- syslog-ng-announce - lists.balabit.hu

syslog-ng 3.1.3 has been released
by devel＠balabit.hu 26 Nov '10

26 Nov '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.1.3 SUMMARY : new stable release DATE : Nov 26, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.1.3) has been released. For latest fixes in the 3.1.x feature branch you are recommended to upgrade to this version. CHANGES: 3.1.3 Thu, 18 Nov 2010 07:50:42 +0100 Bugfixes: * csv-parser() defaults to "escape-none" mode even if it is not specified. * Fixed a possible CPU spinning in case mark_freq() is changed from a non-zero value to zero and syslog-ng is reloaded. * Fixed a flow control problem for the internal() source possibly causing an assertion to fail, e.g. syslog-ng to crash voluntarily. * Make it possible to use a literal '$' character by using two of them. * Make it possible to use binary characters within strings in configuration files by using a C-like \xHH, \oOOO syntax. * Attempt to flush the messages sitting in output queues a bit harder at shutdown. * Handle ESTALE errors in the file source for NFS file systems, which might cause a spin on the CPU otherwise. * Fixed a possible use-after-free problem potentially causing crashes or misbehaviour. No concrete errors were reported though. * The SQL driver didn't honour the port() option, this was fixed. * Fixed program_override() option, previously it overrode the hostname instead because of a typo. * Accept 3.1 as configuration version, previously it only accepted 3.0. * Fixed internal() message loop detection in case an error happened on the log writer flush path. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

syslog-ng 3.0.9 has been released
by devel＠balabit.hu 26 Nov '10

26 Nov '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.0.9 SUMMARY : new stable release DATE : Nov 26, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.0.9) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.9 Thu, 18 Nov 2010 06:43:49 +0100 Bugfixes: * csv-parser() defaults to "escape-none" mode even if it is not specified. * Fixed a possible CPU spinning in case mark_freq() is changed from a non-zero value to zero and syslog-ng is reloaded. * Fixed a flow control problem for the internal() source possibly causing an assertion to fail, e.g. syslog-ng to crash voluntarily. * Make it possible to use a literal '$' character by using two of them. * Make it possible to use binary characters within strings in configuration files by using a C-like \xHH, \oOOO syntax. * Attempt to flush the messages sitting in output queues a bit harder at shutdown. * Handle ESTALE errors in the file source for NFS file systems, which might cause a spin on the CPU otherwise. * Fixed a possible use-after-free problem potentially causing crashes or misbehaviour. No concrete errors were reported though. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system…

1 0

syslog-ng Premium Edition 3.2.1 has been released
by devel＠balabit.hu 09 Nov '10

09 Nov '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 3.2.1 SUMMARY : new feature release DATE : Oct 26, 2010 ------------------------------------------------------------------------------ DESCRIPTION: syslog-ng Premium Edition version 3.2.1 is the first maintenance release of the 3.2 feature release branch. For a full description on stable and feature releases, see Section 2.16. Stable and feature releases of syslog-ng PE in The syslog-ng Premium Edition 3.2 Administrator Guide. WARNING: Downgrading from a feature release to an earlier (and thus unsupported) feature release, or to the stable release is not supported. This means that once you upgrade a system from a stable release (e.g., 3.0) to a feature release (e.g., 3.1), you will have to keep upgrading to the new feature releases until the next stable version release (e.g., 4.0) is published, or risk using an unsupported product. Bugfixes: Installers .RUN installer: * If the /var/log directory did not exist while installing syslog-ng, the installer did not create it, so the logs of the installation were not available. This has been corrected. RPM installer: * The rcd scripts were missing from the SUSE10 installer. This has been corrected. DEB installer: * During upgrades, the installer did not migrate the license.txt file. This has been corrected. Core * On Solaris 10 platforms, if syslog-ng PE was running and there was no PID file or the PID file contained an incorrect PID number, syslog-ng switched to maintenance mode when receiving a STOP signal. This has been corrected. * The syslog-ng PE application terminated if it received a message with a facility number above 23. This has been corrected. * In certain cases, reloading a configuration that used the sql() driver caused the syslog-ng PE application to terminate. This has been corrected. * When using the IETF-syslog protocol, the sequenceID part of SDATA was missing from local messages. This has been corrected. File handling * In certain very rare cases, syslog-ng PE created corrupted logstore files. This has been corrected. * In certain cases when using many wildcard file sources, the syslog-ng PE application used a lot of CPU. This has been corrected. Only UNIX platforms were affected. * When accessing files from an NFS-mounted volume, the syslog-ng PE application could go into an infinite loop when the source files were deleted from NFS. This has been corrected. * The lgstool did not handle properly if its parameters were specified in an unexpected order. This has been corrected. Configuration * The statistics were not correctly updated after reloading the configuration of syslog-ng PE. This has been corrected. * The syslog-ng PE application calculated the checksum only for the main configuration file, and not for included files. This has been corrected. * The $HOST macro displayed incorrect values if the chained_hostnames() and normalize_hostnames() options were used together. This has been corrected. * Two new macros are available, referring to the date of the log messages: $MSEC (millisecond) and $USEC (microsecond). Multiple lines * The syslog-ng PE application terminated when the multiple-line-prefix() option was used and the source file was overwritten or rotated. This has been corrected. * When using the multiple-line-prefix() option without the multi-line-garbage() option, the syslog-ng PE application will wait only 10 seconds for the next message. If no new message arrives, the last message is assumed to be complete and sent to the destination. Accented characters * The pdbtool application did not accept accented characters. This has been corrected. * Pattern matching did not properly handle patterns containing accented characters. This has been corrected. Other * The loggen application did not correctly parse messages read from file sources. This has been corrected. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng Premium Edition 3.2.1 Administrator Guide at: http://www.balabit.com/support/documentation/

