Syslog-NG and UTF8.

hack3rcon · 08-16-2017, 06:49 AM

Hello.
I want to know can Syslog-NG support UTF8?

Code:

# syslog-ng --version
syslog-ng 3.5.6
Installer-Version: 3.5.6
Revision: 
Compile-Date: Dec 30 2015 19:57:24
Available-Modules: affile,afprog,afsocket-notls,afsocket-tls,afsocket,afstomp,afuser,basicfuncs,confgen,cryptofuncs,csvparser,dbparser,linux-kmsg-format,syslogformat,system-source,afsql
Enable-Debug: off
Enable-GProf: off
Enable-Memtrace: off
Enable-IPv6: on
Enable-Spoof-Source: on
Enable-TCP-Wrapper: on
Enable-Linux-Caps: on
Enable-Pcre: on

Some file and folder characters are not English.

Thank you so much.

balabit · 08-17-2017, 02:02 AM

Hi,
Yes, it should work with syslog-ng. If you have any problems, try a newer version and report the issue on github: https://github.com/balabit/syslog-ng/issues

hack3rcon · 08-19-2017, 06:43 AM

Quote:

Originally Posted by balabit

Hi,
Yes, it should work with syslog-ng. If you have any problems, try a newer version and report the issue on github: https://github.com/balabit/syslog-ng/issues

I'm using "CentOS Linux release 7.3.1611 (Core)" and "yum update syslog-ng*" not showed me any update.
Can you tell me the parameter for UTF8?

hack3rcon · 08-22-2017, 02:42 AM

Any idea?

balabit · 08-23-2017, 02:35 AM

Hi,

What parameter do you mean? Internally, syslog-ng represents every message as UTF8. If you write the filenames in your configuration file, that should work. If you use macros in the filenames that contain special characters, then syslog-ng should handle this as well if the incoming message is in UTF8. If it is not, and you want syslog-ng to convert the message to UTF8, then check the UTF-8-related flags options in the syslog-ng source: https://www.balabit.com/documents/sy...tml#idp2420176

hack3rcon · 08-23-2017, 08:12 AM

Quote:

Originally Posted by balabit

Hi,

What parameter do you mean? Internally, syslog-ng represents every message as UTF8. If you write the filenames in your configuration file, that should work. If you use macros in the filenames that contain special characters, then syslog-ng should handle this as well if the incoming message is in UTF8. If it is not, and you want syslog-ng to convert the message to UTF8, then check the UTF-8-related flags options in the syslog-ng source: https://www.balabit.com/documents/sy...tml#idp2420176

The filenames in my configuration file? My configuration is:

Code:

options {
        flush_lines (0);
        time_reopen (10);
        log_fifo_size (1000);
        chain_hostnames (off);
        use_dns (no);
        use_fqdn (no);
        create_dirs (no);
        keep_hostname (yes);
        ts_format(iso);
};

source s_netsyslog {
   # system();
   # internal();
   udp(ip(0.0.0.0) port(514) flags(no-hostname));
   tcp(ip(0.0.0.0) port(514) flags(no-hostname));
};
destination d_separatedbyhosts { file("/var/log/$HOST/messages" owner("root") group("root") perm(0655) dir_perm(0755) create_dirs(yes));
};
log { source(s_netsyslog); destination(d_separatedbyhosts); };
@include "/etc/syslog-ng/conf.d/*.conf"

What is the Syslog-NG version for Windows? I mean is agent.