January 2008 - syslog-ng - lists.balabit.hu

syslog-ng 2.0.8 has been released
by devel＠balabit.hu 04 Feb '08

04 Feb '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.0.8 SUMMARY : new stable release DATE : Jan 31, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.0.8) has been released. For latest fixes in the 2.0.x branch you are recommended to upgrade to this version. CHANGES: 2.0.8 Thu, 31 Jan 2008 12:38:21 +0100 Bugfixes: * Fixed a regression in 2.0.7 that caused destination files not to be reopened when syslog-ng was reloaded. This causes potential problems with log rotation. * Fixed DNS cache size checking, persistent DNS cache entries were also counted against dns_cache_size() which might decrease cache space significantly when a large /etc/hosts file is in use. * Fixed a bug that caused the persistent DNS cache (e.g. /etc/hosts) to be reloaded for all name resolution requests. Other changes: * Fixed sample configuration file for RedHat. * Some portability changes in loggen. * Added cygwin packaging files to contrib/cygwin-packaging. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.0 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.0 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.0 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.0 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.0 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/

3 2

syslog-ng OSE 2.1alpha1
by Balazs Scheidler 31 Jan '08

31 Jan '08

Hi, As posted on my blog, I've released syslog-ng OSE 2.1alpha1, the first GPLd release that features native syslog-to-SQL capability. You can download the source code for OSE 2.1 from: http://www.balabit.com/downloads/files/syslog-ng/sources/2.1/src/ You'll need a patched libdbi/libdbi-drivers package also available at the download location and you have accessibility for all SQL servers that have an driver in libdbi. We've successfully tested MySQL, PostgreSQL, SQLite and Oracle, others will probably work, but are untested. The code in this "alpha" release has already been tested in the context of the commercial syslog-ng product, so I don't expect too much problems once it builds and starts. The configure script and the Makefiles might still have some surprises though. To configure the SQL destination, please read the current Administrator's Guide for syslog-ng, the chapter on SQL is here: http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/ch08s02.html#r… -- Bazsi

1 0

Win syslog-agent PRI
by Tiago Gomes da Silva Mendo 31 Jan '08

31 Jan '08

>On Mon, 2008-01-28 at 11:05 +0000, Tiago Gomes da Silva Mendo wrote: >> Hi, >> >> >> >> I have syslog-ng-premium-edition (2.1.8) on an Debian etch and >> multiple linuxs sending syslog messages to this server, using >> diferents PRIs. >> >> The problem is with the windows agent (2.1.4). In the windows agent I >> have an message format like this: "<182>$DATE $HOST $EVENT_SOURCE: >> $MSG", but at the server the received PRI is not 182. >> >> At the server I get messages with the correct PRI when the syslog-ng >> agent is restarted: >> >> >> >> "Jan 28 10:57:41 10.176.25.108 LogRelay: Application started", with >> local6 and info, but every message I send through syslog-ng agent >> arrives at the server with user/notice (PRI 13). > >Are you reading messages from files or you are sending out the EventLog >records? > >If my assumption is true, then the difference between the LogRelay entry >and the other messages is that the LogRelay entry is coming from the >EventLog, and the others come from files, right? > >I ask my collegue to look into this. > >-- >Bazsi You are rigth. The messages from the eventlog containers are getting to the server with the right PRI, but the ones from the files don't. Thanks

5 11

[Bug 6] New: syslog-ng dies after cron.daily
by bugzilla＠bugzilla.balabit.com 31 Jan '08

31 Jan '08

https://bugzilla.balabit.com/show_bug.cgi?id=6 Summary: syslog-ng dies after cron.daily Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=427791 OS/Version: Linux Status: NEW Severity: critical Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: bug Estimated Hours: 0.0 >From bugs.debian.org: Syslog-ng is dying repeatedly after logrotate runs. I believe that in most cases it continues to log to the original file, despite it having been rotated, though I am not 100% sure of this. Where it does continue running, it dies when the 2nd rotate occurs, where the logfile is gzipped. When trying to reproduce it manually, sending kill -HUP causes syslog-ng to die shortly after it gets a new PID. I am able to consistently reproduce this. No data is written to the new logfile until I manually restart syslog-ng For now, as a workaround, I have altered the post-rotate command to restart syslog-ng rather than reload. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

