- syslog-ng-announce - lists.balabit.hu

syslog-ng 3.0.8 has been released
by devel＠balabit.hu 09 Jul '10

09 Jul '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.0.8 SUMMARY : new stable release DATE : Jul 9, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.0.8) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.8 Fri, 09 Jul 2010 09:27:37 +0200 Bugfixes: * The flush_timeout() fix in 3.0.7 was not working properly for file() destinations. This has been fixed. * Fixed the use of the greedy and drop-invalid flags for csv-parser. * Fixed a possible but rare memory leak in the handling of message suppression. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system…

1 0

[announce] patterndb project
by Balazs Scheidler 25 Jun '10

25 Jun '10

Hi, By now probably most of you know about patterndb, a powerful framework in syslog-ng that lets you extract structured information from log messages and perform classification at a high speed: http://www.balabit.com/dl/html/syslog-ng-ose-v3.1-guide-admin-en.html/conce… Until now, syslog-ng offered the feature, but no release-quality patterns were produced by the syslog-ng developers. Some samples based on the logcheck database were created, but otherwise every syslog-ng user had to create her samples manually, possibly repeating work performed by others. Since this calls out to be a community project, I'm hereby starting one. Goals ===== Create release-quality pattern databases that can simply be deployed to an existing syslog-ng installation. The goal of the patterns is to extract structured information from the free-form syslog messages, e.g. create name-value pairs based on the syslog message. Since the key factor when doing something like this is the naming of fields, we're going to create our generic naming guidelines that can be applied to any application in the industry. It is not our goal to implement correllation or any other advanced form of analysis, although we feel that with the results of this project, event correllation and analysis can be performed much easier than without it. Related projects ================ I know there are other efforts in the field, why not simply join them? CEF - is the log message format for a proprietary log analysis engine, primarily meant to be used to hold IP security device logs (firewalls, IPSs, virus gateways etc). The patterndb project aims to create patterns for a wider range of device logs and be more generic in the approach. On the other hand we feel that it might be useful to create a solution for converting db-parser output to the CEF format. CEE - Common Event Expression project by Mitre has a focus on creating a nv pair dictionary for all kinds of devices/log messages out there. Although I might be missing something, but I didn't find the concrete results so far, apart from a nicely looking white paper. If the CEE delivers something, then patterndb would probably adapt the naming/taxonomy structure. But I guess not all devices will start logging in the new shiny format, thus the existing devices would need their logs converted, so the patterndb work wouldn't be wasted. Infrastructure ============== Our original patterndb related plans were to create an easy to use web based interface for editing patterns, but since that project is progressing slowly, I'm calling for a minimalist approach: git based version control of simple plain text files. Of course once the nice web based interface is finished, we're going to be ready to use it. First steps =========== I have created a git repository at: http://git.balabit.hu/bazsi/syslog-ng-patterndb.git This contains the initial version of the naming policy document and a simple schema for SIEM-style and a user login-logout naming schema. If you are interested please read the file README.txt in the git archive, or if you prefer a web browser, use this link: http://git.balabit.hu/?p=bazsi/syslog-ng-patterndb.git;a=blob;f=README.txt;… Licensing ========= I do not have a decision yet, but for sure this is going to use one of the open source licenses or Creative Commons. Let me know if you have a preference in this area. Getting involved ================ Join the syslog-ng mailing list, a start discussing! If you have existing patterns, great. If you don't, it is not late to join. http://lists.balabit.hu/mailman/listinfo/syslog-ng -- Bazsi

