- syslog-ng - lists.balabit.hu

setting sequenceId in forwarded log messages read from journald reader
by Peter Vollmer 29 Jul '20

29 Jul '20

Hi, I am currently trying to find a way to set meta.sequenceId of log messages that have been read from the locally running systemd-journal to forward them to a remote syslog server that expects the logs to contain a sequenceId according to RFC 5424 section 7.3.1. I found that a sequence number could be taken from the __CURSOR field "i=..." of the journald log: # journalctl -o json-pretty -f ... "__CURSOR" : "s=02a7b30ba17b4a43846f265706bd3a70;i=f01;b=ba633698f20848e480bca4e72476e4d3;m=1a355c1d5;t=5ab670340c8ea;x=33389988ef680e7e", ... My problem is that the journal reader does not seem to parse the __CURSOR string when reading from journald logs. Is there a way to get this information into meta.sequenceId of the forwarded log without modifying the systemd-journal module in syslog-ng ? Thank you for any ideas and best regards Peter Vollmer

3 2

Certificate ip authentication
by Alexandre Damas 27 Jul '20

27 Jul '20

Hi, As my objective on the utilization of syslog-ng is the authentication and certification of received security and auditing events, I implemented an internal CA which generates a certificate per syslog-ng client. Once there was someone that misconfigured a client and got a certificate for a different client. The funny part of it is that no one observed any problem as the certificate, which was generated for a client having an ip (different from the one configured on the machine), was working and communications (using ALTP with TLS) went up for the exchange of messages. Has anyone experienced this? Does someone have a clue on how to prevent certificate reutilization on the client side? On Linux side I did not find any way of preventing the utilization of a certificate for one machine, that was issued for a different machine, having a different ip. If there is no cross checking on the server for the ip addresses on the certificate with the ip address on the received event, I don't have a way of non-repudiate a received event and the client can reuse the certificate for other machines, allowing the events to be received on the server. Kind Regards Alexandre Damas

2 2

Configuration validation Issue with snmptrap module
by Luca Da Col 23 Jul '20

23 Jul '20

Running syslog-ng 3.27.1 on Centos 7. Configuration validation returns an error with snmptrap command. Configuration example has been taken directly from the OSE documentation. Error error was reproducible with version available on epel repository (3.5), though documentation indicates the snmptrap is available from 3.10 Configuration file includes statements: @version:3.22 @include "scl.conf" Any assistance is appreciated, Thank you, Luca [root@adev syslog-ng]# syslog-ng --syntax-only Error parsing source statement, source plugin snmptrap not found in /etc/syslog-ng/syslog-ng.conf:92:5-92:13: 90 log { 91 source { 92----> snmptrap(filename("/var/log/snmptrapd.log")); 92----> ^^^^^^^^ 93 }; 94 destination { 95 file("/var/log/example.log"); 96 }; 97 }; [root@dev syslog-ng]# syslog-ng -V syslog-ng 3 (3.27.1) Config version: 3.22 Installer-Version: 3.27.1 Revision: Compile-Date: Jun 8 2020 07:54:17 Module-Directory: /usr/lib64/syslog-ng Module-Path: /usr/lib64/syslog-ng Include-Path: /usr/share/syslog-ng/include Available-Modules: affile,afprog,afsocket,afstomp,afuser,basicfuncs,confgen,cryptofuncs,csvparser,dbparser,linux-kmsg-format,syslogformat,system-source,add-contextual-data,appmodel,cef,disk-buffer,examples,graphite,hook-commands,json-plugin,kvformat,map-value-pairs,pseudofile,sdjournal,stardate,tags-parser,tfgetent,timestamp,xml Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: on Enable-Systemd: on [root@dev syslog-ng]#

2 1

syslog-ng multiple VRF
by Alexandre Santos 22 Jul '20

22 Jul '20

Hi All, I have a question regarding syslog-ng and VRF. I want to read from a syslog source, which interface is in the default VRF, and send the logs to a syslog/network destination interface which is in a MGMT VRF. Can syslog-ng support this? If yes, what are the aspects I should be careful about? Thanks and regards, Alex

2 2

syslog-ng restarts due to interface not ready
by Alexandre Santos 21 Jul '20

21 Jul '20

Hi, I have a configuration where one of my sources is a syslog source: syslog(ip(127.1.1.1) transport("udp") port(514) keep-alive(no)); But when the system starts up, the interface is not ready yet, and I get the following errors: Jun 26 09:17:50 localhost systemd[1]: Starting System Logger Daemon... Jun 26 09:17:52 localhost syslog-ng[2301]: [2020-06-26T09:17:52.485148] WARNING: With use-dns(no), dns-cache() will be forced to 'no' too!; Jun 26 09:17:52 localhost syslog-ng[2301]: [2020-06-26T09:17:52.487159] Current position not matches to the saved cursor position, seek to head; cursor='s=f62c0e80f50948deb29cf2d28230a Jun 26 09:17:52 localhost syslog-ng[2301]: [2020-06-26T09:17:52.487867] Error resolving hostname; host='127.1.1.1' Jun 26 09:17:52 localhost syslog-ng[2301]: [2020-06-26T09:17:52.487878] Error initializing message pipeline; plugin_name='syslog', location='/etc/syslog-ng/syslog-ng.conf:43:5' Jun 26 09:17:52 localhost systemd[1]: syslog-ng.service: Main process exited, code=exited, status=2/INVALIDARGUMENT Jun 26 09:17:52 localhost systemd[1]: syslog-ng.service: Failed with result 'exit-code'. Jun 26 09:17:52 localhost systemd[1]: Failed to start System Logger Daemon. Jun 26 09:17:52 localhost systemd[1]: syslog-ng.service: Service RestartSec=100ms expired, scheduling restart. Jun 26 09:17:52 localhost systemd[1]: syslog-ng.service: Scheduled restart job, restart counter is at 1. When the systemd reaches the 5 attempts it disables the syslog-ng.service. Do you know some way to fix this, by adding something, the syslog-ng configuration? Thanks in Advance, Alex

