December 2007 - syslog-ng - lists.balabit.hu

Can TAG field be terminated by space?
by Tsurusawa Takeshi 31 Dec '07

31 Dec '07

Hi, I'm using syslog-ng-2.0.5 and trying to store syslog messages into a DB table with a TAG field column. But when TAG fileld is terminated with space character(' ') in syslog message, syslog-ng parser returns as TAG field not only TAG field but also some extra strings end with a colon(':') in CONTENT field. For example, if MSG part is "program abc: message...", syslog-ng returns "program abc" as a TAG field. According to the section 4.1.3 of RFC3164, a space character can also terminate a TAG field. The TAG is a string of ABNF alphanumeric characters that MUST NOT exceed 32 characters. Any non-alphanumeric character will terminate the TAG field and will be assumed to be the starting character of the CONTENT field. Most commonly, the first character of the CONTENT field that signifies the conclusion of the TAG field has been seen to be the left square bracket character ("["), a colon character (":"), or a space character. Is it possible to change this behavior of syslog-ng? Thanks in advance. -- Tsurusawa Takeshi <tsuru(a)grid.nii.ac.jp>

3 6

[Bug 15] New: 2.0.6 is not compatible with previous version's config file
by bugzilla＠bugzilla.balabit.com 30 Dec '07

30 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=15 Summary: 2.0.6 is not compatible with previous version's config file Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: welz(a)fixe-post.de Type of the Report: bug Estimated Hours: 0.0 filter f_mail_count_incoming { program("postfix/smtp") and match("to=") and (match("@mydomain.de") or match("@MYDOMAIN.DE")) and not match("systemmeldung") and match("status=sent"); }; doesn't work since I upgraded from previos version (gentoo linux) However, when I change program("postfix/smtp") to program("postfix") it seems to work, but I have lots of rules and lots of computers, although you would say 12 is not much ;), and I wish to express that it would be absolutely helpful, if syntax changes could be mentioned in the changelog. Regards, Robert -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

Run 2 syslog-ng by defferent configurations
by Takenaka Kazuhiro 28 Dec '07

28 Dec '07

Hi all. I would like to run 2 syslog-ng instances in the same server and tried it, but encounterd a problem. I have some questions, please advise me something you know about this. Firstly, I run a syslog-ng 1.6.8 instance on Redhat EL4 update 5 by a install default configuration file. And then I run the other instance by the following configuration: ------------------------------------------------------------ source s_udp_9000 { udp(port(9000)); }; filter f_host_XXX { host ("[xX][xX][xX]11|172\.20\.100\.100"); }; destination d_udp_messages_XXX { file("/dbf/heartbeat/XXX.log" create_dirs(yes) perm(0640)); }; log { source(s_udp_9000); filter(f_host_XXX); destination(d_udp_messages_XXX); }; ------------------------------------------------------------ The operations proceeded as the following. # service syslog-ng start Starting system logger: [ OK ] # syslog-ng -p /var/run/syslog-ng-vip.pid -f syslog-ng-vip.conf Warning: No source refers to internal messages, they'll go to /dev/null My first question is : 1. Does syslog-ng 1.6.8 always handle internal messages ? I suspict it will cause odd behaviors on logging internal messages when multiple syslog-ng instances run on a server. Or are there some effective configurations to avoid this ? Next, I updated the version of syslog-ng to 2.0.4 and played same operations. No warnings were shown on the terminal. My second question is : 2. Can syslog-ng 2.0.4 ignore internal messages if the configurations specify that it shuld run so ? I think it means run multiple instances can run on a server safely. Or do some problems hide behind the silence ? =========================================================== I'd better to explain what makes me try such configurations I mentioned to help readers understand my demand. I plan to sent my servers' logs to a central syslog-ng server. To make my syslog-ng server a high avalable one, I decided to use Heartbeat as a HA manager to make a ACT/SBY syslog-ng cluster. I also decided to use shared disks so as to save external logs into them and make external log files be taken over on a failover by them. On the other hand, I intend to save central server's own logs into server's internal disks. I think it would be better to run 2 syslog-ng instances and assign one to handle internal logs and the other to handle external logs. The internal one shuld be managed by a rc script and the external should be managed by Heartbeat. The reason I think this way, or the reason I avoid handling all messages by one instance, is the following. Hearteat alway performs a stop operation on eash resources that Hearteat just attempt to failover. If Heartbeat manages the syslog-ng instance which handles all logs, and a failover is triggered by some reason except syslog-ng's own corruption, Heartbeat brings a stop to the syslog-ng instance. This means internal logging must stop in the very time some troubles occurs. It obviously is unpreferable. =========================================================== Sincerely. -- Takenaka Kazuhiro <takenaka.kazuhiro(a)oss.ntt.co.jp> NTT OSS Center

