'Re: [syslog-ng] Undesirable behavior from Cisco parser?'

[prev in list] [next in list] [prev in thread] [next in thread] 

List:       syslog-ng
Subject:    Re: [syslog-ng] Undesirable behavior from Cisco parser?
From:       Péter, Kókai <peter.kokai () oneidentity ! com>
Date:       2018-09-27 9:11:25
Message-ID: CABxQCphhJg0Q8UrjiEh7zPEvzwi4-On2T9eZFyOyTJ1Aq9ygaw () mail ! gmail ! com
[Download RAW message or body]

[Attachment #2 (multipart/alternative)]

Hello,

Thanks for the update and a possible workaround for this issue. I just made
a small test (I do not have cisco device) based on your logs.

I used syslog, cisco and app-parser(in a form of default-network-driver)
and the result:
PARSER=syslog, PROGRAM=%SYS-6-LOGGINGHOST_STARTSTOP, MSG=Logging to host
blahblah
PARSER=cisco, PROGRAM= MSG=%SYS-6-LOGGINGHOST_STARTSTOP: Logging to host
blahblah
PARSER=app-parser, PROGRAM= MSG=%SYS-6-LOGGINGHOST_STARTSTOP: Logging to
host blahblah

Maybe in the feature you could give a chance for the default-network-driver
because it seems to handle the exact thing you aim to do (and more).

Btw the UTC time works, because now syslog parser things that UTC: is a
program name, and it seeks for the message.

--
Kokan

On Mon, Sep 24, 2018 at 4:27 PM Nik Ambrosch <nik@ambrosch.com> wrote:

