- syslog-ng - lists.balabit.hu

Ticket Received - syslog-ng Digest, Vol 239, Issue 8
by Example 27 Mar '25

27 Mar '25

Dear Syslog-ng, We would like to acknowledge that we have received your request and a ticket has been created. A support representative will be reviewing your request and will send you a personal response.(usually within 24 hours). To view the status of the ticket or add comments, please visit https://teeraphanaotjantuek-help.freshdesk.com/helpdesk/tickets/3935 Thank you for your patience. Sincerely, Teeraphan Aotjantuek Support Team

1 0

Ticket Received - syslog-ng Digest, Vol 239, Issue 7
by Example 27 Mar '25

27 Mar '25

Dear Syslog-ng, We would like to acknowledge that we have received your request and a ticket has been created. A support representative will be reviewing your request and will send you a personal response.(usually within 24 hours). To view the status of the ticket or add comments, please visit https://teeraphanaotjantuek-help.freshdesk.com/helpdesk/tickets/3849 Thank you for your patience. Sincerely, Teeraphan Aotjantuek Support Team

1 0

Ticket Received - syslog-ng Digest, Vol 239, Issue 6
by Example 27 Mar '25

27 Mar '25

Dear Syslog-ng, We would like to acknowledge that we have received your request and a ticket has been created. A support representative will be reviewing your request and will send you a personal response.(usually within 24 hours). To view the status of the ticket or add comments, please visit https://teeraphanaotjantuek-help.freshdesk.com/helpdesk/tickets/3787 Thank you for your patience. Sincerely, Teeraphan Aotjantuek Support Team

1 0

Ticket Received - syslog-ng Digest, Vol 239, Issue 5
by Example 27 Mar '25

27 Mar '25

Dear Syslog-ng, We would like to acknowledge that we have received your request and a ticket has been created. A support representative will be reviewing your request and will send you a personal response.(usually within 24 hours). To view the status of the ticket or add comments, please visit https://teeraphanaotjantuek-help.freshdesk.com/helpdesk/tickets/3772 Thank you for your patience. Sincerely, Teeraphan Aotjantuek Support Team

1 0

Re: [syslog-ng] syslog-ng Digest, Vol 239, Issue 4
by Linn, William 27 Mar '25

27 Mar '25

Peter, The error I got was. warning: /tmp/syslog-ng-4.8.1-2.fc40.src.rpm: Header V4 RSA/SHA256 Signature, key ID bb1105ce: NOKEY I had downloaded it from the site, cannot remember exactly as it was done a couple of months ago preparing to upgrade the current version from 4.X. We are on RHEL 7 and upgrading the environment to RHEL 9. I do notice that the older version is.... syslog-ng-3.5.6-3.el7.x86_64.rpm and what I downloaded is syslog-ng-4.8.1-2.fc40.src.rpm maybe I have a source that needs compiled? Thanks William -----Original Message----- From: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: Thursday, March 27, 2025 8:00 AM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 239, Issue 4 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://urldefense.com/v3/__https://lists.balabit.hu/mailman/listinfo/syslo… or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. link (Linn, William) 2. Re: link (Peter Czanik (pczanik)) ---------------------------------------------------------------------- Message: 1 Date: Wed, 26 Mar 2025 12:06:03 +0000 From: "Linn, William" <wlinn(a)bofa.com> To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] link Message-ID: <e79007df7d2a4403b32d9f8b6a0c679a(a)bofa.com> Content-Type: text/plain; charset="us-ascii" I downloaded the RPM for RHEL 9 syslog-ng but getting a weird error. Can someone send the the link so I can make sure I have the right one? Thanks William ---------------------------------------------------------------------- This message, and any attachment(s), is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.bankofamerica.com/electronic-disclaimer. If you are not the intended recipient, please delete this message. For more information about how Bank of America protects your privacy, including specific rights that may apply, please visit the following pages: https://business.bofa.com/en-us/content/global-privacy-notices.html (which includes global privacy notices) and https://www.bankofamerica.com/security-center/privacy-overview/ (which includes US State specific privacy notices such as the http://www.bankofamerica.com/ccpa-notice)

3 4

link
by Linn, William 27 Mar '25

27 Mar '25

I downloaded the RPM for RHEL 9 syslog-ng but getting a weird error. Can someone send the the link so I can make sure I have the right one? Thanks William ---------------------------------------------------------------------- This message, and any attachment(s), is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.bankofamerica.com/electronic-disclaimer. If you are not the intended recipient, please delete this message. For more information about how Bank of America protects your privacy, including specific rights that may apply, please visit the following pages: https://business.bofa.com/en-us/content/global-privacy-notices.html (which includes global privacy notices) and https://www.bankofamerica.com/security-center/privacy-overview/ (which includes US State specific privacy notices such as the http://www.bankofamerica.com/ccpa-notice)

2 1

The syslog-ng Insider 2025-03: EPEL 10; Elasticsearch; Active Roles
by Peter Czanik (pczanik) 12 Mar '25

12 Mar '25

Dear syslog-ng users, This is the 129th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Test syslog-ng on EPEL 10! -------------------------- CentOS Stream 10 and EPEL 10 just became available, and as usual, I tried to build syslog-ng as soon as possible. For now it is available in my git snapshot repository, but I am also planning to make it available in EPEL 10 soon. https://www.syslog-ng.com/community/b/blog/posts/test-syslog-ng-on-epel-10 Collecting Active Roles logs centrally using the syslog-ng Windows Agent -------------------------------- One Identity Active Roles allows you to easily and securely manage Active Directory (AD), Entra ID and M365 Identity objects. While Active Roles stores its log messages into Windows Event Log, most log management and log analytics applications expect to receive log messages over the syslog protocol. This is where syslog-ng Premium Edition (PE) can help you. The syslog-ng Windows Agent can collect and forward Active Roles log messages from Windows Event Log, while the syslog-ng server can collect, process, store and forward Active Roles log messages to multiple destinations. https://www.syslog-ng.com/community/b/blog/posts/collecting-active-roles-lo… syslog-ng OSE 4.8.1 is now in EPEL 10, quick fix for Elasticsearch --------------------------------- This blog is just a quick announcement that syslog-ng 4.8.1 is now available in EPEL 10, so you do not have to use the testing repository anymore. Thanks everyone for the feedback! However, support for Elasticsearch 7+ is broken in this release, as some of you reported. You can fix this problem as described in https://github.com/syslog-ng/syslog-ng/issues/5207 by removing references to “type”. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-ose-4-8-1-is-now… WEBINARS * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

TCP orig_log_iw_size='3', why?
by claudio＠witel.it 02 Mar '25

02 Mar '25

Hello syslog-ng community, I get this warning at syslog-ng start (or restart) when running journalctl [...] Feb 27 02:46:57 xxxsplunksyslog1 syslog-ng[2998304]: [2025-02-27T02:46:57.330923] WARNING: window sizing for tcp sources were changed in syslog-ng 3.3, the configuration value was divided by the value of max-connections(). The result was too small, clamping to value of min_iw_size_per_reader. Ensure you have a proper log_fifo_size setting to avoid message loss.; orig_log_iw_size='3', new_log_iw_size='100', min_iw_size_per_reader='100', min_log_fifo_size='30000' Feb 27 02:46:57 xxxsplunksyslog1 systemd[1]: Started System Logger Daemon. I thought the orig_log_iw_size value was coming from the formula log_iw_size/max_connections which should be 100/300=1/3 What is this orig_log_iw_size='3' ? Thanks.

2 4

The syslog-ng Insider 2025-02: Prometheus; RHEL UBI; WSL
by Peter Czanik (pczanik) 19 Feb '25

19 Feb '25

Dear syslog-ng users, This is the 128th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Syslog-ng Prometheus exporter added to RPM syslog-ng container image ------------------------------------------------- Recently I introduced you to my latest project: a syslog-ng container based on Alma Linux. Now I also added a syslog-ng Prometheus exporter to the container, so you can monitor syslog-ng, if you enable it. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-prometheus-expor… Running syslog-ng PE in RHEL UBI -------------------------------- Recently I have posted a Dockerfile to run syslog-ng in an Alma Linux container. I got some encouraging feedback, so this week I experimented with syslog-ng Premium Edition (PE) in a RHEL UBI (Universal Base Image) container. While this is not officially supported by One Identity, we are really interested in your feedback. https://www.syslog-ng.com/community/b/blog/posts/running-syslog-ng-pe-in-rh… Running a syslog-ng server in WSL --------------------------------- Windows Subsystem for Linux (WSL) allows you to run Linux applications on a Windows host. While you can install and run syslog-ng on a default WSL installation, it is not really practical: there is no systemd and WSL is behind NAT. This blog gives you some pointers for working around these problems. https://www.syslog-ng.com/community/b/blog/posts/running-a-syslog-ng-server… WEBINARS * New webinar: “High Availability for syslog-ng Store Box”. You can register for it at https://www.syslog-ng.com/event/high-availability-for-syslog-ng-store-box-/ * You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

CRL handling in syslog
by Shankar Pramanik 18 Feb '25

18 Feb '25

I've configured syslog-ng 3.35.1 to use CRLs but things aren't working as expected. This is what I've done : 1. Create a self-signed CA and use it to sign a server certificate. The server certificate has a CRL distribution point in it. 2. Revoke the server certificate. Generate the revoked CRL and put it on the syslog client under /etc/syslog-ng/crl in PEM format. There's a <issuer hash>.r0 link to the CRL in this directory. 3. Configure ca-dir and crl-dir in the client's syslog config. Configure the client to connect to the remote syslog server. With this setup, I' d expect the syslog client to reject the server certificate since it's revoked, but that doesn't happen. The TLS handshake and subsequent communication is successful. Is there anything that I'm missing ? Any pointers will be appreciated. I can provide additional details of my setup if needed. Thanks! Shankar.

3 3