- syslog-ng - lists.balabit.hu

Unofficial Debian(including Debian 10)/Ubuntu packages for syslog-ng 3.24.1
by Laszlo Budai 08 Oct '19

08 Oct '19

Hi, syslog-ng 3.24.1[1] packages are available in OBS repo[2, 3]. List of supported OSs: * Debian 8.0 * Debian 9.0 [including armv7l] * Raspbian 9.0 * Ubuntu 14.04 * Ubuntu 16.04 * Ubuntu 18.04 * Ubuntu 18.10 newly added distributions: * Rasbian 10 * Debian 10 (without java modules) * Ubuntu 19.04 (without java modules) Please note that newly added distributions are not tested yet. Any feedback are welcome. Install ------- example: Debian 9.0 1. get release key wget -qO - http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… | sudo apt-key add - 2. add repo to APT sources eg.: /etc/apt/sources.list.d/syslog-ng-obs.list deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… ./ Then `apt-get update` and `apt-get install syslog-ng-core` Links -------- [1] https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.24.1<https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.23.1> [2] https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-…<https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-…> [3] https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-… regards, Laszlo Budai

1 0

syslog-ng-3.24.1
by Laszlo Budai 08 Oct '19

08 Oct '19

3.24.1 Highlights * Add a new template function called $(format-flat-json), which generates flattened json output. This is useful for destinations, where the json parsing does not handle nested json format. (#2890<https://github.com/syslog-ng/syslog-ng/pull/2890>) * Add ISO 8601 compliant week numbering. Use it with the ${ISOWEEK} macro and and all its variants: S_ISOWEEK, R_ISOWEEK and C_ISOWEEK. (#2878<https://github.com/syslog-ng/syslog-ng/pull/2878>) * Add add-contextual-data() glob selector. It matches the message with shell style globbing. Enable it by setting selector(glob("$my_template") in the add-contextual-data() block. (#2936<https://github.com/syslog-ng/syslog-ng/pull/2936>) * Add new rewrite operations to manipulate the timezone portion of timestamps have been added. set-timezone() to set the timezone value to a specific value, fix-timezone() to fix up an incorrectly recognized timezone and guess-timezone() to automatically deduce the timezone value on the assumption that the message is received in near real time. (#2818<https://github.com/syslog-ng/syslog-ng/pull/2818>) * Send Server Name Identification (SNI) information with transport(tls). Enable it by setting the sni(yes) option in the tls block in your destination. (#2930<https://github.com/syslog-ng/syslog-ng/pull/2930>) Features * templates: change the $LOGHOST macro to honour use-fqdn() (#2894<https://github.com/syslog-ng/syslog-ng/pull/2894>) * Define syslog-ng-sysconfdir (#2932<https://github.com/syslog-ng/syslog-ng/pull/2932>) * dqtool: add assign dqfile to persist file feature (#2872<https://github.com/syslog-ng/syslog-ng/pull/2872>) Bugfixes * Fix backtick subsitution of defines/environment variables in the main configuration file. (#2906<https://github.com/syslog-ng/syslog-ng/issues/2906>, #2909<https://github.com/syslog-ng/syslog-ng/pull/2909>) * Fix SCL block parameter substitution of quoted escaped newline (#2901<https://github.com/syslog-ng/syslog-ng/pull/2901>) * python, diskq, random-generator source: crash after failed reload (#2907<https://github.com/syslog-ng/syslog-ng/pull/2907>) * Fix crash at shutdown on 32bit systems (#2893<https://github.com/syslog-ng/syslog-ng/issues/2893>, #2895<https://github.com/syslog-ng/syslog-ng/pull/2895>) * Invalidate the value of the LEGACY_MSGHDR macro in case either the PID or the PROGRAM macros are unset() using a rewrite rule. Previously LEGACY_MSGHDR would retain the old values. (#2896<https://github.com/syslog-ng/syslog-ng/pull/2896>) * on 32bit platform diskq ftruncate could fail due to size 32/64 interface (#2892<https://github.com/syslog-ng/syslog-ng/pull/2892>) * Support new tzdata format, starting from version 2009.XXX, in tzinfo parser. (#2898<https://github.com/syslog-ng/syslog-ng/pull/2898>) * udp, udp6, tcp, tcp6, syslog, network destination: Correctly detect and set IP_MULTICAST_TTL in case of multicast ip address (#2905<https://github.com/syslog-ng/syslog-ng/pull/2905>) * Fix hostname resolve on systems with only the loopback network interface configured (#2933<https://github.com/syslog-ng/syslog-ng/pull/2933>) * wildcard-file(): Add multi-line(), pad_size() and multi-line-mode() option validation. (#2922<https://github.com/syslog-ng/syslog-ng/pull/2922>) * kafka-c: Fix multiple memleaks (#2944<https://github.com/syslog-ng/syslog-ng/pull/2944>) Other changes * geoip: remove deprecated module, geoip2 database location detection (#2780<https://github.com/syslog-ng/syslog-ng/pull/2780>) * various refactor, build issue fixes (#2902<https://github.com/syslog-ng/syslog-ng/pull/2902>) Notes to the developers * LightRunWithStrace: Run syslog-ng behind strace (#2921<https://github.com/syslog-ng/syslog-ng/pull/2921>) * LightVerboseLogOnError: Increase default pytest verbosity on error (#2919<https://github.com/syslog-ng/syslog-ng/pull/2919>) * Dbld image caching (#2858<https://github.com/syslog-ng/syslog-ng/pull/2858>) * Dbld gradle caching (#2857<https://github.com/syslog-ng/syslog-ng/pull/2857>) * logreader,logsource: move scratch-buffer mark and reclaim into LogSource (#2903<https://github.com/syslog-ng/syslog-ng/pull/2903>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Antal Nemes, Attila Szakacs, Balazs Scheidler, Bertrand Jacquin, Gabor Nagy, Henrik Grindal Bakken, Kerin Millar, kjhee43, Laszlo Budai, Laszlo Szemere, László Várady, Péter Kókai, Raghunath Adhyapak, Zoltan Pallagi.