> Update - updating all of our (previously misbehaving) Cisco devices to log
> a time zone there have been no more incidents of syslog-ng parsing
> ${FULLHOST} as ":"
>
>
>
> On Mon, Sep 17, 2018 at 3:40 PM Nik Ambrosch <nik@ambrosch.com> wrote:
>
>> Yes, hostname was parsed properly in 3.9.  Three macros that I use
>> changed after the upgrade:
>>
>> ${FULLHOST}
>> - old: "myhost.com"
>> - new: ":"
>>
>> ${PROGRAM}
>> - old: ""
>> - new: "%IP_VFR-4-FRAG_TABLE_OVERFLOW"
>>
>> ${MSG}
>> old: "%IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/1: the fragment
>> table..."
>> new: "GigabitEthernet0/1: the fragment table..."
>>
>>
>>
>> On Mon, Sep 17, 2018 at 3:26 PM Balazs Scheidler <bazsi77@gmail.com>
>> wrote:
>>
>>> I think this would be handled by our cisco-parser() properly. Was this
>>> format properly parsed in 3.9?
>>>
>>> On Mon, Sep 17, 2018 at 8:35 PM Nik Ambrosch <nik@ambrosch.com> wrote:
>>>
>>>> Confirmed when a cisco device does not send a timezone syslog-ng fails
>>>> to properly parse the message.  TImezone can be toggled on like this:
>>>>
>>>> mydevice.com(config)#service timestamps log datetime show-timezone
>>>>
>>>>
>>>>
>>>>
>>>> On Mon, Sep 17, 2018 at 12:59 PM Nik Ambrosch <nik@ambrosch.com> wrote:
>>>>
>>>>> Well that's certainly easier, thanks :)
>>>>>
>>>>> Patch did not succeed in fixing the issue - it may be because of the
>>>>> missing UTC that I mentioned in my earlier response?
>>>>>
>>>>> Sep 11 12:14:51 1.1.1.1 <190>53: Sep 11 16:14:50.588:
>>>>> %SYS-6-LOGGINGHOST_STARTSTOP: broken device
>>>>> Sep 11 13:17:39 2.2.2.2 <190>10474: Sep 11 17:17:38.447 UTC:
>>>>> %SYS-6-LOGGINGHOST_STARTSTOP: working device
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> On Mon, Sep 17, 2018 at 12:36 PM Budai, László <
>>>>> laszlo.budai@oneidentity.com> wrote:
>>>>>
>>>>>> the PR has been merged six days ago, and this build has been finished
>>>>>> four days ago:
>>>>>> https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng-githead/build/797694/
>>>>>> which means, that these packages should contain that change.
>>>>>>
>>>>>> L.
>>>>>>
>>>>>>
>>>>>> On Mon, Sep 17, 2018 at 6:29 PM, Nik Ambrosch <nik@ambrosch.com>
>>>>>> wrote:
>>>>>>
>>>>>>> Having a hard time getting lib/ivykis to compile on a centos 7.4
>>>>>>> system right now, haven't been able to figure it out yet.
>>>>>>>
>>>>>>>
>>>>>>> On Mon, Sep 17, 2018 at 11:58 AM Budai, László <
>>>>>>> laszlo.budai@oneidentity.com> wrote:
>>>>>>>
>>>>>>>> Hi,
>>>>>>>>
>>>>>>>> Do you need help in how to test the latest changes?
>>>>>>>>
>>>>>>>> L.
>>>>>>>>
>>>>>>>>
>>>>>>>> On Mon, Sep 17, 2018 at 3:03 PM, Nik Ambrosch <nik@ambrosch.com>
>>>>>>>> wrote:
>>>>>>>>
>>>>>>>>> Is there any other information I can provide in order to help
>>>>>>>>> resolve this?
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> On Tue, Sep 11, 2018 at 1:48 PM Nik Ambrosch <nik@ambrosch.com>
>>>>>>>>> wrote:
>>>>>>>>>
>>>>>>>>>> I setup a syslog-ng 3.9 device to capture a message using
>>>>>>>>>>
>>>>>>>>>> network(transport(tcp) flags(no-parse));
>>>>>>>>>>
>>>>>>>>>> Here's what was logged:
>>>>>>>>>>
>>>>>>>>>> Sep 11 12:14:51 1.1.1.1 <190>53: Sep 11 16:14:50.588:
>>>>>>>>>> %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host blahblah
>>>>>>>>>>
>>>>>>>>>> Followed up with a device that delivers a proper hostname, this
>>>>>>>>>> is what was logged:
>>>>>>>>>>
>>>>>>>>>> Sep 11 13:17:39 2.2.2.2 <190>10474: Sep 11 17:17:38.447 UTC:
>>>>>>>>>> %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host blahblah
>>>>>>>>>>
>>>>>>>>>> Looks like the difference is the working device contains a
>>>>>>>>>> timezone where as the non-working device does not.  Everything else is the
>>>>>>>>>> same however neither contain a hostname like in your example.
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> On Tue, Sep 11, 2018 at 9:45 AM, Budai, László <
>>>>>>>>>> laszlo.budai@oneidentity.com> wrote:
>>>>>>>>>>
>>>>>>>>>>> Hi,
>>>>>>>>>>>
>>>>>>>>>>> instead of reverting the ipv6 heuristic, I propose another
>>>>>>>>>>> solution:
>>>>>>>>>>> https://github.com/balabit/syslog-ng/pull/2272
>>>>>>>>>>>
>>>>>>>>>>> I think that when a timestamp is followed by a colon(':'), it is
