- syslog-ng - lists.balabit.hu

use /dev/log on systemd machines
by Matus UHLAR - fantomas 18 Mar '20

18 Mar '20

Hello, if I understand properly, the system() source opens /dev/log socket when machine does not run systemd, am I right? Can I force syslog-ng to open /dev/log socket in this case or have I to configure it explicitly? -- Matus UHLAR - fantomas, uhlar(a)fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. I intend to live forever - so far so good.

2 1

cmake vs autotools
by Chris Packham 18 Mar '20

18 Mar '20

Hi, Question from the buildroot mailing list [1]. Is syslog-ng transitioning to cmake or will both cmake an autotools be supported for the foreseeable future. It's not an issue either way buildroot supports building with either cmake or autotools. But if autotools will be retired we may as well switch now to avoid hassles with future updates. Thanks, Chris -- [1] - http://lists.busybox.net/pipermail/buildroot/2020-March/277459.html

3 2

syslog-ng 3.26 RPM packages
by Peter Czanik (pczanik) 10 Mar '20

10 Mar '20

Hi, A bit slower than usual, but my unofficial syslog-ng 2.26 RPM packages are now available. I'm still traveling, so I did not have a chance for much testing. Any feedback is very welcome! * openSUSE/SLES: https://build.opensuse.org/project/show/home:czanik:syslog-ng326 * fedora/RHEL/CentOS: https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng326/ Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Fwd: facility override
by Alexandre Santos 09 Mar '20

