- syslog-ng - lists.balabit.hu

Re: [syslog-ng] syslog-ng Digest, Vol 169, Issue 1
by Simon Tyler 02 May '19

02 May '19

Hi Kohan, It appears that modules are not loading? [root@ip-10-8-41-60 syslog-ng]# syslog-ng -V syslog-ng 3.2.5 Installer-Version: 3.2.5 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#9d4bea28198bd731df1a61e980a2af5b88d81116 Compile-Date: Jul 25 2014 15:20:50 Enable-Threads: on Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-SSL: off Enable-SQL: on Enable-Linux-Caps: off Enable-Pcre: on Enable-Pacct: off ------------------------------------------------------------- I tried putting full path to modules.conf in scl.conf: [root@ip-10-8-41-60 syslog-ng]# cat scl.conf ############################################################################# # Copyright (c) 2010 BalaBit IT Ltd, Budapest, Hungary # # This program is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License version 2 as published # by the Free Software Foundation, or (at your option) any later version. # # As an additional exemption you are allowed to compile & link against the # OpenSSL libraries as published by the OpenSSL project. See the file # COPYING for details. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA # ############################################################################# # # This file is placed into /etc/syslog-ng in order to make it trivial to # include in user written syslog-ng.conf files. It sets up 'scl-root' and # `include-path`, then includes all SCL supplied plugins. # @define scl-root "`syslog-ng-data`/include/scl" @define include-path "`include-path`:`syslog-ng-data`/include" #@include 'modules.conf' @include '/etc/syslog-ng/modules.conf' @include 'scl/system/plugin.conf' @include 'scl/pacct/plugin.conf' @include 'scl/syslogconf/plugin.conf' --------------------------------------------------- Debug it seems to be trying to open modules, and it knows where they live: [root@ip-10-8-41-60 syslog-ng]# syslog-ng --debug Trying to open module; module='syslogformat', filename='/lib64/syslog-ng/libsyslogformat.so' Trying to open module; module='basicfuncs', filename='/lib64/syslog-ng/libbasicfuncs.so' Trying to open module; module='afsocket', filename='/lib64/syslog-ng/libafsocket.so' Trying to open module; module='affile', filename='/lib64/syslog-ng/libaffile.so' Trying to open module; module='afprog', filename='/lib64/syslog-ng/libafprog.so' Trying to open module; module='afuser', filename='/lib64/syslog-ng/libafuser.so' Trying to open module; module='dbparser', filename='/lib64/syslog-ng/libdbparser.so' Trying to open module; module='csvparser', filename='/lib64/syslog-ng/libcsvparser.so' Trying to open module; module='afsql', filename='/lib64/syslog-ng/libafsql.so' Starting to read include file; filename='/etc/syslog-ng/scl.conf', depth='1' Global value changed; define='scl-root', value='/usr/share/syslog-ng/include/scl' Global value changed; define='include-path', value='/etc/syslog-ng:/usr/share/syslog-ng/include' Starting to read include file; filename='/etc/syslog-ng/modules.conf', depth='2' Global value changed; define='autoload-compiled-modules', value='0' Trying to open module; module='syslogformat', filename='/lib64/syslog-ng/libsyslogformat.so' Attempted to register the same plugin multiple times, ignoring; context='format', name='syslog' Trying to open module; module='basicfuncs', filename='/lib64/syslog-ng/libbasicfuncs.so' Attempted to register the same plugin multiple times, ignoring; context='template-func', name='echo' Attempted to register the same plugin multiple times, ignoring; context='template-func', name='grep' Attempted to register the same plugin multiple times, ignoring; context='template-func', name='if' Trying to open module; module='afsocket', filename='/lib64/syslog-ng/libafsocket.so' Attempted to register the same plugin multiple times, ignoring; context='source', name='unix-stream' Attempted to register the same plugin multiple times, ignoring; context='destination', name='unix-stream' Attempted to register the same plugin multiple times, ignoring; context='source', name='unix-dgram' Attempted to register the same plugin multiple times, ignoring; context='destination', name='unix-dgram' Attempted to register the same plugin multiple times, ignoring; context='source', name='tcp' Attempted to register the same plugin multiple times, ignoring; context='destination', name='tcp' Attempted to register the same plugin multiple times, ignoring; context='source', name='tcp6' Attempted to register the same plugin multiple times, ignoring; context='destination', name='tcp6' Attempted to register the same plugin multiple times, ignoring; context='source', name='udp' Attempted to register the same plugin multiple times, ignoring; context='destination', name='udp' Attempted to register the same plugin multiple times, ignoring; context='source', name='udp6' Attempted to register the same plugin multiple times, ignoring; context='destination', name='udp6' Attempted to register the same plugin multiple times, ignoring; context='source', name='syslog' Attempted to register the same plugin multiple times, ignoring; context='destination', name='syslog' Trying to open