>>>>>>>>>>> part of the timestamp and the (legacy) timestamp parser should 'eat' it.
>>>>>>>>>>>
>>>>>>>>>>> I tested with the following log:
>>>>>>>>>>> <0>91: *Oct 07 03:10:04: mydevice.com %CRYPTO-4-RECVD_PKT_INV_SPI:
>>>>>>>>>>> decaps: rec'd IPSEC packet has invalid spi for destaddr=150.1.1.1, prot=50,
>>>>>>>>>>> spi=0x72662541(1919296833), srcaddr=150.3.1.3
>>>>>>>>>>>
>>>>>>>>>>> Could you validate that this is the same format that you have?
>>>>>>>>>>>
>>>>>>>>>>> L.
>>>>>>>>>>>
>>>>>>>>>>> On Mon, Sep 10, 2018 at 4:32 PM, Scheidler, Balázs <
>>>>>>>>>>> balazs.scheidler@oneidentity.com> wrote:
>>>>>>>>>>>
>>>>>>>>>>>> This branch has a patch to revert that specific commit, and
>>>>>>>>>>>> I've confirmed that it resolves the issue for me, in exchange for not
>>>>>>>>>>>> supporting IPV6 addresses in the hostname field.
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> On Mon, Sep 10, 2018 at 3:55 PM, Balazs Scheidler <
>>>>>>>>>>>> bazsi77@gmail.com> wrote:
>>>>>>>>>>>>
>>>>>>>>>>>>> This patch broke it:
>>>>>>>>>>>>>
>>>>>>>>>>>>> 399d565e9857e7cb41253e9a714d5cc6ad4d50fb.
>>>>>>>>>>>>>
>>>>>>>>>>>>> This patch can be reverted easily even on the latest master to
>>>>>>>>>>>>> resolve the issue.
>>>>>>>>>>>>>
>>>>>>>>>>>>> On Mon, Sep 10, 2018 at 3:16 PM Scheidler, Balázs <
>>>>>>>>>>>>> balazs.scheidler@oneidentity.com> wrote:
>>>>>>>>>>>>>
>>>>>>>>>>>>>> This is probably not it, the syslog-parser() changed some
>>>>>>>>>>>>>> behaviours that changed it.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> On Mon, Sep 10, 2018, 13:45 Budai, László <
>>>>>>>>>>>>>> laszlo.budai@oneidentity.com> wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> Hi,
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> in syslog-ng OSE 3.13 [1] we introduced a new feature,
>>>>>>>>>>>>>>> called app-parser [2] and the default network network driver is using it.
>>>>>>>>>>>>>>> Maybe that could cause your issue.  If this is the case,
>>>>>>>>>>>>>>> then we have another PR [3] which makes it possible to disable the
>>>>>>>>>>>>>>> auto-parse (also part of 3.13).
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> Example:
>>>>>>>>>>>>>>> source s_network {
>>>>>>>>>>>>>>>   default-network-drivers(auto-parse(no));
>>>>>>>>>>>>>>> };
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> If it not solves your problem then could you share the
>>>>>>>>>>>>>>> relevant part of your config?
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> [1]
>>>>>>>>>>>>>>> https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.13.1
>>>>>>>>>>>>>>> [2] https://github.com/balabit/syslog-ng/pull/1689
>>>>>>>>>>>>>>> [3] https://github.com/balabit/syslog-ng/pull/1788/
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> regards,
>>>>>>>>>>>>>>> Laszlo Budai
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> On Fri, Sep 7, 2018 at 6:00 PM, Nik Ambrosch <
>>>>>>>>>>>>>>> nik@ambrosch.com> wrote:
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> Recently I upgraded my centralized loghost from 3.9 -> 3.15
>>>>>>>>>>>>>>>> and I noticed that some of my cisco devices started being logged in an
>>>>>>>>>>>>>>>> undesirable format... I don't want to enable the cisco parser because more
>>>>>>>>>>>>>>>> than just cisco messages get delivered to this interface.  Here are the
>>>>>>>>>>>>>>>> relevant fields that have changed before/after the upgrade:
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> syslog-ng 3.9, before upgrade ---
>>>>>>>>>>>>>>>>     ${FULLHOST}: "mydevice.com"
>>>>>>>>>>>>>>>>     ${PROGRAM}: ""
>>>>>>>>>>>>>>>>     message: "%CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd
>>>>>>>>>>>>>>>> IPSEC packet has invalid spi for..."
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> syslog-ng 3.15, before upgrade ---
>>>>>>>>>>>>>>>>     ${FULLHOST}: ":"
>>>>>>>>>>>>>>>>     ${PROGRAM}: "%CRYPTO-4-RECVD_PKT_INV_SPI"
>>>>>>>>>>>>>>>>     ${MSG}: "decaps: rec'd IPSEC packet has invalid spi
>>>>>>>>>>>>>>>> for..."
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> Is this unintended behavior or a bug?  This particular
>>>>>>>>>>>>>>>> device is a Cisco 3845 running ios 12.4(22)T4.