1 0

group-by() send all messages to destination() ?
by Jason Cooper 06 Oct '19

06 Oct '19

All, I have Cloudflare Workers sending log messages to my syslog-ng server. There is an intermediary step where nginx receives a POST with a JSON body containing all the messages for a given run (try{}catch(e){} ensures it sends the accumulated messages at the end of each run). Some Lua in the nginx server parses the JSON and separates the array of messages into individual writes to the unix domain socket syslog-ng is listening on. This whole setup is tested, and working great. I even get the stack trace (JS, not a core dump) when I screw up. :-) Now, I'd like to auto-fire an email on certain events. e.g. when .json.level == "CRIT" (script threw an error). The trick is, I'd like to dump *all* the log messages for the matching run (only a single line from a run might match) to the email / process destination. See the commented out alert_parser{}, below. The last message of every run (equivalent to a unique .json.rayid, which I treat as a process id) always starts with 'BAIL'. So I use that as a trigger. I've been using $searchengine[*] and not been able to figure out how to send /all/ of the messages in a group to aggregate(). I even dug into the source a bit and saw that I can reference messages by '@2' for the second message back. But I see no way to a) get the number of messages, b) loop through the messages, or c) reference all of them, e.g. '@*'. Has anyone solved this problem? tia, Jason. ----------->8--------------------------------------------------------- @version: 3.22 # common parser nginx-lua-parser { json-parser (prefix(".json.")); }; #parser alert_parser { # grouping-by( # key("${json.rayid}") # scope("process") # timeout(5) # having("CRIT") # trigger("BAIL") # aggregate( # value("MESSAGE" "\n\n") # inherit-mode("context") # ) # inject-mode("pass-through") # ); #}; # template nginx-lua-template "${.json.timestamp} ${.json.colo} ${.json.script}[${.json.rayid}]: ${.json.level} ${.json.message}\n"; source worker-src { unix-stream("/var/run/nginx-lua/worker.sock", group(nginx) flags(no-parse)); }; # development logs filter worker-dev-filter {match("-dev" value (".json.script"));}; destination worker-dev-dest { file("/var/log/worker/development.log" template(nginx-lua-template)); }; log { source(worker-src); parser(nginx-lua-parser); filter(worker-dev-filter); destination(worker-dev-dest); }; # production logs filter worker-prod-filter {match("-prod" value (".json.script"));}; destination worker-prod-dest { file("/var/log/worker/production.log" template(nginx-lua-template)); }; log { source(worker-src); parser(nginx-lua-parser); filter(worker-prod-filter); destination(worker-prod-dest); };

4 10

In-list problem
by László Pál 04 Oct '19

04 Oct '19

Hi, I have a strange (at least to me :) issue. In my new system I’m heavily using in-list in my filters to tell which logs should be forwarded. In my lists it is sometimes hostnames, sometimes programs sometimes source IP, but it is very erratic. What I think because I’m using it wrong. What exact pattern matching is used in this feature? Is this posix regex or simply glob? I have lines like this in my files 1.2..3.4 Host.domain.com ssh.* host.* The problem is, sometimes it is matches sometimes not…. So, my question is how to use it to work properly? Unfortunately the admin guide is quite poor around this subject Thanks Laszlo

1 1

Remove Part of message
by William Luiz Ribeiro Vasconcelos Da Silva 03 Oct '19

03 Oct '19

Good afternoon every one!, This is a example of message collected using syslo-ng: RELEASE: 100.80.93.85 -> 189.40.107.74:55200-55215 0x5d8f3e5a And I need remove from message this part: 0x5d8f3e5a. My question is, how I can remove it ? Because the message should be send to destination without this part. Thanks for your help! William Luiz Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada para recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteúdo. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto

2 1

Re: [syslog-ng] filter not working
by Lin, Victor 01 Oct '19

01 Oct '19

Dear all, I found my issue with syslog-ng.conf's filter. After I replaced "or" with "and". Filter start working Thank you! VL -----Original Message----- From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: 2019, September, 30 1:28 AM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 173, Issue 34 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. filter not working (Lin, Victor) 2. Re: filter not working (Attila Szakacs (aszakacs)) ---------------------------------------------------------------------- Message: 1 Date: Mon, 30 Sep 2019 01:19:35 +0000 From: "Lin, Victor" <victor.lin(a)rbc.com> To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] filter not working Message-ID: <9715f6b2792e4fbf919ab60ef8c5205a(a)SXSCMA01.fg.rbc.com> Content-Type: text/plain; charset="utf-8" Dear all, I don't want forwarding the syslog messages which contain the following to my local syslog, so I setup the filter like below ISDN-6-CONNECT ISDN-6-DISCONNECT changed by user However the messages contain the above are still show up in my local syslog file ForMe.log Below is from my syslog-ng.conf source s_network { network( transport("udp") port(514) flags(syslog_protocol) keep_hostname(yes) keep_timestamp(yes) use_dns(yes) use_fqdn(yes) ); }; destination d_ForMe_logs { file("/app/syslog-ng/custom/output/ForMe.log"); }; filter f_DoNotSendtoMe { not match("ISDN-6-CONNECT" value("MESSAGE")); or not match("ISDN-6-DISCONNECT" value("MESSAGE")); or not match("changed by user" value("MESSAGE")); }; log { source(s_network); filter(f_DoNotSendtoMe); destination(d_ForMe_logs); }; Do I missing any confing ? Thank you so much for your expertize! VL -----Original Message----- From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: 2019, September, 27 12:52 PM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 173, Issue 33 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: Enable SNI (Server Name Identification) in TLS connection (Raghunath Adhyapak) ---------------------------------------------------------------------- Message: 1 Date: Fri, 27 Sep 2019 22:22:14 +0530 From: Raghunath Adhyapak <funduraghu(a)gmail.com> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] Enable SNI (Server Name Identification) in TLS connection Message-ID: <CAEiok=Qrmw-s5r-ttRrQyQ+8CSq0BzdXgfzw+L0GhvR0_w-gUg(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" I built from source and tested and it worked fine I need Deb package to ease install on my machines. I can wait for some more time. Raghu On Fri, Sep 27, 2019, 12:35 Gabor Nagy (gnagy) <Gabor.Nagy(a)oneidentity.com> wrote: > If you would like to test before the upcoming release, you can create > a deb package with our docker based package scripts: > https://github.com/syslog-ng/syslog-ng/tree/master/dbld > > depending on your platform, it would be "dbld/rules deb" or > "dbld/rules deb-ubuntu-xenial" > > > Regards, > Gabor > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Thursday, September 26, 2019 15:30 > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Thanks. Now waiting for Debian package > > Raghu > > On Thu, Sep 26, 2019, 18:26 Attila Szakacs (aszakacs) < > Attila.Szakacs(a)oneidentity.com> wrote: > > Hi Raghu, > > It got merged to master! 🙂 > https://github.com/syslog-ng/syslog-ng/pull/2930 > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit > hub.com%2Fsyslog-ng%2Fsyslog-ng%2Fpull%2F2930&data=02%7C01%7Cgabor.nag > y%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e4 > 39c989c1867ec606603%7C0%7C0%7C637051014645449880&sdata=CYEi5latvJWnPQo > 7xYHa3klvdXiNVyXai5PhV51yVeI%3D&reserved=0> > > Best regards, > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Wednesday, September 18, 2019 5:35 PM > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > That's awesome. > > Thanks > Raghu > > On Wed, Sep 18, 2019, 17:05 Attila Szakacs (aszakacs) < > Attila.Szakacs(a)oneidentity.com> wrote: > > To the other question: It will be merged on the master branch probably > in a week. > > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Attila Szakacs (aszakacs) <Attila.Szakacs(a)oneidentity.com> > *Sent:* Wednesday, September 18, 2019 1:28 PM > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Hi Raghu, > > You are welcome! Thanks for the good idea. > If everything goes well, this feature will be released in version > 3.24, in > 3-4 weeks. > The packaging happens at the same time, you will find the 3.24 > installer at > https://download.opensuse.org/repositories/home:/laszlo_budai:/syslog- > ng/ > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdow > nload.opensuse.org%2Frepositories%2Fhome%3A%2Flaszlo_budai%3A%2Fsyslog > -ng%2F&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b0 > 7d408d74285c639%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014 > 645459869&sdata=krct3nD%2BVSMEQG00R0VJO2D1CeLqITAi8ZNTI7mV1a8%3D&reser > ved=0> > > Best regards, > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Wednesday, September 18, 2019 12:50 PM > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Hi Atilla, > > I updated the code, compiled it and tested the changes. > The changes works as expected. > Thanks for the addressing the issue in such a short time. > > Follow-up question: > When will this change get merged into the master branch? > Also, when will this get packaged in Debian package? > > Thanks > Raghu > > On Tue, Sep 17, 2019 at 4:27 PM Attila Szakacs (aszakacs) < > Attila.Szakacs(a)oneidentity.com> wrote: > > Hi Raghu, > > Currently we are not sending SNI extension in the Client Hello message. > However, I made a PR to implement this: > https://github.com/balabit/syslog-ng/pull/2930 > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit > hub.com%2Fbalabit%2Fsyslog-ng%2Fpull%2F2930&data=02%7C01%7Cgabor.nagy% > 40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439 > c989c1867ec606603%7C0%7C0%7C637051014645459869&sdata=IlcWEnngIqkJFPjWv > S7hrar4Tli4Kqgad5IdN7X5WVc%3D&reserved=0> > > Can you build syslog-ng from source? It would be great, if you tested > the PR. > > Best regards, > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Tuesday, September 17, 2019 9:05 AM > *To:* syslog-ng(a)lists.balabit.hu <syslog-ng(a)lists.balabit.hu> > *Subject:* [syslog-ng] Enable SNI (Server Name Identification) in TLS > connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Hi, > > I am using TLS over TCP connection to forward my syslog events to a > remote server. > My remote server uses SNI (Server Name Identification) to route > connections/events to one of the available backend servers. > > I observe that syslog-ng doesn't send SNI during TLS handshake. > > How can I enable it? > > My configuration is as follows: > > =================================== > source s_net { syslog(transport(udp) port(1514)); }; destination d_tcp > { > tcp( > "XX.example.net > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2FXX.e > xample.net&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf4 > 30b07d408d74285c639%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C63705 > 1014645469860&sdata=RTiMaNycpB56zTGx2gmqeFESNI2QO3JvOvSXUyC2MRk%3D&res > erved=0> > " > port(96) > tls( > peer-verify(required-untrusted) > ca_dir("/etc/syslog-ng/ssl") > > key-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.key.pem") > > cert-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.cert.pem") > ) > ); > }; > log { > source(s_net); > destination(d_tcp); > }; > =================================== > > I want syslog-ng to send XX.example.net > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2FXX.e > xample.net&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf4 > 30b07d408d74285c639%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C63705 > 1014645469860&sdata=RTiMaNycpB56zTGx2gmqeFESNI2QO3JvOvSXUyC2MRk%3D&res > erved=0> > as SNI to my remote server > > Please advise > > Thanks > Raghu > > ______________________________________________________________________ > ________ Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flis > ts.