- syslog-ng-announce - lists.balabit.hu

syslog-ng Agent for Windows 3.0.4 has been released
by devel＠balabit.hu 17 Aug '09

17 Aug '09

------------------------------------------------------------------------------ PACKAGE : syslog-ng Agent for Windows VERSION : 3.0.4 SUMMARY : new stable release DATE : Aug 13, 2009 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Agent for Windows (3.0.4) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: Core: * It is possible to specify the configuration of the agent in an XML file when installing the agent, and also when starting the agent. See the documentation of the agent in the upcoming version of The syslog-ng 3.0 Administrator Guide for details on the format of the XML file. * If the agent loses the connection to the logserver and the reconnection fails, it will send an eventlog message only once in every ten minutes. The successful reconnection attempt is also logged. * Decreased the load caused by the agent on Windows 2008 and 2003 systems. * In some situations, the agent did not properly start because of a deadlock. This has been corrected. * When starting the agent in service mode, command-line parameters were not processed correctly. This has been corrected. * Trying to register the syslog-ng agent service from the command line failed in some cases if the path to the syslog-ng-agent.exe file contained whitespace characters. This has been corrected. Eventlog sources: * If a log file is corrupt, the agent will stop processing the event source. A log message is sent directly to the logserver to notify about the error ('Eventlog file is corrupt'). Configuration snap-in: * The Previous Settings and Next Settings buttons were not functioning properly and have been disabled. Packaging: * Installing the agent from a domain controller using the .msi installer failed in certain situations. This has been corrected. * The .msi installer does not install the MMC configuration snap-in of the agent, therefore does not require .NET to be installed on the clients. * Uninstalling the agent on 64-bit systems did not correctly remove every file. This has been corrected. HOW TO UPGRADE * When upgrading a machine running version 3.0.3 in standalone mode, run the .exe installer and verify that the displayed information is correct. * When upgrading a machine running version 3.0.3 in domain mode, follow the steps described in section 'Installing the syslog-ng agent on the hosts of a domain' of the documentation. The system will automatically recognize that the new package will update the syslog-ng Agent for Windows version 3.0.4 package. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng Agent for Windows application is available in The syslog-ng 3.0 Administrator Guide at: http://www.balabit.com/support/documentation/?product=syslog-ng&type=all&la…

1 0

syslog-ng 3.0.4 has been released
by devel＠balabit.hu 05 Aug '09

05 Aug '09

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.0.4 SUMMARY : new stable release DATE : Aug 5, 2009 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.0.4) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.4 Wed, 05 Aug 2009 12:51:31 +0200 Bugfixes: * The use of the tcp6 destination caused aborts during startup, which has now been fixed. * The window size used for flow control could be decremented to a negative value in case multiple incoming connections overflowed the queue. This could cause an abort if a SIGHUP was received at this time. * Fixed a possible segmentation fault under Solaris if the syslog() driver was used without explicitly specifying a transport() option. * Fixed parse error handling when loading the patterndb. * Fixed the handling of door initialization failures on Solaris. Other changes: * Fixed performance degradation when using the host_override/program_override options. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system…

1 0

syslog-ng 3.0.3 has been released
by devel＠balabit.hu 03 Jul '09

03 Jul '09

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.0.3 SUMMARY : new stable release DATE : Jul 3, 2009 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.0.3) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.3 Thu, 25 Jun 2009 08:20:28 +0200 IMPORTANT CHANGES: * There was an unintended change in the meaning of command line argument -C (--chroot) and -R (--persist-file) between 2.x and 3.x versions of syslog-ng. This release reverts this change back to the original 2.x behaviour. This is a incompatible change compared against 3.0.2. Please review your startup scripts if you use either -C or -R. Bugfixes: * Fixed a compilation problem if IPv6 is disabled. * Fixed a crash problem if a log statement has a filter but no destinations. * The usertty() driver was changed to open the terminal device in nonblocking mode, as open on a serial device might block which cause the syslog-ng process to hang. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system…

