February 2008 - syslog-ng - lists.balabit.hu

Problem on RHEL4
by Abid Ghufran 17 Feb '08

17 Feb '08

Hello, While trying to compile syslog-ng from I am getting the following error. I have seen that many others have had the same problem but I could not find any solution. I am installing on RHEL4 and have used all the latest requisities for syslog-ng as follows: bison-2.3eventlog-0.2.5flex-2.5.34glib-2.14.6libnetpkg-config-0.20syslog-ng-2.0.8tcp_wrappers_7.6I would appreciate if someone could help me with this problem. Thanks and regards, Abid Ghufran. =============================================== make all-recursivemake[1]: Entering directory `/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8'Making all in srcmake[2]: Entering directory `/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src'gcc -g -O2 -Wall -o syslog-ng main.o libsyslog-ng.a -lnsl -lrt -Wl,-Bstatic -lfl -L/usr/local/lib -lglib-2.0 -L/usr/local/lib -levtlog -lwrap -Wl,-Bdynamiclibsyslog-ng.a(misc.o)(.text+0x3a9): In function `resolve_hostname':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/misc.c:191: undefined reference to `g_assert_warning'libsyslog-ng.a(logmsg.o)(.text+0x6a): In function `log_stamp_format':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/logmsg.c:110: undefined reference to `g_assert_warning'libsyslog-ng.a(logmsg.o)(.text+0x2b6): In function `log_msg_ref':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/logmsg.c:575: undefined reference to `g_assert_warning'libsyslog-ng.a(logmsg.o)(.text+0x342): In function `log_msg_unref':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/logmsg.c:589: undefined reference to `g_assert_warning'libsyslog-ng.a(logmsg.o)(.text+0x1132): In function `log_msg_ack_block_end':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/logmsg.c:726: undefined reference to `g_return_if_fail_warning'libsyslog-ng.a(logpipe.o)(.text+0x4f): In function `log_pipe_ref':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/logpipe.c:38: undefined reference to `g_assert_warning'libsyslog-ng.a(logpipe.o)(.text+0x9b): In function `log_pipe_unref':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/logpipe.c:47: undefined reference to `g_assert_warning'libsyslog-ng.a(center.o)(.text+0x7d): In function `log_endpoint_free':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/center.c:90: undefined reference to `g_assert_warning'libsyslog-ng.a(center.o)(.text+0x175): In function `log_connection_new':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/center.c:132: undefined reference to `g_assert_warning'libsyslog-ng.a(templates.o)(.text+0x2de): In function `log_template_ref':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/templates.c:191: undefined reference to `g_assert_warning'libsyslog-ng.a(templates.o)(.text+0x396):/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/templates.c:202: more undefined references to `g_assert_warning' followcollect2: ld returned 1 exit statusmake[2]: *** [syslog-ng] Error 1make[2]: Leaving directory `/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src'make[1]: *** [all-recursive] Error 1make[1]: Leaving directory `/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8'make: *** [all] Error 2 _________________________________________________________________ Free games, great prizes - get gaming at Gamesbox. http://www.searchgamesbox.com

2 1

Reference counter width of log messages and group/user handling
by Roger J. Meier 14 Feb '08

14 Feb '08

Hi all, These patches fix two segmentation fault and abort signal problems which we encountered in our use case of syslog-ng 2.0.8. Patch 1: "syslog-ng-2.0.8-refcounter.diff". If specifying more than about 256 "destination" directives inside one log directive, then the reference counter of a log message wraps. The reference counter width of LogMessage is expanded from 8 bit to unsigned int (32 bit). Reason: The reference counter wraps after 256 increments, which causes an abort() call when decrementing the reference counter below 0 at a later time. The additional 3 bytes per message in memory seem to be affordable. Patch 2: "syslog-ng-2.0.8-group.diff". Handling of "-g" and "-u" options is not mutual exclusive: If group is specified on the command line, but not the user, then the user is a NULL pointer. Calling initgroups() with a null pointer segfaults in our case. And once again, many thanks to Bazsi for the syslog-ng software. -- Roger -- --------------------------------------------------------------- addr://Kasinostrasse 30, CH-5001 Aarau fon://++41 62 823 9355 http://www.terreactive.com fax://++41 62 823 9356 --------------------------------------------------------------- Wir sichern Ihren Erfolg. terreActive AG --------------------------------------------------------------- --- syslog-ng-2.0.8-orig/src/logmsg.h 2008-01-26 16:15:14 +0100 +++ syslog-ng-2.0.8/src/logmsg.h 2008-02-08 13:58:48 +0100 @@ -77,7 +77,7 @@ typedef struct _LogMessage { - guint8 ref_cnt; + guint ref_cnt; guint8 flags; guint8 pri; guint8 num_re_matches; --- syslog-ng-2.0.8-orig/src/main.c 2007-12-27 11:55:59 +0100 +++ syslog-ng-2.0.8/src/main.c 2008-02-08 18:31:49 +0100 @@ -287,7 +287,8 @@ if (uid || gid || run_as_user) { setgid(gid); - initgroups(run_as_user, gid); + if (run_as_user) + initgroups(run_as_user, gid); setuid(uid); } return 1;

