- syslog-ng-announce - lists.balabit.hu

syslog-ng Premium Edition 2.1.11a has been released
by devel＠balabit.hu 30 Jun '08

30 Jun '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 2.1.11a SUMMARY : new stable release DATE : Jun 30, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (2.1.11a) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: 2.1.11a Mon, 30 Jun 2008 12:16:10 +0200 Bugfixes: * Fixed the $PID macro expansion in cases when there's no PID value in the syslog header and a '[' and ']' is found in the message body. * Readded support for RHEL3 with the SQL destination feature omitted. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/downloads/files/syslog-ng/binaries/premium-edition/ OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ debian-etch/syslog-ng-2.1 syslog-ng-pe RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ rhel-4/syslog-ng-2.1 syslog-ng-pe SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ suse-10.0/syslog-ng-2.1 syslog-ng-pe SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ suse-10.1/syslog-ng-2.1 syslog-ng-pe HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted.

1 0

syslog-ng Premium Edition 2.1.11 has been released
by devel＠balabit.hu 29 May '08

29 May '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 2.1.11 SUMMARY : new stable release DATE : May 28, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (2.1.11) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: 2.1.11 Tue, 27 May 2008 11:06:48 +0200 Bugfixes: * Fixed RPM packaging to create /var/lib/syslog-ng automatically. * Fixed a 100% CPU usage problem triggered by the pipe() destination. This is a regression in 2.1.10 and does not affect earlier versions. * Fixed hostname parsing for names that begin with numeric characters. * Proper handling of disk-full conditions (and any write-related errors); prior versions suspended writing to the failing destination until a SIGHUP was received. From now on syslog-ng reopens the given destination after time_reopen() seconds. * Fixed year recognition heuristics to properly handle timestamps that are slightly in the future at month changes. Earlier versions mistakenly recognized these timestamps as ones from the preceding year. Other changes: * Added support for specifying the name of the disk-spool directory on the syslog-ng command line. * The configuration file can use DOS-style CRLF line endings. * Added support for the BSDTAG macro. * The syslog-ng startup will not fail if the initial connection to the server fails; syslog-ng will try to reconnect later instead. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/downloads/files/syslog-ng/binaries/premium-edition/ OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ debian-etch/syslog-ng-2.1 syslog-ng-pe RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ rhel-4/syslog-ng-2.1 syslog-ng-pe SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ suse-10.0/syslog-ng-2.1 syslog-ng-pe SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ suse-10.1/syslog-ng-2.1 syslog-ng-pe HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted.

1 0

syslog-ng Agent for Windows 2.1.6 has been released
by devel＠balabit.hu 15 May '08

15 May '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng Agent for Windows VERSION : 2.1.6 SUMMARY : new stable release DATE : May 15, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Agent for Windows (2.1.6) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: 2.1.6 Thu, 15 May 2008 10:20:55 +0200 New features: * The agent automatically resolves Security Descriptor Strings (SIDs) to names in the log messages. Bugfixes: * Corrections in the handling of timezones and daylight-saving changes. * Improvements in the SSL-encryption support on Windows Vista. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/downloads/files/syslog-ng/binaries/syslog-ng-agent/

1 0

syslog-ng Agent for Windows 2.2beta1 has been released
by devel＠balabit.hu 15 May '08

