- syslog-ng-announce - lists.balabit.hu

syslog-ng Premium Edition 4.0.1 has been released
by devel＠balabit.hu 25 Feb '11

25 Feb '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 4.0.1 SUMMARY : new stable release DATE : Feb 24, 2011 ------------------------------------------------------------------------------ Dear syslog-ng User, We are happy to announce that version 4.0 of the syslog-ng Premium Edition system logging application has been released. The news and highlights of this version are summarized in the following document: http://www.balabit.com/support/documentation/syslog-ng-v4.0-guide-whatsnew-… Version 4.0 of syslog-ng PE includes all the new functionality introduced in the earlier 3.1 and 3.2 feature releases. For the list of changes between the latest feature release (version 3.2) and the new stable release, see the end of this e-mail. Customers who have valid software subscription will be able to access the new software packages and their new license on the MyBalaBit webpage (http://www.balabit.com/mybalabit/) Licenses will be made available this month; you will receive a notification e-mail when your license is ready. If you would like to try syslog-ng 4.0 but have not purchased software subscription, register on the MyBalaBit webpage and request a free trial version. The documentation of syslog-ng 4.0, including the installation and user guides is available in PDF, HTML, and single-page HTML format at: http://www.balabit.com/support/documentation/?product_line=46&product_type=… UPGRADE: For details on upgrading and possible upgrade paths, read Section 3.4., Upgrading syslog-ng in the The syslog-ng Premium Edition 4.0 Administrator Guide: http://www.balabit.com/support/documentation/syslog-ng-pe-v4.0-guide-admin-… CHANGES: Changes between syslog-ng Premium Edition 3.2 and 4.0: SQL destination * By default, syslog-ng PE commits every log message to the target database individually. When the 'explicit-commits' option is enabled, messages are committed in batches. This improves the performance, but results in some latency, as the messages are not immediately sent to the database. The size and frequency of batched commits can be set using the 'flush_lines' and 'flush_timeout' parameters. * If inserting a log message into the database fails for some reason, syslog-ng PE now attempts to insert the log message again. The maximal number of retry attempts can be set using the 'retry_sql_inserts' parameter. File source * When reading a log message from file and forwarding the message using the IETF-syslog message format, syslog-ng PE automatically adds meta information about the source file into the 'file(a)18372.4' SDATA block. The metadata includes the name and size of the file, as well as the file position the message was read from. New platforms * In addition to the already supported platforms, syslog-ng Premium Edition now supports the following operating systems and architectures: - AIX 6.1 on PowerPC - FreeBSD 7.1 and 8.0 i386 and amd64 - RHEL 6.0 and SLES 11.1 on i386 and amd64 - Solaris 8, Solaris 9, and Solaris 10 on SPARC64 Mark messages * The functionality of syslog-ng's internal MARK messages has been reworked and extended. In syslog-ng Premium Edition 4.0, it is possible to set different operation modes for MARK messages, for example, to disable them altogether, or send them only to destinations where there was no traffic, and so on. For details, see The syslog-ng Premium Edition 4.0 Administrator Guide. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng Premium Edition Dear syslog-ng User, Administrator Guide at: http://www.balabit.com/support/documentation/

