Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [syslog-ng]

The syslog-ng application is a flexible and highly scalable system logging application that is ideal for creating centralized and trusted logging solutions.

The syslog-ng application is a flexible and highly scalable system logging application that is ideal for creating centralized and trusted logging solutions. The main features of syslog-ng are summarized below.

  • Reliable log transfer: The syslog-ng application enables you to send the log messages of your hosts to remote servers using the latest protocol standards. The logs of different servers can be collected and stored centrally on dedicated log servers. Transferring log messages using the TCP protocol ensures that no messages are lost.
  • Secure logging using TLS: Log messages may contain sensitive information that should not be accessed by third parties. Therefore, syslog-ng supports the Transport Layer Security (TLS) protocol to encrypt the communication. TLS also allows the mutual authentication of the host and the server using X.509 certificates.
  • Direct database access: Storing your log messages in a database allows you to easily search and query the messages and interoperate with log analyzing applications. The syslog-ng application supports the following databases: MSSQL, MySQL, Oracle, PostgreSQL, and SQLite.
  • Heterogeneous environments: The syslog-ng application is the ideal choice to collect logs in massively heterogeneous environments using several different operating systems and hardware platforms, including Linux, Unix, BSD, Sun Solaris, HP-UX, Tru64, and AIX.
  • Filter and classify: The syslog-ng application can sort the incoming log messages based on their content and various parameters like the source host, application, and priority. Directories, files, and database tables can be created dynamically using macros. Complex filtering using regular expressions and boolean operators offers almost unlimited flexibility to forward only the important log messages to the selected destinations.
  • Parse and rewrite: The syslog-ng application can segment log messages to named fields or columns, and also modify the values of these fields.
  • IPv4 and IPv6 support: The syslog-ng application can operate in both IPv4 and IPv6 network environments; it can receive and send messages to both types of networks.
195 questions
0
votes
0 answers

syslog-ng duplicate log message

Not duplicate of this question because that one uses rsyslog on client whereas I use syslog-ng on both sides. I have a syslog-ng instance on both the client and the server and for whatever reason the there are repeated log lines in the server…
ElpersonPL
  • 1
  • 1
0
votes
1 answer

syslog-ng: how to configure sending RFC5424 messages with octet-counting framing

Please don't bother reading this question. syslog-ng is already set up to send RFC5424 messages with octet-counting framing by default. I was confused by the behaviour of another component. This question is invalid. I have a syslog-ng OSE config…
davidA
  • 383
  • 3
  • 12
0
votes
1 answer

syslog-ng / telegraf : EOF occurred when idle - incompatible?

This is a follow-on question from this previous question, created because I found out more information and it's cleaner to pose this as a new question. I'm using syslog-ng OSE v3.31.2 to receive RFC3164 syslog messages over UDP port 514 from a bunch…
davidA
  • 383
  • 3
  • 12
0
votes
2 answers

syslog-ng: How to reduce high latency when forwarding logs to a syslog tcp consumer?

UPDATE 2: I've answered this via my new question at the link below. The root cause is behaviour by telegraf where by default it disconnects the TCP connection 5 seconds after the last received message. This may be by design, however I have an issue…
davidA
  • 383
  • 3
  • 12
0
votes
0 answers

RSyslogd is sending multiples CEF messages in the same Syslog message

There is a Python script sending multiple events to a remote host with Rsyslogd: CEF:0|Test|SIEMintegration|1|1|Normal|0| fileId=767000670128771115 CEF:0|Test|SIEMintegration|1|1|Normal|0| fileId=766000430136104144 But when they reach to that…
Cod1ngFree
  • 174
  • 1
  • 2
  • 11
0
votes
1 answer

Save incoming log with suffix to its logfile-suffix.log using syslog-ng

I've been searching on the internet for answers relating to syslog-ng and how I can configure syslog-ng to save incoming log files with a specific suffix to a file and also carry over the suffix variable. destination d_logs { …
OMG-1
  • 156
  • 1
0
votes
1 answer

using syslog-ng to parse snmptrapd - not keeping up

(centos 7.x) I have syslog-ng setup to parse snmptrapd messages so I can format them for later digestion. The issue is that syslog-ng only outputs the n-1 message. IE if there are 10 lines in snmptrapd.log syslog-ng only outputs 9 lines. If I send a…
ethrbunny
  • 2,369
  • 4
  • 41
  • 75
0
votes
1 answer

How can I set up syslog-ng to send only invalid JSON logs to a destination

I've set up syslog-ng 3.25.1 to read log messages from a file, parse them as JSON, and forward them to an ElasticSearch cluster. This works well when the messages are formatted correctly as JSON, but in cases when json-parser fails to find a valid…
Ben Burns
  • 111
  • 4
0
votes
1 answer

syslog-ng set loglevel/priority to warning or more to be less verbose

How to run/configure syslog-ng to log only above the security loglevel/priority WARNING? I would like to discard NOTICES like: Destination timeout has elapsed, closing connection; fd='36' From the docs:…
nbari
  • 558
  • 1
  • 9
  • 28
0
votes
1 answer

Seprate json part of incoming log with syslog-ng by config

I'm receiving my log without any parse: source s_network { network( transport(tcp) port(601) flags(no-parse)); }; My saved log have two part: reciver information json part of log ( like below ): Feb 18 00:01:58 82.172.112.1 <40>…
MHF
  • 3
  • 4
-1
votes
2 answers

Extract values from MESSAGE in Syslog-NG

I receive syslog messages as follows: [nms321@uhp.1.3.6.1.4.1.8000.10 net_id="325" station="431" fault="16384"] [NotificationHandler] NMS error: STCRC/NOTTS Net: Enas Station: CED Elmas serial-num: 11347 Without Python parser, I correctly…
Dspi
  • 1
  • 1
-1
votes
1 answer

syslog-ng | How to separate Logs from different Applications from one Client without to use different Ports ???

I have some Samba-Domain-Controllers and one central Syslog-Server. All of them running the latest syslog-ng and SUSE Leap15. Every Log from Samba, Winbind and Bind/Named should go to the central Syslog-Server in a separate File. Until now, i…
MHABK
  • 9
  • 5
-1
votes
2 answers

rsyslog execute action on multiple events

I would like to have an application to be executed when an event reaches multiple times in a row in the log, eg: Oct 17 13:09:24 mail clamav-milter[30942]: x x x Happens 4 times but also this counter should be reset like in every hour. Is this…
froggy
  • 1
-1
votes
1 answer

Sending rotated files with syslog-ng

Hello I am currently sending the suricata logs from a probe to a Syslog-ng server(172.16.238.15): @version: 3.25 options { keep-timestamp (no); chain_hostnames (off); keep_hostname (no); }; source s_eve { wildcard-file( …
19mike95
  • 49
  • 5
-3
votes
1 answer

How to hack proof my syslog-ng server

I recently built a Ubuntu syslog-ng server that is behind a firewall. I have opened TCP ports 514, 515, and 516. I have noticed that hackers are writing to my syslog-ng server, they are from China. How do I hack proof my syslog server to only…
BioRod
  • 303
  • 4
  • 13
1 2 3
…
12
13