module; module='affile', filename='/lib64/syslog-ng/libaffile.so' Attempted to register the same plugin multiple times, ignoring; context='source', name='file' Attempted to register the same plugin multiple times, ignoring; context='source', name='pipe' Attempted to register the same plugin multiple times, ignoring; context='destination', name='file' Attempted to register the same plugin multiple times, ignoring; context='destination', name='pipe' Trying to open module; module='afprog', filename='/lib64/syslog-ng/libafprog.so' Attempted to register the same plugin multiple times, ignoring; context='source', name='program' Attempted to register the same plugin multiple times, ignoring; context='destination', name='program' Trying to open module; module='afuser', filename='/lib64/syslog-ng/libafuser.so' Attempted to register the same plugin multiple times, ignoring; context='destination', name='usertty' Trying to open module; module='dbparser', filename='/lib64/syslog-ng/libdbparser.so' Attempted to register the same plugin multiple times, ignoring; context='parser', name='db-parser' Trying to open module; module='csvparser', filename='/lib64/syslog-ng/libcsvparser.so' Attempted to register the same plugin multiple times, ignoring; context='parser', name='csv-parser' Finishing include; filename='/etc/syslog-ng/modules.conf', depth='2' Starting to read include file; filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', depth='2' Trying to open module; module='confgen', filename='/lib64/syslog-ng/libconfgen.so' Finishing include; filename='/usr/share/syslog-ng/include/scl/system/plugin.conf', depth='2' Starting to read include file; filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', depth='2' Finishing include; filename='/usr/share/syslog-ng/include/scl/pacct/plugin.conf', depth='2' Starting to read include file; filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf', depth='2' Trying to open module; module='confgen', filename='/lib64/syslog-ng/libconfgen.so' Finishing include; filename='/usr/share/syslog-ng/include/scl/syslogconf/plugin.conf', depth='2' Finishing include; filename='/etc/syslog-ng/scl.conf', depth='1' Error parsing source, source plugin network not found in /etc/syslog-ng/syslog-ng.conf at line 85, column 2: network( ^^^^^^^ --------------------------------------------------------------- It is not clear to me what the name is for network module; here are the modules in the file system: [root@ip-10-8-41-60 syslog-ng]# ls /lib64/syslog-ng/ libaffile.so libafsocket-notls.so libafsql.so libbasicfuncs.so libconvertfuncs.so libdbparser.so libsyslogformat.so libafprog.so libafsocket.so libafuser.so libconfgen.so libcsvparser.so libdummy.so Thank you for your advice, Simon Tyler | Senior Systems Administrator - PathWise Solutions Group Aon 225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.979.7724 simon.tyler(a)aon.com PLEASE NOTE that my email address has changed to simon.tyler(a)aon.com -----Original Message----- From: syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: Wednesday, May 01, 2019 12:47 PM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 169, Issue 1 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. source plugin network not found/problems getting syslog-ng to listen on tcp port (Simon Tyler) 2. Re: source plugin network not found/problems getting syslog-ng to listen on tcp port (Péter) ---------------------------------------------------------------------- Message: 1 Date: Wed, 1 May 2019 15:22:26 +0000 From: Simon Tyler <simon.tyler(a)aon.com> To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] source plugin network not found/problems getting syslog-ng to listen on tcp port Message-ID: <DM5P170MB0015DD8BF273A79D22817BAAFB3B0(a)DM5P170MB0015.NAMP170.PROD.OUTLOOK.COM> Content-Type: text/plain; charset="utf-8" Hello, I'm new to syslog-ng, and I'm having some trouble just getting it to listen on a tcp port. I've tried several different configurations. Some of the start up with no error, but a netstat or lsof command shows that there is no open /listening tcp port associated with the process. I'm pretty sure my mistake is basic or fundamental, but I haven't had much luck finding specific details to resolve this issue; there is a fair amount of material to comb through. I've tried several different tutorials. I want a central log server that accepts logs from multiple sources, so I started by trying to configure it to listen on a tcp port, I'm thinking 514 because we don't use rshell anywhere, but it doesn't really matter what port. The current error I'm getting is: [root@ip-10-8-41-60 syslog-ng]# service syslog-ng start Error parsing source, source plugin network not found in /etc/syslog-ng/syslog-ng.conf at line 85, column 2: network( ^^^^^^^ The section of the config file related to networking is below; I've commented out several attempts. # s_net = Network listener. This is listening on TCP port 514, no UDP #source s_net { tcp(port(514) max-connections(5000)); udp();}; #source s_net { # tcp(ip(10.8.41.60) port(514)); #}; #source s_net { # network(ip(10.8.41.60) port(514)); #}; #source s_network { # default-network-drivers(); #}; #source s_syslog { syslog( # ip(10.8.41.60) port(514) transport("tcp")); }; source