- syslog-ng - lists.balabit.hu

How does syslog-ng detect the availability of the remote end
by Grant Guo 03 Apr '24

03 Apr '24

Hi, Recently I am using syslog-ng’s docker container as syslog generator as the following: docker run -d \ --cpus=2 \ --name $name \ -v ${PWD}/syslog.log:/data/syslog.log \ --entrypoint="" \ --network=host \ balabit/syslog-ng:latest \ /usr/bin/loggen --dgram --inet --dont-parse --loop-reading --size 8192 --rate $rate --interval $duration --read-file /data/syslog.log $ip 514 I found something interesting, if my syslog server stopped, the client syslog-ng containers stopped too. So I would like to know if syslog-ng detected the availability of the remote end? If so, how? Besides, I didn’t see ICMP packets between the client and server using tcpdump. Thanks Grant *** Please note that this message and any attachments may contain confidential and proprietary material and information and are intended only for the use of the intended recipient(s). If you are not the intended recipient, you are hereby notified that any review, use, disclosure, dissemination, distribution or copying of this message and any attachments is strictly prohibited. If you have received this email in error, please immediately notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed. Please also note that any views, opinions, conclusions or commitments expressed in this message are those of the individual sender and do not necessarily reflect the views of Fortinet, Inc., its affiliates, and emails are not binding on Fortinet and only a writing manually signed by Fortinet's General Counsel can be a binding commitment of Fortinet to Fortinet's customers or partners. Thank you. ***

1 0

The syslog-ng Insider 2024-03: MacOS; OpenTelemetry;
by Peter Czanik (pczanik) 14 Mar '24

14 Mar '24

Dear syslog-ng users, This is the 118th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Native MacOS source in syslog-ng -------------------------------- You know that support for MacOS is important when every third visitor at the syslog-ng booth of Red Hat Summit asks if syslog-ng works on MacOS. With the upcoming syslog-ng version 4.6.0, syslog-ng not only compiles on MacOS, but it also collects local log messages natively. >From this blog you can learn how to compile syslog-ng yourself, options of the MacOS source, and also a bit of history. https://www.syslog-ng.com/community/b/blog/posts/native-macos-source-in-sys… Using OpenTelemetry between syslog-ng instances ----------------------------------------------- Do you have to forward large amounts of logs between two syslog-ng instances? OTLP (OpenTelemetry protocol) support in syslog-ng can solve this problem. Just like the ewmm() destination, syslog-ng-otlp() forwards most name-value pairs, however, unlike a tcp() connection, it scales well with multiple CPU cores. Support for OpenTelemetry was added to syslog-ng a couple of releases ago. OpenTelemetry is an observability framework, mainly used in Linux / Cloud / Kubernetes environments. However, I already had users asking to make this feature available on FreeBSD. (It already worked once, but now it fails to compile again.) Version 4.6.0 added many new OTLP-related enhancements. Batching and multiple workers make OTLP connections significantly faster, while compression can save you bandwidth at the expense of some more CPU usage. This changes the syslog-ng-otlp() destination from an interesting experiment into something really useful. It enables you to send a lot more log messages between two syslog-ng instances than with a tcp() connection, while using less bandwidth. https://www.syslog-ng.com/community/b/blog/posts/using-opentelemetry-betwee… Collecting even more logs on MacOS using syslog-ng -------------------------------------------------- Version 4.6.0 of syslog-ng features not just a new, native log collector for MacOS, but also darwin-oslog-stream(), which can also collect non-persistent log events. Beware that it can collect many megabytes of logs even in just a few minutes! However, if you need to debug MacOS, these logs might come handy. https://www.syslog-ng.com/community/b/blog/posts/collecting-even-more-logs-… WEBINARS * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng service keeps restarting on systemd
by Darren Fuller 29 Feb '24

