- syslog-ng - lists.balabit.hu

html posting
by Benny Pedersen 27 Feb '18

27 Feb '18

please disable html when posting reply and or questions i say this in generic so not blame some for doing it, but it more easy to read if want help

1 0

Ubuntu syslog-ng (version 3.8.1 or better)
by Alicia Smith 26 Feb '18

26 Feb '18

Can anyone tell me where I could download the syslog-ng ubuntu package for Ubuntu 14.04? I installed from source to get the amqp and format json plugins going but was wondering if there was a precompiled package with these modules available for this version of ubuntu? It would make the process a lot smoother Please let me know! Thanks :) -- Alicia Smith @phrozyn Information Security Engineer asmith(a)mozilla.com

2 1

like to volunteer The syslog-ng project.
by Janaka Nanayakkara 24 Feb '18

24 Feb '18

Dear Mentors of The syslog-ng project, Hello, I would like to take part in your project, I’m a Post graduate student who’s following software engineering degree, And I have experience in Java, C,C++,C#, Phython. I have basic knowledge about CEH (Certified Ethical Hacking).As a new Comer to the GSOC. I have less experienced about how to take part in GSOC. Can you tell me how to take part and help Your project? I would like to help for your project, because I like your concept in syslog-ng. I’m so excited to volunteer your Project to become much more effective. Thank You! Janaka Nanayakkara janaka_nanayakkara(a)aol.com +(94)776980292 Janaka Nanayakkara janaka_nanayakkara(a)aol.com

1 0

syslog-ng in Google Summer of Code (GSoC)
by Czanik, Péter 22 Feb '18

22 Feb '18

Dear syslog-ng users, This year the syslog-ng project participates the Google Summer of Code again. We are looking for students interested in working on an open source project – syslog-ng – and participating in the Google Summer of Code (GSoC). If you are new to GSoC, here are a few words about it (from https://summerofcode.withgoogle.com/) "Google Summer of Code is a global program focused on bringing more student developers into open source software development. Students work with an open source organization on a 3 month programming project during their break from school." "Students work for an open source software organization, and earn a stipend for successfully completing the project." In our view, being part of an open source community is a great learning experience with exposure to many aspects of software development. During university and later at the workplace, most people lack this kind of experience, while many of the open source projects are actually the cornerstones of IT. A good example is of course Linux, but there are many more similar projects, such as: Kubernetes, GIMP, Blender, Docker, and the list could go on. We think Google Summer of Code – and syslog-ng in particular – is a great opportunity to start contributing to an open source project, gain invaluable experience, and get that reference that you can put on your CV. :-) If you are interested, go to the syslog-ng page of GSoC, https://summerofcode.withgoogle.com/organizations/4514364854370304/, where you can find contact information, project ideas, and details about how to apply. If you are a teacher or you know students for any other reasons, make sure that your students know about syslog-ng and that they check our project idea list! Please re-tweet this tweet ( https://twitter.com/PCzanik/status/966608289910919168 ) to reach as many students (and their teachers) as possible! Thank you for your help, Peter Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://syslog-ng.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0

multiple file sources, worked - some have now gone silent
by Declan White 21 Feb '18

21 Feb '18

I'm looking at a syslog-ng client that has multiple file() sources feeding a single destination unix-domain socket with flags(flow-control) and some disk-buffer. Two days ago it was sending all these files and tracking their rotations fine etc. The destination server restarted, so the socket disappeared for a while, and the client ran out of the default buffering. The intention is that it recovers when the destination returns and resumes reading the files where it left off. When the server restarted data started flowing again. But I've noticed it's no longer sending data from ALL of the file sources. Some have gone silent. The log is saying nothing about the frozen sources. The statistics counters simply stopped incrementing for them. This is kind of fatal. Has anyone seen this before or know how to avoid it? The faulty instance is still running, so if there's any way of interrogating it to find out its mental state, that's still possible. syslog-ng 3.12.1 OS: Solaris -- Declan White

4 7

enforcing file permissions
by Nik Ambrosch 20 Feb '18

20 Feb '18

i know it's possible to create a file with permissions using owner() and group() however if the file already exists with different permissions or the permissions are changed later syslog-ng does not change the permissions back. in a future release is it possible to change the behavior of owner() and group() to enforce permissions or possibly add a new option like enforce-permissions(true) with a default of false (to mimic the current behavior)? maybe something exists already and i'm just missing it :) thanks all.

