- syslog-ng - lists.balabit.hu

Dropping specific messages from Syslog-NG
by Bell, Christopher E. 05 Apr '19

05 Apr '19

Disclaimer: I'm not an expert in either Linux or syslog-ng. I'm also not a programmer :). That being said, I've built a syslog-ng --> Splunk deployment and I'm trying to drop unwanted log messages before they make their way to Splunk... so drop them at syslog-ng. There are going to be approx. 700 devices logging to this deployment (routers, switches, firewalls, IPAM, AAA, etc..) so I need to make sure whatever I do can scale easily and my teammates can help me manage it. I'm trying to drop messages that are similar to the below: Apr 5 06:02:17 x.x.x.x 2019 Apr 5 06:02:17 EDT: %USER-3-SYSTEM_MSG: NTP Receive dropping message: Received NTP control mode packet. Drop count:4200 - ntpd As well as: Apr 5 08:03:49 x.x.x.x Apr 5 2019 12:03:48.895 UTC: %SNMP-3-RESPONSE_DELAYED: processing GetNext of entPhysicalEntry.2.1065 (5739 msecs) Two different devices. I've tried literally dozens of methods, my latest is below and I can't figure out why we're still logging these messages: filter f_trash { match(SNMP-3-RESPONSE_DELAYED value(MSGHDR)); and match(NTP Receive dropping message value(MSG))}; log { source(s_sys); filter(f_trash); flags (final);}; Any help / constructive criticism would be greatly appreciated.

2 3

Interest in GSoC 2019
by Kushal K S V S 03 Apr '19

03 Apr '19

Hi, I am Kushal. I am a Final Year Undergrad in Computer Science IIT Guwahati, India. I am very much interested in working on Syslog-ng and with the community on the project "Analyze and improve JSON performance". I have installed from the source code and am currently going through the code. I have already participated in GSoC in 2017 as a part of The FreeType Org. Many of my projects including the previous GSoC project are in C. I am well-versed in C, C++, Bash, makefile, etc. which will be the technologies to be used for this project. Hope I am not too late. I am thinking of analyzing the JSON parsers available to get an idea on how to proceed. Any help regarding this would be highly appreciated. Yours sincerely, Kushal K S V S

1 0

syslog-ng moving to its own organization on github
by Scheidler, Balázs 01 Apr '19

01 Apr '19

Hi, syslog-ng as an open source project has long been supported and sponsored by a company called Balabit (which I personally was the founder of), hence syslog-ng related online resources like the github project was published under github.com/balabit. Since Balabit was acquired last January by One Identity (www.oneidentity.com) going forward, the Balabit branding is not the right one for the syslog-ng project. Since the acquisition, all on-line syslog-ng presence was concentrated under the "syslog-ng" brand. An example for this is the website, which is now at www.syslog-ng.com. In a similar way, developer and open source related resources should follow suit. Our plan is to use "syslog-ng" everywhere where we were using "balabit". This includes github, dockerhub, gitter, slack, mailing list etc. We expect that the transition will take time, and that old links, chat rooms, docker images will work for a time yet, redirects will be there for those of us still using the old links. However it is a good idea to update bookmarks & git remotes that this will work on the long run. Over time, the name "Balabit" will fade a bit, at least within the syslog-ng community, but that's good. That's progress. Cheers, Bazsi founder of syslog-ng founder of Balabit

1 0

Redhat repo
by Faine, Mark R. (MSFC-IS40)[NICS] 01 Apr '19

01 Apr '19

I have a question about the Redhat repo for the unofficial OSE builds. It seems as though they are tied to a specific version. For example, I'm currently using czanik-syslog-ng318epel6, however, I see that 3.19 has a different repo specifically for that version. This seems to be counter to the point of yum repositories and it imposes an additional maintenance burden. Am I maybe not properly understanding how it works, and if not, is there a repo that tracks with the latest stable version? -Mark

6 9

Bind source IP using localip()?
by Scot 29 Mar '19

29 Mar '19

Is there a way to bind to a src IP when sending forwarding an event from syslog-ng ? We have an alias on the system and want to use that as the sending IP address for a forward. Tried the localip option which seems to pass conf check but ignored for destinations. Looked in the network and syslog driver documentation and didn't see anything obvious. syslog-ng 3 (3.14.1) Config version: 3.14 Installer-Version: 3.14.1 Revision: Compile-Date: Mar 14 2018 09:48:15 Module-Directory: //usr/lib64/syslog-ng Module-Path: //usr/lib64/syslog-ng Available-Modules: add-contextual-data,affile,afprog,afsocket,afstomp,afuser,basicfuncs,cef,confgen,cryptofuncs,csvparser,date,dbparser,disk-buffer,graphite,json-plugin,kvformat,linux-kmsg-format,pseudofile,sdjournal,syslogformat,system-source,afsmtp,geoip-plugin,mod-java,map-value-pairs,snmptrapd-parser,stardate,tfgetent,appmodel,tags-parser,xml,geoip2-plugin,afamqp Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: on Enable-Systemd: on