15 May '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng Agent for Windows VERSION : 2.2beta1 SUMMARY : new beta release DATE : May 13, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new beta version of syslog-ng Agent for Windows (2.2beta1) has been released. This is a test release produced as part of our development process while preparing for the next stable release. You are recommended to upgrade to only if you wish to test the new features of this release. This release is not recommended for production use. CHANGES: Configuration: * The configuration interface of the syslog-ng Agent has been completely rewritten: now it is fully manageable from a Domain Controller using Group Policies. If the host is not a member of a domain, the agent can be configured from a Local Group Policy in the Microsoft Management Console. Message processing: * The syslog-ng Agent for Windows now supports message filtering, making it possible to drop selected messages. * The $USERNAME macro has been renamed to $EVENT_USERNAME. * Different message format can be assigned to eventlog and file sources. * Facility and priority handling has been unified. * Sources and filters can be enabled and disabled both globally and individually. * Case sensitivity of the filters and regular expressions can be set. File sources: * File sources can either monitor the file that was last modified in the folder, or monitor all files of the folder in parallel. Both types of file sources can be used recursively on folders with subfolders. * Environment variables like %SYSTEMROOT% are supported when specifying file sources. * New macros are available for file sources. Communication: * It is now possible to configure multiple destination servers to send the messages to a failover server if the primary destination becomes unaccessible. * It is now possible to send the messages to multiple destination server in parallel. That way every destination receives a copy of the same message. Every destination may have failover servers configured. The agent considers a message successfully sent if the primary destination or one of its failover servers receives the message. * The syslog-ng Agent for Windows supports the draft IETF protocol described in http://www.ietf.org/internet-drafts/draft-ietf-syslog-protocol- 23.txt. Adding unique message identifier to every message is also supported. NOTE: The Linux/UNIX version of syslog-ng 2.2 will also support this protocol. * The syslog-ng Agent automatically detects if its configuration has changed since the last restart and sends the hash of the new configuration to the server. * The agent reports connection and certificate errors into the event log. * Similarly to the Linux version, the agent now sends MARK messages to the server to indicate that the client host is alive but there are no log messages to send. Packaging: * Both .exe and .msi installer packages are available. Bugfixes: * Improvements in the SSL-encryption support on Windows Vista. * Reading of log files larger than 2GB is supported. * Improvements in the handling of 64bit timestamps. DOWNLOAD: To access this release, login to your MyBalaBit account at http://www.balabit.com/mybalabit/ or signup for a new account at http://www.balabit.com/mybalabit/signup and request an evaluation version at http://www.balabit.com/mybalabit/evalreq

1 0

syslog-ng 2.0.9 has been released
by devel＠balabit.hu 25 Mar '08

25 Mar '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.0.9 SUMMARY : new stable release DATE : Mar 25, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.0.9) has been released. For latest fixes in the 2.0.x branch you are recommended to upgrade to this version. CHANGES: 2.0.9 Sun, 23 Mar 2008 21:36:47 +0100 Bugfixes: * Fixed handling more than 256 destinations by changing the reference counter type of LogMessages to a 16 bit value. * Fixed a possible SIGABRT crash if the hosts file passed to dns-cache-hosts() had multiple entries with the same IP address. * Fixed a possible crash during startup if "-g" was specified without using "-u". BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.0 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.0 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.0 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.0 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.0 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/

1 0

syslog-ng Agent for Windows 2.1.5 has been released
by devel＠balabit.hu 20 Mar '08

20 Mar '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng Agent for Windows VERSION : 2.1.5 SUMMARY : new stable release DATE : Mar 19, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Agent for Windows (2.1.5) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: 2.1.5 Wed, 19 March 2008 10:20:55 +0200 New features: * The syslog-ng Agent can now limit the number of messages sent per second (the throttle feature of syslog-ng). Bugfixes: * Tabs are not removed from the messages. * When two log file sources had exactly the same timestamp, only one of them was processed. This behavior has been corrected. * Corrections to the date verification of certificates. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/downloads/files/syslog-ng/binaries/syslog-ng-agent/

1 0

syslog-ng Premium Edition 2.1.9a has been released
by devel＠balabit.hu 07 Feb '08

07 Feb '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 2.1.9a SUMMARY : new stable release DATE : Feb 7, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (2.1.9a) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: 2.1.9a Wed, 06 Feb 2008 20:57:20 +0100 Bugfixes: * Fixed end-of-line marker for destination files that had no template() parameter. 2.1.9 Mon, 04 Feb 2008 15:16:08 +0100 Bugfixes: * Fixed a potential crash on Solaris 8 in time related functions. * Fixed flow-control behaviour for follow-mode source files. * Fixed bind error in the UNIX domain socket destination driver on Solaris. * Added the "mark" keyword to be an alias of "mark_freq" for compatibility with syslog-ng 1.6. * Fixed message loss in destination files during configuration reloads if syslog-ng is heavily loaded. * Fixed a possible segmentation fault in the dns-cache-host() file parsing code for improperly formatted host files. * Fixed DNS cache size checking, persistent DNS cache entries were also counted against dns_cache_size() which might decrease cache space significantly when a large /etc/hosts file is in use. * Fixed a bug that caused the persistent DNS cache (e.g. /etc/hosts) to be reloaded for all name resolution requests. * Fixed ISO timestamp parsing for timestamps that have no timezone information or have a too long fraction of a second portion. * Fixed possible "Insufficient buffer space" errors in the STREAMS driver. * Fixed the starvation of the timer used to reap unused destination files, which could cause some files never to be closed under heavy load. * Fixed restoring the time stamp from disk queue files in case the timezone offset is negative. * Added a workaround for possible deadlocks on /proc/kmsg and user terminals, this case is still best avoided by careful user configuration. * Fixed program name parsing that caused problems for TAG values that include the '/' character. This problem was introduced by 2.1.8. Other changes: * Added support for file sources that do not exist at startup. * The fsync() option was implemented. * Added support the "--persist-file" configuration option. * Added support for timestamps used by some LinkSys routers. * The SSL support now explicitly disables the use of SSLv2 which prevented the use of network traffic compression. * Significant performance improvements. * Added loggen tool to generate syslog messages at the specified rate. * Added support for Solaris 10/x64 DOWNLOAD: Download the latest binaries from: http://www.balabit.com/downloads/files/syslog-ng/binaries/premium-edition/ OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ debian-etch/syslog-ng-2.1 syslog-ng-pe RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ rhel-4/syslog-ng-2.1 syslog-ng-pe SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ suse-10.0/syslog-ng-2.1 syslog-ng-pe SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ suse-10.1/syslog-ng-2.1 syslog-ng-pe HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted.

