Hi,

I have syslog-ng 3.14 and I am trying to filter DNS logs. I have this working in a very old 2.0.9 version of syslog-ng. But it does not seem to want to work in the 3.14 environment. Can anyone help me out as I am pretty new to administering syslog-ng.

Could you elaborate, please? What do you mean by "not seem to want to work"?

Does syslog-ng receive messages from s_net? You can verify it by starting syslog-ng in debug mode from the command line:

$ sbin/syslog-ng -Fdev

Please share the output of this command.

If so, do your logs appear under /var/log2/gns-dmz/bluecat/?

If not, something is wrong with your filters or with file permissions.

I'm not familiar with syslog-ng 2.0, but I've tested your configuration with syslog-ng 3.16. Let me share my tips:

1. It might be possible that the /var/log2/gns-dmz/bluecat/ directory does not exist, so I added create-dirs(yes) to the configuration.

2. I assume that the hostname ".*ddi-edns.*" is part of the message received from s_net, so I added keep-hostname(yes) to the config. If my assumption is incorrect, you should set keep-hostname(no) and adjust use-dns() and use-fqdn() according to your needs.

3. Make sure s_net is configured correctly, for example, if you want to receive old BSD-style messages, use the network() driver, otherwise use the syslog() driver for framed IETF-syslog messages.

For example:

@version: 3.16
@include "scl.conf"

options {
    create-dirs(yes);
    keep-hostname(yes);
};

source s_net {
    network(port(4444));
};

// insert your previous config snippet here

My test input was "<133>Feb 24 14:04:04 test.ddi-edns.test dhcpd message".

László Várady