December 2007 - syslog-ng - lists.balabit.hu

Lost messages
by Andrew Séguin 21 Dec '07

21 Dec '07

Hello, I'm sorry if I'm missing something obvious, admittedly I've only had the chance to quickly search through the manuals and mailing list and not read them as deep as I'd like to, yet. I'm working in a project where we were considering replacing syslog to take advantage of reliable transmission over tcp. Performance is a factor for us, so we wrote a short program that simply loops and logs a counter and time stamp (to avoid "last message repeated x messages"). We ran it with syslog (saving locally to a file, and then sending remotely to another station which is logging to file) and got some reference numbers for the hardware/OS (Solaris 10). We then started the same test with syslog-ng. Performance didn't get to be an issue: under the pressure of the performance test, only some 5-600,000 lines are logged although 1,000,000 were sent! We tried a few tweaks to the configuration file for buffering (see below), but it hasn't helped unfortunately. Is there a way to avoid this problem? Will we encounter this same problem on the remote host (considering the remote/logging host is planned to be accepting messages from two servers with a lot of traffic) Thanks for any tips/info! Andrew Seguin ps: here is the configuration file we have used... # # Syslog-ng example configuration file for Solaris # # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.solaris,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Solaris 2.5.1 and below uses the STREAMS driver, above extends it # with doors. For 2.5.1 remove the door() option from the source declaration. # options { sync (0); log_fifo_size (65535); gc_idle_threshold(30); gc_busy_threshold(3000); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination all { file("/tmp/messages-ng" log_fifo_size(60000)); }; filter filter_local6 { facility(local6); }; log { source(local); filter(filter_local6); destination(all); };

2 3

Using syslog-ng as a relay inject unexpected data
by Allen Bettilyon 21 Dec '07

21 Dec '07

Hello, I'm doing some pretty basic syslog forwarding using syslog-ng 1.6.2. Essentially, I've got the following: destination remoteHost { tcp("1.1.1.1 port 9999"); }; The forwarding is working correctly, however on the remote side all my log lines are prepended with a <number> tag. For example: Some log line turns into: <38>Some log line I've tried creating a custom template, but the <number> is always added to the log lines when the arrive at the remote host. Why is this happening and is there a way to turn it off? Thanks, - Allen Bettilyon

3 5

[Bug 4] New: Year not being parsed
by bugzilla＠bugzilla.balabit.com 20 Dec '07

20 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=4 Summary: Year not being parsed Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: justin.mr.smith(a)gmail.com Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=1) --> (https://bugzilla.balabit.com/attachment.cgi?id=1) Packet capture of logs being sent to server There seems to be an issue with the parsing of the logs being sent to syslog-ng server in a way that it is unable to parse out the year out of the udp packet being sent to it. After taking a packet capture of the log being sent yes indeed the year is in the packet. Configs: Ubuntu 7.10 - Syslog-ng 2.0.0 & 2.0.6 Sender: Linksys RV042,RV082 routers Packet Capture: Message: Dec 12 11:49:14 2007 RV042 RGFW-IN: BLOCK-RULES (TCP 69.xxx.xxx.xxx:1639->69.xxx.xxx.xxx:1433 on ixp1) [0,0] -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 7

Compilation Woes - RHEL 5 cont.
by Chuck 20 Dec '07

20 Dec '07

I decided to install the eventlog libs into the default location (prefix = /usr/local) and syslog-ng still won't find these libraries. Anyone get this compiled and installed on rhel 5 32-bit? -Chuck

4 5

Re: [syslog-ng] Compilation Woes - RHEL 5 cont.
by andy 20 Dec '07

20 Dec '07

Chuck wrote: > Cool thanks. I was able to install those w/o problems.. > Thanks, > CC > > On Dec 20, 2007 7:40 AM, andy <andy(a)zrmt.com> wrote: > >> Chuck wrote: >> >>> Nah, where did you find them? I must have overlooked them. >>> >>> -Chuck >>> >>> >>> On Dec 20, 2007 7:29 AM, andy <andy(a)zrmt.com> wrote: >>> >>> >>>> Chuck wrote: >>>> >>>> >>>>> I decided to install the eventlog libs into the default location >>>>> (prefix = /usr/local) and syslog-ng still won't find these libraries. >>>>> >>>>> Anyone get this compiled and installed on rhel 5 32-bit? >>>>> >>>>> -Chuck >>>>> _______________________________________________ >>>>> syslog-ng maillist - syslog-ng(a)lists.balabit.hu >>>>> https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>>> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >>>>> >>>>> >>>>> >>>>> >>>> Chuck, >>>> >>>> I just found the syslog-ng and eventlog rpms and installed them. Is >>>> there a reason why you need to compile? >>>> >>>> Regards, >>>> >>>> Andy >>>> >>>> >>>> >> I've put them up at http://andy.zrmt.com. >> >> I can't remember where I originally got them.. but I'll update them as >> necessary.. >> >> Regards, >> >> Andy >> >> No problems. Andy

