- syslog-ng - lists.balabit.hu

syslog-ng-3.9.1-1 is crashing
by Harish Shetty 17 May '17

17 May '17

Hi Peter I have deployed syslog-ng-3.9.1-1.el6.x86_64 , where I am seeing one issue. Where there is disk usage in greater than 90%, It coredumps. Instead of that shouldnt it be handle the syslog-ng service gracefully? I have pasted part of core here and attached the coredump full file gdb) bt full #0 0x0000003b52a325e5 in raise () from /lib64/libc.so.6 No symbol table info available. #1 0x0000003b52a33dc5 in abort () from /lib64/libc.so.6 No symbol table info available. #2 0x0000003206c7506b in iv_fatal (fmt=<value optimized out>) at iv_fatal.c:57 ap = {{gp_offset = 8, fp_offset = 48, overflow_arg_area = 0x7f35c5aadac0, reg_save_area = 0x7f35c5aada00}} msg = "iv_init: can't initialize event dispatcher\000\006\062\000\ 000\000\177\000\000\bZ\003\000\000\000\000`KL\234\065\177\ 000\000?M006\062\000\000\000@֪\177\000\000@֪\177\000\000\ 177\000\000\b\000\000\000\000\000\000\000L\234\065\177\000\ 000L\234\065\177\000\000\000KL\234\065\177\000\000Ye006\062\000\000\000\001\ 000\000\000\000\000\000\000ت\177\000\000ت\177\000\000\177\000\000ت\177", '\000' <repeats 46 times>, "\004", '\000' <repeats 35 times>... #3 0x0000003206c76f2a in iv_fd_init (st=0x7f359c945850) at iv_fd.c:129 No locals. #4 0x0000003206c77499 in iv_init () at iv_main_posix.c:74 st = 0x7f359c945850 #5 0x0000003206c75b8e in iv_work_thread (_thr=0x996c540) at iv_work.c:177 thr = 0x996c540 pool = 0x1df6820 #6 0x0000003206c77def in iv_thread_handler (_thr=0x52933d0) at iv_thread_posix.c:142 __clframe = {__cancel_routine = 0x3206c77e50 <iv_thread_cleanup_handler>, __cancel_arg = 0x52933d0, __do_it = 1, __cancel_type = 0} thr = 0x52933d0 #7 0x0000003b53207aa1 in start_thread () from /lib64/libpthread.so.0 No symbol table info available. ---Type <return> to continue, or q <return> to quit--- #8 0x0000003b52ae8aad in clone () from /lib64/libc.so.6 No symbol table info available. Can you please check and let me know how can we fix this issue? Regards Harish shetty

4 9

Re: [syslog-ng] Syslog-ng input for beats ?
by Scot 17 May '17

17 May '17

I tried reading the mapping documentation in the Balabit Latest docs but I'm not connecting these dots, sorry. Can I use the templates for creating the ES index as a reference for json mapping in syslog-ng ? For example the attached winlogbeat.template.json which created the ES index.

2 3

Running into Error: Could not find Java SE Runtime Environment
by vijay amruth 17 May '17

17 May '17

Hello Peter/team/everyone, Post configure syslog-ng 3.9.1 on redhat 7.3, I am running to this error when running make, please look into this, any help is appreciated. GEN modules/java/syslog-ng-core/classes/org/syslog_ng/LogMessage.class Error: could not find libjava.so Error: Could not find Java SE Runtime Environment. make: *** [modules/java/syslog-ng-core/classes/org/syslog_ng/LogMessage.class] Error 2 Tried fixing path, didn't help...... [root@sml-collector02 syslog-ng-3.9.1]# export JRE_HOME=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.102-4.b14.el7.x86_64/jre [root@sml-collector02 syslog-ng-3.9.1]# export PATH=$PATH:$JRE_HOME/bin [root@sml-collector02 syslog-ng-3.9.1]# export JAVA_HOME=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.102-4.b14.el7.x86_64 [root@sml-collector02 syslog-ng-3.9.1]# export JAVA_PATH=$JAVA_HOME [root@sml-collector02 syslog-ng-3.9.1]# export PATH=$PATH:$JAVA_HOME/bin Please look into it. Thank you. -- Thanks, Vijay Amrut.