1 0

Release date of syslog-ng Premium Edition 4.0: 2011Q1
by devel 04 Nov '10

04 Nov '10

Release date of syslog-ng Premium Edition 4.0: 2011Q1 ----------------------------------------------------- The current roadmap on syslog-ng Premium Edition listed the next stable release (v4.0) for Q4 2010. In order to satisfy customer requests, we will include further features in syslog-ng Premium Edition 4.0, therefore decided to extend the timeframe of the project until 31th January, 2011. In addition to the new features already listed on the roadmap, syslog-ng Premium Edition 4.0 will also: * support the Solaris 8, 9 and 10 operating systems on sparc64 * offer significant performance improvements in the SQL destination by using explicit commits, instead of committing every INSERT statement automatically. The complete list of features planned for syslog-ng Premium Edition 4.0 is available at: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/fea… Further plans ------------- Plans about versions beyond syslog-ng Premium Edition 4.1 are expected to be available by the end of 2010.

1 0

syslog-ng Agent for Windows 3.2.1 has been released
by devel＠balabit.hu 08 Oct '10

08 Oct '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng Agent for Windows VERSION : 3.2.1 SUMMARY : new stable release DATE : Oct 8, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new feature version of syslog-ng Agent for Windows (3.2.1) has been released. This version contains changes, improvements, and new features. For a full description on stable and feature releases, see the Version Policy at http://www.balabit.com/network-security/syslog-ng/central-syslog-server/sup… CHANGES: 3.2.1 Fri, 08 Oct 2010 10:20:55 +0100 WARNING Upgrading to syslog-ng Agent version 3.2 is supported only from syslog-ng Agent version 3.0.8 and 3.1.1. NEW FEATURES File sources * The syslog-ng Agent for Windows application now handles multi-line messages. Therefore, more messages can be processed than if all the lines were handled separately. * Encoding can now be selected for files. Filtering * Besides global filtering, now filtering per destinations is also possible. Therefore, different messages can be forwarded to different destinations. * File sources can now also be filtered with whitelist filtering. Protocols * Snare support is now handled better; Snare-compatible message processing is now accessible as a separate protocol, and uses correct message format. * When using IETF-syslog protocol for eventlog messages, macros received during processing can be sent as name-value pairs in the SDATA part of the message. This is the default setting in new installations. * In new installations, the IETF-syslog protocol is the default. Configuration * It is possible to export the configuration to an XML file (both from command line and GUI), and it can be imported to other agents from command line. * Configuring destinations is now more user-friendly. * Clicking help in the GUI opens the relevant part of the Administrator Guide in Internet Explorer browser window. BUGFIXES * There was a rare issue when there were several destinations configured, the syslog-ng Agent terminated abnormally. This has been corrected. HOW TO UPGRADE WARNING Upgrading to syslog-ng Agent for Windows version 3.2 is supported only from syslog-ng Agent version 3.0.8 and 3.1.1. WARNING Downgrading from a feature release to an earlier (and thus unsupported) feature release, or to the stable release is not supported: this means that once you upgrade a system from a stable release (e.g., 3.0) to a feature release (e.g., 3.1), you will have to keep upgrading to the new feature releases until the next stable version release (e.g., 4.0) is published, or risk using an unsupported product. Both the stable and the feature branches will be supported via maintenance (e.g., bugfix) releases. * When upgrading a machine running version 3.0.8 in standalone mode, run the .exe installer and verify that the displayed information is correct. * When upgrading a machine running version 3.0.8 in domain mode, follow the steps described in section 'Installing the syslog-ng Agent on the hosts of a domain' of the documentation. The system will automatically recognize that the new package will update the syslog-ng Agent for Windows package. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng Agent for Windows application is available in The syslog-ng Agent for Windows 3.2.1 Administrator Guide at: http://www.balabit.com/support/documentation/