1 0

syslog-ng 3.0.7 has been released
by devel＠balabit.hu 11 Jun '10

11 Jun '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.0.7 SUMMARY : new stable release DATE : Jun 7, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.0.7) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.7 Sun, 06 Jun 2010 13:27:38 +0200 Bugfixes: * When syslog-ng is reloaded, the local hostname value was not refreshed, causing syslog-ng to remember the hostname until the next restart. This may not play nice with DHCP configured hostnames, which may change dynamically. * When several SIGHUP signals are received in quick succession, the last one may have been dropped. This problem is fixed. * Make sure that numbers never get resolved using getpwnam/getgrnam (e.g. libnss functions), because this may cause deadlocks if the NSS provider is LDAP and the LDAP server is trying to log a message to syslog about invalid usernames. * Fixed flush_timeout() handling in for non-file destinations. Enabling flush_lines()/flush_timeout() for a non-file destination, either using a global option, or a per-destination option could cause excess CPU usage as long as the destination wasn't writable. Other changes: * Introduced a new, cleaner syntax to specify that the permissions of a file are not to be changed. Use owner/group/perm options of a file without any parameters instead of "-1". The old mechanism had the problem that both per-file and global settings had to use "-1" to effectively stop syslog-ng from changing the uid/gid/perm values. The new syntax will make it possible to specify defaults in the global options section and customize those on a per-file basis. * syslog-ng will not go into the background if either the --syntax-only or --debug options are specified. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system…

1 0

syslog-ng 3.0.6 has been released
by devel＠balabit.hu 12 Apr '10

12 Apr '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.0.6 SUMMARY : new stable release DATE : Apr 11, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.0.6) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.6 Sun, 11 Apr 2010 10:35:46 +0200 Bugfixes: * Fixed a boundary checking error on the usertty() destination, which can cause a local buffer to be overflown if the wtmp file on the system contains more than 123 characters in its ut_line member. It is not believed to be exploitable on the following platforms: Linux (32 chars) Solaris (12 chars) AIX (64 chars) HP-UX (12 chars) FreeBSD (8 chars) OpenBSD (8 chars) * Fixed a possible loss of the last partial message in the TCP and TLS transports of the syslog() driver. * Fixed empty line handling in the syslog() driver. The parser now accepts empty lines (which it didn't, but should have) and empty lines have the required trailing space which it didn't previously. * Fixed SDATA value lookup in case the the SD-ID contains dots. * Added escaping support to the structured-data parser. * Fixed an off-by-one bug in the structured data parser. * Fixed a possible segmentation fault after initializing the configuration when using unix-stream() and unix-dgram() destinations. * Fixed the Solaris 10 SMF script to handle "refresh" calls. * Fixed the Solaris 10 SMF script to handle an existing PID file without syslog-ng running with that pid. * Fixed the Solaris init/SMF scripts to avoid ugly error messages if the dump device doesn't exist. This situation can easily happen in a chroot or a zone. * Fixed a 100% CPU usage if the pipe() driver is applied to a regular file, or a file() driver on a named pipe. * Fixed a daylight saving problem in the transition window when receiving a BSD timestamp. * syslog-ng CSV format statistics (reachable via the syslog-ng.ctl socket) is now properly escaped. Other changes: * Fixed a linking problem with the MacOSX linker. * Added automatic test coverage for RFC5424 protocol format. * The SQL driver will drop a message after 3 failed attempts to insert it into the database. * If a character set conversion problem occurs on a connection, syslog-ng will drop the connection instead of trying to read further. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system…

1 0

syslog-ng 3.1.1 has been released
by devel＠balabit.hu 12 Apr '10

12 Apr '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.1.1 SUMMARY : new stable release DATE : Apr 11, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.1.1) has been released. For latest fixes in the 3.1.x feature branch you are recommended to upgrade to this version. CHANGES: 3.1.1 Sun, 11 Apr 2010 10:26:57 +0200 Bugfixes: * Solaris 10 SMF script now checks if the pid file refers to an actual instance of syslog-ng to make sure that syslog-ng is started even after a system crash. * The System V init script used on Solaris 8/9 gave ugly error messages if the dump device doesn't exist (which happens in a chroot/zone environment), this was fixed. * Fixed a 100% CPU usage if the configuration file uses the pipe driver on a regular file or a file driver on a named pipe. * Fixed a daylight saving problem in the transition window when receiving a BSD timestamp. * syslog-ng CSV format statistics (reachable via syslog-ng-ctl) is now properly escaped. Other changes: * Added "TAGS" macro which expands to a list of comma separated message tags. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