1 0

in-list filter for substrings
by Clayton Dukes 16 May '17

16 May '17

Question: Is there are way to read in a file to match for substrings? Example: filter f_malware { in-list("/etc/syslog-ng/conf.d/malware.list", value("MSG")); }; rewrite rw_malware { set("Malware", value("PROGRAM") condition(filter(f_malware))); }; Then, given a string like: Dec 15 17:57:02 230.16.190.121 %ASA-5-304001: 67.16.126.205 Accessed URL 114.4.201.244:http://wvqwdhimen.jaqwejggvwxyangoqepw.tk/storageframe.html It would look at malware.list and see a line containing: wvqwdhimen.jaqwejggvwxyangoqepw.tk and set the Program name as "Malware" I see in the docs, it says ' Only exact matches are supported, partial and substring matches are not' so I don't think this will work. Is there a way to do anything like this? - Clayton

1 0

How to get list of IPs
by Sathish Sundaravel 13 May '17

13 May '17

Hi All I have syslog Ng server running on Solaris platform and configured to receive or accept events from all unix servers in one single log file. If I want to collect list of servers reporting to the log server , I have to manually extract list from a single log file which is too much time consuming . What would the best way ? Regards Sathish

5 6

PLEASE REMOVE MY EMAIL FROM THIS LIST...
by Alex Norton 13 May '17

13 May '17

THANKS ALEX

2 1

Re: [syslog-ng] How to get list of IPs
by james.r.hendrick 12 May '17

12 May '17

If you don't need all logs in a single file you could use $HOST or $HOST_FROM as part of the file name Sent from my Verizon, Samsung Galaxy smartphone -------- Original message --------From: Sathish Sundaravel <sathish.sundaravel(a)gmail.com> Date: 5/12/17 1:11 PM (GMT-05:00) To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] How to get list of IPs Hi All I have syslog Ng server running on Solaris platform and configured to receive or accept events from all unix servers in one single log file. If I want to collect list of servers reporting to the log server , I have to manually extract list from a single log file which is too much time consuming . What would the best way ? RegardsSathish

1 0

Syslog-ng input for beats ?
by Scot 12 May '17

12 May '17

Hi Has anyone tried using syslog-ng inputs for logstash or beats data ? I'm trying to find a solution that will let me mirror my beats data like syslog-ng lets me do with syslog traffic. my syslog data goes to file, es and splunk. Need the same split for winlogbeat Winlogbeat goes to logstash then ES. Thanks for reading.

4 21

Unable to track root activity in syslog-ng
by vijay amruth 11 May '17

11 May '17

Hello everyone, here is is my configuration file, I am unable to track root activity, I am able to track user activity like the commands ran etc. For example: If I run a command as sudo, I see it in the log however the same command when switched to root is not being tracked. Any help is appreciated. Thank you. @version:3.9 @include "scl.conf" options { threaded(yes); }; source s_sys { unix-stream("/dev/log"); system(); internal(); }; # Destinations ############## destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" flush_lines(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_kern { file("/var/log/kern" ); }; destination d_mlal { usertty("*"); }; # Filters ########## filter f_kernel { facility(kern); }; filter f_default { level(info..emerg) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_auth { facility(authpriv); }; filter f_mail { facility(mail); }; filter f_emergency { level(emerg); }; filter f_news { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_boot { facility(local7); }; filter f_cron { facility(cron); }; # Log Bindings ############## #log { source(s_sys); filter(f_kernel); destination(d_cons); }; log { source(s_sys); filter(f_kernel); destination(d_kern); }; log { source(s_sys); filter(f_default); destination(d_mesg); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_mail); destination(d_mail); }; log { source(s_sys); filter(f_emergency); destination(d_mlal); }; log { source(s_sys); filter(f_news); destination(d_spol); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; log { source(s_sys); filter(f_cron); destination(d_cron); }; -- Thanks, Vijay.

4 4

Documentation error
by Evan Rempel 11 May '17

11 May '17

The documentation defines the macro WEEK_ABBREV, C_WEEK_ABBREV, R_WEEK_ABBREV, S_WEEK_ABBREV Description: The 3-letter English abbreviation of the name of the day the message was sent, for example Thu. but syslog-ng (3.9) actually populates the macros WEEK_DAY_ABBREV, C_WEEK_DAY_ABBREV, R_WEEK_DAY_ABBREV, S_WEEK_DAY_ABBREV -- Evan

2 1