- syslog-ng-announce - lists.balabit.hu

BalaBit products are not exposed to CVE-2014-6271
by devel＠balabit.hu 26 Sep '14

26 Sep '14

------------------------------------------------------------------------------ SUMMARY : BalaBit products are not exposed to CVE-2014-6271 PACKAGE : Shell Control Box, syslog-ng Store Box, syslog-ng PE VERSION : All versions DATE : Sep 26, 2014 ------------------------------------------------------------------------------ DESCRIPTION: As published a few days ago, a bug discovered in the widely used Bash command interpreter poses a critical security risk to Unix and Linux systems. The BalaBit Security Team has analyzed the source code of all supported versions of every BalaBit products, and concluded that although our products contain the impacted version of Bash, none of our products are exploitable by the vulnerability described in CVE-2014-6271 aka. 'Shell Shock' or 'Bash vulnerability'. We will incorporate the required Bash patches in the next regular security updates. The following product versions were analyzed: syslog-ng PE 4.0: There is no attack vector in this product. 5.0: There is no attack vector in this product. 5.1: There is no attack vector in this product. SSB 3.0: The code review showed no vulnerable code. 3.1: The code review showed no vulnerable code. 3.2: The code review showed no vulnerable code. SCB 3.0: The code review showed no vulnerable code. 3.5: The code review showed no vulnerable code. 4.0: The code review showed no vulnerable code. For further information regarding the vulnerability, please consult: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271 Best Regards, BalaBit You are receiving this email because you showed interest in our products. Unsubscribe <http://www.balabit.com/newsletter/unsubscribe/4398019b4f2681fdce75b07177a63…> from the syslog-ng Premium Edition Technical Newsletter.

1 0

syslog-ng 3.6.0rc1 has been released
by devel＠balabit.hu 26 Sep '14

26 Sep '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.6.0rc1 SUMMARY : new release candidate DATE : Sep 26, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new release candidate of syslog-ng Open Source Edition (3.6.0rc1) has been released. CHANGES: 3.6.0rc1 ======== Fri, 26 Sep 2014 11:17:31 +0200 This is the first Release Candidate of the syslog-ng OSE 3.6 branch. Based on our test results this release is almost production ready. Features -------- * Added groupset rewrite object. Groupset allows the user to modify multiple log message properties at once. It also allows referencing the old value of the property as the $_ macro. Bugfixes -------- * Fixed a memory leak during configuration parsing when using `rewrite()`. * Change control socket message from notice to debug * Fixes for retries() functionality. Retry counter incremented by every message write error (including network connection errors) which can lead to message lost. Credits ------- syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessary to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Balazs Scheidler, Brian De Wolf, Gergely Nagy, Laszlo Budai, Peter Czanik, Tibor Benke, Viktor Juhasz, Viktor Tusa. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.6.0r… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

syslog-ng Premium Edition 5 LTS (5.0.6b) has been released
by devel＠balabit.hu 17 Sep '14

17 Sep '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 5 LTS (5.0.6b) SUMMARY : new stable release DATE : Sep 17, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (5 LTS (5.0.6b)) has been released. For latest fixes in the 5.0.x branch you are recommended to upgrade to this version. CHANGES: 5 LTS (5.0.6b) Wed, 17 September 2014 10:00:20 +0100 Fixed Bugs: Correction of bug #32324 was missing from 5.0.6a. This release solves the problem and provides a fix for bug #32324. #32324 Memory consumption of syslog-ng is high when using reliable disk-buffer and the destination becomes inaccessible For details on the fixed issues see our issue tracking page at https://www.balabit.com/mybalabit/fixed-bugs/revision/ DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/sup… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng Premium Edition 5 LTS (5.0.6b) Administrator Guide at: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/sup… Kind Regards, BalaBit IT Security You are receiving this email because you showed interest in our products. Unsubscribe <http://www.balabit.com/newsletter/unsubscribe/4398019b4f2681fdce75b07177a63…> from the syslog-ng Premium Edition Technical Newsletter.