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cgabor.na > gy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e > 439c989c1867ec606603%7C0%7C0%7C637051014645479861&sdata=gHBU5J5tU99NDH > J4PwjtxlnS0jVp2Vxh%2BgAuiTsVKaE%3D&reserved=0> > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02 > %7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c63 > 9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014645479861&sdat > a=NmD0lHSiQw0DbM8voUKjVOFX2fSnDwhyqaZvA7%2BBmnA%3D&reserved=0> > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cgabor.nagy%40oneiden > tity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439c989c1867 > ec606603%7C0%7C0%7C637051014645489858&sdata=9VaEY4yqC3Y8y0gQZbVY6M0g%2 > F2rhXsfXRlw2%2Fwbik2s%3D&reserved=0> > > > ______________________________________________________________________ > ________ Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flis > ts.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cgabor.na > gy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e > 439c989c1867ec606603%7C0%7C0%7C637051014645489858&sdata=EWEYbbHYLIenlm > GBceeB%2B0pLauNIABFmT0dt6%2F77TUs%3D&reserved=0> > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02 > %7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c63 > 9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014645499850&sdat > a=mVlgDpNt3RVoHdr7ESi2Im89VnA0W7NOjkQbB11V3LM%3D&reserved=0> > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cgabor.nagy%40oneiden > tity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439c989c1867 > ec606603%7C0%7C0%7C637051014645499850&sdata=mNe53MBvTKfpkm1a%2FS6rEvCt > YPwO3Pfjca0jLyPNeqw%3D&reserved=0> > > > ______________________________________________________________________ > ________ Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flis > ts.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cgabor.na > gy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e > 439c989c1867ec606603%7C0%7C0%7C637051014645509849&sdata=YUrhyXSF6MkgRf > RsxlOWqsSBsedoNo8UPb292Y0vTps%3D&reserved=0> > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02 > %7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c63 > 9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014645509849&sdat > a=I2zhc1DPDcvLEShMr4v2V2MgtEZf72oDOvqx%2F607r%2BA%3D&reserved=0> > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cgabor.nagy%40oneiden > tity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439c989c1867 > ec606603%7C0%7C0%7C637051014645519834&sdata=eicWBDsPB4aguw98EKqegLs0ZB > NcHmbifbm8lEFeKF0%3D&reserved=0> > > > ______________________________________________________________________ > ________ Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190927/04aa6f04/a…> ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng ------------------------------ End of syslog-ng Digest, Vol 173, Issue 33 ****************************************** _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future. ------------------------------ Message: 2 Date: Mon, 30 Sep 2019 05:28:01 +0000 From: "Attila Szakacs (aszakacs)" <Attila.Szakacs(a)oneidentity.com> To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] filter not working Message-ID: <MN2PR19MB32298B32AD5C8D777E992FF59E820(a)MN2PR19MB3229.namprd19.prod.outlook.com> Content-Type: text/plain; charset="utf-8" Hi, I think your filter expression should have "and" instead of "or", like: filter f_DoNotSendtoMe { not match("ISDN-6-CONNECT" value("MESSAGE")); and not match("ISDN-6-DISCONNECT" value("MESSAGE")); and not match("changed by user" value("MESSAGE")); }; Just imagine: with "or" connections, when you receive a message with "ISDN-6-DISCONNECT", syslog-ng checks the first expression: not match("ISDN-6-CONNECT" value("MESSAGE")); It will be true, as it does not match with "ISDN-6-CONNECT", so the whole filter returns true. With "and" connections, we make sure, that none of the expressions match with the message. Best regards, Attila ________________________________ From: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of Lin, Victor <victor.lin(a)rbc.com> Sent: Monday, September 30, 2019 3:19 AM To: syslog-ng(a)lists.balabit.hu <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] filter not working CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe. Dear all, I don't want forwarding the syslog messages which contain the following to my local syslog, so I setup the filter like below ISDN-6-CONNECT ISDN-6-DISCONNECT changed by user However the messages contain the above are still show up in my local syslog file ForMe.log Below is from my syslog-ng.conf source s_network { network( transport("udp") port(514) flags(syslog_protocol) keep_hostname(yes) keep_timestamp(yes) use_dns(yes) use_fqdn(yes) ); }; destination d_ForMe_logs { file("/app/syslog-ng/custom/output/ForMe.log"); }; filter f_DoNotSendtoMe { not match("ISDN-6-CONNECT" value("MESSAGE")); or not match("ISDN-6-DISCONNECT" value("MESSAGE")); or not match("changed by user" value("MESSAGE")); }; log { source(s_network); filter(f_DoNotSendtoMe); destination(d_ForMe_logs); }; Do I missing any confing ? Thank you so much for your expertize! VL -----Original Message----- From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: 2019, September, 27 12:52 PM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 173, Issue 33 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.bal… or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: Enable SNI (Server Name Identification) in TLS connection (Raghunath Adhyapak) ---------------------------------------------------------------------- Message: 1 Date: Fri, 27 Sep 2019 22:22:14 +0530 From: Raghunath Adhyapak <funduraghu(a)gmail.com> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] Enable SNI (Server Name Identification) in TLS connection Message-ID: <CAEiok=Qrmw-s5r-ttRrQyQ+8CSq0BzdXgfzw+L0GhvR0_w-gUg(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" I built from source and tested and it worked fine I need Deb package to ease install on my machines. I can wait for some more time. Raghu On Fri, Sep 27, 2019, 12:35 Gabor Nagy (gnagy) <Gabor.Nagy(a)oneidentity.com> wrote: > If you would like to test before the upcoming release, you can create > a deb package with our docker based package scripts: > https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgith > ub.com%2Fsyslog-ng%2Fsyslog-ng%2Ftree%2Fmaster%2Fdbld&data=02%7C01 > %7Cattila.szakacs%40oneidentity.com%7Cb9e9365d670d40a9c18708d7454447a9 > %7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637054031891964192&s > data=KqQzgSFM9LZjrO8Yoe%2FInZ64tgMoydhB4REPmH7TEM8%3D&reserved=0 > > depending on your platform, it would be "dbld/rules deb" or > "dbld/rules deb-ubuntu-xenial" > > > Regards, > Gabor > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Thursday, September 26, 2019 15:30 > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Thanks. Now waiting for Debian package > > Raghu > > On Thu, Sep 26, 2019, 18:26 Attila Szakacs (aszakacs) < > Attila.Szakacs(a)oneidentity.com> wrote: > > Hi Raghu, > > It got merged to master! 