2 1

syslog-ng 3.13 key-value parser crashes and aborts
by Don C 19 Feb '18

19 Feb '18

Hi, I was upgrading syslog-ng from 3.12 to 3.13 using the prebuilt unofficial RPMs. I was testing my config on 3.13 and ran into the following issue where the key-value parsing aborts.This appears to be a regression in 3.13, the abort never happened in 3.12. If I remove the kv_parser from my config, there is no issue. Here's the end of the debug and verbose output I get. Notice the garbage values in the key-value names parsed from the message. [2018-01-25T17:33:08.924895] Filter rule evaluation result; msg='0x7fc0a807b370', result='match', rule='f_compliant_hosts', location='/etc/syslog-ng/syslog-ng.conf:66:27' [2018-01-25T17:33:08.924919] Setting value; msg='0x7fc0a80612f0', name='@\x15\x01pÀ', value='2017-11-21 19:11:24.817041' [2018-01-25T17:33:08.924930] Setting value; msg='0x7fc0a80612f0', name='', value='debug' [2018-01-25T17:33:08.924936] Setting value; msg='0x7fc0a80612f0', name='f_compliant_hosts', value='[robotnats kafka transport prepared]' [2018-01-25T17:33:08.924944] Setting value; msg='0x7fc0a80612f0', name='PK\x06¨À', value='ROBOT_serviceTracking_neo4j-topo-svc-2717019760-1sdn1' [2018-01-25T17:33:08.924952] Setting value; msg='0x7fc0a80612f0', name='', value='nats://nats:4222' [2018-01-25T17:33:08.924957] Setting value; msg='0x7fc0a80612f0', name='', value='[robot-kafka:9092]' [2018-01-25T17:33:08.924963] Setting value; msg='0x7fc0a80612f0', name='kv_kafka', value='robotnats_kafka' [2018-01-25T17:33:08.924969] Setting value; msg='0x7fc0a80612f0', name=' »\x08¬À', value='ROBOT_serviceTracking_neo4j-topo-svc-2717019760-1sdn1' [2018-01-25T17:33:08.924975] Message parsing complete; result='1', rule='p_kv', location='/etc/syslog-ng/syslog-ng.conf:75:5' [2018-01-25T17:33:08.924998] Incoming log entry; line='time="2017-11-21 19:11:24.817095" level=info msg="[skeleton core configuration parse stage complete]" config=/etc/robot/servicetracking.conf debug=true logfile= maxthreads=16 tag=ROBOT_serviceTracking_neo4j-topo-svc-2717019760-1sdn1 version=' [2018-01-25T17:33:08.925030] Setting value; msg='0x7fc0a807bd60', name='MESSAGE', value='time="2017-11-21 19:11:24.817095" level=info msg="[skeleton core configuration parse stage complete]" config=/etc/robot/servicetracking.conf debug=true logfile= maxthreads=16 tag=ROBOT_serviceTracking_neo4j-topo-svc-2717019760-1sdn1 version=' [2018-01-25T17:33:08.925040] Setting value; msg='0x7fc0a807bd60', name='HOST_FROM', value='syslog-ng-logging-1040168119-qsmrf' [2018-01-25T17:33:08.925046] Setting value; msg='0x7fc0a807bd60', name='HOST', value='syslog-ng-logging-1040168119-qsmrf/syslog-ng-logging-1040168119-qsmrf' [2018-01-25T17:33:08.925053] Setting value; msg='0x7fc0a807bd60', name='FILE_NAME', value='/mnt/logfs/neo4j-topo-svc/1/servicetracking_stdout.log' [2018-01-25T17:33:08.925057] Setting value; msg='0x7fc0a807bd60', name='SOURCE', value='s_file_stdout' [2018-01-25T17:33:08.925062] Requesting flow control; location='/etc/syslog-ng/syslog-ng.conf:81:5' [2018-01-25T17:33:08.824606] Incoming log entry; line='time="2017-11-21 19:10:56.399341" level=debug msg="[section not required]" section=etcd tag=ROBOT_serviceTracking_robot-topo-svc-2107321943-48rnw' [2018-01-25T17:33:09.022629] Filter rule evaluation begins; msg='0x7fc0a807bd60', rule='f_compliant_hosts', location='/etc/syslog-ng/syslog-ng.conf:66:27' [2018-01-25T17:33:08.824700] Setting value; msg='0x7fc0a409b810', name='HOST_FROM', value='syslog-ng-logging-1040168119-qsmrf' # # If you would like to submit a bug report, please visit: # http://bugreport.java.com/bugreport/crash.jsp # The crash happened outside the Java Virtual Machine in native code. # See problematic frame for where to report the bug. # ... [2018-01-25T17:33:09.022911] Requesting flow control; location='/etc/syslog-ng/syslog-ng.conf:81:5' [2018-01-25T17:33:09.022916] Filter rule evaluation begins; msg='0x7fc08c0f5550', rule='f_compliant_hosts', location='/etc/syslog-ng/syslog-ng.conf:66:27' [2018-01-25T17:33:09.022922] Filter node evaluation result; msg='0x7fc08c0f5550', result='not-match', type='==' [2018-01-25T17:33:09.022927] Filter rule evaluation result; msg='0x7fc08c0f5550', result='not-match', rule='f_compliant_hosts', location='/etc/syslog-ng/syslog-ng.conf:66:27' [2018-01-25T17:33:09.022932] Filter rule evaluation begins; msg='0x7fc08c0f5550', rule='f_noncompliant_hosts', location='/etc/syslog-ng/syslog-ng.conf:70:30' [2018-01-25T17:33:09.022937] Filter node evaluation result; msg='0x7fc08c0f5550', result='not-match', type='==' [2018-01-25T17:33:09.022942] Filter node evaluation result; msg='0x7fc08c0f5550', result='match', type='filter(f_compliant_hosts)' [2018-01-25T17:33:09.022947] Filter rule evaluation result; msg='0x7fc08c0f5550', result='match', rule='f_noncompliant_hosts', location='/etc/syslog-ng/syslog-ng.conf:70:30' Aborted Is this a known issue with the key-value parser in 3.13? Regards, Don