1 0

syslog-ng 3.6.0beta2 has been released
by devel＠balabit.hu 11 Sep '14

11 Sep '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.6.0beta2 SUMMARY : new beta release DATE : Sep 11, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new beta version of syslog-ng Open Source Edition (3.6.0beta2) has been released. Being the - hopefully - last beta release, we would be very grateful for any feedback, to stabilize the release further. CHANGES: 3.6.0beta2 ========== Thu, 11 Sep 2014 13:09:57 +0200 This is the second beta release of the upcoming syslog-ng OSE 3.6 branch. Compared to the previous beta, this release contains a few minor features and bugfixes. We expect the next release to be a release candidate, focusing on stability and bugfixes. Testing is most appreciated! Features -------- * It is now possible to load not only a single certificate when using TLS, but a certificate chain. * The `system()` source will not include `/dev/kmsg` (or `/proc/kmsg`) when running inside a Linux container. Bugfixes -------- * The `in-list()` filter was fixed to look at all elements of the list, instead of only the last one. * Fixed an assertion when using the `match()` filter under certain circumstances. * The `system()` source will not add `/dev/kmsg` (or `/proc/kmsg` on older kernels) to the default sources if using the systemd journal, because kernel logs are included in the journal. Credits ------- syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessary to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Balazs Scheidler, Gergely Nagy, Gyorgy Pasztor, Peter Czanik, Tibor Benke. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.6.0b… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

syslog-ng Premium Edition 5 LTS (5.0.6a) has been released
by devel＠balabit.hu 10 Sep '14

10 Sep '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 5 LTS (5.0.6a) SUMMARY : new stable release DATE : Sep 10, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (5 LTS (5.0.6a)) has been released. For latest fixes in the 5.0.x branch you are recommended to upgrade to this version. CHANGES: 5 LTS (5.0.6a) Wed, 10 September 2014 13:10:20 +0100 Fixed Bugs: #31733 When using wildcard file sources to monitor lots (1000+) of files, syslog-ng detects new files very slowly #31734 syslog-ng does not indicate if it uses inotify or poll #32324 Memory consumption of syslog-ng is high when using reliable disk-buffer and the destination becomes inaccessible #32409 syslog-ng does not create a table for new month in MSSQL #32428 SQL error messages are not displayed #32453 SQL source cannot read newer resources like BIGINT from MSSQL Security updates: CVE-2014-3505, CVE-2014-3506, CVE-2014-3507, CVE-2014-3508, CVE-2014-3509, CVE-2014-3510, CVE-2014-3511, CVE-2014-3512, CVE-2014-5139 For details on the fixed issues see the following OpenSSL Security Advisory: https://www.openssl.org/news/secadv_20140806.txt For details on the fixed issues see our issue tracking page at https://www.balabit.com/mybalabit/fixed-bugs/revision/ DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/sup… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng Premium Edition 5 LTS (5.0.6a) Administrator Guide at: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/sup… Kind Regards, BalaBit IT Security You are receiving this email because you showed interest in our products. Unsubscribe <http://www.balabit.com/newsletter/unsubscribe/4398019b4f2681fdce75b07177a63…> from the syslog-ng Premium Edition Technical Newsletter.

1 0

syslog-ng 3.6.0beta1 has been released
by devel＠balabit.hu 05 Sep '14

05 Sep '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.6.0beta1 SUMMARY : new beta release DATE : Sep 5, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.6.0beta1) has been released. Being the first beta release, we would be very grateful for any feedback, to stabilize the release further. CHANGES: 3.6.0beta1 Wed, 3 Sep 2014 14:40:14 +0200 This is the first beta release of the upcoming syslog-ng OSE 3.6 branch. Compared to the alphas, this release contains a moderate amount of new functionality and bugfixes. Further releases will focus on stability and bugfixes. Features -------- * One can now use multiple elements in the `key()` and `exclude()` options of any value-pairs declaration. * A new source driver was added to the syslog-ng: `systemd-journal()`, which reads from the Journal directly, not via the syslog forwarding socket. The `system()` source defaults to using this source when systemd is detected. Bugfixes -------- * All the various crypto-related template functions now check that the desired length of the digest is not larger than the digest itself. If a larger value is requested, they will truncate it to the digest length. * The `$(geoip)` template function now works with `threaded(yes)` too. * The unix domain socket credentials code was changed to only build on Linux and FreeBSD. With this change, syslog-ng should compile again on platforms where the OS does not support this, with the feature disabled. Credits ------- syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessary to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Fabien Wernli, Gergely Nagy, Laszlo Budai, Michael Hocke, Tibor Benke, Viktor Juhasz, Viktor Tusa. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.6.0b… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