syslog-ng dnscache.c patch
by Steven McDougall 30 Jan '08

30 Jan '08

We enabled dns caching with a configuration like dns_cache_hosts(/etc/hosts), and found that syslog-ng was re-reading the hosts file every time it needed to resolve a host name. This patch fixed it. diff -ru syslog-ng-2.0.6/src/dnscache.c syslog-ng-2.0.6-patch/src/dnscache.c --- syslog-ng-2.0.6/src/dnscache.c 2007-04-19 15:37:16.000000000 -0400 +++ syslog-ng-2.0.6-patch/src/dnscache.c 2008-01-26 19:45:31.000000000 -0500 @@ -168,7 +168,9 @@ if (hosts) { gchar buf[4096]; - + + dns_cache_hosts_mtime = st.st_mtime; + while (fgets(buf, sizeof(buf), hosts)) { gchar *p, *ip;

2 1

preparing for 2.0.8
by Balazs Scheidler 28 Jan '08

28 Jan '08

Hi, I'm preparing a 2.0.8 release, but I'd like to avoid past mistakes with recent releases, thus I'd be very grateful if some of you could test the current snapshot. There are two patches that I haven't received real feedback yet, the others are so trivial that I doubt they'd cause problems. The candidates that should be tested are below. I've also included a description how I think the patches should be tested, to make it easier for you to perform testing: SIGHUP did not reopen files as needed for logrotation, fixed that (a8b9878ab38b10d24df7b773c8c580d341b22383) * the problem this patch fixes is that syslog-ng did not properly reopen destination files, it kept them opened and wrote into them even if a SIGHUP was sent to it * this was a regression in 2.0.7 and didn't affect earlier versions * to test whether the fix was ok, you should start the new version of syslog-ng, generate a continous stream of messages (for instance with loggen), and send rotate the output files using logrotate, or by hand * if syslog-ng starts a new file after rotation, then the fix was ok * if syslog-ng writes to the new file, or crashes or behaves oddly in any other was, then the fix was bad. and: fixed checking the DNS cache size limit 40f999eaff5fdb217656ab6af03e336e8e703cbf * the problem was related to the support for a persistent set of DNS cache entries (dns-cache-hosts() option) * if the hosts file specified for dns-cache-hosts() contained over dns-cache-size() entries, syslog-ng quickly dumped core right after the reception of the first message * to test this, please enable dns-cache-hosts(), populate the file with over 1007 ip->name mappings * start syslog-ng, generate some messages and check whether: * syslog-ng behaves correctly (no crash, no other odd behaviour) * syslog-ng does not try to resolve the names that are already in the dns-cache, you can check this by adding an entry that has no DNS record and check whether syslog-ng successfully resolves the name (keep_hostname(no), use_dns(yes), dns_cache(persist-only)) I've now checked that the latest snapshot (syslog-ng-2.0.7+20080128.tar.gz) contains both of these patches. Both patches run the regression test suite well, but as you know real world testing is the only thing that matters at the end. I'm going to release 2.0.8 this week, any kind of help on the patches above would help a lot. Thanks in advance. -- Bazsi

1 0

Win syslog-agent PRI
by Tiago Gomes da Silva Mendo 28 Jan '08

28 Jan '08

Hi, I have syslog-ng-premium-edition (2.1.8) on an Debian etch and multiple linuxs sending syslog messages to this server, using diferents PRIs. The problem is with the windows agent (2.1.4). In the windows agent I have an message format like this: "<182>$DATE $HOST $EVENT_SOURCE: $MSG", but at the server the received PRI is not 182. At the server I get messages with the correct PRI when the syslog-ng agent is restarted: "Jan 28 10:57:41 10.176.25.108 LogRelay: Application started", with local6 and info, but every message I send through syslog-ng agent arrives at the server with user/notice (PRI 13). Any ideas?