29 Feb '24

Hello, I have installed syslog-ng OSE from source on Amazon Linux 2023 distribution (as there is no EPEL available on that distribution nor are there any precompiled binaries for it) When i start up syslog-ng in the local terminal with syslog-ng -Fedv , it runs fine forever.. But when i start it with systemd : systemctl start syslog-ng, the command times out (but does start in the background) and then it the service restarts every two minutes or so. I am stumped. any thoughts? where have i gone wrong? appreciate any assistance you can offer. thanks, Darren More information: ------------ i compiled with the following and saw no errors: > ./configure --disable-smtp --disable-http --disable-python --disable-json > make > make install ------------ I created the systemd service file as so: > cat /etc/systemd/system/syslog-ng.service [Unit] Description=System Logger Daemon Documentation=man:syslog-ng(8) After=network.target [Service] Type=notify PIDFile=/run/syslogd.pid ExecStart=/usr/local/sbin/syslog-ng -F -p /run/syslogd.pid ExecReload=/bin/kill -HUP $MAINPID StandardOutput=null Restart=on-failure [Install] WantedBy=multi-user.target ------------ My config is here: ------------ > cat /usr/local/etc/syslog-ng.conf @include “scl.conf” source s_local { system(); internal(); }; destination d_local { file(“/var/log/messages”); file(“/var/log/messages-kv.log” template(“$ISODATE $HOST $(format-welf --scope all-nv-pairs)\n”) frac-digits(3)); }; log { source(s_local); destination(d_local); }; @include /etc/syslog-ng.d/*.conf > cat /etc/syslog.d/syslognet.conf options { long_hostnames(off); sync(0); keep_hostname(yes); owner(“splunk”); group(“splunk”); perm(0640); create_dirs(yes); dir_perm(0750); }; source s_tcp_net { tcp(ip(0.0.0.0) port(41514)); }; source s_tls_net { network ( ip(0.0.0.0) port(42514) transport(“tls”) tls( key-file(“/path/to/syslog-ng.key”) cert-file(“/path/to/syslog-ng.crt”) peer-verify(no) ) ); }; destination d_net { file(“/data/syslog/app/${SOURCEIP}/${YEAR}${MONTH}${DAY}-app-data.log”); }; log { source(s_tcp_net); source(s_tls_net); destination(d_net); }; ------------ Here is what i see when i start it with systemd: > systemctl start syslog-ng Job for syslog-ng.service failed because a timeout was exceeded. See “systemctl status syslog-ng.service” and “journalctl -xeu syslog-ng.service” for details. > systemctl status syslog-ng.service syslog-ng.service - System Logger Daemon Loaded: loaded (/etc/systemd/system/syslog-ng.service; enabled; preset: enabled) Active: activating (start) since Wed 2024-02-28 15:25:01 UTC; 35s ago Docs: man:syslog-ng(8) Main PID: 488557 (syslog-ng) Tasks: 4 (limit: 2322) Memory: 2.5M CPU: 39ms CGroup: /system.slice/syslog-ng.service └─488557 /usr/local/sbin/syslog-ng -F -p /run/syslogd.pid Feb 28 15:25:01 ip-172-31-7-110.ca-central-1.compute.internal systemd[1]: Starting syslog-ng.service - System Logger Daemon... ------------ And here is what's in /var/log/messages showing the restart: > cat /var/log/messages | grep syslog-ng Feb 28 14:38:24 ip-172-31-7-110 syslog-ng[447117]: syslog-ng