1

Should start off that I’m not an expert in Linux, primarily a Windows Engineer. With that said I’m having some trouble limiting Syslog-NG on Ubuntu from using 100% of the local disk.

In order to ingest Syslog messages from our FortiGates into Microsoft Sentinel, we have to use a log forwarder. In this case its an Ubuntu VM that receives the Syslog messages via Syslog-NG and forwards them up to Microsoft Sentinel. We have zero need to keep these messages on the local VM after being forwarded to Sentinel. No configuration changes have been made since installing Syslog-NG, completely vanilla default.

How can I change Syslog-NG behavior to receive the message, forward the message and delete from local disk to avoid disk full situations? A Linux for Idiots answer would be extremely helpful, a step by step if anyone could be so kind. Really appreciate any help!

6 Spice ups
2

The configuration format is very simple for syslog-ng, there are 3 sections that you are going to use 99%of the time.

source - with some squiggle brackets enclosing names of things that make log entries
destination - with squiggle wrapped list of places to forward log data to
log {source(thing);destination(thing) which links them together.

when the log data is supposed to be put in a file, the place thing in the destination squiggle section is file(‘/some/path/and/filename’)

I suspect you have that in your config, and don’t want it, sence you are just passing data from one machine to another machine, — unless — someone had to write a log format translator to rewrite the fortigate data stream into aproper compatable format, in which case, yes, you need to write and read it back and now your life is misery because someone can’t follow standards.

Then you probably need to make a cron job to stop syslog, rename the log file, start it back up again, make sure all that worked, then delete the old one…
But that is a cron thing, not a syslog thing…

4 Spice ups
3

Thanks for reaching out! Posting my configuration files below. The only thing I’m missing is any callouts to a file. Would you mind taking a look through here and let me know what to change up? Very grateful for your assist.

/conf.d/azuremonitoragent-tcp.conf

during install time, we detect if s_src exist, if it does then we

replace it by appropriate source name like in redhat ‘s_sys’

Forwrding using tcp

destination d_azure_mdsd {
network(“127.0.0.1”
port(28330)
flags(no_multi_line)
log-fifo-size(25000));
};

log {
source(s_src); # will be automatically parsed from /etc/syslog-ng/syslog-ng.conf
destination(d_azure_mdsd);
flags(flow-control);
};

/etc/syslog-ng/syslog-ng.conf
#log { source(s_src); filter(f_mail); filter(f_info); destination(d_mailinfo); };
#log { source(s_src); filter(f_mail); filter(f_warn); destination(d_mailwarn); };
#log { source(s_src); filter(f_mail); filter(f_err); destination(d_mailerr); };

log { source(s_src); filter(f_news); filter(f_crit); destination(d_newscrit); };
log { source(s_src); filter(f_news); filter(f_err); destination(d_newserr); };
log { source(s_src); filter(f_news); filter(f_notice); destination(d_newsnotice); };
#log { source(s_src); filter(f_cnews); destination(d_console_all); };
#log { source(s_src); filter(f_cother); destination(d_console_all); };

#log { source(s_src); filter(f_ppp); destination(d_ppp); };

log { source(s_src); filter(f_debug); destination(d_debug); };
log { source(s_src); filter(f_error); destination(d_error); };
log { source(s_src); filter(f_messages); destination(d_messages); };

log { source(s_src); filter(f_console); destination(d_console_all); destination(d_xconsole); };
log { source(s_src); filter(f_crit); destination(d_console); };

All messages send to a remote site

#log { source(s_src); destination(d_net); };

Include all config files in /etc/syslog-ng/conf.d/

@include “/etc/syslog-ng/conf.d/*.conf”

#source s_src { udp( port(514)); tcp( port(514));};
#source s_src { udp( port(514)); tcp( port(514));};
source s_src { udp( port(514)); tcp( port(514));};

1 Spice up
4

Hmm, this is depreciated, do you know what version of syslog-ng you have?
Anyway, that is 25k messages being stashed on disk, but, it should clean up after itself, but
part of why it is depreciated is it leaks …sigh

The newer versions have better commands for specifying storage (where to put the fifo), reliability (is it ok to delete before confirming destination got the logs) etc, but you can’t use them if ng is too old..

What you can do easily in the meantime is make that size a little smaller, not less than 1000 however..

3 Spice ups
5

Just get rid off the config boilerplate because that instructs syslog-ng to write logs to the local disk. If you don’t want it, just remove it. I’d start from a clean/empty config and only add the relevant stuff to it.

You have an azure config file in conf.d, retain that and the sources it references and remove the rest.

Btw, original syslog-ng founder here.

1 Spice up