Where communities thrive


  • Join over 1.5M+ people
  • Join over 100K+ communities
  • Free without limits
  • Create your own community
People
Repo info
Activity
  • 13:49
    alltilla opened #4014
  • 06:25
    kira-syslogng commented #4012
  • 06:01
    OverOrion synchronize #4012
  • 05:17
    quicujo starred syslog-ng/syslog-ng
  • 04:18
    mohitvaid commented #4013
  • 04:18
    mohitvaid opened #4013
  • 04:18
    mohitvaid labeled #4013
  • May 19 19:23
    i-made starred syslog-ng/syslog-ng
  • May 19 14:52
    kira-syslogng commented #4012
  • May 19 14:29
    OverOrion synchronize #4012
  • May 19 14:27
    OverOrion opened #4012
  • May 19 13:18
    OverOrion review_requested #3998
  • May 19 13:18
    OverOrion review_requested #3957
  • May 19 11:38
    shikharvashistha commented #4009
  • May 19 11:37
    shikharvashistha synchronize #4009
  • May 19 03:40
    shikharvashistha closed #3986
  • May 19 03:40
    shikharvashistha commented #3986
  • May 19 03:39
    kira-syslogng commented #4009
  • May 19 03:39
    kira-syslogng commented #4009
  • May 19 03:39
    shikharvashistha opened #4009
kiphackman
@kiphackman
hi guys im getting an issue on syslog-ng version 3.23.1 where logs are not written to the disk. I've spent a lot of time troubleshooting but had no luck. Would love some insight or assistance from the community if you guys may have any recommendations. Sorry for the trouble. And thank you so much
6 replies
Wojciech Adam Koszek
@wkoszek_gitlab
Imagine you're building a hobby project. You don't want to invest in Logstash'es and Kibanas. You love syslog-ng however. What's the easiest way to get some dashboard for logs?
To give you an example: modern tool to get web stats could be Grafana or something, but one can use Webalizer tool that has 1995 look, but does the job. I wonder if there's some 1995 tool that just works and gives me simple querability without all the maintenance
2 replies
Fabien Wernli
@faxm0dem
I'm guessing grafana/loki would be the most straightforward route nowadays
Peter Czanik
@czanik
if you do not mind closed source and do not need scalability in the long run, I liked SEQ, when I tested it a while ago: https://www.syslog-ng.com/community/b/blog/posts/creating-a-new-http--based-syslog-ng-destination-seq
1 reply
Fabien Wernli
@faxm0dem_twitter
Hi I'm getting a json parsing error that I don't understand: https://gist.github.com/faxm0dem/463d632d2f4031d8236f3294a04a98f6
I'm guessing it's the NaN it doesn't like
Fabien Wernli
@faxm0dem_twitter
yeah that was it
sorry for the noise
svestenik
@svestenik
Hello
syslog-ng 3 (3.35.1)
looks like cisco parser is not working
and when I introduce syslog traffic from my network through the cisco parser, nothing comes out

Basic config elements look like this:

source s_ciscoudp { udp (ip("0.0.0.0") port(5140) flags(no-parse,store-raw-message)); };
destination d_raw { file("/var/log/raw" template("${RAWMSG}\n")); };
destination d_fromcisco { file("/etc/syslog-ng/fromcisco" template(t_jsonfile)); };

template t_jsonfile {
template("$(format-json --scope rfc5424 --scope dot-nv-pairs
--rekey .* --shift 1 --scope nv-pairs --key ISODATE)\n\n");
};

parser p_cisco {
cisco-parser();
};

log { source(s_ciscoudp); destination(d_raw); parser(p_cisco); destination(d_fromcisco); };

