From 25fee1f33e0bcf9526e7b9054a6c8d262c39fbf4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A1nos=20Barta?= Permission is hereby granted, free of charge, to any person obtaining a copy of these documentation files (the "Documentation"), to use the Documentation subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or portions of the Documentation. Any and all copies of the above copyright and this permission notice contained in the Documentation shall not be removed, obscured, or modified. If you modify the Documentation, You must cause any modified files to carry prominent notices stating that You changed the files. The Documentation contains trademarks and registered trademarks owned by One Identity and its affiliates. Permission is granted to make and distribute verbatim copies of the Documentation from the official syslog-ng.com site. Modified versions of the Documentation containing One Identity trademarks are permitted exclusively for internal use; however, all external distributions of modified Documentation are prohibited from containing any One Identity trademarks which include syslog-ng, the syslog-ng logo, Balabit, the Balabit logo, One Identity and the One Identity logo. No relationship is established as a result of this Documentation license. Any statements that suggest a partnership or other relationship with One Identity and its affiliates are prohibited. THE DOCUMENTATION IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE DOCUMENTATION OR THE USE OR OTHER DEALINGS IN THE DOCUMENTATION. YOU ACKNOWLEDGE THAT THE DOCUMENTATION YOU ARE DOWNLOADING IS SUBJECT TO THE RESTRICTIONS AND CONTROLS IMPOSED BY UNITED STATES EXPORT REGULATIONS.
+ YOU CERTIFY THAT:
+ YOU DO NOT INTEND TO USE THE DOCUMENTATION FOR ANY PURPOSE PROHIBITED BY UNITED STATES EXPORT REGULATIONS, INCLUDING, WITHOUT LIMITATION, TERRORISM, CYBER-ATTACKS, CYBER-CRIMES, MONEY-LAUNDERING, INDUSTRIAL ESPIONAGE, OR NUCLEAR, CHEMICAL OR BIOLOGICAL WEAPONS PROLIFERATION.
+ YOU ARE NOT LISTED AS A DENIED PARTY ON ANY LIST GOVERNING UNITED STATES EXPORTS.
+ YOU ARE NOT A NATIONAL OF ANY COUNTRY THAT IS NOT APPROVED TO RECEIVE A U.S. EXPORT. AS OF 2023, THESE COUNTRIES ARE CUBA, IRAN, NORTH KOREA, SYRIA, BELARUS AND RUSSIA.
+ If any of the above applicable conditions are not met or if your certification is inaccurate, this restricted copyright license is immediately terminated. This chapter explains how to install You can install You can install For instructions on compiling syslog-ng Open Source Edition from the source code, see NOTE: Note that not every Cisco log message conforms to this format. If you find a message that the cisco-parser() cannot properly parse, [%=General.contact-support-text%] so we can improve the parser. NOTE: Not every Cisco log message conforms to this format. If you find a message that the cisco-parser() cannot properly parse, contact Support, so we can improve the parser. The To compile syslog-ng Open Source Edition (OSE) from the source code, complete the following steps. Alternatively, you can use precompiled binary packages on several platforms. For a list of third-party packages available for various Linux, UNIX, and other platforms, see the [%=General.downloads-text%]. To compile syslog-ng Open Source Edition (OSE) from the source code, complete the following steps. Alternatively, you can use precompiled binary packages on several platforms. For a list of third-party packages available for various Linux, UNIX, and other platforms, see syslog-ng Open Source Edition installation packages. For details about the LGPL and GPL licenses, see For clarity, the Documentation is licensed separately. For details, see The Check Point Log Exporter parser can parse Check Point log messages. These messages do not completely comply with the syslog RFCs, making them difficult to parse. The checkpoint-parser() of For example: Splunk format: If you find a message that the checkpoint-parser() cannot properly parse, [%=General.contact-support-text%] so we can improve the parser. If you find a message that the checkpoint-parser() cannot properly parse, contact Support, so we can improve