October 2002 - syslog-ng - lists.balabit.hu

Urgent: Mangled messages in pipe() destinations in version 1.5.19
by Andreas Schulze 20 Mar '03

20 Mar '03

Hello Balazs, in version 1.5.19 (and in other versions between >1.5.7 and <=1.5.19, too) we observing obscure message mangling in pipe() destinations. Imagine the config below and the scenario: syslog-ng --write(2)--> pipe() --read(2)--> application All four log paths below, writes lines to the pipe '/tmp/pipe'. With 1.5.7 we read from the pipe exactly that, what syslog-ng (using the config below) writes to it. But with all newer versions (espec. 1.5.19) we read (with the same config): message_1 message_2 messagmessage_4 !!! ... message_n if we try to let syslog-ng write: message_1 message_2 message_3 message_4 ... message_n (The numbers and terms are only examples, because of the different sources and high message load.) Seems, that write(2) to fifo skips some message ends now. (espec. the terminating newline) > # example config: > # > source sys { sun-streams ("/dev/log" door("/var/run/syslog_door")); }; > source net { udp (ip(w.x.y.z) port(n)); }; > destination d_cisco { pipe("/tmp/pipe" template("@cisco: | $MSG\n")); }; > destination d_icmp { pipe("/tmp/pipe" template("@icmpd: | $MSG\n")); }; > log { source(net); filter(fa); destination(da); destination(d_cisco); }; > log { source(net); filter(fb); destination(db); destination(d_cisco); }; > log { source(sys); filter(f1); destination(d1); destination(d_icmp); }; > log { source(sys); filter(f2); destination(d2); destination(d_icmp); }; We are running a config similar to this above, with 1.5.7 since a lot of months very successfully in production ennvironment with very high message load. Since 1.5.1? the message mangling occurs. But now, some of your newer features becomes mission critical for us. Have you any idea, what happens? Versions <= 1.5.7 works well. Thanks a lot. -- Best regards --Andreas Schulze [phone: +49.5246.80.1275, fax: +49.5246.80.2275] | I believe, it was Dennis Ritchie who said something like: | "C is rarely the best language for a given task, | but it's often the second-best". | The implication being that: "[...]" | | sh# cat>$$.c<<EOT | main(l,a,n,d)char**a;{for(d=atoi(a[1])/10*80-atoi(a[2])/5-596;n="@NK\ | ACLCCGZAAQBEAADAFaISADJABBA^SNLGAQABDAXIMBAACTBATAHDBANZcEMMCCCCAAhE\ | IJFAEAAABAfHJETBdFLDAANEfDNBPHdBcBBBEA_AL H E L L O, W O R L D! " | [l++-3];)for(;n-->64;)putchar(!d+++33^l&1);} | EOT | gcc -o$$ $$.c;clear;./$$ 52 8;rm -f $$*

6 19

crashbug fix in recent syslog-ng versions
by Balazs Scheidler 22 Nov '02

22 Nov '02

Hi, I have found two problems which are the possible cause of the crashes reported on this list. expect a new release soon if the fixes below prove to be effective. The first one is a misallocation, causing an off-by-one error: diff -u -r1.35 sources.c --- sources.c 21 Aug 2002 14:03:50 -0000 1.35 +++ sources.c 27 Oct 2002 07:35:23 -0000 @@ -163,10 +163,10 @@ self->dgram = dgram; self->next = next; self->prefix = prefix; - self->max_log_line = MAX(max_log_line, pad_size) + 1; + self->max_log_line = MAX(max_log_line, pad_size); self->pad_size = pad_size; self->msg_flags = msg_flags; - self->buffer = ol_space_alloc(max_log_line); + self->buffer = ol_space_alloc(self->max_log_line); return &self->super; } ---- end of patch The second one is triggered with much less probability, it is also an off-by-one (this one can be triggered when the byte _after_ the allocated buffer is either '\n' or '\r'). diff -u -r1.27 -r1.28 --- log.c 21 Aug 2002 14:03:50 -0000 1.27 +++ log.c 18 Oct 2002 12:31:08 -0000 1.28 @@ -44,11 +44,9 @@ static void parse_log_msg(struct log_info *lm, UINT32 length, UINT8 *data, UINT8 *prefix) { unsigned char *src; - int left; - int pri; + unsigned int left, pri, oldleft; time_t now = time(NULL); char *oldsrc; - int oldleft; src = data; left = length; @@ -241,7 +239,7 @@ lm->stamp = now; } - for (oldsrc = src, oldleft = left; oldleft >= 0; oldleft--, oldsrc++) { + for (oldsrc = src, oldleft = left; oldleft > 0; oldleft--, oldsrc++) { if (*oldsrc == '\n' || *oldsrc == '\r') *oldsrc = ' '; } lm->msg = c_format_cstring("%z%s", prefix ? prefix : (UINT8 *) "", left, src); -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