09 Mar '20

Hi, I tried to rewrite PRI but the macro is not writable: Mar 09 11:27:31 localhost syslog-ng[31986]: Error parsing rewrite expression, PRI is read-only, it cannot be changed in rewrite rules in /etc/syslog-ng/syslog-ng.conf: Mar 09 11:27:31 localhost syslog-ng[31986]: 359 }; Mar 09 11:27:31 localhost syslog-ng[31986]: 360 # end of localFile: netconf-commands Mar 09 11:27:31 localhost syslog-ng[31986]: 361 Mar 09 11:27:31 localhost syslog-ng[31986]: 362 Mar 09 11:27:31 localhost syslog-ng[31986]: 363 # remote: test Mar 09 11:27:31 localhost syslog-ng[31986]: 364---> rewrite r_pri{set("189", value("PRI"));}; Mar 09 11:27:31 localhost syslog-ng[31986]: 364---> ^ Mar 09 11:27:31 localhost syslog-ng[31986]: 365 destination d_test_udp { Mar 09 11:27:31 localhost syslog-ng[31986]: 366 syslog("192.168.122.1" transport("udp") ip-protocol(4) port(514) Mar 09 11:27:31 localhost syslog-ng[31986]: 367 suppress(5) Mar 09 11:27:31 localhost syslog-ng[31986]: 368 disk-buffer( Mar 09 11:27:31 localhost syslog-ng[31986]: 369 mem-buf-size(2097152) I tried to use the following configuration to make a facility override local0 -> local7: # remote: test template t_test { template("$(if ('${LEVEL_NUM}' == '0') '<184>1' $(if ('${LEVEL_NUM}' == '1') '<185>1' $(if ('${LEVEL_NUM}' == '2') '<186>1' $(if ('${LEVEL_NUM}' == '3') '<187>1' $(if ('${LEVEL_NUM}' == '4') '<188>1' $(if ('${LEVEL_NUM}' == '5') '<189>1' $(if ('${LEVEL_NUM}' == '6') '<190>1' '<191>1' ))))))) ${ISODATE} ${HOST} ${PROGRAM} ${PID} $(if ('${MSGID}' == '') '-' '${MSGID}') $(if ('${SDATA}' == '') '-' '${SDATA}') ${MESSAGE}"); }; destination d_test_udp { network("192.168.122.1" transport("udp") ip-protocol(4) port(514) template ("t_test") ); }; filter f_remote_test_udp_local0 { facility(local0) and level(debug .. emerg); }; log { source(s_src); filter(f_remote_test_udp_local0); destination(d_test_udp); flags(flow-control); }; # end of remote server: test The problem is that I get a double header in the syslog server: Mar 9 11:41:52 127.0.0.1 root[31353] <190>1 2020-03-09T11:41:52+00:00 127.0.0.1 root 31353 - - This is a Test 6 Mar 9 11:41:53 127.0.0.1 root[31404] <190>1 2020-03-09T11:41:53+00:00 127.0.0.1 root 31404 - - This is a Test 7 Mar 9 11:41:53 127.0.0.1 root[31448] <190>1 2020-03-09T11:41:53+00:00 127.0.0.1 root 31448 - - This is a Test 8 Mar 9 11:41:54 127.0.0.1 root[31449] <190>1 2020-03-09T11:41:54+00:00 127.0.0.1 root 31449 - - This is a Test 9 Mar 9 11:41:54 127.0.0.1 root[31468] <190>1 2020-03-09T11:41:54+00:00 127.0.0.1 root 31468 - - This is a Test 10 Mar 9 11:41:55 127.0.0.1 root[31485] <190>1 2020-03-09T11:41:55+00:00 127.0.0.1 root 31485 - - This is a Test 11 Mar 9 11:41:55 127.0.0.1 root[31526] <190>1 2020-03-09T11:41:55+00:00 127.0.0.1 root 31526 - - This is a Test 12 Mar 9 11:41:55 127.0.0.1 root[31567] <190>1 2020-03-09T11:41:55+00:00 127.0.0.1 root 31567 - - This is a Test 13 Can you help me? Thanks and regards, Alex On Mon, Jan 20, 2020 at 07:49 AM Attila Szakacs (aszakacs) < Attila.Szakacs(a)oneidentity.com> wrote: > Hi Alex, > > I think ${PRI} does exactly that. > > PRI > Description: The priority and facility encoded as a 2 or 3 digit decimal number as it is present in syslog messages. > > Regards, > Attila > ________________________________ > From: syslog-ng <syslog-ng-bounces at lists.balabit.hu <https://lists.balabit.hu/mailman/listinfo/syslog-ng>> on behalf of Alexandre Santos <alexandre.rosas.santos at gmail.com <https://lists.balabit.hu/mailman/listinfo/syslog-ng>> > Sent: Friday, January 17, 2020 7:56 PM > To: Syslog-ng users' and developers' mailing list <syslog-ng at lists.balabit.hu <https://lists.balabit.hu/mailman/listinfo/syslog-ng>> > Subject: [syslog-ng] facility override > > CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe. > > Hi, > > Is there a way of overriding the facility of the messages on the destination, besides using a template like: > { template("$(if ('${LEVEL_NUM}' == '2') '<186>1' $(if ('${LEVEL_NUM}' == '3') '<187>1' $(if ('${LEVEL_NUM}' == '4') '<188>1' ${HOST}\\@`HOSTIPV4` ${PROGRAM} ${PID} ${SDATA} ${MESSAGE}\n"); }; > > Thanks in advance, > Alex >

2 2

restart vs reload
by Alexandre Santos 09 Mar '20

09 Mar '20

Hi, I am trying to dynamically change the output message format between RFC3164 and RFC5424. root@localhost:~# diff /etc/syslog-ng/syslog-ng.conf /root/syslog-ng.conf.bak 365c365 < network("192.168.122.1" transport("udp") ip-protocol(4) port(514) --- > syslog("192.168.122.1" transport("udp") ip-protocol(4) port(514) If I use: "/usr/sbin/service syslog-ng restart" it works fine, but if I use "/usr/sbin/syslog-ng-ctl reload", the message format does not change. I am using syslog-ng version 3.19 Any thoughts? Thanks & Regards, Alex

2 1

my unofficial 3.26 RPM packages delayed
by Peter Czanik (pczanik) 05 Mar '20

05 Mar '20

Hi, Just a heads up. I'm traveling and at my current location wifi is too slow and unstable to do package building. Once I have a stable wifi I'll first build them in my syslog-ng-githead repositories and once everything builds (I have to disable Python support on SLES 12 as Python 3.4 is too old) I'll create the usual versioned repositories. So lets hope, that wifi will work better at my next hotel / conference and then I can prepare my usual openSUSE/SLES & Fedora/RHEL/CentOS packages. Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Not able to link syslog-ng libraries through gcc
by Nitish Saboo 05 Mar '20