syslog-ng 3.6.0alpha3 has been released
by devel＠balabit.hu 19 Aug '14

19 Aug '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.6.0alpha3 SUMMARY : new alpha release DATE : Aug 19, 2014 ------------------------------------------------------------------------------ DESCRIPTION: The third alpha version of syslog-ng Open Source Edition (3.6.0alpha3) has been released. This being an alpha release, testing is most welcome, but production use is not recommended! CHANGES: 3.6.0alpha3 Released: Tue, 19 Aug 2014 14:33:00 +0200 This is the third alpha release of the upcoming syslog-ng OSE 3.6 branch. It is expected to be the last alpha release, with the first beta in about two weeks. This release contains a number of important features and bugfixes: Changed defaults ---------------- * The `flush-lines()` setting now defaults to *100*, rather than *1*, for increased speed. Features -------- * The `system()` source will now parse `@cim` marked messages as JSON, if the JSON module is available at run-time. This improves inter-operation with other software that uses the *Common Information Model*. ### Features from the [Incubator][incubator] * The `$(or)` template function that returns the first non-empty argument is now included in syslog-ng itself. * The `$(padding)` template function, to pad text with custom padding to a given length is also included. * The `$(graphite-output)` template function, to be used for sending metrics to [Graphite][graphite] was ported over from the Incubator. The `graphite()` destination SCL block is also available now, to make it even easier to talk to Graphite. * The `riemann()` destination, which allows sending metrics to the [Riemann][riemann] monitoring system was also ported over from the Incubator. [graphite]: http://graphite.wikidot.com/ [incubator]: https://github.com/balabit/syslog-ng-incubator [riemann]: http://riemann.io/ ### Threaded destinations A number of features were implemented for all threaded destinations: `amqp()`, `mongodb()`, `redis()`, `riemann()`, `smtp()` and `stomp()`. * The destinations gained support for `SEQNUM` persistence: the counter will be preserved across reloads and restarts. * A new option called `retries()` was implemented for all of these, which controls how many times a message delivery is retried before dropping it. * The `throttle()` option is now implemented, and works for all of the aforementioned destination drivers. * The message delivery loop was optimised to do less sleep/wakeup cycles, which should make the drivers not only faster, but more CPU friendly too. Bugfixes -------- * The basicfuncs module was fixed to work correctly on 32-bit architectures. * The `stored` statistics is no longer incremented by various drivers when they mean `processed`. * The type hinting feature is now more picky about what kind of type hints it accepts, allowing one to use template functions in - for example - `$(format-json)` pairs. Miscellaneous changes --------------------- * We now ship a "Contributors Guide" in the `CONTRIBUTING.md` file. Credits ------- syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessary to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Balazs Scheidler, Fabien Wernli, Gergely Nagy, Laszlo Budai, Peter Czanik, Robert Fekete, Tibor Benke, Viktor Juhasz, Viktor Tusa. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.6.0a… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

syslog-ng 3.6.0alpha2 has been released
by devel＠balabit.hu 11 Aug '14

11 Aug '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.6.0alpha2 SUMMARY : new alpha release DATE : Aug 11, 2014 ------------------------------------------------------------------------------ DESCRIPTION: The second alpha version of syslog-ng Open Source Edition (3.6.0alpha2) has been released. This being an alpha release, testing is most welcome, but production use is not recommended! CHANGES: 3.6.0alpha2 Released: Mon, 11 Aug 2014 15:02:59 +0200 This is the second alpha release of the upcoming syslog-ng OSE 3.6 branch, with more internal changes and features compared to the previous 3.6.0alpha1 release. Above the changes in the latest 3.5.6 stable version, this release contains the following noteworthy changes: Changed defaults ---------------- * Threaded mode is now **enabled** by default. To turn it off, use `threaded(no)` in the global options section. * The versioning of the `libsyslog-ng` internal library has changed: instead of always using the current release number, we will now try to maintain ABI compatibility during the lifetime of a stable branch. Therefore, we use only the first two components of our version as the base of the library version. Another number will be part of the SONAME too, but that will only change when we break compatibility. The SONAME is currently set to `libsyslog-ng-3.6.so.0`, and will remain the same during alpha and beta releases, even when the ABI changes. We will start bumping the version after the first stable release from this branch, if needed. Features -------- * The new `systemd-syslog()` source replaces the former implicit support for the same thing. Users who use systemd are advised to use either the `system()` source, or this new one when they want to receive logs from systemd via the `/run/systemd/journal/syslog` socket. ### SMTP destination changes * The `smtp()` destination now supports a `retries()` option, which controls how many times a message delivery will be attempted before dropping it. * The destination no longer counts delivered messages as `stored`. * The templates used in the destination now honor the time-zone settings. * The driver will abort if required options (any of `to()`, `cc()`, `bcc()` and `from()`, and `subject()` and `body()`) are not set. Bugfixes -------- * The `file()` and `network()` (including `tcp()` et al) sources will now properly set the `$SOURCE` macro. * To build syslog-ng with the MongoDB destination, libmongo-client version 0.1.8+ is now required. (The internal copy has been updated accordingly.) * The UNIX credential extracting feature was ported to FreeBSD, syslog-ng now compiles, and has support for this feature. (The previous support in alpha1 was sadly incomplete.) * The `pdbtool merge` command will now generate version 4 patterndb files. Credits ------- syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessary to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Fabien Wernli, Gergely Nagy, Laszlo Budai, Peter Czanik, Tibor Benke, Viktor Juhasz, Viktor Tusa. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.6.0a… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

