- syslog-ng - lists.balabit.hu

How to enable log file generation by row size or Megabytes?
by William Luiz Ribeiro Vasconcelos Da Silva 09 Sep '19

09 Sep '19

Good afternoon everyone! Which parameters should be enabled in the "syslog-ng.conf" file, because I want the captured log files to be a maximum of 5Mb in size or 1500 lines. Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada para recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteúdo. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto

2 1

sub-second time digits all 0
by John Chang 09 Sep '19

09 Sep '19

Hello, I am not getting non-zero sub-second timestamp digits. My /etc/syslog-ng/syslog-ng.conf file includes this global configuration: # First, set some global options. options { frac-digits(3); chain_hostnames(off); flush_lines(0); use_dns(no); use_fqdn(no); owner("root"); group("adm"); perm(0640); stats_freq(0); bad_hostname("^gconfd$"); }; My syslog-ng.conf also includes a sub-config file for sending the logs to a remote host, with this configuration: destination d_net { udp("loggerhost" port(30515) frac-digits(3) ); }; log { source(s_src); destination(d_net); }; But all sub-second timestamp digits wind up being only zeroes on the remote "loggerhost", like this: 2019-09-03T21:57:23.000+00:00 10.73.254.255 [info] [sshd] 3284 Accepted password for root from 10.72.0.186 port 50720 ssh2 The sending host is running syslog-ng 3.5.3. The receiving "loggerhost" is running 3.5.6 Thanks in advance for any help you can afford.

2 3

How to parser the message obtained from syslog-ng?
by William Luiz Ribeiro Vasconcelos Da Silva 06 Sep '19

06 Sep '19

Hello every one! The Syslog-ng is writing the log with the layout below: Jun 7 11:54:23 2019 vXXXXX01-node1 RT_XXT: RT_SRC_XXT_PBA_ALLOC: Subscriber 100.64.0.2 But the system that will do the treatment expects to receive the log in the following layout: Jun 7;11:54:23;2019;vxxxxx01-node1;RT_xxT: RT_SRC_NAT_PBA_ALLOC:;Subscriber 100.64.0.2; What setting can I do to be able to do the requested? The expected result is as follows: Current: Jun 7 11:54:23 2019 vXXXXX01-node1 RT_XXT: RT_SRC_XXT_PBA_ALLOC: Subscriber 100.64.0.2 Changed: Jun 7;11:54:23;2019;vxxxxx01-node1;RT_xxT: RT_SRC_NAT_PBA_ALLOC:;Subscriber 100.64.0.2; Tks for the help! Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada para recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor nos informe respondendo imediatamente a este e-mail e delete o seu conteúdo. This message, including its attachments, may contain privileged or confidential information, and it must not be fowarded without the express authorization of the sender. If you are not the intended recipient, we hereby inform you that the use, disclosure, copy or filing are forbidden. So, if you received this message as a mistake, please inform us by answering this e-mail and deleting its contents Questo messaggio, inclusi gli allegati, potrebbe contenere informazioni privilegiate e/o riservate, e non deve essere ritrasmesse senza l'autorizzazione del mittente. Se non siete il destinatario o la persona autorizzata a riceverlo, informiamo che il suo utilizzo, diffusione, copia o archiviazione sono proibite. Quindi, se avete ricevuto questo messaggio per errore, per cortesia ci informi rispondendo immediatamente a questa email e cancelli il suo contenuto

2 1

Regular expressions in rewrite
by Faine, Mark R. (MSFC-IS40)[NICS] 06 Sep '19

06 Sep '19

Is there a way to use regular expressions when setting a value in a rewrite rule? Something like: rewrite r_rewrite_set_host{ subst("^[a-z]+\-([a-z]+).*$", "$1", value("HOST")); set("HOST" value("location") condition( filter(f_filter_hostnames) ) ); }; But without changing the actual log message. The goal is to create a variable from a regular expression of the host field in the message that I can then use in a destination path. Thanks, -Mark Mark Faine System Administrator SAIC/NICS 215 Wynn Dr. 5065 Huntsville, AL 35805 256-961-1295 (Desk) 256-617-4861 (Work Cell)

4 4

Handling lists in syslog-ng: the in-list() filter
by Peter Czanik (pczanik) 05 Sep '19

05 Sep '19

Hi, Recently, a number of quite complex configurations came up here and on github issues. As it turned out, these configurations could be significantly simplified using the in-list() filter, one of syslog-ng’s lesser known features. So, if you have a long list of filters in your configuration containing IP addresses, host names, and so on, you should consider using the in-list() filter. Check out my latest blog about its advantages: https://www.syslog-ng.com/community/b/blog/posts/handling-lists-in-syslog-n… Bye, Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Elasticscearh-http dest wish list
by Russell Fulton 03 Sep '19