s_network { network( ip("10.8.41.60") transport("tcp") listen-backlog(2048) ); }; There is a line at the top of the file: @include "scl.conf" I've attached the entire file. Any guidance would be very much appreciated, Simon Tyler | Senior Systems Administrator - PathWise Solutions Group Aon 225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.979.7724 simon.tyler(a)aon.com<mailto:simon.tyler@aon.com> PLEASE NOTE that my email address has changed to simon.tyler(a)aon.com -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190501/4cfbf496/a…> -------------- next part -------------- A non-text attachment was scrubbed... Name: syslog-ng.conf Type: application/octet-stream Size: 4159 bytes Desc: syslog-ng.conf URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190501/4cfbf496/a…> ------------------------------ Message: 2 Date: Wed, 1 May 2019 18:46:41 +0200 From: Péter, Kókai <peter.kokai(a)oneidentity.com> To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] source plugin network not found/problems getting syslog-ng to listen on tcp port Message-ID: <CABxQCphBGgTm47G=KVSB67Ri6BRKUZYgX-HvAj1SrS9ofMoaoQ(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Hello, It either looks for a wrong place for the network module or that actually really not installed. You could run the following: syslog-ng -V That should provide something like this: syslog-ng 3.20.1.317.g98479aa Config version: 3.20 Installer-Version: 3.20.1.317.g98479aa Revision: 3.20.1.317.g98479aa Module-Directory: /tmp/install/lib/syslog-ng Module-Path: /tmp/install/lib/syslog-ng Include-Path: /tmp/install/share/syslog-ng/include Available-Modules: xml,tags-parser,system-source,sdjournal,syslogformat,stardate,snmptrapd_parser,riemann,mod-python,pseudofile,pacctformat,map_value_pairs,linux-kmsg-format,kvformat,json-plugin,http,hook-commands,graphite,tfgetent,geoip2-plugin,geoip-plugin,examples,disk-buffer,dbparser,date,csvparser,cryptofuncs,confgen,cef,basicfuncs,appmodel,afuser,afstomp,afsql,afsocket,afprog,affile,afamqp,add_contextual_data Enable-Debug: on Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-Linux-Caps: on Enable-Systemd: on Check if the "Available-Modules" line has the *afsocket*, if the *afsocket* is not listed there, try to look in the "Module-Path:" directory for *libafsocket.so", if it is missing maybe it is actually in a different package, you may need to install something like syslog-ng-mod-afsocket. If you find the *libafsocket.so* in the directory I would run syslog-ng --module-registry -dvt (possibly past its result here) or look for error message as why it cannot load *libafsocket.so*. -- Kokan On Wed, May 1, 2019 at 5:22 PM Simon Tyler <simon.tyler(a)aon.com> wrote: > Hello, > > > > I’m new to syslog-ng, and I’m having some trouble just getting it to > listen on a tcp port. I’ve tried several different configurations. Some of > the start up with no error, but a netstat or lsof command shows that there > is no open /listening tcp port associated with the process. I’m pretty sure > my mistake is basic or fundamental, but I haven’t had much luck finding > specific details to resolve this issue; there is a fair amount of material > to comb through. I’ve tried several different tutorials. > > > > I want a central log server that accepts logs from multiple sources, so I > started by trying to configure it to listen on a tcp port, I’m thinking 514 > because we don’t use rshell anywhere, but it doesn’t really matter what > port. > > > > The current error I’m getting is: > > > > [root@ip-10-8-41-60 syslog-ng]# service syslog-ng start > > Error parsing source, source plugin network not found in > /etc/syslog-ng/syslog-ng.conf at line 85, column 2: > > > > network( > > ^^^^^^^ > > > > The section of the config file related to networking is below; I’ve > commented out several attempts. > > > > # s_net = Network listener. This is listening on TCP port 514, no UDP > > #source s_net { tcp(port(514) max-connections(5000)); udp();}; > > > > #source s_net { > > # tcp(ip(10.8.41.60) port(514)); > > #}; > > > > #source s_net { > > # network(ip(10.8.41.60) port(514)); > > #}; > > > > #source s_network { > > # default-network-drivers(); > > #}; > > > > #source s_syslog { syslog( > > # ip(10.8.41.60) port(514) transport("tcp")); }; > > > > source s_network { > > network( > > ip("10.8.41.60") > > transport("tcp") > > listen-backlog(2048) > > ); > > }; > > > > There is a line at the top of the file: > > @include "scl.conf" > > > > I’ve attached the entire file. > > > > Any guidance would be very much appreciated, > > > > *Simon Tyler *| Senior Systems Administrator - PathWise Solutions Group > Aon > 225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada > t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.979.7724 > *simon.tyler(a)aon.com <simon.tyler(a)aon.com>* > > *PLEASE NOTE that my email address has changed to simon.tyler(a)aon.com > <http://simon.tyler@aon.com>* > > > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190501/715578b1/a…> ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng ------------------------------ End of syslog-ng Digest, Vol 169, Issue 1 *****************************************

