- syslog-ng - lists.balabit.hu

syslog-ng 3.9.1 erroneously matching regex
by Soumyadip Das Mahapatra 01 May '17

01 May '17

Hi folks, I raised https://github.com/balabit/syslog-ng/issues/1455 Could you guys help me troubleshooting the issue. It looks to be a buggy regex match. Thanks, Soumyadip

2 1

bug in syslog-ng 3.9.1 triggered by bug in ivykis >= 0.40
by Lennert Buytenhek 29 Apr '17

29 Apr '17

Hello! (I subscribed to this mailing list to be able to post, but I have mailing list mail delivery disabled -- please CC me on replies.) A syslog-ng user tried to use syslog-ng with ivykis 0.41 and ran into the following issue: https://github.com/buytenh/ivykis/issues/11 In a nutshell, syslog-ng seems to be registering an ivykis timer (iv_timer) with timeout tv_sec = 0, tv_nsec = 0, and ivykis >= 0.40 added support for timerfd_create, but due to a bug in ivykis, this {0, 0} timeout would get passed into timerfd_settime() verbatim, and timerfd_settime() interprets this zero timeout as a request to disable the timerfd, which would cause timer processing to stop. I will release a new ivykis release with a workaround for this, but I figured that you'd probably want to know about this as well, as I don't think it makes sense for syslog-ng to be registering timers with an absolute timeout of zero. Cheers, Lennert

2 2

Syslog-ng and OSQUERY
by Dwijadas Dey 28 Apr '17

28 Apr '17

Hi List users Is it possible to send OSQUERY logs to syslog-ng 3.5 In the OSQUERY docs <https://osquery.readthedocs.io/en/latest/deployment/syslog/> rsyslog is configured to write logs to syslog. Does the same method applies to syslog-ng 3.5 ? Thanks and regards

4 16

Relay Server Config Help
by wiskbroom＠hotmail.com 27 Apr '17

27 Apr '17

Hello; I am running syslog-NG on a server inside of a DMZ, and on that server I'd like to just forward all messages into my internal syslog-NG server. I feel this is better than having to create a new firewall rule for each new DMZ node. I have a simple syslog-NG config that looks like this: ---------START syslog-ng.conf----------- @version:3.5 @include "scl.conf" @include "/etc/syslog-ng/conf.d/*.conf" options { time-reap(30); mark-freq(10); keep-hostname(yes); chain_hostnames (off); flush_lines (0); time_reopen (10); log_fifo_size (1000); use_dns (yes); use_fqdn (no); create_dirs (no); }; source s_relay { udp(ip(0.0.0.0) port(514) so_rcvbuf(425984)); tcp(ip(0.0.0.0) port(514) max-connections(250) so_rcvbuf(425984) log_iw_size(25000) so_keepalive(yes) log_fetch_limit(100)); syslog(ip(0.0.0.0) transport("tcp") port(1514) max-connections(500) log_iw_size(25000) flags("threaded") log_fetch_limit(100)); }; destination d_syslog_tcp { syslog("10.5.5.10" transport("tcp") port(514)); }; log { source(s_relay); destination(d_syslog_tcp); }; ----------END syslog-NG.conf------------- The problem that I am experiencing is that my messages, once received by my internal syslog-NG server, look like the following: Apr 26 17:31:06 relay-sng-server 126 <30>1 2017-04-26T17:32:01-04:00 relay-client-host-X appserv - - - 606881792 140565409392384 INFO: @2 SessionExchange::ProcessTCPRead Apr 26 17:31:06 relay-sng-server 124 <30>1 2017-04-26T17:32:01-04:00 relay-client-host-X appserv - - - 606881792 140565409392384 DEBUG: OpenSSLHandler::PerformHandshake I am hoping not to muck around too much with my config for my internal syslog-NG servers, and want for the messages above to appear as coming from relay-client-host-X and NOT relay-sng-server. It could potentially be nice to know that the message was first received by relay-sng-server, but... I was considering opening another TCP port on my internal syslog servers, and using that to send from DMZ, then a rewrite, but that all seems far more complicated than necessary. Am I missing something on my syslog-NG conf? Any suggestions greatly appreciated! Thanks all in advance, -Vadim

2 2

syslog 3.9 modifying ${MSG}?
by Nik Ambrosch 27 Apr '17

27 Apr '17

After moving from syslog-ng 3.5 to 3.9 i noticed that the contents of $PROGRAM and $MSG are being logged differently than before. Here is how they used to be logged: # program: 53 # message: Apr 19 09:35:35.713 GMT: %ILPOWER-5-POWER_GRANTED: Interface xxx: Power granted | That is the full message (as seen on the device) which is optimal behavior. Below is the behavior i’m seeing with syslog-ng 3.9 with similar configuration: # program: GMT # message: %ILPOWER-5-POWER_GRANTED: Interface xxx: Power granted The value of program and message are altered but everything else is the same. I’ve been investigating the date parser and the flags(no-parse) options but haven’t had any luck getting a properly formatted message yet. If anyone has any ideas on how to get the old behavior back it would be greatly appreciated.