1 0

Roadmap for syslog-ng OSE 4.0
by Balazs Scheidler 03 Jun '09

03 Jun '09

Dear syslog-ng users, The roadmap for syslog-ng OSE has been updated and published at: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The same page also describes important release policy changes, thus it is recommended reading for all syslog-ng users. A related blog post can be found here: http://bazsi.blogs.balabit.com/2009/05/syslog-ng-40-roadmap-plus-release.ht… -- Bazsi

1 0

syslog-ng 3.0.2 has been released
by devel＠balabit.hu 08 May '09

08 May '09

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.0.2 SUMMARY : new stable release DATE : May 8, 2009 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.0.2) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.2 Thu, 07 May 2009 08:30:06 +0200 Highlights: * This release is the first to feature binary packages, installation packages for various platforms. Bugfixes: * Only assume that a source logfile was rotated if the new log file has a non-zero size. This fix solves a minor race which might cause some messages to be lost from the end of the old logfile. * Fixed the processing of the -u and -g command line options to set the user/group of the syslog-ng process. Previously all usernames were rejected as non-existant. * Resolve usernames before chrooting, to avoid the need to have an /etc/passwd & /etc/group inside the chroot. * Fixed the read rate of regular files, with the change in this release it is now possible to fully saturate a destination pipe by using plain text files. * Fixed a synchronization problem in the SQL destination on AIX causing random crashes when the SQL destination is used. * Make the "syslog" reserved word usable as a facility name, previously syslog-ng indicated a syntax error if syslog as a facility was not enclosed in quotation marks. * Don't write the pidfile in case only a syntax check was requested. * Fixed compilation problems if SSL support is not enabled. * Set the default fd limit to 256 on cygwin as that platform does not support the current default of 4096 used on all other platforms. * Fixed template expansion for non-inline templates defined using the template statement. * Fixed the handling of zero-sized packets in the udp() source. * Fixed the storing of regexp/db-parser() matches on big-endian, 32 bit CPUs. * Fixed character conversion in case one chunk of data has an incomplete sequence at the end. * Don't let the character conversion eat up unlimited memory to avoid an easy DoS condition. * Fixed SSL certificate validation, added X.509 policy check, fixed required-untrusted verify-mode and added basicConstraints validation. * Fixed /dev/klog handling on FreeBSD, syslog-ng attempted to open this device multiple times which is not permitted. * Fixed $TZOFS expansion in templates in case the target does not specify a conversion timezone (which is the default and is true in most cases). * Fixed the use of multiple SQL destinations, previously due to an initialization problem only the first SQL destination would ever start writing messages to the target database. * If you elected to use a host-file only name resolution, the check to see if the hosts file was changed was performed for each DNS resolution, causing a major performance drop. This was fixed. * Due to a typo in the configuration file parser, using SSL destinations always resulted in a segmentation fault. This was fixed. * Fixed counting the number of concurrent connections in the SSL enabled tcp() source, previously failing handshakes were counted, thus it is quite easy to reach the max-connection limit. * Clarified logging about connection rejected by /etc/hosts.deny & /etc/hosts.allow * HP-UX 11v3 compilation fixes * Fixed SOURCEIP expansion for IPv6 addresses. * Fixed match(type(string)) not to match the message in case only a prefix match was found. * Fixed capability setup code around file opens. Other changes: * Implemented 'store-legacy-msghdr' source flag which keeps the original value of MSGHDR intact, instead of parsing/rebuilding it at the cost of some performance penalty. * Implemented 'empty-lines' source flag to avoid dropping empty log messages which is the default behaviour. * Added support for file includes in the configuration file. * Allow follow_freq() to be a floating point number. * Cygwin packaging fixes. * Make it possible to create named pipes automatically in the pipe() destination. * Allow the use of macros in the filename of pipe() destinations. * Added support for setting the default priority/facility value for each source that get applied to messages that lack one. * Recognize "mssql" as an alias for "freetds" in the SQL destination. * Added the "greedy" flags to the csv-parser(): it makes the last column eat the complete end of the line without caring about column separation characters * Added the "drop-invalid" flag to the csv-parser() which makes the parser drop anything that has less columns than it expects to have. * Make it possible to use fractions of a second even in non-ISO timestamps. * The default values for SQL columns is being deprecated, please supply SQL schema information explicitly in your SQL destinations. A warning message was added in case you don't have a full schema and rely on the default values. * The SQL destination got a null() option that specifies a 'special' value for a column which get replaced by an SQL NULL. * Added local_timezone() option to file/sql destinations that control the timezone used when expanding the filename/tablename templates. It defaults to the local timezone. Configure changes: * This section lists changes that might affect distribution packages, please make sure that these changes do not break the syslog-ng packages in any way. * Changed the default value of pidfiledir to ${localstatedir} to match GNU conventions, you can specify it explicitly with a --with-pidfile-dir configure option. * Changed the default linking mode to "dynamic" to make it easier to compile syslog-ng, as most distributions prefer dynamic libraries over static ones. This means that syslog-ng might not be able to start up if /usr is on NFS. On platforms where syslog-ng is used as a system logger, the previous setting of --enable-mixed-linking is preferred. Loggen changes: * the sequence number and timestamping of generated messages were erroneously commented out, these were reverted. * do not allow message sizes that are larger than the predefined message buffer size. * in addition to reporting the number of messages/sec, also report the effective bandwidth used during testing. Test suite changes: * A lot of enhancements to the functional test program to cover more of the syslog-ng code, like SSL sources & SQL destinations. DOWNLOAD: You can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/

