog/posts/working-with-parsed-active… Running syslog-ng PE in RHEL UBI --------------------------------- Recently I have posted a Dockerfile to run syslog-ng in an Alma Linux container. I got some encouraging feedback, so this week I experimented with syslog-ng Premium Edition (PE) in a RHEL UBI (Universal Base Image) container. While this is not officially supported by One Identity, we are really interested in your feedback. https://www.syslog-ng.com/community/b/blog/posts/running-syslog-ng-pe-in-rh… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Ticket Received - syslog-ng Digest, Vol 239, Issue 9
by Example 27 Mar '25

27 Mar '25

Dear Syslog-ng, We would like to acknowledge that we have received your request and a ticket has been created. A support representative will be reviewing your request and will send you a personal response.(usually within 24 hours). To view the status of the ticket or add comments, please visit https://teeraphanaotjantuek-help.freshdesk.com/helpdesk/tickets/3988 Thank you for your patience. Sincerely, Teeraphan Aotjantuek Support Team

2 1