December 2009 - syslog-ng - lists.balabit.hu

[Bug 42] New: capabilities, chown, chmod
by bugzilla＠bugzilla.balabit.com 20 Dec '12

20 Dec '12

https://bugzilla.balabit.com/show_bug.cgi?id=42 Summary: capabilities, chown, chmod Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: zbyniu(a)pld-linux.org Type of the Report: bug Estimated Hours: 0.0 Let's take a look at syslog-ng-3.0.1/src/affile.c lines 60-83 1. CAP_SYS_ADMIN is needed only for /proc/kmsg, it is added w/o check 2. CAP_DAC_READ_SEARCH should be added only if open fail with errno 13 2a. CAP_DAC_OVERRIDE should be added only if open fail with errno 13 and with CAP_DAC_READ_SEARCH set 3. fchown needs CAP_CHOWN unconditionaly 4. fchmod needs CAP_FOWNER if file owner != euid (root here) 5. all caps should be restored summary: - CAP_SYS_ADMIN and CAP_DAC_OVERRIDE are set always even if unnecessary, and permanently - owner, group and perm doesn't work -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 10

[Bug 14] New: Maintain symlinks to current and previous log output files...
by bugzilla＠bugzilla.balabit.com 28 Sep '11

28 Sep '11

https://bugzilla.balabit.com/show_bug.cgi?id=14 Summary: Maintain symlinks to current and previous log output files... Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=218688 OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: enhancement Estimated Hours: 0.0 >From bugs.debian.org: I'm hoping that upstream might consider adding functionality to syslog-ng to allow it to track current and previous log files and maintain symlinks to them, as a user option. This replicates one of the options that I (and others) find useful in cronolog. This has been previously discussed on the syslog-ng mailing list, though apparently nothing fully came of it. The archive of that discussion is at: https://lists.balabit.hu/pipermail/syslog-ng/2002-June/003452.html Obviously, it's probably somewhat of a low priority, but it would be nice. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

filter/parse based on certificate attributes?
by Christian Tramnitz 22 Feb '11

22 Feb '11

With syslog 3.0 and ssl support using mutual certificate authentication is it possible to parse/filter/tag based on attributes in the certificate? I'd like to have a common listener and then relay or append messages based on client-cert attribute values... (Sorry if this message is arriving more than once, I seem to have problems with posting through Gmane.) Regards, Christian

4 4

[Bug 38] New: Setting values of the Structured Data block.
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=38 Summary: Setting values of the Structured Data block. Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: c.haase(a)ifu.com Type of the Report: enhancement Estimated Hours: 0.0 Please add the functionality to set values inside the Structured Data block. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 37] New: Syslog-ng macros don't work in filters
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=37 Summary: Syslog-ng macros don't work in filters Product: syslog-ng Version: 3.0.x Platform: Other OS/Version: Other Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: vincent.panel(a)telindus.be Type of the Report: --- Estimated Hours: 0.0 Several documented macros don't work when used in filters. It's the case for $SEC, $MSGHDR. Already reported on the syslog-ng mailing list and acknowleged as a syslog-ng bug. I've tried it on Sparc/Solaris (but can't choose it in the platform menu of bugzilla...) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

syslog-ng client messages delayed
by mark peters 22 Mar '10

22 Mar '10

Hi, We are running into a issue where syslog-ng clients who are configured to forward to a central syslog-ng destination server that are reasonably chatty are getting there messages delayed at the source (ie. 'tcpdump'ing the client shows it is sending messages from N minutes ago, where N is anything from 5 to 60 minutes on average sometimes more). We have also seen a small percentage of loss at the destination. On these 'delayed' clients we also see the resident memory footprint on the growing. Clients are running 1.6.12 (have tried 2.0.8 also - same symptons). The central syslog-ng server is running 2.0.8. relevant config entries are: syslog-ng client: options { sync (1); time_reopen (10); log_fifo_size (2097152); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; destination d_central { tcp("log2.xyz.com" port(5140)); }; filter f_local5 { facility(local5); }; log { source(s_sys); filter(f_local5); destination(d_central); flags(final); }; syslog-ng central server: options { time_reopen (10); log_fifo_size (2097152); long_hostnames (off); use_dns (yes); dns_cache (yes); dns_cache_expire (28800); use_fqdn (no); create_dirs (yes); dir_perm (0755); perm (0644); keep_hostname (no); use_time_recvd (no); stats_freq(600); flush_timeout(16000); flush_lines(256); time_sleep(80); }; destination d_server { file("/logs/server.$LEVEL.log"); }; filter f_server { facility(local5) and program("server"); }; log { source(s_sys); filter(f_server); destination(d_server); flags(final); }; to give a rough idea of message volume the server is receiving approximately 50 million log lines per day on average any help/information would be appreciated thanks -------------------------------------- Easy + Joy + Powerful = Yahoo! Bookmarks x Toolbar http://pr.mail.yahoo.co.jp/toolbar/

