- syslog-ng - lists.balabit.hu

syslog-ng-3.29.1
by Laszlo Budai 28 Aug '20

28 Aug '20

3.29.1 Highlights * panos-parser(): parse Palo Alto PAN-OS logs Example: @include "scl.conf" log { source { network(transport("udp")); }; parser { panos-parser(); }; destination { elasticsearch-http( index("syslog-ng-${YEAR}-${MONTH}-${DAY}") type("") url("http://localhost:9200/_bulk") template("$(format-json --scope rfc5424 --scope dot-nv-pairs --rekey .* --shift 1 --exclude *future_* --exclude *dg_hier_level_* --scope nv-pairs --exclude DATE --key ISODATE @timestamp=${ISODATE})") ); }; }; (#3234<https://github.com/syslog-ng/syslog-ng/pull/3234>) Features * snmptrap: improve error message when missing dependency (#3363<https://github.com/syslog-ng/syslog-ng/pull/3363>) * disk queue: reduce memory usage during load (#3352<https://github.com/syslog-ng/syslog-ng/pull/3352>) * Allow dupnames flag to be used in PCRE expressions, allowing duplicate names for named subpatterns as explained here: https://www.pcre.org/original/doc/html/pcrepattern.html#SEC16 . Example: filter f_filter1 { match("(?<FOOBAR>bar)|(?<FOOBAR>foo)" value(MSG) flags(store-matches, dupnames)); }; (#3381<https://github.com/syslog-ng/syslog-ng/pull/3381>) Bugfixes * filter/regex: if there was a named match (?..)? that is optional to match, the previose or the next named matches might not be saved as named match. (#3393<https://github.com/syslog-ng/syslog-ng/pull/3393>) * tls: Fixed a bug, where ecdh-curve-list() were not applied at client side. (#3356<https://github.com/syslog-ng/syslog-ng/pull/3356>) * scratch-buffers: fix global.scratch_buffers_bytes.queued counter bug This bug only affected the stats_counter value, not the actual memory usage (i.e. memory usage was fine before) (#3355<https://github.com/syslog-ng/syslog-ng/pull/3355>) * wsl: fix infinite loop during startup (#3340<https://github.com/syslog-ng/syslog-ng/pull/3340>) * openbsd: showing grammar debug info for openbsd too, when -y command line option is used (#3339<https://github.com/syslog-ng/syslog-ng/pull/3339>) * stats-query: speedup syslog-ng-ctl query get "*" command. An algorithmic error view made syslog-ng-ctl query get "*" very slow with large number of counters. (#3376<https://github.com/syslog-ng/syslog-ng/pull/3376>) * syslogformat: fixing crashing with small invalid formatted logs see example in #3328<https://github.com/syslog-ng/syslog-ng/issues/3328> (#3364<https://github.com/syslog-ng/syslog-ng/pull/3364>) * cfg: fix config reload crash via introducing on_config_inited in LogPipe (#3176<https://github.com/syslog-ng/syslog-ng/pull/3176>) * config: fix error reporting * Error reporting was fixed for lines longer than 1024 characters. * The location of the error was incorrectly reported in some cases. (#3383<https://github.com/syslog-ng/syslog-ng/pull/3383>) * disk queue: fix possible crash during load, and possible false positive corruption detection (#3342<https://github.com/syslog-ng/syslog-ng/pull/3342>) * db-parser, pdbtool, graphite-output: fix glib assertion error The assertion happened in these cases * dbparser database load * argument parsing in graphite-output * pdbtool merge commad Syslog-ng emitted a glib assertion warning in the cases above, even in successful executions. If G_DEBUG=fatal-warnings environment variable was used, the warning turned into a crash. (#3344<https://github.com/syslog-ng/syslog-ng/pull/3344>) * stats: fix stats-ctl query crash when trying to reset all the counters syslog-ng-ctl query get '*' --reset (#3361<https://github.com/syslog-ng/syslog-ng/pull/3361>) Packaging * RHEL 7 packaging: fix logrotate file conflict with rsyslog (#3324<https://github.com/syslog-ng/syslog-ng/pull/3324>) * Debian packaging: python3-nose was removed from package dependencies. Pytest will run Python related unittests (for modules/python/pylib/syslogng/debuggercli/tests/) instead of nose. (#3343<https://github.com/syslog-ng/syslog-ng/pull/3343>) Notes to developers * light: test for assertion errors in glib for each testcases (#3344<https://github.com/syslog-ng/syslog-ng/pull/3344>) * Fix signal handling when an external library/plugin sets SIG_IGN Previously, setting SIG_IGN in a plugin/library (for example, in a Python module) resulted in a crash. (#3338<https://github.com/syslog-ng/syslog-ng/pull/3338>) * func-test: removed logstore_reader check, which was never reached (#3236<https://github.com/syslog-ng/syslog-ng/pull/3236>) * plugin_skeleton_creator: fixing a compiler switch Wrong compiler switch used in plugin_skeleton_creator. This caused a compiler warning. The grammar debug info did not appear for that module, when -y command line option was used. (#3339<https://github.com/syslog-ng/syslog-ng/pull/3339>) * Light test framework: get_stats and get_query functions to DestinationDriver class Two new functions added to DestinationDriver class which can be used for getting the stats and query output of syslog-ng-ctl. (#3211<https://github.com/syslog-ng/syslog-ng/pull/3211>) Other changes * internal(): limit the size of internal()'s temporary queue The internal() source uses a temporary queue to buffer messages. >From now on, the queue has a maximum capacity, the log-fifo-size() option can be used to change the default limit (10000). This change prevents consuming all the available memory in special rare cases. (#3229<https://github.com/syslog-ng/syslog-ng/pull/3229>) * network plugins: better timer defaults for TCP keepalive >From now on, syslog-ng uses the following defaults for TCP keepalive: * tcp-keepalive-time(): 60 * tcp-keepalive-intvl(): 10 * tcp-keepalive-probes(): 6 Note: so-keepalive() is enabled by default. (#3357<https://github.com/syslog-ng/syslog-ng/pull/3357>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Antal Nemes, Attila Szakacs, Balazs Scheidler, Christian Tramnitz, chunmeng, Gabor Nagy, Laszlo Budai, Laszlo Szemere, László Várady, MileK, Norbert Takacs, Peter Czanik, Péter Kókai, Terez Nemes.

