Recent Posts
Collecting One Identity Cloud PAM Essentials logs using syslog-ng
One Identity Cloud PAM Essentials is the latest security product by One Identity. It provides asset management as well as secure and monitored remote access for One Identity Cloud users to hosts on their local network. I had a chance to test PAM Essentials while still in development. While there, I also integrated it with syslog-ng.
From this blog, you can learn what PAM Essentials is, and how you can collect its logs using syslog-ng.
read more
The syslog-ng Insider 2024-03: MacOS; OpenTelemetry;
The March syslog-ng newsletter is now on-line:
Native MacOS source in syslog-ng Using OpenTelemetry between syslog-ng instances Collecting even more logs on MacOS using syslog-ng It is available at https://www.syslog-ng.com/community/b/blog/posts/the-syslog-ng-insider-2024-03-macos-opentelemetry
syslog-ng logo
read more
Dedicated Windows XML eventlog parser in syslog-ng
Version 4.6 of syslog-ng introduced windows-eventlog-xml-parser(), a dedicated parser for XML-formatted event logs from Windows. It makes the EventData portion of log messages more useful, as it combines two arrays into a list of name-value pairs.
https://www.syslog-ng.com/community/b/blog/posts/dedicated-windows-xml-eventlog-parser-in-syslog-ng
syslog-ng logo
read more
Aggregating messages in syslog-ng using grouping-by()
Sometimes you have many log messages from an app, but none of them have the exact content you need. This is where the grouping-by() parser of syslog-ng can help. It allows you to aggregate information from multiple log messages into a single message.
In this blog, I will show you how to parse sshd logs using the patterndb parser of syslog-ng, and then create an aggregate message from the opening and closing log message using grouping-by.
read more
Working with multi-line logs in syslog-ng
Most log messages fit on a single line. However, Windows and some developer tools and services, like Tomcat, write multi-line log messages. These can come in various formats. For example, new log messages start with a date in a specific format. You use the multi-line-prefix() of the syslog-ng file() source to send multi-line messages as single messages instead of line by line.
I must admit that I have never seen multi-line logs in production.
read more
The syslog-ng Insider 2024-02: OpenObserve; configuration check; build services;
The February syslog-ng newsletter is now on-line:
Version 4.5.0 of syslog-ng is now available with OpenObserve JSON API support Syslog-ng PE can now send logs to Google BigQuery Syslog-ng can now do a full configuration check How build services make life easier for upstream developers It is available at https://www.syslog-ng.com/community/b/blog/posts/the-syslog-ng-insider-2024-02-openobserve-configuration-check-build-services
syslog-ng logo
read more
Using OpenTelemetry between syslog-ng instances
Do you have to forward large amounts of logs between two syslog-ng instances? OTLP (OpenTelemetry protocol) support in syslog-ng was contributed by Axoflow, and it can solve this problem. Just like the ewmm() destination, syslog-ng-otlp() forwards most name-value pairs, however, unlike a tcp() connection, it scales well with multiple CPU cores.
Support for OpenTelemetry was added to syslog-ng a couple of releases ago. OpenTelemetry is an observability framework, mainly used in Linux / Cloud / Kubernetes environments.
read more
Native MacOS source in syslog-ng
You know that support for MacOS is important when every third visitor at the syslog-ng booth of Red Hat Summit asks if syslog-ng works on MacOS. With the upcoming syslog-ng version 4.6.0, syslog-ng not only compiles on MacOS, but it also collects local log messages natively. From this blog you can learn how to compile syslog-ng yourself, options of the MacOS source, and also a bit of history.
https://www.syslog-ng.com/community/b/blog/posts/native-macos-source-in-syslog-ng
syslog-ng logo
read more
The syslog-ng Insider 2024-01: HTTP; Cloudflare; systemd-journal; Humio / Logscale;
The January syslog-ng newsletter is now on-line:
Why use a http()-based destination in syslog-ng? An overview of Cloudflare’s logging pipeline Working with multiple systemd-journal namespaces in syslog-ng Logging to Humio / Logscale simplified in syslog-ng It is available at https://www.syslog-ng.com/community/b/blog/posts/the-syslog-ng-insider-2024-01-http-cloudflare-systemd-journal-humio-logscale
syslog-ng logo
read more
Music of the week: five albums to bring with me to the desert island
I love music. My family, friends, colleagues love music. I am in quite a few music-related Facebook groups. A returning question everywhere in the past couple of weeks in various wordings was: what are the five albums you would bring to a desert island? This list is of course changing almost each and every year. And also depends on the number of albums, and if live concert recordings, “best of”, etc.
read more