2023-07-04, 09:15–12:15 (Europe/Paris), Workshop room
The syslog-ng application is an enhanced logging daemon with a focus on portability and high-performance central log collection. It is used mainly by IT security professionals, but also in Ops and DevOps environments and by embedded developers. The syslog-ng workshop helps you take the first steps with syslog-ng, and shows how you can quickly get more information out of your logs and have greater insight into what happens on your network. Ideal for beginners, but covers advanced possibilities for seasoned syslog-ng users as well. It also introduces you to syslog-ng 4 changes, focusing on type support, and how it makes your work easier and broadens possibilities.
You will learn:
• The basic concepts of configuring and running syslog-ng,
• an introduction to message parsing,
• how to store your log messages in Elasticsearch, and
• differences between syslog-ng 3 and 4
To try the configurations on your machine, you will need:
• a recent version of syslog-ng (3.23 or newer: https://syslog-ng.com/3rd-party-binaries)
• Elasticsearch 7+ with Kibana installed or Opensearch (optional)
Last time I was criticized that handing out an USB key at a security event is controversial :-) so install syslog-ng and optionally Elasticsearch on your laptop or in a VM.
Workshop schedule:
• Theory: Introductory presentation - the concepts of syslog-ng. Explains the different building blocks (sources, parsers, filters, destinations, etc.), and how to connect them together using log statements.
• Practice: Try these concepts in practice. Creating a simple configuration, checking syntax, running in the foreground with different debugging options, and running in the background as a service.
• Theory: Message parsing is a main feature of syslog-ng from the security professional point of view. Most of the log messages on Linux / UNIX arrive in a free form text format, which are easy to read by humans, but very difficult to act on. Using message parsing you can extract actionable information from log messages and create alerts or simply storing data in an easy to search format.
• Pratice: Extend the configuration with a few filters and parsers to make it more complex. To see the results of parsing, we use templates on the output side to include name-value pairs.
• See the differences between syslog-ng 3 and 4
• Practice: Store the results to Elasticsearch and display them in Kibana.
• Q&A session (if there is some time left): touch a few additional topics, based on questions from the audience.
Peter is an engineer working as open source evangelist at Balabit (a One Identity business), the company that developed syslog-ng. He assists distributions to maintain the syslog-ng package, follows bug trackers, helps users and talks regularly about sudo and syslog-ng at conferences (SCALE, All Things Open, FOSDEM, LOADays, and others). In his limited free time he is interested in non-x86 architectures, and works on one of his PPC or ARM machines.