November 2008 - syslog-ng - lists.balabit.hu

[Bug 14] New: Maintain symlinks to current and previous log output files...
by bugzilla＠bugzilla.balabit.com 28 Sep '11

28 Sep '11

https://bugzilla.balabit.com/show_bug.cgi?id=14 Summary: Maintain symlinks to current and previous log output files... Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=218688 OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: enhancement Estimated Hours: 0.0 >From bugs.debian.org: I'm hoping that upstream might consider adding functionality to syslog-ng to allow it to track current and previous log files and maintain symlinks to them, as a user option. This replicates one of the options that I (and others) find useful in cronolog. This has been previously discussed on the syslog-ng mailing list, though apparently nothing fully came of it. The archive of that discussion is at: https://lists.balabit.hu/pipermail/syslog-ng/2002-June/003452.html Obviously, it's probably somewhat of a low priority, but it would be nice. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

syslog-ng client messages delayed
by mark peters 22 Mar '10

22 Mar '10

Hi, We are running into a issue where syslog-ng clients who are configured to forward to a central syslog-ng destination server that are reasonably chatty are getting there messages delayed at the source (ie. 'tcpdump'ing the client shows it is sending messages from N minutes ago, where N is anything from 5 to 60 minutes on average sometimes more). We have also seen a small percentage of loss at the destination. On these 'delayed' clients we also see the resident memory footprint on the growing. Clients are running 1.6.12 (have tried 2.0.8 also - same symptons). The central syslog-ng server is running 2.0.8. relevant config entries are: syslog-ng client: options { sync (1); time_reopen (10); log_fifo_size (2097152); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; destination d_central { tcp("log2.xyz.com" port(5140)); }; filter f_local5 { facility(local5); }; log { source(s_sys); filter(f_local5); destination(d_central); flags(final); }; syslog-ng central server: options { time_reopen (10); log_fifo_size (2097152); long_hostnames (off); use_dns (yes); dns_cache (yes); dns_cache_expire (28800); use_fqdn (no); create_dirs (yes); dir_perm (0755); perm (0644); keep_hostname (no); use_time_recvd (no); stats_freq(600); flush_timeout(16000); flush_lines(256); time_sleep(80); }; destination d_server { file("/logs/server.$LEVEL.log"); }; filter f_server { facility(local5) and program("server"); }; log { source(s_sys); filter(f_server); destination(d_server); flags(final); }; to give a rough idea of message volume the server is receiving approximately 50 million log lines per day on average any help/information would be appreciated thanks -------------------------------------- Easy + Joy + Powerful = Yahoo! Bookmarks x Toolbar http://pr.mail.yahoo.co.jp/toolbar/

3 4

[Bug 21] New: call shutdown() before closing a socket
by bugzilla＠bugzilla.balabit.com 30 Apr '09

30 Apr '09

https://bugzilla.balabit.com/show_bug.cgi?id=21 Summary: call shutdown() before closing a socket Product: syslog-ng Version: 2.1.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bazsi(a)balabit.hu Type of the Report: --- Estimated Hours: 0.0 syslog-ng should call shutdown() before closing a socket to ensure the contents of the socket buffer are emptied. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 23] New: MySQL default configuration causes error on 'pid' column
by bugzilla＠bugzilla.balabit.com 30 Apr '09

30 Apr '09

https://bugzilla.balabit.com/show_bug.cgi?id=23 Summary: MySQL default configuration causes error on 'pid' column Product: syslog-ng Version: 2.1.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: mark(a)la-croix.net Type of the Report: bug Estimated Hours: 0.0 When configuring a MySQL destination, the default 'pid' column type is INT. However, if a message comes through with no PID, the SQL command tries to insert an empty quoted string, which causes an error in MySQL 5.0. Example error: Error running SQL query; type='mysql', host='!MY_DB_HOST!', port='', user='syslog-ng', database='syslog-ng', error='1366: Incorrect integer value: \'\' for column \'pid\' at row 1', query='INSERT INTO !MY_LOG_CLIENT_HOST!_2008_09_23 (date, facility, level, host, program, pid, message) VALUES (\'2008-09-23 12:24:35\', \'1\', \'5\', \'!MY_LOG_CLIENT!\', \'root\', \'\', \'test\')' The message is coming from a TCP source from which a large percentage of messages have no PID associated. The workaround is to explicitly set the PID column to VARCHAR so it can handle empty strings, but it would be nice to see the empty PID case gracefully handled. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 9

[patch] Add follow_freq_ms option
by Joe Shaw 16 Jan '09

16 Jan '09

Hi, As I mentioned in the last thread, I've found myself wanting to have better than one second resolution for the follow_freq() option. Attached is a patch which adds a follow_freq_ms option, which takes its value in milliseconds rather than full seconds. follow_freq() continues to work as it did previously. Thanks, Joe

