December 2010 - syslog-ng - lists.balabit.hu

[Bug 42] New: capabilities, chown, chmod
by bugzilla＠bugzilla.balabit.com 20 Dec '12

20 Dec '12

https://bugzilla.balabit.com/show_bug.cgi?id=42 Summary: capabilities, chown, chmod Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: zbyniu(a)pld-linux.org Type of the Report: bug Estimated Hours: 0.0 Let's take a look at syslog-ng-3.0.1/src/affile.c lines 60-83 1. CAP_SYS_ADMIN is needed only for /proc/kmsg, it is added w/o check 2. CAP_DAC_READ_SEARCH should be added only if open fail with errno 13 2a. CAP_DAC_OVERRIDE should be added only if open fail with errno 13 and with CAP_DAC_READ_SEARCH set 3. fchown needs CAP_CHOWN unconditionaly 4. fchmod needs CAP_FOWNER if file owner != euid (root here) 5. all caps should be restored summary: - CAP_SYS_ADMIN and CAP_DAC_OVERRIDE are set always even if unnecessary, and permanently - owner, group and perm doesn't work -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 10

[Bug 96] New: pdbtool misleading error message
by bugzilla＠bugzilla.balabit.com 01 Nov '11

01 Nov '11

https://bugzilla.balabit.com/show_bug.cgi?id=96 Summary: pdbtool misleading error message Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: czanik(a)balabit.hu Type of the Report: --- Estimated Hours: 0.0 When trying to test a non-existent file with pdbtool it gives misleading error messages and even calls an external application before failing. czanik@linux-6y8u:~/patterndb> pdbtool test --validate uw-imapd.ceee uw-imapd.ceee: Unable to detect patterndb version, please write the <patterndb> tag on a single line warning: failed to load external entity "/usr/share/syslog-ng/xsd/patterndb-0.xsd" Schemas parser error : Failed to locate the main schema resource at '/usr/share/syslog-ng/xsd/patterndb-0.xsd'. WXS schema /usr/share/syslog-ng/xsd/patterndb-0.xsd failed to compile warning: failed to load external entity "uw-imapd.ceee" uw-imapd.ceee: xmllint returned an error, the executed command was: xmllint --noout --nonet --schema /usr/share/syslog-ng/xsd/patterndb-0.xsd uw-imapd.ceeeError opening classifier configuration file; filename='uw-imapd.ceee', error='No such file or directory (2)' I think, that the proper behavior would be, that pdbtool detect that the file is nonexistent, prints a message about it (without any other misleading messages) and quits without calling external apps. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[Bug 106] New: Syslog-ng memory strdup and g_malloc leaks
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=106 Summary: Syslog-ng memory strdup and g_malloc leaks Product: syslog-ng Version: 3.2.x Platform: Other OS/Version: Solaris Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: daniel_novak(a)kb.cz Type of the Report: refactorization Estimated Hours: 0.0 We tried to compile a few last git version of syslog-3.2.1(syslog-ng-3.2.git-5f25ce47ab57774f8fe8df17bc96a006e535cb53) as well as 3.2.1 stable release. Everything is running well, but there are several minor memory leaks.We run on Solaris 10/08 on sparc platform.With libumem.so in memory debug mode MDB output is following : > ::findleaks CACHE LEAKED BUFCTL CALLER 00052288 2 00110d98 libc.so.1`strdup+0xc 00052788 1 0007de00 libglib-2.0.so.0.2513.0`g_malloc0+0x64 ---------------------------------------------------------------------- Total 3 buffers, 64 bytes =========================================================================================== > ::findleaks -dvf findleaks: maximum buffers => 4121 findleaks: actual buffers => 3967 mdb: [fef80000, fef84000): couldn't read 16384 bytes at fef80000: no mapping for address findleaks: findleaks: potential pointers => 341574 findleaks: dismissals => 196071 (57.4%) findleaks: misses => 130325 (38.1%) findleaks: dups => 11214 ( 3.2%) findleaks: follows => 3964 ( 1.1%) findleaks: findleaks: elapsed wall time => 0 seconds findleaks: CACHE LEAKED BUFCTL CALLER 00052288 2 00110d98 libc.so.1`strdup+0xc 00052788 1 0007de00 libglib-2.0.so.0.2513.0`g_malloc0+0x64 ---------------------------------------------------------------------- Total 3 buffers, 64 bytes umem_alloc_16 leak: 2 buffers, 16 bytes each, 32 bytes total ADDR BUFADDR TIMESTAMP THREAD CACHE LASTLOG CONTENTS 110d98 1097e0 1b08cf3fb0c96c 1 52288 43af4 0 libumem.so.1`umem_cache_alloc+0x210 libumem.so.1`umem_alloc+0x60 libumem.so.1`malloc+0x28 libc.so.1`strdup+0xc libsyslog-ng.so.0.0.0`cfg_lexer_lookup_keyword+0xf0 libsyslog-ng.so.0.0.0`_cfg_lexer_lex+0x18a4 libsyslog-ng.so.0.0.0`cfg_lexer_lex+0x284 libsyslog-ng.so.0.0.0`main_lex+0x1c libsyslog-ng.so.0.0.0`main_parse+0x7a4 libsyslog-ng.so.0.0.0`cfg_parser_parse+0xcc libsyslog-ng.so.0.0.0`cfg_run_parser+0x1ac libsyslog-ng.so.0.0.0`cfg_read_config+0x98 initial_init+0x5c main+0x244 _start+0x5c umem_alloc_32 leak: 1 buffer, 32 bytes ADDR BUFADDR TIMESTAMP THREAD CACHE LASTLOG CONTENTS 7de00 77b98 1b08cf406e21b0 1 52788 373ec 0 libumem.so.1`umem_cache_alloc+0x210 libumem.so.1`umem_alloc+0x60 libumem.so.1`malloc+0x28 libumem.so.1`calloc+0x58 libglib-2.0.so.0.2513.0`g_malloc0+0x64 libsyslog-ng.so.0.0.0`serialize_file_archive_new+0x1c libsyslog-ng.so.0.0.0`persist_state_load+0x54 libsyslog-ng.so.0.0.0`persist_state_start+0x34 libsyslog-ng.so.0.0.0`cfg_initial_init+0x28 initial_init+0xbc main+0x244 _start+0x5c ========================================================================= findleaks: using cached results (-f will force a full run) CACHE LEAKED BUFCTL CALLER 00052288 2 00110d98 libc.so.1`strdup+0xc 00052788 1 0007de00 libglib-2.0.so.0.2513.0`g_malloc0+0x64 ---------------------------------------------------------------------- Total 3 buffers, 64 bytes > 00110d98::umem_verify mdb: cache 110d98 () does not have redzone checking enabled > 00052288::umem_verify Summary for cache 'umem_alloc_16' clean > 00052788::umem_verify Summary for cache 'umem_alloc_32' clean ============================================================================= -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

