- syslog-ng - lists.balabit.hu

[SOLVED] Strange issue when forwarding using LEEF template
by Pal, Laszlo 28 May '20

28 May '20

Hi, I have a strange issue with templates... Maybe some stupid issue on my side, maybe a bug I don't know *<spoiler> Solutions at the end of this </spoiler>* Here is the scenario Logs coming from Windows using Syslog-ng Agent (syslog destination) Logs received using latest OSE (but same issues at the customer with PE6) Logs must be forwarded to Qradar using a special LEEF template like this (there are also tabs in the template). I've tried both network and syslog destination template t_leefwin { template("<${PRI}>${BSDDATE} ${HOST} LEEF:1.0|Microsoft|Windows|2k8r2|${EVENT_ID}| devTime=${R_YEAR}-${R_MONTH}-${R_DAY}T${R_HOUR}:${R_MIN}:${R_SEC}GMT${TZOFFSET} devTimeFormat=yyyy-MM-dd'T'HH:mm:ssz cat=${EVENT_TYPE} sev=${EVENT_LEVEL} resource=${HOST} usrName=${EVENT_USERNAME} application=${EVENT_SOURCE} message=${EVENT_MSG}\n"); }; The forwarded results like this <46> IP-address LEEF:1.0|Microsoft|Windows|2k8r2||devTime=2020-05-28T09:10:02GMT+02:00 devTimeFormat=yyyy-MM-dd'T'HH:mm:ssz cat= sev= resource=172.17.24.174 usrName= application= message= So, the $macro-s are empty except the one which is not from .sdata (resource) I've created a local json and welf destination and I can see the macros there SDATA="[win(a)18372.4 EVENT_CATEGORY=\"None\" EVENT_FACILITY=\"16\" EVENT_ID=\"4098\" EVENT_LEVEL=\"3\" EVENT_NAME=\"Application\" EVENT_REC_NUM=\"73006\" EVENT_SID=\"S-1-5-18\" EVENT_SID_TYPE=\"User\" EVENT_SOURCE=\"Group Policy Services\" EVENT_TYPE=\"Figyelmeztetés\" EVENT_HOST=\"hostname\" EVENT_USERNAME=\"NT AUTHORITY\\\\SYSTEM\" I remember I used this method years ago to forward logs from syslog-ng agent to Qradar with proper LEEF format and it was ok... but now, some small thing is missing Versions syslog-ng 3 (3.25.1) Config version: 3.25 Installer-Version: 3.25.1 But, we have a similar issue with PE6 at the customer Any idea? --- so after playing with the welf output a bit, I figured out the short version of the macro names are not longer working somehow, but the long ones are ok like this template t_leefwin { template("<${PRI}>${BSDDATE} ${HOST} LEEF:1.0|Microsoft|Windows|2k8r2|${.SDATA.win@18372.4.EVENT_ID }|devTime=${R_YEAR}-${R_MONTH}-${R_DAY}T${R_HOUR}:${R_MIN}:${R_SEC}GMT${TZOFFSET} devTimeFormat=yyyy-MM-dd'T'HH:mm:ssz cat=${.SDATA.win(a)18372.4.EVENT_TYPE} sev=${.SDATA.win(a)18372.4.EVENT_LEVEL} resource=${SDATA.win(a)18372.4.EVENT_HOST} usrName=${.SDATA.win(a)18372.4.EVENT_USERNAME} application=${.SDATA.win(a)18372.4.EVENT_SOURCE} message=${MESSAGE}\n"); }; Thanks L:

2 2

High throughput UDP logging configuration.
by Evan Rempel 28 May '20

28 May '20

I know. There is a ton of information online about this. It shouldn't be that difficult, but I'm still having problems. I have one device with a very high logging rate. Approaching 15K msg/sec (7.5MB/sec). I am running on a 2 socket 8 core/CPU system (Intel(R) Xeon(R) CPU E5-2670 0 @ 2.60GHz). Not the latest and greatest, but still fairly quick. All of the storage is on SSD. What I have configured 1. OS net.core.rmem_max = 536870912 2. so-reuseport(1) - and 8 sources on the UDP port 3. so_rcvbuf(67108864) - all 9 udp sources. 4. log_iw_size(2M) 5. log_fetch_limit(20k) 6. log_fifo_size(4M) Flow control is NOT enabled. Monitoring the queued messages inside syslog-ng and they remain near zero. Monitoring udp buffer queues in the OS shows that one stream is still overwhelming syslog-ng's ability to read messages. [~]$ sudo netstat -unlp|egrep -e 'PID|syslog' Proto Recv-Q Send-Q Local Address Foreign Addr State PID/Program name udp 0 0 11.22.33.44:514 0.0.0.0:* 15591/syslog-ng udp 0 0 11.22.33.44:514 0.0.0.0:* 15591/syslog-ng udp 0 0 11.22.33.44:514 0.0.0.0:* 15591/syslog-ng udp 0 0 11.22.33.44:514 0.0.0.0:* 15591/syslog-ng udp 0 0 11.22.33.44:514 0.0.0.0:* 15591/syslog-ng udp 134216320 0 11.22.33.44:514 0.0.0.0:* 15591/syslog-ng udp 0 0 11.22.33.44:514 0.0.0.0:* 15591/syslog-ng udp 0 0 11.22.33.44:514 0.0.0.0:* 15591/syslog-ng A few things of note. 1. The OS UDP buffer seems to be 128MB in size and the so_rcvbuf configured ins 64M in size. Is that because the syslog-ng configuration of so_rcvbuf is in characters but the OS buffer is in bytes? 2. In a 1 second interval "cat /proc/net/udp" shows that one UDP stream dropped 6283 packets. So I'm continually dropping approx 50% of the UDP stream. 3. Increasing the log_iw_size or the log_iw_size actually seems to make things worse. All suggestions that help me understand this and help to minimize the drops are welcome. -- Evan Rempel

2 3

Forwarding to Elastic
by Shawn Taylor 28 May '20

28 May '20

I am running ES/Kibana 6.8.9-1 and am struggling with this issue. https://discuss.elastic.co/t/message-failed-to-find-message-in-kibana-logs/… I have added my index to the *Logs Indices* field in the Logs configuration. When I look at the fields in a document I see a field called MESSAGE, but not message. I do not see a way to add this field in the configuration. Is it possible to have this document display in the Logs UI? Can I convert the fields in syslog-ng to lowercase before forwarding them to elastic? Thanks, Shawn

3 4

Extract SNI on incoming connections
by Raghunath Adhyapak 23 May '20

23 May '20

Hi, I would like to run a syslog-ng server that accepts TLS connections. I want to identify clients based on the server name they use to connect and do specific processing for each client. I see the following macros being available to be used in filter, but I don't see .TLS.SN (or something like that to indicate server name used by client to connect) .TLS.X509 *Description:* When using a transport that uses TLS, these macros contain information about the peer's certificate. That way, you can use information from the client certificate in filenames, database values, or as other metadata. If you clients have their own certificates, then these values are unique per client, but unchangeable by the client. The following macros are available in syslog-ng OSE version 3.9 and later. - .TLS.X509_CN: The Common Name of the certificate. - .TLS.X509_O: The value of the Organization field. - .TLS.X509_OU: The value of the Organization Unit field. Thanks Raghu

2 2

Convert json format to syslog rfc5424
by Carlos Lopez 22 May '20

22 May '20

Hi all, Due to some issues with our logs collector server, I need to read some logs in json format and convert them to syslog rfc5424 and forward to our central syslog server. Acctually, all information regarding this type of configuration located in syslog-ng’s web site is related to send json format as a destination. But, is it possible to do the opposite: read a json file and forward to a third server in syslog rfc5424 format? Yes, I will try to catch up only some specific fields, not all fields contained in the json soure file. Any tips? Regards, C. L. Martinez