1 0

Compilation Woes on RHEL 5
by Chuck 20 Dec '07

20 Dec '07

I am trying to build syslog-ng 2.0.6 with eventlog installed into /usr/local/eventlog-0.2.5/. configure is complaining it can't find eventlog or pkg-config: checking for GLIB... yes checking for EVTLOG... no configure: error: Cannot find eventlog version >= 0.2: is pkg-config in path? charger:/usr/local/src/syslog-ng-2.0.6 #which pkg-config I have tried adding the /usr/local/eventlog-0.2.5/lib path to /etc/ld.so.conf (and reconfiguring ld). charger:/usr/local/src/syslog-ng-2.0.6 #ldconfig -p | grep eventlog libevtlog.so.0 (libc6) => /usr/local/eventlog-0.2.5/lib/libevtlog.so.0 libevtlog.so (libc6) => /usr/local/eventlog-0.2.5/lib/libevtlog.so I have tried defining this in LD_LIBRARY_PATH. I have also tried explicitly setting LDFLAGS (for the libs) and CPPFLAGS (for the includes) in the environment I'n running configure from. I am unable to get configure to find these libraries. It also complains it can't find pkg-config, however this pkg-config is under /usr/bin and the shell I'm running this from has no problems findind it: charger:/usr/local/src/syslog-ng-2.0.6 #which pkg-config /usr/bin/pkg-config charger:/usr/local/src/syslog-ng-2.0.6 #pkg-config --version 0.21 I don't want to install the eventlog libraries directly under /lib or /usr/local/lib. Is there any way to do this? Thanks for any help, CC

1 0

Solaris 10: Insufficient buffer space for retrieving STREAMS log message
by AndyH＠nominet.org.uk 18 Dec '07

18 Dec '07

Hi, I'm running the latest version compiled on Solaris 10 It runs ok for a while but then I get this: syslog-ng[18894]: Insufficient buffer space for retrieving STREAMS log message; res='2' and then nothing new logs apart from the "-- MARK --" lines I've seen a couple of references to this problem here https://lists.balabit.hu/pipermail/syslog-ng/2007-September/010690.html but the patches mentioned are all now in the downloaded src. Is there any other reason for this behaviour? Regards Andy

2 3

Getting "--MARK--" in the generated logs----Please REPLY soon
by ROHIT SAXENA 17 Dec '07

17 Dec '07

Hi All, Since last three days I m getting the logs as follows: Dec 17 02:37:35 src@inoc-cabin3-17 -- MARK -- Dec 17 02:57:35 src@inoc-cabin3-17 -- MARK -- Dec 17 03:17:35 src@inoc-cabin3-17 -- MARK -- Dec 17 03:37:35 src@inoc-cabin3-17 -- MARK -- Dec 17 03:57:35 src@inoc-cabin3-17 -- MARK -- Dec 17 04:17:35 src@inoc-cabin3-17 -- MARK -- Dec 17 04:37:35 src@inoc-cabin3-17 -- MARK -- Dec 17 04:57:35 src@inoc-cabin3-17 -- MARK -- Dec 17 05:17:35 src@inoc-cabin3-17 -- MARK -- Dec 17 05:37:35 src@inoc-cabin3-17 -- MARK -- Can any one please let me know the reasons why this is happening????? I m attaching the file syslog-ng.conf configuration file.....Please check it and inform me.... "Faliure is not getting knocked down, it's not getting up again" --------------------------------- 5, 50, 500, 5000 - Store N number of mails in your inbox. Click here.

2 1

Cisco Catalyst switches
by Charles Mattair 17 Dec '07

17 Dec '07

We've recently started getting traffic from catalyst switches and it doesn't parse well. The start of a message looks like: 445750: Dec 14 11:23:27: %SW_MATM-4-MACFLAP_NOTIF: Host 0201.0000.0000 in v... The event id (445750) looks like a program id (the parser sees everything else as missing) and the date becomes part of the message text. Are there any plans to "teach" the parser to recognize this format? We noticed it recognizes PIX formats with a colon following the date so it doesn't seem too out of line. If there aren't, we'll generate mods and submit them. tnx

3 2

ZSA-2007-029: syslog-ng Denial of Service
by Balazs Scheidler 17 Dec '07

17 Dec '07

-------- Z o r p S e c u r i t y A d v i s o r y ( Z S A ) ------------ PACKAGE : syslog-ng, syslog-ng-premium-edition AFFECTED VERSION : <= 2.0.6, 2.1.8 FIXED : 2.0.6, 2.1.8 SUMMARY : Denial of Service TYPE : remote AFFECTED : all platforms ZSA-ID : ZSA-2007-029 DATE : Dec 14, 2007 ----------------------------------------------------------------------------- DESCRIPTION: Oriol Carreras has discovered a security vulnerability in syslog-ng, the multi-platform syslog-replacement application developed by BalaBit IT Security. BACKGROUND: Earlier versions of syslog-ng Open Source Edition and syslog-ng Premium Edition were vulnerable to a possible Denial of Service. The latest release (2.0.6 for syslog-ng, 2.1.8 for syslog-ng Premium Edition) fixes a segmentation fault which occurred when the timestamp of the incoming messages did not end with a space character (NULL pointer dereference). This is an easy Denial of Service possibility. Apart from the Denial of Service, no further exploits are known to be possible. FURTHER INFORMATION For further information on syslog-ng, visit http://www.balabit.com/network-security/syslog-ng/ or download the documentation of syslog-ng from http://www.balabit.com/support/documentation/ SOLUTION: We recommend that you update the affected packages immediately, or apply the patch referenced below: http://git.balabit.hu/?p=bazsi/syslog-ng-2.0.git;a=commitdiff;h=3126ebad217… DOWNLOAD: If you are a syslog-ng Open Source Edition user, download the source of the latest release from: http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/ If you are a syslog-ng Premium Edition user, or have binary subscription for syslog-ng Open Source Edition, download the latest binaries from: http://www.balabit.com/downloads/files/syslog-ng/binaries/premium-edition/ OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ debian-etch/syslog-ng-2.1 syslog-ng-pe RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ rhel-4/syslog-ng-2.1 syslog-ng-pe SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ suse-10.0/syslog-ng-2.1 syslog-ng-pe SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ suse-10.1/syslog-ng-2.1 syslog-ng-pe HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted.

1 1