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> Thanks in advance.
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> ______________________________________________________________________________
>>>>>>>>>>>>>>>> Member info:
>>>>>>>>>>>>>>>> https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>>>>>>>>>>>>>>> Documentation:
>>>>>>>>>>>>>>>> http://www.balabit.com/support/documentation/?product=syslog-ng
>>>>>>>>>>>>>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> ______________________________________________________________________________
>>>>>>>>>>>>>>> Member info:
>>>>>>>>>>>>>>> https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>>>>>>>>>>>>>> Documentation:
>>>>>>>>>>>>>>> http://www.balabit.com/support/documentation/?product=syslog-ng
>>>>>>>>>>>>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>> ______________________________________________________________________________
>>>>>>>>>>>>>> Member info:
>>>>>>>>>>>>>> https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>>>>>>>>>>>>> Documentation:
>>>>>>>>>>>>>> http://www.balabit.com/support/documentation/?product=syslog-ng
>>>>>>>>>>>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> --
>>>>>>>>>>>>> Bazsi
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> ______________________________________________________________________________
>>>>>>>>>>>>> Member info:
>>>>>>>>>>>>> https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>>>>>>>>>>>> Documentation:
>>>>>>>>>>>>> http://www.balabit.com/support/documentation/?product=syslog-ng
>>>>>>>>>>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> ______________________________________________________________________________
>>>>>>>>>>>> Member info:
>>>>>>>>>>>> https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>>>>>>>>>>> Documentation:
>>>>>>>>>>>> http://www.balabit.com/support/documentation/?product=syslog-ng
>>>>>>>>>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> ______________________________________________________________________________
>>>>>>>>>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>>>>>>>>>> Documentation:
>>>>>>>>>>> http://www.balabit.com/support/documentation/?product=syslog-ng
>>>>>>>>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>> ______________________________________________________________________________
>>>>>>>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>>>>>>>> Documentation:
>>>>>>>>> http://www.balabit.com/support/documentation/?product=syslog-ng
>>>>>>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>
>>>>>>>> ______________________________________________________________________________
>>>>>>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>>>>>>> Documentation:
>>>>>>>> http://www.balabit.com/support/documentation/?product=syslog-ng
>>>>>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>>>>>>>
>>>>>>>>
>>>>>>>
>>>>>>> ______________________________________________________________________________
>>>>>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>>>>>> Documentation:
>>>>>>> http://www.balabit.com/support/documentation/?product=syslog-ng
>>>>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>
>>>>>> ______________________________________________________________________________
>>>>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>>>>> Documentation:
>>>>>> http://www.balabit.com/support/documentation/?product=syslog-ng
>>>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>>>>>
>>>>>>
>>>> ______________________________________________________________________________
>>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>>> Documentation:
>>>> http://www.balabit.com/support/documentation/?product=syslog-ng
>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>>>
>>>>
>>>
>>> --
>>> Bazsi
>>>
>>> ______________________________________________________________________________
>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>> Documentation:
>>> http://www.balabit.com/support/documentation/?product=syslog-ng
>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>>
>>>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>