shutting down; version=‘4.6.0’ Feb 28 14:38:25 ip-172-31-7-110 syslog-ng[447177]: syslog-ng starting up; version=‘4.6.0’ Feb 28 14:38:26 ip-172-31-7-110 syslog-ng[447177]: Syslog connection accepted; fd=‘26’, client=‘AF_INET(1.2.3.4:27717)’, local=‘AF_INET(0.0.0.0:41514)’ Feb 28 14:38:26 ip-172-31-7-110 syslog-ng[447177]: Syslog connection accepted; fd=‘27’, client=‘AF_INET(1.2.3.4:2300)’, local=‘AF_INET(0.0.0.0:41514)’ Feb 28 14:38:26 ip-172-31-7-110 syslog-ng[447177]: Syslog connection accepted; fd=‘28’, client=‘AF_INET(1.2.3.4:31585)’, local=‘AF_INET(0.0.0.0:41514)’ Feb 28 14:38:26 ip-172-31-7-110 syslog-ng[447177]: Syslog connection accepted; fd=‘29’, client=‘AF_INET(1.2.3.4:17761)’, local=‘AF_INET(0.0.0.0:41514)’ Feb 28 14:39:55 ip-172-31-7-110 syslog-ng[447177]: syslog-ng shutting down; version=‘4.6.0’ Feb 28 14:39:55 ip-172-31-7-110 syslog-ng[447234]: syslog-ng starting up; version=‘4.6.0’ Feb 28 14:39:56 ip-172-31-7-110 syslog-ng[447234]: Syslog connection accepted; fd=‘25’, client=‘AF_INET(1.2.3.4:7213)’, local=‘AF_INET(0.0.0.0:41514)’ Feb 28 14:39:56 ip-172-31-7-110 syslog-ng[447234]: Syslog connection accepted; fd=‘26’, client=‘AF_INET(1.2.3.4:9268)’, local=‘AF_INET(0.0.0.0:41514)’ Feb 28 14:39:56 ip-172-31-7-110 syslog-ng[447234]: Syslog connection accepted; fd=‘27’, client=‘AF_INET(1.2.3.4:13128)’, local=‘AF_INET(0.0.0.0:41514)’ Feb 28 14:39:56 ip-172-31-7-110 syslog-ng[447234]: Syslog connection accepted; fd=‘28’, client=‘AF_INET(1.2.3.4:3928)’, local=‘AF_INET(0.0.0.0:41514)’ Feb 28 14:41:25 ip-172-31-7-110 syslog-ng[447234]: syslog-ng shutting down; version=‘4.6.0’ Feb 28 14:41:26 ip-172-31-7-110 syslog-ng[447385]: syslog-ng starting up; version=‘4.6.0’ Feb 28 14:41:27 ip-172-31-7-110 syslog-ng[447385]: Syslog connection accepted; fd=‘25’, client=‘AF_INET(1.2.3.4:1382)’, local=‘AF_INET(0.0.0.0:41514)’ Feb 28 14:41:27 ip-172-31-7-110 syslog-ng[447385]: Syslog connection accepted; fd=‘26’, client=‘AF_INET(1.2.3.4:5430)’, local=‘AF_INET(0.0.0.0:41514)’ Feb 28 14:41:27 ip-172-31-7-110 syslog-ng[447385]: Syslog connection accepted; fd=‘27’, client=‘AF_INET(1.2.3.4:6373)’, local=‘AF_INET(0.0.0.0:41514)’ Feb 28 14:41:27 ip-172-31-7-110 syslog-ng[447385]: Syslog connection accepted; fd=‘28’, client=‘AF_INET(1.2.3.4:26287)’, local=‘AF_INET(0.0.0.0:41514)’ Feb 28 14:42:56 ip-172-31-7-110 syslog-ng[447385]: syslog-ng shutting down; version=‘4.6.0’ Feb 28 14:42:56 ip-172-31-7-110 syslog-ng[447443]: syslog-ng starting up; version=‘4.6.0’ Feb 28 14:42:57 ip-172-31-7-110 syslog-ng[447443]: Syslog connection accepted; fd=‘25’, client=‘AF_INET(1.2.3.4:15165)’, local=‘AF_INET(0.0.0.0:41514)’ Feb 28 14:42:57 ip-172-31-7-110 syslog-ng[447443]: Syslog connection accepted; fd=‘26’, client=‘AF_INET(1.2.3.4:6967)’, local=‘AF_INET(0.0.0.0:41514)’ Feb 28 14:42:57 ip-172-31-7-110 syslog-ng[447443]: Syslog connection accepted; fd=‘27’, client=‘AF_INET(1.2.3.4:27444)’, local=‘AF_INET(0.0.0.0:41514)’ Feb 28 14:42:57 ip-172-31-7-110 syslog-ng[447443]: Syslog connection accepted; fd=‘28’, client=‘AF_INET(1.2.3.4:20758)’, local=‘AF_INET(0.0.0.0:41514)’