2 1

getting "Error processing log message" for checkpoint logs
by Russell Fulton 20 May '20

20 May '20

I am trying to ingest logs from a checkpoint firewall over a tcp connection: source s_checkpoint { network( transport("tcp") flags(no-multi-line) port(2514) keep-alive(yes) flags(syslog-protocol) ); }; # added flags(syslog-protocol) on suggest of checkpoint docs for syslog-ng destination d_debug { file( "/data/russell//test.log" ); }; log { source( s_checkpoint ); destination( d_debug ); }; This is what turns up in the output: May 18 12:10:42 secmgrprd02 syslog-ng[1555]: Error processing log message: <134>1 2020-05-17T23:33:27Z smartlog01 CheckPoint 25651 -….. Any ideas on what is going on or how to find out? Russell

2 5

How to get the number of logged message count
by Monitto Pitchaimani sebastin (mopitcha) 18 May '20

18 May '20

Hi All, Is there a way to get the logged messages to the particular destination? We wanted to get the count of number of logs delivered to the particular destination I.e., network() etc Regards, Monitto

2 1

Insider 2020-05: syslog-ng 3.27; Python HTTP header; DBLD; Sumologic;
by Peter Czanik (pczanik) 14 May '20

14 May '20

Dear syslog-ng users, This is the 81st issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Version 3.27 of syslog-ng released ---------------------------------- Version 3.27.1 of syslog-ng is now available, adding many smaller features to syslog-ng. These include new macros to check where a given log message arrived, a new rewrite to easily change the syslog facility of a message, a Sumologic destination and an experimental feature to check log integrity. For source code and full details, check https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-3.27.1 For ready-to-use packages check https://syslog-ng.com/3rd-party-binaries Introduction to the Python HTTP header -------------------------------------- You can create your own custom headers for the HTTP destination using syslog-ng’s Python HTTP header plugin and Python scripts. The included example configuration only adds a simple counter to the headers, but with a bit of coding, you can resolve authentication problems or fine-tune how data is handled at cloud-based logging and SIEM platforms, like Sumologic. https://www.syslog-ng.com/community/b/blog/posts/introduction-to-the-python… DBLD: a syslog-ng developer tool not just for developers -------------------------------------------------------- DBLD is a central tool when it comes to syslog-ng development, but even after multiple blogs about the tool, it is still not much used outside of the developers’ team. So, what is DBLD and how could it be used even by you? The abbreviation stands for Docker BuiLD. Using containers ensures both that you have an easily reproducible build environment, and also that you do not have to “pollute” your base system with development-related software packages. You can use DBLD to build the release tarball or ready-to-use packages for a number of Linux distributions. It can even be used as a development environment with all necessary tools installed. Still not convinced? Yes, the listed possibilities are mostly interesting for syslog-ng developers and 3rd party packagers. If you are lucky, you will never need DBLD. On the other hand, it can come handy if you reported a problem and the syslog-ng team fixed it. Even if you are not a developer, only a junior sysadmin, you can still easily build fixed syslog-ng packages for testing (and even for production use) until an official release with the fix arrives. https://www.syslog-ng.com/community/b/blog/posts/dbld-a-syslog-ng-developer… Getting your logs into Sumo Logic with syslog-ng made easy ---------------------------------------------------------- Sumo Logic is one of the most popular cloud-based log management and security analytics services. They provide their own log shippers, but also work with others, including syslog-ng. The use of syslog-ng is well documented on their support website, but the actual configuration part can easily be simplified. A new, dedicated Sumo Logic destination is already available as part of syslog-ng 3.27. It is based either on the network() or the http() destination of syslog-ng and implemented as an SCL, hiding away most of the configuration details from the users. https://www.syslog-ng.com/community/b/blog/posts/getting-your-logs-into-sum… syslog-ng PE 7.0.20 available ----------------------------- Version 7.0.20 of syslog-ng Premium Edition was released. It adds Red Hat Enterprise Linux 8 to the supported platforms: https://support.oneidentity.com/technical-documents/syslog-ng-premium-editi… Using RHEL 8 instead of RHEL 7 you can use udp-balancer() source for high performance UDP log collection: https://support.oneidentity.com/technical-documents/syslog-ng-premium-editi… NEW WHITE PAPERS * Upgrade to State-of-the-Art Log Management: https://www.syslog-ng.com/whitepaper/log-management-essentials8137754/ WEBINARS * Learn how to easily integrate Azure Sentinel into your log-data strategy: https://www.syslog-ng.com/webcast-ondemand/learn-how-to-easily-integrate-az… * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Missing one log message when destination unavailable for short period of time.
by Ali Shirvani 08 May '20