2 1

source plugin network not found/problems getting syslog-ng to listen on tcp port
by Simon Tyler 01 May '19

01 May '19

Hello, I'm new to syslog-ng, and I'm having some trouble just getting it to listen on a tcp port. I've tried several different configurations. Some of the start up with no error, but a netstat or lsof command shows that there is no open /listening tcp port associated with the process. I'm pretty sure my mistake is basic or fundamental, but I haven't had much luck finding specific details to resolve this issue; there is a fair amount of material to comb through. I've tried several different tutorials. I want a central log server that accepts logs from multiple sources, so I started by trying to configure it to listen on a tcp port, I'm thinking 514 because we don't use rshell anywhere, but it doesn't really matter what port. The current error I'm getting is: [root@ip-10-8-41-60 syslog-ng]# service syslog-ng start Error parsing source, source plugin network not found in /etc/syslog-ng/syslog-ng.conf at line 85, column 2: network( ^^^^^^^ The section of the config file related to networking is below; I've commented out several attempts. # s_net = Network listener. This is listening on TCP port 514, no UDP #source s_net { tcp(port(514) max-connections(5000)); udp();}; #source s_net { # tcp(ip(10.8.41.60) port(514)); #}; #source s_net { # network(ip(10.8.41.60) port(514)); #}; #source s_network { # default-network-drivers(); #}; #source s_syslog { syslog( # ip(10.8.41.60) port(514) transport("tcp")); }; source s_network { network( ip("10.8.41.60") transport("tcp") listen-backlog(2048) ); }; There is a line at the top of the file: @include "scl.conf" I've attached the entire file. Any guidance would be very much appreciated, Simon Tyler | Senior Systems Administrator - PathWise Solutions Group Aon 225 King Street West, Suite 1000 | Toronto, ON M5V 3M2, Canada t +1.416.263.7755 | m +1.416.564.4855 | f +1.416.979.7724 simon.tyler(a)aon.com<mailto:simon.tyler@aon.com> PLEASE NOTE that my email address has changed to simon.tyler(a)aon.com

2 1

syslog-ng for filtering and execute external application
by Thomas Schmiedl 29 Apr '19

