March 2009 - syslog-ng - lists.balabit.hu

[Bug 24] New: .pid file not set correctly (STOP not working)
by bugzilla＠bugzilla.balabit.com 30 Apr '09

30 Apr '09

https://bugzilla.balabit.com/show_bug.cgi?id=24 Summary: .pid file not set correctly (STOP not working) Product: syslog-ng Version: unspecified Platform: Other OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: man(a)inspektsecurity.com Type of the Report: --- Estimated Hours: 0.0 Hi. in installed syslog-ng 3.0.1 PE (syslog-ng-premium-edition-3.0.1-linux-i386.run). The installation is on a CentOS 5 system (RedHat spin-off). Although the program itself works fine, the RC scripts STOP command does not work. I traced the problem down to the .pid file not being set correctly. According to the RC script the .pid file shoud be in: PIDFILE=$SYSLOGNG_PREFIX/var/run/syslog-ng.pid resulting in the below when running STOP/RESTART ------------ [root@test-server:~] /etc/init.d/syslog-ng restart -n Restarting syslog-ng: -n Stopping syslog-ng: -n Starting syslog-ng: Error binding socket; addr='AF_INET(0.0.0.0:514)', error='Address already in use (98)' Error initializing source driver; source='tcp_input_syslog', id='tcp_input_syslog#0' Error initializing message pipeline; failed ------------- I found out that the pid file set is actually: /var/run/syslogd.pid So changing the RC script to: PIDFILE=/var/run/syslogd.pid seems to work. br /Marc -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

setting facility/level of source log messages ?
by bana＠docisland.org 29 Apr '09

29 Apr '09

Hi, I often meet the case where I need to centralize some purely applicative log messages (ie they don't even have a PRI header). So syslog-ng sets a default facility and severity for these messages, like kern facility and emergency severity for a source file with a "no-parse" option. Is there a clean way to change these default values by modifying the configuration file ? (and not using a source program() nor a tail | logger trick). I've already written a quick and dirty patch for my needs, but it would be great to have a native way of doing the same thing (I may have missed something in the documentation). Best Regards. -- Xavier

2 9

syslog-ng 3.0.1 dies on reload with program() destination
by Jan Rekorajski 24 Apr '09

24 Apr '09

Sorry for possible double post, I sent the first from wrong email. Hi, Syslog-ng 3.0.1 dies on reload (kill -HUP pid) when config file contains log { destination { program() } } directive set. 100% repeatable. Here are the relevant config lines: destination d_sshguard { program("/usr/sbin/sshguard -a 6"); }; # A desperate experiment #destination d_sshguard { program("read"); }; log { source(s_sys); filter(f_authpriv); destination(d_sshguard); }; >From what I managed to find with strace/ltrace, syslog-ng kills the program, does not clear some data structures and then falls face down with sigsegv/term/ill trying to restart/reattach(?) to the program. The exact same configuration works perfectly with version 2.0.10. -- Jan Rekorajski | ALL SUSPECTS ARE GUILTY. PERIOD! baggins<at>mimuw.edu.pl | OTHERWISE THEY WOULDN'T BE SUSPECTS, WOULD THEY? BOFH, MANIAC | -- TROOPS by Kevin Rubio

5 8

[PATCH] Cygwin: missing colon in default syslog-ng.conf
by Corinna Vinschen 14 Apr '09

14 Apr '09

Hi, The Cygwin service installer script creates a version entry without a colon, which leads to warnings. The below patch fixes that. Please apply. Thanks, Corinna --- contrib/cygwin-packaging/syslog-ng-config.ORIG 2009-03-25 17:08:34.000000000 +0100 +++ contrib/cygwin-packaging/syslog-ng-config 2009-03-19 19:21:34.000000000 +0100 @@ -205,7 +205,7 @@ if [ ! -f "${SYSCONFDIR}/syslog-ng.conf" then echo "Creating default ${SYSCONFDIR}/syslog-ng.conf file" cat > ${SYSCONFDIR}/syslog-ng.conf << EOF -@version 3.0 +@version: 3.0 options { keep_hostname(yes); owner("system"); -- Corinna Vinschen Cygwin Project Co-Leader Red Hat

4 6

Database field types
by Liam Kirsher 14 Apr '09

14 Apr '09

Hi -- I notice that when the database tables get created all the fields are 'text' type. That is okay. However, it might in some cases be convenient for us to have different field types. Is there any problem with that? If we create the table with the desired field types, will that take care of it (assuming the data actually matches the type)? Liam -- Liam Kirsher PGP: http://liam.numenet.com/pgp/

