February 2009 - syslog-ng - lists.balabit.hu

Syslog-ng refuses to create directories on Linux
by John Chajecki 24 Feb '09

24 Feb '09

We have been running a syslog server on a Solaris server for some time. The server collects syslogs from a number of sources and places the log data into separate files for each system according to the host IP address and date. Recently, we have begun migrating the facility to a Linux server running Novell SuSE Linux 10. (SLES10) 64bit. We are running syslog-ng version 2.0.9-6.1 for the 64bit platform which I obtained from OpenSuSE and that is supposed to be compatible with SLES10. The problem is that although I am using essentially the same config file I am getting my log filled with: Feb 24 14:55:04 itssyslog syslog-ng[10090]: Error opening file for writing; filename='/media/syslog/HOSTS/192.168.1.146', error='Permission denied (13)' The directories /media, /media/syslog and /media/syslog/HOSTS have permissions of 0640. This is what happens in strace: open("/var/run/syslog-ng.pid", O_WRONLY|O_CREAT|O_TRUNC|O_NOCTTY, 0600) = 7 write(7, "10090", 5) = 5 close(7) = 0 open("/dev/null", O_RDONLY) = 7 dup2(7, 0) = 0 close(7) = 0 open("/dev/null", O_WRONLY) = 7 dup2(7, 1) = 1 dup2(7, 2) = 2 close(7) = 0 setsid() = 10090 poll([{fd=3, events=POLLIN}, {fd=4, events=POLLIN}], 2, 0) = 0 uname({sys="Linux", node="itssyslog", ...}) = 0 open("/var/log/messages", O_WRONLY|O_NONBLOCK|O_APPEND|O_CREAT|O_NOCTTY, 0640) = 7 fcntl(7, F_GETFD) = 0 fcntl(7, F_SETFD, FD_CLOEXEC) = 0 fchown(7, 0, 4294967295) = 0 fchown(7, 4294967295, 0) = 0 fchmod(7, 0640) = 0 poll([{fd=7, events=POLLOUT, revents=POLLOUT}, {fd=3, events=POLLIN}, {fd=4, eve nts=POLLIN}], 3, 29983) = 1 stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1323, ...}) = 0 write(7, "Feb 24 14:16:50 itssyslog syslog"..., 83) = 83 poll([{fd=3, events=POLLIN}, {fd=4, events=POLLIN, revents=POLLIN}], 2, 29983) = 1 recvfrom(4, "<22>Feb 24 14:12:24 192.168.193."..., 8192, 0, {sa_family=AF_INET, sin_port=htons(61643), sin_addr=inet_addr("192.168.1.146")}, [16]) = 155 stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1323, ...}) = 0 brk(0x5be000) = 0x5be000 brk(0x5df000) = 0x5df000 open("/media/syslog/HOSTS/192.168.1.146/2009/02/24/192.168.1.146.log", O_WRONLY| O_NONBLOCK|O_APPEND|O_CREAT|O_NOCTTY, 0640) = -1 ENOENT (No such file or directory) stat("/media", {st_mode=S_IFDIR|0640, st_size=4096, ...}) = 0 stat("/media/syslog", {st_mode=S_IFDIR|0640, st_size=4096, ...}) = 0 stat("/media/syslog/HOSTS", {st_mode=S_IFDIR|0640, st_size=4096, ...}) = 0 stat("/media/syslog/HOSTS/192.168.1.146", 0x7fff7eb5c400) = -1 ENOENT (No such file or directory) mkdir("/media/syslog/HOSTS/192.168.1.146", 0640) = -1 EACCES (Permission denied) recvfrom(4, 0x583fe0, 8192, 0, 0x7fff7eb5c780, 0x7fff7eb5c80c) = -1 EAGAIN (Resource temporarily unavailable) poll([{fd=3, events=POLLIN}, {fd=4, events=POLLIN}], 2, 0) = 0 ..... For some reason, the syslog-ng daemon tries to create the directory structure but fails with the Permission denied error. itssyslog:/var/log # The daemon is running as root: ps -ef |grep syslog-ng root 10077 1 0 14:15 ? 00:00:00 /sbin/syslog-ng I have tried creating a directory structure manually and I have no problem creating, writing to and removing the directories. Just to test, I created another directory stucture /syslog/HOSTS with permissions 0777. I restarted the syslog-ng service but I got the same error. I also ran the syslog-ng executable manually as root, but still got the same problem. What's stopping syslog-ng from creating the directory structure? Does it perhaps run in a chroot jail by default? As I mentioned, this worked fine on the Solaris system. John.

