- syslog-ng-announce - lists.balabit.hu

syslog-ng Premium Edition 4 F1 (4.1.1a) has been released
by devel＠balabit.hu 06 Sep '11

06 Sep '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 4 F1 (4.1.1a) SUMMARY : New syslog-ng Premium Edition feature release DATE : Sep 5, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new version of syslog-ng Premium Edition 4 F1 (4.1.1a) has been released. For latest fixes in the 4 F1 (4.1.x) branch you are recommended to upgrade to this version. CHANGES: This release corrects a single issue (#23960), the timestamp-processing error announced on September 5, 2011. #23960: Month name parsing error in BSD timestamps WARNING If you are running syslog-ng Premium Edition 4 F1 (4.1.1), upgrade to 4.1.1a no later than September 30 to avoid losing information. Starting with October 1, version 4.1.1 of 4 F1 will log the new log messages as messages from December, possibly mixing or overwriting the log files or database tables of September. For details on the fixed issue, see our new issue tracking page at http://www.balabit.com/mybalabit/fixed_bugs/revision/ DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/sup… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng Premium Edition 4 F1 (4.1.1a) Administrator Guide at: http://www.balabit.hu/support/documentation?&product_line=46&product_type=48

1 0

Critical error in syslog-ng PE version 4 F1
by devel 05 Sep '11

05 Sep '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 4 F1 SUMMARY : Critical error in syslog-ng PE version 4 F1 DATE : Sep 5, 2011 ------------------------------------------------------------------------------ A critical error has been found in syslog-ng Premium Edition (PE) version 4 F1 that in certain situations causes the month information for September to be interpreted as December in legacy-syslog formatted log messages. This announcement contains important information about an error that may affect your system logging infrastructure, and describes how to assess and remedy the situation. Read the entire announcement thoroughly. WARNING You will have to upgrade to the new, corrected version of syslog-ng 4 F1 no later than September 30 to avoid losing information. Performing the upgrade is recommended as soon as possible. AFFECTED VERSIONS syslog-ng Premium Edition 4.1.x (4 F1) BACKGROUND The syslog-ng Premium Edition application associates two timestamps with every incoming log message: the timestamp that is included in the header of the log message, and the time when syslog-ng actually receives the log message. The information from the timestamp included in the log message is available using the "S_"-prefixed macros of syslog-ng (for example, "$S_DATE"), while the timestamp added when syslog-ng PE received the log message is available using the "R_"-prefixed macros. Macros without prefix (for example, "$DATE") are equivalent with the "S_"-prefixed macros. ISSUE Because of an error, the month information from September to December will be interpreted as December in the timestamp of messages received by syslog-ng Premium Edition 4 F1. This causes the month information in the log messages and date-related macros to be incorrect. Since the macro values are affected as well, filenames, pathnames, and the names of database tables that have date-related macros in their names will be misnamed as well. For example, if a destination uses the "$YEAR/$MONTH/$DAY/$HOST.log" filename template for log files, then the logs of the recent days (that is, September 1-5) are incorrectly stored under the "2011/12/$DAY/$HOST.log" directory instead of "2011/09/$DAY/$HOST.log", and the timestamp of the stored log messages contains December instead of September. HOW TO FIND OUT IF YOUR CONFIGURATION IS AFFECTED Your configuration is affected if the following is true: - You are using syslog-ng PE 4 F1, and: - At least one log source is define that uses the legacy-syslog (also called RFC3164, or BSD-syslog) message format. Such sources include, but are not limited to network sources (for example, the tcp() or udp() driver), sockets (for example, unix-stream()), and file or pipe sources. A source is not affected if the "flags(syslog-protocol)" option is set for the source. - At least one date-related macro that is not prefixed with "R_" is used in a filename, database table name, or other template. Your configuration is NOT affected, if the following is true: - the "keep_timestamp(no)" global option is set, or - the "keep_timestamp(no)" option is set individually for every source, or - you use custom templates for every destination that explicitly use the "R_"-version of the date-related macros. SOLUTION BalaBit will provide new, corrected syslog-ng PE 4 F1 packages by Tuesday, September 6. If you are using syslog-ng Premium Edition 4 F1 in a production environment and your configuration is affected, please contact the BalaBit Support Team at http://www.balabit.com/boss/ to help assess and remedy the situation. The complete solution involves upgrading to the new, corrected version of syslog-ng PE 4 F1, and correcting the problems resulting from the error (for example, renaming misnamed files). WARNING You will have to upgrade to the new, corrected version of syslog-ng 4 F1 no later than September 30 to avoid losing information. Starting with October 1, uncorrected versions of 4 F1 will log the new log messages as messages from December, possibly mixing or overwriting the log files or database tables of September. WORKAROUND To have syslog-ng process the timestamps correctly until you upgrade to the corrected packages, use the timestamp when the messages are received. Note that in this case the information about when the log message was sent is irrevocably lost. To accomplish this, set the "keep_timestamp()" option to "no", either globally, or locally for the affected sources. Alternatively, replace the date-related macros (for example, $DATE, $ISODATE, $S_MONTH, and so on) used in your configuration with their "R_"-prefixed versions to use the received date of the log message. POSSIBLE SIDE-EFFECTS OF THE ERROR Depending on your environment, certain further steps might be needed to resolve the results of the issue. For example: - Backups and archives of the log files must be reviewed if log files of the affected period (September 1-5) have already been archived or backed up. - If you forward the log messages from syslog-ng Premium Edition to a SIEM or log analyzing application or device, the incorrect dates might appear in the SIEM reports as well, and might also affect the monthly statistics of the log messages. - Misnamed database tables, and the contents of database columns containing date-related information might have to be corrected. Kind Regards and Sincere Apologies, BalaBit IT Security

