------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 3.0.2 SUMMARY : new stable release DATE : Feb 10, 2009 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (3.0.2) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.2 Sun, 08 Feb 2009 15:16:22 +0100 NOTE: This release fixes security problem CVE-2008-5077. See the changelog below for more details. TLS * Fixed the improper handling of certain certificates when using the 'required-untrusted' option. * Corrections in verifying certificates using trusted CA certificates: certificates signed with a CA certificate that has its CA parameter set to False are treated as invalid, even if the CA certificate is explicitly labeled as trusted. SQL * Connections to MSSQL databases always used the default 1433 port, regardless of the configuration settings. This has been fixed. * Existing tables were not handled properly when logging into an SQLite database. This has been corrected. * The syslog-ng application terminated when logging into a database from the IBM AIX platform. This has been corrected. Logstore * A log message related to the logstore file format did not properly include the id of the chunk related to the message. This has been corrected. Controlling syslog-ng * Stopping syslog-ng produced an unnecessary error message under HP-UX. This has been corrected. * Starting syslog-ng did not properly check if syslog-ng was already running on the Linux, Solaris 8/9, and HP-UX platforms. This has been corrected. * Starting/stopping/reloading syslog-ng under Linux produced some unwanted system messages under the dash shell and under bash on the SUSE platform. This has been corrected. * The native logrotation tools do not send a SIGHUP to syslog-ng after rotating the log files, causing syslog-ng to write into files already rotated. To solve this problem, the syslog-ng init script links the /var/run/syslog.pid file to syslog-ng's pid. Also, on Linux, the install.sh script symlinks the initscript of the original syslog daemon to syslog-ng's initscript. * When running syslog-ng in a chroot, the username and groupname is resolved before chrooting is performed. * If the username or groupname cannot be resolved, syslog-ng runs as the root user. * Corrected a username-resolution problem introduced in version 3.0.1b. * The configuration of syslog-ng is now initialized with the credentials specified using the --user and --group command line options and not with the "root" account as with previous versions. This change fixes /dev/klog opening problems on FreeBSD, but affects all non-Linux platforms. Installation and upgrading * The RPM and DEB packages are out of beta with this release, installing syslog-ng via these packages is now supported. * It is now possible to properly uninstall syslog-ng using the uninstall.sh script, reverting to the default syslog daemon of the system. * The licenses and copyright notices of some third-party libraries used by syslog-ng were not properly installed. This has been corrected. * RPM packages are now signed with the following GPG key: Balabit Archive Automatic Signing Key <zorpos@balabit.hu> 1AE2 DA36 3316 3070 FC1C 90FF 3BDA F86D 2AA2 8252 Available at: http://www.balabit.com/company/contacts/pgp/keys/zorpos.pgp * When upgrading from syslog-ng PE 2.1.x using the .deb or .rpm packages, the disk buffer, the configuration, and the persist files were not correctly migrated. This has been corrected. * Installation and upgrade of syslog-ng from the .deb package using dpkg failed because the package conflicted with the existing syslog daemon. This has been corrected. Configuration * The follow_freq parameter now accepts floating point numbers as well (e.g., 0.1). * The syslog-ng configuration file now supports including other files and directories. * Implemented the following new time-related macros: YEAR_DAY, MONTH_WEEK, MONTH_ABBREV, MONTH_NAME, WEEK_DAY, WEEK_DAY_ABBREV, WEEK_DAY_NAME, R_YEAR_DAY, R_MONTH_WEEK, R_MONTH_ABBREV, R_MONTH_NAME, R_WEEK_DAY, R_WEEK_DAY_ABBREV, R_WEEK_DAY_NAME, S_YEAR_DAY, S_MONTH_WEEK, S_MONTH_ABBREV, S_MONTH_NAME, S_WEEK_DAY, S_WEEK_DAY_ABBREV, S_WEEK_DAY_NAME. See The syslog-ng 3.0 Administrator Guide for details. * Implemented a new source flag (store-legacy-msghdr) that stores the original incoming header of the log message. This is useful if the original format of a non-syslog-compliant message must be retained (syslog-ng automatically corrects minor header errors). * The facility(syslog) filter was broken because "syslog" became a reserved word in syslog-ng 3.0. Now the filter works again. Security * The security vulnerability CVE-2008-5077 affecting the openssl library has been fixed. See http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5077 for details. Other * Unix domain socket connect/disconnect messages are only logged if "verbose" mode is enabled. * Terminating a connection caused 100% CPU usage on HP-UX. This has been corrected. * A minor correction in the handling of parser and rewrite values. * When syslog-ng is abnormally terminated, it can execute a user-created failure script. This can be used for example to send an automatic e-mail notification. The script must be located at /opt/syslog-ng/sbin/syslog-ng-failure * Fixed a race condition that occurred when reading a log message from a file source that has just been rotated. * The performance of reading log messages from source files that used the follow_freq() option has been significantly improved. * Corrected a lockup related to improper character-encoding. * Correction in the evaluation of filter() operators: match(a) AND match(b) was evaluated in the order match(b) and then match(a). This caused problems when regular expressions were used to extract fields from a message. Known issues: * The built-in syslog-ng configuration file that comes with SUSE 10 contains a reserved word in its configuration file, causing syslog-ng to exit with a syntax error. Future versions of syslog-ng will contain a workaround for this issue, until then please rename the "null" destination and all its references _OR_ enclose the name "null" with quotes. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upgr... Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng 3.0 Administrator Guide at: http://www.balabit.com/support/documentation/?product=syslog-ng&type=all&language[en]=en&