2 3

Solaris 9/SPARC patch for 2.0.6 (tests/unit/test_dnscache.c)
by Albert Chin 27 Dec '07

27 Dec '07

Solaris 9/SPARC needs sys/socket.h for AF_INET. Patch for tests/unit/test_dnscache.c attached. -- albert chin (china(a)thewrittenword.com)

2 1

[Bug 5] New: syslog-ng crashes when using fallback flag
by bugzilla＠bugzilla.balabit.com 27 Dec '07

27 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=5 Summary: syslog-ng crashes when using fallback flag Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: srainville(a)videotron.ca Type of the Report: --- Estimated Hours: 0.0 Tested on RHEL ES 4u5 32bit. Attached conf file. Used Nessus to scan system with all plugins enabled (even dangerous ones). Process quits but pid still exists. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

[Bug 9] New: syslog-ng crashes when /etc/eventlog.conf exists
by bugzilla＠bugzilla.balabit.com 27 Dec '07

27 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=9 Summary: syslog-ng crashes when /etc/eventlog.conf exists Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=447105 OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: bug Estimated Hours: 0.0 >From bugs.debian.org: When /etc/eventlog.conf exists and contains "[hello]" (for example), syslog-ng segfaults at start. Here is the end of strace output: uname({sys="Linux", node="naruto", ...}) = 0 brk(0) = 0x8088000 brk(0x80a9000) = 0x80a9000 open("/etc/localtime", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 fstat64(3, {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f7c000 read(3, "TZif\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\0\0\0\f\0"..., 4096) = 1082 close(3) = 0 munmap(0xb7f7c000, 4096) = 0 rt_sigaction(SIGPIPE, {SIG_IGN}, NULL, 8) = 0 rt_sigaction(SIGHUP, {0x804aae0, [], 0}, NULL, 8) = 0 rt_sigaction(SIGTERM, {0x804aaf0, [], 0}, NULL, 8) = 0 rt_sigaction(SIGINT, {0x804aaf0, [], 0}, NULL, 8) = 0 rt_sigaction(SIGCHLD, {0x804ab00, [], 0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {0x804ab10, [], SA_ONESHOT}, NULL, 8) = 0 gettimeofday({1192688001, 803861}, NULL) = 0 open("/etc/eventlog.conf", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=8, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f7c000 read(3, "[hello]\n", 4096) = 8 --- SIGSEGV (Segmentation fault) @ 0 (0) --- kill(12421, SIGSEGV) = 0 sigreturn() = ? (mask now []) --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ Process 12421 detached I did not find any documentation about /etc/eventlog.conf file. I have found this bug because such file was created by an unrelated application. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

[Bug 1] New: syslog-ng crashes when /etc/eventlog.conf exists
by bugzilla＠bugzilla.balabit.com 27 Dec '07

27 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=1 Summary: syslog-ng crashes when /etc/eventlog.conf exists Product: syslog-ng Version: 2.1.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bazsi(a)balabit.hu Estimated Hours: 0.0 Hi ! When /etc/eventlog.conf exists and contains "[hello]" (for example), syslog-ng segfaults at start. Here is the end of strace output: uname({sys="Linux", node="naruto", ...}) = 0 brk(0) = 0x8088000 brk(0x80a9000) = 0x80a9000 open("/etc/localtime", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 fstat64(3, {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f7c000 read(3, "TZif\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\0\0\0\f\0"..., 4096) = 1082 close(3) = 0 munmap(0xb7f7c000, 4096) = 0 rt_sigaction(SIGPIPE, {SIG_IGN}, NULL, 8) = 0 rt_sigaction(SIGHUP, {0x804aae0, [], 0}, NULL, 8) = 0 rt_sigaction(SIGTERM, {0x804aaf0, [], 0}, NULL, 8) = 0 rt_sigaction(SIGINT, {0x804aaf0, [], 0}, NULL, 8) = 0 rt_sigaction(SIGCHLD, {0x804ab00, [], 0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {0x804ab10, [], SA_ONESHOT}, NULL, 8) = 0 gettimeofday({1192688001, 803861}, NULL) = 0 open("/etc/eventlog.conf", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=8, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f7c000 read(3, "[hello]\n", 4096) = 8 --- SIGSEGV (Segmentation fault) @ 0 (0) --- kill(12421, SIGSEGV) = 0 sigreturn() = ? (mask now []) --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ Process 12421 detached I did not find any documentation about /etc/eventlog.conf file. I have found this bug because such file was created by an unrelated application. -- System Information: Debian Release: lenny/sid APT prefers unstable APT policy: (500, 'unstable'), (500, 'stable'), (1, 'experimental') Architecture: i386 (i686) Kernel: Linux 2.6.22-2-686-bigmem (SMP w/2 CPU cores) Locale: LANG=fr_FR@euro, LC_CTYPE=fr_FR@euro (charmap=ISO-8859-15) Shell: /bin/sh linked to /bin/bash Versions of packages syslog-ng depends on: ii libc6 2.6.1-5 GNU C Library: Shared libraries Versions of packages syslog-ng recommends: ii logrotate 3.7.1-3 Log rotation utility -- no debconf information -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 10] New: Option mark() not working
by bugzilla＠bugzilla.balabit.com 27 Dec '07