3 7

importing old syslog-ng messages
by Daniel L. Spells Sr. 05 Jan '09

05 Jan '09

Sirs, Is there a way to import /var/log/messages, created by syslog-ng, into syslog-ng to be placed into a database? Daniel

5 11

running syslog-ng and syslogd concurrently?
by Matt Camuto 28 Nov '08

28 Nov '08

Hi There - I am new to this group so I thank you in advance for any help. We are in the process of evaluating syslog-ng for a replacement for normal syslogd. However it is desired for a few months to have syslog-ng and syslogd running on the same box with syslog-ng simply not handling the normal 'syslog traffic' (udp/514). We currently have a 30 day eval license to test out syslog-ng. We are using a sun t1000 box as an fyi. When we install syslog-ng the install script informs us that syslogd will be removed as a service?!?! Has anybody ever run syslogd (in either agent or server mode) on the same machine with syslogd running. Any guidance there would be highly appreciated. We are not in the position to do a hard cross over to syslog-ng for our production environment. Thanks in advance. Matt

5 6

syslog-ng 2.1.3 has been released
by devel＠balabit.hu 26 Nov '08

26 Nov '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.1.3 SUMMARY : new stable release DATE : Nov 26, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.1.3) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: NOTE: this release fixes a security problem CVE-2008-5110, see the changelog below for more details. Bugfixes: * Fixed chroot() support to change into the chrooted directory after chroot is invoked. This fixes the security problem CVE-2008-5110. NOTE: this vulnerability is not exploitable on its own, it only makes breaking out of the jail somewhat easier. Please also NOTE that, even with this patch applied, it is still possible to break out of the jail if syslog-ng is running as root. * Fixed the code to resolve usernames, 2.1.2 had a regression which caused all username lookups to fail. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.1 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.1 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.1 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.1 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.1 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.1/src/

4 4

syslog-ng 2.0.10 has been released
by devel＠balabit.hu 26 Nov '08

26 Nov '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.0.10 SUMMARY : new stable release DATE : Nov 26, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.0.10) has been released. For latest fixes in the 2.0.x branch you are recommended to upgrade to this version. CHANGES: NOTE: this release fixes a security problem CVE-2008-5110, see the changelog below for more details. Bugfixes: * Fixed Solaris door support, the door portion of sun-streams() sources did not work in previous releases, as the door specific thread was lost through the fork() call used to background syslog-ng. * Fixed a possible segfault if non-existing, optional source files are present in the configuration. * Fixed the internal representation of "facility" values, earlier an 8 bit value was used for both the priority and facility values, and although systems do not define facilities in this range, the LOG_FACMASK macro defines two additional bits. The type of this field was changed to 16 bits. * Fixed a possible 100% CPU usage case on HP-UX. HP-UX may return POLLERR on its own without the other flags set, this was not properly handled by syslog-ng, causing it to spin on the CPU. * Fixed chroot() support to change into the chrooted directory after chroot is invoked. This fixes the security problem CVE-2008-5110. NOTE: this vulnerability is not exploitable on its own, it only makes breaking out of the jail somewhat easier. Please also NOTE that, even with this patch applied, it is still possible to break out of the jail if syslog-ng is running as root. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.0 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.0 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.0 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.0 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.0 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/

1 0

2 Issues - Resolving User and corrupt forwarding
by Robert Kong 22 Nov '08

22 Nov '08

Syslog-ng Version 3.0+20081121 is not resolving the user when using the option "owner(0)" or "owner(root)". The following error message is displayed: Error resolving user; user='root' or Error resolving user; user='0' Going through the archives I found a posting stating a similar problem. I am wondering if the incorrect patch was also applied to version 3.0? After a little debugging I noticed that in resolve_user the conditional check "if (*user) return FALSE" looks to be the culprit. When comparing resolve_user to resolve_group I notice that under resolve_group the conditional is "if (!*group) return FALSE". Negating the conditional in resolve_user seems to correct the problem. Though I am not sure if would be the correct thing to do. The second issue that I am having is with forwarding of incoming syslog messages to a secondary server running a native syslogd daemon. If I leave the original syslog message un-touched destination D_ONE { udp("10.10.10.10" port(514)); }; log { source(S_ALL); destination(D_ONE); }; The remote server receives and processes the syslog msg correctly. However, if I attempt to use a template the forwarded syslog msg become corrupted. destination D_ONE { udp("10.10.10.10" port(514) template("$DATE $HOST $MSGHDR$MSGONLY")); }; log { source(S_ALL); destination(D_ONE); }; What seems to be occurring is the PRI portion of the syslog msg becomes malformed when using the template. Is this the proper behavior or am I doing something wrong? Thanks Bob

1 0