1 0

syslog-ng Premium Edition 4 LTS (4.0.2) has been released
by devel＠balabit.hu 22 Aug '11

22 Aug '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 4 LTS (4.0.2) SUMMARY : new stable release DATE : Aug 22, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (4 LTS (4.0.2)) has been released. For a full description on stable and feature releases, see Section 2.16. Stable and feature releases of syslog-ng PE in The syslog-ng Premium Edition 4 LTS (4.0.2) Administrator Guide. CHANGES: 4 LTS (4.0.2) Fri, 19 Aug 2011 14:08:00 +0200 Fixed issues: #23529: syslog-ng segfaults when reading syslog messages from the disk buffer #23204: Fixed a problem in syslog() source when it returned with TCP reset #23112: Failure to open a destination file results in message loss #22890: syslog-ng cannot start if the disk buffer is corrupt #23381: syslog-ng aborted due to a deserialization problem #23149: Message loss when a TLS destination goes down #23052: Disk buffer becomes corrupt when receiving very large messages #23404: lgstool marks valid logstore chunks as invalid #23095: syslog-ng 4.0 failed with an assertion on Solaris when writing files in rare cases. #22787: Added table name to the persist-state file to identify an SQL destination. #22316: Unable to specify database port in MySQL destination For details on the fixed issues see our new issue tracking page at http://www.balabit.com/mybalabit/fixed_bugs/revision/ The documentation of syslog-ng 4.0, including the installation and user guides is available in PDF, HTML, and single-page HTML format at: http://www.balabit.com/support/documentation/?product_line=46&product_type=… UPGRADE: For details on upgrading and possible upgrade paths, read Section 3.4., Upgrading syslog-ng in the The syslog-ng Premium Edition 4.0 Administrator Guide: http://www.balabit.com/support/documentation/syslog-ng-pe-v4.0-guide-admin-… Kind Regards, BalaBit IT Security DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng Premium Edition 4 LTS (4.0.2) Administrator Guide at: http://www.balabit.com/support/documentation/