3 4

md5sum or sha1sum files not found .
by Mr. James W. Laferriere 19 Jan '10

19 Jan '10

Hello All , When going to ... http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.0.4/… I am not finding either a md5sum or sha1sum (or greater) file for the contents . Is this due to decission not to or a oversight ? Tia , JimL -- +------------------------------------------------------------------+ | James W. Laferriere | System Techniques | Give me VMS | | Network&System Engineer | 3237 Holden Road | Give me Linux | | babydr(a)baby-dragons.com | Fairbanks, AK. 99709 | only on AXP | +------------------------------------------------------------------+

5 15

Leaking objects in size-4096 cache in slabinfo
by Doug Warner 12 Jan '10

12 Jan '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'm running syslog-ng 3.0.4 OSE on Gentoo and have a central syslog host that accepts about 3Mbps of log traffic via a TCP pipe. We've recently been having oom-killer problems and I finally tracked it down to the fact that we seem to be leaking objects in the size-4096 cache. Now, slabinfo is new to me so I could be interpreting this wrong, but restarting syslog-ng definite reclaims this cache. What data can I provide to help track down this problem? I noticed that there seems to be a similar error in 3.1 beta, reported here: http://thread.gmane.org/gmane.comp.syslog-ng/8544 - -Doug -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iD8DBQFLJ8FqJV36su0A0xIRAizGAKDbVEpHRMhrRgAogUuAh0nCKz9xFwCgtz17 6EN8aU3MxU7bL8Sr4xRx6tI= =1LQg -----END PGP SIGNATURE-----

