November 2008 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] I/O error occurred while reading; fd='4',error='Operation not permitted (1)'
by Florian Grandel 18 Nov '08

18 Nov '08

I Matt and Bazsi, as Bazsi said, the problem is less one of syslog-ng but one of permissions in the kernel. Access to /proc/kmsg is not only governed by file permissions but also by process capabilities. In this case reading from /proc/kmsg causes internal system calls that are only accessible to the superuser. There have been several kernel patches proposed ([1], [2], to give just a few examples). Kernel developers have already extensively discussed the topic [3]. The only practical solution I know of is the one implemented by Ubuntu in their klogd init script. They are using a daemonized dd process running as root that forwards messages from /proc/kmsg to the log process: kmsgpipe=/var/run/klogd/kmsg ... # create klog-writeable pid and fifo directory mkdir -p /var/run/klogd chown klog:klog /var/run/klogd mkfifo -m 700 $kmsgpipe chown klog:klog $kmsgpipe # shovel /proc/kmsg to pipe readable by klogd user start-stop-daemon --start --pidfile $kmsgpidfile --exec /bin/dd -b -m -- bs=1 if=/proc/kmsg of=$kmsgpipe # start klogd as non-root with reading from kmsgpipe start-stop-daemon --start --quiet --chuid klog --exec $binpath -- $KLOGD I think that this exact solution can be easily ported to syslog-ng. Florian [1] http://lkml.indiana.edu/hypermail/linux/kernel/9806.3/0896.html [2] http://lkml.indiana.edu/hypermail/linux/kernel/9811.1/0073.html [3] http://readlist.com/lists/vger.kernel.org/linux-kernel/55/276838.html

2 1

fix for 3.0 compile error
by Joe Shaw 18 Nov '08

18 Nov '08

Hi, I was getting an error compiling 3.0 because there was a reference to self->fd->fd which doesn't exist anymore. Attached is a patch which fixes that. Thanks, Joe

2 1

fix build without openssl
by Joe Shaw 18 Nov '08

18 Nov '08

Hi, Currently syslog-ng 3.0 from git fails to build if you don't have the right version of OpenSSL installed, even if you pass in --disable-ssl. Attached is a patch which fixes it. Thanks, Joe

2 1

Response to CVE-2008-5110
by Douglas E. Warner 18 Nov '08

18 Nov '08

Just wanted to make sure others were aware of this CVE [1] and get a response on the patch put up by Debian and if a release is planned to address this. -Doug [1] http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-5110

2 1

Re: [syslog-ng] I/O error occurred while reading; fd='4',error='Operation not permitted (1)'
by Florian Grandel 17 Nov '08

17 Nov '08

Hi Matt, Bazsi and all, I saw that the thread was not correctly attached. So here is the original post I am refering to. https://lists.balabit.hu/pipermail/syslog-ng/2007-January/009686.html Florian

1 0

keep_hostname as source option
by joël Winteregg 16 Nov '08

16 Nov '08

I All, I saw this post related to keep_hostname option: https://lists.balabit.hu/pipermail/syslog-ng/2002-November/004075.html And I'm wondering if there is now a possible keep_hostname usage as a non-global option (which would override the given global option) ? A bit as given here: source syslog { udp( port(514); keep_hostname(no); ); }; Thanks in advance, Regards, Joël

2 1

syslog-ng 2.1.2 has been released
by devel＠balabit.hu 16 Nov '08

16 Nov '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.1.2 SUMMARY : new stable release DATE : Nov 16, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.1.2) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: 2.1.2 Wed, 12 Nov 2008 12:25:37 +0100 Bugfixes: * Fixed handling windows sizes above 65535 by changing the internal reference counter type to a 32 bit integer. * Fixed the reported port number in log statistics messages. * Fixed the internal representation of "facility" values, earlier an 8 bit value was used for both the priority and facility values, and although systems do not define facilities in this range, the LOG_FACMASK macro defines two additional bits. The type of this field was changed to 16 bits. * Fixed filter evaluation, the evaluation in AND and OR operators had a problem, it evaluated the right-hand-size of expressions first, and then the left-hand-side. This is wrong, and it easily ruins the concept of extracting information from messages via regexps. * Fixed a segmentation fault in the configuration parser on OpenBSD/amd64. All configuration options that expected a number in the parser may cause a crash, as the strdup() function went undeclared on OpenBSD, causing it to be auto-declared as a function returning "int". As a 32 bit int cannot hold a 64 bit pointer, this may cause a crash if the high-order bits of the pointer are lost. * Fixed a possible "stall" of the syslog-ng main loop, when SQL destinations are used and flow control is enabled on the log path feeding the SQL destination. * Fixed a possible 100% CPU usage case on HP-UX. HP-UX may return POLLERR on its own without the other flags set, this was not properly handled by syslog-ng, causing it to spin on the CPU. Other changes: * Instead of relying on BalaBit's version of libdbi, adapt the configure script to libdbi upstream. This currently means that instead of dbi-0.8.pc, syslog-ng is looking for dbi.pc, just as the upstream installs the pkg-config file. * Added --enable-mixed-linking option to the configure script. This functionally equivalent of the default linking option in syslog-ng 2.0. This change only makes this possibility more explicit. * Fixed some compilation warnings. * Removed the build dependency on flex 2.5.34. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.1 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.1 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.1 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.1 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.1 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.1/src/