3 2

running RHEL 9
by Linn, William 19 Feb '24

19 Feb '24

Has anyone seen any issues with syslog-ng running on RHEL 9? Any pointers, caveats? Thanks William ---------------------------------------------------------------------- This message, and any attachment(s), is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.bankofamerica.com/electronic-disclaimer. If you are not the intended recipient, please delete this message. For more information about how Bank of America protects your privacy, including specific rights that may apply, please visit the following pages: https://business.bofa.com/en-us/content/global-privacy-notices.html (which includes global privacy notices) and https://www.bankofamerica.com/security-center/privacy-overview/ (which includes US State specific privacy notices such as the http://www.bankofamerica.com/ccpa-notice)

3 3

The syslog-ng Insider 2024-02: OpenObserve; configuration check; build services;
by Peter Czanik (pczanik) 15 Feb '24

15 Feb '24

Dear syslog-ng users, This is the 117th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Version 4.5.0 of syslog-ng is now available with OpenObserve JSON API support ------------------------------------------------ Recently, syslog-ng 4.5.0 was released with many new features. These include sending logs to OpenObserve using its JSON API, support for Google Pub/Sub, a new macro describing message transport mechanisms like RFC 3164 + TCP, an SSL option to ignore validity periods, and many more. You can find a full list of new features and bug fixes in the release notes at: https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.5.0 In this blog, you can find some pointers on how to install the very latest syslog-ng version and learn how you can configure syslog-ng to use the OpenObserve JSON API. https://www.syslog-ng.com/community/b/blog/posts/version-4-5-0-of-syslog-ng… Syslog-ng PE can now send logs to Google BigQuery ------------------------------------------------- Version 7.0.34 of syslog-ng PE can now send logs to Google BigQuery destinations. You can learn more about how it works from the syslog-ng PE documentation: https://support.oneidentity.com/technical-documents/syslog-ng-premium-editi… Syslog-ng can now do a full configuration check ----------------------------------------------- One of the most frequent syslog-ng feature requests is now resolved. Welcome the --check-startup option, allowing you to check the syntax and also spot spelling mistakes! https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-can-now-do-a-ful… How build services make life easier for upstream developers ----------------------------------------------------------- Many Linux distributions provide build services under various names: openSUSE Build Service (OBS), Fedora Copr, and so on. These resources are indispensable for upstream developers, and also for their users. I will demonstrate this through some examples from the syslog-ng project. Note: this blog is loosely based on a talk idea I had for the FOSDEM Distributions Devroom. There is no deep technical information about syslog-ng in this blog. This is more like a history of syslog-ng packaging, and how the fantastic tools by openSUSE and Fedora made it a lot easier and made me an active part of these communities. https://www.syslog-ng.com/community/b/blog/posts/how-build-services-make-li… WEBINARS * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

The syslog-ng Insider 2024-01: HTTP; Cloudflare; systemd-journal; Humio / Logscale;
by Peter Czanik (pczanik) 18 Jan '24