1 0

syslog-ng 3.3.0beta2 has been released
by devel＠balabit.hu 15 Aug '11

15 Aug '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.3.0beta2 SUMMARY : new stable release DATE : Aug 15, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new version of syslog-ng Open Source Edition (3.3.0beta2) has been released. CHANGES: 3.3.0beta2 Fri, 12 Aug 2011 09:00:17 +0200 Highlights ========== This release has started using the officially assigned port numbers for RFC5424 based log transports. syslog-ng will properly use the old defaults if the configuration @version indicates an old config. This release contains all identified bug fixes published by the BalaBit syslog-ng team in their syslog-ng PE 4.1 release, additional features will be integrated into syslog-ng 3.4 as 3.3 is already feature-frozen. See more details on the list of bugs fixed in the "bugfixes" section below. This release got a "beta" tag instead of a "release-candidate" because of the level of public testing it has received. However all currently known bugs are believed to be fixed and this should be much better than beta1 was. Bugfixes: ========= * Fixed a memory leak in macro based destination files. * Fixed the "dropped" and "stored" counters for the SQL destination, which were swapped previously. * Fixed file sources to properly start the source file from the beginning when restoring the persistent state failed. * Fixed BSD timestamp parsing, that caused an extra syslog header to be added to messages which had a single digit day-of-the-month (e.g. the first ten days for every month). * Fixed a possible crasher at exit, caused by the destinations being flushed and the associated sources already cleaned up. * Fixed a destination specific memory leak, which caused some hundred bytes to be leaked when the configuration was reloaded. * Set O_CLOEXEC for child program pipes, in order to avoid inheriting those to other children. * Allow RFC5424 structured data blocks to have no parameters (e.g. "[foo]", which only has an SDID and no SDPARAM). * Fixed the value of the $PRI macro which expanded to an empty string if the priority was 0 (= kern.emerg) * Fixed a race conditions in template compilation and expansion, that could cause segmentation faults and other nastiness. * Fixed a race condition in macro based file destinations, which caused crashes when multiple sources wrote into the same file, when the filename expanded to the same name from the multiple connections. (e.g. using $PROGRAM in the filename and receiving messages from different hosts running the same programs). * Fixed a possible segmentation fault in certificate validation, when the peer certificate contains an X.509 certificate purpose extension. * Try to load modules with the .a extension on AIX. * Fixed a possible crash in the socket source with optional(yes). * Made stats counters and their registration thread safe, which either caused crashes if stats_level() > 1 or miscalculated values due to parallel threads accessing the same counters. * Fixed a possible crash for unknown or mistyped source flags. * Fixed an fd and memory leak for opened destination connections. * Fixed possible crashes in SIGHUP handling in case syslog-ng is busy processing messages. * Fixed a failed assertion in persistent-state handling, triggered when multiple file sources are busy processing messages and recording their current file position. * Fixed SCL block expansion, when passing the empty value for a parameter. * The final flush that happens right before syslog-ng exits honoured the throttle() value. Since this is an attempt to squeeze out everything we have to the destination, it's best to ignore throttle in this case. * Fixed a possible use-after-free and other crash causing problems in file macro based destinations. * Fixed a massive memory leak of all processed messages, which were triggered by a change past v3.3.0beta1, but was found in a git snapshot. * Fixed keep-alive(yes) behaviour for destination drivers. * Messages generated by the db-parser() will be marked as local messages. * Implemented locking callbacks for OpenSSL, without which enabling SSL and threading mode almost guaranteed a crash in case multiple connections were running SSL. * Fixed an issue with the SQL destination, which can cause stalls in message processing. Build changes: ============== * Added --with-module-path configure option that specifies the default search path for modules. The help for the older --with-module-dir option was clarified, it indicates where syslog-ng Makefiles install modules. * The configure script automatically adds -pthread to the CC command line. Hopefully this is indeed supported on all platforms (worked on the ones I've tried), and avoids having to play dirty tricks with macros like _REENTRANT and _THREAD_SAFE. * Link unit test programs against -livykis in case we're using a system-installed ivykis, rather than our private copy. * Fixed compile issues on Solaris. * Updated to a newer libmongo-client (v0.1.3) * Updated to a newer ivykis version (v0.19 with syslog-ng specific patches) Performance improvements: ========================= * Use the GSlice allocator for objects allocated in the fast path. * Avoid another use of sprintf in the LogWriter fastpath. * Use per-thread caches for time related functions and the DNS cache. * Use the string representation of IP addresses in the DNS cache, as inet_ntop() performs much worse than the cache. Other changes: ============== * Functional tests: properly detect the presence of sqlite to do the sql() testing. * The minimum permissible value for the log-iw-size was changed to 100 from 10, as the per-connection window calculation has changed. Earlier all connections shared the same window, starting with 3.3, the window is distributed evenly to all connections, to avoid starving (e.g. one connection starves the rest by using up the window space) and to avoid thread synchronization in the message processing fast path. * Ported per-facility, per-severity, per-program and per-host counters from the PE version. * Other systemd unit files. Credits: ======== syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: * Dave Reisner (ArchLinux) * Nix (esperi.org.uk) * Hendrik Visage * Viacheslav Biriukov * Andras Mitzki (BalaBit) * Attila Nagy (BalaBit) * Gyorgy Fischhof (BalaBit) * Viktor Juhasz (BalaBit) * Balazs Scheidler (BalaBit) * Peter Czanik (BalaBit) * Gergely Nagy (BalaBit) * Peter Gyorko (BalaBit) * Tamas Pal (BalaBit) * Zoltan Pallagi (BalaBit) * Robert Fekete (BalaBit) DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