syslog-ng 3.5.6 has been released
by devel＠balabit.hu 05 Aug '14

05 Aug '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.5.6 SUMMARY : new stable release DATE : Aug 5, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.5.6) has been released. For latest fixes in the 3.5.x feature branch you are recommended to upgrade to this version. CHANGES: 3.5.6 Mon, 4 Aug 2014 13:39:42 +0200 This is the sixth bug-fix release for the 3.5.x series. Upgrading from earlier versions is highly recommended, as the changes in this release are very small, yet, also very important for most platforms and workloads. Bugfixes ======== * A major memory leak was fixed in the value-pairs framework, which affects $(format-json), MongoDB, AMQP and more. The leak was supposed to be fixed in 3.5.5, but due to a merging mistake, it was missed. * The configure script now detects Linux capabilities properly, there is no need to use --disable-linux-caps on non-Linux platforms anymore. * The pdbtool merge command will now generate version 4 patterndb files, instead of version 3. Credits ======= syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessary to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Fabien Wernli Gergely Nagy Peter Czanik DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.5.6 The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

syslog-ng 3.6.0alpha1 has been released
by devel＠balabit.hu 30 Jul '14

30 Jul '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.6.0alpha1 SUMMARY : new alpha release DATE : Jul 30, 2014 ------------------------------------------------------------------------------ DESCRIPTION: The first alpha version of syslog-ng Open Source Edition (3.6.0alpha1) has been released. This being an alpha release, testing is most welcome, but production use is not recommended! CHANGES: 3.6.0alpha1 Wed, 30 Jul 2014 15:40:42 +0200 This is the first alpha release of the upcoming syslog-ng OSE 3.6 branch, a result of about seven months of work, by more than a dozen contributors, touching 379 files, and changing over twenty thousand lines. Compared to the latest stable release (3.5.5), this alpha release contains the following noteworthy changes: New dependencies ---------------- PCRE is now a required dependency of syslog-ng, and is not optional anymore. Features -------- ### New options * A new `custom-domain()` global setting was introduced, which allows the administrator to override the local domain name used by syslog-ng. It affects all locally generated log messages. * Added a `use-rcptid()` global option, that tells syslog-ng to assign a reception ID to each message received and generated by syslog-ng. This ID is available as the `$RCPTID` macro, and is unique on a given host. The counter wraps around at 48 bits and is never zero. ### New drivers * The `pseudofile()` destination driver is a very simple driver, aimed at delivering messages to special files in `/proc` or `/dev`. It opens and closes the file on each message, instead of keeping it open. It does not support templates in the filename, and does not have a queue (and as such, is not adequate in high traffic situations). * The new `nodejs()` source driver (implemented as an SCL macro) adds a source driver that allows syslog-ng to accept messages from node.js applications that use the `winston` logging API. ### Miscellaneous new features * The `multi-line-mode()` option gained a new setting: `prefix-suffix`, which works similarly to the `prefix-garbage` (which is the new name for `regexp`), except it appends the garbage part to the message, instead of discarding it. This new mode can be used to work around the absence of a timeout. * Filters default to PCRE matching, instead of the previous POSIX regexp default. ### Statistics * The stats counter for PROGRAM counters now includes the timestamp of the last update. * A new `stats-lifetime()` global option was introduced, which controls how often dynamic counters are expired. The timer is not exact, some timers may live a little bit longer than the specified time. * Dynamic counters are now cleaned up every `stats-lifetime()` minutes (defaulting to 10 minutes) instead of only on reloads. This change was done to reduce the memory used by dynamic counters. * There is now an `internal_queue_length` statistic, which shows the length of the internal queue. This is most useful to see if the `internal()` source is not connected, or if it is not being emptied fast enough (which, again, indicates a more serious error). ### MongoDB * The `mongodb()` driver now supports authentication, even when using replica sets. When re-connecting to another member of the set, the driver will automatically re-authenticate. * The `--with-libmongo-client` option of the configure script now supports `auto` as a value, and will then detect whether to use the system version of the library or the internal copy. We default to `auto` now, which prefers the system library over the internal copy. * The driver does not automatically add an `_id` field to the message: the server will do that automatically, if none is present. This allows users to override the field from within their syslog-ng config. * A new `retries()` option can be used to tell the driver how many