05 Mar '20

Hi, I compiled syslog-ng-3.25.1 using the following code: tar -xvzf syslog-ng_3.25.1.tar.gz mkdir -p syslog-ng_3.25.1/build cd syslog-ng_3.25.1/build ../configure --prefix=/home/nsaboo/Desktop/Cproject/syslog/syslog-ng_3.25.1/install make make install Post installation,the folder structure looks like this: nsaboo@ubuntu:~/Desktop/Cproject/syslog/syslog-ng-3.25.1/install$ ls -lrt total 28 drwxrwxr-x 2 nsaboo nsaboo 4096 Feb 11 04:08 sbin drwxrwxr-x 2 nsaboo nsaboo 4096 Feb 11 04:08 bin drwxr-xr-x 2 nsaboo nsaboo 4096 Feb 11 04:08 var drwxr-xr-x 3 nsaboo nsaboo 4096 Feb 11 04:08 share drwxrwxr-x 4 nsaboo nsaboo 4096 Feb 11 04:08 include drwxr-xr-x 3 nsaboo nsaboo 4096 Feb 11 04:08 etc drwxrwxr-x 4 nsaboo nsaboo 4096 Feb 18 00:35 lib nsaboo@ubuntu:~/Desktop/Cproject/syslog/syslog-ng-3.25.1/install$ I have a C code base (syslog-node.c) and header file (node.h) that is internally calling syslog-ng patterndb apis': I have a main.c file that calls methods in 'syslog-node.c'. My header file has following methods: typedef void (*key_value_cb)(const char* key, const char* value, size_t value_len, int data); int initialize_engine(const char* filename, const char* module_path, key_value_cb cb); int reload_pattern_db(const char* filename, key_value_cb cb); int load_pattern_db(const char* filename, key_value_cb cb); void match(const char* pattern, size_t pattern_len, const char* program, size_t program_len); int shutdown(); I am calling following gcc command to create a binary but it is erroring out: gcc -L/home/nsaboo/Desktop/Cproject/syslog/syslog-ng-3.25.1/install/lib lsyslog-ng -L/home/nsaboo/Desktop/Cproject/syslog/syslog-ng-3.25.1/install/lib/syslog-ng ldbparser -I/usr/include/glib-2.0 -I/usr/lib/x86_64-linux-gnu/glib-2.0/include -I/home/nsaboo/Desktop/Cproject/syslog/syslog-ng-3.25.1/install/include/syslog-ng -I/home/nsaboo/Desktop/Cproject/syslog/syslog-ng-3.25.1/install/include -I/home/nsaboo/Desktop/Cproject/syslog/syslog-ng-3.25.1/ -I/home/nsaboo/Desktop/Cproject/syslog/syslog-ng-3.25.1/build/ -I/usr/local/include/eventlog/ syslog-node.c main.c -o main Error ===== nsaboo@ubuntu:~/Desktop/Cproject$ gcc -L/home/nsaboo/Desktop/Cproject/syslog/syslog-ng-3.25.1/install/lib -lsyslog-ng -L/home/nsaboo/Desktop/Cproject/syslog/syslog-ng-3.25.1/install/lib/syslog-ng -ldbparser -I/usr/include/glib-2.0 -I/usr/lib/x86_64-linux-gnu/glib-2.0/include -I/home/nsaboo/Desktop/Cproject/syslog/syslog-ng-3.25.1/install/include/syslog-ng -I/home/nsaboo/Desktop/Cproject/syslog/syslog-ng-3.25.1/install/include -I/home/nsaboo/Desktop/Cproject/syslog/syslog-ng-3.25.1/ -I/home/nsaboo/Desktop/Cproject/syslog/syslog-ng-3.25.1/build/ -I/usr/local/include/eventlog/ syslog-node.c main.c -o main /tmp/ccam1ao5.o: In function `pdbtool_pdb_emit_accumulate': syslog-node.c:(.text+0x55): undefined reference to `logmsg_registry' syslog-node.c:(.text+0x73): undefined reference to `nv_table_foreach' /tmp/ccam1ao5.o: In function `match': syslog-node.c:(.text+0x93): undefined reference to `log_msg_new_empty' syslog-node.c:(.text+0xb0): undefined reference to `log_msg_set_value' syslog-node.c:(.text+0xc9): undefined reference to `log_msg_set_value' syslog-node.c:(.text+0xdf): undefined reference to `pattern_db_process' syslog-node.c:(.text+0xeb): undefined reference to `log_msg_unref' /tmp/ccam1ao5.o: In function `reload_pattern_db': syslog-node.c:(.text+0x1e2): undefined reference to `pattern_db_free' syslog-node.c:(.text+0x1e7): undefined reference to `pattern_db_new' syslog-node.c:(.text+0x20b): undefined reference to `pattern_db_reload_ruleset' syslog-node.c:(.text+0x225): undefined reference to `pattern_db_set_emit_func' /tmp/ccam1ao5.o: In function `load_pattern_db': syslog-node.c:(.text+0x257): undefined reference to `pattern_db_free' syslog-node.c:(.text+0x25c): undefined reference to `pattern_db_new' syslog-node.c:(.text+0x280): undefined reference to `pattern_db_reload_ruleset' syslog-node.c:(.text+0x29a): undefined reference to `pattern_db_set_emit_func' /tmp/ccam1ao5.o: In function `initialize_engine': syslog-node.c:(.text+0x2ba): undefined reference to `app_startup' syslog-node.c:(.text+0x2c4): undefined reference to `msg_init' syslog-node.c:(.text+0x2cb): undefined reference to `resolvedConfigurablePaths' syslog-node.c:(.text+0x2d0): undefined reference to `resolved_configurable_paths_init' syslog-node.c:(.text+0x2db): undefined reference to `resolvedConfigurablePaths' syslog-node.c:(.text+0x2e5): undefined reference to `cfg_new' syslog-node.c:(.text+0x2fb): undefined reference to `cfg_set_global_paths' syslog-node.c:(.text+0x311): undefined reference to `cfg_load_module' syslog-node.c:(.text+0x327): undefined reference to `cfg_load_module' syslog-node.c:(.text+0x32c): undefined reference to `pattern_db_global_init' syslog-node.c:(.text+0x347): undefined reference to `pattern_db_free' syslog-node.c:(.text+0x34c): undefined reference to `pattern_db_new' syslog-node.c:(.text+0x370): undefined reference to `pattern_db_reload_ruleset' syslog-node.c:(.text+0x38a): undefined reference to `pattern_db_set_emit_func' /tmp/ccam1ao5.o: In function `shutdown': syslog-node.c:(.text+0x39a): undefined reference to `app_shutdown' collect2: error: ld returned 1 exit status Those functions are available in the shared libraries.nm command output shows the same nsaboo@ubuntu:~/Desktop/Cproject$ nm syslog/syslog-ng-3.25.1/install/lib/syslog-ng/libdbparser.so | grep T | grep 'pattern_db_set_emit_func' 0000000000010d40 T pattern_db_set_emit_func nsaboo@ubuntu:~/Desktop/Cproject$ nm syslog/syslog-ng-3.25.1/install/lib/syslog-ng/libdbparser.so | grep T | grep 'pattern_db_new' 0000000000010ef0 T pattern_db_new nsaboo@ubuntu:~/Desktop/Cproject$ nm syslog/syslog-ng-3.25.1/install/lib/syslog-ng/libdbparser.so | grep T | grep 'pattern_db_reload_ruleset' 0000000000010cc0 T pattern_db_reload_ruleset nsaboo@ubuntu:~/Desktop/Cproject$ nm syslog/syslog-ng-3.25.1/install/lib/libsyslog-ng.so.0 | grep T | grep 'log_msg_set_value' 0000000000080df0 T log_msg_set_value 00000000000811d0 T __log_msg_set_value_by_name 0000000000081220 T log_msg_set_value_indirect nsaboo@ubuntu:~/Desktop/Cproject$ nm syslog/syslog-ng-3.25.1/install/lib/libsyslog-ng.so | grep T | grep 'msg_init' 0000000000051990 T msg_init nsaboo@ubuntu:~/Desktop/Cproject$ nm syslog/syslog-ng-3.25.1/install/lib/libsyslog-ng.so | grep T | grep 'cfg_new' 0000000000039200 T cfg_new 0000000000039360 T cfg_new_snippet 0000000000039390 T cfg_new_subordinate I understand this is the C linking error where I am including all the dynamic shared libraries and header files, but not able to figure out what is causing this issue. Can someone please help me to determine what am I missing here ? Thanks, Nitish