syslog-ng Premium Edition 4 F1 (4.1.1) has been released
by devel＠balabit.hu 28 Jul '11

28 Jul '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 4 F1 (4.1.1) SUMMARY : New syslog-ng Premium Edition feature release DATE : Jul 27, 2011 ------------------------------------------------------------------------------ Dear syslog-ng Premium Edition Users, A new feature version of the syslog-ng Premium Edition (PE) has been released. The main new features of syslog-ng Premium Edition 4 F1 (4.1.1) are briefly summarized below: Improved performance, over 500000 messages/second * The syslog-ng PE 4 F1 application can be run in multithreaded mode to scale to multiple CPUs or cores for increased performance. Depending on its configuration and other parameters, it can process over 150000 messages/second when receiving messages from a single connection and storing them in logstore or text files, or over 500000 messages/second when receiving messages from multiple connections and storing them in logstore or text files. Sending SNMP traps * The syslog-ng PE 4 F1 application can send SNMP traps using the Simple Network Management Protocol version 2c or version 3. Converting the syslog messages sent by Cisco devices to Cisco-specific SNMP traps defined by the CISCO-SYSLOG-MIB is also supported. Message correlation and triggers * The syslog-ng PE 4 F1 application can correlate the messages identified using pattern databases and use all the information of the correlated messages, for example, to collect all important information about an event into a single log message. * The syslog-ng PE 4 F1 application is able to generate (trigger) messages automatically if certain events occur, for example, a specific log message is received, or the correlation timeout of a message expires. Other changes * For details about the news and highlights of syslog-ng Premium Edition 4 F1 (4.1.1), see the What is new in syslog-ng Premium Edition 4 F1 at: http://www.balabit.com/sites/default/files/documents/syslog-ng-pe-4.1-guide… DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/sup… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng Premium Edition 4 F1 (4.1.1) Administrator Guide at: http://www.balabit.hu/support/documentation?&product_line=46&product_type=48 Kind Regards, BalaBit IT Security

