syslog (stdlib.syslogMiner) does not work for PAN-OS generated logs

Reply
Highlighted
L3 Networker

syslog (stdlib.syslogMiner) does not work for PAN-OS generated logs

Hi community,

 

I installed a fresh ubuntu 16.04.6 and updated the installation to the newest packages. When I create the PAN-OS syslsog receiver as from "stdlib.syslogMiner" prototype, the miner does not receive anything.While doing a tcpdump capture on the inemeld device I can see syslog coming in to the rsyslogd via port 13514. PCAP shows the content I expect to see (syslog messages from PAN-OS). After investigating further I found in the local /var/log/syslog the following messages:

 

Oct 15 16:35:17 minemeld rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="971" x-info="http://www.rsyslog.com"] exiting on signal 15.
Oct 15 16:35:17 minemeld rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="1755" x-info="http://www.rsyslog.com"] start
Oct 15 16:35:17 minemeld systemd[1]: Stopping System Logging Service...
Oct 15 16:35:17 minemeld systemd[1]: Stopped System Logging Service.
Oct 15 16:35:17 minemeld rsyslogd-2222: command 'KLogPermitNonKernelFacility' is currently not permitted - did you already set it via a RainerScript command (v6+ config)? [v8.16.0 try http://www.rsyslog.com/e/2222 ]
Oct 15 16:35:17 minemeld systemd[1]: Starting System Logging Service...
Oct 15 16:35:17 minemeld rsyslogd-2066: could not load module '/usr/lib/rsyslog/pmpanngfw.so', dlopen: /usr/lib/rsyslog/pmpanngfw.so: cannot open shared object file: No such file or directory [v8.16.0 try http://www.rsyslog.com/e/2066 ]
Oct 15 16:35:17 minemeld rsyslogd-2066: could not load module '/usr/lib/rsyslog/mmnormalize.so', dlopen: /usr/lib/rsyslog/mmnormalize.so: cannot open shared object file: No such file or directory [v8.16.0 try http://www.rsyslog.com/e/2066 ]
Oct 15 16:35:17 minemeld rsyslogd-2066: could not load module '/usr/lib/rsyslog/omrabbitmq.so', dlopen: /usr/lib/rsyslog/omrabbitmq.so: cannot open shared object file: No such file or directory [v8.16.0 try http://www.rsyslog.com/e/2066 ]
Oct 15 16:35:17 minemeld rsyslogd-2209: module name 'mmnormalize' is unknown [v8.16.0 try http://www.rsyslog.com/e/2209 ]
Oct 15 16:35:17 minemeld rsyslogd-2207: error during parsing file /etc/rsyslog.d/60-syslog-minemeld.conf, on or before line 9: errors occured in file '/etc/rsyslog.d/60-syslog-minemeld.conf' around line 9 [v8.16.0 try http://www.rsyslog.com/e/2207 ]
Oct 15 16:35:17 minemeld rsyslogd-2209: module name 'omrabbitmq' is unknown [v8.16.0 try http://www.rsyslog.com/e/2209 ]
Oct 15 16:35:17 minemeld rsyslogd-2207: error during parsing file /etc/rsyslog.d/60-syslog-minemeld.conf, on or before line 22: errors occured in file '/etc/rsyslog.d/60-syslog-minemeld.conf' around line 22 [v8.16.0 try http://www.rsyslog.com/e/2207 ]
Oct 15 16:35:17 minemeld rsyslogd-2159: error: parser 'rsyslog.panngfw' unknown at this time (maybe defined too late in rsyslog.conf?) [v8.16.0 try http://www.rsyslog.com/e/2159 ]
Oct 15 16:35:17 minemeld rsyslogd: rsyslogd's groupid changed to 108
Oct 15 16:35:17 minemeld rsyslogd: rsyslogd's userid changed to 104
Oct 15 16:35:17 minemeld rsyslogd-2039: Could not open output pipe '/dev/xconsole':: No such file or directory [v8.16.0 try http://www.rsyslog.com/e/2039 ]
Oct 15 16:35:17 minemeld rsyslogd-2007: action 'action 10' suspended, next retry is Tue Oct 15 16:35:47 2019 [v8.16.0 try http://www.rsyslog.com/e/2007 ]

 

When I take a look in directory /usr/lib/rsyslog/ I cannot find the modules that are complained about in syslog:

root@minemeld:/var/log# ls -l /usr/lib/rsyslog/
total 640
-rw-r--r-- 1 root root 36960 Mar 25 2019 imfile.so
-rw-r--r-- 1 root root 24320 Mar 25 2019 imjournal.so
-rw-r--r-- 1 root root 19936 Mar 25 2019 imklog.so
-rw-r--r-- 1 root root 15680 Mar 25 2019 imkmsg.so
-rw-r--r-- 1 root root 11040 Mar 25 2019 immark.so
-rw-r--r-- 1 root root 19856 Mar 25 2019 impstats.so
-rw-r--r-- 1 root root 36992 Mar 25 2019 imptcp.so
-rw-r--r-- 1 root root 20128 Mar 25 2019 imtcp.so
-rw-r--r-- 1 root root 28624 Mar 25 2019 imudp.so
-rw-r--r-- 1 root root 33072 Mar 25 2019 imuxsock.so
-rw-r--r-- 1 root root 23648 Mar 25 2019 lmnet.so
-rw-r--r-- 1 root root 20864 Mar 25 2019 lmnetstrms.so
-rw-r--r-- 1 root root 25344 Mar 25 2019 lmnsd_ptcp.so
-rw-r--r-- 1 root root 6304 Mar 25 2019 lmregexp.so
-rw-r--r-- 1 root root 21088 Mar 25 2019 lmstrmsrv.so
-rw-r--r-- 1 root root 10496 Mar 25 2019 lmtcpclt.so
-rw-r--r-- 1 root root 33952 Mar 25 2019 lmtcpsrv.so
-rw-r--r-- 1 root root 10432 Mar 25 2019 lmzlibw.so
-rw-r--r-- 1 root root 14704 Mar 25 2019 mmanon.so
-rw-r--r-- 1 root root 19040 Mar 25 2019 mmexternal.so
-rw-r--r-- 1 root root 14832 Mar 25 2019 mmjsonparse.so
-rw-r--r-- 1 root root 14688 Mar 25 2019 mmpstrucdata.so
-rw-r--r-- 1 root root 14816 Mar 25 2019 mmsequence.so
-rw-r--r-- 1 root root 10592 Mar 25 2019 mmutf8fix.so
-rw-r--r-- 1 root root 10488 Mar 25 2019 omjournal.so
-rw-r--r-- 1 root root 19584 Mar 25 2019 ommail.so
-rw-r--r-- 1 root root 19056 Mar 25 2019 omprog.so
-rw-r--r-- 1 root root 15200 Mar 25 2019 omuxsock.so
-rw-r--r-- 1 root root 11176 Mar 25 2019 pmaixforwardedfrom.so
-rw-r--r-- 1 root root 11168 Mar 25 2019 pmcisconames.so
-rw-r--r-- 1 root root 11200 Mar 25 2019 pmlastmsg.so
-rw-r--r-- 1 root root 11168 Mar 25 2019 pmsnare.so
-rwxr-xr-x 1 root root 140 Mar 20 2019 rsyslog-rotate

 

So, there must be something wrong with the binary install.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!