syslog-ng Premium Edition 3.0.5 has been released
by devel＠balabit.hu 24 Mar '10

24 Mar '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 3.0.5 SUMMARY : new stable release DATE : Mar 24, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (3.0.5) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: General * The timezone offset of applications other than syslog-ng was not adjusted correctly during the one-hour transition period of the daylight-saving changes. This has been corrected. * If the /var/log directory did not exist the syslog-ng could not log into the /var/log/messages file. Now this directory is automatically created during installation. * The semicolon (;), double-quote ("), and end-of-line (EOL) characters are automatically escaped in the syslog-ng STATS output. * The SDATA ID, PARAM and VALUE fields of RFC5424-formatted messages were not handled correctly in certain cases and might cause a segmentation fault. This has been corrected. Solaris * Corrected the start method of the syslog-ng initscript on Solaris 10 in case when the syslog-ng.pid file exists but syslog-ng is not running. * The syslog-ng application displayed an unnecessary error message if the dump device did not exist. This has been corrected. * Files and symbolic links are copied using piped tar instead of cp in order to retain the symbolic links. The old behavior caused significant increase of disk space requirements. * Corrections in the handling of the syslog_door file under Solaris 10. In Solaris 10 the file name of the door file has been changed to /var/run/syslog_door but the default syslog-ng configuration used the old file name /etc/.syslog_door. The upgrade process fixes this problem by creating a symbolic link. New installations will not be affected. HP-UX * The installer did not find and backup the old syslog rc symbolic links. This has been corrected. Debian Installer * The syslog-ng installer displayed an unnecessary error message. This has been corrected. .Run Installer * The syslog-ng application did not start after installation if there was an old (v2.1) license file under /opt/syslog-ng/etc/. Now this file is moved to the /opt/syslog-ng.old directory. * The unnecessary files under /opt/syslog-ng/share/doc/ belonging to other platforms have been deleted. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng 3.0 Administrator Guide at: http://www.balabit.com/support/documentation/?product=syslog-ng&type=all&la…

1 0

syslog-ng Premium Edition 3.1.0a has been released
by devel＠balabit.hu 24 Mar '10

24 Mar '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 3.1.0a SUMMARY : new feature release DATE : Mar 24, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new feature version of syslog-ng Premium Edition (3.1.0a) has been released. For a full description on stable and feature releases, see Section 'Stable and feature releases of syslog-ng PE' in The syslog-ng Premium Edition 3.1.0a Administrator Guide. CHANGES: Due to a late minute compilation problem, support for the Perl Compatible Regular Expression (pcre) library was not present in 3.1.0. This has been corrected in this release. No other changes were applied to the syslog-ng code base. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng Premium Edition 3.1.0a Administrator Guide at: http://www.balabit.com/support/documentation/

