[syslog-ng] Insider 2019-03: syslog-ng 3.20.1; fail2ban; HTTP source; container tools; UDP; Conferences & Webinars

[Czanik, Péter]

Dear syslog-ng users,

This is the 73rd issue of syslog-ng Insider, a monthly newsletter that
brings you syslog-ng-related news.



NEWS



syslog-ng 3.20.1 released

-------------------------

Version 3.20.1 of syslog-ng was released. It adds persist-tool to
manipulate persists files, a collectd destination, parsers for
Netskope and Websense logs, and list support to JSON and XML.
Naturally, bug fixes and many more changes were under the hood as
well. There are some developer facing improvements, too, such as the
fact that Python developers can now generate internal() log messages.

For a complete list of changes with links to individual pull requests
describing the changes in more detail, check
https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.20.1

Documentation for most of the new features is now available online at
https://www.syslog-ng.com/technical-documents/list/syslog-ng-open-source-edition/3.20



Visualizing Fail2ban logs in Kibana

-----------------------------------

In his previous syslog-ng blog post, Balage wrote about how you can
enrich Fail2ban logs with GeoIP metadata and other data parsed from
the logs. In this post he will show you how you can use syslog-ng to
send the logs into Elasticsearch and how visualizing Fail2ban logs in
Kibana can show you where the failed login attempts come from.

https://balagetech.com/visualizing-fail2ban-logs-in-kibana/





Creating an HTTP source for syslog-ng in Python

-----------------------------------------------

HTTP is quickly becoming the universal transport protocol of the
Internet. Nowadays even DNS over HTTPS implementations are available.
There is no HTTP source implemented in C for syslog-ng, but starting
with syslog-ng version 3.18, you can write new source drivers for
syslog-ng in Python. While performance is not as good as it would be
using C, you gain flexibility and ease of implementation by using
Python. From this blog post you can learn how to create a basic HTTP
source for syslog-ng in Python.

https://www.syslog-ng.com/community/b/blog/posts/creating-an-http-source-for-syslog-ng-in-python





Building and running a syslog-ng container using the latest tools

-----------------------------------------------------------

>From this blog you can learn the basics of skopeo, buildah and podman
through the examples of a syslog-ng container. These tools come from
Red Hat, replacing and extending functionality of the docker daemon
without the need to run a “big fat daemon” on the hosts. The
architectural redesign is closer to the UNIX philosophy and here is no
single point of failure.

https://www.syslog-ng.com/community/b/blog/posts/building-and-running-a-syslog-ng-container-using-the-latest-tools





Improved log collection over UDP

--------------------------------

“I'd tell you the joke about UDP, but you might not get it.” This old
joke perfectly summarizes UDP. There is no guarantee (frankly, not
even a real effort) that data sent over UDP ever reaches the receiving
end. Still, a surprisingly large number of syslog(-ng) users still
keep using UDP as their transport protocol. The introduction of the
so-reuseport() option for the UDP source in syslog-ng 3.19 is for
those people who, for policy or other reasons, can not switch to TCP
logging but still want to make UDP log reception as reliable as
possible.

https://www.syslog-ng.com/community/b/blog/posts/improved-log-collection-over-udp



CONFERENCES



* DevOps Pro talk:

Syslog-ng for DevOps: Customized Logging with Python (
https://devopspro.lt/peter-czanik/ )



WEBINARS



You can watch our past webinars:

* Got a Hungry Splunk? Feed it Smartly with syslog-ng:
https://www.brighttalk.com/webcast/16207/350610





Your feedback and news, or tips about the next issue are welcome. To
read this newsletter online, visit: https://syslog-ng.com/blog/

Peter Czanik (CzP) <peter.czanik at balabit.com>
Balabit (a OneIdentity company) / syslog-ng upstream
https://syslog-ng.com/community/
https://twitter.com/PCzanik