29 Apr '19

Hello, I use the mediaserver xupnpd2 (https://github.com/clark15b/xupnpd2) on the router to show HLS streams on the TV. Unfortunately, the software is no longer maintained by the original developer (I'm not a developer myself). The HLS processing would have to be revised. My idea is to start a ffmpeg and a local web server on the router, if I want to display the stream (the script xupnpd.lua will be executed, which starts ffmpeg etc.). Unfortunately there is not such a script when terminating the stream (exit ffmpeg etc.). xupnpd2 uses a log where you can track the start as well as the ending of the stream. Since the router has only a small amount of internal memory to write and analyze a logfile, I have the question, if I could use syslog-ng to filter the start and stop of the stream and execute an action "ffmpeg stop" and "delete video segments". I have very little Linux knowledge, maybe you can help me. Here is the excerpt from the xupnpd2 log (Loglevel 8). When starting the stream: run child, pid = 1715 using handler 'hls' for '... URL ...' When stopping the stream: exit child, pid = 1715 Best regards, Thomas Schmiedl

2 7

Bumped off the list again
by Scot 28 Apr '19

28 Apr '19

Anyone else using gmail getting bumped off the list ? Twice so far due to too many bounces to my gmail account.

4 4

how to insert a word before forwarding to another remote host
by Lin, Victor 25 Apr '19

25 Apr '19

Dear all, Could anyone let me know how can Insert a label into a syslog message? I received Cisco syslog from port514, Arista 5214, Airwave 5514, then my syslog forwarding these into one remote host with port 5714 ( they don't want separate port for each vendor) , so I will need to insert "Cisco" or "Arista" or "Airwave" before forwarding Thank you very much for your direction! VL If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. RBC collects information from you and your device, including through use of cookies, in order to improve your digital experience and measure the effectiveness of RBC digital channels. Additional information may be found here <https://www.rbc.com/privacysecurity/ca/online-privacy.html>. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future. RBC recueille des renseignements fournis par vous et par votre appareil, de même que par l’utilisation de témoins, dans le but d’améliorer votre expérience numérique et de mesurer l’efficacité de nos canaux numériques. Vous pouvez obtenir des renseignements supplémentaires

1 0

startup and network sources
by Evan Rempel 18 Apr '19

18 Apr '19

I've been looking at an interesting scenario on Redhat 7 (systemd) where syslog-ng fails to start because it can not resolve a network source name. This happens because the network has not started. Systemd attempts to restart syslog-ng a few times and then decides that it is restarting syslog-ng too quickly and gives up on it. 2019-04-17T05:13:30.009 daemon.warning systemd[1]: start request repeated too quickly for syslog-ng.service 2019-04-17T05:13:30.010 daemon.err systemd[1]: Failed to start System Logger Daemon. 2019-04-17T05:13:30.010 daemon.notice systemd[1]: Unit syslog-ng.service entered failed state. 2019-04-17T05:13:30.010 daemon.warning systemd[1]: syslog-ng.service failed. My first reaction was to add the "Wants=network-online.target" to the service definition to make syslog-ng start after the network has started, but that would mean that if I boot up without a network that syslog-ng would never start, and that seems incorrect to me. Is there a way to to configure a network source to be optional and continue to retry binding to it after startup? How do others handle this issue? -- Evan

2 3

Permissions Issues
by Faine, Mark R. (MSFC-IS40)[NICS] 16 Apr '19

16 Apr '19

syslog-ng 3.18.1 RHEL 6.10 Can someone please help me understand what I'm doing wrong? I thought that when I set the following on a destination: create_dirs(yes); dir-owner(myuser); dir-group(myuser); group(myuser); owner(myuser); perm(0640); that files and directories would be created with those permissions, however, I'm seeing something strange. It seems that syslog-ng still wants to create and write to files with root.root. Also, and this is even more unexpected. If I change the permissions on the directories before starting syslog-ng, it fails to write to the directories that are not root.root. Am I missing something? Thanks, -Mark

2 4

Missing http module 3.18.1 CentOS
by Faine, Mark R. (MSFC-IS40)[NICS] 10 Apr '19

10 Apr '19

Forgive me if this is common knowledge or an easy fix but I just installed syslog-ng 3.18.1 on CentOS 7.6.1810 and I'm seeing the following message on startup and when doing syntax checks. It seems to be working otherwise. [2019-04-09T18:44:57.702909] Plugin module not found in 'module-path'; module-path='//usr/lib64/syslog-ng', module='http' Thanks, -Mark

3 4

Insider 2019-04: Tetris; Docker; Podman; python-fetcher
by Czanik, Péter 10 Apr '19

