Stack Overflow
Stack Overflow

Questions tagged [syslog-ng]

The syslog-ng application is a flexible and highly scalable system logging application that is ideal for creating centralized and trusted logging solutions.

The syslog-ng application is a flexible and highly scalable system logging application that is ideal for creating centralized and trusted logging solutions. The main features of syslog-ng are summarized below.

  • Reliable log transfer: The syslog-ng application enables you to send the log messages of your hosts to remote servers using the latest protocol standards. The logs of different servers can be collected and stored centrally on dedicated log servers. Transferring log messages using the TCP protocol ensures that no messages are lost.
  • Secure logging using TLS: Log messages may contain sensitive information that should not be accessed by third parties. Therefore, syslog-ng supports the Transport Layer Security (TLS) protocol to encrypt the communication. TLS also allows the mutual authentication of the host and the server using X.509 certificates.
  • Direct database access: Storing your log messages in a database allows you to easily search and query the messages and interoperate with log analyzing applications. The syslog-ng application supports the following databases: MSSQL, MySQL, Oracle, PostgreSQL, and SQLite.
  • Heterogeneous environments: The syslog-ng application is the ideal choice to collect logs in massively heterogeneous environments using several different operating systems and hardware platforms, including Linux, Unix, BSD, Sun Solaris, HP-UX, Tru64, and AIX.
  • Filter and classify: The syslog-ng application can sort the incoming log messages based on their content and various parameters like the source host, application, and priority. Directories, files, and database tables can be created dynamically using macros. Complex filtering using regular expressions and boolean operators offers almost unlimited flexibility to forward only the important log messages to the selected destinations.
  • Parse and rewrite: The syslog-ng application can segment log messages to named fields or columns, and also modify the values of these fields.
  • IPv4 and IPv6 support: The syslog-ng application can operate in both IPv4 and IPv6 network environments; it can receive and send messages to both types of networks.
275 questions
0
votes
1 answer

With syslog-ng how do you embed regex's in templates

I am converting a rsyslog template to syslog-ng and I cannot find in the syslog-ng docs how to embed regex's in a template. The incoming message body looks like this: 123 1.2.3.4 4.3.2.1:80 someone@somewhere.com US The original rsyslog template…
Rob
  • 1
0
votes
1 answer

Sylog-ng cert issue

We have configured a Syslog-ng relay server to which accepts client logs. Client and the relay server communicates and forward the logs using TLS. We are noticing the below error in our client. I followed Configuring syslog-ng PE clients to setup…
user1115980
  • 13
  • 1
  • 7
0
votes
3 answers

How can I create dynamic destination files name based on what is filtered?

For example if in my log line appears something like that [xxx], I must put this message in a file with a name starting as xxx.log And if the message changes and appears [xxy] I must create a new log file named as xxy.log How can I do that in a…
Rys
  • 4,934
  • 8
  • 21
  • 37
0
votes
1 answer

Syslog-NG two relay server issue

I am trying to forward logs through two syslog-ng relay server, which adds the first relay server IP as a source and in my SIEM, I am seeing all logs are coming from the first syslog relay server. Setup is below. Client --> Syslog-Relay1 --->…
xor_lord
  • 9
  • 1
  • 2
0
votes
1 answer

Syslog-ng multiline input over TCP/Network module

We are attempting to capture logs to syslog-ng over tcp connection. The logs looks something like this: 1810717353--user--notice--IPV4----2017-10-23T16:03:23.015170-04:00--<11>Oct 23 16:03:23 HOSTNAME [443-Multiplexer][0x80000001][xsltmsg][error]…
ScipioAfricanus
  • 1,331
  • 6
  • 18
  • 39
0
votes
1 answer

Rsyslog lognormalizer date field parse failure

I am trying to use lognorm/lognormalizer to test my .rb file to use with rsyslog mmnormalize module. My log file looks like this: 2017-08-19T17:00:12.52Z,john,26,engineer 2017-08-19T17:00:12.59Z,susan,28,doctor My rb file is as…
João
  • 177
  • 4
  • 15
0
votes
1 answer

How to make Syslog-ng server show facility, priority in the logs it receives from the client?

I'm sending syslogs from my client ( Freebsd) which is using syslogd, to the syslog server which is using Syslog-NG ( Ubuntu 16.04 ) . I'm forwarding all the logs I receive on local0 facility to the syslog server. Log shown in the client: Aug 29…
flexter
  • 97
  • 7
0
votes
1 answer

using regex with syslog-ng input file

i use syslog-ng for logging Application Logs to remote Destinations. I have application logs in the following pattern: javaservice.2017-05-11.log and i want to use a regex at the Source definition…
178877
  • 23
  • 4
0
votes
1 answer

syslog-ng match and filter is not working the way I want

I have following messages 1)"customer1"," 5","0",""..... 2)"customer2"," 5","0","".... 3)"customer3"," 5","0",""... 4)""," 5","0","" 5)""," 5","0","" What I want to achieve is based on first value in double quotes I want to create folders and then…
user3332404
  • 161
  • 1
  • 4
  • 13
0
votes
0 answers

Several tcp connections from same syslog-ng clients

We have a syslog-ng server with several rsyslog clients. Over time some of them open a lot of client connections to the server instead of just one TCP connection. From the client perspective a netstat shows only one connection but from the server…
keegita gina
  • 35
  • 9
0
votes
1 answer

syslog-ng 2.09 threaded() syntax

Sles 11 SP 4 syslog-ng-2.0.9-27.34.39.2 - does threaded() even work on this version? I'm trying to enable multithreading but running into a syntax error when adding the threaded() into the options {} stanza .. Line 16 is the threaded() .. I've tried…
Sean
  • 1
  • 1
0
votes
0 answers

Correlation using patterndb and syslog

I am trying to make a correlation using patterndb, my requirement is when an exception or a message gets added into a context more than 4 times in 60 secondes a message gets generated.Here is my patterndb xml and syslog configuration…
saurabh kumar
  • 155
  • 5
  • 26
0
votes
1 answer

unable to filter badly-formatted messages in syslog-ng

I am contacting you regarding an issue I have with syslog-NG. some of our devices (mainly HP switches and SANs) are sending syslog messages that do not respect the syslog RFC 5424 it seems. to give you a few examples : if I sniff the network…
olivierg
  • 728
  • 7
  • 26
0
votes
1 answer

syslog messages coming from HP switches cannot be filtered correctly in syslog-NG?

i am having some trouble filtering messages coming from a few sources (HP Switches) and i would like to have some advices. i have a huge syslog-NG configuration file, filtering messages coming from many different sources (Unix servers, NAS filers,…
olivierg
  • 728
  • 7
  • 26
0
votes
1 answer

How to receive syslog messages and convert them to string

First I would like to receive the syslog message, the second I would like to syslog message into string type, please tell me how to write java code。 The following code can only be output in the console, how to get the string type of…
Aaron
  • 1
  • 2
1 2 3
…
18 19