- syslog-ng - lists.balabit.hu

syslog-ng vs pcre2 without jit vs disable-jit config feature
by "Tóth Attila" 27 Nov '23

27 Nov '23

I'm using syslog-ng-4.4.0 on a Gentoo system, that also employs PaX hardening. Due to the necessity to elevate restrictions on pcre2 with jit enabled, I keep it disabled for this particular installation. Syslog-ng emits error messages during startup complaining about pcre2 and jit. I had studied the manual and found the disable-jit feature. https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edi… Maybe I'm using a wrong syntax, but syslog-ng doesn't seem to respect the option. Commenting out the jit feature in the source code works, but it would be much more comfortable to find the proper way to disable jit. Are there any other who managed to use disable-jit in action? Are there any tips or tricks aboutv what to pay attention on? Thx: Dw. -- dr Tóth Attila, Radiológus, 06-20-825-8057 Attila Toth MD, Radiologist, +36-20-825-8057

2 6

New install
by Klimek, Bryan J. 16 Nov '23

16 Nov '23

We've been using Syslog-ng for a long time. Our current deployment is on Red Hat 7 servers that we built 6 years ago. It's time to start a refresh of our Syslog-ng environment. Our plan is to use Red Hat 9 servers. Can you give me a jumping off point on where to obtain installation instructions and how to obtain the installation media. Thank you. Bryan Klimek IT Systems Architect I EIS Application Hosting Services E-mail: klimek.bryan(a)mayo.edu<mailto:klimek.bryan@mayo.edu>

2 1

Insider 2023-11: Splunk; configuration; journald;
by Peter Czanik (pczanik) 14 Nov '23

14 Nov '23

Dear syslog-ng users, This is the 114th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Sending logs to Splunk using syslog-ng -------------------------------------- There are many ways you can collect log messages using syslog-ng and forward them to Splunk. In this blog I collect the history of Splunk support in syslog-ng, and the advantages and disadvantages of various solutions, both open source and commercial. https://www.syslog-ng.com/community/b/blog/posts/sending-logs-to-splunk-usi… Developing a syslog-ng configuration ------------------------------------ This year I started publishing a syslog-ng tutorial series both on my blog and on YouTube: https://peter.czanik.hu/posts/syslog-ng-tutorial-toc/ And while the series was praised as the best possible introduction to syslog-ng, viewers also mentioned that one interesting element is missing from it: namely, it does not tell users how to develop a syslog-ng configuration. So, in this blog, learn how to develop a syslog-ng configuration from the ground up! I will explain not just the end result, but also the process and the steps to take to develop a configuration. It starts with a single source and destination, then concludes with a conditional log path and sending parsed and enriched logs to Elasticsearch (or a compatible document store). https://www.syslog-ng.com/community/b/blog/posts/developing-a-syslog-ng-con… Systemd-journald vs. syslog-ng ------------------------------ Even if most people ask me to compare systemd-journald vs. syslog-ng, I would say that they complement each other. Systemd-journald excels at collecting local log messages, including those of various system services. The focus of syslog-ng is on central log collection and forwarding the logs to a wide variety of destinations after processing and filtering. Combining the two gives you the most flexibility. https://www.syslog-ng.com/community/b/blog/posts/systemd-journald-vs-syslog… WEBINARS * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Custom script with map-value-pairs(pair(<script>))
by Faisal Chishti 18 Oct '23

18 Oct '23

Hi, I am trying to capture some custom information using a simple shell script. I am trying below but getting an error. Below is my parser, it works fine without the line that has custom_script_output. How do I get this to work? parser p_cr_syslog { # Convert the LEVEL field to uppercase. map-value-pairs(pair("jcnr.header.logLevel", "$(uppercase $LEVEL)")); map-value-pairs(pair("jc.header.custom_script_output", "$(script("/path/to/script.sh"))")); syslog-parser(flags(syslog-protocol) template("${MESSAGE}")); map-value-pairs( pair("jc.header.nodeName", "$HOST") pair("jc.header.eventDateTime", "$R_ISODATE") pair("jc.header.notificationType", "$MSGID") pair("jc.body", "$MSG") pair("jc.header.program", "$PROGRAM") ); # Log the output of the script. action { file { path "/var/log/syslog"; message "$jc.header.custom_script_output"; } } } Thanks in advance. -- Regards, Faisal

2 1

Re: [syslog-ng] Vulnerability making News - HTTP/2 Rapid Reset DDoS CVE-2023-44487
by Mayekar, PrachiX 16 Oct '23

16 Oct '23

Hi Team, Are syslog products vulnerable to this vulnerability ? Need to know if Syslog is affected: CVE-2023-44487 is a vulnerability in the HTTP/2 protocol that was recently used to launch DDoS attacks. The vulnerability allows for denial of service (DoS) because request cancellation can reset many streams quickly. https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-… Thanks & Regards, Prachi Mayekar ITI-Network Services A Contingent Worker at Intel For assistance, please visit us at https://it.intel.com<https://it.intel.com/>