1 0

syslog-ng Agent for Windows 3.0.8 has been released
by devel＠balabit.hu 05 Aug '10

05 Aug '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng Agent for Windows VERSION : 3.0.8 SUMMARY : new stable release DATE : Aug 4, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Agent for Windows (3.0.8) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.8 Wed, 4 Aug 2010 10:20:55 +0100 Core: * When the syslog-ng Agent had 62 or more sources, sometimes it resulted in 100% of CPU usage. This has been corrected. * Changed the facility names "auth" (code 10) to "authpriv", and "cron" (code 15) to "solaris-cron" in the syslog-ng Agent GUI. File Sources: * When reading from wildcarded file source, syslog-ng Agent will now recognize renamed files. * When reading from a file source, syslog-ng Agent mishandled lines with more than 8192 characters. These were split into two separate log entries. This has been corrected. * syslog-ng Agent inserted an extra CR (ASCII 13) character at the end of the FILE_MESSAGE macro, causing problems when this macro was not the last one in the template. This behaviour has been corrected. HOW TO UPGRADE * When upgrading a machine running version 3.0.3 or later in standalone mode, run the .exe installer and verify that the displayed information is correct. * When upgrading a machine running version 3.0.3 or later in domain mode, follow the steps described in section 'Installing the syslog-ng Agent on the hosts of a domain' of the documentation. The system will automatically recognize that the new package will update the syslog-ng Agent for Windows package. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng Agent for Windows application is available in The syslog-ng 3.0 Administrator Guide at: http://www.balabit.com/support/documentation/?product=syslog-ng&type=all&la…

1 0

syslog-ng Agent for Windows 3.1.1 has been released
by devel＠balabit.hu 05 Aug '10

05 Aug '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng Agent for Windows VERSION : 3.1.1 SUMMARY : new feature release DATE : Aug 4, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new feature version of syslog-ng Agent for Windows (3.1.1) has been released. For latest fixes in the 3.1.x branch you are recommended to upgrade to this version. CHANGES: 3.1.1 Wed, 4 Aug 2010 10:20:55 +0100 BUGFIXES Core: * When the syslog-ng Agent had 62 or more sources, sometimes it resulted in 100% of CPU usage. This has been corrected. * There was a possible situation when syslog-ng Agent crashed in debug mode. This has been corrected. * Changed the facility names "auth" (code 10) to "authpriv", and "cron" (code 15) to "solaris-cron" in the syslog-ng Agent GUI. Eventlog Sources: * When the event message format is configured to SNARE Compatible Message Type, and the event (in $EVENT_MSG or $EVENT_MESSAGE macros) contains tab character or carriage return, line feed characters, syslog-ng Agent will replace them with space (in case of tab) and double space (in case of carriage return, line feed) in the outgoing message. File Sources: * When reading from wildcarded file source, syslog-ng Agent will now recognize renamed files. * When reading from a file source, syslog-ng Agent mishandled lines with more than 8192 characters. These were split into two separate log entries. This has been corrected. * syslog-ng Agent inserted an extra CR (ASCII 13) character at the end of the FILE_MESSAGE macro, causing problems when this macro was not the last one in the template. This behaviour has been corrected. Miscellaneous changes: * Added dbghelp.dll file to the installer, for creating crash dumps. * Corrected the descriptions of syslog-ng-agent-conf.xsd file. HOW TO UPGRADE WARNING Upgrading to syslog-ng Agent version 3.1 is supported only from syslog-ng Agent version 3.0.7. WARNING Downgrading from a feature release to an earlier (and thus unsupported) feature release, or to the stable release is not supported: this means that once you upgrade a system from a stable release (e.g., 2.0) to a feature release (e.g., 2.1), you will have to keep upgrading to the new feature releases until the next stable version release (e.g., 3.0) is published, or risk using an unsupported product. Both the stable and the feature branches will be supported via maintenance (e.g., bugfix) releases. * When upgrading a machine running version 3.0.7 in standalone mode, run the .exe installer and verify that the displayed information is correct. * When upgrading a machine running version 3.0.7 in domain mode, follow the steps described in section 'Installing the syslog-ng Agent on the hosts of a domain' of the documentation. The system will automatically recognize that the new package will update the syslog-ng Agent for Windows package. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng Agent for Windows application is available in The syslog-ng Agent for Windows 3.1 Administrator Guide at: http://www.balabit.com/support/documentation/?product=syslog-ng&type=all&la…

1 0

syslog-ng 3.1.2 has been released
by devel＠balabit.hu 04 Aug '10

04 Aug '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.1.2 SUMMARY : new stable release DATE : Aug 4, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.1.2) has been released. For latest fixes in the 3.1.x feature branch you are recommended to upgrade to this version. CHANGES: 3.1.2 Mon, 02 Aug 2010 17:06:28 +0200 INCOMPATIBLE CHANGES: * This release changes the default for 'store-legacy-msghdr' flag for log sources. In previous releases this had to be enabled explicitly, because of the performance penalties, which do not apply to 3.1. The original behaviour can be restored by explicitly specifying 'dont-store-legacy-msghdr'. See this blog post for more details: http://bazsi.blogs.balabit.com/2010/05/small-incompatible-change-for-31.html Bugfixes: * When syslog-ng is reloaded, the local hostname value was not refreshed, causing syslog-ng to remember the hostname until the next restart. This may not play nice with DHCP configured hostnames, which may change dynamically. * When several SIGHUP signals are received in quick succession, the last one may have been dropped. This problem is fixed. * Make sure that numbers never get resolved using getpwnam/getgrnam (e.g. libnss functions), because this may cause deadlocks if the NSS provider is LDAP and the LDAP server is trying to log a message to syslog about invalid usernames. * Fixed flush_timeout() handling in for non-file destinations. Enabling flush_lines()/flush_timeout() for a non-file destination, either using a global option, or a per-destination option could cause excess CPU usage as long as the destination wasn't writable. * In case patterndb has a syntax error when reloading the file, syslog-ng automatically reverts to the old version instead of dropping pattern matching altogether. * Fixed pdbtool to properly handle accented characters in the command line. * Fixed the use of the greedy and drop-invalid flags for csv-parser. * Fixed a possible but rare memory leak in the handling of message suppression. Other changes: * Added "update-patterndb" command that merges patterndb files from ${sysconfdir}/patterndb.d and produces ${localstatedir}/patterndb.xml, the default file of the db-parser(). * Make it possible to specify the path to the syslog-ng control socket using a command line option in order to make it easier to launch multiple syslog-ng instances. * Introduced a new, cleaner syntax to specify that the permissions of a file are not to be changed. Use owner/group/perm options of a file without any parameters instead of "-1". The old mechanism had the problem that both per-file and global settings had to use "-1" to effectively stop syslog-ng from changing the uid/gid/perm values. The new syntax will make it possible to specify defaults in the global options section and customize those on a per-file basis. * syslog-ng will not go into the background if either the --syntax-only or --debug options are specified. Loggen: * Added SSL support. * Added the ability to read from a sample file Credits: * We would like to send our thank for all contributors sending us bugreports, documentation issues or patches. They are: * Marius Tomaschewski * Corey Hickey * Evan Rempel * Andy Kitchingman * andrewn at locus.net Hopefully noone was missed from this list. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