[Bug 104] New: Add libtool option -module
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=104 Summary: Add libtool option -module Product: syslog-ng Version: 3.2.x Platform: All OS/Version: All Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: vinschen(a)redhat.com Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=30) --> (https://bugzilla.balabit.com/attachment.cgi?id=30) Patch to add libtool option -module Libtool 2.2.6 and later provides an option -module which should be used when creating shared libraries which are supposed to be used as modules which get loaded via dlopen. See the "Building modules to dlopen" chapter in `info libtool'. For Cygwin the additional benefit is that the modules are not copied into a parallel "bin" directory at installation time, which is the default otherwise to accommodate the DLL search algorithm on Windows. The attached patch just adds the -module option to each of the Makefile.am files in the modules subdir. Corinna -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 4

[Bug 14] New: Maintain symlinks to current and previous log output files...
by bugzilla＠bugzilla.balabit.com 28 Sep '11

28 Sep '11

https://bugzilla.balabit.com/show_bug.cgi?id=14 Summary: Maintain symlinks to current and previous log output files... Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=218688 OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: enhancement Estimated Hours: 0.0 >From bugs.debian.org: I'm hoping that upstream might consider adding functionality to syslog-ng to allow it to track current and previous log files and maintain symlinks to them, as a user option. This replicates one of the options that I (and others) find useful in cronolog. This has been previously discussed on the syslog-ng mailing list, though apparently nothing fully came of it. The archive of that discussion is at: https://lists.balabit.hu/pipermail/syslog-ng/2002-June/003452.html Obviously, it's probably somewhat of a low priority, but it would be nice. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