10 Apr '19

Dear syslog-ng users, This is the 74th issue of syslog-ng Insider, a monthly newsletter that brings you news related to syslog-ng. NEWS Tetris destination ------------------ In this blog post we show you a fun way of using the Python destination of syslog-ng. We will write a Tetris destination. We will use the built-in Tetris implementation of Emacs. The syslog-ng Python destination will connect to an Emacs server. The log messages will be turned into Tetris commands inside Emacs. Using an stdin source, users can interactively feed syslog-ng with messages that will control the Tetris in the end. https://www.syslog-ng.com/community/b/blog/posts/tetris-destination A simplified guide to logging Docker to Elasticsearch in 2019 using syslog-ng ----------------------------------- This simplified guide shows you how to send logs of containers into Elasticsearch. Although there are several tutorials on logging Docker to Elasticsearch, this one is entirely different, as it uses syslog-ng. You can also visualize your Docker logs on a nice dashboard in Kibana. https://balagetech.com/simplified-logging-docker-elasticsearch-syslog-ng/ Replacing Docker with Podman in the syslog-ng build container ------------------------------------------------------------- The syslog-ng source code includes a container-based build system. You can use this build system to generate source tarballs (the official syslog-ng release tarball is also generated this way) and to build packages for RHEL 7 as well as different Debian and Ubuntu releases. Although it was originally built around Docker, with the general availability of RHEL 8 is drawing near, I wanted to know how difficult it is to replace Docker with Podman in the syslog-ng build system. Originally I tested this replacement on Fedora Silverblue (Silverblue), then a week later on RHEL 8 Beta. While the syslog-ng build scripts do not support these distributions (yet), the point was to check Podman as a Docker replacement. https://www.syslog-ng.com/community/b/blog/posts/replacing-docker-with-podm… The syslog-ng python-fetcher(): collecting load average data ------------------------------------------------------------ Using python-fetcher() simplifies developing a source driver for syslog-ng even further. You do not have to implement your own event loop, since syslog-ng does it for you. You only need to focus on what information you need and how you (or your code) can fetch it. In this blog I will show you two examples. The first one is a dead end: it is a project that looked simple at first but turned out to be problematic later on. The second one is simple but still manages to illustrate most features of the python-fetcher. https://www.syslog-ng.com/community/b/blog/posts/the-syslog-ng-python-fetch… CONFERENCES * LOADays (https://loadays.org/) syslog-ng featured in my sudo talk * Red Hat Summit (https://www.redhat.com/en/summit/2019) One Identity booth WEBINARS Upcoming: * Bridge the gap between cloud and on-premises: https://www.syslog-ng.com/event/bridge-the-gap-between-cloud-and-onpremises… You can watch our past webinars: * Got a hungry Splunk? Feed it smartly with syslog-ng: https://www.brighttalk.com/webcast/16207/350610 Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Re: [syslog-ng] syslog-ng Digest, Vol 168, Issue 11
by Aguilu, Miguel 10 Apr '19