the parser. By default, the Check Point-specific fields are extracted into name-value pairs prefixed with .checkpoint. For example, the action in the previous message becomes ${.checkpoint.action}. You can change the prefix using the prefix option of the parser. The Fortigate parser can parse the log messages of FortiGate/FortiOS (Fortigate Next-Generation Firewall (NGFW)). These messages do not completely comply with the syslog RFCs, making them difficult to parse. The fortigate-parser() of For example: If you find a message that the fortigate-parser() cannot properly parse, [%=General.contact-support-text%] so we can improve the parser. If you find a message that the fortigate-parser() cannot properly parse, contact Support, so we can improve the parser. By default, the Fortigate-specific fields are extracted into name-value pairs prefixed with .fortigate. For example, the devname in the previous message becomes ${.fortigate.devname}. You can change the prefix using the prefix option of the parser. The Netskope parser can parse Netskope log messages. These messages do not completely comply with the syslog RFCs, making them difficult to parse. The netskope-parser() of For example: If you find a message that the netskope-parser() cannot properly parse, [%=General.contact-support-text%] so we can improve the parser. If you find a message that the netskope-parser() cannot properly parse, contact Support, so we can improve the parser. The By default, the Netskope-specific fields are extracted into name-value pairs prefixed with .netskope. For example, the organization_unit in the previous message becomes ${.netskope.organization_unit}. You can change the prefix using the prefix option of the parser. The Websense parser can parse the log messages of Websense Content Gateway (Raytheon|Websense, now Forcepoint). These messages do not completely comply with the syslog RFCs, making them difficult to parse. The websense-parser() of For example: If you find a message that the websense-parser() cannot properly parse, [%=General.contact-support-text%] so we can improve the parser. If you find a message that the websense-parser() cannot properly parse, contact Support, so we can improve the parser. The By default, the websense-specific fields are extracted into name-value pairs prefixed with .websense. For example, the product_version in the previous message becomes ${.websense.product_version}. You can change the prefix using the prefix option of the parser. If you need help, want to open a support ticket, or report a bug, we recommend using the syslog-ng-debun tool to collect information about your environment and If you need help, want to open a support ticket, or report a bug, we recommend using the syslog-ng-debun tool to collect information about your environment and The source code of See the [%=General.downloads-text%] for binary packages. For the available binary installation packages, see syslog-ng Open Source Edition installation packages.The
+
+
+
+
+ Installing syslog-ng
Cisco parser
<189>32: 0.0.0.0: *Apr 29 13:59:12.491: %SYS-5-CONFIG_I: Configured from console by console
<189>32: foo: *Apr 29 13:58:46.411: %SYSMGR-STANDBY-3-SHUTDOWN_START: The System Manager has started the shutdown procedure.
${MESSAGE}=%FAC-SEV-MNEMONIC: message
${HOST}=origin-id
diff --git a/Content/Guides/syslog-ng-guide-admin/compiling-syslog-ng.htm b/Content/Guides/syslog-ng-guide-admin/compiling-syslog-ng.htm
index 31a671cc0..d7d3a9c35 100644
--- a/Content/Guides/syslog-ng-guide-admin/compiling-syslog-ng.htm
+++ b/Content/Guides/syslog-ng-guide-admin/compiling-syslog-ng.htm
@@ -1,6 +1,7 @@
+
@@ -11,7 +12,7 @@ Compiling syslog-ng from source
Purpose:
- Steps:
diff --git a/Content/Guides/syslog-ng-guide-admin/concepts-licensing.htm b/Content/Guides/syslog-ng-guide-admin/concepts-licensing.htm
index 1c19800ea..f4102fbb7 100644
--- a/Content/Guides/syslog-ng-guide-admin/concepts-licensing.htm
+++ b/Content/Guides/syslog-ng-guide-admin/concepts-licensing.htm
@@ -11,5 +11,6 @@ Product licensing
Practically, the code stored under the lib directory of the source code package is under LGPL, the rest is GPL.