18 Jan '24

Dear syslog-ng users, This is the 116th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Why use a http()-based destination in syslog-ng? ------------------------------------------------ Logging is not just syslog anymore. Still, many syslog-ng users stick to using one of the syslog protocols for log transport and flat files for log storage. While most SIEMs and log analytics tools can receive syslog messages or read them using their own agents, in most cases, you can use the http() destination of syslog-ng as well to send logs to them. You gain extreme performance and an architecture that is easier to maintain. Some of the drivers in syslog-ng built on top of the http() destination include elasticsearch-http() destination for sending logs to Elasticsearch / OpenSearch. Many other services utilizing the Elasticsearch Bulk API exist, and there are also others using Sumo Logic, Splunk, and so on. Of course, there are some destinations where performance is not a major concern (or can even be a drawback, in fact). For example,various instant messaging services used for alerting (like Telegram or Slack) belong in this category. You can also read the API docs and write a new destination based on http() yourself. https://www.syslog-ng.com/community/b/blog/posts/why-use-a-http--based-dest… An overview of Cloudflare's logging pipeline -------------------------------------------- One of the roles of Cloudflare's Observability Platform team is managing the operation, improvement, and maintenance of our internal logging pipelines. These pipelines are used to ship debugging logs from every service across Cloudflare’s infrastructure into a centralised location, allowing our engineers to operate and debug their services in near real time. In this post, we’re going to go over what that looks like, how we achieve high availability, and how we meet our Service Level Objectives (SLOs) while shipping close to a million log lines per second. https://blog.cloudflare.com/an-overview-of-cloudflares-logging-pipeline/ Working with multiple systemd-journal namespaces in syslog-ng ------------------------------------------------------------- Initial support for systemd-journal namespaces is available in syslog-ng 3.29. However, only version 4.4.0 allows you to work with multiple namespaces in your syslog-ng configuration. So, what changed in the latest version of syslog-ng? Previously, you could only configure a single systemd-journal() source in syslog-ng. By default, it collected logs from all namespaces, but you could configure it to collect log messages from a single one exclusively. This means that logs from other namespaces could not be collected by syslog-ng. Version 4.4.0 allows you to use multiple systemd-journal() source drivers in the configuration, as long as each source uses a unique namespace. https://www.syslog-ng.com/community/b/blog/posts/working-with-multiple-syst… Logging to Humio / Logscale simplified in syslog-ng --------------------------------------------------- Logging into Humio (which was recently re-branded to Falcon LogScale) was available for years, using their Elasticsearch compatible API. However, according to Humio developers, it is slightly slower than other APIs for log ingestion. Axoflow contributed a Logscale destination to syslog-ng, which uses Logscale’s native API. I did not measure if there is really a performance difference, however it is definitely easier to configure it. WEBINARS * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Syslog-ng Not Working properly
by Sumanta Banerjee 15 Jan '24

15 Jan '24

Hi Team, I am trying to configure syslog-ng in one our linux instance to get NGIPS/FMC data via udp connection on its default port (514). I have configured syslog-ng.conf under /etc/syslog-ng and then we have set SE Linux as Permissive. I am using RHEL 8.7 and syslog version 4.0. Apparently all looked good to me however while checking in the destination path that is mentioned I don't see any directory or logfile from for the said udp connection got created. Below is our observation and steps that we executed, can any of you please help me telling where I went wrong or if I am missing something, there is another testing in pipeline that is stalled for this - 1. Define source, destination and log_file in syslog-ng.conf (file attached). 2. Run the below SELinux command - # ausearch -c 'syslog-ng' --raw | audit2allow -M my-syslogng # semodule -X 300 -i my-syslogng.pp 1. Restart syslog-ng service - # systemctl restart syslog-ng.service (no error message received) 1. Check if the service is running - [cid:image002.png@01D99309.5147A9A0] 1. Check if syslog-ng is listening to udp port 514 - [cid:image003.png@01D99309.5147A9A0] 1. Checked and we have incoming data stream from source using the below command - tcpdump -i any -c10 -nn -A port 514 1. I have went through the syslog-ng troubleshooting steps mentioned in the link - https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edi… [cid:image004.png@01D9930B.D0B70940] syslog-ng -Fdev command output is also attached. 1. While running the following command got the below output - # watch '/usr/sbin/syslog-ng-ctl stats | grep "^center"' [cid:image005.png@01D99311.15E497D0] 1. # journaltctl command output (first 500 lines) attached 1. Current SE Linux status : [cid:image006.png@01D9931C.B8765370] 1. Our syslog-ng is logging to /var/log/messages and we are getting this message in /var/log/messages - [cid:image007.png@01D9931E.592725A0] Thanks & Regards, Sumanta Banerjee Splunk Admin | CISO | Aviva Group Tel: +91-8420892593 24x7x365: +44 1603 208 582 sumanta.banerjee(a)aviva.com<mailto:sumanta.banerjee@aviva.com> GlobalCyberSecurityEngineeringTeam(a)aviva.com<mailto:GlobalCyberSecurityEngineeringTeam@aviva.com> www.aviva.com<http://www.aviva.com> Wipro Technologies - SJP2, Bangalore, India [cid:image001.gif@01D99303.20AF3AC0] Aviva: Internal Aviva plc, registered Office: St. Helen's, 1 Undershaft, London EC3P 3DQ. Registered in England No. 02468686. www.aviva.com This message and any attachments may be confidential or legally privileged. If you are not the intended recipient, please telephone or e-mail the sender and delete this message and any attachments from your system. Also, if you are not the intended recipient you must not copy this message or attachments or disclose the contents to any other person. Any views or opinions expressed are solely those of the author and do not necessarily represent those of Aviva.