2 2

Insider 2023-10: contribute; parallelize; compatibility;
by Peter Czanik (pczanik) 12 Oct '23

12 Oct '23

Dear syslog-ng users, This is the 113th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Why contribute to syslog-ng upstream? ------------------------------------- One of the returning questions I received recently: why contribute to the syslog-ng upstream? I guess it is a question many open-source projects receive regularly. There are many generic answers. Here I would like to focus more on syslog-ng, focusing on various parts of it. Of course, the generic answers also apply. Syslog-ng is an open-source project, free to use, modify, and extend. By contributing, you can give something back and improve syslog-ng for everyone. You do not have to be a developer in order to contribute: bug reports, configuration examples, PatternDB rules are all very useful contributions. https://www.syslog-ng.com/community/b/blog/posts/why-contribute-to-syslog-n… Accelerating single TCP connections in syslog-ng: parallelize() --------------------------------------------------------------- One of the highlights of the syslog-ng 4.3.0 release is parallelize(). Normally, syslog-ng processes incoming messages from a TCP connection in a single thread. While this works fine with many connections, it is a bottleneck when using a single or very few high-traffic connections. Using parallelize() allows syslog-ng to process log messages from a single high-traffic TCP connection in multiple threads, thus increasing processing performance on multi-core machines. https://www.syslog-ng.com/community/b/blog/posts/accelerating-single-tcp-co… Backward compatibility in syslog-ng by using the version number in syslog-ng.conf --------------------------------------------------------- Many users are annoyed by the version number included in the syslog-ng configuration. However, it ensures backward compatibility in syslog-ng. It is especially useful when updating to syslog-ng 4 from version 3, but also when updating within the same major version. https://www.syslog-ng.com/community/b/blog/posts/backward-compatibility-in-… WEBINARS * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Syslog-ng.com seems to be down
by Balazs Scheidler 18 Sep '23

18 Sep '23

Hi, As it seems syslog-ng.com has been down for a while (2 days at least). If your are looking for the syslog-ng documentation, a good alternative is the AxoSyslog documentation at the Axoflow website. https://axoflow.com/docs/axosyslog-core/

2 1

Insider 2023-09: MongoDB; UDP; sngbench; contribute;
by Peter Czanik (pczanik) 14 Sep '23

14 Sep '23

Dear syslog-ng users, This is the 112th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS The syslog-ng MongoDB destination receives bulk operations support ---------------------------------- The MongoDB destination of syslog-ng will receive another performance update. Starting with the upcoming version 4.3, it will support bulk operations. Depending on the configuration settings, this may result in a more than 300% performance increase. https://www.syslog-ng.com/community/b/blog/posts/the-syslog-ng-mongodb-dest… Syslog-ng 4.2: extra UDP performance ------------------------------------ No matter how awkward you feel when you hear about UDP syslog in the age of encrypted TCP connections, UDP syslog is here to stay in some special cases. The scalability issues of UDP log collection were first addressed in syslog-ng Open Source Edition (OSE) (the so-reuseport() parameter), and later a more advanced solution arrived to syslog-ng Premium Edition (PE) (the udp-balancer() source). The good news is that a new, open-source implementation is now available as part of syslog-ng 4.2.0. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-4-2-extra-udp-pe… What I learned about syslog-ng performance using sngbench --------------------------------------------------------- A few weeks ago, I posted about sngbench, a shell script to measure syslog-ng performance. The performance of syslog-ng is influenced by many factors, including the hardware and OS it runs on, and syslog-ng itself. This blog summarizes some of my findings using the script. https://www.syslog-ng.com/community/b/blog/posts/what-i-learned-about-syslo… WEBINARS * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

syslog-ng stops logging some messages
by Lars Wagner 14 Sep '23

14 Sep '23

Hi everyone We’re having a very odd problem with syslog-ng. After some time syslog-ng just stops logging further messages. A restart is required that syslog-ng starts to log again. I already put some information in a GitHub issue: https://github.com/syslog-ng/syslog-ng/issues/4485 As there was nearly no response there I try it that way. Thanks anyone in advance. Regards, Lars

1 0

syslog-ng 4.2.0 changed the interpretation of regexp
by Evan Rempel 11 Sep '23

11 Sep '23

Prior to syslog-ng 4.2.0 I was able to use a filter specified as match("ABC\|DEF" value("MESSAGE")) to match the exact string ABC|DEF in the MESSAGE After upgrading to 4.2.0 this will match either ABC or DEF in the MESSAGE To match an exact string of ABC|DEF I now need to escape both the backslash and the pipe match("ABC\\\|DEF" value("MESSAGE")) I can't find anything in the release notes. Of course I can easily solve this with single quotes, but more complex examples would not be so straight forward. Can someone confirm that this was intentional, or if this is a bug. -- Evan

3 4