2 3

syslog-ng takes 100% CPU(RHEL 5)
by Yoshinobu Ushida 24 Feb '09

24 Feb '09

Hello, We are running syslog-ng-2.1.1-5.el5 on a RHEL5. The problem in HP-UX was heard fixed and I want to do the upgrade. but,libdbi8.so.0() is necessary for 2.1.3. This is not found. Where is libdbi8.so.0()? Please tell me. I am sorry in clumsy English. I hope help.

2 1

Kevin Gorski/IS/NEU is out of the office.
by K.Gorski＠neu.edu 23 Feb '09

23 Feb '09

I will be out of the office starting Mon 02/23/2009 and will not return until Mon 03/02/2009. I will respond to your message when I return Thursday morning.

1 0

3.01 Starting system logger: Error resolving user; user='root'
by Tim Boyer 17 Feb '09

17 Feb '09

I've compiled and installed 3.0.1. I'm seeing something surface that was a reported bug in the 2.1 era. Perhaps it's the same patch? [root@princeton syslog-ng-3.0.1]# service syslog-ng start Starting system logger: Error resolving user; user='root' syntax error in /etc/syslog-ng.conf at line 61. [FAILED] root exists, of course, and it doesn't matter which username I put there - good or bad, they all fail. -- Tim Boyer Denman Tire Corporation

2 2

file source driver questions
by Michael Hocke 17 Feb '09

17 Feb '09

Hi, I have an application here that does not use syslog but writes all log messages straight into a file. I want to use syslog-ng to pick up the entries of that file and send them over to my log repository via syslog. I am running 3.0.1 and the config looks as follows: * Client side (radserver): source s_accounting { file ("/opt/CSCOar/logs/accounting.log" follow_freq (1) program_override ("radius") flags (no-parse)); }; destination d_archive { udp ("a.b.c.d"); }; log { source (s_accounting); destination (d_archive); }; * Server side (a.b.c.d): source s_udp { udp (); }; destination d_radius { file ("/usr/local/var/log/remote/$HOST_FROM/ accounting.log" template ("$MSGONLY\n")); }; filter f_radius { host ("radserver") and facility (kern); }; log { source (s_udp); filter (f_radius); destination (d_radius); flags (final); }; That works but there are a couple of minor things. - By default all messages coming from the file source driver are tagged with the kern facility. I was not able to find this in the documentation but the source code (cfg-grammar.y) revealed that the file driver accepts the options "facility()" and "level()" to change this behavior. source s_accounting { file ("/opt/CSCOar/logs/accounting.log" follow_freq (1) program_override ("radius") flags (no-parse) facility (local7)); }; fixed that problem. - Empty lines seem to be ignored and not transmitted. The entries: "La la blah blah Hi There good-bye" end up as "La la blah blah Hi There good-bye" in my log file on the server side. Is there a way to enable that? Thanks! - Michael

2 2

[Bug 32] New: syslog-ng stops listening after receiving a zero length udp packet
by bugzilla＠bugzilla.balabit.com 17 Feb '09

17 Feb '09

https://bugzilla.balabit.com/show_bug.cgi?id=32 Summary: syslog-ng stops listening after receiving a zero length udp packet Product: syslog-ng Version: 3.0.x Platform: Other OS/Version: Other Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: ffs(a)ccn.net Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=12) --> (https://bugzilla.balabit.com/attachment.cgi?id=12) afsocket EOF patch Hi, if syslog-ng has an udp() source configured it stops listening after receiving a zero length udp packet. In debug mode it logs 'EOF occurred while reading'. After this message no udp messages get processed anymore. After a restart syslog-ng is logging again. As this bug is reproducible it could be abused for DOS attacks also. Tested on: Solaris 8/9 Attached is a patch for version 3.0.1. There might be a better way to solve this problem, but it's working for me. Thank you for syslog-ng! Florian -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 7

[Bug 33] New: syslog-ng 2.0.10 compile error over solaris
by bugzilla＠bugzilla.balabit.com 17 Feb '09