🙂 > https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgith > ub.com%2Fsyslog-ng%2Fsyslog-ng%2Fpull%2F2930&data=02%7C01%7Cattila > .szakacs%40oneidentity.com%7Cb9e9365d670d40a9c18708d7454447a9%7C91c369 > b51c9e439c989c1867ec606603%7C0%7C0%7C637054031891964192&sdata=8vSu > SCX6t33xfYtXSKmsH2WIxkr6CXrKT0MnGnYVulw%3D&reserved=0 > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit > hub.com%2Fsyslog-ng%2Fsyslog-ng%2Fpull%2F2930&data=02%7C01%7Cgabor.nag > y%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e4 > 39c989c1867ec606603%7C0%7C0%7C637051014645449880&sdata=CYEi5latvJWnPQo > 7xYHa3klvdXiNVyXai5PhV51yVeI%3D&reserved=0> > > Best regards, > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Wednesday, September 18, 2019 5:35 PM > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > That's awesome. > > Thanks > Raghu > > On Wed, Sep 18, 2019, 17:05 Attila Szakacs (aszakacs) < > Attila.Szakacs(a)oneidentity.com> wrote: > > To the other question: It will be merged on the master branch probably > in a week. > > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Attila Szakacs (aszakacs) <Attila.Szakacs(a)oneidentity.com> > *Sent:* Wednesday, September 18, 2019 1:28 PM > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Hi Raghu, > > You are welcome! Thanks for the good idea. > If everything goes well, this feature will be released in version > 3.24, in > 3-4 weeks. > The packaging happens at the same time, you will find the 3.24 > installer at > https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdown > load.opensuse.org%2Frepositories%2Fhome%3A%2Flaszlo_budai%3A%2Fsyslog- > &data=02%7C01%7Cattila.szakacs%40oneidentity.com%7Cb9e9365d670d40a > 9c18708d7454447a9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C6370540 > 31891964192&sdata=hLf%2BXVakNoLjXSxORRVifqFgKK%2F84YvD564uAe1AErE% > 3D&reserved=0 > ng/ > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdow > nload.opensuse.org%2Frepositories%2Fhome%3A%2Flaszlo_budai%3A%2Fsyslog > -ng%2F&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b0 > 7d408d74285c639%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014 > 645459869&sdata=krct3nD%2BVSMEQG00R0VJO2D1CeLqITAi8ZNTI7mV1a8%3D&reser > ved=0> > > Best regards, > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Wednesday, September 18, 2019 12:50 PM > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Hi Atilla, > > I updated the code, compiled it and tested the changes. > The changes works as expected. > Thanks for the addressing the issue in such a short time. > > Follow-up question: > When will this change get merged into the master branch? > Also, when will this get packaged in Debian package? > > Thanks > Raghu > > On Tue, Sep 17, 2019 at 4:27 PM Attila Szakacs (aszakacs) < > Attila.Szakacs(a)oneidentity.com> wrote: > > Hi Raghu, > > Currently we are not sending SNI extension in the Client Hello message. > However, I made a PR to implement this: > https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgith > ub.com%2Fbalabit%2Fsyslog-ng%2Fpull%2F2930&data=02%7C01%7Cattila.s > zakacs%40oneidentity.com%7Cb9e9365d670d40a9c18708d7454447a9%7C91c369b5 > 1c9e439c989c1867ec606603%7C0%7C0%7C637054031891964192&sdata=cTMURG > BeAIsPwwGsBUmmsIwPDwJpDabqBkek6LlASEo%3D&reserved=0 > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit > hub.com%2Fbalabit%2Fsyslog-ng%2Fpull%2F2930&data=02%7C01%7Cgabor.nagy% > 40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439 > c989c1867ec606603%7C0%7C0%7C637051014645459869&sdata=IlcWEnngIqkJFPjWv > S7hrar4Tli4Kqgad5IdN7X5WVc%3D&reserved=0> > > Can you build syslog-ng from source? It would be great, if you tested > the PR. > > Best regards, > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Tuesday, September 17, 2019 9:05 AM > *To:* syslog-ng(a)lists.balabit.hu <syslog-ng(a)lists.balabit.hu> > *Subject:* [syslog-ng] Enable SNI (Server Name Identification) in TLS > connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Hi, > > I am using TLS over TCP connection to forward my syslog events to a > remote server. > My remote server uses SNI (Server Name Identification) to route > connections/events to one of the available backend servers. > > I observe that syslog-ng doesn't send SNI during TLS handshake. > > How can I enable it? > > My configuration is as follows: > > =================================== > source s_net { syslog(transport(udp) port(1514)); }; destination d_tcp > { > tcp( > "XX.example.net > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2FXX.e > xample.net&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf4 > 30b07d408d74285c639%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C63705 > 1014645469860&sdata=RTiMaNycpB56zTGx2gmqeFESNI2QO3JvOvSXUyC2MRk%3D&res > erved=0> > " > port(96) > tls( > peer-verify(required-untrusted) > ca_dir("/etc/syslog-ng/ssl") > > key-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.key.pem") > > cert-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.cert.pem") > ) > ); > }; > log { > source(s_net); > destination(d_tcp); > }; > =================================== > > I want syslog-ng to send XX.example.net > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2FXX.e > xample.net&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf4 > 30b07d408d74285c639%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C63705 > 1014645469860&sdata=RTiMaNycpB56zTGx2gmqeFESNI2QO3JvOvSXUyC2MRk%3D&res > erved=0> > as SNI to my remote server > > Please advise > > Thanks > Raghu > > ______________________________________________________________________ > ________ Member info: > https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flist > s.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cattil > a.szakacs%40oneidentity.com%7Cb9e9365d670d40a9c18708d7454447a9%7C91c36 > 9b51c9e439c989c1867ec606603%7C0%7C0%7C637054031891974190&sdata=t7d > 8IBFLJO9uUAMf4s%2BzfzYHgA3SBOR58DmTfnuxE1M%3D&reserved=0 > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flis > ts.