- syslog-ng - lists.balabit.hu

Elasticscearh-http dest wish list
by Russell Fulton 03 Sep '19

03 Sep '19

It would be really nice if nv pairs parsed as IP addresses got pushed to ES with a field mapping of IP rather than text and keyword. Russell(a)fulton.nz

3 5

syslog-ng: unofficial 3.23 Debian/Ubuntu packages
by Laszlo Budai 26 Aug '19

26 Aug '19

Hi, syslog-ng 3.23.1[1] packages are available in OBS repo[2]. List of supported OSs: * Debian 8.0 * Debian 9.0 [including armv7l] * Raspbian 9.0 * Ubuntu 14.04 * Ubuntu 16.04 * Ubuntu 18.04 * Ubuntu 18.10 Install ------- example: Debian 9.0 1. get release key wget -qO - http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… | sudo apt-key add - 2. add repo to APT sources eg.: /etc/apt/sources.list.d/syslog-ng-obs.list deb http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Deb… ./ Then `apt-get update` and `apt-get install syslog-ng-core` Links -------- [1] https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.23.1 [2] https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-… regards, Laszlo Budai [Twitter]<https://twitter.com/Budai_L> [LinkedIn] <https://www.linkedin.com/in/laszlo-budai-55243a3/> [Github] <https://github.com/lbudai>

1 0

syslog-ng-3.23
by Laszlo Budai 26 Aug '19

26 Aug '19

3.23.1 ====== ## Features * The `redis()` destination now handles any number of command parameters. (#2816) * The `format()` option of `date-parser()` supports lists. From now on, a single `date-parser()` instance is able to process different date formats, making it easy to catch on when some programs change the way they log information. (#2779) * Add relocation support for `disk-buffer()`. The `relocate` subcommand of `dqtool` can be used to move a single or multiple queue files. (#2855) * `file(), pipe()`: The `time-reap()` option now can be set or disabled for each destination separately. Use `time-reap(0)` to disable closing idle destination files. (#2798) * `syslog-ng-ctl`: Add `list-files` subcommand to print files present in the current configuration. (#2797) ## Bugfixes * Fix minor memory leaks (#2868) * Add global context to standalone parsers (#2876) * Fix heap usage after free in cfg_run_parser_with_main_context (#2884) * Fix g_thread_init call order issue with older glibs (#2853) * SNMP destination: fixing statistics format (#2854) * eventlog: flush escaped_buffer when full (#2837) * dbparser: remove unnecessary lock (#2838) * dbparser: fix crash when context times out in the middle of another rule (#2832) * radix: fix grouping in PCRE (#2808) * add-contextual-data: make filters config plugin aware (#2886) * Undefined warning regression (#2829) ## Other changes * Disable `time-reap()` on non-templated filenames by default (#2798) * The `--preprocess-into` command line flag accepts `-`, and writes the preprocessed configuration to stdout. (#2869) * Add information on environment variables passed to the confgen script (#2888) * Light: minor fixes (#2867, #2844) * python: use malloc_debug for python unit tests (#2866) * Travis: verbose unit test output (#2851) * Travis cleanup (#2809) * filter: add unit tests to `filter-op` (#2835) * Fix clang/gcc diagnostic differences (#2810) * Fix leak in stats test (#2874) * cmake, autotools: -Wundef to enable-extra-warning (#2806) ## Notes to the developers * Check whether commit messages are properly formatted (#2803, #2807) * gitignore: tags file and build directory (#2794) ## Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Antal Nemes, Attila Szakacs, Balazs Scheidler, Gabor Nagy, Laszlo Budai, Laszlo Szemere, László Várady, Mark Bonsack, Mehul Prajapati, Péter Kókai, Romain Tartière, Zoltan Pallagi. https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.23.1

1 0

IP WHITE LIST
by Onur GURSOY 21 Aug '19

21 Aug '19

Hello Guys, Nowadays, im finding whitelist method for IP. Is it possible ? How can i allow IP which is in whitelist ? So Many Thanks, My Best Regards. -- Onur GÜRSOY R&D Engineer in Embedded Systems Master Student at Gebze Institute Of Technology Department Of Electronic Engineering GSM : 0(545) 764 7653 e-mail: onurgursoygyte(a)gmail.com

2 1

Dynamic collection name in MongoDb
by PC LP 15 Aug '19

15 Aug '19

Hi, I am retrieving the value for *$M_ADDRESS* from the Syslog message using patterndb. $M_ADDRESS is a unique value. Based on that I have to create the collection in MongoDB dynamically. If I provide the value like below it is not recognizing collection("$M_ADDRESS") Is there any alternate way to create it? Please advise. Regards, PCLP.

2 1

if condition
by Alexey Vlasov 15 Aug '19

15 Aug '19

Hi, I would like to optimize my syslong-ng.conf file thus it could be used on some boxes without any changing. Now I have a few modifications of syslong-ng.conf on each server to copy logs to remote box. For example, group of hosts A* ============================== A1-machine (it is its hostname) has: destination clnt { udp("remote-box-a" port(514)); }; log { source(src); filter(f_messages); destination(clnt); }; ============================== ============================== A2-machine has: destination clnt { udp("remote-box-a" port(514)); }; log { source(src); filter(f_messages); destination(clnt); }; ============================== and group of hosts B* ============================== B1-machine has: destination clnt { udp("remote-box-b" port(514)); }; log { source(src); filter(f_messages); destination(clnt); }; ============================== ============================== B2-machine has: destination clnt { udp("remote-box-b" port(514)); }; log { source(src); filter(f_messages); destination(clnt); }; ============================== Is there possible to write something like that If (${HOSTNAME} ~ ^A) use remote-box-a If (${HOSTNAME} ~ ^B) use remote-box-b Thanks in advance!