[Attachment #5 (text/html)]

<div dir="ltr">Hello,<div><br></div><div>Thanks for the update and a possible \
workaround for this issue. I just made a small test (I do not have cisco device) \
based on your logs.</div><div><br></div><div>I used syslog, cisco and app-parser(in a \
form of default-network-driver) and the result:</div><div><div>PARSER=syslog, \
PROGRAM=%SYS-6-LOGGINGHOST_STARTSTOP, MSG=Logging to host \
blahblah</div><div>PARSER=cisco, PROGRAM= MSG=%SYS-6-LOGGINGHOST_STARTSTOP: Logging \
to host blahblah</div><div>PARSER=app-parser, PROGRAM= \
MSG=%SYS-6-LOGGINGHOST_STARTSTOP: Logging to host \
blahblah</div></div><div><br></div><div>Maybe in the feature you could give a chance \
for the default-network-driver because it seems to handle the exact thing you aim to \
do (and more).</div><div><br></div><div>Btw the UTC time works, because now syslog \
parser things that UTC: is a program name, and it seeks for the \
message.</div><div><br></div><div>--</div><div>Kokan</div><br><div \
class="gmail_quote"><div dir="ltr">On Mon, Sep 24, 2018 at 4:27 PM Nik Ambrosch \
&lt;<a href="mailto:nik@ambrosch.com" target="_blank">nik@ambrosch.com</a>&gt; \
wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 \
.8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Update - \
updating all of our (previously misbehaving) Cisco devices to log a time zone there \
have been no more incidents of syslog-ng parsing ${FULLHOST} as \
&quot;:&quot;<br></div><div><br></div><div><br></div></div><br><div \
class="gmail_quote"><div dir="ltr">On Mon, Sep 17, 2018 at 3:40 PM Nik Ambrosch \
&lt;<a href="mailto:nik@ambrosch.com" target="_blank">nik@ambrosch.com</a>&gt; \
wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 \
.8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div \
dir="ltr"><div>Yes, hostname was parsed properly in 3.9.   Three macros that I use \
changed after the upgrade:<br></div><div><br></div><div>${FULLHOST}<br>- old: \
&quot;<a href="http://myhost.com" target="_blank">myhost.com</a>&quot;<br>- new: \
&quot;:&quot;<br><br>${PROGRAM}<br>- old: &quot;&quot;<br>- new: \
&quot;%IP_VFR-4-FRAG_TABLE_OVERFLOW&quot;<br><br>${MSG}<br>old: \
&quot;%IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/1: the fragment \
table...&quot;<br>new: &quot;GigabitEthernet0/1: the fragment \
table...&quot;</div><div><br></div><div><br></div></div></div><br><div \
class="gmail_quote"><div dir="ltr">On Mon, Sep 17, 2018 at 3:26 PM Balazs Scheidler \
&lt;<a href="mailto:bazsi77@gmail.com" target="_blank">bazsi77@gmail.com</a>&gt; \
wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 \
.8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I think this would \
be handled by our cisco-parser() properly. Was this format properly parsed in \
3.9?<br></div><br><div class="gmail_quote"><div dir="ltr">On Mon, Sep 17, 2018 at \
8:35 PM Nik Ambrosch &lt;<a href="mailto:nik@ambrosch.com" \
target="_blank">nik@ambrosch.com</a>&gt; wrote:<br></div><blockquote \
class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc \
solid;padding-left:1ex"><div dir="ltr"><div dir="ltr"><div>Confirmed when a cisco \
device does not send a timezone syslog-ng fails to properly parse the message.   \
TImezone can be toggled on like this:</div><div><br></div><div><a \
href="http://mydevice.com" target="_blank">mydevice.com</a>(config)#service \
timestamps log datetime show-timezone</div><div><br></div><div>  \
</div><div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr">On Mon, \
Sep 17, 2018 at 12:59 PM Nik Ambrosch &lt;<a href="mailto:nik@ambrosch.com" \
target="_blank">nik@ambrosch.com</a>&gt; wrote:<br></div><blockquote \
class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc \
solid;padding-left:1ex"><div dir="ltr"><div>Well that&#39;s certainly easier, thanks \
:)</div><div><br></div><div>Patch did not succeed in fixing the issue - it may be \
because of the missing UTC that I mentioned in my earlier \
response?</div><div><br></div><div><div dir="ltr">Sep 11 12:14:51 1.1.1.1 \
&lt;190&gt;53: Sep 11 16:14:50.588: %SYS-6-LOGGINGHOST_STARTSTOP: broken \
device<br></div><div>Sep 11 13:17:39 2.2.2.2 &lt;190&gt;10474: Sep 11 17:17:38.447 \
UTC: %SYS-6-LOGGINGHOST_STARTSTOP: working \
device</div><div><br></div><div><br></div><div><br></div></div></div><br><div \
class="gmail_quote"><div dir="ltr">On Mon, Sep 17, 2018 at 12:36 PM Budai, László \
&lt;<a href="mailto:laszlo.budai@oneidentity.com" \
target="_blank">laszlo.budai@oneidentity.com</a>&gt; wrote:<br></div><blockquote \
class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc \
solid;padding-left:1ex"><div dir="ltr"><div dir="ltr">the PR has been merged six days \
ago, and this build has been finished four days ago: <a \
href="https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng-githead/build/797694/" \
target="_blank">https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng-githead/build/797694/</a> \
which means, that these packages should contain that \
change.</div><div><br></div><div>L.</div><div><br></div></div><div \
class="gmail_extra"><br><div class="gmail_quote">On Mon, Sep 17, 2018 at 6:29 PM, Nik \
Ambrosch <span dir="ltr">&lt;<a href="mailto:nik@ambrosch.com" \
target="_blank">nik@ambrosch.com</a>&gt;</span> wrote:<br><blockquote \
class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc \
solid;padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr">Having a hard \
time getting lib/ivykis to compile on a centos 7.4 system right now, haven&#39;t been \
