- syslog-ng-announce - lists.balabit.hu

syslog-ng 3.0.1 has been released
by devel＠balabit.hu 12 Jan '09

12 Jan '09

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.0.1 SUMMARY : new stable release DATE : Jan 12, 2009 ------------------------------------------------------------------------------ DESCRIPTION: A new major version of syslog-ng Open Source Edition 3.0 has been released. The news and highlights of this version are summarized below. CHANGES: 3.0.1 Wed, 24 Dec 2008 12:16:08 +0100 NEWS: Communication: * Version 3.0 of syslog-ng supports the new syslog protocol standards developed by the Internet Engineering Task Force (IETF). The details of these protocols can be found at http://www.ietf.org/internet-drafts/draft-ietf-syslog-protocol-23.txt and http://www.ietf.org/internet-drafts/draft-ietf-syslog-transport-tls-11.txt. * The capability to encrypt log connections using TLS has been added. Configuration: * Log statements can be embedded into each other, making it possible to design complex log paths. That way for example the results of a filter can be sent to multiple destinations, or it can be sent to a destination unchanged, and partly rewritten for the other destination. Log files: * The encoding of source files can be set for proper character conversion (internally syslog-ng represents every message in UTF-8). Log messages: * The syslog-ng application assigns a unique message identification number to every log message, making it easy to detect if any messages are lost. * The syslog-ng application can read, process, and rewrite structured messages (e.g., Apache webserver logs) using templates and regular expressions. Both messages with fixed field sizes and fields separated with delimiters (e.g., comma-separated values) are supported. DOWNLOAD: This is a source code only release, no binary packages are available at this time. Those will be provided at a later date. The documentation of syslog-ng OSE 3.0, including the installation and user guides is available at: http://www.balabit.com/support/documentation/?product=syslog-ng Best Regards, BalaBit IT Security DOWNLOAD: You can download the latest source and binary packages of syslog-ng from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system…

1 0

syslog-ng Premium Edition 2.1.11d has been released
by devel＠balabit.hu 26 Nov '08

26 Nov '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 2.1.11d SUMMARY : new stable release DATE : Nov 26, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (2.1.11d) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: NOTE: this release fixes a security problem CVE-2008-5110, see the changelog below for more details. Bugfixes: * Fixed chroot() support to change into the chrooted directory after chroot is invoked. This fixes the security problem CVE-2008-5110. NOTE: this vulnerability is not exploitable on its own, it only makes breaking out of the jail somewhat easier. Please also NOTE that, even with this patch applied, it is still possible to break out of the jail if syslog-ng is running as root. DOWNLOAD: Download the latest binaries from: https://www.balabit.com/network-security/syslog-ng/central-syslog-server/up… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng 2.0 Administrator Guide at: http://www.balabit.com/support/documentation/?product=syslog-ng&type=all&la…

1 0

syslog-ng Premium Edition 3.0.1b has been released
by devel＠balabit.hu 26 Nov '08

26 Nov '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 3.0.1b SUMMARY : new stable release DATE : Nov 26, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (3.0.1b) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.1b Wed, 19 Nov 2008 13:15:16 +0100 NOTE: this release fixes a security problem CVE-2008-5110, see the changelog below for more details. Bugfixes: * UNIX domain socket connect/disconnect events are only logged in verbose mode to avoid cluttering the system log. * Fixed a possible 100% CPU usage case on HP-UX. HP-UX may return POLLERR on its own without the other flags set, this was not properly handled by syslog-ng, causing it to spin on the CPU. * Fixed chroot() support to change into the chrooted directory after chroot is invoked. This fixes the security problem CVE-2008-5110. NOTE: this vulnerability is not exploitable on its own, it only makes breaking out of the jail somewhat easier. Please also NOTE that, even with this patch applied, it is still possible to break out of the jail if syslog-ng is running as root. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng 3.0 Administrator Guide at: http://www.balabit.com/support/documentation/?product=syslog-ng&type=all&la…

1 0

syslog-ng 2.1.3 has been released
by devel＠balabit.hu 26 Nov '08

26 Nov '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.1.3 SUMMARY : new stable release DATE : Nov 26, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.1.3) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: NOTE: this release fixes a security problem CVE-2008-5110, see the changelog below for more details. Bugfixes: * Fixed chroot() support to change into the chrooted directory after chroot is invoked. This fixes the security problem CVE-2008-5110. NOTE: this vulnerability is not exploitable on its own, it only makes breaking out of the jail somewhat easier. Please also NOTE that, even with this patch applied, it is still possible to break out of the jail if syslog-ng is running as root. * Fixed the code to resolve usernames, 2.1.2 had a regression which caused all username lookups to fail. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.1 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.1 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.1 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.1 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.1 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.1/src/

