September 2011 - syslog-ng-announce

syslog-ng Premium Edition 4 F1 (4.1.2) has been released
by devel＠balabit.hu 28 Sep '11

28 Sep '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 4 F1 (4.1.2) SUMMARY : New syslog-ng Premium Edition feature release DATE : Sep 27, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new version of syslog-ng Premium Edition 4 F1 (4 F1 (4.1.2)) has been released. For latest fixes in the 4 F1 (4.1.x) branch you are recommended to upgrade to this version. CHANGES: 4 F1 (4.1.2) Tue, 27 Sep 2011 14:08:00 +0200 Fixed issues: #23752: syslog-ng created unusable indexes for Oracle SQL destination #24202: lgstool marks valid logstore chunks as invalid #24197: syslog-ng cannot start if the disk buffer is corrupt #24209: program-override option does not work properly #24204: MSSQL insert does not work if DEFAULT values are used #24199: Failure to open a destination file results in message loss #23588: Disk buffer becomes corrupt when receiving very large messages #24206: Possible FD leak if destination is unavailable #24201: syslog-ng aborts due to a deserialization problem #24196: Unable to specify database port in MySQL destination #24208: Crash under high load if the spoof_source() and threaded() options are enabled #24203: syslog-ng segfaults when reading syslog messages from the disk buffer #24198: syslog-ng failed with an assertion on Solaris when writing files #24205: syslog-ng can drop messages when flow_control is enabled #24200: Message loss when a TLS destination goes down For details on the fixed issues see our new issue tracking page at http://www.balabit.com/mybalabit/fixed_bugs/revision/ The documentation of syslog-ng 4.1, including the installation and user guides is available in PDF, HTML, and single-page HTML format at: http://www.balabit.com/support/documentation/?product_line=46&product_type=… UPGRADE: For details on upgrading and possible upgrade paths, read Section 3.4., Upgrading syslog-ng in the The syslog-ng Premium Edition 4.1 Administrator Guide: http://www.balabit.com/support/documentation/syslog-ng-pe-v4.1-guide-admin-… Kind Regards, BalaBit IT Security DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/sup… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng Premium Edition 4 F1 (4.1.2) Administrator Guide at: http://www.balabit.hu/support/documentation?&product_line=46&product_type=48

1 0

syslog-ng Agent for Windows 4 LTS (4.0.2) has been released
by devel＠balabit.hu 09 Sep '11

09 Sep '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng Agent for Windows VERSION : 4 LTS (4.0.2) SUMMARY : new stable release DATE : Sep 9, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new feature version of syslog-ng Agent for Windows (4 LTS (4.0.2)) has been released. This version contains changes, improvements, and new features. For a full description on stable and feature releases, see the Version Policy at http://www.balabit.com/network-security/syslog-ng/central-syslog-server/sup… CHANGES: 4 LTS (4.0.2) Thu, 08 Sep 2011 10:20:55 +0100 WARNING Upgrading to syslog-ng Agent version 4.0.2 is supported only from syslog-ng Agent version 3.0.9 and 4.0.1. WARNING If your server certificate contains an invalid Common Name (CN) field, generate a new certificate before upgrading to syslog-ng Agent version 4.0.2, otherwise the Agent will be unable to send the log messages to the server. For details on the correct Common Name, see: http://www.balabit.com/sites/default/files/documents/syslog-ng-pe-4.0-guide… Fixed issues: #21412: Drop connection if CN name does not match server name #22631: servername is case-sensitive in xml configuration #22760: syslog-ng Agent MMC snap-in shows Facility and Priority values in File Sources Property dialog box incorrectly #22798: Syslog-ng agent consumes more than 1GB of memory, when using xml config and lot of sources. #23899: The state of the removed file is not updated #23901: Agent is capable to work without updating the registry, spinning in. #23919: Syslog-ng Agent for Windows leaves the program name field empty in start and stop messages #21456: Sending double backslashes in the $FILENAME macro For details on the fixed issues see our new issue tracking page at http://www.balabit.com/mybalabit/fixed_bugs/revision/ The documentation of syslog-ng Agent 4.0, including the installation and user guides is available in PDF, HTML, and single-page HTML format at: http://www.balabit.com/support/documentation/?product_line=46&product_type=… UPGRADE: For details on upgrading and possible upgrade paths, read Section 2.4., Upgrading syslog-ng in the The syslog-ng Agent for Windows 4.0 Administrator Guide: http://www.balabit.com/support/documentation/syslog-ng-windows-agent-v4.0-g… Kind Regards, BalaBit IT Security DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng Agent for Windows application is available in The syslog-ng Agent for Windows 4 LTS (4.0.2) Administrator Guide at: http://www.balabit.com/support/documentation/