2 1

[patch] Fixes for 2.0.7 on not ipv6 aware systems
by Corinna Vinschen 28 Jan '08

28 Jan '08

Hi, I'm maintaining syslog-ng as part of the Cygwin net distro. Today I tried to build 2.0.7 and came across a couple of problems, which were mostly due to the fact that the current Cygwin release 1.5.25 is not ipv6 aware. While this is rectified in Cygwin's CVS, the current release is still based on older code. Below you find a patch which solves the following problems: - Two functions in src/afsocket.c use AF_INET6 even if ENABLED_IPV6 is not defined. - The new loggen tool has a typo in usage(), printing -i instead of -I for the interval arg. - loggen has a bug in the option handling. Due to a missing colon in the option string, it crashes when using the -s option. - loggen uses getaddrinfo/freeaddrinfo even on systems on which HAVE_GETADDRINFO is undefined. I created replacement code using gethostbyname/gertservbyname on systems lacking getaddrinfo. ChangeLog and diff below. Another problem I have is this: Given that loggen is in the tests subdir, I'm wondering if it's correct that loggen is installed to ${bindir} when running `make install'. Is that really supposed to happen or should `make install' skip loggen? Thanks, Corinna * src/afsocket.c (afsocket_sd_process_connection): Allow building with tcp_wrappers if AF_INET6 is unknown. (afsocket_dd_format_stats_name): Guard AF_INET6 case with ENABLE_IPV6. * tests/loggen/loggen.c diff -rup syslog-ng-2.0.7/src/afsocket.c syslog-ng-2.0.7-1/src/afsocket.c --- syslog-ng-2.0.7/src/afsocket.c 2007-11-26 09:26:38.000000000 +0100 +++ syslog-ng-2.0.7-1/src/afsocket.c 2008-01-07 18:38:31.088449800 +0100 @@ -359,7 +359,11 @@ gboolean afsocket_sd_process_connection(AFSocketSourceDriver *self, GSockAddr *peer_addr, gint fd) { #if ENABLE_TCP_WRAPPER - if (peer_addr && (peer_addr->sa.sa_family == AF_INET || peer_addr->sa.sa_family == AF_INET6)) + if (peer_addr && (peer_addr->sa.sa_family == AF_INET +#if ENABLE_IPV6 + || peer_addr->sa.sa_family == AF_INET6 +#endif + )) { struct request_info req; @@ -693,9 +697,11 @@ afsocket_dd_format_stats_name(AFSocketDe case AF_INET: driver_name = !!(self->flags & AFSOCKET_STREAM) ? "tcp" : "udp"; break; +#if ENABLE_IPV6 case AF_INET6: driver_name = !!(self->flags & AFSOCKET_STREAM) ? "tcp6" : "udp6"; break; +#endif } g_snprintf(stats_name, sizeof(stats_name), "%s(%s)", diff -rup syslog-ng-2.0.7/tests/loggen/loggen.c syslog-ng-2.0.7-1/tests/loggen/loggen.c --- syslog-ng-2.0.7/tests/loggen/loggen.c 2008-01-03 07:29:56.000000000 +0100 +++ syslog-ng-2.0.7-1/tests/loggen/loggen.c 2008-01-07 19:42:46.720451400 +0100 @@ -147,7 +147,7 @@ usage() " --stream, or -S Use stream socket (TCP and unix-stream)\n" " --dgram, or -D Use datagram socket (UDP and unix-dgram)\n" " --size, or -s Specify the size of the syslog message\n" - " --interval, or -i <sec> Number of seconds to run the test for\n"); + " --interval, or -I <sec> Number of seconds to run the test for\n"); exit(0); } @@ -176,9 +176,9 @@ main(int argc, char *argv[]) int opt; #if HAVE_GETOPT_LONG - while ((opt = getopt_long(argc, argv, "r:I:ixsSDh", syslog_ng_options, NULL)) != -1) + while ((opt = getopt_long(argc, argv, "r:I:ixs:SDh", syslog_ng_options, NULL)) != -1) #else - while ((opt = getopt(argc, argv, "r:I:ixsSDh")) != -1) + while ((opt = getopt(argc, argv, "r:I:ixs:SDh")) != -1) #endif { switch (opt) @@ -211,6 +211,7 @@ main(int argc, char *argv[]) } if (!unix_socket) { +#if HAVE_GETADDRINFO struct addrinfo hints; struct addrinfo *res, *rp; @@ -250,6 +251,53 @@ main(int argc, char *argv[]) fprintf(stderr, "Error connecting to target server: %s\n", strerror(errno)); return 2; } +#else + struct hostent *host; + struct servent *serv = NULL; + struct sockaddr_in saddr; + + if (argc - optind < 2) + { + fprintf(stderr, "No target server specified\n"); + usage(); + } + + host = gethostbyname (argv[optind]); + if (!host) + { + fprintf(stderr, "Name lookup error"); + return 2; + } + memcpy (&saddr.sin_addr, host->h_addr_list[0], host->h_length); + serv = getservbyname (argv[optind + 1], + sock_type == SOCK_STREAM ? "tcp" : "udp"); + if (!serv) + { + char *c; + + saddr.sin_port = htons (strtol (argv[optind + 1], &c, 10)); + if (c == argv[optind + 1]) + { + fprintf(stderr, "Service lookup error"); + return 2; + } + } + else + saddr.sin_port = serv->s_port; + saddr.sin_family = AF_INET; + sock = socket (AF_INET, sock_type, 0); + if (sock != -1 + && connect(sock, (struct sockaddr *) &saddr, sizeof saddr) == -1) + { + close (sock); + sock = -1; + } + if (sock == -1) + { + fprintf(stderr, "Error connecting to target server: %s\n", strerror(errno)); + return 2; + } +#endif } else { -- Corinna Vinschen Cygwin Project Co-Leader Red Hat