2 4

Critical Severity Security Advisory: Apache Struts Vulnerability CVE-2023-50164
by Mayekar, PrachiX 16 Dec '23

16 Dec '23

Hi Team, Can you please confirm whether Syslog is affected by this vulnerability: Critical Severity Security Advisory: Apache Struts Vulnerability CVE-2023-50164 Thanks & Regards, Prachi Mayekar ITI-Network Services A Contingent Worker at Intel For assistance, please visit us at https://it.intel.com<https://it.intel.com/>

3 2

Insider 2023-12: compressed HTTP; packages; OpenObserve; duplicates;
by Peter Czanik (pczanik) 14 Dec '23

14 Dec '23

Dear syslog-ng users, This is the 115th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Compressing HTTP traffic in syslog-ng ------------------------------------- Network traffic is expensive in the cloud, and even a single syslog-ng instance can easily saturate the full bandwidth of a network connection. Compressing HTTP traffic was introduced in syslog-ng Version 4.4.0 and depending on your use case, you can cut down on your expenses on your networking or send more logs using the same budget or bandwidth. Development of this feature was done using a locally installed OpenResty web server, and later tested using Sumologic. However, according to the docs it should also work with Splunk, Elasticsearch, and many other services accessible using the http() destination. https://www.syslog-ng.com/community/b/blog/posts/compressing-http-traffic-i… Why is a feature not available in the syslog-ng package? -------------------------------------------------------- You can read about many interesting syslog-ng features in my blogs. However, it can happen that when you want to try them at home, you fail because the feature is missing. How can you solve such problems? In this blog, I discuss some of the possible solutions from installing sub-packages through using unofficial repositories, to upgrading your OS. This blog focuses on RPM packages for openSUSE / SLES, Fedora / RHEL, and FreeBSD, because these are the packages I know – I am their maintainer. However, these problems and their solutions also apply to Debian / Ubuntu, and other Linux distributions. https://www.syslog-ng.com/community/b/blog/posts/why-is-a-feature-not-avail… Sending logs to OpenObserve using syslog-ng ------------------------------------------- A question was asked if syslog-ng can send logs to OpenObserve. It has an Elasticsearch compatible API for log ingestion, but syslog-ng is not mentioned in the documentation. My plan was to document how to modify the syslog-ng elasticsearch-http() destination, based on API documentation. However, as it turned out, OpenObserve has a ready to use syslog-ng configuration example in the web UI. https://www.syslog-ng.com/community/b/blog/posts/sending-logs-to-openobserv… Removing duplicate messages with syslog-ng in a redundant logging environment ----------------------------- Creating highly available servers is difficult. Sending logs to two (or more) servers and hoping that at least one of them can collect logs any time is a lot easier. Since network traffic and storage are cheap, redundancy is usually not a problem. However, once you also want to analyze your log messages using a SIEM or other software, you do not want duplicate log messages. In this blog, I show you how you can make sure that each log message produced on your network reaches your SIEM system only once. Sending logs to a SIEM is expensive: both resource usage and licensing costs are much higher than at the log management level. https://www.syslog-ng.com/community/b/blog/posts/removing-duplicate-message… WEBINARS * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng 4.5.0
by Attila Szakács 30 Nov '23