times it should try to insert a message into the database before giving up (defaults to 3). This fixes the case where a rogue message could hold up the entire queue, as it was retried forever. * The driver now enables `safe-mode()` by default. * There is now a one-minute timeout for MongoDB operations. If an operation times out, it will be considered failed. * The driver can now connect to MongoDB via UNIX domain sockets. * The `double()` type hint is now supported by the driver. ### Unix Domain Sockets * The `unix-dgram()` and `unix-stream()` sources now extract UNIX credentials (PID, UID and GID of the sending application) from the passed messages, if any. On Linux, and FreeBSD, the path of the executable belonging to PID is extracted too, along with command-line arguments. The extracted values are available in `${.unix.pid}`, `${.unix.uid}`, `${.unix.gid}`, `${.unix.exe}` and `${.unix.cmdline}`, respectively. * The `system()` source will overwrite the PID macro with the value of `${.unix.pid}`, if present. ### JSON * The json-parser gained an `extract-prefix()` option, which can be used to tell the parser to only extract JSON members from a specific subtree of the incoming object. Example: `json-parser(extract-prefix("foo.bar[5]"));` Assuming that the incoming object is named msg, this is equivalent to the following javascript code: `msg.foo.bar[5]` The resulting expression must be a JSON object, so that syslog-ng can extract its members into LogMessage name-value pairs. This also works when the top-level object is an array, as `extract-prefix()` allows the use of an array index at the first indirection level, for example: `json-parser(extract-prefix("[5]"));`, which translates to `msg[5]`. * The `$(format-json)` template function now handles the `double()` type hint. ### Debugging * When sending messages to stderr in debug mode, prepend a timestamp to the messages. * The new `$RUNID` macro is available for templates, which changes its value every time syslog-ng is restarted, but not when reloaded. * A Valgrind suppression file was added (available under `contrib/valgrind/`), to aid in debugging memory leaks in syslog-ng. It supresses a couple of known false positives, and a few other things in third-party libraries. * A new utility, `system-expand`, was added, which returns what the `system()` source would expand to. Bugfixes -------- * With the MongoDB destination, successfully inserted messages are not counted as "stored" anymore: stored messages are those that are in a memory or disk buffer. * In the MongoDB destination, reconnecting in a replica-set environment now works correctly, and reliably. * The reliability of the `usertty()` destination driver was greatly improved. Previously, some parts of it were not thread-safe, which could result in strange behaviour. * The handling of escape related flags of `csvparser()` was changed: instead of these flags overwriting all other (even non-escape related) flags, if the flag to set is an escape-flag, it will keep all non-escape flags, and set the new one. If it is a not such a flag, then it will clear all flags, and set the previous escape flags, and the new flag. This, in essence, means that when setting flags on a `csvparser()`, if it is an escape flag, only escape flags will be affected. If not, then escape flags will not be affected at all. * The SQL destination now correctly continues $SEQNUM counting after a reload, instead of starting afresh. * When tring to stop syslog-ng while a reload is in progress, syslog-ng will now correctly shut down cleanly. * When the local hostname is not an FQDN, and the local resolver fails to return an FQDN too, syslog-ng does not abort anymore, but continues using a non-FQDN hostname after emitting a warning on the internal source. Furthermore, syslog-ng will try to resolve the FQDN harder: when multiple names are returned, it will search for the first FQDN one, instead of stopping at the primary name. * The `update-patterndb` script will now work correctly when the current working directory contains .pdb files. * We will now correctly handle time going backwards in patterndb: it will realign its idea of current time with the system. This corrects a bug where timeouts did not function properly when system time was set backwards. * The Linux capability support is now correctly auto-detected by the configure script, and defaults to off on FreeBSD 9+, as it should. * Various memory leak fixes around the code base. Developer notes --------------- The code base went through a lot of refactoring, too many to list in a simple NEWS file. Groundwork has been laid out for future features which are yet to hit the 3.6 branch. Credits ------- syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Andres Tamayo, Balazs Scheidler, Csaba Karsai, Daniel Gados, Evan Rempel, Fabien Wernli, Gergely Nagy, Igor Ippolitov, Imre Lazar, Jakub Wilk, Laszlo Budai, Lucas McLane, Martin Bagge, Matyas Koszik, Nick Alcock, Otto Berger, Peter Czanik, Peter Gyongyosi, Sebastien Badia, Sebastiaan Hoogeveen, Tamas Pal, Tibor Benke, Tobias Schwab, Viktor Juhasz, Viktor Tusa, Xufeng Zhang DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.6.0a… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0