Check Point Log Exporter parser
<PRI><VERSION> <YYYY-MM-DD> <HH-MM-SS> <PROGRAM> <PID> <MSGID> - [key1:value1; key2:value2; ... ]
<134>1 2018-03-21 17:25:25 MDS-72 CheckPoint 13752 - [action:"Update"; flags:"150784"; ifdir:"inbound"; logid:"160571424"; loguid:"{0x5ab27965,0x0,0x5b20a8c0,0x7d5707b6}";]
time=1557767758|hostname=r80test|product=Firewall|layer_name=Network|layer_uuid=c0264a80-1832-4fce-8a90-d0849dc4ba33|match_id=1|parent_rule=0|rule_action=Accept|rule_uid=4420bdc0-19f3-4a3e-8954-03b742cd3aee|action=Accept|ifdir=inbound|ifname=eth0|logid=0|loguid={0x5cd9a64e,0x0,0x5060a8c0,0xc0000001}|origin=192.168.96.80|originsicname=cn\=cp_mgmt,o\=r80test..ymydp2|sequencenum=1|time=1557767758|version=5|dst=192.168.96.80|inzone=Internal|outzone=Local|proto=6|s_port=63945|service=443|service_id=https|src=192.168.96.27|
- Declaration:
@version:
Fortigate parser
<PRI><NAME=VALUE PAIRS>
<189>date=2021-01-15 time=12:58:59 devname="FORTI_111" devid="FG100D3G12801312" logid="0001000014" type="traffic" subtype="local" level="notice" vd="root" eventtime=1610704739683510055 tz="+0300" srcip=91.234.154.139 srcname="91.234.154.139" srcport=45295 srcintf="wan1" srcintfrole="wan" dstip=213.59.243.9 dstname="213.59.243.9" dstport=46730 dstintf="unknown0" dstintfrole="undefined" sessionid=2364413215 proto=17 action="deny" policyid=0 policytype="local-in-policy" service="udp/46730" dstcountry="Russian Federation" srccountry="Russian Federation" trandisp="noop" app="udp/46730" duration=0 sentbyte=0 rcvdbyte=0 sentpkt=0 appcat="unscanned" crscore=5 craction=262144 crlevel="low"
- Declaration:
@version:
Netskope parser
<PRI>{JSON-formatted-log-message}
<134>{"count": 1, "supporting_data": {"data_values": ["x.x.x.x", "user@domain.com"], "data_type": "user"}, "organization_unit": "domain/domain/Domain Users/Enterprise Users", "severity_level": 2, "category": null, "timestamp": 1547421943, "_insertion_epoch_timestamp": 1547421943, "ccl": "unknown", "user": "user@domain.com", "audit_log_event": "Login Successful", "ur_normalized": "user@domain.com", "_id": "936289", "type": "admin_audit_logs", "appcategory": null}
- Websense parser
<PRI><DATE> <TIMEZONE> <IP-ADDRESS> <NAME=VALUE PAIRS>
<159>Dec 19 10:48:57 EST 192.168.1.1 vendor=Websense product=Security product_version=7.7.0 action=permitted severity=1 category=153 user=- src_host=192.168.2.1 src_port=62189 dst_host=example.com dst_ip=192.168.3.1 dst_port=443 bytes_out=197 bytes_in=76 http_response=200 http_method=CONNECT http_content_type=- http_user_agent=Mozilla/5.0_(Windows;_U;_Windows_NT_6.1;_enUS;_rv:1.9.2.23)_Gecko/20110920_Firefox/3.6.23 http_proxy_status_code=200 reason=- disposition=1034 policy=- role=8 duration=0 url=https://example.com
- Reporting bugs and finding help
- Supported platforms
Collecting log messages is an essential part of managing, maintaining, and troubleshooting IT systems. Since your log messages can contain all kinds of sensitive information, you should make sure that they are kept safe. The easiest way to protect the log messages as they are transferred from your clients to your logserver is to authenticate and encrypt the connection between the client and the server.
-This tutorial shows you step-by-step how to create the certificates required to authenticate your server and your clients, and how to configure
This tutorial shows you step-by-step how to create the certificates required to authenticate your server and your clients, and how to configure
The tutorial is organized as follows: