April 2008 - syslog-ng - lists.balabit.hu

13 Apr '08

Hi, What packages does it need to compile syslog-ng? Is it the same package when to make RPM? (bison, flex, gcc-c++, pkgconfig, glib2-devel, libevtlog-devel) (It needs only libc to compile eventlog, doesn't it?) And if it's not necessary to connect database, does it need to install libdbi8? Thanks hiro _________________________________________________________________ 【MSNビデオ】超貴重！驚きの大物対談が実現。作家村上龍が話題のあの人に迫る http://video.msn.co.jp/rvr/default.htm

4 14

[Bug 3] New: udp flood
by bugzilla＠bugzilla.balabit.com 13 Apr '08

13 Apr '08

https://bugzilla.balabit.com/show_bug.cgi?id=3 Summary: udp flood Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: manoo(a)manoo.hu Type of the Report: bug Estimated Hours: 0.0 I installed syslog-ng 2.0.5 (because there was no .rpm for a RHEL3 server I made it with rpmbuild). In the config file I placed two destination lines for the same filter, first for place the log locally and an other to send it to a remote loghost (udp/514). I had a typo in the path of the local logfile (started with "/vavr" instead of "/var") and syslog-ng cannot create/write the specified file (I made no "create_dirs(yes)") when I started the logging (with logger - that was an apache logging system) the result was the following: it did not checked the writability of the file but could start itself (resart of syslog-ng was successfull) and started to sends this errormessage to the loghost with full speed: Dec 13 09:56:07 192.168.0.2 syslog-ng[19315]: Error opening file for writing; filename='/vavr/log/apache/apache.log', error='No such file or directory (2)' within 20 minutes it sends cca 700mb of clear text to the loghost. There is a leased line between the two hosts via internet and this flooded the communication channel. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[Bug 19] New: syslog-ng 2.0. x can not follow a change of IP at target syslog server
by bugzilla＠bugzilla.balabit.com 12 Apr '08

12 Apr '08

https://bugzilla.balabit.com/show_bug.cgi?id=19 Summary: syslog-ng 2.0.x can not follow a change of IP at target syslog server Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: enhancement Estimated Hours: 0.0 If the IP address of the destination for syslogging is changed, then all sending syslog-ng servers must be reloaded to figure out that the address has changed, even if the IP name has not changed. We recently moved one of our centralized syslog servers to a different building, resulting in a different network address. We took great pains (it was actually easy, but required planning) to maintain the IP name of the syslog server, but all of the sending hosts required a syslog-ng reload to resolve the IP name in the configuration file to the new IP address. The "reopen" logic should be changed to resolve the IP address of the hostname provided in the configuration file. Hopefully the reopen process should be relatively rare, and no significant load will be placed on the DNS servers during normal operation. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

5 6

STATS: high amount of dropped messages
by Jeffrey Chandler 10 Apr '08

10 Apr '08

Hello, I am using syslog-ng 1.6.12 on Solaris 10 (sparc). I am seeing a large amount of dropped message every time Apr 9 20:14:18 syslog syslog-ng[16754]: STATS: dropped 1068470 Apr 9 20:24:18 syslog syslog-ng[16754]: STATS: dropped 1031716 Apr 9 20:34:18 syslog syslog-ng[16754]: STATS: dropped 997105 Apr 9 20:44:18 syslog syslog-ng[16754]: STATS: dropped 943151 Apr 9 20:54:18 syslog syslog-ng[16754]: STATS: dropped 1016377 Apr 9 21:04:18 syslog syslog-ng[16754]: STATS: dropped 992911 In previous posts, I have seen that this does not relate to log entries written to disk, but rather to a different destination, ie a pipe. In the case of our environment, we pipe all of the data which comes into syslog-ng to a pipe which is then forwarded to ArcSight through an agent running on the system. With the number of entries showing up as "dropped," would you recommend a different method to achieve this same task? Is this also a 1 to 1 correlation of messages that are not sent to the pipe? Thanks, Jeff

2 1

Redhat Enterprise 3 compile of 2.0.9
by Sigurður Bjarnason 10 Apr '08

10 Apr '08

Hi All, I am trying to compile syslog-ng 2.0.9 for Redhat ES3, it is not going too good it complains about not have-ing glib 2.x ,now my problem is that I cannot complile this for glib v2 and I need to stick with the orginal glib of Redhat ES3. Can it be done that is compile Syslog-ng for RedhatEs with the old glib or I am forced to upgrade to glib version 2.x . Regards Siggi

2 2

Bug: Numeric digits stripped from source hostname and time mangled.
by Christopher Cashell 09 Apr '08

09 Apr '08

[Apologies if this has been reported before, but I couldn't find any mention of it. Also, my apologies if this shows up twice. I sent it yesterday, but after 24 hours, it hasn't hit the list yet, so I'm resending.] It appears that Syslog-NG 2.0.x (tested with 2.0.9) will mangle originating source hostname when it begins numerically hostnames, and this also causes errors with date/time handling. Verified with Syslog-NG 2.0.9 on Red Hat Enterprise Linux 3 To duplicate and display the bug (destination(d_log_expanded) and template added to more easily display what's going on): [root@logbox syslog-ng]# cat syslog-ng.conf options { sync(0); chain_hostnames(yes); }; source s_net { tcp(); }; destination d_log { file("/tmp/test.log") ; }; destination d_log_expanded { file("/tmp/test-long.log" template("Date: $DATE, Sender Unixtime: $S_UNIXTIME, Receiver Unixtime: $R_UNIXTIME, Host: $FULLHOST Message: $MSGONLY\n") template_escape(no)) ; }; log { source(s_net); destination(d_log); }; log { source(s_net); destination(d_log_expanded); }; [root@logbox tmp]# cat /tmp/problem-log <0d>Mar 31 04:41:57 1234-xxxx/192.168.1.1 TestLog: This is a test log that includes the relevant bits of the original log, before Syslog-NG mangles them: "Mar 31 04:41:57 1234-xxxx/192.168.1.1 TestLog: This is a test log. . ." [root@logbox tmp]# cat < /tmp/problem-log | nc localhost 514 [root@logbox tmp]# tail -1 *.log ==> test.log <== Dec 31 17:59:59 -xxxx/192.168.1.1/localhost TestLog: This is a test log that includes the relevant bits of the original log, before Syslog-NG mangles them: "Mar 31 04:41:57 1234-xxxx/192.168.1.1 TestLog: This is a test log. . ." ==> test-long.log <== Date: Dec 31 17:59:59, Sender Unixtime: -1, Receiver Unixtime: 1207676046, Host: -xxxx/192.168.1.1/localhost Message: This is a test log that includes the relevant bits of the original log, before Syslog-NG mangles them: "Mar 31 04:41:57 1234-xxxx/192.168.1.1 TestLog: This is a test log. . ." You can see from the above that the '1234' is being stripped from the originating hostname '1234-xxxx', and the sender timestamp is then being mangled to -1. It appears to only pull the first 4 numbers from the source hostname (assuming there are more numbers, such as '123456-xxxx'), and it only happens when the hostname starts numerically. If you add a non-numeric character to the beginning part of the hostname, it is handled correctly (such as 'z1234-xxxx' or '12z34-xxxx'). -- Christopher Cashell ____________________________________ Christopher Cashell Systems & Network Security Engineer phone: 402.361.3065 fax: 402.361.3165 e-mail: christophercashell(a)solutionary.com Solutionary, Inc. www.Solutionary.com Making Security Manageable _____________________________________ Confidentiality Notice The content of this communication, along with any attachments, is covered by federal and state law governing electronic communications and may contain confidential and legally privileged information. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution, use or copying of the information contained herein is strictly prohibited. If you have received this communication in error, please immediately contact us by telephone at (402) 361-3000 or e-mail security(a)solutionary.com. Thank you. Copyright 2000-2007, Solutionary, Inc. All rights reserved. ActiveGuard, eV3, Solutionary and the Solutionary logo are registered marks of Solutionary, Inc. SecurCompass is a service mark of Solutionary, Inc.

3 4

io.c: bind_inet_socket() bind failed Address already inuse
by Lucky Y 09 Apr '08

09 Apr '08

> >We use syslog-ng 1.6.12 in RHEL4. > >As part of our system testing we restart syslog-ng 150 times in a loop > >along with other services in the server. > > > >syslog-ng fails to come up 3/4 times with the error : > >"io.c: bind_inet_socket() bind failed 192.168.128.1:601 >> Address already in use". >How do you restart syslog-ng? It takes some time to close sources/ >destinations and there is a chance that the new syslog-ng instance >tries to bind to the same address the not-yet-stopped instance >still uses. Does syslog-ng use SO_REUSEADDR option ?

3 3

syslog-ng logging with wrong year
by Jean-Sebastien Pilon 09 Apr '08

09 Apr '08

Hello, We have a log collector receiving logs from several nodes and it is logging in the wrong $YEAR directory every 1st of the month for some host for about 2 minutes... We have 75 nodes sending logs, and we have a directory created under /var/log/hosts/2007/*/01/hostname for about 3-4 host. As you can see below, the folder 01 (January 1st) was created at 23:59 on December 31st... Same thing for Feb. 1st to now... /var/log/hosts/2007/01# ls -l total 4 drwxr-xr-x 2 root root 4096 2007-12-31 23:59 01 Here are my destination and log rules destination d_local { file("/var/log/hosts/$YEAR/$MONTH/$DAY/$HOST"); }; log { source(s_tcp); source(s_udp); source(s_local); destination(d_local); }; Any one has any idea why this is happening? NOTICE: This email contains privileged and confidential information and is intended only for the individual to whom it is addressed. If you are not the named addressee, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this transmission by mistake and delete this communication from your system. E-mail transmission cannot be guaranteed to be secured or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. AVIS: Le pr�sent courriel contient des renseignements de nature privil�gi�e et confidentielle et n�est destin� qu'� la personne � qui il est adress�. Si vous n��tes pas le destinataire pr�vu, vous �tes par les pr�sentes avis�s que toute diffusion, distribution ou reproduction de cette communication est strictement interdite.� Si vous avez re�u ce courriel par erreur, veuillez en aviser imm�diatement l�exp�diteur et le supprimer de votre syst�me. Notez que la transmission de courriel ne peut en aucun cas �tre consid�r� comme inviolable ou exempt d�erreur puisque les informations qu�il contient pourraient �tre intercept�s, corrompues, perdues, d�truites, arriv�es en retard ou incompl�tes ou contenir un virus. �

4 8

Re: [syslog-ng] syslog-ng logging with wrong year
by G.W. Haywood 09 Apr '08

09 Apr '08

Hi there, On Wed, 9 Apr 2008 Balazs Scheidler wrote: > ...the timestamp of the message does not contain a year, there's a > heuristic in syslog-ng to determine that. > ... > I'm reluctant to change this in 2.0 (the current algorithm has been > in place for about a decade now), however I can commit a patch to 2.1. > What do others think? If you do, please make it optional, disabled by default. It could be enabled by a command-line switch or by the configuration file options. -- 73, Ged.

2 1

Re: [syslog-ng] TAG-Macro
by JUNG, Christian 07 Apr '08

07 Apr '08

Here's a new version of the BSDTAG macro patch which doesn't use a lookup-table for the facility anymore.

2 1