- syslog-ng - lists.balabit.hu

Disk based queuing with rsyslog?
by Delon Lee Di Lun 09 May '18

09 May '18

Hi, I read that syslog-ng can be setup to use disk based with flow control with the client to prevent lost of logs. However I was just thinking, how does this mechanism works? Does the client have to be using syslog-ng? Will it work if the client is using rsyslog? Native appliance that purely support syslog? Yours Sincerely, Delon Lee

4 9

Difference in version
by Delon Lee Di Lun 08 May '18

08 May '18

Hi, I am trying to download the source code of syslog-ng 3.15.1 from the link below: https://github.com/balabit/syslog-ng/releases May I know what is the difference between the file with "orig" and the one without? Yours Sincerely, Delon

6 13

hostname not appearing correctly when receiving logs from switches
by Clayton Dukes 07 May '18

07 May '18

Interesting! We’ve been getting a lot of support tickets for this very problem. I can easily recreate the issue. Balabit Team: is this a new bug? [cid:image001.png@01D306E3.0FEBC990] Clayton Dukes Founder & CEO LogZilla Corporation 2900 N. Quinlan Park Rd, B240-341 Austin, TX, 78732 Tel: 936-4NetOps (463-8677) Web: www.logzilla.net<http://www.logzilla.net/> [cid:image002.png@01D306E3.0FEBC990]<https://twitter.com/logzilla>[cid:image003.png@01D306E3.0FEBC990]<https://youtu.be/drg5wv_mgfA>[cid:image004.png@01D306E3.0FEBC990]<https://www.linkedin.com/in/lzcdukes/> For NetOps, By NetOps! From: syslog-ng <syslog-ng-bounces(a)lists.balabit.hu> on behalf of Joshua <aces621(a)yahoo.com> Reply-To: Joshua <aces621(a)yahoo.com>, Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Date: Monday, April 30, 2018 at 7:09 PM To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> Subject: [Suspected Spam] [syslog-ng] hostname not appearing correctly when receiving logs from switches Hi All, I am pretty new to syslog-ng but do have some basic knowledge. I have deployed syslog-ng v3.14 on a newly deployed Linux server because syslog-ng v3.5 is working very well on another syslog server. On this new deployment, the syslogs received from most of the servers are able to show IP/host, however, the syslogs from our switches contains IP/host showing as ":" (colons). I copied the current working custom build .conf from another syslog server into our new server. Can someone help me figure out what I am missing? It is working for some components but not for switches. I tested the same switch by sending syslog to another syslog server and the hostname is appearing but just not appearing on the new syslog server. The only difference between the two server is that one uses v3.5 (the working one) and the other uses syslog-ng v3.14. I have set: "keep_hostname (yes)" but it still doesn't work. Can someone please help? Am I missing something here? Thanks Joshua Lai

5 5

save Syslog-ng daemon logs locally
by Hirbod Moriani 05 May '18

05 May '18

Hi everyone, I want to save log from syslog-ng daemon itself. For example "start a TLS session"/"end of a TLS session" or something like that should be logged. It's possible in syslog-ng CE? and how to config syslog-ng to save daemon logs locally?

2 1

Difference in 3.15.1 versions?
by Delon Lee Di Lun 05 May '18

05 May '18

Hi, I am trying to download the source code of syslog-ng 3.15.1 from the link below: https://github.com/balabit/syslog-ng/releases May I know what is the difference between the file with "orig" and the one without? Yours Sincerely, Delon

1 0

hostname not appearing correctly when receiving logs from switches
by Joshua 01 May '18

01 May '18

Hi All, I am pretty new to syslog-ng but do have some basic knowledge. I have deployed syslog-ng v3.14 on a newly deployed Linux server because syslog-ng v3.5 is working very well on another syslog server. On this new deployment, the syslogs received from most of the servers are able to show IP/host, however, the syslogs from our switches contains IP/host showing as ":" (colons). I copied the current working custom build .conf from another syslog server into our new server. Can someone help me figure out what I am missing? It is working for some components but not for switches. I tested the same switch by sending syslog to another syslog server and the hostname is appearing but just not appearing on the new syslog server. The only difference between the two server is that one uses v3.5 (the working one) and the other uses syslog-ng v3.14. I have set: "keep_hostname (yes)" but it still doesn't work. Can someone please help? Am I missing something here? ThanksJoshua Lai