08 May '20

Hi all, I tried to setup simple relay with syslog-ng, it receives log on one port and forward to the destination. It works fine when destination is available, but when destination unavailable for a short period of time and then became available I miss one log entry. For example assume that I send simple numbers with logger command to syslog-ng, from 0 to 100, when I receive 50 on destination I stop its listener and start it again, in this case the first log entry that I receive is 52 instead of 51. Here is my syslog-ng.conf: @version: 3.26 options { time_reopen(5); }; source s_network { network( ip("127.0.0.1") port(514) transport("udp") ); }; destination d_network { network( "127.0.0.1" port(5514) transport("udp") ); }; log { source(s_network); destination(d_network); }; Would you please help me to resolve this issue? Regards, Ali

3 6

Syslogs not writing to disk
by Rose, Ed 05 May '20

05 May '20

Hello All, I have syslog-ng setup currently setup to write to disk and forward events on to a different syslog server. Syslog isn't writing to disk it seems. I do not see any errors either, unless I am not looking in the right place for the errors. Tcpdump -v host x.x.x.x shows data coming in from the host but a tail -f ${HOST}/log_${HOST} shows no logs going to disk. Thanks Ed syslog-ng 3 (3.14.1) Config version: 3.14 Installer-Version: 3.14.1 Revision: Module-Directory: /usr/lib64/syslog-ng Module-Path: /usr/lib64/syslog-ng Available-Modules: afmongodb,sdjournal,linux-kmsg-format,appmodel,date,pseudofile,afamqp,syslogformat,csvparser,cef,tags-parser,affile,afsocket,afstomp,tfgetent,json-plugin,confgen,system-source,stardate,graphite,dbparser,afprog,xml,add-contextual-data,snmptrapd-parser,cryptofuncs,kvformat,disk-buffer,basicfuncs,afuser,map-value-pairs Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: on Enable-Systemd: on filter f_awanra1 { host("x.x.x.x"); }; filter f_bwanra1 { host("x.x.x.x"); }; filter f_cwanra1 { host("x.x.x.x"); }; destination d_ciscoasa { file("/var/log2/gns/cisco_asa/${HOST}/log_${HOST}" create-dirs(yes) dir-perm(0755) dir-group(splunk) perm(0640) group(splunk)); }; destination d_uid1 { tcp("x.x.x.x" port(514) ); }; destination d_uid2 { tcp("x.x.x.x" port(514) ); }; destination d_uid3 { tcp("x.x.x.x" port(514) ); }; destination d_uid4 { tcp("x.x.x.x" port(514) ); }; log { source(s_net); filter(f_amywanra1); destination(d_ciscoasa); destination(d_uid1); destination(d_uid2); destination(d_uid3); destination(d_uid4); flags(final); }; log { source(s_net); filter(f_cnswanra1); destination(d_ciscoasa); destination(d_uid1); destination(d_uid2); destination(d_uid3); destination(d_uid4); flags(final); }; log { source(s_net); filter(f_demwanra1); destination(d_ciscoasa); destination(d_uid1); destination(d_uid2); destination(d_uid3); destination(d_uid4); flags(final); };

2 8