able to figure it out yet.<br></div><div dir="ltr"><br></div></div></div><br><div \
class="gmail_quote"><div dir="ltr">On Mon, Sep 17, 2018 at 11:58 AM Budai, László \
&lt;<a href="mailto:laszlo.budai@oneidentity.com" \
target="_blank">laszlo.budai@oneidentity.com</a>&gt; wrote:<br></div><blockquote \
class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc \
solid;padding-left:1ex"><div dir="ltr"><div>Hi,<br></div><div><br></div><div>Do you \
need help in how to test the latest \
changes?<br></div><div><br></div><div>L.<br></div><br><div><div \
class="gmail_extra"><br><div class="gmail_quote">On Mon, Sep 17, 2018 at 3:03 PM, Nik \
Ambrosch <span dir="ltr">&lt;<a href="mailto:nik@ambrosch.com" \
target="_blank">nik@ambrosch.com</a>&gt;</span> wrote:<br><blockquote \
class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc \
solid;padding-left:1ex"><div dir="ltr"><div>Is there any other information I can \
provide in order to help resolve this?</div><div><br></div></div><br><div \
class="gmail_quote"><div dir="ltr">On Tue, Sep 11, 2018 at 1:48 PM Nik Ambrosch \
&lt;<a href="mailto:nik@ambrosch.com" target="_blank">nik@ambrosch.com</a>&gt; \
wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 \
.8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div dir="ltr"><div \
dir="ltr"><div dir="ltr"><div dir="ltr"><div>I setup a syslog-ng 3.9 device to \
capture a message using<br></div><div><br></div><div>network(transport(tcp) \
flags(no-parse));</div><div><br></div><div>Here&#39;s what was \
logged:<br></div><div><br></div><div dir="ltr">Sep 11 12:14:51 1.1.1.1 &lt;190&gt;53: \
Sep 11 16:14:50.588: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host \
blahblah<br><br></div><div>Followed up with a device that delivers a proper hostname, \
this is what was logged:</div><div><br></div><div>Sep 11 13:17:39 2.2.2.2 \
&lt;190&gt;10474: Sep 11 17:17:38.447 UTC: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to \
host blahblah<br></div><div><br></div><div>Looks like the difference is the working \
device contains a timezone where as the non-working device does not.   Everything \
else is the same however neither contain a hostname like in your \
example.<br></div><div><br></div><div><br></div><div dir="ltr"><br></div><div \
dir="ltr"><br></div></div></div></div></div></div><div class="gmail_extra"><br><div \
class="gmail_quote">On Tue, Sep 11, 2018 at 9:45 AM, Budai, László <span \
dir="ltr">&lt;<a href="mailto:laszlo.budai@oneidentity.com" \
target="_blank">laszlo.budai@oneidentity.com</a>&gt;</span> wrote:<br><blockquote \
class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc \
solid;padding-left:1ex"><div dir="ltr"><div \
dir="ltr"><div>Hi,</div><div><br></div><div>instead of reverting the ipv6 heuristic, \
I propose another solution:</div><div><a \
href="https://github.com/balabit/syslog-ng/pull/2272" \
target="_blank">https://github.com/balabit/syslog-ng/pull/2272</a></div><div><br></div><div>I \
think that when a timestamp is followed by a colon(&#39;:&#39;), it is part of the \
timestamp and the (legacy) timestamp parser should &#39;eat&#39; \
it.<br></div><div><br></div><div>I tested with the following log:<br></div><div><span \
class="m_-3095059812338776623m_-3949274382587801019m_-3786985030304924382m_68538530495 \
8424464m_5338069929607792025m_-3240868514605911311m_-2277337889873492712m_-31236820728 \
46733048m_-2805381115174931326m_1441315018812253849m_1217662517935852919m_-3437618904530764263m_5001920760894036064gmail-blob-code-inner \
m_-3095059812338776623m_-3949274382587801019m_-3786985030304924382m_685385304958424464 \
m_5338069929607792025m_-3240868514605911311m_-2277337889873492712m_-312368207284673304 \
8m_-2805381115174931326m_1441315018812253849m_1217662517935852919m_-3437618904530764263m_5001920760894036064gmail-blob-code-marker-addition"><span \
class="m_-3095059812338776623m_-3949274382587801019m_-3786985030304924382m_68538530495 \
8424464m_5338069929607792025m_-3240868514605911311m_-2277337889873492712m_-31236820728 \
46733048m_-2805381115174931326m_1441315018812253849m_1217662517935852919m_-3437618904530764263m_5001920760894036064gmail-pl-s">&lt;0&gt;91: \
*Oct 07 03:10:04: <a href="http://mydevice.com" target="_blank">mydevice.com</a> \
<span class="m_-3095059812338776623m_-3949274382587801019m_-3786985030304924382m_68538 \
5304958424464m_5338069929607792025m_-3240868514605911311m_-2277337889873492712m_-31236 \
82072846733048m_-2805381115174931326m_1441315018812253849m_1217662517935852919m_-34376 \
18904530764263m_5001920760894036064gmail-pl-c1">%C</span>RYPTO-4-RECVD_PKT_INV_SPI: \
decaps: rec&#39;d IPSEC packet has invalid spi for destaddr=150.1.1.1, prot=50, \
spi=0x72662541(1919296833), srcaddr=150.3.1.3</span></span></div><div><span \
class="m_-3095059812338776623m_-3949274382587801019m_-3786985030304924382m_68538530495 \
8424464m_5338069929607792025m_-3240868514605911311m_-2277337889873492712m_-31236820728 \
46733048m_-2805381115174931326m_1441315018812253849m_1217662517935852919m_-3437618904530764263m_5001920760894036064gmail-blob-code-inner \
m_-3095059812338776623m_-3949274382587801019m_-3786985030304924382m_685385304958424464 \
m_5338069929607792025m_-3240868514605911311m_-2277337889873492712m_-312368207284673304 \
8m_-2805381115174931326m_1441315018812253849m_1217662517935852919m_-3437618904530764263m_5001920760894036064gmail-blob-code-marker-addition"><span \
class="m_-3095059812338776623m_-3949274382587801019m_-3786985030304924382m_68538530495 \
8424464m_5338069929607792025m_-3240868514605911311m_-2277337889873492712m_-31236820728 \