1 1

syslog-ng 3.26 Debian/Ubuntu packages (OBS)
by Laszlo Budai 05 Mar '20

05 Mar '20

Hi, syslog-ng 3.26.1[1] packages are available in OBS repositories[2, 3]. List of supported OSs: * Debian 8.0 * Debian 9.0 * Debian 10.0 * Raspbian 9.0 * Raspbian 10.0 * Ubuntu 14.04 * Ubuntu 16.04 * Ubuntu 18.04 * Ubuntu 18.10 * Ubuntu 19.04 * Ubuntu 19.10 Install ------- example: Debian 9.0 1. get release key wget -qO - http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… | sudo apt-key add - 2. add repo to APT sources eg.: /etc/apt/sources.list.d/syslog-ng-obs.list deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… ./ Then `apt-get update` and `apt-get install syslog-ng-core` Links -------- [1] https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.26.1 [2] https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-… [3] https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-… regards, Laszlo Budai

1 0

syslog-ng-3.26.1
by Laszlo Budai 05 Mar '20

05 Mar '20

3.26.1 Highlights * file source: Added a new option to multi-line file sources: multi-line-timeout() After waiting multi-line-timeout() seconds without reading new data from the file, the last (potentially partial) message will be flushed and sent through the pipeline as a LogMessage. Since the multi-line file source detects the end of a message after finding the beginning of the subsequent message (indented or no-garbage/suffix mode), this option can be used to flush the last multi-line message in the file after a multi-line-timeout()-second timeout. There is no default value, i.e. this timeout needs to be explicitly configured. Example config: file("/some/folder/events" multi-line-mode("prefix-garbage") multi-line-prefix('^EVENT: ') multi-line-timeout(10) flags("no-parse") ); (#2963<https://github.com/syslog-ng/syslog-ng/pull/2963>) * python-http-header: Added this new plugin, which makes it possible for users to implement HTTP header plugins in Python language. It is built on top of signal-slot mechanism: currently HTTP module defines only one signal, that is signal_http_header_request and python-http-header plugin implements a python binding for this signal. This means that when the signal_http_header_request signal is emitted then the connected slot executes the Python code. The Python interface is: def get_headers(self, body, headers): It should return string List. The headers that will be appended to the request's header. When the plugin fails, http module won't try to send the http request without the header items by default. If you want http module to trying to send the request without these headers, just disable mark-errors-as-critical() function. Original code was written by Ferenc Sipos. Example config, click to expand! (#3123<https://github.com/syslog-ng/syslog-ng/pull/3123>) * azure-auth-header: Added this new plugin, which generates authorization header for applications connecting to Azure. It can be used as a building block in higher level SCLs. Implemented as a signal-slot plugin. Example config, click to expand! (#3078<https://github.com/syslog-ng/syslog-ng/pull/3078>) * python: From now on users can specify a persist name template from python code. @staticmethod def generate_persist_name(options): return options["file_name"] * Usage of this function is necessary, when one python destination is used multiple times in one config. * Persist name from config takes precedence over generate_persist_name. * Persist name is exposed through self.persist_name. (#3016<https://github.com/syslog-ng/syslog-ng/pull/3016>) Features * set-severity(): Added this new rewrite rule for changing message severity. It receives a template and sets message severity by evaluating the template. Numerical and textual severity levels are both supported. Examples: rewrite { set-severity("info"); set-severity("6"); set-severity("${.json.severity}"); }; (#3115<https://github.com/syslog-ng/syslog-ng/pull/3115>) * $(list-search): Added a new template function, which returns the first index of a pattern in a list. Starts the search at start_index. 