2 7

[PATCH] typo in misc.c, function resolve_user?
by Corinna Vinschen 01 Apr '09

01 Apr '09

Hi, a Cygwin user got a message in the syslog every time the syslog-ng service started up: Error resolving user; user='system' He also found why this message was generated. The function resolve_user() in misc.c appears to have a typo. If the incoming user argument points to a non-empty string, resolve_user() just returns NULL. So, the following getpwnam is only called for an empty user string. This looks like a typo. One possible fix below. However, maybe the intention was actually to test for if (!user) instead of if (!*user) ??? Corinna --- src/misc.c.ORIG 2009-03-25 17:01:15.000000000 +0100 +++ src/misc.c 2009-03-25 17:01:29.000000000 +0100 @@ -274,7 +274,7 @@ resolve_user(const char *user, uid_t *ui struct passwd *pw; *uid = 0; - if (*user) + if (!*user) return FALSE; pw = getpwnam(user); -- Corinna Vinschen Cygwin Project Co-Leader Red Hat

2 3

INCLUDE not working for me :(
by Charles Jennings 01 Apr '09

01 Apr '09

I have implemented the following version: syslog-ng -V syslog-ng 3.0.1 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline-- 3.0#master#93a342dae3a2b0cb15811d0c34ea7f58b3fba14e Compile-Date: Mar 13 2009 16:29:42 Enable-Threads: off Enable-Debug: on Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: off When I try to implement file inclusion, I get an error at the point where I include the file. I essentially cut the section out of the main syslog-ng.conf file, place it into a new file and replace the area cut in the main syslog-ng.conf file with: include "/etc/syslog-ng/syslog-ng-local.conf"; When I do this I get the following error on service start: service syslog-ng start Starting syslog-ng: syntax error in /etc/syslog-ng/syslog-ng.conf at line 114. [FAILED] Charles Jennings | Network Security Engineer "There is one safeguard known generally to the wise, which is an advantage and security to all, but especially to democracies as against despots. What is it? Distrust." Demosthenes (c 384-322 B.C.), Greek orator. Second Philippic, sct. 24 (344 B.C.)

2 6

syslog 3.0 and fra_digits()
by Joe Hansen 01 Apr '09

01 Apr '09

I just installed syslog 3.0 and added fra_digits(3) in my options, and restarted syslog-ng. I still don't see the milliseconds in the logs. I don't want to use ISO format. Can anyone suggest a solution? Thanks, Jo __________________________________________________________________ Yahoo! Canada Toolbar: Search from anywhere on the web, and bookmark your favourite sites. Download it now http://ca.toolbar.yahoo.com.

2 2

syslog-ng using ssl
by Luigi Augello 27 Mar '09

27 Mar '09

Hello some days ago I sent this message ello I try to use ssl ad I have the follow scenario: but just now i not solved. Anyone may help me Tanks Luigi One server (192.168.1.2) with this syslog.ng.conf ########################################### @version:3.0 source s_sk{file("/var/log/messages");}; source s_ssl{ tcp(ip("0.0.0.0") port (1999) tls(key_file("/root/Scaricati/certificati/privkey.pem") cert_file("/root/Scaricati/certificati/cacert.pem")));}; destination d_file{file("/var/log/syslog-ng.log");}; log{source(s_sk);destination(d_file);}; log{source(s_ssl);destination(d_file);}; One client (192.168.1.3) with this syslog.ng.conf ################################################### @version:3.0 source s_sk{file("/var/log/messages");}; destination d_file{file("/var/log/syslog-ng.log");}; destination d_ssl{tcp("192.168.1.2" port (1999) tls(ca_dir("/root/software/ca/")));}; log{source(s_sk);destination(d_file);}; log{source(s_sk);destination(d_ssl);}; I haven't a CA certificate and I use a self-signed certificate created by these instructions opennsl genrsa -out privkey.pem opennsl req -new -x509 -key prixkey.pem -out cacert.pem -days 1095 I follow step by step the instructions on "The syslog-ng Administrators guide " page 58 and so on and I copied the cacert.pem generated in the server in the client and I use ln -s .... When I try to start the server it starts. Though the client doesn't give me any errors it doesn't start. I suppose the certificate may crate some problems. tanks for help Luigi

2 3

[PATCH] autocreate fifo
by Peter Warasin 27 Mar '09

27 Mar '09

Hi list If you define a pipe as log destination, the pipe must exist before syslog starts, otherwise syslog logs that it cannot write to the pipe. That should be fine normally, but if *all* messages go to that pipe syslog will cause a log-loop with those error messages. The attached patch creates the fifo automatically. kind regards peter -- :: e n d i a n :: open source - open minds :: peter warasin :: http://www.endian.com :: peter(a)endian.com

2 1