2 2

Re: [syslog-ng] Problems with short messages
by Guy Fleegman 13 Feb '08

13 Feb '08

I see what you are saying... I don't think the length of a packet either 1024 or 69 bytes in length is causing the problem. The problem is that the second frame (the 69 byte one) is not going to the appropriate file. It is going to the default "catch all" file instead of the one it should be. If you look at the actual packet code... I believe the applications part of the header is missing on the 69 byte packet. Would this cause syslog-ng to dump the packet into the default catch all file as opposed to the one specified by IP? Please advise and thanks, Chris -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Monday, February 11, 2008 4:04 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Problems with short messages On Sun, 2008-02-10 at 08:03 -0500, Guy Fleegman wrote: > The first packet is only 1066 bytes long... and the second one is 69. > I thought that the default log msg size was 8192...so i was not > thinking that adjusting that in either direction would make a > difference.... should it? If it's over your desired length, then you don't need to adjust that. The problem is that if you're using the UDP transport, messages terminated by the datagram borders, e.g. each message is a separate frame. Syslog-ng will happily process UDP frames over 1024 bytes (even thought the RFC says that's the limit), so change the sender to send it out with a single frame. -- Bazsi

3 2

usertty
by Anurag Agarwal 12 Feb '08

12 Feb '08

Hello everybuddy, I am using syslog-ng and used usertty in destination. I am using a user 'test' as destination. But other users can also see the message on their console e.g root and other users. Please help as this is creating a problem and NG not working as desired. OS: Solaris 10 Anurag aggarwal GSM: +91-9811511699 mailto:anurag.agarwal@telsima.com Skype: anuraganuj Yahoo IM: anuraganuj

1 0

Eric Savidan/France/Equant is out of the office. : Eric Savidan/France/Equant is out of the office. : EricSavidan/France/Equant is out of the office. : EricSavidan/France/Equant isout of the office. : Re:anybody usingflags(fallback) ?
by eric.savidan＠orange-ftgroup.com 11 Feb '08

11 Feb '08

I will be out of the office starting 11/02/2008 and will not return until 18/02/2008. Pour tout problème sur bongrain et valrhona, veuillez contacter M. Abdelmounim Baroudi (02 23 28 64 96) Pour tout autre problème SB Alliance, veuillez contacter M. Hervé Samson (01 44 45 12 91) Pour tout autre problème urgent, veuillez contacter Mme Gwenola Wyckens (02 23 28 33 15)

1 0

Eric Savidan/France/Equant is out of the office. : Eric Savidan/France/Equant is out of the office. : EricSavidan/France/Equant is out of the office. : Re:anybody usingflags(fallback) ?
by eric.savidan＠orange-ftgroup.com 11 Feb '08

11 Feb '08

I will be out of the office starting 11/02/2008 and will not return until 18/02/2008. Pour tout problème sur bongrain et valrhona, veuillez contacter M. Abdelmounim Baroudi (02 23 28 64 96) Pour tout autre problème SB Alliance, veuillez contacter M. Hervé Samson (01 44 45 12 91) Pour tout autre problème urgent, veuillez contacter Mme Gwenola Wyckens (02 23 28 33 15)

1 0

Eric Savidan/France/Equant is out of the office. : Eric Savidan/France/Equant is out of the office. : Re:anybody using flags(fallback) ?
by eric.savidan＠orange-ftgroup.com 11 Feb '08