1 0

syslog-ng Premium Edition 3.0.7 has been released
by devel＠balabit.hu 25 Feb '11

25 Feb '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 3.0.7 SUMMARY : new stable release DATE : Feb 2, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (3.0.7) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.7 Wed, 2 Feb 2011 17:31:17 +0100 General * AIX-5.2 platforms, the permission and the content of the rc.tcpip file was incorrect. This has been corrected. * On Solaris 10 platforms, if syslog-ng PE was running and there was no PID file or the PID file contained an incorrect PID number, syslog-ng switched to maintenance mode when receiving a STOP signal. This has been corrected. * The SDATA part of RFC5424-formatted log messages can contain sections without any name-value pairs, e.g.: [UserData.updatelist(a)18372.4] * The syslog-ng PE application did not properly handle CA certificates that have the ExplicitPolicy field set. This has been corrected. * When running in server mode, the syslog-ng PE application does not count messages of the local host as a remote client against the license limit. Logstore * The permissions of logstore were not properly set in some cases. This has been corrected. * The syslog-ng PE application now requests timestamp for logstore chunks only when required by the timestamp-freq() option. * Incorrect timestamps are now handled properly. Upgrading * When upgrading using the .run installer, the persist file of the old version was not retained. This has been corrected. Configuration * The statistics were not correctly updated after reloading the configuration of syslog-ng PE. This has been corrected. * The syslog-ng PE application now properly handles unknown parameters. * The syslog-ng PE application calculated the checksum only for the main configuration file, and not for included files. This has been corrected. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng 3.0 Administrator Guide at: http://www.balabit.com/support/documentation/?product=syslog-ng&type=all&la…

1 0

syslog-ng Premium Edition 4.0.1a has been released
by devel＠balabit.hu 24 Feb '11

24 Feb '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 4.0.1a SUMMARY : new stable release DATE : Feb 24, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (4.0.1a) has been released. For a full description on stable and feature releases, see Section 2.16. Stable and feature releases of syslog-ng PE in The syslog-ng Premium Edition 4.0.1a Administrator Guide. CHANGES: 4.0.1a Security updates: CVE-2008-7270, CVE-2010-3555, CVE-2010-4180 DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng Premium Edition 4.0.1a Administrator Guide at: http://www.balabit.com/support/documentation/

1 0

syslog-ng Premium Edition 3.0.7a has been released
by devel＠balabit.hu 24 Feb '11

24 Feb '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 3.0.7a SUMMARY : new stable release DATE : Feb 24, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (3.0.7a) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.7a Thu, 24 Feb 2011 12:00:00 +0100 Security updates: CVE-2008-4316, CVE-2008-7270, CVE-2009-3555, CVE-2010-4180 DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng 3.0 Administrator Guide at: http://www.balabit.com/support/documentation/?product=syslog-ng&type=all&la…

1 0

syslog-ng Agent for Windows 4.0.1 has been released
by devel＠balabit.hu 24 Feb '11

24 Feb '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng Agent for Windows VERSION : 4.0.1 SUMMARY : new stable release DATE : Feb 24, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Agent for Windows (4.0.1) has been released. This version contains changes, improvements, and new features. For a full description on stable and feature releases, see the Version Policy at http://www.balabit.com/network-security/syslog-ng/central-syslog-server/sup… CHANGES: 4.0.1 Fri, 04 Feb 2011 10:20:55 +0100 WARNING Upgrading to syslog-ng Agent version 4.0.1 is supported only from syslog-ng Agent version 3.0.8 and 3.2.1. BUGFIXES Protocols * When using Legacy BSD Syslog Protocol, syslog-ng Agent for Windows replaced CRLF with 1 spaces in the $EVENT_MSG macro. Now, this has been corrected: the agent replaces CRLF with 2 spaces. Installer * The installer displays a warning if there is only the currently incompatible Microsoft .NET Framework 4.0 version present on the computer. The syslog-ng Agent for Windows requires the Microsoft .NET Framework version 2.0 or 3.0 or 3.5. * The executable (.exe) version of the syslog-ng Agent installer automatically executes the gpupdate command if the agent is installed on the host of a domain and domain configuration is used. Messages * MARK messages now have syslog(5) facility and info(6) severity. * Shut down and startup messages now have syslog(5) facility and notice(5) priority. Eventlog sources * In case of XML Eventlog messages, the agent cannot handle illegal unicode characters in the messages. Now, they are replaced with "_" in the messages. HOW TO UPGRADE WARNING Upgrading to syslog-ng Agent for Windows version 4.0.1 is supported only from syslog-ng Agent version 3.0.8 and 3.2.1. * When upgrading a machine running version 3.0.8 or 3.2.1 in standalone mode, run the .exe installer and verify that the displayed information is correct. * When upgrading a machine running version 3.0.8 or 3.2.1 in domain mode, follow the steps described in section 'Installing the syslog-ng Agent on the hosts of a domain' of the documentation. The system will automatically recognize that the new package will update the syslog-ng Agent for Windows package. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng Agent for Windows application is available in The syslog-ng Agent for Windows 4.0.1 Administrator Guide at: http://www.balabit.com/support/documentation/