1 0

syslog-ng PE 2.1 end of support on December 31, 2009
by devel 22 Apr '09

22 Apr '09

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.1 SUMMARY : syslog-ng PE 2.1 end of support on December 31, 2009 DATE : April 22, 2009 ------------------------------------------------------------------------------ DESCRIPTION: The support for syslog-ng Premium Edition 2.1 ends on December 31, 2009. Updates, security fixes, and technical support of syslog-ng 2.1 will be discontinued at this date. This announcement applies to syslog-ng PE and the syslog-ng Agent for Windows alike. You are recommended to upgrade to syslog-ng 3.0 before the support for version 2.1 ends. UPGRADING: For details on upgrading to syslog-ng 3.0, see What is new in syslog-ng Premium Edition 3.0 (available at http://www.balabit.com/dl/guides/syslog-ng-v3.0-guide-whatsnew-en.pdf) especially the Upgrading and the Important changes sections. In order to upgrade to syslog-ng Premium Edition 3.0, login to your MyBalabit account at http://www.balabit.com/mybalabit/ and download the new license file and the binary packages. After that, follow the installation procedure described in Chapter 4, Installing syslog-ng in The syslog-ng 3.0 Administrator Guide (available at http://www.balabit.com/support/documentation/) The installer will automatically recognize earlier installations of syslog-ng, and offer to re-use the syslog-ng configuration file and the license. It will also display warnings about parameters and the format of the configuration file that have changed since version 2.1. For details on upgrading the syslog-ng Agent for Windows, see Section 5.1.1. Upgrading syslog-ng Agent for Windows 2.x to 3.0.x in The syslog-ng 3.0 Administrator Guide. NOTE: The syslog-ng 3.0 license is available only if you have valid software subscription. In case you do not see the new license under your MyBalaBit account, please contact your local distributor, or send an e-mail from the address used in your MyBalaBit registration to Ms. Edit Tusjak at edit.tusjak(a)balabit.com

1 0

syslog-ng Premium Edition 3.0.2a has been released
by devel＠balabit.hu 22 Apr '09

