November 2010 - syslog-ng - lists.balabit.hu

[Bug 42] New: capabilities, chown, chmod
by bugzilla＠bugzilla.balabit.com 20 Dec '12

20 Dec '12

https://bugzilla.balabit.com/show_bug.cgi?id=42 Summary: capabilities, chown, chmod Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: zbyniu(a)pld-linux.org Type of the Report: bug Estimated Hours: 0.0 Let's take a look at syslog-ng-3.0.1/src/affile.c lines 60-83 1. CAP_SYS_ADMIN is needed only for /proc/kmsg, it is added w/o check 2. CAP_DAC_READ_SEARCH should be added only if open fail with errno 13 2a. CAP_DAC_OVERRIDE should be added only if open fail with errno 13 and with CAP_DAC_READ_SEARCH set 3. fchown needs CAP_CHOWN unconditionaly 4. fchmod needs CAP_FOWNER if file owner != euid (root here) 5. all caps should be restored summary: - CAP_SYS_ADMIN and CAP_DAC_OVERRIDE are set always even if unnecessary, and permanently - owner, group and perm doesn't work -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 10

[Bug 96] New: pdbtool misleading error message
by bugzilla＠bugzilla.balabit.com 01 Nov '11

01 Nov '11

https://bugzilla.balabit.com/show_bug.cgi?id=96 Summary: pdbtool misleading error message Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: czanik(a)balabit.hu Type of the Report: --- Estimated Hours: 0.0 When trying to test a non-existent file with pdbtool it gives misleading error messages and even calls an external application before failing. czanik@linux-6y8u:~/patterndb> pdbtool test --validate uw-imapd.ceee uw-imapd.ceee: Unable to detect patterndb version, please write the <patterndb> tag on a single line warning: failed to load external entity "/usr/share/syslog-ng/xsd/patterndb-0.xsd" Schemas parser error : Failed to locate the main schema resource at '/usr/share/syslog-ng/xsd/patterndb-0.xsd'. WXS schema /usr/share/syslog-ng/xsd/patterndb-0.xsd failed to compile warning: failed to load external entity "uw-imapd.ceee" uw-imapd.ceee: xmllint returned an error, the executed command was: xmllint --noout --nonet --schema /usr/share/syslog-ng/xsd/patterndb-0.xsd uw-imapd.ceeeError opening classifier configuration file; filename='uw-imapd.ceee', error='No such file or directory (2)' I think, that the proper behavior would be, that pdbtool detect that the file is nonexistent, prints a message about it (without any other misleading messages) and quits without calling external apps. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[Bug 14] New: Maintain symlinks to current and previous log output files...
by bugzilla＠bugzilla.balabit.com 28 Sep '11

28 Sep '11

https://bugzilla.balabit.com/show_bug.cgi?id=14 Summary: Maintain symlinks to current and previous log output files... Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=218688 OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: enhancement Estimated Hours: 0.0 >From bugs.debian.org: I'm hoping that upstream might consider adding functionality to syslog-ng to allow it to track current and previous log files and maintain symlinks to them, as a user option. This replicates one of the options that I (and others) find useful in cronolog. This has been previously discussed on the syslog-ng mailing list, though apparently nothing fully came of it. The archive of that discussion is at: https://lists.balabit.hu/pipermail/syslog-ng/2002-June/003452.html Obviously, it's probably somewhat of a low priority, but it would be nice. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

filter/parse based on certificate attributes?
by Christian Tramnitz 22 Feb '11

22 Feb '11

With syslog 3.0 and ssl support using mutual certificate authentication is it possible to parse/filter/tag based on attributes in the certificate? I'd like to have a common listener and then relay or append messages based on client-cert attribute values... (Sorry if this message is arriving more than once, I seem to have problems with posting through Gmane.) Regards, Christian

4 4

[Bug 92] New: Allow user to specify SSL/TLS cipher suite for connections
by bugzilla＠bugzilla.balabit.com 11 Jan '11

11 Jan '11

https://bugzilla.balabit.com/show_bug.cgi?id=92 Summary: Allow user to specify SSL/TLS cipher suite for connections Product: syslog-ng Version: 3.1.x Platform: PC OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: brett.edgar(a)truedigitalsecurity.com Type of the Report: enhancement Estimated Hours: 0.0 Created an attachment (id=22) --> (https://bugzilla.balabit.com/attachment.cgi?id=22) Patch to allow user to specify acceptable TLS cipher suites. Some compliance regimens (e.g., the PCI DSS) require SSL/TLS connections to disable weak (<128 bit key length) ciphers and old protocols like SSLv2. Syslog-ng already disables SSLv2 by default, but there is no way to disable the weak ciphers without modifying the source with every new release. I have developed a very small patch that adds a configuration file line with the tls { } stanza to specify which TLS ciphers can be used. Example: source tlssrc { tcp(ip(1.2.3.4) port(514) max-connections(32) tls( key_file("/etc/syslog-ng/server.key") cert_file("/etc/syslog-ng/server.crt") cipher_suite("ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:!SSLv2") peer_verify(optional-untrusted)) ); }; -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

memory exhausted in /opt/syslog-ng/etc/syslog-ng.conf at line 5347
by Mukarram Syed 17 Dec '10