1 0

Re: [syslog-ng] syslog-ng is ignoring a network source
by Bruns, Benjamin 28 Aug '20

28 Aug '20

Hello Laci, how do I check that by using netcat? Cheers, Ben Von: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> Im Auftrag von Laszlo Szemere (lszemere) Gesendet: Freitag, 28. August 2020 12:21 An: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Betreff: Re: [syslog-ng] syslog-ng is ignoring a network source Hello Ben, our experience shows that having logs in Wireshark doesn't necessary means that they reach the applications. (Wireshark captures packets on the interface level.) So as a first step I would recommend to clarify that the logs from the second host indeed reaches Syslog-ng. (For UDP logs netcat usually is enough.) Once it is clear that those logs reaches the application level, we can focus on debugging Syslog-ng. By starting Syslog-ng with the following options, it would be much easier to examine the flow of messages: syslog-ng -Fdevt -F : start it in the foreground -d : debug mode -e : log messages to stderr -v : increases verbository -t : also enable trace messages Note: With these options enabled, Syslog-ng will produce a LOT of messages. So if you can turn off other logging sources temporary, than it will be much more easier to read those logs. At this point you should start to receive this kind of debug messages, which will indicate that Syslog-ng received the log messages from your host: [2020-08-28T10:09:43.289660] Incoming log entry; line='hello world' >From this point the easiest way is to start with a minimal config, and build up your final configuration step by step. Checking incoming logs in each steps. Br, Laci ________________________________ From: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu<mailto:syslog-ng-bounces@lists.balabit.hu>> on behalf of Bruns, Benjamin <Benjamin.Bruns(a)cypp.de<mailto:Benjamin.Bruns@cypp.de>> Sent: Friday, August 28, 2020 11:53 To: syslog-ng(a)lists.balabit.hu<mailto:syslog-ng@lists.balabit.hu> <syslog-ng(a)lists.balabit.hu<mailto:syslog-ng@lists.balabit.hu>> Subject: [syslog-ng] syslog-ng is ignoring a network source CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe. Hello! I try to send syslogs from two firewalls to my syslog-ng host. The first one worked immediately, but logs of the second firewall seems to be ignored. Both syslogs come in via UDP on port 514 and I can see them in Wireshark on my syslog-ng host, but they disappear for my second firewall in a black hole. Both have Logstash as their destination configured. Any ideas? Thanks in advance! Cheers, Ben

2 1

syslog-ng is ignoring a network source
by Bruns, Benjamin 28 Aug '20

28 Aug '20

Hello! I try to send syslogs from two firewalls to my syslog-ng host. The first one worked immediately, but logs of the second firewall seems to be ignored. Both syslogs come in via UDP on port 514 and I can see them in Wireshark on my syslog-ng host, but they disappear for my second firewall in a black hole. Both have Logstash as their destination configured. Any ideas? Thanks in advance! Cheers, Ben

2 1

Message Macros
by Faine, Mark R. (MSFC-IS40)[NICS] 27 Aug '20

27 Aug '20

Is it possible to break up the $MESSAGE macro into smaller macros that constitute the entire message? The reason I ask is that we tried this format in our destination: template("${S_ISODATE} ${MESSAGE}\n") However, we get two dates now, since I'm assuming one is part of the $MESSAGE macro, and we also lost the $HOST in our messages. We just want the output to be exactly like it would be without specifying a template but with an ISO date, followed by the hostname/ip, and the rest of the message excluding the date. Thanks, -Mark