Newer libtool and autoconf versions?
by Corinna Vinschen 23 Feb '11

23 Feb '11

Hi, Right now, the current 3.2.1 sources can't be build on Cygwin. Apart from two minor problems which are fixed in git (bugzilla items 101 and 102) and a refresh of the files in contrib/cygwin-packaging (bugzilla entry 103), there's a somewhat more troubeling problem. The source tarballs contain libtool/autoconf-generated files which have been created with older versions of these tools, namely libtool 2.2.6b and autoconf 2.65. In order to get a working libtool *.la dependency mechanism on Cygwin, these files have to be created with pretty new versions of libtool/autoconf, right now at least libtool 2.4 and autoconf 2.67 (automake is not affected). Otherwise, with the old versions, building the shared libs fails due to a libtool bug. While I can rectify this situation locally by running autoreconf, it would be nice if building syslog-ng from a tarball would work out of the box on Cygwin, just as on other systems. So, here's my question: Is it possible to generate subsequent source tarballs using these newer versions of libtool and autoconf? Thanks in advance, Corinna -- Corinna Vinschen Cygwin Project Co-Leader Red Hat

5 32

using correlation to filter out some messages ?
by Guillaume Rousse 22 Feb '11

22 Feb '11

Hello. I've had a look at message correlation in the 3.2 manual, but it's still a bit obscure for me to understand if it could allow me to achieve filtering of pairs of log messages, as described here: https://lists.balabit.hu/pipermail/syslog-ng/2010-January/013857.html -- BOFH excuse #360: Your parity check is overdrawn and you're out of cache.

5 19

filter/parse based on certificate attributes?
by Christian Tramnitz 22 Feb '11

22 Feb '11

With syslog 3.0 and ssl support using mutual certificate authentication is it possible to parse/filter/tag based on attributes in the certificate? I'd like to have a common listener and then relay or append messages based on client-cert attribute values... (Sorry if this message is arriving more than once, I seem to have problems with posting through Gmane.) Regards, Christian

4 4

MongoDB destination driver
by Gergely Nagy 16 Jan '11

16 Jan '11

Greetings! I was contemplating switching one of the websites I maintain from postgresql to one of these document store things, and while wondering about how to evaluate the options best, I stumbled into a short article on the MongoDB website: http://blog.mongodb.org/post/172254834/mongodb-is-fantastic-for-logging, which promptly led me to start pondering about how hard - or easy, as it turns out - would it be to write a MongoDB destination driver for syslog-ng? Only four hours later, I can present you the mongodb destination driver, available from my git repo (note the -b option, it is important): $ git clone -b algernon/dest/mongodb git://git.madhouse-project.org/syslog-ng/syslog-ng-3.2.git Of course, one can browse the sources on the web too: http://git.madhouse-project.org/syslog-ng/syslog-ng-3.2/tree/modules/afmong… It is using the MongoDB C client library (http://www.mongodb.org/display/DOCS/C+Language+Center) - I simply embedded the sources for now, lacking a better option. Once compiled, one can already begin using it with the default options: destination d_mongodb { mongodb(); }; This will try to connect to localhost:27017, and use the logs collection in the syslog-ng database, and will log all the standard fields. Of course, all of those are configurable! To demonstrate all the - currently - available options, the destination definition above is the same as the following: destination d_mongodb { mongodb( host("localhost") port(27017) database("syslog-ng") collection("logs") keys("date", "facility", "level", "host", "program", "pid", "message") values("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "$FACILITY", "$LEVEL", "$HOST", "$PROGRAM", "$PID", "$MSGONLY") ); }; A few things, like authentication and some template options are not configurable yet, partly because I didn't figure out what they're good for, or how they work. But I will get there at some point, especially if there's interest in said features. All in all, I'm very happy that I could cook up a fairly simple destination driver within a few hours, having no prior experience writing one. The syslog-ng code is amazing, by the way, it was a breeze to navigate through and find the stuff I needed to make this driver work. Mind you, this is very new code, and I haven't tested it extensively, but I do have some great plans involving syslog-ng and mongodb >;) Hope you like the code, and perhaps find it useful! -- |8]

6 38

[Bug 103] New: Refresh of files in contrib/cygwin-packaging
by bugzilla＠bugzilla.balabit.com 14 Jan '11

14 Jan '11

https://bugzilla.balabit.com/show_bug.cgi?id=103 Summary: Refresh of files in contrib/cygwin-packaging Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Other Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: vinschen(a)redhat.com Type of the Report: --- Estimated Hours: 0.0 Created an attachment (id=29) --> (https://bugzilla.balabit.com/attachment.cgi?id=29) changes to contrib/cygwin-packaging files Hi, the latest version of syslog-ng requires a couple of changes to the files in contrib/cygwin-packaging. I've attached a patch consisting of the changes to the existing files as well as a new file contrib/cygwin-packaging/syslog-ng.sh Please make sure the new file has execute permissions by default. Thanks, Corinna -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 6