certificate errors result in excessive logging.
Evan Rempel <[email protected]> Mon, 21 Oct 2024 19:29:50 +0000
| Newsgroups | gmane.comp.syslog-ng |
|---|---|
| Message-ID | <YT4P288MB033522E860DB4E0E91AC6813B9432@YT4P288MB0335.CANP288.PROD.OUTLOOK.COM> |
--===============5919079226260899656==
Content-Language: en-CA
Content-Type: multipart/alternative;
boundary="_000_YT4P288MB033522E860DB4E0E91AC6813B9432YT4P288MB0335CANP_"
--_000_YT4P288MB033522E860DB4E0E91AC6813B9432YT4P288MB0335CANP_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
I am using tls configuration with a locally signed certificate. This mans t=
hat I have to configure a custom root CA on to all client systems for them =
to be able to establish the tls connection to my syslog server.
When the clients are unable to verify the server certificate, the server lo=
gs three messages for every connection attempt
syslog-ng[452597]: SSL error while reading stream; tls_error=3D'error:14094=
418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca', location=3D'/etc/=
syslog-ng/syslog-ng.server.conf:71:17'
syslog-ng[452597]: Error reading RFC6587 style framed data; fd=3D'21', erro=
r=3D'Connection reset by peer (104)'
syslog-ng[452597]: Syslog connection closed; fd=3D'21', client=3D'AF_INET(1=
.2.3.4:1234)', local=3D'AF_INET(1.2.3.4:1234)'
If there are 100's of clients, and they try to reconnect at a fast rate (ev=
ery 5 seconds) this can result in a large volume of messages.
Is there any way to configure the logging rate of these types of errors or =
get rid of it altogether.
Anyone have any comments on this?
--
Evan
--_000_YT4P288MB033522E860DB4E0E91AC6813B9432YT4P288MB0335CANP_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=
1">
<style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo=
ttom:0;} </style>
</head>
<body dir=3D"ltr">
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
I am using tls configuration with a locally signed certificate. This mans t=
hat I have to configure a custom root CA on to all client systems for them =
to be able to establish the tls connection to my syslog server.</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
<br>
</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
When the clients are unable to verify the server certificate, the server lo=
gs three messages for every connection attempt</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
<br>
</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
syslog-ng[452597]: SSL error while reading stream; tls_error=3D'error:14094=
418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca', location=3D'/etc/=
syslog-ng/syslog-ng.server.conf:71:17'</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
syslog-ng[452597]: Error reading RFC6587 style framed data; fd=3D'21', erro=
r=3D'Connection reset by peer (104)'</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
syslog-ng[452597]: Syslog connection closed; fd=3D'21', client=3D'AF_INET(1=
.2.3.4:1234)', local=3D'AF_INET(1.2.3.4:1234)'</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
<br>
</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
If there are 100's of clients, and they try to reconnect at a fast rate (ev=
ery 5 seconds) this can result in a large volume of messages.</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
<br>
</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
Is there any way to configure the logging rate of these types of errors or =
get rid of it altogether.</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
<br>
</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
Anyone have any comments on this?</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
<br>
</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
<br>
</div>
<div id=3D"Signature" class=3D"elementToProof">
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: "Courier New", monospace; font-size: 1=
4.6667px; color: rgb(153, 153, 153);">
<span style=3D"background-color: rgb(255, 255, 255);">--</span></div>
<div style=3D"font-family: "Courier New", monospace; font-size: 1=
4.6667px; color: rgb(153, 153, 153);">
<span style=3D"background-color: rgb(255, 255, 255);">Evan</span></div>
</div>
</body>
</html>
--_000_YT4P288MB033522E860DB4E0E91AC6813B9432YT4P288MB0335CANP_--
--===============5919079226260899656==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq
--===============5919079226260899656==--