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cgabor.na > gy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e > 439c989c1867ec606603%7C0%7C0%7C637051014645479861&sdata=gHBU5J5tU99NDH > J4PwjtxlnS0jVp2Vxh%2BgAuiTsVKaE%3D&reserved=0> > Documentation: > https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.b > alabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data > =02%7C01%7Cattila.szakacs%40oneidentity.com%7Cb9e9365d670d40a9c18708d7 > 454447a9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C6370540318919741 > 90&sdata=RsEoc2uH1DoInM3kgU6h710DWrWqLC5LwFe99F9wBro%3D&reserv > ed=0 > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02 > %7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c63 > 9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014645479861&sdat > a=NmD0lHSiQw0DbM8voUKjVOFX2fSnDwhyqaZvA7%2BBmnA%3D&reserved=0> > FAQ: > https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.b > alabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cattila.szakacs%40 > oneidentity.com%7Cb9e9365d670d40a9c18708d7454447a9%7C91c369b51c9e439c9 > 89c1867ec606603%7C0%7C0%7C637054031891974190&sdata=vExFemoXWyItsTk > VAxjJAlKpv4FODd8IFP2BktJpwio%3D&reserved=0 > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cgabor.nagy%40oneiden > tity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439c989c1867 > ec606603%7C0%7C0%7C637051014645489858&sdata=9VaEY4yqC3Y8y0gQZbVY6M0g%2 > F2rhXsfXRlw2%2Fwbik2s%3D&reserved=0> > > > ______________________________________________________________________ > ________ Member info: > https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flist > s.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cattil > a.szakacs%40oneidentity.com%7Cb9e9365d670d40a9c18708d7454447a9%7C91c36 > 9b51c9e439c989c1867ec606603%7C0%7C0%7C637054031891974190&sdata=t7d > 8IBFLJO9uUAMf4s%2BzfzYHgA3SBOR58DmTfnuxE1M%3D&reserved=0 > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flis > ts.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cgabor.na > gy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e > 439c989c1867ec606603%7C0%7C0%7C637051014645489858&sdata=EWEYbbHYLIenlm > GBceeB%2B0pLauNIABFmT0dt6%2F77TUs%3D&reserved=0> > Documentation: > https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.b > alabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data > =02%7C01%7Cattila.szakacs%40oneidentity.com%7Cb9e9365d670d40a9c18708d7 > 454447a9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C6370540318919741 > 90&sdata=RsEoc2uH1DoInM3kgU6h710DWrWqLC5LwFe99F9wBro%3D&reserv > ed=0 > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02 > %7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c63 > 9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014645499850&sdat > a=mVlgDpNt3RVoHdr7ESi2Im89VnA0W7NOjkQbB11V3LM%3D&reserved=0> > FAQ: > https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.b > alabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cattila.szakacs%40 > oneidentity.com%7Cb9e9365d670d40a9c18708d7454447a9%7C91c369b51c9e439c9 > 89c1867ec606603%7C0%7C0%7C637054031891974190&sdata=vExFemoXWyItsTk > VAxjJAlKpv4FODd8IFP2BktJpwio%3D&reserved=0 > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cgabor.nagy%40oneiden > tity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439c989c1867 > ec606603%7C0%7C0%7C637051014645499850&sdata=mNe53MBvTKfpkm1a%2FS6rEvCt > YPwO3Pfjca0jLyPNeqw%3D&reserved=0> > > > ______________________________________________________________________ > ________ Member info: > https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flist > s.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cattil > a.szakacs%40oneidentity.com%7Cb9e9365d670d40a9c18708d7454447a9%7C91c36 > 9b51c9e439c989c1867ec606603%7C0%7C0%7C637054031891974190&sdata=t7d > 8IBFLJO9uUAMf4s%2BzfzYHgA3SBOR58DmTfnuxE1M%3D&reserved=0 > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flis > ts.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cgabor.na > gy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e > 439c989c1867ec606603%7C0%7C0%7C637051014645509849&sdata=YUrhyXSF6MkgRf > RsxlOWqsSBsedoNo8UPb292Y0vTps%3D&reserved=0> > Documentation: > https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.b > alabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data > =02%7C01%7Cattila.szakacs%40oneidentity.com%7Cb9e9365d670d40a9c18708d7 > 454447a9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C6370540318919741 > 90&sdata=RsEoc2uH1DoInM3kgU6h710DWrWqLC5LwFe99F9wBro%3D&reserv > ed=0 > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02 > %7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c63 > 9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014645509849&sdat > a=I2zhc1DPDcvLEShMr4v2V2MgtEZf72oDOvqx%2F607r%2BA%3D&reserved=0> > FAQ: > https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.b > alabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cattila.szakacs%40 > oneidentity.com%7Cb9e9365d670d40a9c18708d7454447a9%7C91c369b51c9e439c9 > 89c1867ec606603%7C0%7C0%7C637054031891974190&sdata=vExFemoXWyItsTk > VAxjJAlKpv4FODd8IFP2BktJpwio%3D&reserved=0 > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cgabor.nagy%40oneiden > tity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439c989c1867 > ec606603%7C0%7C0%7C637051014645519834&sdata=eicWBDsPB4aguw98EKqegLs0ZB > NcHmbifbm8lEFeKF0%3D&reserved=0> > > > ______________________________________________________________________ > ________ Member info: > https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flist > s.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cattil > a.szakacs%40oneidentity.com%7Cb9e9365d670d40a9c18708d7454447a9%7C91c36 > 9b51c9e439c989c1867ec606603%7C0%7C0%7C637054031891974190&sdata=t7d > 8IBFLJO9uUAMf4s%2BzfzYHgA3SBOR58DmTfnuxE1M%3D&reserved=0 > Documentation: > https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.b > alabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data > =02%7C01%7Cattila.szakacs%40oneidentity.com%7Cb9e9365d670d40a9c18708d7 > 454447a9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C6370540318919741 > 90&sdata=RsEoc2uH1DoInM3kgU6h710DWrWqLC5LwFe99F9wBro%3D&reserv > ed=0 > FAQ: > https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.b > alabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cattila.szakacs%40 > oneidentity.com%7Cb9e9365d670d40a9c18708d7454447a9%7C91c369b51c9e439c9 > 89c1867ec606603%7C0%7C0%7C637054031891974190&sdata=vExFemoXWyItsTk > VAxjJAlKpv4FODd8IFP2BktJpwio%3D&reserved=0 > > -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.bala…> ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.bal… ------------------------------ End of syslog-ng Digest, Vol 173, Issue 33 ****************************************** _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future. ______________________________________________________________________________ Member info: https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.bal… Documentation: https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabi… FAQ: https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabi… -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190930/9b03bc99/a…> ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng ------------------------------ End of syslog-ng Digest, Vol 173, Issue 34 ****************************************** _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future.