4 4

disk buffer files permissions
by Pal, Laszlo 13 Jul '20

13 Jul '20

Hi, We want to monitor disk-buffer files, so we can detect if there is are some issues with the destinations. syslog-ng creates these files with permissions like this otal 360 -rw-------. 1 root root 4096 Oct 10 2019 syslog-ng-00000.qf -rw-------. 1 root root 4096 Jul 12 03:49 syslog-ng-00001.qf So, our monitor script (for zabbix) cannot stat files because it is running under user zabbix. I'm not sure how to submit a feature request nowadays, but it would be great of perm() option added to disk-buffer() Any chance? Thx L:

3 4

Insider 2020-07: TLS; capabilities; 3.27;
by Peter Czanik (pczanik) 09 Jul '20

09 Jul '20

Dear syslog-ng users, This is the 83rd issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Simplifying CA handling in syslog-ng TLS connections ---------------------------------------------------- When talking to users about the TLS-encrypted message transfer, almost everyone immediately complains about configuring a certificate authority (CA) in syslog-ng. You needed to create a hash and create a symbolic link to the CA file based on the hash. Not anymore. While this old method is still available, there is now a much easier way: the new ca-file() option. https://www.syslog-ng.com/community/b/blog/posts/simplifying-ca-handling-in… Working around Linux capabilities problems for syslog-ng -------------------------------------------------------- No, SELinux is not the cause of all permission troubles on Linux. For example, syslog-ng makes use of the capabilities system on Linux to drop as many privileges as possible, as early as possible. But it might cause problems in some corner cases, as even when running as root, syslog-ng cannot read files owned by a different user. Learn from this blog how you can figure out if you have a SELinux or capabilities problem and how to fix it if you do. https://www.syslog-ng.com/community/b/blog/posts/working-around-linux-capab… Figuring out where a message arrived, and other syslog-ng 3.27 tricks ---------------------- Version 3.27 of syslog-ng has brought many smaller, but useful features to us. The new Sumo Logic destination was already covered in an earlier blog. You can now also check exactly where a message arrived on a network source (IP address, port and protocol). Rewriting the facility of a syslog message was also made easy. For a complete list of new features and changes, check the release notes at https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-3.27.1 You can learn more about these features at https://www.syslog-ng.com/community/b/blog/posts/figuring-out-where-a-messa… NEW RELEASES * Version 3.28.1 released: https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-3.28.1 * syslog-ng PE version 7.0.21 is coming soon with MSSQL and Oracle SQL sources, and you can send logs to Google Pub/Sub. For details, check the documentation at https://support.oneidentity.com/syslog-ng-premium-edition/7.0.21 WEBINARS * Learn how to do custom HTTP REST API Authentication with syslog-ng: https://www.syslog-ng.com/event/customize-http-rest-apis-authentication-wit… * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Convert logs back into syslog-ng logs
by Faine, Mark R. (MSFC-IS40)[NICS] 07 Jul '20

07 Jul '20

I would like to read lines from a file back into log data that syslog-ng can parse. What would be involved in doing this? Thanks, -Mark

2 3

syslog-ng 3.28.1 RPM packages
by Peter Czanik (pczanik) 24 Jun '20

24 Jun '20

Hi, As usual, my unofficial syslog-ng rpm packages for openSUSE/SLES and Fedora/RHEL/CentOS first appear in my git snapshot repositories. I hope to create the usual dedicated repositories later this week and that will be followed by a separate announcement. For now you can install/test 3.28.1 following instructions from https://syslog-ng.com/blog/rpm-packages-from-syslog-ng-git-head/ Any feedback is appreciated! Here is a list of changes since the last release: * Java modules (HDFS, Elasticsearch, Kafka, etc.) removed. The Java binding itself stays, where JDK 1.8 is available. * Logrotate script on Fedora is renamed to syslog-ng and only installed if rsyslog is not on the system * Logrotate script on RHEL 8 is only installed if rsyslog is not on the system to avoid conflict * * Logrotate bug on RHEL 7 fixed (the same logrotate script is used as for rsyslog to avoid conflict * Bye, CzP Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng 3.28 Debian/Ubuntu packages (OBS)
by Laszlo Budai 23 Jun '20

23 Jun '20

Hi, syslog-ng 3.28.1[1] packages are available from OBS repositories[2, 3, 4]. List of supported OSs: * Debian 8.0 * Debian 9.0 * Debian 10.0 * Raspbian 9.0 * Raspbian 10.0 * Ubuntu 14.04 * Ubuntu 16.04 * Ubuntu 18.04 * Ubuntu 18.10 * Ubuntu 19.04 * Ubuntu 19.10 * Ubuntu 20.04 Install ------- example: Debian 9.0 1. get release key wget -qO - http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… | sudo apt-key add - 2. add repo to APT sources eg.: /etc/apt/sources.list.d/syslog-ng-obs.list deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… ./ Then `apt-get update` and `apt-get install syslog-ng-core` Links -------- [1] https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.28.1 [2] https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-… [3] https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-… [4] https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-… regards, Laszlo Budai

1 0