1 0

Destination program input
by Scappatura Rocco 30 Apr '18

30 Apr '18

Hello. I have written a C program that read the successful POP3 access log lines to my POP3 server. After get one line, it get the time and the POP3 account that logged in. These data are then stored in the account MySQL database. The program (named 'pop3_access') works fine: echo "Apr 10 12:00:17 mail1 pop3d: LOGIN, user= xxx(a)domain.tld, ip=[::ffff:xxx.yyy.zzz.vvv], port=[56196]"|./pop3_access Infact quering DB, I get: username pop3_last_access xxx(a)domain.tld 2018-04-10 12:00:17 I have configured syslog: filter f_pop3_access { facility(local7) and match ('LOGIN,'); }; destination d_pop3_last_access { program("/usr/local/bin/pop3_access >/dev/null" ); }; log { source(src); filter(f_pop3_access); destination(d_pop3_last_access); }; But no rows are inserted in the database.. >From log of destination program 'pop3_access' I see the it remains in a while loop waiting for an 'EOF' that never arrives: while (fgets(line, MAXSTR, stdin)) { if (sscanf(line, "%s %d %s %s %s %s %s %s %s", mese, &giorno, ora, s, proto, comando, u, ip, porta) != 9){ syslog (LOG_NOTICE, "Errore scanf"); exit(-1); } } How I have to do so that my program succeed in taking the syslog row correctly, and then returns after process the data as expected? Regards, Rocco Scappatura

3 5

insert timezone into log
by Asif Iqbal 26 Apr '18

26 Apr '18

How do I change the time in the log to append a timezone. Timestamp should be based on generateTime=1523620861 which is in the log So today the time in the shows like this Apr 25 16:46:51 host.example.net .., generateTime=1524674663, ... I like to change it like below 2018-04-25T16:46:55+0000 host.example.net ...,generateTime=1524674663, .... {"PROGRAM":"alarmLog,","PRIORITY":"notice","MESSAGE":"applianceName=KING-MER-50-PRI, tenantName=king, alarmType=vrrp-v3-proto-error, alarmKey=0|vni-0/3.0, generateTime=1523620861, applianceId=1, vsnId=0, tenantId=4, alarmCause=causeOther, alarmClearable=no, alarmClass=new, alarmKind=root, alarmEventType=equipmentAlarm, alarmSeverity=indeterminate, alarmOwner=tenant, alarmSeqNo=36657, alarmText=\"vni-0/3.0\", siteName=","HOST":"host.example.net","FACILITY":"user","DATE":"Apr 13 04:01:22"} -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

2 4

GSoC 2018 participant: Queue Interface
by Mehul Prajapati 25 Apr '18

25 Apr '18

Hi All, I'm Mehul Prajapati, a prospective student in Masters of Applied Computer Science graduate program at Concordia University. In my spare time, I do competitive programming on HackerRank, online computer science courses (edx, Coursera, Udacity) and open source projects to improve myself as a software developer. I am going to work on the Queue Interface project using C. The aim of this project is to develop a Redis based queue interface which could be an alternative to the disk queue. Many thanks to Mr. Kókai Péter for selecting me. I am excited to be a part of this community. Looking forward to work on this project. -- Regards, Mehul Prajapati

1 0

GSoC 2018 participant : ElasticSearch Destination Client
by Videet Singhai 25 Apr '18

25 Apr '18

Hello all, I am Videet Singhai from India, currently pursuing Bachelor of Engineering in Information Technology. I am going to work on the ElasticSearch Destination REST Client using C. This client should be able to send the logs to ElasticSearch without depending on other languages. Thanks to Mr. Laszlo Budai for selecting me. Looking forward to having an amazing summer. Thank you

1 0