1 0

syslog-ng 3.2.2 has been released
by devel＠balabit.hu 16 Jan '11

16 Jan '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.2.2 SUMMARY : new stable release DATE : Jan 16, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.2.2) has been released. For latest fixes in the 3.2.x feature branch you are recommended to upgrade to this version. CHANGES: 3.2.2 Sat, 15 Jan 2011 13:50:35 +0100 Bugfixes: * Fixed a possible segmentation fault when the port number is changed for a TCP source, the configuration is reloaded and there were open connections for the old port, which send messages after the SIGHUP. This behaviour has been broken since 3.0.1. * Fixed a possible security issue on FreeBSD and on platforms where mode_t is an unsigned 16 bit value. On these platforms syslog-ng may be using 0xFFFF as the permission bits causing log files to be world readable/writable/executable/setuid. * Fixed leaking the contents of internal() messages (such as MARK or the statistics message). * Fixed current time tracking when calculating the time in the correllation engine. * When the patterndb file got reloaded the correllation state was dropped. This behaviour was fixed. * Really ignore invalid persist-state files, which caused syslog-ng startup to fail previously. * Added the missing support for blocks inside log {} statements. * Fixed a configuration init error when the same db-parser() instance is referenced from multiple log paths. * Fixed handling the port() options for SQL destinations. Platform specific: * Added cygwin support to the system() source. Build related: * syslog-ng modules are now linked with "-module -no-undefined" parameters, pdbtool and unit tests are using -dlpreopen when explicitly linking against such modules. * The core patterndb functionality got split off to a separate library installed to $libdir to make it easier to be used by pdbtool. * Fixed support for an explicit --exec-prefix configure parameter. Earlier if exec_prefix was different from prefix, the installation layout produced unworkable binaries. * If no OpenSSL libraries are available, pdbtool patternize still can work, although in this case proper UUID generation is not possible. * If syslog-ng is compiled against an old glib (earlier than 2.13), it'll not use an API that is present in newer ones. Please note however that there might be other similar compatibility issues with old Glib versions. * Updated cygwin packaging files. * Don't use -wno-pointer-sign in dbparser if gcc doesn't support it. This will emit a lot of warnings, but still make the code possible to compile with older gcc versions. Credits: syslog-ng is developed as a community project. All changes and improvements requires effort, and this effort is really appreciated. Writing code, testing changes or simply providing use-cases and information on one's setup will make syslog-ng better. Here are the people, listed in no specific order who made this release possible. * Balázs Németh (BalaBit) * Sándor Gellér (Morgan Stanley) * Péter Czanik (BalaBit) * Owen Mann (Interactive Data) * Zhengxiang Pan (Alcatel Lucent) * Corinna Vinschen (RedHat) * Eric Berggren (Apple) * Gergely Nagy (BalaBit) * Matthew Hall * LEBRETON Philippe * Craig Bell * Steven Chamberlain * Balázs Scheidler (BalaBit) Thanks for their efforts, it is appreciated. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