syslog-ng Premium Edition 3.0.6 has been released
by devel＠balabit.hu 22 Jul '10

22 Jul '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 3.0.6 SUMMARY : new stable release DATE : Jul 21, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (3.0.6) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.6 Tue, 20 Jul 2010 16:14:17 +0100 General * The lgstool utility reported "record too large" errors on some logstore files. This has been a problem in the lgstool utility, not in the logstore files themselves. This has been corrected. * The syslog-ng PE application now ensures that the last chunks of logstore files are properly timestamped even if syslog-ng is terminated. * Non-file (for example pipe or tcp) destinations with flush_timeout() set to non-zero may cause high CPU usage as long as the destination is stalled. The situation resolved itself when the destination became writable again. This has been corrected. * Fixed a possible but rare memory leak in the handling of message suppression. * The default configuration file was incorrectly using the program_override() option, causing an extra ':' to be added to kernel log messages. This has been corrected. * Corrections in the handling of octal and hexadecimal numbers literals. * The syslog-ng application automatically stays in the foreground when performing configuration syntax checks (--syntax-only) or when started in debug mode (-d). * The syslog-ng PE application now ensures that numbers are never resolved using getpwnam/getgrnam functions, because this may cause deadlocks if the NSS provider is LDAP and the LDAP server is trying to log a message to syslog about invalid usernames. * When several SIGHUP signals are received in quick succession, the last one may have been dropped. This problem is fixed. * When syslog-ng is reloaded, the local hostname value was not refreshed, causing syslog-ng to remember the hostname until the next restart. This may not play nice with DHCP configured hostnames, which may change dynamically. * Fixed a boundary checking error on the usertty() destination, which can cause a local buffer to be overflown if the wtmp file on the system contains more than 123 characters in its ut_line member. It is not believed to be exploitable on the following platforms: Linux (32 chars) Solaris (12 chars) AIX (64 chars) HP-UX (12 chars) FreeBSD (8 chars) OpenBSD (8 chars) * Using the greedy and drop-invalid flags of the csv-parser() together caused syslog-ng to reject messages. This has been corrected. * So far, opening a file with the pipe() source driver (or a pipe with the file() driver) has been considered as an error. From now on, syslog-ng gives only a warning about such situations. * The dir_perm, dir_user and dir_group options were not available for logstore destinations. This has been corrected. * It was not possible to leave the ownership, permission, and group settings of existing log files and directories unchanged, because the owner(-1) setting always inherited the global settings. Now using these attributes without specifying an argument (for example, 'owner()') leaves the properties of the file unchanged. * When using templates to format messages, it is now possible to use the dollar-sign ($) in a template literally. Including two dollar signs in the template will result in a single dollar sign in the messages. * The syslog-ng.8 and syslog-ng.conf.5 man pages have been updated, and a new man page has been added for the loggen tool. Solaris * The Solaris 10 SMF script now checks if the pid file refers to an actual instance of syslog-ng to make sure that syslog-ng is started even after a system crash. * Corrections to the Solaris init scripts. AIX * The syslog-ng application did not automatically start on IBM AIX systems after the system was rebooted. This has been corrected. Debian, RPM installer * RPM and DEB packages now can rotate the /var/log/messages file, using a newly added logrotate script: /etc/logrotate.d/opt-syslog-ng DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng 3.0 Administrator Guide at: http://www.balabit.com/support/documentation/?product=syslog-ng&type=all&la…