1 0

syslog-ng 2.0.8 has been released
by devel＠balabit.hu 31 Jan '08

31 Jan '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.0.8 SUMMARY : new stable release DATE : Jan 31, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.0.8) has been released. For latest fixes in the 2.0.x branch you are recommended to upgrade to this version. CHANGES: 2.0.8 Thu, 31 Jan 2008 12:38:21 +0100 Bugfixes: * Fixed a regression in 2.0.7 that caused destination files not to be reopened when syslog-ng was reloaded. This causes potential problems with log rotation. * Fixed DNS cache size checking, persistent DNS cache entries were also counted against dns_cache_size() which might decrease cache space significantly when a large /etc/hosts file is in use. * Fixed a bug that caused the persistent DNS cache (e.g. /etc/hosts) to be reloaded for all name resolution requests. Other changes: * Fixed sample configuration file for RedHat. * Some portability changes in loggen. * Added cygwin packaging files to contrib/cygwin-packaging. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.0 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.0 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.0 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.0 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.0 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/

1 0

syslog-ng 2.0.7 has been released
by devel＠balabit.hu 08 Jan '08

08 Jan '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.0.7 SUMMARY : new stable release DATE : Jan 8, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.0.7) has been released. For latest fixes in the 2.0.x branch you are recommended to upgrade to this version. CHANGES: 2.0.7 Thu, 03 Jan 2008 07:01:59 +0100 Bugfixes: * Fixed UNIX domain socket destinations on Solaris. * Fixed flow-control behaviour for follow-mode source files. * Added the "mark" keyword to be an alias of "mark_freq" for compatibility with syslog-ng 1.6. * Fixed message loss in destination files during configuration reloads if syslog-ng is heavily loaded. * Fixed a possible segmentation fault in the dns-cache-host() file parsing code for improperly formatted host files. * Fixed possible "Insufficient buffer space" errors in the STREAMS driver. * Fixed the starvation of the timer used to reap unused destination files, which could cause some files never to be closed under heavy load. * Fixed ISO timestamp parsing for timestamps that have no timezone information or have a too long fraction of a second portion. * Added a workaround for possible deadlocks on /proc/kmsg and user terminals. * Fixed program name parsing that caused problems for TAG values that include the '/' character. This problem was introduced by 2.0.6. Other changes: * The fsync() option was implemented. * Added support for file sources that do not exist at startup. * Added support the "--persist-file" configuration option. * Added support for timestamps used by some LinkSys routers. * Added loggen tool to generate syslog messages at the specified rate. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.0 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.0 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.0 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.0 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.0 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/

1 0

BBSA-2008-001: BalaBit Security Advisory
by devel 02 Jan '08

02 Jan '08

----- B a l a B i t S e c u r i t y A d v i s o r y ( B B S A ) ----- BBSA-AUTHOR : Tamás Pál <tamas.pal(a)balabit.hu> BBSA-ID : BBSA-2008-001 BBSA-ADDRESS : advisory(a)balabit.hu GNUPG FINGERPRINT : 933E 6763 D32D A01C 1A75 F228 9CB1 81C7 D91E 8915 DATE : Jan 02, 2008 ----------------------------------------------------------------------------- BACKGROUND: As of January 1, 2008, security advisories released by BalaBit IT Security are called BalaBit Security Advisory (BBSA). The Zorp Security Advisory name will not be used in the future.

1 0