1 0

syslog-ng 2.0.10 has been released
by devel＠balabit.hu 26 Nov '08

26 Nov '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.0.10 SUMMARY : new stable release DATE : Nov 26, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.0.10) has been released. For latest fixes in the 2.0.x branch you are recommended to upgrade to this version. CHANGES: NOTE: this release fixes a security problem CVE-2008-5110, see the changelog below for more details. Bugfixes: * Fixed Solaris door support, the door portion of sun-streams() sources did not work in previous releases, as the door specific thread was lost through the fork() call used to background syslog-ng. * Fixed a possible segfault if non-existing, optional source files are present in the configuration. * Fixed the internal representation of "facility" values, earlier an 8 bit value was used for both the priority and facility values, and although systems do not define facilities in this range, the LOG_FACMASK macro defines two additional bits. The type of this field was changed to 16 bits. * Fixed a possible 100% CPU usage case on HP-UX. HP-UX may return POLLERR on its own without the other flags set, this was not properly handled by syslog-ng, causing it to spin on the CPU. * Fixed chroot() support to change into the chrooted directory after chroot is invoked. This fixes the security problem CVE-2008-5110. NOTE: this vulnerability is not exploitable on its own, it only makes breaking out of the jail somewhat easier. Please also NOTE that, even with this patch applied, it is still possible to break out of the jail if syslog-ng is running as root. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.0 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.0 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.0 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.0 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.0 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/

1 0

syslog-ng 2.1.2 has been released
by devel＠balabit.hu 16 Nov '08

16 Nov '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.1.2 SUMMARY : new stable release DATE : Nov 16, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.1.2) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: 2.1.2 Wed, 12 Nov 2008 12:25:37 +0100 Bugfixes: * Fixed handling windows sizes above 65535 by changing the internal reference counter type to a 32 bit integer. * Fixed the reported port number in log statistics messages. * Fixed the internal representation of "facility" values, earlier an 8 bit value was used for both the priority and facility values, and although systems do not define facilities in this range, the LOG_FACMASK macro defines two additional bits. The type of this field was changed to 16 bits. * Fixed filter evaluation, the evaluation in AND and OR operators had a problem, it evaluated the right-hand-size of expressions first, and then the left-hand-side. This is wrong, and it easily ruins the concept of extracting information from messages via regexps. * Fixed a segmentation fault in the configuration parser on OpenBSD/amd64. All configuration options that expected a number in the parser may cause a crash, as the strdup() function went undeclared on OpenBSD, causing it to be auto-declared as a function returning "int". As a 32 bit int cannot hold a 64 bit pointer, this may cause a crash if the high-order bits of the pointer are lost. * Fixed a possible "stall" of the syslog-ng main loop, when SQL destinations are used and flow control is enabled on the log path feeding the SQL destination. * Fixed a possible 100% CPU usage case on HP-UX. HP-UX may return POLLERR on its own without the other flags set, this was not properly handled by syslog-ng, causing it to spin on the CPU. Other changes: * Instead of relying on BalaBit's version of libdbi, adapt the configure script to libdbi upstream. This currently means that instead of dbi-0.8.pc, syslog-ng is looking for dbi.pc, just as the upstream installs the pkg-config file. * Added --enable-mixed-linking option to the configure script. This functionally equivalent of the default linking option in syslog-ng 2.0. This change only makes this possibility more explicit. * Fixed some compilation warnings. * Removed the build dependency on flex 2.5.34. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.1 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.1 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.1 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.1 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.1 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.1/src/