6 11

Re: [syslog-ng]compile problem HAVE_RES_INIT
by BONIKOWSKE, SCOTT 31 Oct '02

31 Oct '02

--- Received from WPS.SBONIKOW (608) 226-2630 10-31-02 953a If I remember correctly, doesn't libol installation still require an ldconfig after it is installed? Thanks Scott ****************************************************************************** From: xyf(a)nixnotes.org To: syslog-ng(a)lists.balabit.hu Date: Thu, 31 Oct 2002 08:47:15 -0600 Subject: Re: [syslog-ng]compile problem HAVE_RES_INIT On Thu, Oct 31, 2002 at 09:36:23AM -0500, Hamilton, Andrew wrote: > All these includes are part of the libol package. For some reason it is not > finding them. OK even though I installed libol-0.3.5 ./configure couldn't seem to find it so I ran "./configure --with-libol=/path/to/libol" and everything is happy:) Thanks so much for your help. kent -- To know the truth is to distort the Universe. Alfred N. Whitehead (adaptation) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ---- 10-31-02 953a ---- Sent to --------------------------------------- -> syslog-ng(a)lists.balabit.hu -> xyf(a)nixnotes.org

1 0

RE: [syslog-ng]compile problem HAVE_RES_INIT
by Hamilton, Andrew 31 Oct '02

31 Oct '02

All these includes are part of the libol package. For some reason it is not finding them. -----Original Message----- From: ktb [mailto:xyf@nixnotes.org] Sent: Thursday, October 31, 2002 9:28 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]compile problem HAVE_RES_INIT On Thu, Oct 31, 2002 at 09:04:58AM -0500, Hamilton, Andrew wrote: > Try this: > > FWIW the following patch seems to have fixed it: > > --- syslog-ng-1.5.23/acconfig.h.orig Wed Apr 3 12:37:02 2002 > +++ syslog-ng-1.5.23/acconfig.h Tue Oct 29 17:00:12 2002 > @@ -40,4 +40,5 @@ > #undef PATH_SYSCONFDIR > > #undef ENABLE_TCP_WRAPPER > - > \ No newline at end of file > + > +#undef HAVE_RES_INIT > > Drew I'm not a programmer so wasn't completely sure how to implement this but assumed the "-" meant to take those lines out of acconfig.h and the "+" meant to add "#undef HAVE_RES_INIT" to the file in question. I ended up with the errors below - make[3]: Entering directory `/usr/local/src/syslog-ng-1.5.23/src' gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.23/src -I. -g -O2 -Wall -D_G NU_SOURCE -c main.c In file included from main.c:26: syslog-ng.h:31: objects.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:30: read_line.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:30: io.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:33: list.h: No such file or directory main.c:29: format.h: No such file or directory main.c:30: werror.h: No such file or directory main.c:31: queue.h: No such file or directory main.c:32: pkt_buffer.h: No such file or directory make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/usr/local/src/syslog-ng-1.5.23/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng-1.5.23/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/local/src/syslog-ng-1.5.23/src' make: *** [all-recursive] Error 1 Thanks for the quick respons:) kent -- To know the truth is to distort the Universe. Alfred N. Whitehead (adaptation) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng]compile problem HAVE_RES_INIT
by Hamilton, Andrew 31 Oct '02