30 Nov '23

Dear syslog-ng users, We are pleased to announce the 4.5.0 version of syslog-ng, which has been released and is now available on GitHub: https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.5.0 Packages <https://github.com/syslog-ng/syslog-ng#installation-from-binaries> are also available for various platforms. The AxoSyslog project provides cloud-ready container images <https://axoflow.com/cloud-ready-syslog-ng-images/>, Helm charts <https://axoflow.com/axosyslog-log-collection-for-kubernetes/>. 4.5.0 Read Axoflow's blog post <https://axoflow.com/axosyslog-release-4-5/> for more details. You can read more about the new features in the AxoSyslog documentation <https://axoflow.com/docs/axosyslog-core/>. HighlightsSending log messages to OpenObserve The openobserve-log() destination feeds OpenObserve via the JSON API <https://openobserve.ai/docs/api/ingestion/logs/json/>. Example config: openobserve-log( url("http://openobserve-endpoint") port(5080) stream("default") user("root(a)example.com") password("V2tsn88GhdNTKxaS") ); (#4698 <https://github.com/syslog-ng/syslog-ng/pull/4698>) Sending messages to Google Pub/Sub The google-pubsub() destination feeds Google Pub/Sub via the HTTP REST API <https://cloud.google.com/pubsub/docs/reference/rest/v1/projects.topics/publ…> . Example config: google-pubsub( project("syslog-ng-project") topic("syslog-ng-topic") auth( service-account( key("/path/to/service-account-key.json") ) ) ); See the Google Pub/Sub documentation <https://cloud.google.com/pubsub/docs/building-pubsub-messaging-system> to learn more about configuring a service account. (#4651 <https://github.com/syslog-ng/syslog-ng/pull/4651>) Parsing PostgreSQL logs The postgresql-csvlog-parser(): add a new parser to process CSV log formatted by PostgreSQL ( https://www.postgresql.org/docs/current/runtime-config-logging.html) The CSV format is extracted into a set of name-value pairs. (#4586 <https://github.com/syslog-ng/syslog-ng/pull/4586>) Features - http(): Added support for using templates in the url() option. In syslog-ng a template can only be resolved on a single message, as the same template might have different resolutions on different messages. A http batch consists of multiple messages, so it is not trivial to decide which message should be used for the resolution. When batching is enabled and multiple workers are configured it is important to only batch messages which generate identical URLs. In this scenario one must set the worker-partition-key() option with a template that contains all the templates used in the url() option, otherwise messages will be mixed. For security reasons, all the templated contents in the url() option are getting URL encoded automatically. Also the following parts of the url cannot be templated: - scheme - host - port - user - password (#4663 <https://github.com/syslog-ng/syslog-ng/pull/4663>) - $TRANSPORT: this is a new name-value pair that syslog-ng populates automatically. It indicates the "transport" mechanism used to retrieve/receive the message. It is up to the source driver to determine the value. Currently the following values were implemented: BSD syslog drivers: tcp(), udp() & network() - rfc3164+tls - rfc3164+tcp - rfc3164+udp - rfc3164+proxied-tls - rfc3164+<custom logproto like altp> UNIX domain drivers: unix-dgram(), unix-stream() - unix-stream - unix-dgram RFC5424 style syslog: syslog(): - rfc5426: syslog over udp - rfc5425: syslog over tls - rfc6587: syslog over tcp - rfc5424+<custom logproto like altp>: syslog over a logproto plugin Other drivers: - otlp: otel() driver - mqtt: mqtt() driver - hypr-api: hypr-audit-source() driver $IP_PROTO: indicate the IP protocol version used to retrieve/receive the message. Contains either "4" to indicate IPv4 and "6" to indicate IPv6. (#4673 <https://github.com/syslog-ng/syslog-ng/pull/4673>) - network() and syslog() drivers: Added ignore-validity-period as a new flag to ssl-options(). By specifying ignore-validity-period, you can ignore the validity periods of certificates during the certificate validation process. (#4642 <https://github.com/syslog-ng/syslog-ng/pull/4642>) - tls() in udp()/tcp()/network() and syslog() drivers: add support for a new http() compatible ssl-version() option. This makes the TLS related options for http() and other syslog-like drivers more similar. This requires OpenSSL 1.1.0. (#4682 <https://github.com/syslog-ng/syslog-ng/pull/4682>) - cloud-auth(): Added a new plugin for drivers, which implements different cloud related authentications. Currently