46733048m_-2805381115174931326m_1441315018812253849m_1217662517935852919m_-3437618904530764263m_5001920760894036064gmail-pl-s"><br></span></span></div><div><span \
class="m_-3095059812338776623m_-3949274382587801019m_-3786985030304924382m_68538530495 \
8424464m_5338069929607792025m_-3240868514605911311m_-2277337889873492712m_-31236820728 \
46733048m_-2805381115174931326m_1441315018812253849m_1217662517935852919m_-3437618904530764263m_5001920760894036064gmail-blob-code-inner \
m_-3095059812338776623m_-3949274382587801019m_-3786985030304924382m_685385304958424464 \
m_5338069929607792025m_-3240868514605911311m_-2277337889873492712m_-312368207284673304 \
8m_-2805381115174931326m_1441315018812253849m_1217662517935852919m_-3437618904530764263m_5001920760894036064gmail-blob-code-marker-addition"><span \
class="m_-3095059812338776623m_-3949274382587801019m_-3786985030304924382m_68538530495 \
8424464m_5338069929607792025m_-3240868514605911311m_-2277337889873492712m_-31236820728 \
46733048m_-2805381115174931326m_1441315018812253849m_1217662517935852919m_-3437618904530764263m_5001920760894036064gmail-pl-s">Could \
you validate that this is the same format that you \
have?</span></span><br></div><div><br></div><div>L.<br></div></div></div><div \
class="gmail_extra"><br><div class="gmail_quote">On Mon, Sep 10, 2018 at 4:32 PM, \
Scheidler, Balázs <span dir="ltr">&lt;<a \
href="mailto:balazs.scheidler@oneidentity.com" \
target="_blank">balazs.scheidler@oneidentity.com</a>&gt;</span> wrote:<br><blockquote \
class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc \
solid;padding-left:1ex"><div dir="ltr"><div>This branch has a patch to revert that \
specific commit, and I&#39;ve confirmed that it resolves the issue for me, in \
exchange for not supporting IPV6 addresses in the hostname \
field.</div><div><br></div></div><div class="gmail_extra"><br><div \
class="gmail_quote">On Mon, Sep 10, 2018 at 3:55 PM, Balazs Scheidler <span \
dir="ltr">&lt;<a href="mailto:bazsi77@gmail.com" \
target="_blank">bazsi77@gmail.com</a>&gt;</span> wrote:<br><blockquote \
class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc \
solid;padding-left:1ex"><div dir="ltr"><div dir="ltr"><div>This patch broke \
it:</div><div><br></div><div>399d565e9857e7cb41253e9a714d5cc6ad4d50fb.</div><div><br></div><div>This \
patch can be reverted easily even on the latest master to resolve the \
issue.<br></div></div></div><div \
class="m_-3095059812338776623m_-3949274382587801019m_-3786985030304924382m_68538530495 \
8424464m_5338069929607792025m_-3240868514605911311m_-2277337889873492712m_-31236820728 \
46733048m_-2805381115174931326m_1441315018812253849m_1217662517935852919m_-3437618904530764263m_5001920760894036064m_-5482981200732931473HOEnZb"><div \
class="m_-3095059812338776623m_-3949274382587801019m_-3786985030304924382m_68538530495 \
8424464m_5338069929607792025m_-3240868514605911311m_-2277337889873492712m_-31236820728 \
46733048m_-2805381115174931326m_1441315018812253849m_1217662517935852919m_-3437618904530764263m_5001920760894036064m_-5482981200732931473h5"><br><div \
class="gmail_quote"><div dir="ltr">On Mon, Sep 10, 2018 at 3:16 PM Scheidler, Balázs \
&lt;<a href="mailto:balazs.scheidler@oneidentity.com" \
target="_blank">balazs.scheidler@oneidentity.com</a>&gt; wrote:<br></div><blockquote \
class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc \
solid;padding-left:1ex"><div dir="auto">This is probably not it, the syslog-parser() \
changed some behaviours that changed it.</div><br><div class="gmail_quote"><div \
dir="ltr">On Mon, Sep 10, 2018, 13:45 Budai, László &lt;<a \
href="mailto:laszlo.budai@oneidentity.com" \
target="_blank">laszlo.budai@oneidentity.com</a>&gt; wrote:<br></div><blockquote \
class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc \
solid;padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div \
dir="ltr"><div dir="ltr"><div>Hi,</div><div><br></div><div>in syslog-ng OSE 3.13 [1] \
we introduced a new feature, called app-parser [2] and the default network network \
driver is using it.</div><div>Maybe that could cause your issue.   If this is the \
case, then we have another PR [3] which makes it possible to disable the auto-parse \
(also part of 3.13).</div><div><br></div><div>Example: <br></div><div>source \
s_network {<br>   default-network-drivers(auto-parse(no));<br>};<br><br></div><div><table \
class="m_-3095059812338776623m_-3949274382587801019m_-3786985030304924382m_68538530495 \
8424464m_5338069929607792025m_-3240868514605911311m_-2277337889873492712m_-31236820728 \
46733048m_-2805381115174931326m_1441315018812253849m_1217662517935852919m_-34376189045 \
30764263m_5001920760894036064m_-5482981200732931473m_-8752580009611113285m_-446578958207021189m_5049968178163612207gmail-highlight \
m_-3095059812338776623m_-3949274382587801019m_-3786985030304924382m_685385304958424464 \
m_5338069929607792025m_-3240868514605911311m_-2277337889873492712m_-312368207284673304 \
8m_-2805381115174931326m_1441315018812253849m_1217662517935852919m_-343761890453076426 \
3m_5001920760894036064m_-5482981200732931473m_-8752580009611113285m_-446578958207021189m_5049968178163612207gmail-tab-size \
m_-3095059812338776623m_-3949274382587801019m_-3786985030304924382m_685385304958424464 \
<br>______________________________________________________________________________<br>
 Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" \
rel="noreferrer noreferrer" \
                target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>

Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" \
rel="noreferrer noreferrer" \
target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>

FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer noreferrer" \
target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br> <br>
<br></blockquote></div><br></div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" \
rel="noreferrer noreferrer" \
                target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>

Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" \
rel="noreferrer noreferrer" \
target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>

FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer noreferrer" \
target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br> <br>
</blockquote></div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" \
rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>

Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" \
rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>

FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" \
target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br> <br>
</blockquote></div><br clear="all"><span \
class="m_-3095059812338776623m_-3949274382587801019m_-3786985030304924382m_68538530495 \
8424464m_5338069929607792025m_-3240868514605911311m_-2277337889873492712m_-31236820728 \
46733048m_-2805381115174931326m_1441315018812253849m_1217662517935852919m_-3437618904530764263m_5001920760894036064HOEnZb"><font \
color="#888888"><br></font></span></div></div><span \
class="m_-3095059812338776623m_-3949274382587801019m_-3786985030304924382m_68538530495 \
8424464m_5338069929607792025m_-3240868514605911311m_-2277337889873492712m_-31236820728 \
46733048m_-2805381115174931326m_1441315018812253849m_1217662517935852919m_-3437618904530764263m_5001920760894036064HOEnZb"><font \
color="#888888"><span \
class="m_-3095059812338776623m_-3949274382587801019m_-3786985030304924382m_68538530495 \
8424464m_5338069929607792025m_-3240868514605911311m_-2277337889873492712m_-31236820728 \
46733048m_-2805381115174931326m_1441315018812253849m_1217662517935852919m_-3437618904530764263m_5001920760894036064m_-5482981200732931473HOEnZb"><font \
color="#888888">-- <br><div dir="ltr" \
class="m_-3095059812338776623m_-3949274382587801019m_-3786985030304924382m_68538530495 \
8424464m_5338069929607792025m_-3240868514605911311m_-2277337889873492712m_-31236820728 \
46733048m_-2805381115174931326m_1441315018812253849m_1217662517935852919m_-34376189045 \
30764263m_5001920760894036064m_-5482981200732931473m_-8752580009611113285gmail_signature" \
data-smartmail="gmail_signature">Bazsi</div> \
</font></span><br>______________________________________________________________________________<br>
 Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" \
rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>

Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" \
rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>

FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" \
target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br> <br>
<br></font></span></blockquote></div><br></div>
<br>______________________________________________________________________________<br>
 Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" \
rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>

Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" \
rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>

FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" \
target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br> <br>
<br></blockquote></div><br></div>
<br>______________________________________________________________________________<br>
 Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" \
rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>

Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" \
rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>

FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" \
target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br> <br>
<br></blockquote></div><br></div>
</blockquote></div>
<br>______________________________________________________________________________<br>
 Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" \
rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>

Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" \
rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>

FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" \
target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br> <br>
<br></blockquote></div><br></div></div></div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" \
rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>

Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" \
rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>

FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" \
target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br> <br>
</blockquote></div>
<br>______________________________________________________________________________<br>
 Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" \
rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>

Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" \
rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>

FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" \
target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br> <br>
<br></blockquote></div><br></div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" \
rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>

Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" \
rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>

FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" \
target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br> <br>
</blockquote></div>
</blockquote></div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" \
rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>

Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" \
rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>

FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" \
target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br> <br>
</blockquote></div><br clear="all"><br>-- <br><div dir="ltr" \
class="m_-3095059812338776623m_-3949274382587801019m_-3786985030304924382m_685385304958424464m_5338069929607792025gmail_signature" \
data-smartmail="gmail_signature">Bazsi</div> \
______________________________________________________________________________<br> \
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" \
rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>

Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" \
rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>

FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" \
target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br> <br>
</blockquote></div>
</blockquote></div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" \
rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>

Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" \
rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>

FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" \
target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br> <br>
</blockquote></div></div>

[Attachment #6 (text/plain)]

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

[prev in list] [next in list] [prev in thread] [next in thread] 