0 based. If not found, returns empty string. Usage: $(list-search --mode MODE <pattern> ${list}) Where mode can be: literal (default), prefix, substring, glob, pcre. Add --start-index <index> to change the start index. (#2955<https://github.com/syslog-ng/syslog-ng/pull/2955>) * config version: Made the config version check of the configuration more liberal by accepting version numbers that had no changes relative to the current version. This means that if you are running 3.26 and the last semantic change in the configuration was 3.22, then anything between 3.22 and 3.26 (inclusive) is accepted by syslog-ng without a warning at startup. (#3074<https://github.com/syslog-ng/syslog-ng/pull/3074>) * $SEVERITY instead of $LEVEL: syslog-ng now follows the RFC3164 trend of using severity instead of level to refer to the severity of the message that is used in the template language ($SEVERITY), filter expressions (severity()) and so on. (#3128<https://github.com/syslog-ng/syslog-ng/pull/3128>) * http: Added ssl_version("tlsv1_3") and ssl_version("no-tlsv13") options to respectively force and disable TLSv1.3. (#3063<https://github.com/syslog-ng/syslog-ng/pull/3063>) * scl: Improved error message at init, when an scl is missing a dependency. (#3015<https://github.com/syslog-ng/syslog-ng/pull/3015>) * geoip2: Added template() option as an alias for the positional argument string, to match the grammar convention. (#3051<https://github.com/syslog-ng/syslog-ng/pull/3051>) * loggly: Added transport() option, so users can now use it with tls (or any network() supported transport). (#3149<https://github.com/syslog-ng/syslog-ng/pull/3149>) * config-option-database: Added support for parser, diskq and hook-commands blocks. (#3029<https://github.com/syslog-ng/syslog-ng/pull/3029>) Bugfixes * configure.ac: Fixed gethostbyname() function location detection (#3135<https://github.com/syslog-ng/syslog-ng/pull/3135>) * http: Fixed a crash, when workers() was set to 0. We do not allow nonnegative values anymore. (#3116<https://github.com/syslog-ng/syslog-ng/pull/3116>) * snmp-dest: engine-id() option now handles 5 to 32 characters, instead of the strict 10 before. (#3058<https://github.com/syslog-ng/syslog-ng/pull/3058>) * http: Fixed handling of ssl-version() option, which was ignored before. Prior this fix, these values of ssl-version in http destination were ignored by syslog-ng: tlsv1_0, tlsv1_1, tlsv1_2, tlsv1_3. (#3083<https://github.com/syslog-ng/syslog-ng/pull/3083>) * network sources: Added workaround for a TLS 1.3 bug to prevent data loss. Due to a bug in the OpenSSL TLS 1.3 implementation (openssl/openssl#10880<https://github.com/openssl/openssl/issues/10880>), it is possible to lose messages when one-way communication protocols are used, - such as the syslog protocol over TLS (RFC 5425<https://tools.ietf.org/html/rfc5425>, RFC 6587<https://tools.ietf.org/html/rfc6587>) - and the connection is closed by the client right after sending data. The bug is in the TLS 1.3 session ticket handling logic of OpenSSL. To prevent such data loss, we've disabled TLS 1.3 session tickets in all syslog-ng network sources. Tickets are used for session resumption, which is currently not supported by syslog-ng. The loggen testing tool also received some bugfixes (#3064<https://github.com/syslog-ng/syslog-ng/pull/3064>), which reduce the likelihood of data loss if the target of loggen has not turned off session tickets. If you're sending logs to third-party OpenSSL-based TLS 1.3 collectors, we recommend turning session tickets off in those applications as well until the OpenSSL bug is fixed. (#3082<https://github.com/syslog-ng/syslog-ng/pull/3082>) * cmake: Now we install loggen headers, as we do with autotools. (#3067<https://github.com/syslog-ng/syslog-ng/pull/3067>) * graylog2, format-gelf: Fixed sending empty message, when ${PID} is not set. Also added a default value "-" to empty short_message and host as they are mandatory fields. (#3112<https://github.com/syslog-ng/syslog-ng/pull/3112>) * loggen: fix dependency error with cmake + openssl from nonstandard location (#3062<https://github.com/syslog-ng/syslog-ng/pull/3062>) * config-option-database: Fixed reading 'grammar' and 'parser' files on 'POSIX' environment (#3125<https://github.com/syslog-ng/syslog-ng/pull/3125>) * file source: Fixed file source not able to process new message after log-msg-size() increase. (#3075<https://github.com/syslog-ng/syslog-ng/pull/3075>) * checkpoint parser: Fixed parsing ISO timestamp. (#3056<https://github.com/syslog-ng/syslog-ng/pull/3056>) * secret-storage: Fixed some cases, where diagnostical logs were truncated. (#3141<https://github.com/syslog-ng/syslog-ng/pull/3141>) * loggen, dqtool: Fixed a crash, when writing error/debug message or relocating qfile. (#3069<https://github.com/syslog-ng/syslog-ng/pull/3069>) * build: Fixed a compatibility related build error on Solaris 11. (#3070<https://github.com/syslog-ng/syslog-ng/pull/3070>) * loggen: Fixed address resolution when only loopback interface was configured. (#3048<https://github.com/syslog-ng/syslog-ng/pull/3048>) Packaging * scl: Moved scl files to the core package. (#2979<https://github.com/syslog-ng/syslog-ng/pull/2979>) * RHEL: Now we include the