1 0

filter not working
by Lin, Victor 30 Sep '19

30 Sep '19

Dear all, I don't want forwarding the syslog messages which contain the following to my local syslog, so I setup the filter like below ISDN-6-CONNECT ISDN-6-DISCONNECT changed by user However the messages contain the above are still show up in my local syslog file ForMe.log Below is from my syslog-ng.conf source s_network { network( transport("udp") port(514) flags(syslog_protocol) keep_hostname(yes) keep_timestamp(yes) use_dns(yes) use_fqdn(yes) ); }; destination d_ForMe_logs { file("/app/syslog-ng/custom/output/ForMe.log"); }; filter f_DoNotSendtoMe { not match("ISDN-6-CONNECT" value("MESSAGE")); or not match("ISDN-6-DISCONNECT" value("MESSAGE")); or not match("changed by user" value("MESSAGE")); }; log { source(s_network); filter(f_DoNotSendtoMe); destination(d_ForMe_logs); }; Do I missing any confing ? Thank you so much for your expertize! VL -----Original Message----- From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: 2019, September, 27 12:52 PM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 173, Issue 33 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: Enable SNI (Server Name Identification) in TLS connection (Raghunath Adhyapak) ---------------------------------------------------------------------- Message: 1 Date: Fri, 27 Sep 2019 22:22:14 +0530 From: Raghunath Adhyapak <funduraghu(a)gmail.com> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] Enable SNI (Server Name Identification) in TLS connection Message-ID: <CAEiok=Qrmw-s5r-ttRrQyQ+8CSq0BzdXgfzw+L0GhvR0_w-gUg(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" I built from source and tested and it worked fine I need Deb package to ease install on my machines. I can wait for some more time. Raghu On Fri, Sep 27, 2019, 12:35 Gabor Nagy (gnagy) <Gabor.Nagy(a)oneidentity.com> wrote: > If you would like to test before the upcoming release, you can create > a deb package with our docker based package scripts: > https://github.com/syslog-ng/syslog-ng/tree/master/dbld > > depending on your platform, it would be "dbld/rules deb" or > "dbld/rules deb-ubuntu-xenial" > > > Regards, > Gabor > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Thursday, September 26, 2019 15:30 > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Thanks. Now waiting for Debian package > > Raghu > > On Thu, Sep 26, 2019, 18:26 Attila Szakacs (aszakacs) < > Attila.Szakacs(a)oneidentity.com> wrote: > > Hi Raghu, > > It got merged to master! 🙂 > https://github.com/syslog-ng/syslog-ng/pull/2930 > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit > hub.com%2Fsyslog-ng%2Fsyslog-ng%2Fpull%2F2930&data=02%7C01%7Cgabor.nag > y%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e4 > 39c989c1867ec606603%7C0%7C0%7C637051014645449880&sdata=CYEi5latvJWnPQo > 7xYHa3klvdXiNVyXai5PhV51yVeI%3D&reserved=0> > > Best regards, > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Wednesday, September 18, 2019 5:35 PM > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > That's awesome. > > Thanks > Raghu > > On Wed, Sep 18, 2019, 17:05 Attila Szakacs (aszakacs) < > Attila.Szakacs(a)oneidentity.com> wrote: > > To the other question: It will be merged on the master branch probably > in a week. > > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Attila Szakacs (aszakacs) <Attila.Szakacs(a)oneidentity.com> > *Sent:* Wednesday, September 18, 2019 1:28 PM > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Hi Raghu, > > You are welcome! Thanks for the good idea. > If everything goes well, this feature will be released in version > 3.24, in > 3-4 weeks. > The packaging happens at the same time, you will find the 3.24 > installer at > https://download.opensuse.org/repositories/home:/laszlo_budai:/syslog- > ng/ > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdow > nload.opensuse.org%2Frepositories%2Fhome%3A%2Flaszlo_budai%3A%2Fsyslog > -ng%2F&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b0 > 7d408d74285c639%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014 > 645459869&sdata=krct3nD%2BVSMEQG00R0VJO2D1CeLqITAi8ZNTI7mV1a8%3D&reser > ved=0> > > Best regards, > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Wednesday, September 18, 2019 12:50 PM > *To:* Syslog-ng users' and developers' mailing list < > syslog-ng(a)lists.balabit.hu> > *Subject:* Re: [syslog-ng] Enable SNI (Server Name Identification) in > TLS connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Hi Atilla, > > I updated the code, compiled it and tested the changes. > The changes works as expected. > Thanks for the addressing the issue in such a short time. > > Follow-up question: > When will this change get merged into the master branch? > Also, when will this get packaged in Debian package? > > Thanks > Raghu > > On Tue, Sep 17, 2019 at 4:27 PM Attila Szakacs (aszakacs) < > Attila.Szakacs(a)oneidentity.com> wrote: > > Hi Raghu, > > Currently we are not sending SNI extension in the Client Hello message. > However, I made a PR to implement this: > https://github.com/balabit/syslog-ng/pull/2930 > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit > hub.com%2Fbalabit%2Fsyslog-ng%2Fpull%2F2930&data=02%7C01%7Cgabor.nagy% > 40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439 > c989c1867ec606603%7C0%7C0%7C637051014645459869&sdata=IlcWEnngIqkJFPjWv > S7hrar4Tli4Kqgad5IdN7X5WVc%3D&reserved=0> > > Can you build syslog-ng from source? It would be great, if you tested > the PR. > > Best regards, > Attila > ------------------------------ > *From:* syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of > Raghunath Adhyapak <funduraghu(a)gmail.com> > *Sent:* Tuesday, September 17, 2019 9:05 AM > *To:* syslog-ng(a)lists.balabit.hu <syslog-ng(a)lists.balabit.hu> > *Subject:* [syslog-ng] Enable SNI (Server Name Identification) in TLS > connection > > CAUTION: This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > Hi, > > I am using TLS over TCP connection to forward my syslog events to a > remote server. > My remote server uses SNI (Server Name Identification) to route > connections/events to one of the available backend servers. > > I observe that syslog-ng doesn't send SNI during TLS handshake. > > How can I enable it? > > My configuration is as follows: > > =================================== > source s_net { syslog(transport(udp) port(1514)); }; destination d_tcp > { > tcp( > "XX.example.net > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2FXX.e > xample.net&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf4 > 30b07d408d74285c639%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C63705 > 1014645469860&sdata=RTiMaNycpB56zTGx2gmqeFESNI2QO3JvOvSXUyC2MRk%3D&res > erved=0> > " > port(96) > tls( > peer-verify(required-untrusted) > ca_dir("/etc/syslog-ng/ssl") > > key-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.key.pem") > > cert-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.cert.pem") > ) > ); > }; > log { > source(s_net); > destination(d_tcp); > }; > =================================== > > I want syslog-ng to send XX.example.net > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2FXX.e > xample.net&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf4 > 30b07d408d74285c639%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C63705 > 1014645469860&sdata=RTiMaNycpB56zTGx2gmqeFESNI2QO3JvOvSXUyC2MRk%3D&res > erved=0> > as SNI to my remote server > > Please advise > > Thanks > Raghu > > ______________________________________________________________________ > ________ Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flis > ts.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cgabor.na > gy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e > 439c989c1867ec606603%7C0%7C0%7C637051014645479861&sdata=gHBU5J5tU99NDH > J4PwjtxlnS0jVp2Vxh%2BgAuiTsVKaE%3D&reserved=0> > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02 > %7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c63 > 9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014645479861&sdat > a=NmD0lHSiQw0DbM8voUKjVOFX2fSnDwhyqaZvA7%2BBmnA%3D&reserved=0> > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cgabor.nagy%40oneiden > tity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439c989c1867 > ec606603%7C0%7C0%7C637051014645489858&sdata=9VaEY4yqC3Y8y0gQZbVY6M0g%2 > F2rhXsfXRlw2%2Fwbik2s%3D&reserved=0> > > > ______________________________________________________________________ > ________ Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flis > ts.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cgabor.na > gy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e > 439c989c1867ec606603%7C0%7C0%7C637051014645489858&sdata=EWEYbbHYLIenlm > GBceeB%2B0pLauNIABFmT0dt6%2F77TUs%3D&reserved=0> > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02 > %7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c63 > 9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014645499850&sdat > a=mVlgDpNt3RVoHdr7ESi2Im89VnA0W7NOjkQbB11V3LM%3D&reserved=0> > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cgabor.nagy%40oneiden > tity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439c989c1867 > ec606603%7C0%7C0%7C637051014645499850&sdata=mNe53MBvTKfpkm1a%2FS6rEvCt > YPwO3Pfjca0jLyPNeqw%3D&reserved=0> > > > ______________________________________________________________________ > ________ Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flis > ts.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cgabor.na > gy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e > 439c989c1867ec606603%7C0%7C0%7C637051014645509849&sdata=YUrhyXSF6MkgRf > RsxlOWqsSBsedoNo8UPb292Y0vTps%3D&reserved=0> > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02 > %7C01%7Cgabor.nagy%40oneidentity.com%7Cfb559bbffddf430b07d408d74285c63 > 9%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637051014645509849&sdat > a=I2zhc1DPDcvLEShMr4v2V2MgtEZf72oDOvqx%2F607r%2BA%3D&reserved=0> > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cgabor.nagy%40oneiden > tity.com%7Cfb559bbffddf430b07d408d74285c639%7C91c369b51c9e439c989c1867 > ec606603%7C0%7C0%7C637051014645519834&sdata=eicWBDsPB4aguw98EKqegLs0ZB > NcHmbifbm8lEFeKF0%3D&reserved=0> > > > ______________________________________________________________________ > ________ Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190927/04aa6f04/a…> ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng ------------------------------ End of syslog-ng Digest, Vol 173, Issue 33 ****************************************** _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future.