3 2

vCenter 6.5 RFC5425 prefacing messages with a space
by Evan Rempel 18 Feb '18

18 Feb '18

Our VMWare team has been busy upgrading out infrastructure to 6.5 which is great, but the syslogs started showing up as 2018-02-17T07:00:12 esx.host.name auth.info 1 2018-02-17T07:00:12.162028-08:00 esx.host.name sshd 4662 - - Did not receive identification string from 142.104.139.163 port 51088 which I recognise as RFC5425, So I added the flags(syslog-protocol) to my network source definition. Now the log message arrives much nicer as 2018-02-17T07:48:12 esx.host.name auth.info sshd[20835]: Did not receive identification string from 142.104.139.163 port 42060 but if you look very closely you will notice that there are 2 spaces in "sshd[20835]: Did" and in the original logged message there were 2 spaces preceding the word "Did". Has anyone seen this before (or currently with your own VMWare 6.5). I'm trying to figure out if this is a bug in syslog-ng or a bug in vCenter 6.5 or a config error on my systems. Thanks, Evan.

2 1

confgen not usable (by me) 3.13.2 on Redhat 7
by Evan Rempel 18 Feb '18

18 Feb '18

I am using the copr RPM build syslog-ng-3.13.2-3.el7.centos.x86_64 on a redhat 7 system. I am trying to use the confgen to create a value and use it in a rewrite. I realize that I can use $LOGHOST in this context but am using it as an example. @module confgen context(rewrite) name(z_myself) exec("/usr/bin/hostname") rewrite r_local { set( "z_myself()", value("HOST") ); }; log { source(local); rewrite(r_local); destination(d_var_syslog); }; d_var_syslog is any file destination to capture the log message. The above configuration actually sets the hostname in the log line to be "z_myself()". 2018-02-17T21:15:39.220-08:00 z_myself() solaris-cron.err erempel: just testing if I make the rewrite rewrite r_local { set( z_myself(), value("HOST") ); }; I get syntax errors. The top example works on redhat 6 with syslog-ng 3.9 I can't find any documentation on how to use a block (confgen) define in a rewrite statement. I have tried back ticks, $(z_myself()) macros "`z_myself()`" and any other combination but they all result in syslog-ng failing to start. What am I doing wrong? Evan.

2 1

Re: [syslog-ng] QuickQ syslog source drivers
by Balazs Scheidler 17 Feb '18

17 Feb '18

Yes, recent versions would accept normal bsd like messages. The key to watch out is the framing, as that needs to be correct. syslog(transport(tcp)) expects rfc5425 (or rfc5426, cant remember which) style framing network(transport(tcp) flags(syslog-protocol)) accepts both old and new formats without framing syslog(transport(udp)) has no framing, so again it accepts 5424 and 3164 and uses udp. Actually, we may want to imply flags(syslog-protocol) everywhere in the future, there's an easy way to autodetect the format. On Feb 16, 2018 21:31, "Scot" <scotrn(a)gmail.com> wrote: Will the syslog() source driver support both RFC5424 and RFC3164 from different hosts at the same time in flight? source s_syslog_tcp { syslog(port(514) transport("tcp")); }; source s_syslog_udp { syslog(port(514) transport("udp")); }; ____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0