Re: certificate errors result in excessive logging.

--===============7439522815381738340==
Content-Type: multipart/alternative; boundary="000000000000381837062501ebfc"

--000000000000381837062501ebfc
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

hi,

I literally submitted a patch this morning to mute #3 from the list above.
https://github.com/axoflow/axosyslog/pull/352

As for the other two, you can filter these out from your internal() source
using regexps.
Bazsi

On Mon, Oct 21, 2024 at 9:30=E2=80=AFPM Evan Rempel <[email protected]> wrote=
:

> I am using tls configuration with a locally signed certificate. This mans
> that I have to configure a custom root CA on to all client systems for th=
em
> to be able to establish the tls connection to my syslog server.
>
> When the clients are unable to verify the server certificate, the server
> logs three messages for every connection attempt
>
> syslog-ng[452597]: SSL error while reading stream;
> tls_error=3D'error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unkn=
own
> ca', location=3D'/etc/syslog-ng/syslog-ng.server.conf:71:17'
> syslog-ng[452597]: Error reading RFC6587 style framed data; fd=3D'21',
> error=3D'Connection reset by peer (104)'
> syslog-ng[452597]: Syslog connection closed; fd=3D'21',
> client=3D'AF_INET(1.2.3.4:1234)', local=3D'AF_INET(1.2.3.4:1234)'
>
> If there are 100's of clients, and they try to reconnect at a fast rate
> (every 5 seconds) this can result in a large volume of messages.
>
> Is there any way to configure the logging rate of these types of errors o=
r
> get rid of it altogether.
>
> Anyone have any comments on this?
>
>
>
> --
> Evan
>
> _________________________________________________________________________=
_____
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=3Dsyslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>

--=20
Bazsi

--000000000000381837062501ebfc
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>hi,</div><div><br></div><div>I literally submitted a =
patch this morning to mute #3 from the list above.</div><div><a href=3D"htt=
ps://github.com/axoflow/axosyslog/pull/352">https://github.com/axoflow/axos=
yslog/pull/352</a></div><div><br></div><div>As for the other two, you can f=
ilter these out from your internal() source using regexps.</div><div>Bazsi<=
br></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gma=
il_attr">On Mon, Oct 21, 2024 at 9:30=E2=80=AFPM Evan Rempel &lt;<a href=3D=
"mailto:[email protected]">[email protected]</a>&gt; wrote:<br></div><blockquot=
e class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px s=
olid rgb(204,204,204);padding-left:1ex"><div class=3D"msg459091407509125494=
5">




<div dir=3D"ltr">
<div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali=
bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
I am using tls configuration with a locally signed certificate. This mans t=
hat I have to configure a custom root CA on to all client systems for them =
to be able to establish the tls connection to my syslog server.</div>
<div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali=
bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali=
bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
When the clients are unable to verify the server certificate, the server lo=
gs three messages for every connection attempt</div>
<div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali=
bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali=
bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
syslog-ng[452597]: SSL error while reading stream; tls_error=3D&#39;error:1=
4094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca&#39;, location=
=3D&#39;/etc/syslog-ng/syslog-ng.server.conf:71:17&#39;</div>
<div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali=
bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
syslog-ng[452597]: Error reading RFC6587 style framed data; fd=3D&#39;21&#3=
9;, error=3D&#39;Connection reset by peer (104)&#39;</div>
<div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali=
bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
syslog-ng[452597]: Syslog connection closed; fd=3D&#39;21&#39;, client=3D&#=
39;AF_INET(1.2.3.4:1234)&#39;, local=3D&#39;AF_INET(<a href=3D"http://1.2.3=
.4:1234" target=3D"_blank">1.2.3.4:1234</a>)&#39;</div>
<div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali=
bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali=
bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
If there are 100&#39;s of clients, and they try to reconnect at a fast rate=
 (every 5 seconds) this can result in a large volume of messages.</div>
<div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali=
bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali=
bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Is there any way to configure the logging rate of these types of errors or =
get rid of it altogether.</div>
<div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali=
bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali=
bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Anyone have any comments on this?</div>
<div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali=
bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali=
bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div id=3D"m_4590914075091254945Signature">
<div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali=
bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"font-family:&quot;Courier New&quot;,monospace;font-size:14.66=
67px;color:rgb(153,153,153)">
<span style=3D"background-color:rgb(255,255,255)">--</span></div>
<div style=3D"font-family:&quot;Courier New&quot;,monospace;font-size:14.66=
67px;color:rgb(153,153,153)">
<span style=3D"background-color:rgb(255,255,255)">Evan</span></div>
</div>
</div>

___________________________________________________________________________=
___<br>
Member info: <a href=3D"https://lists.balabit.hu/mailman/listinfo/syslog-ng=
" rel=3D"noreferrer" target=3D"_blank">https://lists.balabit.hu/mailman/lis=
tinfo/syslog-ng</a><br>
Documentation: <a href=3D"http://www.balabit.com/support/documentation/?pro=
duct=3Dsyslog-ng" rel=3D"noreferrer" target=3D"_blank">http://www.balabit.c=
om/support/documentation/?product=3Dsyslog-ng</a><br>
FAQ: <a href=3D"http://www.balabit.com/wiki/syslog-ng-faq" rel=3D"noreferre=
r" target=3D"_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</div></blockquote></div><br clear=3D"all"><br><span class=3D"gmail_signatu=
re_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signature">Bazsi</=
div>

--000000000000381837062501ebfc--

--===============7439522815381738340==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq


--===============7439522815381738340==--