22 Apr '09

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 3.0.2a SUMMARY : new stable release DATE : Apr 22, 2009 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (3.0.2a) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.2a Sun, 29 Mar 2009 20:05:46 +0200 Bugfixes: * Fixed TZOFFSET macro expansion problem which resulted in -00:00 as timezone value if no explicit timezone conversion was specified. * Zero sized UDP datagrams were interpreted as end-of-file and the listener was incorrectly closed, causing all further syslog messages to be dropped. This behavior was fixed. * If the kernel lacked inotify support, syslog-ng did not fall back to poll-based file monitoring properly on Linux. Affects RHEL4 and earlier. This behavior was fixed. * Fixed the default value for follow-freq(); in 3.0.2 the default value was incorrectly set to 1msec instead of 1sec. Earlier versions in the 3.0 branch were behaving correctly. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng 3.0 Administrator Guide at: http://www.balabit.com/support/documentation/?product=syslog-ng&type=all&la…

1 0

syslog-ng OSE 2.1.4 released
by Balazs Scheidler 17 Mar '09

17 Mar '09

Hi, I've released syslog-ng OSE 2.1.4 with the following changes: 2.1.4 Tue, 17 Mar 2009 13:35:00 +0100 Bugfixes: * Fixed a possible DoS condition triggered by a destination port unreachable ICMP packet received from a UDP destination. syslog-ng started eating all available memory and CPU until it crashed if this happened. * Fixed the rate at which files regular were read using the file() source. * Report connection breaks as a write error instead of reporting POLLERR as the write error path reports more sensible information in the logs. The release is available at: https://www.balabit.com/network-security/syslog-ng/opensource-logging-syste… -- Bazsi