1 0

syslog-ng Agent for Windows 3 LTS (3.0.9) has been released
by devel＠balabit.hu 09 Sep '11

09 Sep '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng Agent for Windows VERSION : 3 LTS (3.0.9) SUMMARY : new stable release DATE : Sep 9, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Agent for Windows (3 LTS (3.0.9)) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3 LTS (3.0.9) Thu, 08 Sep 2011 10:20:55 +0100 WARNING If your server certificate contains an invalid Common Name (CN) field, generate a new certificate before upgrading to syslog-ng Agent version 4.0.2, otherwise the Agent will be unable to send the log messages to the server. For details on the correct Common Name, see: http://www.balabit.com/sites/default/files/documents/syslog-ng-v3.0-guide-a… Fixed issues: #22034: syslog-ng Agent for Windows can not parse illegal XML characters from the eventlog. #22279: Agent crashed in a high load while stopping the service #19847: Unable to get syslog-ng agent version if the agent already runs #20259: Log Facility and Log Priority lists contain elements repeatedly #22272: Startup, shutdown and MARK messages are generated with wrong priority #22276: Drop connection if CN name does not match server name For details on the fixed issues see our new issue tracking page at http://www.balabit.com/mybalabit/fixed_bugs/revision/ The documentation of syslog-ng Agent 3.0, including the installation and user guides is available in PDF, HTML, and single-page HTML format: http://www.balabit.com/support/documentation/?product_line=46&product_type=… UPGRADE: For details on upgrading and possible upgrade paths, read Section 5.1., Upgrading syslog-ng in the The syslog-ng 3.0 Administrator Guide: http://www.balabit.com/support/documentation/syslog-ng-v3.0-guide-admin-en_… Kind Regards, BalaBit IT Security DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng Agent for Windows application is available in The syslog-ng 3.0 Administrator Guide at: http://www.balabit.com/support/documentation/?product=syslog-ng&type=all&la…

1 0

syslog-ng Premium Edition 4 LTS (4.0.3) has been released
by devel＠balabit.hu 09 Sep '11

09 Sep '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 4 LTS (4.0.3) SUMMARY : new stable release DATE : Sep 8, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (4 LTS (4.0.3)) has been released. For a full description on stable and feature releases, see Section 2.16. Stable and feature releases of syslog-ng PE in The syslog-ng Premium Edition 4 LTS (4.0.3) Administrator Guide. CHANGES: 4 LTS (4.0.3) Thu, 08 Sep 2011 14:08:00 +0200 UPGRADE: For details on upgrading and possible upgrade paths, read Section 3.4., Upgrading syslog-ng in the The syslog-ng Premium Edition 4.0 Administrator Guide: http://www.balabit.com/support/documentation/syslog-ng-pe-v4.0-guide-admin-… CHANGES: Changes between syslog-ng Premium Edition 4.0.2 and 4.0.3: New platforms * In addition to the already supported platforms, syslog-ng Premium Edition now supports the following operating systems and architectures: - Debian 6.0 (Squeeze) on i386 and amd64 - Ubuntu 8.04 (Hardy) on i386 and amd64 - Ubuntu 10.04 (Lucid) on i386 and amd64 Kind Regards, BalaBit IT Security DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng Premium Edition 4 LTS (4.0.3) Administrator Guide at: http://www.balabit.com/support/documentation/

1 0

syslog-ng Premium Edition 4 F1 (4.1.1a) has been released
by devel＠balabit.hu 06 Sep '11

06 Sep '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 4 F1 (4.1.1a) SUMMARY : New syslog-ng Premium Edition feature release DATE : Sep 5, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new version of syslog-ng Premium Edition 4 F1 (4.1.1a) has been released. For latest fixes in the 4 F1 (4.1.x) branch you are recommended to upgrade to this version. CHANGES: This release corrects a single issue (#23960), the timestamp-processing error announced on September 5, 2011. #23960: Month name parsing error in BSD timestamps WARNING If you are running syslog-ng Premium Edition 4 F1 (4.1.1), upgrade to 4.1.1a no later than September 30 to avoid losing information. Starting with October 1, version 4.1.1 of 4 F1 will log the new log messages as messages from December, possibly mixing or overwriting the log files or database tables of September. For details on the fixed issue, see our new issue tracking page at http://www.balabit.com/mybalabit/fixed_bugs/revision/ DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/sup… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng Premium Edition 4 F1 (4.1.1a) Administrator Guide at: http://www.balabit.hu/support/documentation?&product_line=46&product_type=48