17 Feb '09

https://bugzilla.balabit.com/show_bug.cgi?id=33 Summary: syslog-ng 2.0.10 compile error over solaris Product: syslog-ng Version: 2.1.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: girl111_2002(a)hotmail.com Type of the Report: bug Estimated Hours: 0.0 gcc -g -O2 -Wall -o loggen loggen.o -lpthread -lresolv -lnsl -lrt -lsocket -ldoor -lfl -lglib-2.0 -L/usr/local/lib -levtlog -lwrap Undefined first referenced symbol in file yylex /usr/sfw/lib/gcc/sparc-sun-solaris2.10/3.4.3/../../../libfl.so deny_severity /usr/sfw/lib/gcc/sparc-sun-solaris2.10/3.4.3/../../../libwrap.so allow_severity /usr/sfw/lib/gcc/sparc-sun-solaris2.10/3.4.3/../../../libwrap.so ld: fatal: Symbol referencing errors. No output written to loggen collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `loggen' Current working directory /opt/software/syslog-ng/syslog-ng-2.0.10/tests/loggen *** Error code 1 The following command caused the error: set fnord $MAKEFLAGS; amf=$2; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='unit functional loggen'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || case "$amf" in *=*) exit 1;; *k*) fail=yes;; *) exit 1;; esac; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /opt/software/syslog-ng/syslog-ng-2.0.10/tests *** Error code 1 The following command caused the error: set fnord $MAKEFLAGS; amf=$2; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src tests doc contrib solbuild tgzbuild'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || case "$amf" in *=*) exit 1;; *k*) fail=yes;; *) exit 1;; esac; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /opt/software/syslog-ng/syslog-ng-2.0.10 *** Error code 1 make: Fatal error: Command failed for target `all' -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

grouping of sources
by Joe Shaw 16 Feb '09

16 Feb '09

Hi, Is there a way to create a "group" of sources for log rules? This would be quite helpful when using the new include functionality for configuration files. To give you an idea of my setup: I have two files. One is a site config, which will be the same for every host. It contains global configuration and well-known destinations. The other file differs per-host, with different sources. I would like to be able to set up log rules for routing messages from those disparate sources to the well-known destinations inside the site config, but there doesn't seem to be any way to do it. Here's a pseudo-example. Site config: options { ... }; destination d_whatever { ... }; Host 1 config: source s_one { ... }; log { source(s_one); destination(d_whatever); }; Host 2 config: source s_two_alpha { ... }; source s_two_beta { ... }; log { source(s_two_alpha); source(s_two_beta); destination(d_whatever); }; Ideally, I'd be able to do something like this: Site config: options { ... }; destination d_whatever { ... }; log { source(s_aggregate); destination(d_whatever); }; Host 1 config: source s_one { ... }; source s_aggregate { source(s_one); }; Host 2 config: source s_two_alpha { ... }; source s_two_beta { ... }; source s_aggregate { source(s_two_alpha); source(s_two_beta); }; This setup maintains a nice, clean abstraction of the logging rules away from the source data. Is there any way to do something like this? Thanks, Joe