2 1

Enable SNI (Server Name Identification) in TLS connection
by Raghunath Adhyapak 27 Sep '19

27 Sep '19

Hi, I am using TLS over TCP connection to forward my syslog events to a remote server. My remote server uses SNI (Server Name Identification) to route connections/events to one of the available backend servers. I observe that syslog-ng doesn't send SNI during TLS handshake. How can I enable it? My configuration is as follows: =================================== source s_net { syslog(transport(udp) port(1514)); }; destination d_tcp { tcp( "XX.example.net" port(96) tls( peer-verify(required-untrusted) ca_dir("/etc/syslog-ng/ssl") key-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.key.pem") cert-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.cert.pem") ) ); }; log { source(s_net); destination(d_tcp); }; =================================== I want syslog-ng to send XX.example.net as SNI to my remote server Please advise Thanks Raghu

3 9

Generate filename with part of message.
by William Luiz Ribeiro Vasconcelos Da Silva 26 Sep '19

26 Sep '19

Hello every one!, It's possible get part of the message obtained by syslog-ng to compose the file name. For example: The message: 2019-09-05;18:11:47;BLM0102-SP2[FWNAT]:ASP_NAT_PORT_BLOCK_ALLOC:;100.86.147.89;189.40.100.001:12800-12815 Expected filename: BLM0102-SP2_2019-09-05_18:11:47.syslog-ng How can I do to generate this nomenclature? Tks! Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada para recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteúdo. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto

2 1

OS Support Version for syslog-ng
by William Luiz Ribeiro Vasconcelos Da Silva 26 Sep '19

26 Sep '19

Hello Every one, Does SYSLOG-NG PE support RHEL version 7.7? Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada para recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteúdo. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto

1 0