the only supported authentication is GCP's Service Account <https://cloud.google.com/iam/docs/service-account-overview> for the http() destination. Example config: http( cloud-auth( gcp( service-account( key("/path/to/service-account-key.json") audience("https://pubsub.googleapis.com/google.pubsub.v1.Publisher") ) ) ) ); (#4651 <https://github.com/syslog-ng/syslog-ng/pull/4651>) - csv-parser(): allow parsing the extracted values into matches ($1, $2, $3 ...) by omitting the columns() parameter, which normally specifies the column names. (#4678 <https://github.com/syslog-ng/syslog-ng/pull/4678>) - --check-startup: a new command line option for syslog-ng along with the existing --syntax-only. This new option will do a complete configuration initialization and then exit with exit code indicating the result. Since this also initializes things like network listeners, it will probably *not* work when there is another syslog-ng instance running in the background. The recommended use of this option is a dedicated config check container, as explained in #4592 <https://github.com/syslog-ng/syslog-ng/issues/4592>. (#4646 <https://github.com/syslog-ng/syslog-ng/pull/4646>) Bugfixes - s3: Fixed an ImportError. ImportError: cannot import name 'SharedBool' from 'syslogng.modules.s3.s3_object' (#4700 <https://github.com/syslog-ng/syslog-ng/pull/4700>) - loki(): fixed mixing non-related label values (#4713 <https://github.com/syslog-ng/syslog-ng/pull/4713>) - type hinting: Parsing and casting fractions are now done locale independently. (#4702 <https://github.com/syslog-ng/syslog-ng/pull/4702>) - metrics-probe(): Fixed a crash. This crash occurred when a metrics-probe() instance was used in multiple source threads, like a network() source with multiple connections. (#4685 <https://github.com/syslog-ng/syslog-ng/pull/4685>) - flags() argument to various drivers: fix a potential crash in case a flag with at least 32 characters is used. No such flag is defined by syslog-ng, so the only way to trigger the crash is to use an invalid configuration file. (#4689 <https://github.com/syslog-ng/syslog-ng/pull/4689>) - Fix $PROTO value for transport(tls) connections, previously it was set to "0" while in reality these are tcp connections (e.g. "6"). Fix how syslog-ng sets $HOST for V4-mapped addresses in case of IPv6 source drivers (e.g. udp6()/tcp6() or when using ip-protocol(6) for tcp()/udp() ). Previously V4-mapped addresses would be represented as "::ffff:<ipv4 address>". This is not wrong per-se, but would potentially cause the same host to be represented in multiple ways. With the fix, syslog-ng would just use "<ipv4 address>" in these cases. (#4673 <https://github.com/syslog-ng/syslog-ng/pull/4673>) - db-parser(): support nested match characters in @QSTRING@ pattern parser (#4717 <https://github.com/syslog-ng/syslog-ng/pull/4717>) Other changes - LogSource and LogFetcher: additional documentation was added to these Python classes to cover explicit source-side batching functionalities (e.g. the auto_close_batch attribute and the close_batch() method). (#4673 <https://github.com/syslog-ng/syslog-ng/pull/4673>) - rate-limit(): Renamed the template() option to key(), which better communicates the intention. (#4679 <https://github.com/syslog-ng/syslog-ng/pull/4679>) - templates: The template-escape() option now only escapes the top-level template function. Before syslog-ng 4.5.0 if you had embedded template functions, the template-escape(yes) setting escaped the output of each template function, so the parent template function received an already escaped string. This was never the intention of the template-escape() option. Although this is a breaking change, we do not except anyone having a config that is affected. If you have such a config, make sure to follow-up this change. If you need help with it, feel free to open an issue or discussion on GitHub, or contact us on the Axoflow Discord server. (#4666 <https://github.com/syslog-ng/syslog-ng/pull/4666>) - loki(): The timestamp() option now supports quoted strings. The valid values are the following, with or without quotes, case insensitive: - "current" - "received" - "msg" (#4688 <https://github.com/syslog-ng/syslog-ng/pull/4688>) syslog-ng Discord For a bit more interactive discussion, join our Discord server: [image: Axoflow Discord Server] <https://discord.gg/E65kP9aZGm> Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Attila Szakacs, Balazs Scheidler, Cedric Arickx, Fabrice Fontaine, Hofi, László Várady, Romain Tartière, Szilard Parrag, yashmathne

1 0