1 0

syslog-ng Premium Edition 3.2.0 has been released
by devel＠balabit.hu 09 Jul '10

09 Jul '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 3.2.0 SUMMARY : new feature release DATE : Jul 5, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new feature version of syslog-ng Premium Edition (3.2.0) has been released. For a full description on stable and feature releases, see Section 2.16. Stable and feature releases of syslog-ng PE in The syslog-ng Premium Edition 3.2.0 Administrator Guide. CHANGES: 3.2.0 Fri, 2 July 2010 10:14:17 +0100 syslog-ng Premium Edition version 3.2 is the second feature release based on the stable 3.0 branch. For a full description on stable and feature releases, see Section 2.16. Stable and feature releases of syslog-ng PE in The syslog-ng Premium Edition 3.2 Administrator Guide. WARNING: Downgrading from a feature release to an earlier (and thus unsupported) feature release, or to the stable release is not supported. This means that once you upgrade a system from a stable release (e.g., 3.0) to a feature release (e.g., 3.1), you will have to keep upgrading to the new feature releases until the next stable version release (e.g., 4.0) is published, or risk using an unsupported product. Important changes in syslog-ng PE 3.2 * The default port numbers used by syslog-ng have changed to make them consistent with the relevant RFCs. Until now, the syslog() drivers used port 601 by default. Starting with this version, syslog-ng uses the following default ports for the syslog() destination and source drivers: * 514 for syslog over UDP * 601 for syslog over TCP * 6514 for syslog over TLS WARNING: If you used the syslog() driver with the default ports, adjust your configuration when upgrading to avoid data loss. * The behavior of handling the message header has changed: earlier versions stored the parsed header by default, and stored the original header only if the store-legacy-msghdr flag was enabled. Starting with syslog-ng PE 3.2 the original incoming header of the log message is stored in the $MSGHDR macro by default, the original (3.0 and 3.1) behavior of MSGHDR macro can be restored by using dont-store-legacy-msghdr flag. New features * The extended timestamp format of Cisco IOS is now supported, including sequence numbers and the NTP synchronicity indicator. The sequence number of such messages is available in the $SEQNUM macro. * The syslog-ng Premium Edition 3.2 application supports client-side failover to reduce the risk of message loss. For details, see Section 2.15, Client-side failover in The syslog-ng Premium Edition 3.2 Administrator Guide. * The syslog-ng Premium Edition 3.2 can handle multi-line log messages (for example, Tomcat logs) more efficiently. For details, see the descriptions of the multi-line-prefix() and multi-line-garbage() options in Section 6.1.2, file() in The syslog-ng Premium Edition 3.2 Administrator Guide. * Multi-line messages can be automatically indented using the new $(indent-multi-line $MESSAGE) expression in a destination template. * The lgstool application is available for Microsoft Windows platforms as well. Note that the recover function of lgstool is available only on Linux/UNIX. Available at: http://www.balabit.com/downloads/files/syslog-ng/premium-edition/3.2.0/setu… * The installer automatically installs the current HTML version of The syslog-ng Premium Edition 3.2 Administrator Guide under the /opt/syslog-ng/share/docs/admin-guide directory. Stability improvements * The contents of the disk buffer are stored even if syslog-ng crashes. * Until now, if syslog-ng crashed, it resent the contents of the monitored file sources. Now, the position of the last processed message is stored even in case of a crash. * The syslog-ng application uses journals to keep logstore files consistent even if syslog-ng crashes. For details, see 2.8.1. Journal files in The syslog-ng Premium Edition 3.2 Administrator Guide. * The performance of writing messages to logstore files has approximately doubled. Macros * Two new macros ($HOUR12, $AMPM) are available to format timestamps in an Oracle-compatible way. The $HOUR12 macro returns the hour of the day on a 0-12 scale, while the $AMPM macro returns AM for hours before mid day and PM for hours after mid day. * A new macro called $TAGS is available which expands to a list of comma-separated message tags. For details on using message tags, see 4.6.3. Tagging messages in The syslog-ng Premium Edition 3.2 Administrator Guide. Bugfixes * The SDATA ID, PARAM and VALUE fields of RFC5424-formatted messages were not handled correctly in certain cases and might cause a segmentation fault. This has been corrected. * The syslog-ng PE application now ensures that numbers are never resolved using getpwnam/getgrnam functions, because this may cause deadlocks if the NSS provider is LDAP and the LDAP server is trying to log a message to syslog about invalid usernames. * When several SIGHUP signals are received in quick succession, the last one may have been dropped. This problem is fixed. * The Solaris 10 SMF script now checks if the pid file refers to an actual instance of syslog-ng to make sure that syslog-ng is started even after a system crash. * The System V init script used on Solaris 8/9 gave error messages if the dump device did not exist (which happens in a chroot/zone environment). This has been corrected. * Corrections to the Solaris init scripts. * The timezone offset of applications other than syslog-ng was not adjusted correctly during the one-hour transition period of the daylight-saving changes. This has been corrected. * When syslog-ng is reloaded, the local hostname value was not refreshed, causing syslog-ng to remember the hostname until the next restart. This may not play nice with DHCP configured hostnames, which may change dynamically. * Fixed a boundary checking error on the usertty() destination, which can cause a local buffer to be overflown if the wtmp file on the system contains more than 123 characters in its ut_line member. It is not believed to be exploitable on the following platforms: Linux (32 chars) Solaris (12 chars) AIX (64 chars) HP-UX (12 chars) FreeBSD (8 chars) OpenBSD (8 chars) * CSV formatted statistics (accessible with syslog-ng-ctl) are now properly escaped. * Using a pipe driver on a regular file or a file driver on a named pipe caused 100% CPU usage. This has been corrected. * When running in server mode, the syslog-ng Premium Edition application counted messages of the local host into the number of licensed clients. This has been corrected. * It was not possible to leave the ownership, permission, and group settings of existing log files and directories unchanged, because the owner(-1) setting always inherited the global settings. Now using these attributes without specifying an argument (for example, 'owner()') leaves the properties of the file unchanged. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng Premium Edition 3.2.0 Administrator Guide at: http://www.balabit.com/support/documentation/

1 0