https://peter.czanik.hu/ Recent content on Random thoughts of Peter 'CzP' Czanik Hugo -- gohugo.io en-us Wed, 02 Sep 2026 13:49:17 +0200 https://peter.czanik.hu/other/syslog-ng-elasticsearch-9-5/ Wed, 02 Sep 2026 13:49:17 +0200 https://peter.czanik.hu/other/syslog-ng-elasticsearch-9-5/ Recently, I heard complaints within the syslog-ng community that using Elasticsearch is not that easy anymore. I installed Elasticsearch 9.5 with Kibana to verify these claims. Read more at https://www.syslog-ng.com/community/b/blog/posts/using-syslog-ng-with-elasticsearch-9-5 syslog-ng logo https://peter.czanik.hu/other/syslog-ng-end-of-august-scaling-back-java/ Thu, 27 Aug 2026 13:02:53 +0200 https://peter.czanik.hu/other/syslog-ng-end-of-august-scaling-back-java/ Most of August, I was on vacation, but now I’m back and I try catching up on the events of the past weeks, just like my colleagues do. Currently, we are fixing issues and reviewing contributions, but we also discussed scaling back our efforts on Java support. While most of the team was away on vacation, the number of syslog-ng contributions suddenly grew. We support both autotools and cmake, and while differences are narrowing, there are still some minor problems to fix. https://peter.czanik.hu/other/syslog-ng-hardening-using-tor/ Wed, 29 Jul 2026 13:37:05 +0200 https://peter.czanik.hu/other/syslog-ng-hardening-using-tor/ For many years, I didn’t think that Tor could be useful for me. However, I’ve recently found a Gist on GitHub that describes how you can use it to harden your central syslog-ng server. And while I have yet to try it, at least now I have a reason to actually test Tor. The Tor website describes the project as follows: “Protect yourself against tracking, surveillance, and censorship.” I live in a country where thankfully I do not need these, nor do I perform any activities for which Tor would be useful. https://peter.czanik.hu/other/syslog-ng-journald-source-how-to-avoid-log-bombs-on-error/ Wed, 22 Jul 2026 13:56:05 +0200 https://peter.czanik.hu/other/syslog-ng-journald-source-how-to-avoid-log-bombs-on-error/ Choose your poison: Up until version 4.12, when syslog-ng ran into an error jumping to a saved systemd journal position, it read the journal from the beginning. With the latest syslog-ng version, you can configure what happens in case of such an error. Read more at https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-journald-source-how-to-avoid-log-bombs-on-errors syslog-ng logo https://peter.czanik.hu/other/syslog-ng-412-available-for-ubuntu-resolute/ Tue, 14 Jul 2026 14:41:41 +0200 https://peter.czanik.hu/other/syslog-ng-412-available-for-ubuntu-resolute/ Recently I was asked if syslog-ng supports Ubuntu 26.04 (Ubuntu Resolute). Yes, and with the arrival of the syslog-ng 4.12.0 release we also provide ready-to-use packages for it. The release notes mention it, and info is in the Readme on GitHub. I tend to mention FreeBSD and openSUSE more often in my blogs (personal preference), so today I installed Ubuntu 26.04 and tested syslog-ng myself. Read more at https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-4-12-0-available-for-ubuntu-26-04-resolute syslog-ng logo https://peter.czanik.hu/other/syslog-ng-java-destination-disabled/ Thu, 09 Jul 2026 15:19:41 +0200 https://peter.czanik.hu/other/syslog-ng-java-destination-disabled/ For many years, syslog-ng used Java, where C libraries were unavailable. However, over the years native C libraries became available for Elasticsearch and Kafka, and HDFS practically disappeared. As a “scream test”, I am going to disable Java support in all of my syslog-ng packages. Once upon a time, Java support was added to syslog-ng to be able to load Elasticsearch Java drivers. Later, Kafka, HDFS, and a generic HTTP destination were also added. https://peter.czanik.hu/posts/syslog-ng-4120-released/ Tue, 16 Jun 2026 16:50:23 +0200 https://peter.czanik.hu/posts/syslog-ng-4120-released/ Today, the syslog-ng team released three different syslog-ng versions, which provided a good opportunity to wear my “Release is coming” t-shirt. This coordinated release is due to an SQL injection security bug fix, even if most likely it affects less than a handful of people (I mean, is there anyone who still uses SQL to store logs in 2026…?) Release is coming