2 15

Bug in 2.0.7's use_dns(persist_only) and large host files
by Steve Bernacki 27 Jan '08

27 Jan '08

Environment: CentOS 5 and Syslog-ng 2.0.7 (current snapshot) Relevant syslog-ng.conf snippet: === options { use_dns(persist_only); dns_cache_hosts("/etc/hosts"); }; === If you point syslog-ng to an /etc/hosts file that has more than 1007 entries, upon receiving its first message, syslog-ng will throw the following assertion: # ./syslog-ng -Fed syslog-ng starting up; version='2.0.7' Incoming log entry; line='<38>well hello' file dnscache.c: line 99 (dns_cache_key_hash): should not be reached Aborted Workaround: In syslog-ng.conf, set dns_cache_size() to a value greater than the number of entries in your /etc/hosts file. Fix: See the attached patch; it should apply cleanly to any version of 2.0.7, and perhaps older versions as well. Steve -- Steve Bernacki, Jr To date, the Pan-Massachusetts Challenge has raised 204 million dollars for cancer research. Get involved! http://www.pmc.org/ diff -ur syslog-ng-2.0.7/src/dnscache.c syslog-ng-2.0.7-patch/src/dnscache.c --- syslog-ng-2.0.7/src/dnscache.c 2008-01-03 06:59:18.000000000 -0500 +++ syslog-ng-2.0.7-patch/src/dnscache.c 2008-01-27 09:24:52.000000000 -0500 @@ -271,7 +271,7 @@ } g_hash_table_replace(cache, &entry->key, entry); - if (g_hash_table_size(cache) > dns_cache_size) + if (!persistent && g_hash_table_size(cache) > dns_cache_size) { /* remove oldest element */ g_hash_table_remove(cache, &cache_first.next->key);

2 1

Fail safe test fot syslog-ng
by dstuxo 27 Jan '08

27 Jan '08

Hi everyone, I am using syslog-ng in a system which is supposed to be fail safe to avoid data loss. However I encountered an unexpected delay and messages are lost.. To test it I am proceeding like this: syslog-ng-config: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); } ... destination d_cron { file("/var/log/cron"); }; ... logger -t tester -p cron.info "power failure test" & tail -f /var/log/cron Waiting aprox. 2 seconds then I power down. The previous command shows the message, but after reboot it is lost. I supposed that it's happening due the fact that the buffers are not flushed to disk. So I tried strace on syslog-ng process. No read/write syscall for the message is made.. Another case is with a cycle of messages: for i in `seq 1 1000`;do logger -t tester -p cron.info "power failure test: $i";echo ">> $i";done After 3-4 seconds all messages are written. But not before that time... I know about the fsync(yes) option and I tried it, but with high load of messages It doesn't work proper (syslog-ng.config becomes corrupted and messages are also lost) There is something I am missing here? Configuration option, maybe? Regards

4 9