2 5

File descriptor leaks with 3.0.1
by chris packham 16 Feb '09

16 Feb '09

Hi, We're running a test where syslog-ng gets frequently sighup-ed (about every 5 seconds) and what we are finding is that after a while (sorry don't know specifically how may times) we run into a problem where syslog-ng starts experiencing errors reading its config. We are making use of the new 'include' feature (which is brilliant by the way). Here's a snippet of the internal() log 2009 Feb 17 00:05:01 syslog.notice syslog-ng[838]: Configuration reload request received, reloading configuration; 2009 Feb 17 00:05:04 syslog.notice syslog-ng[838]: Configuration reload request received, reloading configuration; 2009 Feb 17 00:05:37 syslog.notice syslog-ng[838]: Configuration reload request received, reloading configuration; 2009 Feb 17 00:05:43 syslog.notice syslog-ng[838]: Configuration reload request received, reloading configuration; 2009 Feb 17 00:05:46 syslog.err syslog-ng[838]: Error opening include file; filename='/etc/syslog-conf.d/trace-cfg', depth='1' 2009 Feb 17 00:05:46 syslog.notice syslog-ng[838]: Configuration reload request received, reloading configuration; 2009 Feb 17 00:05:47 syslog.err syslog-ng[838]: Error accepting new connection; error='Too many open files (24)' 2009 Feb 17 00:05:47 syslog.err syslog-ng[838]: Error accepting new connection; error='Too many open files (24)' /proc/$(pidof syslog-ng)/fd is also hinting that the included files aren't being closed. lr-x------ 1 root root 64 Feb 17 00:05 4042 -> /tmp/etc/syslog-conf.d/trace-cfg lr-x------ 1 root root 64 Feb 17 00:05 4043 -> /tmp/etc/syslog-conf.d/1_standalone lr-x------ 1 root root 64 Feb 17 00:05 4044 -> /tmp/etc/syslog-conf.d/buffered lr-x------ 1 root root 64 Feb 17 00:05 4045 -> /tmp/etc/syslog-conf.d/console lr-x------ 1 root root 64 Feb 17 00:05 4046 -> /tmp/etc/syslog-conf.d/email lr-x------ 1 root root 64 Feb 17 00:05 4047 -> /tmp/etc/syslog-conf.d/host lr-x------ 1 root root 64 Feb 17 00:05 4048 -> /tmp/etc/syslog-conf.d/permanent lr-x------ 1 root root 64 Feb 17 00:05 4049 -> /tmp/etc/syslog-conf.d/stats lr-x------ 1 root root 64 Feb 17 00:05 4050 -> /tmp/terminal lr-x------ 1 root root 64 Feb 17 00:05 4051 -> /tmp/etc/syslog-conf.d/trace-cfg lr-x------ 1 root root 64 Feb 17 00:05 4052 -> /tmp/etc/syslog-conf.d/1_standalone lr-x------ 1 root root 64 Feb 17 00:05 4053 -> /tmp/etc/syslog-conf.d/buffered lr-x------ 1 root root 64 Feb 17 00:05 4054 -> /tmp/etc/syslog-conf.d/console lr-x------ 1 root root 64 Feb 17 00:05 4055 -> /tmp/etc/syslog-conf.d/email lr-x------ 1 root root 64 Feb 17 00:05 4056 -> /tmp/etc/syslog-conf.d/host lr-x------ 1 root root 64 Feb 17 00:05 4057 -> /tmp/etc/syslog-conf.d/permanent lr-x------ 1 root root 64 Feb 17 00:05 4058 -> /tmp/etc/syslog-conf.d/stats lr-x------ 1 root root 64 Feb 17 00:05 4059 -> /tmp/terminal Also seems to be present in the latest version checked out from the git repo but I'll do some more digging. Thanks, Chris

1 0

Timezone problem?!
by Charles Chan 16 Feb '09

16 Feb '09

Recently I use the syslog-ng for log collection environment encountered a time zone problem,hope somebody can help me.Thanks The environment is like this: The apache server(PDT timezone,UTC-8) forword apache log through syslog to the syslog-ng server（CST timezone，UTC＋8）. The server with same time zones no problem between the forward. Syslog-ng test configuration is as follows: destination int_apache (file ( "/ disk3/cookie_logs/pid1 / $ YEAR-$ MONTH-$ DAY / $ (HOST). apache.log" time_zone (-08:00) template ( "$ DAY-$ HOUR $ S_DAY-$ S_HOUR $ R_DAY-$ R_HOUR $ $ ISODATE $ MSGONLY \ n ") template_escape (no));); The original apache log is: 58.240.69.161 - - - [14/Jan/2009: 22:27:47 -0800] "GET / www.example.com/HTTP/1.1" 200 2028 "-" "Mozilla/4.0 ( compatible; MSIE 7.0; Windows NT 5.1) " The syslog-ng server generated log is: 14-22 14-22 14-22 2009-01-14T22 :27:47-08: 00 58.240.69.161 - - - [14/Jan/2009: 22:27:47 -0800] "GET / www.example. com / HTTP/1.1 "200 2028" - "" Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1) " Originally generated documents should be kept in /disk3/cookie_logs/pid1/2009-01-14 However, the actual file is stored in the /disk3/cookie_logs/pid1/2009-01-15 It can be seen, in fact, syslog-ng configuration item file() use the $DAY and template() use the $DAY not with a identical Macros. Is this the syslog-ng a bug? or I configuration errors. Who can help me answer you?Thanks!

2 8