1 0

Send auditd info to syslog-ng in RHEL
by Phusion 13 Nov '08

13 Nov '08

Does anyone know a way to send auditd information to syslog-ng? I have a server running RHEL5 and by default it stores the info to a log file defined in the config file. By default it points to /var/log/audit/audit.log. Let me know if you have experience with this or ideas of things to try. Phusion

2 1

snmptrapd and HOST macro mapping
by joël Winteregg 13 Nov '08

13 Nov '08

Dear Syslog-ng users, I'm trying to understand (using syslog-ng community source code and some testing) if it is possible to map a given hostname located into MSGONLY macro to the FULLHOST or HOST macro. I'm trying to achieve this in order to fetch the hostname (SNMP trap source) provided by my snmptrapd collector (which is located on the same server as syslog-ng). The snmptrapd collector is logging its trap using syslog API as follow (snmptrapd source code): int log_handler_syslog( netsnmp_log_handler* logh, int pri, const char *str){ /* * XXX * We've got three items of information to work with: * Is the syslog currently open? * What ident string to use? * What facility to log to? * * We've got two "magic" locations (imagic & magic) plus the token */ if (!(logh->imagic)) { const char *ident = logh->token; int facility = (int)(intptr_t)logh->magic; if (!ident) ident = netsnmp_ds_get_string(NETSNMP_DS_LIBRARY_ID, NETSNMP_DS_LIB_APPTYPE); openlog(ident, LOG_CONS | LOG_PID, facility); logh->imagic = 1; } syslog( pri, "%s", str ); return 1; } As provided by syslog.h, there is no way to set the hostname used into syslog message (it is automatically set by the API). So my logs, provided by snmptrapd, look like the following (where HOST macro is related to the server hosting syslog-ng and snmptrapd): 12/11/2008 16:57:14 SYSLOG-COLLECTOR LEVEL=info snmptrapd[29592]: wlc02.mydomain.com Cold Start In order to be able to get wlc02.mydomain.com as $HOST or $FULLHOST macro, I set: chain_hostnames(yes); keep_hostname(yes); and I formated my snmptrapd logs MSGONLY content (using snmptrad config statements) as RFC 3164 need it: 12/11/2008 16:58:00 SYSLOG-COLLECTOR LEVEL=info snmptrapd[29592]: Nov 12 16:57:59 wlc02.mydomain.com Cold Start I thought that the above log would be seen as a relayed message by syslog-ng allowing me to fetch wlc02.mydomain.com into $HOST or $FULLHOST. Unfortunately this config provide me the following string into $FULLHOST macro: s_source@SYSLOG-COLLECTOR Does syslog-ng only use relay config statements (keep_hostname, etc.) when the log source is defined as udp() or tcp() ? I saw another hint about this here: http://osdir.com/ml/syslog-ng/2004-10/msg00062.html It says that: "If you still have your snmptrapd hostname, then you have to modify snmptrapd to use the original hostname when it sends the message about the trap" But as given above (syslog API usage into snmptrapd) how can I set the hostname of the syslog message ? Any hint is welcome ! Thanks in advance, Joël

2 6

Does syslog-ng have the ability of controlling repeated lines?
by Mao Rui 13 Nov '08

13 Nov '08

I always got multiple lines of repeated messages. Syslog can merge them into a line like 'last message repeated n times'. But syslog-ng did not. Is there any way to make syslog-ng working in the same way? Best regards, Mao Rui

3 2