03 Sep '19

It would be really nice if nv pairs parsed as IP addresses got pushed to ES with a field mapping of IP rather than text and keyword. Russell(a)fulton.nz

3 5

syslog-ng: unofficial 3.23 Debian/Ubuntu packages
by Laszlo Budai 26 Aug '19

26 Aug '19

Hi, syslog-ng 3.23.1[1] packages are available in OBS repo[2]. List of supported OSs: * Debian 8.0 * Debian 9.0 [including armv7l] * Raspbian 9.0 * Ubuntu 14.04 * Ubuntu 16.04 * Ubuntu 18.04 * Ubuntu 18.10 Install ------- example: Debian 9.0 1. get release key wget -qO - http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… | sudo apt-key add - 2. add repo to APT sources eg.: /etc/apt/sources.list.d/syslog-ng-obs.list deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… ./ Then `apt-get update` and `apt-get install syslog-ng-core` Links -------- [1] https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.23.1 [2] https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-… regards, Laszlo Budai [Twitter]<https://twitter.com/Budai_L> [LinkedIn] <https://www.linkedin.com/in/laszlo-budai-55243a3/> [Github] <https://github.com/lbudai>

1 0

syslog-ng-3.23
by Laszlo Budai 26 Aug '19

26 Aug '19

3.23.1 ====== ## Features * The `redis()` destination now handles any number of command parameters. (#2816) * The `format()` option of `date-parser()` supports lists. From now on, a single `date-parser()` instance is able to process different date formats, making it easy to catch on when some programs change the way they log information. (#2779) * Add relocation support for `disk-buffer()`. The `relocate` subcommand of `dqtool` can be used to move a single or multiple queue files. (#2855) * `file(), pipe()`: The `time-reap()` option now can be set or disabled for each destination separately. Use `time-reap(0)` to disable closing idle destination files. (#2798) * `syslog-ng-ctl`: Add `list-files` subcommand to print files present in the current configuration. (#2797) ## Bugfixes * Fix minor memory leaks (#2868) * Add global context to standalone parsers (#2876) * Fix heap usage after free in cfg_run_parser_with_main_context (#2884) * Fix g_thread_init call order issue with older glibs (#2853) * SNMP destination: fixing statistics format (#2854) * eventlog: flush escaped_buffer when full (#2837) * dbparser: remove unnecessary lock (#2838) * dbparser: fix crash when context times out in the middle of another rule (#2832) * radix: fix grouping in PCRE (#2808) * add-contextual-data: make filters config plugin aware (#2886) * Undefined warning regression (#2829) ## Other changes * Disable `time-reap()` on non-templated filenames by default (#2798) * The `--preprocess-into` command line flag accepts `-`, and writes the preprocessed configuration to stdout. (#2869) * Add information on environment variables passed to the confgen script (#2888) * Light: minor fixes (#2867, #2844) * python: use malloc_debug for python unit tests (#2866) * Travis: verbose unit test output (#2851) * Travis cleanup (#2809) * filter: add unit tests to `filter-op` (#2835) * Fix clang/gcc diagnostic differences (#2810) * Fix leak in stats test (#2874) * cmake, autotools: -Wundef to enable-extra-warning (#2806) ## Notes to the developers * Check whether commit messages are properly formatted (#2803, #2807) * gitignore: tags file and build directory (#2794) ## Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Antal Nemes, Attila Szakacs, Balazs Scheidler, Gabor Nagy, Laszlo Budai, Laszlo Szemere, László Várady, Mark Bonsack, Mehul Prajapati, Péter Kókai, Romain Tartière, Zoltan Pallagi. https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.23.1

1 0

IP WHITE LIST
by Onur GURSOY 21 Aug '19

21 Aug '19

Hello Guys, Nowadays, im finding whitelist method for IP. Is it possible ? How can i allow IP which is in whitelist ? So Many Thanks, My Best Regards. -- Onur GÜRSOY R&D Engineer in Embedded Systems Master Student at Gebze Institute Of Technology Department Of Electronic Engineering GSM : 0(545) 764 7653 e-mail: onurgursoygyte(a)gmail.com

2 1

Dynamic collection name in MongoDb
by PC LP 15 Aug '19

15 Aug '19

Hi, I am retrieving the value for *$M_ADDRESS* from the Syslog message using patterndb. $M_ADDRESS is a unique value. Based on that I have to create the collection in MongoDB dynamically. If I provide the value like below it is not recognizing collection("$M_ADDRESS") Is there any alternate way to create it? Please advise. Regards, PCLP.

2 1