1 0

syslog-ng 3.3.0beta1 has been released
by devel＠balabit.hu 24 May '11

24 May '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.3.0beta1 SUMMARY : new stable release DATE : May 24, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.3.0beta1) has been released. For latest fixes in the 3.3.x branch you are recommended to upgrade to this version. CHANGES: 3.3.0beta1 Fri, 13 May 2011 13:17:12 +0200 Highlights: =========== This release marks the feature freeze for the upcoming 3.3 version of syslog-ng, development continues on the newly opened 3.4 branch, while this one only receives bugfixes in the future. db-parser(): ============ * db-parser() has a new option called inject-mode() that can be used to specify where synthetic messages generated by syslog-ng itself should be injected. In 3.2 these appeared in the internal() source, in 3.3 they'll be generated from within db-parser(). * "pdbtool patternize": added --no-parse option sql(): ====== * Make the number of retries runtime configurable in case an INSERT is rejected by the database using the new retry-sql-inserts() option. * Added support for using the "default" value for columns, by specifying "default" as the column value. This can be used for auto-incrementing fields. * Explicit commits were adapted to use the proper BEGIN TRANSACTION command on MS SQL and Oracle. * Oracle doesn't like overly long index names, and since this limit was easily reached by syslog-ng, use md5 to compress the index name. * Removed the defaults for columns(), values() and indexes() as it's almost impossible to come up with a set of defaults that works on all databases. * DBI initialization errors are reported earlier, during startup, to make their detection easier. file(): ======= * The owner(), group(), perm(), dir_owner(), dir_group() and dir_perm() can be specified without an argument which tells syslog-ng to avoid changing file permissions even if the globals are set. mongodb(): ========== * The name of the collection was changed to be a simple string, instead of a template, to make implementing bulk inserts much easier. * Added support for the value-pairs() option, that makes it trivial to add fields to records dynamically. $(format-json): =============== * A new module named tfjson was created which implements a $(format-json) template function, capable of exporting the syslog-ng message model as a properly marked up JSON object. * The plugin supports both json-c and json-glib as backend implementations. Performance changes: ==================== * The LogQueue component was restructured for better scalability. This component is responsible to connect source and destination drivers as they work in separate threads, and as such it plays an important role in influencing the overall performance of syslog-ng. Loggen: ======= * Added support for reading files in multi-threaded mode (each thread sending a copy of that file, instead of mixing lines). * Added support for IPv6. Other changes: ============== * The list of plugins loaded by default became build-time configurable using the --default-modules configure switch. The same command line option can be used to override the same at runtime. * --version now includes information on the list of available modules, and --module-registry displays even more information on every loadable module. * Introduced another plugin possibility, inner-source and inner-dest plugin types allow the extension any kind of source or destination driver. * Use the newly introduced "cap-syslog" capability with kernels post-2.6.38. Build changes: ============== * A new shared library was introduced named libsyslog-ng-crypto.so that contains all crypto related code shared between plugins. * Added pkg-config files to be used in -dev packages in order to make it possible to build external modules. * "make uninstall" now properly uninstalls config files and SCL. Note that it removes everything without checking that they were changed locally. Bugfixes: ========= * The program destination caused a segmentation fault during startup, this was fixed. * Fixed syslog() style framing over TLS or tcp, which caused the syslog-ng server to shut connections down prematurely. * Fixed syslog() client code, which may cause invalid framing to be emitted on contended network connections. * Fixed a possibly failed assert in the flow control code in reaction to a broken source connection. * Fixed processing flush_timeout() for destinations, in earlier alpha versions flush_timeout() never expired. * Some platforms return EINVAL for writev() calls with zero I/O buffers, causing file output to fail. Make sure syslog-ng never generates such calls. * Fixed read behaviour for special files (like /proc/kmsg on Linux, /dev/klog for FreeBSD), as epoll/kqueue is unable to handle these. * Fixed write behaviour for special files (like /dev/console) as epoll/kqueue must be used even though syslog-ng doesn't use those for regular files. * Fixed a premature connection closure when the destination is unable to accept data (e.g. EAGAIN is returned from send()). This was easily reproduced by enabling SSL, as SSL is reporting the same condition when the negotiation is running and the client is expecting the response from a server. * Fixed a 100% CPU usage case in the SSL server case. * Fixed a possible segmentation fault during runtime (use-after-free problem which could cause segfaults). * Fixed a segmentation fault at exit when the tcp() destination couldn't connect to the server. * Don't attempt to remember the file position for files that are read using follow-freq(0), e.g. /dev/klog, /proc/kmsg and similar files. * Fixed a db-parser() correllation bug, sometimes timers were not expired as they should have. [3.2 port] * Accept three forms of the catch-all log statement flag: catch-all, catchall and catch_all since the documentation was wrong and it differed from the actual implementation for ages. * PCRE: fixed a potential resource hog triggered by PCRE 8.12 and "global" replacements. * loggen: make sure loggen sends out all data by calling shutdown() on the output socket. * loggen: handle SIGPIPE signals which caused loggen to exit prematurely when connections broke. * loggen: fixed a potential division by zero when reporting the message rate for unsuccessful connections. * Fixed a number of compilation warnings triggered by gcc 4.6 Credits: ======== syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: * Martin Holste * Balazs Scheidler (BalaBit) * Gergely Nagy (BalaBit) * Andy Ruch * Peter Czanik (BalaBit) * Viktor Juhasz (BalaBit) * Attila Nagy (BalaBit) * Andras Miczki (BalaBit) * György Fischhof (BalaBit) * Tamás Pál (BalaBit) * Bálint Kovács (BalaBit) * Hendrik Visage * Peter Gyöngyösi (BalaBit) * Mishou Michael (IRS) * Matthew Hall * Sándor Gellér (Morgan Stanley) * Micah Anderson * Jose Oliveira (Fedora) * Serge Hallyn (Ubuntu) DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