10 Apr '19

If it is a simple typo I do not see it. But I did remove all sources with the exception of the upd on all filters. So, it is writing the udp traffic to the log. But getting errors: - You are using the pipe() driver, underlying file is not a FIFO, it should be used by file(); filename='/opt/log/nco' - Apr 9 19:18:01 eorcrp-dsc-ncsl1-new-ms syslog-ng[15695]: Error opening file for writing; filename='/opt/log/nco', error='Invalid argument (22)' Regard Essentially I can write to a log but not a pipe even when create the file as a pipe or let syslog-ng create it - eventually after the creation will start companying it can't write to it. Not sure if I am missing something the pipe configuration (don’t think so) or there is a bug in this version 3.19/3.14/3.1. Yes I am on my 3rd version to see if a see anything different. But so far, I am seeing the same behavior Any thought Thanks Miguel Office - 321.939.7483 Cell - 321.261.1385 PCell – 321.693.5726 miguel.aguilu(a)atos.net Upcoming PTO: TBD On 4/9/19, 2:54 PM, "syslog-ng on behalf of syslog-ng-request(a)lists.balabit.hu" <syslog-ng-bounces(a)lists.balabit.hu on behalf of syslog-ng-request(a)lists.balabit.hu> wrote: Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.bal… or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: Syslog-ng 3.16 unable to write to pipe (Evan Rempel) 2. Missing http module 3.18.1 CentOS (Faine, Mark R. (MSFC-IS40)[NICS]) ---------------------------------------------------------------------- Message: 1 Date: Tue, 9 Apr 2019 07:57:41 -0700 From: Evan Rempel <erempel(a)uvic.ca> To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] Syslog-ng 3.16 unable to write to pipe Message-ID: <cf965cf4-ada3-42c7-f875-d7325a4887ec(a)uvic.ca> Content-Type: text/plain; charset="utf-8"; Format="flowed" You keep referring to /opt/log but your configuration is for /var/log/nco.pipe destination netcool { pipe("/var/log/nco.pipe"); }; Is this a simple typo? On 4/9/19 6:38 AM, Aguilu, Miguel wrote: > > We are in the middle of a project to Migrate from 3.0 to 3.16 (latest in redhat distro) > > The standard 3.14 config works fine writing to some standard logs in /var/log > > But we need to write special files to /opt/log/ > > * In this directory will be a file type pipe to be read by a syslog probe (parse messages into alerts). Using the following configuration NG returns unable to write. > > source s_dgram > > { unix-dgram("/dev/log"); }; > > source s_kernel > > { file("/proc/kmsg" program_override("kernel: ")); }; > > source s_udp > > { udp(); }; > > destination netcool { pipe("/var/log/nco.pipe"); }; > > log { source(s_dgram); > > source(s_kernel); > > source(s_udp); filter(f_NOfwflow); > > filter(f_NOdata_cent); > > filter(f_NOtacacs); > > filter(f_netcool); destination(netcool); }; > > * Even if I remove the filter I get the same error. > * Also removed all of the sources with the exception of the upd and got the same error. > * Changed the file type to file and getting: > o OLLERR occurred while idle; fd='66' > o Apr 9 13:17:45 wbucrp-isdmz1a-lb err syslog-ng[2475]: Connection broken; time_reopen='60' > o Apr 9 13:17:47 wbucrp-isdmz1b-lb err syslog-ng[10934]: POLLERR occurred while idle; fd='66' > o Apr 9 13:17:47 wbucrp-isdmz1b-lb err syslog-ng[10934]: Connection broken; time_reopen='60' > o Apr 9 13:17:51 wapcrp-isdmz0a-lb err syslog-ng[3713]: I/O error occurred while writing; fd='38', error='Connection refused (111)' > o Apr 9 13:17:51 wapcrp-isdmz0a-lb err syslog-ng[3713]: Connection broken; time_reopen='60' > o Apr 9 13:17:51 wapcrp-isdmz0a-lb notice syslog-ng[3713]: Suspending write operation because of an I/O error; fd='38', time_reopen='60' > * The permissions in /opt/log are 777 and owned by root which is the user syslog-ng is running under. > * Also change the path to where the config was updating file (/varr/log) and attemted to create the pipe and no luck > > Here are my global options: > > * options { > * flush_lines (0); > * # time_reopen (10); > * log_fifo_size (1000); > * chain_hostnames (on); > * use_dns (yes); ## changed test > * use_fqdn (yes); > * keep_hostname (yes); > * owner("root"); > * group("root"); > * create_dirs(yes); #Test > * dir_perm(0755); > * perm(0644); > * }; > > ANY Ideas? > > Thanks > > Miguel > -- Evan -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.bala…> ------------------------------ Message: 2 Date: Tue, 9 Apr 2019 18:53:44 +0000 From: "Faine, Mark R. (MSFC-IS40)[NICS]" <mark.faine(a)nasa.gov> To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] Missing http module 3.18.1 CentOS Message-ID: <BN6PR09MB14584A6B3A85C39D8AFB049BE92D0(a)BN6PR09MB1458.namprd09.prod.outlook.com> Content-Type: text/plain; charset="utf-8" Forgive me if this is common knowledge or an easy fix but I just installed syslog-ng 3.18.1 on CentOS 7.6.1810 and I'm seeing the following message on startup and when doing syntax checks. It seems to be working otherwise. [2019-04-09T18:44:57.702909] Plugin module not found in 'module-path'; module-path='//usr/lib64/syslog-ng', module='http' Thanks, -Mark -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.bala…> ------------------------------ Subject: Digest Footer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.bal… ------------------------------ End of syslog-ng Digest, Vol 168, Issue 11 ******************************************

1 0