27 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=10 Summary: Option mark() not working Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=425018 OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: bug Estimated Hours: 0.0 >From bugs.debian.org: syslog-ng.conf(5) states that mark(n) is not implemented yet but mark-lines are printed to syslog. mark(0) should disable that but gives an error during syntax-check. If one writes mark_freq() to config it works. So, at least the manpage should be updated. Second quirk: mark_freq(0) does not disable printing of mark-lines, instead it really floods the syslog with mark-lines. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 8] New: syslog-ng hangs writing to /dev/ttyN
by bugzilla＠bugzilla.balabit.com 27 Dec '07

27 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=8 Summary: syslog-ng hangs writing to /dev/ttyN Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=397650 OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=4) --> (https://bugzilla.balabit.com/attachment.cgi?id=4) Patch to prevent hanging >From bugs.debian.org: (This is the same problem reported against syslog-ng in Gentoo at https://bugs.gentoo.org/show_bug.cgi?id=154465 -- this contains a patch which fixes the problem with a similar approach to that taken in sysklogd.) When syslog-ng writes to a tty under Linux, for example as a result of a usertty directive, the write syscall to /dev/ttyN can ocassionally block indefinitely. One situation when this occurs is when the user has set XOFF (perhaps with Ctrl-S or Scroll Lock). Aside from the fact that this obvious prevents any further log messages from being written, /dev/log's buffer eventually fills up causing other programs to block writing to /dev/log. In extremis, this can render a machine inaccesible when ssh, etc., all block preventing access. Reproducible: Always Steps to Reproduce: 1. Check that there is a usertty("*") directive for (say) kern.emerg logs 2. Ensure syslog-ng is running 3. On console, press Scroll Lock 4. Log something, e.g. logger -p kern.emerg 'Foo'. 5. Repeat #4 many times; eventually it will hang trying to log -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 7] New: Syslog-ng doesn' t send to *any* remote host when one of them isn't reachable
by bugzilla＠bugzilla.balabit.com 27 Dec '07

27 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=7 Summary: Syslog-ng doesn't send to *any* remote host when one of them isn't reachable Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=452249 OS/Version: Linux Status: NEW Severity: critical Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: bug Estimated Hours: 0.0 >From bugs.debian.org: Hi, I'm using syslog-ng to have a bunch of webservers log to remote syslog-servers. I have defined them on the webservers like this; destination remote_logging { tcp("10.10.10.1" port(1999)); }; destination remote_logging { tcp("10.10.10.2" port(1999)); }; Which works fine as long as both the remote servers are reachable. The moment one of them is unreachable, syslog-ng starts complaining about it in the logging: Nov 21 11:46:34 web01 syslog-ng[9892]: Connection broken to AF_INET(10.10.10.2:1999), reopening in 10 seconds But at this moment it doesn't log to the other remote syslog-ng server either, which makes the setup useless. I could not find a configuration-feature to prevent this from happening, am I overlooking something? thanks a lot, Roel. -- System Information: Debian Release: 3.1 Architecture: i386 (i686) Kernel: Linux 2.6.17-mp20070417 Locale: LANG=en_US, LC_CTYPE=en_US (charmap=ISO-8859-1) Versions of packages syslog-ng depends on: ii libc6 2.3.2.ds1-22sarge5 GNU C Library: Shared libraries an ii util-linux 2.12p-4sarge1 Miscellaneous system utilities -- no debconf information -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1