3 2

Convert if/else to nested log paths
by Faine, Mark R. (MSFC-IS40)[NICS] 27 Mar '19

27 Mar '19

What is the conversion of an if/else to embedded log path statements? I tried to do this today and didn't have any luck so I reverted back to if/else. I have a log statement with a series of if/else blocks: log { source(pan_splunk); if { filter { host("^[a-z]+\.foo.*$") or netmask('192.168.1.100/32') or netmask('192.168.1.101/32'); }; rewrite { set("foo" value("location")); }; } elif { filter { host("^[a-z]+\.bar.*$") or netmask('192.168.1.102/32') or netmask('192.168.1.103/32'); }; } else { rewrite { set("unknown" value("location")); }; } Can this be written with embedded log statements? The if/else blocks are working for me so this is just an academic exercise but I'd really like to understand how to do it with embedded log paths. Thanks, -Mark

2 2

Filtering out messages before any other action
by Faine, Mark R. (MSFC-IS40)[NICS] 27 Mar '19

27 Mar '19

I have the following as the first log path in my configuration, however, My understanding is that this should match any message with the text 'type=traffic' AND any of the listed policyid=## or a message with the text 'action=timeout'. Flags(final) indicates that it should not be further processed by any other log path. However, I'm still seeing messages that should be discarded, am I doing something wrong? log { if { filter { message('type=traffic') }; filter { ( message('policyid=35 ') or message('policyid=37 ') or message('policyid=38 ') or message('policyid=40_D ') or message('policyid=5 ') or message('policyid=10 ') or message('policyid=12 ') or message('policyid=50 ') or message('policyid=3 ') or message('action=timeout ') ) }; destination { file("/dev/null"); }; }; flags(final); }; Thanks, -Mark

2 2

syslog-ng.conf filter not working
by Lin, Victor 27 Mar '19

27 Mar '19

Dear All, I am trying to forwarding all cisco IOS and Nexus to remote server Here is from my syslog-ng.conf ********************* # Syslog collection for all devices source s_network { network( transport("udp") port(514) flags(syslog_protocol) keep_hostname(yes) keep_timestamp(yes) use_dns(no) use_fqdn(no) ); }; destination d_all_logs { file("/app/syslog-ng/My_custom/My_output/all_devices.log"); }; #All syslogs log { source(s_network); destination(d_all_logs); }; ***************************** #Cisco to elastic Mar.22.2019 destination d_cisco_logs { file("/app/syslog-ng/My_custom/My_output/cisco.log"); network("10.20.30.44" port(2514) transport(udp) spoof_source(yes)); }; ***************************************** #Cisco logs to elastic Mar.22.2019 log { source(s_network); filter(f_cisco_message); destination(d_cisco_logs); }; *********************************** #Cisco to elastic Mar.22.2019 filter f_cisco_message { match ("Cisco IOS", value ("MESSAGE")); or match ("Cisco Nexus", value ("MESSAGE")); }; But looks like cisco.log is never have any data inside. Below is from Could you please review my config and advice ? Thank you so much for your reply in advance! VL _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future.

2 1

Best way to manage apache's access logs
by Nik Ambrosch 26 Mar '19

26 Mar '19

How are people managing their apache access logs using syslog-ng these days - still just piping through logger? I'm looking to take over logging entirely using syslog-ng, not just reading files from disk and sending to ES or something. In the past I've used cronolog, which works fine, but I'd love the flexibility of sending the logs through syslog-ng.

3 4

Setting and using variables
by Faine, Mark R. (MSFC-IS40)[NICS] 25 Mar '19

25 Mar '19

Is there a way to set variables in syslog-ng? I have a log path with about 20 if/else branches and each one does a unnamed destination for that branch: log { source(pan_splunk); if ( tags('mytag') ) { destination { file("/var/log/remote/backup/$HOST/asa/${HOST}_asa.log" create-dirs(yes) dir-owner("splunk") dir-group("splunk") dir-perm(0750)); }; } elif ( message('something else') ) { destination { file("/var/log/remote/backup/$HOST/pubfw/${HOST}_pubfw.log" create-dirs(yes) dir-owner("splunk") dir-group("splunk") dir-perm(0750)); }; } elif { filter { message('foo') or message('bar') or message('baz') or ... I'd need to introduce another directory level as a variable and I'd also like to change an existing part of the path to a variable so that then I could then do something like this: if ( tags('mytag') ) { app = asa location = msfc elif ... and at the end I could then just do a single destination that had a file path with the variables file("/var/log/remote/backup/$location/$HOST/$app/${HOST}_$app.log" Thanks, -Mark

3 11