syslog-ng 3.1.4 has been released
by devel＠balabit.hu 14 Jan '11

14 Jan '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.1.4 SUMMARY : new stable release DATE : Jan 14, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.1.4) has been released. For latest fixes in the 3.1.x feature branch you are recommended to upgrade to this version. CHANGES: 3.1.4 Sun, 02 Jan 2011 13:06:13 +0100 Bugfixes: * Fixed hostname resolution in case normalize_hostnames() is enabled. In this case syslog-ng didn't properly NUL terminate the string causing binary characters to be emitted in log messages. * Fixed a possible security issue on FreeBSD and on platforms where mode_t is an unsigned 16 bit value. On these platforms syslog-ng may be using 0xFFFF as the permission bits causing log files to be world readable/writable/executable/setuid. * Fixed handling the port() options for SQL destinations. * Fixed a possible segmentation fault when the port number is changed for a TCP source, the configuration is reloaded and there were open connections for the old port, which send messages after the SIGHUP. This behaviour has been broken since 3.0.1. * The configure script has been changed to properly honour the value of ${exec_prefix} in case the env wrapper is enabled (--enable-env-wrapper). Configurations not using the env wrapper or using the same value for exec_prefix & prefix should not be affected. Other Changes: * Added explicit patterndb version check, in order to inform the user that a patterndb file is meant to be used by a newer syslog-ng version. * Increase YYMAXDEPTH value to make it possible to process larger configuration files. * Clarified the message on the deprecated use of use_time_recvd() Credits: Paul Krizak, Mukarram Syed, Philippe LEBRETON, Zhengxiang Pan, Matthew Hall, Craig Bell, Gergely Nagy, Laszlo Boszormenyi, Peter Czanik and Steven Chamberlain for reporting the bugs fixed in this release. Patches were authored by by Attila Nagy (BalaBit) and Balazs Scheidler (BalaBit). DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

syslog-ng 3.0.10 has been released
by devel＠balabit.hu 14 Jan '11

14 Jan '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.0.10 SUMMARY : new stable release DATE : Jan 14, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.0.10) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.10 Sun, 02 Jan 2011 12:43:46 +0100 Bugfixes: * Fixed handling the port() options for SQL destinations. * Fixed a possible segmentation fault when the port number is changed for a TCP source, the configuration is reloaded and there were open connections for the old port, which send messages after the SIGHUP. This behaviour has been broken since 3.0.1. * The configure script has been changed to properly honour the value of ${exec_prefix} in case the env wrapper is enabled (--enable-env-wrapper). Configurations not using the env wrapper or using the same value for exec_prefix & prefix should not be affected. * Fixed a possible security issue on Debian/kFreeBSD and on platforms where mode_t is an unsigned 16 bit value. On these platforms syslog-ng may be using 0xFFFF as the permission bits. Credits: Philippe LEBRETON, Zhengxiang Pan, Matthew Hall and Steven Chamberlain for reporting the bugs fixed in this release. Patches were authored by by Attila Nagy (BalaBit) and Balazs Scheidler (BalaBit). DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system…

1 0

syslog-ng Premium Edition 3.2.1a has been released
by devel＠balabit.hu 10 Jan '11

10 Jan '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 3.2.1a SUMMARY : new feature release DATE : Jan 7, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new feature version of syslog-ng Premium Edition (3.2.1a) has been released. For a full description on stable and feature releases, see Section 2.16. Stable and feature releases of syslog-ng PE in The syslog-ng Premium Edition 3.2.1a Administrator Guide. CHANGES: 3.2.1a Security updates: CVE-2009-0590, CVE-2009-2409, CVE-2009-3245, CVE-2010-0433, CVE-2010-0740, CVE-2010-0742, CVE-2010-3864, CVE-2011-0343 DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng Premium Edition 3.2.1a Administrator Guide at: http://www.balabit.com/support/documentation/

1 0

syslog-ng Premium Edition 3.0.6a has been released
by devel＠balabit.hu 10 Jan '11

10 Jan '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 3.0.6a SUMMARY : new stable release DATE : Jan 7, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (3.0.6a) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.6a Security updates: CVE-2009-0590, CVE-2009-2409, CVE-2009-3245, CVE-2010-0433, CVE-2010-0740, CVE-2010-0742, CVE-2010-3864, CVE-2011-0343 DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng 3.0 Administrator Guide at: http://www.balabit.com/support/documentation/?product=syslog-ng&type=all&la…

1 0