31 Oct '02

Ok. Where is libol? Did you install it or tell it where it is? -----Original Message----- From: ktb [mailto:xyf@nixnotes.org] Sent: Thursday, October 31, 2002 9:35 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]compile problem HAVE_RES_INIT On Thu, Oct 31, 2002 at 09:33:38AM -0500, Hamilton, Andrew wrote: > After the patch did you rerun configure? > Ya, I did a "make clean && ./configure && make" kent -- To know the truth is to distort the Universe. Alfred N. Whitehead (adaptation) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]compile problem HAVE_RES_INIT
by Hamilton, Andrew 31 Oct '02

31 Oct '02

After the patch did you rerun configure? -----Original Message----- From: ktb [mailto:xyf@nixnotes.org] Sent: Thursday, October 31, 2002 9:28 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]compile problem HAVE_RES_INIT On Thu, Oct 31, 2002 at 09:04:58AM -0500, Hamilton, Andrew wrote: > Try this: > > FWIW the following patch seems to have fixed it: > > --- syslog-ng-1.5.23/acconfig.h.orig Wed Apr 3 12:37:02 2002 > +++ syslog-ng-1.5.23/acconfig.h Tue Oct 29 17:00:12 2002 > @@ -40,4 +40,5 @@ > #undef PATH_SYSCONFDIR > > #undef ENABLE_TCP_WRAPPER > - > \ No newline at end of file > + > +#undef HAVE_RES_INIT > > Drew I'm not a programmer so wasn't completely sure how to implement this but assumed the "-" meant to take those lines out of acconfig.h and the "+" meant to add "#undef HAVE_RES_INIT" to the file in question. I ended up with the errors below - make[3]: Entering directory `/usr/local/src/syslog-ng-1.5.23/src' gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.23/src -I. -g -O2 -Wall -D_G NU_SOURCE -c main.c In file included from main.c:26: syslog-ng.h:31: objects.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:30: read_line.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:30: io.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:33: list.h: No such file or directory main.c:29: format.h: No such file or directory main.c:30: werror.h: No such file or directory main.c:31: queue.h: No such file or directory main.c:32: pkt_buffer.h: No such file or directory make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/usr/local/src/syslog-ng-1.5.23/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng-1.5.23/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/local/src/syslog-ng-1.5.23/src' make: *** [all-recursive] Error 1 Thanks for the quick respons:) kent -- To know the truth is to distort the Universe. Alfred N. Whitehead (adaptation) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng]compile problem HAVE_RES_INIT
by Hamilton, Andrew 31 Oct '02

31 Oct '02

Try this: FWIW the following patch seems to have fixed it: --- syslog-ng-1.5.23/acconfig.h.orig Wed Apr 3 12:37:02 2002 +++ syslog-ng-1.5.23/acconfig.h Tue Oct 29 17:00:12 2002 @@ -40,4 +40,5 @@ #undef PATH_SYSCONFDIR #undef ENABLE_TCP_WRAPPER - \ No newline at end of file + +#undef HAVE_RES_INIT Drew -----Original Message----- From: ktb [mailto:xyf@nixnotes.org] Sent: Thursday, October 31, 2002 8:57 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]compile problem HAVE_RES_INIT I'm trying to compile syslog-ng-1.5.23 on a RedHat 6.0 machine. When I run "make" I get the following error - make[1]: Entering directory `/usr/local/src/syslog-ng-1.5.23/src' cd /usr/local/src/syslog-ng-1.5.23 && autoheader /usr/bin/autoheader: Symbol `HAVE_RES_INIT' is not covered by /usr/share/autoconf/acconfig.h ./acconfig.h make[1]: *** [/usr/local/src/syslog-ng-1.5.23/src/stamp-h.in] Error 1 make[1]: Leaving directory `/usr/local/src/syslog-ng-1.5.23/src' make: *** [all-recursive] Error 1 Anyone know how I can get around this error? Thanks, kent -- To know the truth is to distort the Universe. Alfred N. Whitehead (adaptation) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