1 0

Critical error in syslog-ng PE version 4 F1
by devel 05 Sep '11

05 Sep '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 4 F1 SUMMARY : Critical error in syslog-ng PE version 4 F1 DATE : Sep 5, 2011 ------------------------------------------------------------------------------ A critical error has been found in syslog-ng Premium Edition (PE) version 4 F1 that in certain situations causes the month information for September to be interpreted as December in legacy-syslog formatted log messages. This announcement contains important information about an error that may affect your system logging infrastructure, and describes how to assess and remedy the situation. Read the entire announcement thoroughly. WARNING You will have to upgrade to the new, corrected version of syslog-ng 4 F1 no later than September 30 to avoid losing information. Performing the upgrade is recommended as soon as possible. AFFECTED VERSIONS syslog-ng Premium Edition 4.1.x (4 F1) BACKGROUND The syslog-ng Premium Edition application associates two timestamps with every incoming log message: the timestamp that is included in the header of the log message, and the time when syslog-ng actually receives the log message. The information from the timestamp included in the log message is available using the "S_"-prefixed macros of syslog-ng (for example, "$S_DATE"), while the timestamp added when syslog-ng PE received the log message is available using the "R_"-prefixed macros. Macros without prefix (for example, "$DATE") are equivalent with the "S_"-prefixed macros. ISSUE Because of an error, the month information from September to December will be interpreted as December in the timestamp of messages received by syslog-ng Premium Edition 4 F1. This causes the month information in the log messages and date-related macros to be incorrect. Since the macro values are affected as well, filenames, pathnames, and the names of database tables that have date-related macros in their names will be misnamed as well. For example, if a destination uses the "$YEAR/$MONTH/$DAY/$HOST.log" filename template for log files, then the logs of the recent days (that is, September 1-5) are incorrectly stored under the "2011/12/$DAY/$HOST.log" directory instead of "2011/09/$DAY/$HOST.log", and the timestamp of the stored log messages contains December instead of September. HOW TO FIND OUT IF YOUR CONFIGURATION IS AFFECTED Your configuration is affected if the following is true: - You are using syslog-ng PE 4 F1, and: - At least one log source is define that uses the legacy-syslog (also called RFC3164, or BSD-syslog) message format. Such sources include, but are not limited to network sources (for example, the tcp() or udp() driver), sockets (for example, unix-stream()), and file or pipe sources. A source is not affected if the "flags(syslog-protocol)" option is set for the source. - At least one date-related macro that is not prefixed with "R_" is used in a filename, database table name, or other template. Your configuration is NOT affected, if the following is true: - the "keep_timestamp(no)" global option is set, or - the "keep_timestamp(no)" option is set individually for every source, or - you use custom templates for every destination that explicitly use the "R_"-version of the date-related macros. SOLUTION BalaBit will provide new, corrected syslog-ng PE 4 F1 packages by Tuesday, September 6. If you are using syslog-ng Premium Edition 4 F1 in a production environment and your configuration is affected, please contact the BalaBit Support Team at http://www.balabit.com/boss/ to help assess and remedy the situation. The complete solution involves upgrading to the new, corrected version of syslog-ng PE 4 F1, and correcting the problems resulting from the error (for example, renaming misnamed files). WARNING You will have to upgrade to the new, corrected version of syslog-ng 4 F1 no later than September 30 to avoid losing information. Starting with October 1, uncorrected versions of 4 F1 will log the new log messages as messages from December, possibly mixing or overwriting the log files or database tables of September. WORKAROUND To have syslog-ng process the timestamps correctly until you upgrade to the corrected packages, use the timestamp when the messages are received. Note that in this case the information about when the log message was sent is irrevocably lost. To accomplish this, set the "keep_timestamp()" option to "no", either globally, or locally for the affected sources. Alternatively, replace the date-related macros (for example, $DATE, $ISODATE, $S_MONTH, and so on) used in your configuration with their "R_"-prefixed versions to use the received date of the log message. POSSIBLE SIDE-EFFECTS OF THE ERROR Depending on your environment, certain further steps might be needed to resolve the results of the issue. For example: - Backups and archives of the log files must be reviewed if log files of the affected period (September 1-5) have already been archived or backed up. - If you forward the log messages from syslog-ng Premium Edition to a SIEM or log analyzing application or device, the incorrect dates might appear in the SIEM reports as well, and might also affect the monthly statistics of the log messages. - Misnamed database tables, and the contents of database columns containing date-related information might have to be corrected. Kind Regards and Sincere Apologies, BalaBit IT Security

1 0