17 Dec '10

Hi , I am getting the following error when starting syslog-ng.conf file which has more than 5000 lines in it and getting the following error: # service syslog-ng start memory exhausted in /opt/syslog-ng/etc/syslog-ng.conf at line 5347. syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng [FAILED] When I truncate the file to < 5000 lines it starts up fine. This is running version syslog-ng-3.0.8-1.rhel5.x86_64 Mailing list does not have any clues to it. Anything in the syslog-ng.conf file that needs to be done to accept more lines? Any ideas would be appreciated. Thanks # mukarram Mukarram Syed

6 23

[Bug 97] New: syslog-ng crashes after SIGHUP
by bugzilla＠bugzilla.balabit.com 04 Dec '10

04 Dec '10

https://bugzilla.balabit.com/show_bug.cgi?id=97 Summary: syslog-ng crashes after SIGHUP Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: zhengxiang.pan(a)alcatel-lucent.com Type of the Report: bug Estimated Hours: 0.0 Syslog-ng 3.0.6 crashes with following trace: Program terminated with signal 11, Segmentation fault. [New process 6311] #0 0x08063558 in log_source_group_queue (s=0x8ca6e00, msg=0x8caecc0, path_options=0xbfffaf18) at sgroup.c:98 98 (*self->processed_messages)++; (gdb) bt #0 0x08063558 in log_source_group_queue (s=0x8ca6e00, msg=0x8caecc0, path_options=0xbfffaf18) at sgroup.c:98 #1 0x08070580 in log_source_queue (s=0x8cadc78, msg=0x8caecc0, path_options=0xbfffaf74) at logpipe.h:121 #2 0x08063e80 in log_reader_fd_dispatch (source=0x8cadd10, callback=0, user_data=0x0) at logpipe.h:121 #3 0x08080081 in g_main_context_dispatch () #4 0x08083103 in g_main_context_iterate () #5 0x0808327f in g_main_context_iteration () #6 0x0804b52f in main_loop_run (cfg=0xbfffb0e8) at main.c:163 #7 0x0804bbcd in main (argc=147613904, argv=0xbfffb110) at main.c:443 The problem happens from version 3.0.6 ( I did not test other version lower than that) until the lastest 3.1.3. I guess what happens is that when SIGHUP is recevied, some connections are persisted, while the persistent connections points to the already-freed pipe (via pipe_next), if there are messages coming before the freed-pipes are replaced, the messages are forwarded to the freed-pipe handler. For version 3.1.3, in logpipe.c, log_pipe_forward_msg() may add check the pipe_next flags, however this may be not enough. log_pipe_forward_msg(LogPipe *self, LogMessage *msg, const LogPathOptions *path_options) { if (self->pipe_next && self->flags&PIF_INITIALIZED) { log_pipe_queue(self->pipe_next, msg, path_options); -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

hostname incorrect after upgrade to 3.1.2
by w3euu 01 Dec '10

01 Dec '10

I have used syslog-ng for many years and have been a faithful reader of the mailing list, but do not believe I have ever had occasion to post. Thank you for an excellent product and for the great support you have provided. I have always been able to solve problems by reading the archives...until now. I just completed an upgrade from source on several (6) systems from syslog-ng 3.1.1 (OSE) to 3.1.2 and then 3.1.3. All of them went smoothly, without error. However, after the upgrade to 3.1.2, one of the systems began reporting the hostname as "localhost" rather than the correct host name. The problem persisted when I upgraded to 3.1.3. When I roll it back to 3.1.1 it reports the hostname correctly. All of the systmes are fedora. Some are fc13, some are fc14. The system that failed is fc14. It is forwarding its logs to a central logger via tcp. I have checked the following: hosts file is OK. Contains only 127.0.0.1 entry as localhost dig -x returns the correct hostname hostname returns the correct hostname tcpdump confirms that syslog-ng is reporting "localhost" I was unable to correct the problem by changing global options. Global options are: options { flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); check_hostname(yes); chain_hostnames(no); keep_hostname (no); stats_freq (43200); mark_freq (1200); keep_timestamp (no); # send_time_zone (-04:00); }; I have googled but have not found anything that seemed relavant. Not sure how to procede to correct this situation. Any ideas would be appreciated. I would be happy to post additional data that will help.

2 6

New syslog-ng poll: how many platforms do you use?
by Robert Fekete 30 Nov '10

30 Nov '10

Continuing our survey to get a picture about how you use syslog-ng, our next poll is online. The question is, how many different platforms do you use syslog-ng on? Please count every distribution or architecture separately. For example, if you are running syslog-ng on 200 identical servers that all run the 64-bit version of RHEL 5, that's only a single platform. If you are using both the 32-bit and 64-bit version of the same distro, that's two platforms. If you have a mix of RHEL 4, 5, 6 servers and have 32-bit and 64-bit versions of each, that's already 6 platforms, and so on. You find the poll at <a href="http://www.balabit.com/poll/ syslog_ng_platforms">http://www.balabit.com/poll/syslog_ng_platforms</ a> The results of the <a href="http://www.balabit.com/poll/ syslog_ng_admin_guide">latest poll</a> show that the vast majority of you use the PDF version of the syslog-ng admin guide - I suspected this, but haven't thought that the HTML versions will lag behind so badly. Though if I have some time, I'll compare this to the download statistics. Thanks for voting!

1 0

providing Windows Event Viewer logs into syslog
by Oguz Yilmaz 30 Nov '10

30 Nov '10

Hi, I wanted to start a thread to see alternatives for providing Windows logs into a linux based syslog server. I would be grateful to see my alternatives, as free software as propriatery software. Regards, -- Oguz YILMAZ

3 2