1 0

syslog-ng 3.1.0 has been released
by devel＠balabit.hu 22 Mar '10

22 Mar '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.1.0 SUMMARY : new feature release DATE : Mar 22, 2010 ------------------------------------------------------------------------------ DESCRIPTION: This is the first stable release of syslog-ng Open Source Edition 3.1. syslog-ng 3.1 is the first so called "feature release" of syslog-ng, as such its support period ends when either the next feature (named 3.2) or the next stable (named 4.0) version is published. Please note that this announcement contains features that were already published in one of the earlier BETA releases. If you are upgrading from 3.1beta2, please see the list of changes relative to that version at the end of the "CHANGES" block below. CHANGES SINCE v3.0: New features: * Support for patterndb v2 and v3 format, along with a bunch of new parsers: ANYSTRING, IPv6, IPvANY and FLOAT. * Added a new "pdbtool" utility to manage patterndb files: convert them from v1 or v2 format, merge mulitple patterndb files into one and look up matching patterns given a specific message. * Support for message tags: tags can be assigned to log messages as they enter syslog-ng: either by the source driver or via patterndb. Later it these tags can be used for efficient filtering. * Added support for rewriting structured data. * Macros and name-value pairs got a little tighter integration, in filters where syslog-ng 3.0 was limited to only use name-value pairs, with 3.1 you can also use macros. * Enhanced dynamic name-value performance by a factor of three. * Some parsers got additional features: NUMBER is now able to parse hexadecimal numbers, ESTRING is now able to search for multiple characters as the end of the string. * Added non-standard and non-portable facility codes (range 10-15), decouple syslog-ng facility name information from the system used to compile syslog-ng on. * Added pcre support in the binary packages of syslog-ng. An updated administrator's guide is available on the BalaBit documentation page at: http://www.balabit.com/support/documentation/ CHANGES SINCE v3.1beta2: Bugfixes: * Fixed Solaris 10 SMF script to properly handle svcadm refresh requests. * Fixed a possible segmentation fault for unix-dgram/unix-stream destinations on some (non-Linux) platforms. * Fixed processing empty log entries when using the syslog() protocol. * Fixed processing partially received syslog messages. Other changes: * It is now possible to add comments before the @version header in the configuration file. * Decrease the frequency of gettimeofday() calls during syslog-ng operation, as gettimeofday() is expensive to call on some platforms. * The SQL destination will only attempt to INSERT a given log message 3 times, and after that it gives up, instead of trying indefinitely. * Tru64 portability fixes. * The functional test program was improved to check the new RFC5424 syslog protocol. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

syslog-ng Premium Edition 3.1.0 has been released
by devel＠balabit.hu 16 Mar '10

16 Mar '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 3.1.0 SUMMARY : new feature release DATE : Mar 16, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new feature version of syslog-ng Premium Edition (3.1.0) has been released. For a full description on stable and feature releases, see Section 'Stable and feature releases of syslog-ng PE' in The syslog-ng Premium Edition 3.1.0 Administrator Guide. CHANGES: syslog-ng Premium Edition version 3.1 is the first feature release based on the stable 3.0 branch. For a full description on stable and feature releases, see Section 'Stable and feature releases of syslog-ng PE' in The syslog-ng Premium Edition 3.1 Administrator Guide. WARNING: Downgrading from a feature release to an earlier (and thus unsupported) feature release, or to the stable release is not supported. This means that once you upgrade a system from a stable release (e.g., 3.0) to a feature release (e.g., 3.1), you will have to keep upgrading to the new feature releases until the next stable version release (e.g., 4.0) is published, or risk using an unsupported product. New supported platforms * The syslog-ng application now supports the following operating systems and platforms: * Solaris 9 on x86 * Tru64 5.1b on Alpha * HP-UX 11v2 on Itanium64 * Legacy Linux systems including RedHat Enterprise Linux 2 and Debian potato on x86, as well as RedHat Enterprise Linux 3, Debian sarge on x86 and x86_64. * Although not explicitly supported, but in general syslog-ng should run on other legacy Linux systems as well that have at least glibc version 2.1.3 (x86) or glibc version 2.3.2 (x86_64). Pattern databases * Support for pattern database V2 and V3 formats. The V3 format has support for tagging messages, adding static name-value pairs, and also for including automatic test messages in the pattern database. See The syslog-ng 3.1 Premium Edition Administrator Guide for details. * A new command-line utility called 'pdbtool' is available to manage pattern database files. It can convert files using the old V1 or V2 database format to the latest V3 format, merge multitple pattern database files into one, and test patterns matching a specific message. See the pdbtool manual page in Appendix A of The syslog-ng 3.1 Premium Edition Administrator Guide for details. * The DOUBLE parser has been renamed to FLOAT. * The NUMBER parser can parse hexadecimal numbers as well. * It is possible to set multiple characters (a stopstring) instead of a single character in the ESTRING parser. * Log messages can be tagged. Tags can be assigned to log messages as they enter syslog-ng: either by the source driver or via patterndb. Later these tags can be used for efficient filtering using the tags() filter option. Messages are automatically tagged with the name of the source group in the ".source.name" format. Message statistics * The dynamic counters used for statistics with static ones. That way, statistics can be retained across syslog-ng reloads (but not when syslog-ng is restarted). Retaining statistics can be enabled using the 'stat_reset()' option. * Statistics can be collected for sender hosts, sources and destinations, facilities and severities, pattern database classes and rule IDs, as well as tags. Configuration file * The version of the syslog-ng configuration file is properly recognized even if it contains whitespace between the 'version' string and the version number. * Comments and empty lines before the version mark are accepted. Logstore * Logstore files can be encrypted with multiple keys. * The cipher and digest algorithms used in encrypting the logstore files can be specified. * Warnings and error messages related to logstore files include the name of the affected logstore file. * Timestamp policy OIDs can be specified using the 'timestamp_policy()' option. The OID is included in the timestamping request sent to the Timestamping Authority. * The logcat utility has been renamed to lgstool. SQL destinations * Auto-incremented columns are now supported. This must be specified in the 'indexes()' option of the destination's SQL schema like: indexes("id int not null auto_increment primary key"). * SQL INSERT statements were not formatted properly when the schema used default values. This has been corrected. * Oracle databases do not handle index names longer than 30 characters. In such cases, syslog-ng uses the MD5 hash of the name index. * If an index used with an Oracle destination starts with a digit, an 'I' character is automatically prefixed to the ID. This solves a problem experienced with Oracle 10 destinations. Other * Non-standard and non-portable facility codes (range 10-15) are now properly recognized. * Added support for Cisco ASA timestamps. * The syslog-ng application keeps the message queue when receiving a SIGHUP signal. * Support for PCRE regular expressions in now available on every supported platform. Loggen * Loggen can send log messages can be sent using SSL connections. * Messages can be read from a text file. syslog-ng-ctl * A new command-line utility called syslog-ng-ctl is available for the run-time control of syslog-ng. It can display message-related statistics on-demand, and enable/disable the debug, verbose and trace modes of syslog-ng to help troubleshooting. Security updates: CVE-2009-4355, CVE-2009-0591 DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng Premium Edition 3.1.0 Administrator Guide at: http://www.balabit.com/support/documentation/