3 13

SQL destination function issue
by Christopher O'Brien 07 Jan '10

07 Jan '10

Hi, I am trying to log messages from a Cisco ASA into a MySQL database through syslog-ng 3.0.4. I have the whole thing working except I cannot import data if I want to use a function. Here is an example: Here is the log message that is coming into the syslog server from the ASA device: Dec 04 2009 10:22:23: %ASA-5-305012: Teardown dynamic TCP translation from inside:10.6.42.166/2617 to outside:10.16.19.17/61631 duration 0:01:00 Here is what is logged by syslog-ng: Running SQL query; query='INSERT INTO stop (s_time, e_time, proto, in_ip, in_port, out_ip, out_port) VALUES (\'DATE_SUB(\"2009-12-04 10:22:23\", INTERVAL \"0:01:00\" HOUR_SECOND)\', \'2009-12-04 10:22:23\', \'TCP\', \'10.6.42.166\', \'2617\', \'10.16.19.17\', \'61631\')' Here is what is recorded in the database: +-----+---------------------+---------------------+-------+-------------+---------+---------------+----------+ | idx | s_time | e_time | proto | in_ip | in_port | out_ip | out_port | +-----+---------------------+---------------------+-------+-------------+---------+---------------+----------+ | 166 | 0000-00-00 00:00:00 | 2009-12-04 10:22:23 | TCP | 10.6.42.166 | 2617 | 10.16.19.17 | 61631 | Every field is recorded properly aside from the one that I am trying to use a function in. The purpose of the function is to record the start time of a translation. I get the end time from the syslog timestamp and the duration from the syslog message itself. I am trying to use a builtin MySQL function to record the start time in s_time. I think the problme is syslog-ng is putting single quotes around the whole function so it is being treated like a string literal by MySQL instead of variable data. Is that right? Is there a way to remedy this? Here is my syslog-ng.conf configuration if it helps: @version: 3.0 # $Header: /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.conf.gentoo,v 1.7 2007/08/02 04:52:18 mr_bones_ Exp $ # # Syslog-ng default configuration file for Gentoo Linux # contributed by Michael Sterrett options { chain_hostnames(no); # The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats_freq(43200); }; source src { unix-stream("/dev/log" max-connections(256)); internal(); file("/proc/kmsg"); }; source s_xlate { udp(ip(0.0.0.0) port(514)); }; filter f_xlate_start { host(10.16.19.33) and program("%ASA-5-305011") ; }; filter f_xlate_stop { host(10.16.19.33) and program("%ASA-5-305012") ; }; parser p_xlate { csv-parser(columns("LOG.STATUS", "LOG.TYPE", "LOG.PROTOCOL", "LOG.XLATE", "LOG.FROM","LOG.INSIDE", "LOG.IN_IP", "LOG.IN_PORT", "LOG.TO","LOG.OUTSIDE", "LOG.OUT_IP", "LOG.OUT_PORT", "LOG.DURATION","LOG.HR", "LOG.MIN", "LOG.SEC") delimiters("/: ") flags(escape-none) template("${MSGONLY}")); }; destination messages { file("/var/log/messages"); }; destination d_xlate_start { sql(type(mysql) username("user") password("pass") database("nat") table("start") columns("s_time DATETIME", "proto VARCHAR(4)", "in_ip VARCHAR(15)", "in_port VARCHAR(5)", "out_ip VARCHAR(15)", "out_port VARCHAR(5)") values("$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC", "${LOG.PROTOCOL}", "${LOG.IN_IP}", "${LOG.IN_PORT}", "${LOG.OUT_IP}", "${LOG.OUT_PORT}")); }; destination d_xlate_stop { sql(type(mysql) username("user") password("pass") database("nat") table("stop") columns("s_time DATETIME", "e_time DATETIME", "proto VARCHAR(4)", "in_ip VARCHAR(15)", "in_port VARCHAR(5)", "out_ip VARCHAR(15)", "out_port VARCHAR(5)") values("DATE_SUB(\"$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC\", INTERVAL \"${LOG.HR}:${LOG.MIN}:${LOG.SEC}\" HOUR_SECOND)", "$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC", "${LOG.PROTOCOL}", "${LOG.IN_IP}", "${LOG.IN_PORT}", "${LOG.OUT_IP}", "${LOG.OUT_PORT}")); }; destination console_all { file("/dev/tty12"); }; log { source(s_xlate); filter(f_xlate_start); parser(p_xlate); destination(d_xlate_start); flags(final); }; log { source(s_xlate); filter(f_xlate_stop); parser(p_xlate); destination(d_xlate_stop); flags(final); }; log { source(src); destination(messages); }; log { source(src); destination(console_all); };

2 2

Chained changing IP addresses to FQDN
by Jason Carr 28 Dec '09

28 Dec '09

Hello, I have a syslog infrastructure using syslog-ng comprising of three tiers: probes that accept messages and forwards them to the broker, a broker that routes and/or duplicates messages to the appropriate storage devices, and storage devices. All forward using the tcp("hostname"); as a destination. Basically it looks like this: machine1 ==udp==> +-------+ +--------+ +-----------+ machine2 ==udp==> | probe | ==tcp==> | broker | ==tcp==> | storage 1 | machine3 ==udp==> +-------+ +--------+ +-----------+ || +-----------+ ++=======tcp==> | storage 2 | +-----------+ The probes rewrite the hostname to the IP address that the packet came from using the chain_hostnames(no) and keep_hostname(no) options. One of the requirements of one specific storage device is to change the IP addresses into hostnames. I'm having difficulty on the storage device switching the IP address in the log message to the FQDN. I have tried all combinations I can think of of chain_hostnames and keep_hostname and cannot seem to get the IP address replaced with the FQDN. Is there a way to replace the IP address with the FQDN while receiving the messages from an intermediary? Thank you, Jason

4 5