August 2009 - syslog-ng - lists.balabit.hu

syslog-ng 3.0.4 has been released
by devel＠balabit.hu 05 Aug '09

05 Aug '09

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.0.4 SUMMARY : new stable release DATE : Aug 5, 2009 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.0.4) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.4 Wed, 05 Aug 2009 12:51:31 +0200 Bugfixes: * The use of the tcp6 destination caused aborts during startup, which has now been fixed. * The window size used for flow control could be decremented to a negative value in case multiple incoming connections overflowed the queue. This could cause an abort if a SIGHUP was received at this time. * Fixed a possible segmentation fault under Solaris if the syslog() driver was used without explicitly specifying a transport() option. * Fixed parse error handling when loading the patterndb. * Fixed the handling of door initialization failures on Solaris. Other changes: * Fixed performance degradation when using the host_override/program_override options. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system…

1 0

IPv6 destination host + port causes assertion failure in gsockaddr.h
by Alexei Aliaev 05 Aug '09

05 Aug '09

Hi, I am trying to solve an issue with syslog-ng 3.0.3 in IPv6 environment... I have a destination specified in my config file as such: destination collector { tcp6("fdab:228b:77af:6e7e:206:5bff:fef6:e2af" port(514)); }; When I run syslog-ng, I get this: file gsockaddr.h: line 86 (g_sockaddr_inet_get_sa): assertion failed: (g_sockaddr_inet_check(s)) Aborted I tracked down that this is caused by the destination definition above. The destination address is of the same box and port 514 is open and listening. If I remove the port, everything seems to start-up fine but it tries to connect to the specified IP to port 0 and I keep getting connection refused messages. Are there any known issues that could explain this? -- Alexey

2 7

Re: [syslog-ng] 3.0.3: Accessing unix-dgram source appears to break all logging
by Markus Stalder 05 Aug '09

05 Aug '09

> But who and what is reading the fifo /tmp/.tivoli/.logfile. in your > configuration? Opening a fifo for write will hang until someone else opens > it for read, that's how named pipes work... Thanks for your reply. As said before, the config worked just fine with 2.0.9. Also, the following config snippet will produce the exact same effect, ALL logging will stop, and there's no fifo involved at all: destination dings { udp("172.30.10.204" port(514) ); file("/var/monitoring/chk/logs/chk.log"); }; filter f_local5 { facility(local5); }; filter f_info { level(info); }; log { source(src); filter(f_local5); filter(f_info); destination(dings); }; So, it got to be about the source, since only this snippet and the previous one refer to the unix-dgram source "src". If I comment them, everything works fine, and I got a few dozen other log-entries in the config which refer to the unix-stream source "s_all". Again, *ALL* logging stops! Or, put differently: syslog-ng stops to log anything. It stops working. Thanks, Markus

1 0

log analyzer
by dreamywoman 04 Aug '09

04 Aug '09

hi everybody I would like to know that what web analyzer i can integrate with syslog-ng ? Best Roya

3 2

analyzer
by dreamywoman 02 Aug '09

02 Aug '09

Hi all Tanx for ur reply but I have installed php-syslog-ng but i need something more. I need one analyzer that realize attacks because I have different mailer. Best Roya

1 0