1 0

syslog-ng Premium Edition 3.0.2 has been released
by devel＠balabit.hu 11 Feb '09

11 Feb '09

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 3.0.2 SUMMARY : new stable release DATE : Feb 10, 2009 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (3.0.2) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.2 Sun, 08 Feb 2009 15:16:22 +0100 NOTE: This release fixes security problem CVE-2008-5077. See the changelog below for more details. TLS * Fixed the improper handling of certain certificates when using the 'required-untrusted' option. * Corrections in verifying certificates using trusted CA certificates: certificates signed with a CA certificate that has its CA parameter set to False are treated as invalid, even if the CA certificate is explicitly labeled as trusted. SQL * Connections to MSSQL databases always used the default 1433 port, regardless of the configuration settings. This has been fixed. * Existing tables were not handled properly when logging into an SQLite database. This has been corrected. * The syslog-ng application terminated when logging into a database from the IBM AIX platform. This has been corrected. Logstore * A log message related to the logstore file format did not properly include the id of the chunk related to the message. This has been corrected. Controlling syslog-ng * Stopping syslog-ng produced an unnecessary error message under HP-UX. This has been corrected. * Starting syslog-ng did not properly check if syslog-ng was already running on the Linux, Solaris 8/9, and HP-UX platforms. This has been corrected. * Starting/stopping/reloading syslog-ng under Linux produced some unwanted system messages under the dash shell and under bash on the SUSE platform. This has been corrected. * The native logrotation tools do not send a SIGHUP to syslog-ng after rotating the log files, causing syslog-ng to write into files already rotated. To solve this problem, the syslog-ng init script links the /var/run/syslog.pid file to syslog-ng's pid. Also, on Linux, the install.sh script symlinks the initscript of the original syslog daemon to syslog-ng's initscript. * When running syslog-ng in a chroot, the username and groupname is resolved before chrooting is performed. * If the username or groupname cannot be resolved, syslog-ng runs as the root user. * Corrected a username-resolution problem introduced in version 3.0.1b. * The configuration of syslog-ng is now initialized with the credentials specified using the --user and --group command line options and not with the "root" account as with previous versions. This change fixes /dev/klog opening problems on FreeBSD, but affects all non-Linux platforms. Installation and upgrading * The RPM and DEB packages are out of beta with this release, installing syslog-ng via these packages is now supported. * It is now possible to properly uninstall syslog-ng using the uninstall.sh script, reverting to the default syslog daemon of the system. * The licenses and copyright notices of some third-party libraries used by syslog-ng were not properly installed. This has been corrected. * RPM packages are now signed with the following GPG key: Balabit Archive Automatic Signing Key <zorpos(a)balabit.hu> 1AE2 DA36 3316 3070 FC1C 90FF 3BDA F86D 2AA2 8252 Available at: http://www.balabit.com/company/contacts/pgp/keys/zorpos.pgp * When upgrading from syslog-ng PE 2.1.x using the .deb or .rpm packages, the disk buffer, the configuration, and the persist files were not correctly migrated. This has been corrected. * Installation and upgrade of syslog-ng from the .deb package using dpkg failed because the package conflicted with the existing syslog daemon. This has been corrected. Configuration * The follow_freq parameter now accepts floating point numbers as well (e.g., 0.1). * The syslog-ng configuration file now supports including other files and directories. * Implemented the following new time-related macros: YEAR_DAY, MONTH_WEEK, MONTH_ABBREV, MONTH_NAME, WEEK_DAY, WEEK_DAY_ABBREV, WEEK_DAY_NAME, R_YEAR_DAY, R_MONTH_WEEK, R_MONTH_ABBREV, R_MONTH_NAME, R_WEEK_DAY, R_WEEK_DAY_ABBREV, R_WEEK_DAY_NAME, S_YEAR_DAY, S_MONTH_WEEK, S_MONTH_ABBREV, S_MONTH_NAME, S_WEEK_DAY, S_WEEK_DAY_ABBREV, S_WEEK_DAY_NAME. See The syslog-ng 3.0 Administrator Guide for details. * Implemented a new source flag (store-legacy-msghdr) that stores the original incoming header of the log message. This is useful if the original format of a non-syslog-compliant message must be retained (syslog-ng automatically corrects minor header errors). * The facility(syslog) filter was broken because "syslog" became a reserved word in syslog-ng 3.0. Now the filter works again. Security * The security vulnerability CVE-2008-5077 affecting the openssl library has been fixed. See http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5077 for details. Other * Unix domain socket connect/disconnect messages are only logged if "verbose" mode is enabled. * Terminating a connection caused 100% CPU usage on HP-UX. This has been corrected. * A minor correction in the handling of parser and rewrite values. * When syslog-ng is abnormally terminated, it can execute a user-created failure script. This can be used for example to send an automatic e-mail notification. The script must be located at /opt/syslog-ng/sbin/syslog-ng-failure * Fixed a race condition that occurred when reading a log message from a file source that has just been rotated. * The performance of reading log messages from source files that used the follow_freq() option has been significantly improved. * Corrected a lockup related to improper character-encoding. * Correction in the evaluation of filter() operators: match(a) AND match(b) was evaluated in the order match(b) and then match(a). This caused problems when regular expressions were used to extract fields from a message. Known issues: * The built-in syslog-ng configuration file that comes with SUSE 10 contains a reserved word in its configuration file, causing syslog-ng to exit with a syntax error. Future versions of syslog-ng will contain a workaround for this issue, until then please rename the "null" destination and all its references _OR_ enclose the name "null" with quotes. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng 3.0 Administrator Guide at: http://www.balabit.com/support/documentation/?product=syslog-ng&type=all&la…

1 0

syslog-ng Premium Edition 2.1.11e has been released
by devel＠balabit.hu 15 Jan '09

15 Jan '09

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 2.1.11e SUMMARY : new stable release DATE : Jan 15, 2009 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (2.1.11e) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: 2.1.11e Wed, 17 Dec 2008 21:47:47 +0100 This release has no code changes relative to 2.1.11d. It is being rebuilt in order to add digital signatures to RPM packages. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ debian-etch/syslog-ng-2.1 syslog-ng-pe RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ rhel-4/syslog-ng-2.1 syslog-ng-pe SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ suse-10.0/syslog-ng-2.1 syslog-ng-pe SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ suse-10.1/syslog-ng-2.1 syslog-ng-pe HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted.

1 0