March 2010 - syslog-ng-announce

syslog-ng Premium Edition 3.0.5 has been released
by devel＠balabit.hu 24 Mar '10

24 Mar '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 3.0.5 SUMMARY : new stable release DATE : Mar 24, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (3.0.5) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: General * The timezone offset of applications other than syslog-ng was not adjusted correctly during the one-hour transition period of the daylight-saving changes. This has been corrected. * If the /var/log directory did not exist the syslog-ng could not log into the /var/log/messages file. Now this directory is automatically created during installation. * The semicolon (;), double-quote ("), and end-of-line (EOL) characters are automatically escaped in the syslog-ng STATS output. * The SDATA ID, PARAM and VALUE fields of RFC5424-formatted messages were not handled correctly in certain cases and might cause a segmentation fault. This has been corrected. Solaris * Corrected the start method of the syslog-ng initscript on Solaris 10 in case when the syslog-ng.pid file exists but syslog-ng is not running. * The syslog-ng application displayed an unnecessary error message if the dump device did not exist. This has been corrected. * Files and symbolic links are copied using piped tar instead of cp in order to retain the symbolic links. The old behavior caused significant increase of disk space requirements. * Corrections in the handling of the syslog_door file under Solaris 10. In Solaris 10 the file name of the door file has been changed to /var/run/syslog_door but the default syslog-ng configuration used the old file name /etc/.syslog_door. The upgrade process fixes this problem by creating a symbolic link. New installations will not be affected. HP-UX * The installer did not find and backup the old syslog rc symbolic links. This has been corrected. Debian Installer * The syslog-ng installer displayed an unnecessary error message. This has been corrected. .Run Installer * The syslog-ng application did not start after installation if there was an old (v2.1) license file under /opt/syslog-ng/etc/. Now this file is moved to the /opt/syslog-ng.old directory. * The unnecessary files under /opt/syslog-ng/share/doc/ belonging to other platforms have been deleted. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng 3.0 Administrator Guide at: http://www.balabit.com/support/documentation/?product=syslog-ng&type=all&la…

1 0

syslog-ng Premium Edition 3.1.0a has been released
by devel＠balabit.hu 24 Mar '10

24 Mar '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 3.1.0a SUMMARY : new feature release DATE : Mar 24, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new feature version of syslog-ng Premium Edition (3.1.0a) has been released. For a full description on stable and feature releases, see Section 'Stable and feature releases of syslog-ng PE' in The syslog-ng Premium Edition 3.1.0a Administrator Guide. CHANGES: Due to a late minute compilation problem, support for the Perl Compatible Regular Expression (pcre) library was not present in 3.1.0. This has been corrected in this release. No other changes were applied to the syslog-ng code base. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng Premium Edition 3.1.0a Administrator Guide at: http://www.balabit.com/support/documentation/

1 0

syslog-ng 3.1.0 has been released
by devel＠balabit.hu 22 Mar '10

22 Mar '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.1.0 SUMMARY : new feature release DATE : Mar 22, 2010 ------------------------------------------------------------------------------ DESCRIPTION: This is the first stable release of syslog-ng Open Source Edition 3.1. syslog-ng 3.1 is the first so called "feature release" of syslog-ng, as such its support period ends when either the next feature (named 3.2) or the next stable (named 4.0) version is published. Please note that this announcement contains features that were already published in one of the earlier BETA releases. If you are upgrading from 3.1beta2, please see the list of changes relative to that version at the end of the "CHANGES" block below. CHANGES SINCE v3.0: New features: * Support for patterndb v2 and v3 format, along with a bunch of new parsers: ANYSTRING, IPv6, IPvANY and FLOAT. * Added a new "pdbtool" utility to manage patterndb files: convert them from v1 or v2 format, merge mulitple patterndb files into one and look up matching patterns given a specific message. * Support for message tags: tags can be assigned to log messages as they enter syslog-ng: either by the source driver or via patterndb. Later it these tags can be used for efficient filtering. * Added support for rewriting structured data. * Macros and name-value pairs got a little tighter integration, in filters where syslog-ng 3.0 was limited to only use name-value pairs, with 3.1 you can also use macros. * Enhanced dynamic name-value performance by a factor of three. * Some parsers got additional features: NUMBER is now able to parse hexadecimal numbers, ESTRING is now able to search for multiple characters as the end of the string. * Added non-standard and non-portable facility codes (range 10-15), decouple syslog-ng facility name information from the system used to compile syslog-ng on. * Added pcre support in the binary packages of syslog-ng. An updated administrator's guide is available on the BalaBit documentation page at: http://www.balabit.com/support/documentation/ CHANGES SINCE v3.1beta2: Bugfixes: * Fixed Solaris 10 SMF script to properly handle svcadm refresh requests. * Fixed a possible segmentation fault for unix-dgram/unix-stream destinations on some (non-Linux) platforms. * Fixed processing empty log entries when using the syslog() protocol. * Fixed processing partially received syslog messages. Other changes: * It is now possible to add comments before the @version header in the configuration file. * Decrease the frequency of gettimeofday() calls during syslog-ng operation, as gettimeofday() is expensive to call on some platforms. * The SQL destination will only attempt to INSERT a given log message 3 times, and after that it gives up, instead of trying indefinitely. * Tru64 portability fixes. * The functional test program was improved to check the new RFC5424 syslog protocol. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