1 0

syslog-ng OSE git tree opened
by Balazs Scheidler 02 Oct '08

02 Oct '08

Dear syslog-ng users, I'm proud to announce that I've opened the syslog-ng OSE 3.0 branch and pushed a backport of the result of the latest Premium Edition development cycle. The size of the patch is enourmous, it took me a while to integrate it back to OSE 3.0, that's why this announcement is coming so late. The diffstat is as follows: 175 files changed, 21537 insertions(+), 7377 deletions(-) The list of changes of interest are: * various performance improvements, syslog-ng can do about 120-130k messages/sec in case no destination is written to (not very useful though), and about 75k msg/sec when writing to a plain text file * TLS encrypted channels, works the same as the PE version, documentation is: http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/ch03s09.html * support for the new IETF syslog protocols, in order to use this, you need to use the syslog() driver either as a source or a destination. It behaves quiet closely to tcp/udp, except it uses the new protocol * log message classification using a database, scales up to tens of thousands of messages per second, the pattern database also serves as a means to parse variable parts of messages. No real documentation so far, there's an XML Schema file in the tarball, it can be used using the db_parser() parser. * rewrite parts of the message using regexps, and simple string search and replace. Here's a post on the syslog-ng mailing list that has some info on usage: http://marc.info/?l=syslog-ng&m=122051372205555&w=2 * parse parts of the syslog message, makes it possible to parse fields in an Apache log for instance. Also the parsed values can be used as macros. Again, the post above has some info: http://marc.info/?l=syslog-ng&m=122051372205555&w=2 * generalize the log message paths, instead of a flat list of source->destination connections, log statements can be organized into a tree, making the configuration simpler and the performance better, here is a description: http://bazsi.blogs.balabit.com/2008/02/redesigning-syslog-ng-internals.html * PCRE and glob filters (in addition to POSIX regexps), use the type("pcre") option in the filter, like this: host("something" type("pcre")) * support for capabilities under Linux, this running syslog-ng as non-root is possible, also with reload support, see the documentation of Linux capabilities in capabilities(7), for the syntax of the --caps option, see cap_from_text(3) * program sources, simply use program("cat /dev/xconsole") in your configuration, the program will be restarted automatically if that exits. * syslog-ng got the ability to restart itself if it crashes, see the --process-mode command line option * new statistics framework that can be queried using UNIX domain sockets, provides per-source-host and per-destination-host statistics. In order to use it, possibly set the stats_level() option and write "STATS\n" to /var/run/syslog-ng.ctl which is a UNIX domain socket. This mass amount of changes also mean some incompatibilities between 2.1 and 3.0, however 3.0 will work in compatibility mode unless it is told to use the 3.0 configuration file format. It'll also report warnings against your configuration file you should change in order to use all the features and best performance. The most important incompatibilities include: * the $MSG macro will not include the "program[pid]:" string anymore, you should prepent an $MSGHDR macro in order to have that, in 2.1 mode the MSG will expand as before, but please note that this value is calculated everytime you reference the macro, thus it affects performance. * some defaults were changed (chain_hostname, template-escape, follow-freq for file sources), in 2.1 mode the old defaults are used but a warning is emitted * the input path does not remove NL characters anymore by default, but you can ask for this behaviour by specifying the "no-multi-line" flag. The documentation for the new features is not yet completely finished, I hope to get a snapshot of the current state to the website soon. In the meanwhile either use the source :) or ask direct questions on the mailing list. I'll also try to make some posts on my blog about various features in more detail and configuration examples. -- Bazsi

1 0

syslog-ng 2.1.1 has been released
by devel＠balabit.hu 02 Sep '08

02 Sep '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.1.1 SUMMARY : new stable release DATE : Sep 2, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.1.1) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: 2.1.1 Thu, 28 Aug 2008 09:26:30 +0200 Bugfixes: * Fixed a possible crash in stats message generation. * Fixed compilation problem in loggen on FreeBSD. Other changes: * The netmask filter was changed to assume that local messages are received from 127.0.0.1. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.1 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.1 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.1 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.1 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.1 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.1/src/

1 0

syslog-ng Premium Edition 2.1.11b has been released
by devel＠balabit.hu 02 Sep '08

02 Sep '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 2.1.11b SUMMARY : new stable release DATE : Aug 28, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (2.1.11b) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: 2.1.11b Thu, 28 Aug 2008 13:38:16 +0200 Changes: * Added support for Solaris 9/i386 and Solaris 10/i386 platforms. * Fixed a possible crash in the preliminary Solaris x86 binaries. This change does not affect systems running 2.1.11a on a non-Solaris-x86 platform. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/downloads/files/syslog-ng/binaries/premium-edition/ OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ debian-etch/syslog-ng-2.1 syslog-ng-pe RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ rhel-4/syslog-ng-2.1 syslog-ng-pe SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ suse-10.0/syslog-ng-2.1 syslog-ng-pe SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ suse-10.1/syslog-ng-2.1 syslog-ng-pe HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted.

1 0

syslog-ng 2.1beta2 has been released
by devel＠balabit.hu 30 Jun '08

30 Jun '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.1beta2 SUMMARY : new stable release DATE : Jun 30, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.1beta2) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: 2.1beta2 Fri, 13 Jun 2008 14:37:08 +0200 Bugfixes: * Create /var/lib/syslog-ng directory from RPM packages. * Fixed a 100% CPU usage problem triggered by the pipe() destination. This is a regression in 2.1beta1 and does not affect earlier versions. * Removed test code that injected "Connection timed out" errors into local file writes. * Set the current directory to the root once syslog-ng daemonized itself. * Fixed the $PID macro to only extract information from the syslog message header and not from the message contents. Other changes: * Instead of using O_APPEND for file writes, add an lseek before writing which performs much better with the NFS client in BSD kernels. * Added support for suppressing duplicate messages. This feature was contributed by Chris Packham. * The default linking mode is changed to dynamic linking, as static linking is more difficult for users to cope with. Those who use NFS mounted /usr on machines where syslog-ng runs on will probably need to explicitly ask for the previous behaviour. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.1 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.1 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.1 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.1 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.1 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.1/src/

1 0