- syslog-ng - lists.balabit.hu

laszlo_budai Key expired
by Clayton Dukes 25 Aug '17

25 Aug '17

Are you guys aware of this? W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/xUb… ./ Release: The following signatures were invalid: KEYEXPIRED 1503496621 W: Failed to fetch http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/xUb… The following signatures were invalid: KEYEXPIRED 1503496621 W: Some index files failed to download. They have been ignored, or old ones used instead. [id:image001.png@01D306E3.0FEBC990] Clayton Dukes Founder & CEO LogZilla Corporation 2900 N. Quinlan Park Rd, B240-341 Austin, TX, 78732 Tel: 936-4NetOps (463-8677) Web: www.logzilla.net<http://www.logzilla.net/> [id:image002.png@01D306E3.0FEBC990]<https://twitter.com/logzilla>[id:image003.png@01D306E3.0FEBC990]<https://youtu.be/drg5wv_mgfA>[id:image004.png@01D306E3.0FEBC990]<https://www.linkedin.com/in/lzcdukes/> For NetOps, By NetOps!

2 4

anyone know of a decent but easy to use syslog visualizer
by Smith, Paul (Sr. Admin-InfoSec) 23 Aug '17

23 Aug '17

Does anyone have a simple, easy to use, visualizer for syslogs that allows me to make new graphs quickly? I am in need of getting dashboards from syslog events to our executive teams. They don't know what information they want from these dashboards so I am trying to come up with some pretty graphs they can look at, and create new ones if they don't want that ones I do create. This way I can sketch things up quickly so they can see what can be graphed. We are a small team in a really big shop and I have many other responsibilities. I don't have the time to spend mucking about with this stuff all day. I'm trying to find a simple, easy to use visualizer that does not take me days to set up and configure. I've tried so many articles about setting up things like ELK and others, and have had a problem getting most of them to work. I spend half a day on each one and something is just not quite right because the build instructions are a month or more out of date and there is something that has changed in a dependency. Also, when trying to deal with creating logstash config files, I don't want to have to learn yet another config file syntax that I only need to touch 2-3 times per year. If I touch it at this frequency, I have to spend a day trying to remember what is what in the config file so I can make a new graph. Paul Smith InfoSec Those who don't study history are doomed to repeat it. Those who do study history are doomed to stand by helplessly while everyone else repeats it. Tom Toro

2 1

UDP devices stop logging after network services restart.
by Vincenti Francesco 23 Aug '17

23 Aug '17

Dear Janos I already sent an email with the data you requested that is under analysis from your moderators because it is too big. Anyway, every NIC has a number of dropped RX packages but either their number and their daily growth is not big enough to explain the amount of data lost. Further, netstat -su shows, under UDP, 1 packet receive errors only. I'm going to switch UDP devices again to log on not-working NIC (ens35 according data I've sent to you) to verify how many packages are lost in this case and I'll inform you about the results. Cheers Francesco Vincenti RHCSA Area Data Center Open Source, Quality and Security Aspasiel Divisione della Società Acciai Speciali Terni S.p.A. con Unico Socio Strada di Pentima, 3 - 05100 Terni francesco.vincenti(a)acciaiterni.it<mailto:francesco.vincenti@acciaiterni.it> www.aspasiel.it<http://www.aspasiel.it/> Ufficio: +39 0744 203224 Fax: +39 0744 203444 This e-mail and any attachments is a confidential correspondence intended only for use of the individual or entity named above. If you are not the intended recipient or the agent responsible for delivering the message to the intended recipient, you are hereby notified that any disclosure, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the error at the following email address: helpdesk(a)aspasiel.it<mailto:helpdesk@aspasiel.it> or at Aspasiel Helpdesk Team by phone (phone number +390744203555), and then delete this message from your system. P Please consider our environment and think before you print. Thank you! q

2 2

poll: which operating system do you use?
by Czanik, Péter 22 Aug '17

22 Aug '17

Hi, Here is my next poll: asking for which operating system you use to run syslog-ng. Cast your vote on Twitter at: https://twitter.com/PCzanik/status/899973381549895680 As the number of possible answers is limited by Twitter, if your choice of OS is missing, add it as a comment. The poll is anonymous, but of course comments are not. If you don't want to share your answer with the rest of the world but don't mind sharing with me, answer this e-mail and make sure that the address is set to my address instead of the list... Thanks for your help, Peter Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0

Syslog-NG and UTF-8 problem.
by Jason Long 22 Aug '17

22 Aug '17

Hello. I forward my Windows event logs to my Linux Box. I guess the Syslog-NG that I installed it on my Linux box can't support UFT-8 because when the file or folder names are English then I can't see them. In my Windows Box, I'm using "nxlog" that it support UTF-8. How can I add UTF-8 feature to my Syslog-NG on Linux? Thank you.