11 Feb '08

I will be out of the office starting 11/02/2008 and will not return until 18/02/2008. Pour tout problème sur bongrain et valrhona, veuillez contacter M. Abdelmounim Baroudi (02 23 28 64 96) Pour tout autre problème SB Alliance, veuillez contacter M. Hervé Samson (01 44 45 12 91) Pour tout autre problème urgent, veuillez contacter Mme Gwenola Wyckens (02 23 28 33 15)

1 0

Eric Savidan/France/Equant is out of the office. : Re: anybody using flags(fallback) ?
by eric.savidan＠orange-ftgroup.com 11 Feb '08

11 Feb '08

I will be out of the office starting 11/02/2008 and will not return until 18/02/2008. Pour tout problème sur bongrain et valrhona, veuillez contacter M. Abdelmounim Baroudi (02 23 28 64 96) Pour tout autre problème SB Alliance, veuillez contacter M. Hervé Samson (01 44 45 12 91) Pour tout autre problème urgent, veuillez contacter Mme Gwenola Wyckens (02 23 28 33 15)

1 0

Problems with short messages
by Guy Fleegman 11 Feb '08

11 Feb '08

Hello: We have a system that sends messages to syslog-ng (Latest version 2.0.8..but this has occurred on all 2.x versions so far) This is what is happening.... An application has a message that us too long for syslog.. .so it breaks the message into 2 separate syslog messages. The first one is a length seen in wireshark of 1066 bytes. The second packet is either 69 or 70 bytes and it it simply the leftover characters 0/n/n The problem is that the filter in my syslog-ng.conf file is not catching the second smaller messages Instead of going to the file i direct it to. It goes to the default file (which i do not want) What is causing this packet to not be processed by my filter? Attached is a copy of the relevant syslog-ng.conf data as well as the actual wireshark trace information Please advise and thanks ! -Chris syslog-ng.conf file source all_devices { udp(ip(0.0.0.0) port(514)); }; destination d_catch_all_others{ file("/var/log/syslog-ng-logs/everything_else.1" perm(0644) template(t_default)); }; destination d_pt_network_device{ file("/var/log/syslog-ng-logs/pt_network_device.1" perm(0644) template(t_default)); }; filter f_all_devices { not (host(1.2.3.4) or host(2.3.4.5)); }; filter f_pt_network_device{ (host1.2.3.4) or host(2.3.4.5)); }; log { source(all_devices); filter(f_all_devices); destination(d_catch_all_others); }; log { source(all_devices); filter(f_pt_network_device); destination(d_pt_network_device); }; here is the wireshark capture No. Time Source Destination Protocol Packet length Info 1 09:14:23.073515 1.2.3.4 9.8.7.6 Syslog 1066 LOCAL2.ERR: Feb 1 09:14:23 auditd: Feb 1 14:14:23 2008 GMT f_system a_hmon t_geninfo p_major pid: 1372 ruid: 0 euid: 0 pgid: 1372 fid: 0 logid: 0 cmd: 'monitord' domain: HMON edomain: HMON hostname: perfjupiterb.bwc.state.oh.us +|health monitor|MON_INFO|MAJOR|SYS|HMONINFO\n=Health Monitor data follows\n\nuptime_util:\t 32 days\t 5:59\nload_avg:\t 0.10\nmem_percent:\t 6.09\ncpu_percent:\t 0\ntcp_count:\t 19\nudp_count:\t 8\nproxy_info:\t syslogd \t1\nproxy_info:\t named \t7\nproxy_info:\t squid \t6\nproxy_info:\t ntpd \t2\nproxy_info:\t snmpp \t2\nproxy_info:\t pudp \t63\nproxy_info:\t entrelayd \t3\nproxy_info:\t dnsp \t2\nproxy_info:\t tcpgsp:(1425) \t2\nproxy_info:\t warder_auth \t5\nproxy_info:\t sshd \t2\ntcp_data:\t ESTABLISHED\t13\ntcp_data:\t TIME_WAIT\t6\ntcp_data:\t FIN_WAIT_1\t0\ntcp_data:\t FIN_WAIT_2\t0\ntcp_data:\t CLOSE_WAIT\t0\nipf_data:\t TCP Total\t\t0\nipf_data:\t UDP Total\t\t0\nipf_total:\t Frame 1 (1066 bytes on wire, 1066 bytes captured) Arrival Time: Feb 1, 2008 09:14:23.073515000 [Time delta from previous packet: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Packet Length: 1066 bytes Capture Length: 1066 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:syslog] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_12:b4:4a (00:0f:f8:12:b4:4a), Dst: CompaqHp_41:c6:af (00:0b:cd:41:c6:af) Destination: CompaqHp_41:c6:af (00:0b:cd:41:c6:af) Address: CompaqHp_41:c6:af (00:0b:cd:41:c6:af) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_12:b4:4a (00:0f:f8:12:b4:4a) Address: Cisco_12:b4:4a (00:0f:f8:12:b4:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 1.2.3.4 (1.2.3.4), Dst: 9.8.7.6 (9.8.7.6) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1052 Identification: 0xa1db (41435) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: UDP (0x11) Header checksum: 0xf7a4 [correct] [Good: True] [Bad : False] Source: 1.2.3.4 (1.2.3.4) Destination: 9.8.7.6 (9.8.7.6) User Datagram Protocol, Src Port: syslog (514), Dst Port: syslog (514) Source port: syslog (514) Destination port: syslog (514) Length: 1032 Checksum: 0xf9d3 [correct] [Good Checksum: True] [Bad Checksum: False] Syslog message: LOCAL2.ERR: Feb 1 09:14:23 auditd: Feb 1 14:14:23 2008 GMT f_system a_hmon t_geninfo p_major pid: 1372 ruid: 0 euid: 0 pgid: 1372 fid: 0 logid: 0 cmd: 'monitord' domain: HMON edomain: HMON hostname: perfjupiterb.bwc.sta 1001 0... = Facility: LOCAL2 - reserved for local use (18) .... .011 = Level: ERR - error conditions (3) Message [truncated]: Feb 1 09:14:23 auditd: Feb 1 14:14:23 2008 GMT f_system a_hmon t_geninfo p_major pid: 1372 ruid: 0 euid: 0 pgid: 1372 fid: 0 logid: 0 cmd: 'monitord' domain: HMON edomain: HMON hostname: perfjupiterb.bwc.state.oh.u No. Time Source Destination Protocol Packet length Info 2 09:14:23.073537 1.2.3.4 9.8.7.6 Syslog 69 LOCAL2.ERR: Feb 1 09:14:23 0\n\n Frame 2 (69 bytes on wire, 69 bytes captured) Arrival Time: Feb 1, 2008 09:14:23.073537000 [Time delta from previous packet: 0.000022000 seconds] [Time since reference or first frame: 0.000022000 seconds] Frame Number: 2 Packet Length: 69 bytes Capture Length: 69 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:syslog] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_12:b4:4a (00:0f:f8:12:b4:4a), Dst: CompaqHp_41:c6:af (00:0b:cd:41:c6:af) Destination: CompaqHp_41:c6:af (00:0b:cd:41:c6:af) Address: CompaqHp_41:c6:af (00:0b:cd:41:c6:af) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_12:b4:4a (00:0f:f8:12:b4:4a) Address: Cisco_12:b4:4a (00:0f:f8:12:b4:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 1.2.3.4 (1.2.3.4), Dst: 9.8.7.6 (9.8.7.6) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 55 Identification: 0xa1dc (41436) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: UDP (0x11) Header checksum: 0xfb88 [correct] [Good: True] [Bad : False] Source: 1.2.3.4 (1.2.3.4) Destination: 9.8.7.6 (9.8.7.6) User Datagram Protocol, Src Port: syslog (514), Dst Port: syslog (514) Source port: syslog (514) Destination port: syslog (514) Length: 35 Checksum: 0xec1c [correct] [Good Checksum: True] [Bad Checksum: False] Syslog message: LOCAL2.ERR: Feb 1 09:14:23 0\n\n 1001 0... = Facility: LOCAL2 - reserved for local use (18) .... .011 = Level: ERR - error conditions (3) Message: Feb 1 09:14:23 0\n\n

3 3

anybody using flags(fallback) ?
by Balazs Scheidler 11 Feb '08

11 Feb '08

Hi, As I wrote earlier I'm in the process of redesigning syslog-ng internals, and some log statement flags are way more difficult to implement than with the previous model. These are: "final" -- I see the merit here, and even though it's more difficult to implement, it's worth it "fallback" -- as I see this can perfectly be substituted by a series of lost statement each with "final" flag. Using the final flag is also faster, as syslog-ng does not have to evaluate filters. What do you think? Does anyone use fallback in a way that is not possible using final? If you need more information on the flags above, it is described in the documentation: http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/ch08s03.html -- Bazsi

3 3