3 3

iptables and syslog-ng
by Faine, Mark R. (MSFC-IS40)[NICS] 13 Aug '20

13 Aug '20

I'm sure there is probably an existing canonical set of rules to allow syslog-ng traffic through iptables but I can't find it. I'm sorry, since I know this is probably a common question. I've been trying to get it to work but I seem to be missing something. This is what I have: iptables -A INPUT -i em3 -p udp --dport 514 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o em3 -p udp --sport 514 -m state --state ESTABLISHED -j ACCEPT iptables -A INPUT -i em1 -p tcp --dport 514 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i em1 -p tcp --dport 10514 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o em1 -p tcp --sport 514 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -o em1 -p tcp --sport 10514 -m state --state ESTABLISHED -j ACCEPT We receive logs on udp 514 and tcp 10514 and we forward all of these logs to another remote server on the same ports. I've not seen any evidence of it but I've been told that we may also receive logs on tcp 514. I appreciate any assistance. We usually rely on hardware firewalls but new security guidelines are also requiring software firewalls be configured. Thanks, -Mark

1 0

Re: [syslog-ng] syslog-ng multiple VRF
by Terry Slattery 10 Aug '20

10 Aug '20

Alex, The simplest solution is to configure the network to share routes between the two VRFs. Linux now supports VRF, however, my quick read on the subject suggests that its configuration is complex. Applications like syslog-ng are rarely VRF-aware. It would have to bind to two different interfaces, one in each VRF. -tcs On 7/22/20 8:00 AM, syslog-ng-request(a)lists.balabit.hu wrote: > Date: Tue, 21 Jul 2020 15:18:46 +0100 > From: Alexandre Santos <alexandre.rosas.santos(a)gmail.com> > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Subject: [syslog-ng] syslog-ng multiple VRF > Message-ID: > <CAHxG_72hhkfCBu3j9nPxr_MVwKevJtFcpcRhVJLYPPYx4Mys1g(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hi All, > > I have a question regarding syslog-ng and VRF. > I want to read from a syslog source, which interface is in the default VRF, > and send the logs to a syslog/network destination interface which is in a > MGMT VRF. > > Can syslog-ng support this? > If yes, what are the aspects I should be careful about? > > Thanks and regards, > Alex -- Terry Slattery CCIE #1026 NetCraftsmen www.netcraftsmen.com

5 7

Kafka performance
by Ronald Fenner 07 Aug '20

07 Aug '20

I'm trying to figure out why the performance of syslog-ng sending to kafka has tanked considerably. Everything was running fine up until 7/30 and then all of sudden syslog-ng is having problems pushing messages to kafka at a quick pace. I've updated to 3.28.1 and it's still having problems. I was using disk buffering but I removed it an d doesn't seem to be the bottleneck. I feel it's something with syslog ng as I can use the kafka perf test to push messages at a very quick rate to the cluster. I was able to push 1 million 1k test messages in several seconds. Syslog-ng seems to be able to only push a couple of messages a second. Any thoughts on what could be tanking it's performance? It's running on Amazon Linux 2. I've rebuilt our base image with the latest version so we can switch between kafka-c and the java version however since the kafka-c topic can't be templated at the moment until a pull request is released I can't switch to it to see if it fairs better. Ronald Fenner Network Architect Game Circus LLC. rfenner(a)gamecircus.com

2 3

Sylog-ng and F5 Load balancer.
by Peter Griggs 07 Aug '20

07 Aug '20

Hello Does anyone have any experience of syslog-ng behind F5 load balancer and preserving source IP address? The F5 can put the X-Forwarding header or TCP Options value but I don't believe syslog-ng can understand either of these - Am I wrong? If I am then I am assuming I can have a filter that overwrites $HOST with the value of X-Forwarding or TCP Options. Any help appreciated. Thanks Peter.

3 7

EWMM and sudo app-parser
by Fabien Wernli 06 Aug '20

06 Aug '20

Hi, I'm investigating using the EWMM forwarding model. Consider the following setup: Linux hosts collect logs using `system()` send them over using `syslog-ng()` destination to a remote host that collects them using `default-network-drivers()` source. It seems to me that the sudo app parsing is fired up twice: 1. On the sender side because `system()` expands to something including the `sudo-parser()` SCL 2. On the receiver side because `default-network-drivers()` expands to something involving the `app-parser()` This happens also when using `syslog()` source on the sender side, which is why I noticed this behaviour. So my question is, is there something wrong with that model ?

2 4

Kafka-c topics dynamic
by Ronald Fenner 06 Aug '20

06 Aug '20

When I was using the java implementation I extracted the topic dynamically from the message to route the message to the proper topic. I see in Kafka c implementation that the topic can't use templates so my old method of doing this topic("${topic}.${environment}") No longer works. Is there a way to reproduce this or do I need to go back to the java version for now? Ronald Fenner Network Architect Game Circus LLC. rfenner(a)gamecircus.com

2 2