1 0

syslog-ng Agent for Windows 3.0.7 has been released
by devel＠balabit.hu 27 Jan '10

27 Jan '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng Agent for Windows VERSION : 3.0.7 SUMMARY : new stable release DATE : Jan 26, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Agent for Windows (3.0.7) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.7 Tue, 1 Dec 2009 10:20:55 +0100 Core: * The syslog-ng Agent for Windows application now adds the version number to its configuration stored in the registry. This will help to avoid problems during later upgrades to future versions, e.g., to 3.1. Upgrading to syslog-ng Agent version 3.1 will be supported only from syslog-ng Agent version 3.0.7. * In certain situations, the agent terminated unexpectedly if a large number of eventlog sources were registered on the client host. This has been corrected. * The GPO occasionally restarted the syslog-ng Agent if the address of a destination server was very long. This has been corrected. * It is possible to specify the Distinguished Name (DN) of the certificate to use for TLS-encrypted connections. So far it was possible to specify the Common Name (CN) only. Eventlog Sources: * In case an event container did not exist, the agent sent "Cannot format event log message" messages. Now the nonexistent event container is ignored, and a proper log message is sent to the Application container. File Sources: * Until now, the agent has opened text files in a mode that prevented the file from being deleted. Now the files can be deleted, but the deleting application must ensure that there are no unsent messages in the file to avoid losing messages. HOW TO UPGRADE * When upgrading a machine running version 3.0.3 or later in standalone mode, run the .exe installer and verify that the displayed information is correct. * When upgrading a machine running version 3.0.3 or later in domain mode, follow the steps described in section 'Installing the syslog-ng Agent on the hosts of a domain' of the documentation. The system will automatically recognize that the new package will update the syslog-ng Agent for Windows package. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng Agent for Windows application is available in The syslog-ng 3.0 Administrator Guide at: http://www.balabit.com/support/documentation/?product=syslog-ng&type=all&la…

1 0