syslog-ng 3.2.4 has been released
by devel＠balabit.hu 11 May '11

11 May '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.2.4 SUMMARY : new stable release DATE : May 11, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.2.4) has been released. For latest fixes in the 3.2.x branch you are recommended to upgrade to this version. CHANGES: 3.2.4 Thu, 05 May 2011 23:10:52 +0200 Highlights: This maintenance release fixes some looser ends in the last published release, 3.2.3. There's one more important bugfix here, which is triggered by PCRE newer than 8.12. Bugfixes: * Fixed build problems on Solaris & AIX. * A bug was found in the pcre implementation for subst(). If the "global" flag is specified and pcre returns an error, an infinite loop is created, consuming memory in the process. It is triggered by PCRE 8.12, but could potentially affect older versions too. * Fixed a potential use of uninitialized memory in the configuration file parser, no bug was triggered but gcc 4.6 reported it via a warning. Other changes: * Fixed most (but not all) compilation warnings when compiling with gcc 4.6 Credits: syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Sandor Geller (Morgan Stanley) Balazs Scheidler (BalaBit) Micah Anderson Jose Oliveira (Fedora) Thanks for your efforts, it is appreciated. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

syslog-ng 3.2.3 has been released
by devel＠balabit.hu 01 May '11

01 May '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.2.3 SUMMARY : new stable release DATE : May 1, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.2.3) has been released. For latest fixes in the 3.2.x feature branch you are recommended to upgrade to this version. CHANGES: 3.2.3 Sun, 01 May 2011 19:05:32 +0200 Highlights: This is a maintenance release for the 3.2 branch, which contains several important functionality fixes in the db-parser() correllation code, an important security fix for FreeBSD & HP-UX (CVE-2011-0343) and build fixes for cygwin and mixed mode linking. Security fixes: * Fixed a possible security issue on Debian/kFreeBSD and on platforms where mode_t is an unsigned 16 bit value (FreeBSD, HP-UX). On these platforms syslog-ng may be using 0xFFFF as the permission bits. (CVE-2011-0343) Bugfixes: * Fixes an y2k38 problem that causes syslog-ng to use 100% CPU time in case mark messages are enabled and the UNIX timestamps overflows a signed 32 bit counter, which happens in 19th, January 2038 * Fixed file() destination to work on device nodes (e.g. files in /dev). Without this change, syslog-ng started using 100% CPU time if given devices as destinations that couldn't always consume data. * The code to restore the last file position for source files will not accept file-position past the file size, and will restart the file from the beginning instead. * Don't attempt to remember the current file position for source files that are read with follow-freq(0), e.g. /dev/klog and /proc/kmsg. These are special files which do not have the notion of file position, so no need to remember them. Regular files should always be read with follow-freq() set to nonzero, which is the default. * Fixed linking unit tests and other tools in mixed linking mode. * Fixed compilation on cygwin, especially lot of efforts went into linker compatibility. * Fixed building on platforms where PCRE is not in the standard include path. * Accept catch-all flag on log statements as well as catchall, as this was incorrectly documented in the past. db-parser() & pdbtool bugfixes: * Fixed @XX style message reference parsing used in correllation rules. * Fixed a segfault in the $(grep) template function when processing the parameters failed. * Fixed segfault in "pdbtool match --debug-pattern" in case the pattern doesn't match. * Fixed "pdbtool test" as previously all patterndb.xml files were reported to be invalid, even valid ones. * Fixed correllation timer related issue that caused some timers not to expire in rare cases. db-parser() & pdbtool changes: * Added support for enclosing template function arguments in parenthesis, in which case the quotes within the parentheses are not removed. For example: $(grep ('$FACILITY' == 'syslog')) This makes writing $(grep) and $(if) arguments much easier. * dbparser() the @NUMBER@ and @FLOAT@ parsers are able to parse negative numbers. * Added debug messages to dbparser() correllation so that it becomes easier to diagnose db-parser() problems. * Added -d (for --debug) and -v (for --verbose) options to pdbtool in order to make patterndb debugging easier. * Added --no-parse option to "pdbtool patternize" in order to read files without syslog-style parsing. Other changes: * Added error messages on DBI initialization failures. * Added systemd socket activation support. Build related changes: * Support for old (e.g. pre 7.1 commonly found in RHEL5) PCRE versions at the cost of an inoperating "newline" regexp flag. * configure now validates flex/bison versions better, as the requirements are more strict starting with syslog-ng 3.2 * Drop the creation of libsyslog-ng-patterndb.so. * "make clean" will properly remove libafsocket.so symlink. Credits: syslog-ng is developed as a community project. All changes and improvements requires effort, and this effort is really appreciated. Writing code, testing changes or simply providing use-cases and information on one's setup will make syslog-ng better. Here are the people, listed in no specific order who made this release possible. Steven Chamberlain Roger Paul Krizak (AMD) Attila Szalay (BalaBit) Matthew Hall Marius Tomaschewski (SUSE) Gergely Nagy (BalaBit) Tom Gundersen Dalibor Toman (Fortech.cz) Corinna Vinschen (RedHat) Balazs Scheidler (BalaBit) Laszlo Boszormenyi (LSC.hu) Arkadiusz Miśkiewicz (PLD Linux) Valentijn Sessink Hendrik Visage Peter Gyongyosi (BalaBit) Zoltan Pallagi (BalaBit) Mishou Michael (US IRS) Thanks for their efforts, it is appreciated. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