2 1

3.22.1: understanding the location of the python's part
by Sergey 14 Aug '19

14 Aug '19

Hello I see that in 3.22 has changed the location of the python's part (relative 3.20): architecture independent files moved to architecture specific directory (lib64 on x86_64). For example, rhel spec 3.20 (syslog-ng-3.20.1/packaging/rhel/syslog-ng.spec) %files python /usr/lib/python2.7/site-packages/syslogng-1.0-py2.7.egg-info %dir /usr/lib/python2.7/site-packages/syslogng/ %dir /usr/lib/python2.7/site-packages/syslogng/debuggercli/ /usr/lib/python2.7/site-packages/syslogng/* /usr/lib/python2.7/site-packages/syslogng/debuggercli/* %{_libdir}/%{name}/libmod-python.so The same in 3.22 %files python %{_libdir}/%{name}/python/syslogng-1.0-py%{py_ver}.egg-info %{_libdir}/%{name}/python/syslogng/* %{_libdir}/%{name}/libmod-python.so Is the architecture specific file libmod-python.so only? Or am I missing something? -- Regards, Sergey

2 1

Parse message fields for use as columns in MySQL
by Allen Olivas 09 Aug '19

09 Aug '19

Hello, I'm really scratching my head trying to make this work and thought maybe the community has experienced this before. I'm collecting logs from Wazuh and Syslog-NG. Those logs are sent from my Wazuh server with Sylog-NG configured to send to my MySQL server. The Syslog-ng.conf file on the MySQL server is configured with a destination to mysql. In the declared the destination and list out columns and values. # MySQL define destination destination d_mysql { sql( type(mysql) username("syslog") password("xxxxxxx") database("syslog") host("127.0.0.1") table("logs") columns("host", "id", "location", "facility", "rule", "priority", "level", "tag", "datetime", "program", "msg") values("$HOST", "$ID", "$LOCATION","$FACILITY", "$RULE", "$PRIORITY", "$LEVEL", "$TAG","$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC","$PROGRAM", "$MSG") indexes("datetime", "host", "id", "location", "rule") ); }; So here's the problem. The Message data contains information like Rule and Location that really equate to the Wazuh Rule and Location = the Wazuh Agent that's reporting it. I had hoped "location" column would populate with the Location date from the message. Same with Rule. SO my question to the community is how on earth do I parse the data in the message field to populate columns (existing or new)? Any thoughts, guidance, recommendations are greatly appreciated. Thanks, Allen Olivas InfoDefense Office: (972) 848-7910 Email: allen.olivas(a)infodefense.com Toll Free: (877) INFODEFENSE www.infodefense.com<https://l.shatrk.com/r/e/DblvLSPvKY2IxMPE?r=https://app.salesforceiq.com/r?…>

2 5

Syslog-ng stops writing until restarted
by Faine, Mark R. (MSFC-IS40)[NICS] 07 Aug '19

07 Aug '19

I have a strange problem where logs are definitely coming in over tcp and udp however they are not written, well not until I restart the server. Whenever I restart the logs are written but shortly after starting they stop until the server is restarted again. Any ideas on where I can look? Thanks, -Mark

2 2

syslog-ng configuration from CLI
by SZIGETVÁRI János 06 Aug '19

06 Aug '19

Hello Team, A few years back I heard about a project that would have added functionality to syslog-ng that would have enabled configurability from the command line. This was the respective PR: https://github.com/balabit/syslog-ng/pull/1326 Since then the PR was closed and part of the functionality provided by the PR has been added to syslog-ng (in https://github.com/balabit/syslog-ng/pull/1605) but not the CLI configurability part. I personally think that being able to configure syslog-ng through its command line arguments would bear a great potential. Of course running it with a complex configuration passed in through CLI argument would be infeasible, but with simple, single-purpose logging setups it would prove to be a very powerful tool. For example when trying to empty a bunch of orphaned disk queue files, it would be very easy to spin up several syslog-ng instances from a script with only slightly differing configuration. What do you guys think? Do you agree as well that this feature would bear a lot of added value to syslog-ng? Thanks for sharing your opinions! Best Regards, János Szigetvári -- Janos SZIGETVARI RHCE, License no. 150-053-692 <https://www.redhat.com/rhtapps/verify/?certId=150-053-692> LinkedIn: linkedin.com/in/janosszigetvari __@__˚V˚ Make the switch to open (source) applications, protocols, formats now: - windows -> Linux, iexplore -> Firefox, msoffice -> LibreOffice - msn -> jabber protocol (Pidgin, Google Talk) - mp3 -> ogg, wmv -> ogg, jpg -> png, doc/xls/ppt -> odt/ods/odp

3 3