packaging/rhel/ folder in our release tarball. (#3071<https://github.com/syslog-ng/syslog-ng/pull/3071>) * RHEL 8 / CentOS 8: Added RHEL 8 / CentOS 8 support to syslog-ng.spec (#3034<https://github.com/syslog-ng/syslog-ng/pull/3034>) Notes to developers * signal-slot-connector: Introduced a generic event handler interface for syslog-ng modules. * The concept is simple: * There is a SignalSlotConnector which stores Signal - Slot connections * Signal : Slot = 1 : N, so multiple slots can be assigned to the same Signal. * When a Signal is emitted, the connected Slots are executed. * Signals are string literals and each module can define its own signals. * Interface/protocol between signals and slots: * A macro (SIGNAL) can be used for defining signals as string literals: SIGNAL(module_name, signal, signal_parameter_type) The parameter type is for expressing a kind of contract between signals and slots. * Usage: #define signal_cfg_reloaded SIGNAL(config, reloaded, GlobalConfig) the generated literal: "config::signal_reloaded(GlobalConfig *)" * emit passes the argument to the slots connected to the emitted signal. (#3043<https://github.com/syslog-ng/syslog-ng/pull/3043>) * http: Defined the Signal interface for HTTP - with one signal at this time. What's in the changeset? * List ADT (abstract data type for list implementations) added to lib. * Interface: * append * foreach * is_empty * remove_all * Implemented the List ADT in http module with struct curl_slist for storing the headers. * HTTP signal(s): * Currently only one signal is added, header_request. Note, that the license for http-signals.h is LGPL . (#3044<https://github.com/syslog-ng/syslog-ng/pull/3044>) * example-modules: Added example http slot plugin. This plugin is an example plugin that implements a slot for a HTTP signal (signal_http_header_request). When the plugin is attached, it CONNECT itself to the signal. When the signal is emitted by the http module, the slot is executed and append the header to the http headers. header is set in the config file. Example config, click to expand! (#3093<https://github.com/syslog-ng/syslog-ng/pull/3093>) * NEWS.md: From now on, for every PR that we want to include in the newsfile, we must create the news entry with the PR itself. See news/README.md. (#3066<https://github.com/syslog-ng/syslog-ng/pull/3066>) * snmp test in Light: Added snmp destination tests in the Light test framework. These tests requires snmptrapd as an external dependency. If you don't want to run this test, you can use the pytest's marker discovery feature: python -m pytest ... -m 'not snmp' The tests are run by syslog-ng's Travis workflow. (#3126<https://github.com/syslog-ng/syslog-ng/pull/3126>) * cmake: Added add_module function to cmake to normalize CMakeLists.txt files for modules. (#3106<https://github.com/syslog-ng/syslog-ng/pull/3106>) * dbld: Introduced syslog-ng-kira as a new CI image (#3125<https://github.com/syslog-ng/syslog-ng/pull/3125>) * FunctionalTests: Functional tests are now Python3 compatible (#3144<https://github.com/syslog-ng/syslog-ng/pull/3144>) * dbld: Added Ubuntu 19.10 and 20.04 (#3091<https://github.com/syslog-ng/syslog-ng/pull/3091>) * dbld: Added option to customize shell command. With this change, it is possible to override the option with rules.conf, while keeping the default behaviour. The simplest example: use existing images, start a new one if there is none. (use docker rm manually if you want to update) DOCKER_SHELL=$(DOCKER) inspect $* > /dev/null 2>&1; \ if [ $$? -eq 0 ]; then \ $(DOCKER) start -ia $*; \ else \ $(DOCKER) run $(DOCKER_RUN_ARGS) -ti --name $* balabit/syslog-ng-$* /source/dbld/shell; \ fi (#3038<https://github.com/syslog-ng/syslog-ng/pull/3038>) Other changes * python: Added --with-python3-home configure option to use a hard-coded PYTHONHOME for Python-based plugins. This can be useful when a Python interpreter is bundled with syslog-ng. Relocation is supported, for example: --with-python3-home='${exec_prefix}' (#3134<https://github.com/syslog-ng/syslog-ng/pull/3134>) * afmongodb: Removed the support of deprecated legacy configurations (#3092<https://github.com/syslog-ng/syslog-ng/pull/3092>) * http: use-system-cert-store() now autodetects the system provided cert-store (#3086<https://github.com/syslog-ng/syslog-ng/pull/3086>) * doc: Added manual page for persist-tool. (#3072<https://github.com/syslog-ng/syslog-ng/pull/3072>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Antal Nemes, Attila Szakacs, Balazs Scheidler, Dylan Perry, Gabor Nagy, Laszlo Budai, Laszlo Szemere, László Várady, Norbert Takacs, Peter Czanik, Péter Kókai, Romain Tartière, Tomáš Mózes.

1 0

Spurious path, logfile not created; path=
by Pal, Laszlo 04 Mar '20

04 Mar '20

Hi, For one of my hosts, I can see lots of these messages *Spurious path, logfile not created; path=* What does it mean exactly? I'm creating files with this macro file("/var/log/netlog/unix/${HOST}/${YEAR}/${MONTH}/${HOST}-${YEAR}${MONTH}${DAY}.log" and even for this host, I have all the logs regardless of this message I also have messages for the same host like this Resource temporarily unavailable (11) Here is some more details may help to find out the reasons behind this - issue started 9th February (I have a total of 160K entries like this) - the filename/path was incorrect during the whole event 2020/02/servername-20200210.log - on 29th the server gone south by consuming lots of CPU and disappeared from the network, console was frozen, so we had to reset the vm The host running an old syslog-ng PE (syslog-ng-premium-edition 4 LTS (4.0.5a) Installer-Version: 4.0.5a Revision: ssh+git://ganesa@git.balabit //var/scm/git/syslog-ng/syslog-ng-pe--mainline--4.0#master#457ec2f494a46d62ecf8cd938f12f02cd0ae9e63) on RHEL5 Log sources are simple plain text files contains tomcat and other web server logs I have a twin-host with the exact same config and log sources, but I never seen messages like this from that one Do you have any idea? To me it looks very mysterious Thanks Laszlo

4 5