• How can I change the macro names to lowercase

    Hello folks:

    I am sending my syslog-ng messages to kafka successfully. I am trying to figure out how I can set my macro names to use lowercase. I am talking about using "source" instead of "SOURCE" or "program" instead of "PROGRAM…

  • Configure memory buffer for "messages" destination

    Hello, I'm trying to configure the syslog-ng service to write the log messages to disk every 10 messages instead of every one.

    I tried to configure via the /etc/syslog-ng/syslog-ng.conf file as below, but it didn't work, the messages keep getting…

  • Syslog-ng OSE ingesting logs from Varonis Server

    Hello All,

    I am running a Linux Centos8 Server with Syslog-ng OSE @version:3.36

    I am having issues ingesting logs coming from Varonis. When running wireshark on the Syslog Server I see the test message being sent from the Varonis Server 10.*.*.196 to…

  • SSB sizing


    we would need some assistance with sizing a virtual syslog-store-box that should handle approximately 5000 clients, mostly divided in windows and linux server (only audit logs) Specifically, we require an SSB that can handle 4,000 events per…

  • Syslog-NG PE ingesting LSH logs using Default-network-drivers and log out to a central SSB

    Seeking advice to on the following :

    Q) Can Syslog-ng PE (7.0.29) be setup as a Relay server, ingesting LSH log data using *default-network-source driver which then pipe towards a central Syslog-ng StoreBox (6.0.4)?

    Example config done :

    source sdnd …

  • syslog-ng unable to read from a UDP port


    I am fairly new to this and trying to figure out why syslog-ng is unable to read from a TCP/UDP port.

    Syslog-ng is running on a server that has multiple interfaces and two of the interfaces have IP addresses assigned to them. We are receiving…

  • Separate logs into different folders that come from single source

    We have logs that comes from a log aggregator, so they are coming from a single source.  We are sending the logs to file destination, which our SEIM is monitoring the root of the folder to detect the new files.  Our current default config is as below,

  • Forwarding server relay logs to a collector behind a proxy

    I would like to forward logs to a centralized collector behind a proxy. The layout would look something like this: client > server relay > proxy server > internet > main collector. I am having trouble finding a destination driver that will…

  • Obtaining events from Oracle dba_common_audit_trail

    Hi forum readers,

    I'm trying to use the oracle driver to obtain the events from the Oracle table "sys.dba_common_audit_trail" at regular intervals but avoiding the potential of retrieving the same log more than once (duplication).  So far…

  • How to get a hold of a sales person?

    Hi, I've been trying to find a Sales person for Syslog-ng premium.  I fill out the form on the One identity web page, but no one ever contacts me..  Does anyone have direct number to sales for syslog-ng premium? 


  • [Newbie] How to have Syslog-NG Forward the logs it received to another Log Server

    What I have: 

    1. Syslog-NG on Centos 7.9

    syslog-ng 3.5.6
    Installer-Version: 3.5.6
    Compile-Date: Dec 30 2015 19:57:24
    Available-Modules: affile,afprog,afsocket-notls,afsocket-tls,afsocket,afstomp,afuser,basicfuncs,confgen,cryptofuncs,csvparser,dbparser…

  • Error assertion failed on syslog-ng

    Hi team , 

    it is a pleasure to write to you, i need to discuss on syslog-ng issue .
    We have many client syslog-ng service , and we got this error : 


  • Syslog-ng-wec no communication between host and collector

    Recently I've installed Syslog-NG PE.
    I need to forward events from Windows Servers to WEC.
    I have carefully followed all steps from administration guide.
    At the beginning the connection was established (Windows 10 -> CentOS 7 with WEC), but in the…

  • Syslog-ng to send data to ELK post parsing

    Syslog-ng is collecting cisco switch , routers and firewall data, which needs to be sent to ELK.

    Before sending, how can i format logs into JSON

  • How syslog-ng check specific host alive.


    I have a question about how syslog-ng check specific host alive, does syslog-ng have this function?

    For example, if I have three hosts, how can I know which host is disconnected, where to show the disconnected host?

    Pong Chang

    Best rega…

  • Cipher Suite Security Level for Syslog-ng Store Box

    Hi, folks at Balabit/One Identity,

    In the Syslog-ng Store Box 6.0 configuration for Cipher Suite, we can configure Syslog-ng web application Cipher Suite Security Level to Secure.

    (Basic Settings > Management > Web Interface and RPC API Settings)…

  • Need help to confirm understanding of syslog-ng nested log elements.

    I am trying to educate myself on syslog-ng product configuration, and hope someone will be kind enough to verify my understanding of the syslog-ng configuration file (between line 100-120) below.

    1) Line 101-103, the purpose is to read unfiltered messages…

  • System Hardening Guideline Standard for Syslog-ng

    Hi, folks at Balabit/One Identity,

    We are in the middle of security evaluating for Syslog-ng PE and Syslog-ng Store Box.
    For Syslog-ng to place in my environment, the system will need to be secure.
    Is Syslog-ng PE and Store Box following any System Hardening…

  • Troubleshooting Syslog-NG

    Basic troubleshooting

    Syslog-ng has an advanced internal logging mechanism. In case of event info, warning, error, fatal or debug messages are generated.  All messages generated internally by syslog-ng use a special source called internal(). Syslog-ng…