3 5

Convert logstash filters to syslog-ng
by C. L. Martinez 26 Apr '17

26 Apr '17

Hi all, I would like to drop Logstash collector from our ELK infrastructure and use syslog-ng instead. This ELK infrastructure collects, report and show dashboards about security devices: firewalls, anti-spam devices, etc. Most of these logs arrives from rsyslog collectors (deployed in several linux and BSD machines). I have seen in Balabit's blog page how this could be done: https://www.balabit.com/blog/how-to-parse-data-with-syslog-ng-store-in-elas… and https://www.balabit.com/blog/collecting-and-parsing-suricata-logs-using-sys…. The most important point here is to test all configured logstash filters inside syslog-ng: GeoIP patterns, some substitution params, etc. Any tips or tricks to accomplish this type of change? Many thanks. -- Greetings, C. L. Martinez

4 3

Getting log statistics file every 10 minutes.
by Jordan Ladora 25 Apr '17

25 Apr '17

Hello, After running normally for 6 or 7 days, starting at midnight, on my syslog-ng server running freebsd 11-Rel and syslog-ng 3.7.3_7 (installed with pkg), I started getting a Log statistics record every 10 minutes, which is excessive. This is only happening with a local log file designated in the .conf file like so- source s_local { system(); internal(); }; destination d_local { file("/var/log/sng_local"); }; log { source(s_local); destination(d_local); }; This is one of the entries I'm getting every 10min in the /var/log/sng_local file- Apr 25 12:00:02 logbox syslog-ng[370]: Log statistics; processed='source(s_network)=2602643', processed='destination(security)=18', processed='center(received)=2912379', processed='destination(ppp)=0', processed='src.internal(s_local#3)=894', stamp='src.internal(s_local#3)=1493139002', processed='center(queued)=3235133', processed='destination(console)=15635', processed='src.none()=0', stamp='src.none()=0', processed='destination(audit)=18', processed='destination(messages)=2595805', processed='destination(xferlog)=0', processed='global(payload_reallocs)=1703', processed='global(sdata_updates)=27054', processed='destination(allusers)=0', processed='destination(authlog)=391', processed='destination(maillog)=299021', processed='destination(consolelog)=0', processed='destination(lpd-errs)=0', processed='destination(cron)=14282', processed='destination(slip)=0', processed='global(msg_clones)=0', processed='source(s_local)=309736', processed='destination(d_local)=309736', processed='destination(debuglog)=227', processed='global(internal_queue_length)=0' What did I do to deserve this every 10 minutes?

2 2

Re: [syslog-ng] Unable to Filter Based On Facility into Different Files
by james.r.hendrick 21 Apr '17

21 Apr '17

flags (final) stops the professing in the first statement Sent from my Verizon, Samsung Galaxy smartphone -------- Original message --------From: wiskbroom(a)hotmail.com Date: 4/21/17 9:37 AM (GMT-05:00) To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Unable to Filter Based On Facility into Different Files Greetings! I am trying to rewrite syslog-ng.conf to create files based on facilities; one way for non-auth messages, another for all authentication messages (ssh, su, sudo, and console logins). I believe I have two issues with my statements below: 1. My ${HOST}- might be incorrect. 2. Am I able to write two filters for a single source? My single source in this case are Linux boxes, all sending their syslog traffic to my syslog-NG server with *.*. My statements below, comments and criticism very welcome. filter f_linux_secure { facility(authpriv) and level(info..emerg); }; filter f_linux_messages { level(info..emerg); }; destination d_linux_secure { file("/data/Linux/${HOST}-secure.log" owner("root") group("systems") perm(0640) dir_perm(0750) create_dirs(yes)); destination d_linux_messages { file("/data/Linux/${HOST}-messages.log" owner("root") group("systems") perm(0640) dir_perm(0750) create_dirs(yes)); log { source(s_remote); filter(f_linux_secure); destination(d_linux_secure); flags(final); }; log { source(s_remote); filter(f_linux_messages); destination(d_linux_messages); flags(final); }; Regards, Vadim Anatoly Pushkin

3 3

Unable to Filter Based On Facility into Different Files
by wiskbroom＠hotmail.com 21 Apr '17

21 Apr '17

Greetings! I am trying to rewrite syslog-ng.conf to create files based on facilities; one way for non-auth messages, another for all authentication messages (ssh, su, sudo, and console logins). I believe I have two issues with my statements below: 1. My ${HOST}- might be incorrect. 2. Am I able to write two filters for a single source? My single source in this case are Linux boxes, all sending their syslog traffic to my syslog-NG server with *.*. My statements below, comments and criticism very welcome. filter f_linux_secure { facility(authpriv) and level(info..emerg); }; filter f_linux_messages { level(info..emerg); }; destination d_linux_secure { file("/data/Linux/${HOST}-secure.log" owner("root") group("systems") perm(0640) dir_perm(0750) create_dirs(yes)); destination d_linux_messages { file("/data/Linux/${HOST}-messages.log" owner("root") group("systems") perm(0640) dir_perm(0750) create_dirs(yes)); log { source(s_remote); filter(f_linux_secure); destination(d_linux_secure); flags(final); }; log { source(s_remote); filter(f_linux_messages); destination(d_linux_messages); flags(final); }; Regards, Vadim Anatoly Pushkin

1 0

RSS memory grows when disk is full
by Arnob Ghosh 20 Apr '17

20 Apr '17

Hi, We are currently using syslog-ng version 3.3.6 . We are observing RSS memory growing issue for syslog-ng when destination disk is full. Is that an expected behavior , as the incoming message gets queued up in system RAM and thus RSS also will grow for syslog-ng process. Please correct me if I am wrong in understanding the same. Thanks, Arnob

1 0