and i am getting the traffic into syslog-ng
destination d_raw works, raw messages get written
but nothing happens afterwards
Any ideas on how to find out whats wrong
Fabien Wernli
@faxm0dem
svestenik: hi
1 reply
you might have more clues when activating the internal() source
it will output internal logs of syslog-ng
if that doesn't give you any more clues, use the debug mode
syslog-ng -evdf /etc/syslog-ng/syslog-ng.conf
Gábor Nagy
@gaborznagy
Hi @svestenik What @faxm0dem suggested is a good idea: you need to know where is your message dropped.
Since you have a relatively simple log path with two destinations and a parser, I suspect the message is dropped in the p_cisco cisco-parser.
Cisco parser drops the message if it's format doesn't match a supported cisco format.
https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.33/administration-guide/79#TOPIC-1663463
Ohh, sorry, you already figured that out...
Fabien Wernli
@faxm0dem
svestenik: you can also send us an example out of your raw log so we can check on our side
Gábor Nagy
@gaborznagy
We need to see what kind of messages are dropped by the cisco-parser. Can you show us an example, please?
17 replies
cisco-parser supports the following format:
<pri>(sequence: )?(origin-id: )?(timestamp? timezone?: )?%msg
dvlsatya
@dvlsatya
i want to contribute to your oragnization.what is the procedure to setup your project .what should i follow?
Gábor Nagy
@gaborznagy
Hello @dvlsatya !
We are more than happy to receive contributions from the community! :)
At first I suggest to compile syslog-ng.
You have several options: you can use our docker-based infrastructure and then you don't have to setup a build environment on your computer.
Here is a short description about the usage the docker-based build system (dbld):
https://github.com/syslog-ng/syslog-ng/tree/master/dbld#hacking-on-syslog-ng-itself
What kind of contribution do you have in mind?
kartiks26
@kartiks26
Where can i find open issue or fields open for contribution
1 reply
Fabien Wernli
@faxm0dem
o/
I just updated to debian/bullseye, and the latest syslog-ng-master says `Required bison not found /home/fwernli/git/syslog-ng/build/lib/rewrite/rewrite-expr-grammar.y
I've got `bison (GNU Bison) 3.7.5
ah I see the warning now in the configure script that I need at least 3.7.6
back to yak shaving then
Fabien Wernli
@faxm0dem
That one's been fun
deepulikesbru
@deepulikesbru
I have created a new syslog configuration file in /opt/syslog-ng/etc/conf.d.
I have created one source and destination file inside script /var/log/myfile.txt
For some reason i have changed the destination file to myfile1.txt inside the configuration and reloaded the config file.
Though i have deleted myfile.txt, still is it there and updated with the same data as myfile1 has. I have deleted myfile.txt multiple times but still creating. Could someone please help on this?
Gábor Nagy
@gaborznagy
Hi @deepulikesbru!
That sounds strange. Syslog-ng writes to the new file after the reload.
Can you share with us the actual config, please?
Does the old file (myfile.txt) have the same content like the new myfile1 file after it's been re-created? Does it have the old myfile.txt contents as well?
deepulikesbru
@deepulikesbru
I cant share the contents of those files.
@gaborznagy I removed the config file and created with different file names again inside the config file with mytext2.txt and deleted myfile.txt and myfile1.txt before reloading. I did see the files myfile.txt and myfile1.txt again after some time. Why these files are creating again after sometime though i have deleted the files? What could be the issue? Does syslog has internally anything to clear the buffer ??
László Várady
@MrAnno
@deepulikesbru What syslog-ng version are you using?
A reload reinitializes the pipeline, so you should not see that file recreated if you previously removed that from the configuration, unless your configuration is invalid. In case the config is invalid, syslog-ng reverts back to the previous configuration.
deepulikesbru
@deepulikesbru

source s_src {
file("/path/myapp.log"
follow-freq(10) );

};

template app_test_struc {
template("${DATE} | From ${HOST_FROM} | ${PRIORITY} | ${MSGHDR}${MSG}\n");
};

destination d_des {
file("/var/log/myfile2.txt" template(app_test_struc));
};

log {source(s_src); destination(d_des); };

@MrAnno @gaborznagy
Above is the config file, When i try to give another file name say myfile3 after some testing, the deleted files also exist in the /var/log along with newly created log myfile3.
Gábor Nagy
@gaborznagy
@deepulikesbru Thanks for sharing the config!
The above config looks okay, but maybe your config is inavlid, as @MrAnno suggested it. Check it with a syslog-ng --syntax-only please.
What kind of syslog-ng do you use? Can you share us a syslog-ng -V output, please?
deepulikesbru
@deepulikesbru
Could @gaborznagy @MrAnno you please provide me the steps to reload the syslog configuration file properly? Thanks in advance
1 reply
deepulikesbru
@deepulikesbru
6.0.21 version AIX OS
The above command dont work in AIX
László Várady
@MrAnno

This channel is for the open-source edition of syslog-ng. Sorry, we can not support syslog-ng PE 6.0.21 here. AIX is a quite rare platform, please consider contacting the commercial support: https://support.oneidentity.com/syslog-ng-premium-edition/6.0.21

(/opt/syslog-ng/sbin/syslog-ng-ctl reload should probably work in this case)