1 0

RFC: incubator is to be discontinued
by Scheidler, Balázs 14 Aug '17

14 Aug '17

Hi, We had a discussion with our Debian maintainer about the fate of syslog-ng-incubator. For those of you who don't know, it is a set of syslog-ng modules not integrated to syslog-ng master for one reason or another. It is available from here: https://github.com/balabit/syslog-ng-incubator The problem with this repository is that it is not really maintained, causing compilation and functionality issues down the line. So our opinion is to go ahead and integrate stuff that can be brough up to speed. Once we've done what we could, we would discontinue the incubator altogether. Please speak up now, if you disagree, but please also be ready to help us out in maintenance in that case. If there are no disagreements in the following week, we would start to phasing out the incubator. We welcome volunteers to: 1) migrate code, OR 2) help with testing If you are the user of any of those plugins, letting us know at this point also helps making sure that no functionality is lost. Thanks. -- Bazsi

4 4

syslog parser modified in git head
by Scheidler, Balázs 10 Aug '17

10 Aug '17

Hi, The pull request #1617 has just been merged, which adds a slight modification to the way we parse RFC3164 syslog messages, by adding support for IPV6 addresses in the host field. Since changing that parser always makes me nervous (lot's of heuristics to support a number of different logging formats), it would be great if any of you having "strange" logging formats (appliances in general, Cisco, F5, Juniper, Huawei, etc) devices could validate that we didn't break anything major. The change is pretty focused, e.g. we accept an IPV6 address as a hostname if it matches the general format of IPv6 addresses. But the interpretation of the ':' character has slightly changed. This could cause hostnames and program names to be parsed incorrectly. Any feedback would be appreciated. -- Bazsi

1 0

Re: [syslog-ng] RFC: incubator is to be discontinued
by Balazs Scheidler 03 Aug '17

03 Aug '17

Thanks for the feedback. On Aug 2, 2017 21:42, "Czanik, Péter" <peter.czanik(a)balabit.com> wrote: Hi, As far as I can see, the kafka-c module is definitely in active use. I added Pyr -- the original author of the kafka module -- on CC. In addition I see once in a while that people are asking about grok and zmq. On the other hand I'm not sure how much functional these modules are (AFAIR the the source part of the ZMQ module was never really finished) and the grok module builds on a C library which is not actively maintained for many years. I don't recall people mentioning any of the other modules recently. Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik On Sun, Jul 30, 2017 at 7:40 PM, Scheidler, Balázs < balazs.scheidler(a)balabit.com> wrote: > Hi, > > We had a discussion with our Debian maintainer about the fate of > syslog-ng-incubator. For those of you who don't know, it is a set of > syslog-ng modules not integrated to syslog-ng master for one reason or > another. > > It is available from here: > > https://github.com/balabit/syslog-ng-incubator > > The problem with this repository is that it is not really maintained, > causing compilation and functionality issues down the line. > > So our opinion is to go ahead and integrate stuff that can be brough up to > speed. Once we've done what we could, we would discontinue the incubator > altogether. > > Please speak up now, if you disagree, but please also be ready to help us > out in maintenance in that case. > > If there are no disagreements in the following week, we would start to > phasing out the incubator. > > We welcome volunteers to: > > 1) migrate code, OR > 2) help with testing > > If you are the user of any of those plugins, letting us know at this point > also helps making sure that no functionality is lost. > > Thanks. > > -- > Bazsi > > ____________________________________________________________ > __________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product= > syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > ____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

syslog-ng 3.11 on twitter
by Czanik, Péter 02 Aug '17

02 Aug '17

Hi, Please help spreading the word about the syslog-ng 3.11 also on Twitter. The syslog-ng OSE twitter account is available at https://twitter.com/sngose Please re-tweet one ore more of the following tweets: - 3.11 announcement: https://twitter.com/PCzanik/status/892315446325776386 - 3.11 documentation: https://twitter.com/PCzanik/status/892742991080763392 Depending on your Linux distribution preferences, there are also tweets about unofficial 3.11 packages: - fedora/RHEL7: https://twitter.com/PCzanik/status/892666279437271040 - openSUSE/SLES12: https://twitter.com/PCzanik/status/892648387400609793 - Debian/Ubuntu: https://twitter.com/PCzanik/status/892763031666556929 Tweets are from my own account, but you should follow @sngOSE account: https://twitter.com/sngose Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0

syslog-ng 3.11.1 resources
by Czanik, Péter 02 Aug '17

02 Aug '17

Hi, Version 3.11.1 of syslog-ng OSE was released yesterday. Here I try to compile a list of useful resources in a hope that it does not end up in your spam folder due to the excess amount of URLs :) - List of new features and bugfixes: https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.11.1 - source tgz: https://github.com/balabit/syslog-ng/releases/download/syslog-ng-3.11.1/sys… - unofficial Debian / Ubuntu packages: https://www.balabit.com/blog/installing-the-latest-syslog-ng-on-ubuntu-and-… - unofficial openSUSE / fedora / SLES / RHEL packages: https://www.balabit.com/blog/installing-latest-syslog-ng-on-rhel-and-other-… - documentation as single page HTML: https://www.balabit.com/documents/syslog-ng-ose-3.11-guides/en/syslog-ng-os… - for other formats go to https://www.balabit.com/support/documentation Choose “syslog-ng Open Source Edition” as product, select your version and your preferred format (single or multi-page HTML or PDF) For generic syslog-ng information go to https://syslog-ng.org/ Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0