Maintenance Policy update for syslog-ng Open Source Editions
by Balazs Scheidler 30 Apr '11

30 Apr '11

Dear syslog-ng users, As discussed on the syslog-ng mailing list, the current versioning policies regarding syslog-ng Open Source Edition is confusing, and with the proliferation of syslog-ng versions, their maintenance is an increasing burden on the syslog-ng project. Currently three major versions are supported (3.0, 3.1 and 3.2) and a fourth one (3.3) is in active development. A decision was made that the distinction between "feature" and "stable" releases for syslog-ng OSE releases will cease to exist: all releases will have the same status support-wise: * they will be supported for a year, or * until the next stable release is made * whichever is longer Also, the versioning of Open Source and Premium editions will become completely independent, and it is not possible to compare their functionality on the version number alone. The Premium Edition will always be based on a specific Open Source release, and provide additional functionality compared to the base version. OSE releases published after the PE release may provide additional functionality, not yet present in a PE release. The changes above cause some of our currently supported versions to be deprecated. In order to provide a time window for migration to a newer release, the following EOL dates were set: syslog-ng 3.0: 30th, June 2011. syslog-ng 3.1: 30th, June 2011. Everyone running these or earlier releases should upgrade to the latest 3.2.x release, which is currently at 3.2.2. For more information: * support periods for syslog-ng OSE versions: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… * to download the latest syslog-ng OSE sources: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The syslog-ng project, on its own doesn't provide syslog-ng binaries, except for a limited number of Linux distributions. It is expected that users compile syslog-ng on their own, or use the binary provided by the OS supplier. This change doesn't affect you, if * you run a Premium Edition of syslog-ng, * you have a support contract in place, that says otherwise Happy logging, -- Bazsi

1 0

syslog-ng Premium Edition 3.2.1b has been released
by devel＠balabit.hu 25 Feb '11

25 Feb '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 3.2.1b SUMMARY : new feature release DATE : Feb 24, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new feature version of syslog-ng Premium Edition (3.2.1b) has been released. For a full description on stable and feature releases, see Section 2.16. Stable and feature releases of syslog-ng PE in The syslog-ng Premium Edition 3.2.1b Administrator Guide. CHANGES: 3.2.1b Security updates: CVE-2008-7270, CVE-2010-3555, CVE-2010-4180 DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng Premium Edition 3.2.1b Administrator Guide at: http://www.balabit.com/support/documentation/

1 0