What’s new? syslog-ng OSE 4.12.0 arrives with performance optimizations, making syslog-ng more scalable in several situations. https://peter.czanik.hu/other/syslog-ng-the-status-of-openssl-4-0-support/ Thu, 04 Jun 2026 14:01:40 +0200 https://peter.czanik.hu/other/syslog-ng-the-status-of-openssl-4-0-support/ OpenSSL 4.0 was released just over a month ago. So, how is its support progressing in syslog-ng? Well, Git master already supports it, and the patch is easy to backport to earlier releases. At the same time, version 4.12 will support OpenSSL 4.0 out of the box. A month ago, someone from Gentoo Linux reached out to the syslog-ng team about OpenSSL 4.0 support. I asked the community about their expectations, knowing that version 4. https://peter.czanik.hu/other/syslog-ng-nightly-containers-based-on-alma-linux/ Tue, 26 May 2026 14:02:31 +0200 https://peter.czanik.hu/other/syslog-ng-nightly-containers-based-on-alma-linux/ For many years, the syslog-ng project provided container images based on Debian. Most of our users run syslog-ng on RHEL & compatibles, and have asked for an RPM-based container. So, nightly containers based on Alma Linux are now also available. A while ago, I prepared a small test project to run syslog-ng in an Alma Linux container: https://www.syslog-ng.com/community/b/blog/posts/experimental-syslog-ng-container-image-based-on-alma-linux However, that was only an experiment which I never updated. Fast forward to today: nightly syslog-ng containers based on the latest syslog-ng git snapshot package builds are now available on the Docker Hub! https://peter.czanik.hu/other/syslog-ng-learning/ Tue, 19 May 2026 13:15:16 +0200 https://peter.czanik.hu/other/syslog-ng-learning/ How can you learn syslog-ng? There are many possibilities, depending on your time and budget. Possibilities range from tutorial series through reading the documentation to instructor-led training. Find out which one is for you! Read more at https://www.syslog-ng.com/community/b/blog/posts/learning-syslog-ng syslog-ng logo https://peter.czanik.hu/other/syslog-ng-insider-2026-05-otel-compliance-mac/ Thu, 14 May 2026 13:46:57 +0200 https://peter.czanik.hu/other/syslog-ng-insider-2026-05-otel-compliance-mac/ Dear syslog-ng users, This is the 140th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. Streaming syslog-ng data to your lakehouse using OTEL Version 4.11.0 of syslog-ng contains contributions from Databricks related to OAuth2 authentication. Recently, they published a blog about how this enables their customers to send logs to their data lake using syslog-ng and the OpenTelemetry protocol. https://www.syslog-ng.com/community/b/blog/posts/streaming-syslog-ng-data-to-your-lakehouse-using-opentelemetry Central log collection - more than just compliance I often hear, even at security conferences that “no central log collection here” or “we have something due to compliance”. https://peter.czanik.hu/other/fedora-44-centos-7-amazon-linux-questions/ Wed, 06 May 2026 13:28:09 +0200 https://peter.czanik.hu/other/fedora-44-centos-7-amazon-linux-questions/ Fedora 44 was announced last week: syslog-ng 4.11 is part of it. While checking the Fedora Copr build service for Fedora 44, I realized that CentOS 7 and Amazon Linux 2023 packages are also there. I have a few questions about those for you! syslog-ng logo Fedora 44 The availability of the Fedora 44 release was announced last week. Vesion 4.11 of syslog-ng, the current latest release, is part of it. https://peter.czanik.hu/other/syslog-ng-support-for-openssl-4-0/ Tue, 28 Apr 2026 15:20:56 +0200 https://peter.czanik.hu/other/syslog-ng-support-for-openssl-4-0/ Although OpenSSL 4.0 released just two weeks ago, the syslog-ng project has already received a GitHub issue complaining that we do not support it. So, before we would allocate too much effort on it: what should we expect? OpenSSL 4.0 was announced on April 14: https://openssl-library.org/post/2026-04-14-openssl-40-final-release/ However, this announcement mentions that it is NOT a long-term support (LTS) release. This raises the question that if it is not an LTS release, then can we stay on version 3. https://peter.czanik.hu/other/syslog-ng-new-performance-tuning-possibilities/ Wed, 22 Apr 2026 12:57:45 +0200 https://peter.czanik.hu/other/syslog-ng-new-performance-tuning-possibilities/ On April’s fool’s day, I shared that syslog-ng can reach 7 million EPS. This test lab result was in part possible thanks to a few performance enhancements coming to syslog-ng version 4.12. How 7 million EPS is possible? Before diving deeper, let me repeat it: 7 million EPS is just a lab testing result, not (yet) possible in the real world. However, the technologies enabling this are already available on the development branch of syslog-ng, or have been available for ages, just not tested or promoted enough. https://peter.czanik.hu/posts/genesi-rto/ Thu, 16 Apr 2026 09:58:48 +0200 https://peter.czanik.hu/posts/genesi-rto/ This Monday I talked to a couple of friends about work while wearing my Genesi t-shirt. A teacher going back to school after Spring break and an IT guy explaining the nightmare of RTO threat. I love coincidences :-) Why do I say that? Genesi t-shirt As I wrote a few years ago about working from home: “After graduating from university, I worked from home for a small US-based company. I never met my boss while working there and met only one of my colleagues at a conference in Brussels. https://peter.czanik.hu/other/syslog-ng-streaming-data-to-your-lakehouse-using-opentelemetry/ Wed, 15 Apr 2026 14:12:22 +0200 https://peter.czanik.hu/other/syslog-ng-streaming-data-to-your-lakehouse-using-opentelemetry/ Version 4.11.0 of syslog-ng contains contributions from Databricks related to OAuth2 authentication. Recently, they published a blog about how this enables their customers to send logs to their data lake using syslog-ng and the OpenTelemetry protocol. The syslog-ng project received two contributions from Databricks in the last weeks of 2025. The first one turned the already existing OAuth2 support generic and extensible, so it can be used anywhere, not just with Microsoft Azure (but of course, Azure compatibility was preserved). https://peter.czanik.hu/posts/new-toy-1st-of-april-syslog-ng-performance-tests/ Wed, 01 Apr 2026 12:35:28 +0200 https://peter.czanik.hu/posts/new-toy-1st-of-april-syslog-ng-performance-tests/ Almost 15 years ago, Balabit had a campaign, stating that syslog-ng could process 650k messages a second. Now I am happy to present 7 million EPS (events per second). Timing the announcement to April 1 is not a coincidence :-) While the 650k EPS measurement was true, it was misleading. This value was measured right after syslog-ng 3.2 introduced multi-threading, in lab environment, under optimal circumstances, using synthetic log messages. However, there was no fine print explaining this, just the statement that syslog-ng could process 650k EPS. https://peter.czanik.hu/posts/new-toy-back-to-high-end-audio/ Tue, 31 Mar 2026 10:12:38 +0200 https://peter.czanik.hu/posts/new-toy-back-to-high-end-audio/ My AI mini workstation from HP has seen some non-AI workloads this weekend. I installed Capture One for photo editing and a couple of software synthesizers. And realized along the way that while built-in speakers are nice, high-end audio is a lot better! :-) For months, I have been listening to music on devices that are designed for speech: a pair of Jabra headphones and the speakers of my various laptops. https://peter.czanik.hu/posts/new-toy-openwebui-first-steps/ Thu, 26 Mar 2026 13:42:45 +0100 https://peter.czanik.hu/posts/new-toy-openwebui-first-steps/ Once I got hardware-accelerated AI working under Linux on my AI mini workstation from HP, my next goal was to make it easier to use. From this blog, you can read about my initial experiments with Open WebUI on Fedora Linux. Open WebUI talking about central log collection :-) Everything in containers As Open WebUI is not yet available as a package in Fedora, my initial approach was to use containers. https://peter.czanik.hu/other/syslog-ng-compiling-on-an-old-mac/ Wed, 25 Mar 2026 15:43:49 +0100 https://peter.czanik.hu/other/syslog-ng-compiling-on-an-old-mac/ I have an aging, but fully functional MacBook. I bought it for syslog-ng testing, but I also use for watching movies. Homebrew no more fully supports old, Intel-based Macs. This blog helps to compile the latest syslog-ng release on these old, but otherwise functional machines. Read more at https://www.syslog-ng.com/community/b/blog/posts/compiling-syslog-ng-on-an-old-mac syslog-ng logo