syslog-ng Premium Edition 3.1.0 has been released
by devel＠balabit.hu 16 Mar '10

16 Mar '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 3.1.0 SUMMARY : new feature release DATE : Mar 16, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new feature version of syslog-ng Premium Edition (3.1.0) has been released. For a full description on stable and feature releases, see Section 'Stable and feature releases of syslog-ng PE' in The syslog-ng Premium Edition 3.1.0 Administrator Guide. CHANGES: syslog-ng Premium Edition version 3.1 is the first feature release based on the stable 3.0 branch. For a full description on stable and feature releases, see Section 'Stable and feature releases of syslog-ng PE' in The syslog-ng Premium Edition 3.1 Administrator Guide. WARNING: Downgrading from a feature release to an earlier (and thus unsupported) feature release, or to the stable release is not supported. This means that once you upgrade a system from a stable release (e.g., 3.0) to a feature release (e.g., 3.1), you will have to keep upgrading to the new feature releases until the next stable version release (e.g., 4.0) is published, or risk using an unsupported product. New supported platforms * The syslog-ng application now supports the following operating systems and platforms: * Solaris 9 on x86 * Tru64 5.1b on Alpha * HP-UX 11v2 on Itanium64 * Legacy Linux systems including RedHat Enterprise Linux 2 and Debian potato on x86, as well as RedHat Enterprise Linux 3, Debian sarge on x86 and x86_64. * Although not explicitly supported, but in general syslog-ng should run on other legacy Linux systems as well that have at least glibc version 2.1.3 (x86) or glibc version 2.3.2 (x86_64). Pattern databases * Support for pattern database V2 and V3 formats. The V3 format has support for tagging messages, adding static name-value pairs, and also for including automatic test messages in the pattern database. See The syslog-ng 3.1 Premium Edition Administrator Guide for details. * A new command-line utility called 'pdbtool' is available to manage pattern database files. It can convert files using the old V1 or V2 database format to the latest V3 format, merge multitple pattern database files into one, and test patterns matching a specific message. See the pdbtool manual page in Appendix A of The syslog-ng 3.1 Premium Edition Administrator Guide for details. * The DOUBLE parser has been renamed to FLOAT. * The NUMBER parser can parse hexadecimal numbers as well. * It is possible to set multiple characters (a stopstring) instead of a single character in the ESTRING parser. * Log messages can be tagged. Tags can be assigned to log messages as they enter syslog-ng: either by the source driver or via patterndb. Later these tags can be used for efficient filtering using the tags() filter option. Messages are automatically tagged with the name of the source group in the ".source.name" format. Message statistics * The dynamic counters used for statistics with static ones. That way, statistics can be retained across syslog-ng reloads (but not when syslog-ng is restarted). Retaining statistics can be enabled using the 'stat_reset()' option. * Statistics can be collected for sender hosts, sources and destinations, facilities and severities, pattern database classes and rule IDs, as well as tags. Configuration file * The version of the syslog-ng configuration file is properly recognized even if it contains whitespace between the 'version' string and the version number. * Comments and empty lines before the version mark are accepted. Logstore * Logstore files can be encrypted with multiple keys. * The cipher and digest algorithms used in encrypting the logstore files can be specified. * Warnings and error messages related to logstore files include the name of the affected logstore file. * Timestamp policy OIDs can be specified using the 'timestamp_policy()' option. The OID is included in the timestamping request sent to the Timestamping Authority. * The logcat utility has been renamed to lgstool. SQL destinations * Auto-incremented columns are now supported. This must be specified in the 'indexes()' option of the destination's SQL schema like: indexes("id int not null auto_increment primary key"). * SQL INSERT statements were not formatted properly when the schema used default values. This has been corrected. * Oracle databases do not handle index names longer than 30 characters. In such cases, syslog-ng uses the MD5 hash of the name index. * If an index used with an Oracle destination starts with a digit, an 'I' character is automatically prefixed to the ID. This solves a problem experienced with Oracle 10 destinations. Other * Non-standard and non-portable facility codes (range 10-15) are now properly recognized. * Added support for Cisco ASA timestamps. * The syslog-ng application keeps the message queue when receiving a SIGHUP signal. * Support for PCRE regular expressions in now available on every supported platform. Loggen * Loggen can send log messages can be sent using SSL connections. * Messages can be read from a text file. syslog-ng-ctl * A new command-line utility called syslog-ng-ctl is available for the run-time control of syslog-ng. It can display message-related statistics on-demand, and enable/disable the debug, verbose and trace modes of syslog-ng to help troubleshooting. Security updates: CVE-2009-4355, CVE-2009-0591 DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng Premium Edition 3.1.0 Administrator Guide at: http://www.balabit.com/support/documentation/

1 0