compile problem HAVE_RES_INIT
by ktb 31 Oct '02

31 Oct '02

I'm trying to compile syslog-ng-1.5.23 on a RedHat 6.0 machine. When I run "make" I get the following error - make[1]: Entering directory `/usr/local/src/syslog-ng-1.5.23/src' cd /usr/local/src/syslog-ng-1.5.23 && autoheader /usr/bin/autoheader: Symbol `HAVE_RES_INIT' is not covered by /usr/share/autoconf/acconfig.h ./acconfig.h make[1]: *** [/usr/local/src/syslog-ng-1.5.23/src/stamp-h.in] Error 1 make[1]: Leaving directory `/usr/local/src/syslog-ng-1.5.23/src' make: *** [all-recursive] Error 1 Anyone know how I can get around this error? Thanks, kent -- To know the truth is to distort the Universe. Alfred N. Whitehead (adaptation)

1 0

Re: [syslog-ng]Syslog forwarding - PIXos...
by Ted_Rule＠flextech.co.uk 31 Oct '02

31 Oct '02

If you're playing with PIXies... please beware all my previous findings on this mailing list regarding the current stupidity of PIXos syslog implementation... Namely a 256 byte message limit, a total lack of properly defined message boundaries on PIX syslog over TCP, and Cisco's complete unwillingness to fix such glaring oversights. Ted *********************************************************************************** This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. *************************************************************************************************

1 0

RE: [syslog-ng]Syslog forwarding
by Hamilton, Andrew 31 Oct '02

31 Oct '02

Fernando, I did the very same thing you are doing for several years. syslog-ng is perfect for that in that it will allow you to configure both ways. It will spoof the name or it will leave the name. By setting various options you can get a combination of the two even. Look at keep_hostname(yes) this tells syslog-ng to keep the hostname it got from the message, use_fqdn(yes), fqdn is important if you have multiple domains with the same hostname in different domains such as ns1. Also chain_hostnames(no), syslog-ng will chain the hostnames together if you don't turn this off. For CiscoWorks you want to turn this off. Realize also that if you have a central loghost that is different from the CiscoWorks machine you must also run syslog-ng on that host as well. Regards, Drew -----Original Message----- From: Fernando Cardoso [mailto:fernando.cardoso@whatevernet.com] Sent: Wednesday, October 30, 2002 3:32 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Syslog forwarding Hi all I'm designing a solution where I need to forward syslog messages to 2 different servers (Cisco Works and a log correlation system). The messages will be sent from Cisco routers and PIXes to a box running syslog-ng that will forward the messages to the servers according to the facility and levels defined on filters. My question regards the origin of the messages as they will be seen by the end servers. Since both Cisco Works and the log correlation engine rely on the source IP to acknowledge and trigger alarms, will they see the syslog-ng box IP or the original IP address of the routers and PIXes? In other words will syslog-ng spoof the source IP addresses when forwarding the messages? Thanks in advance Fernando _____________________________________________________________________ INTERNET MAIL FOOTER A presente mensagem pode conter informação considerada confidencial. Se o receptor desta mensagem não for o destinatário indicado, fica expressamente proibido de copiar ou endereçar a mensagem a terceiros. Em tal situação, o receptor deverá destruir a presente mensagem e por gentileza informar o emissor de tal facto. --------------------------------------------------------------------- Privileged or confidential information may be contained in this message. If you are not the addressee indicated in this message, you may not copy or deliver this message to anyone. In such case, you should destroy this message and kindly notify the sender by reply email. --------------------------------------------------------------------- _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1