December 2010 - syslog-ng - lists.balabit.hu

Issues while using Syslog destination driver
by Amit Khare 13 Jan '11

13 Jan '11

Hi, I am getting a weird issues while using the syslog destination driver. I am sending an xml message to syslog (syslog-ng 3.1) and forwarding the message over to another destination. The relevant entries in my syslog.conf look as following: filter f_atna { facility(local7); }; destination d_loghost { syslog("19.16.2.9" transport("tcp") port(6514) template("$MESSAGE")); }; log { source(src); filter(f_atna); destination(d_loghost); }; The problem I am running into is that the xml message is not getting processed on the other side because I am getting some weird characters are getting added in the xml message: <?xml - - - version="1.0" encoding="UTF-8"?> The above xml tag is constant in my program and therefore I am not inserting it and I don't even see it in /var/log/localmessages Dec 28 11:01:07 10.15.1.1 <?xml version="1.0" encoding="UTF-8"?> but when I do see it in my tcpdump I do see it. I am not seeing these weird dashes when I use the tcp destination driver but the message is not in the required format so it blows up on the other side. Has anyone seen this issue before? Any help will be greatly appreciated. Thanks, Amit

2 1

[Bug 105] New: syslog-ng --no-caps option causes segmentation fault if compiled with caps support in hardened gentoo
by bugzilla＠bugzilla.balabit.com 11 Jan '11

11 Jan '11

https://bugzilla.balabit.com/show_bug.cgi?id=105 Summary: syslog-ng --no-caps option causes segmentation fault if compiled with caps support in hardened gentoo Product: syslog-ng Version: unspecified Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: dk(a)i-zet.ru Type of the Report: bug Estimated Hours: 0.0 syslog-ng --no-caps option causes segmentation fault if compiled with caps support on gentoo hardened system This is from the build log: syslog-ng Open Source Edition 3.1.2 configured Compiler options: compiler : x86_64-pc-linux-gnu-gcc -std=gnu99 compiler options : -O2 -pipe -fforce-addr -mtune=nocona -march=nocona -Wall -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/usr/include/eventlog -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -Wl,-O1 -Wl,--as-needed prefix : /usr linking mode : dynamic Features: Sun STREAMS support : no Sun Door support : no Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : no spoof-source support : no tcp-wrapper support : yes SSL support : yes SQL support : no Linux capability support : yes PCRE support : yes Env wrapper support : no >>> Source configured. System parameters: # syslog-ng --version syslog-ng 3.1.2 Installer-Version: 3.1.2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.1#master#8bf13c304b6ab5fc1a372b49d55c78370efe14ca Compile-Date: Dec 15 2010 21:10:17 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: off Enable-Spoof-Source: off Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: on Enable-Pcre: on # # # uname -a Linux xxxxxx 2.6.32-hardened-r29 #1 SMP Fri Dec 3 14:08:35 MSK 2010 x86_64 Intel(R) Xeon(R) CPU X5450 @ 3.00GHz GenuineIntel GNU/Linux # # gcc -v Using built-in specs. Target: x86_64-pc-linux-gnu Configured with: /var/tmp/portage/sys-devel/gcc-4.4.4-r2/work/gcc-4.4.4/configure --prefix=/usr --bindir=/usr/x86_64-pc-linux-gnu/gcc-bin/4.4.4 --includedir=/usr/lib/gcc/x86_64-pc-linux-gnu/4.4.4/include --datadir=/usr/share/gcc-data/x86_64-pc-linux-gnu/4.4.4 --mandir=/usr/share/gcc-data/x86_64-pc-linux-gnu/4.4.4/man --infodir=/usr/share/gcc-data/x86_64-pc-linux-gnu/4.4.4/info --with-gxx-include-dir=/usr/lib/gcc/x86_64-pc-linux-gnu/4.4.4/include/g++-v4 --host=x86_64-pc-linux-gnu --build=x86_64-pc-linux-gnu --disable-altivec --disable-fixed-point --without-ppl --without-cloog --disable-nls --with-system-zlib --disable-werror --enable-secureplt --enable-multilib --enable-libmudflap --disable-libssp --enable-esp --enable-libgomp --with-python-dir=/share/gcc-data/x86_64-pc-linux-gnu/4.4.4/python --enable-checking=release --disable-libgcj --enable-languages=c,c++ --enable-shared --enable-threads=posix --enable-__cxa_atexit --enable-clocale=gnu --with-bugurl=http://bugs.gentoo.org/ --with-pkgversion='Gentoo Hardened 4.4.4-r2 p1.2, pie-0.4.5' Thread model: posix gcc version 4.4.4 (Gentoo Hardened 4.4.4-r2 p1.2, pie-0.4.5) # glibc - 2.11.2-r3 Example: $ $ /usr/sbin/syslog-ng -F -v -d --no-caps Segmentation fault $ $ strace /usr/sbin/syslog-ng -F -v -d --no-caps execve("/usr/sbin/syslog-ng", ["/usr/sbin/syslog-ng", "-F", "-v", "-d", "--no-caps"], [/* 33 vars */]) = 0 brk(0) = 0x3cdf13cf10 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0cc000 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat(3, {st_mode=S_IFREG|0644, st_size=51584, ...}) = 0 mmap(NULL, 51584, PROT_READ, MAP_PRIVATE, 3, 0) = 0x3752a0bf000 close(3) = 0 open("/usr/lib/libglib-2.0.so.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320{\1\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=981792, ...}) = 0 mmap(NULL, 3079320, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x37529bc2000 mprotect(0x37529cb0000, 2097152, PROT_NONE) = 0 mmap(0x37529eb0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xee000) = 0x37529eb0000 close(3) = 0 open("/usr/lib/libevtlog.so.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\31\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=18184, ...}) = 0 mmap(NULL, 2113664, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x375299bd000 mprotect(0x375299c1000, 2093056, PROT_NONE) = 0 mmap(0x37529bc0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x37529bc0000 close(3) = 0 open("/usr/lib/libssl.so.1.0.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0Pa\1\0\0\0\0\0"..., 832) = 832 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0be000 fstat(3, {st_mode=S_IFREG|0555, st_size=386928, ...}) = 0 mmap(NULL, 2482512, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x3752975e000 mprotect(0x375297b5000, 2093056, PROT_NONE) = 0 mmap(0x375299b4000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x56000) = 0x375299b4000 close(3) = 0 open("/usr/lib/libcrypto.so.1.0.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@U\6\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0555, st_size=1845904, ...}) = 0 mmap(NULL, 3956384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x37529398000 mprotect(0x37529538000, 2093056, PROT_NONE) = 0 mmap(0x37529737000, 147456, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x19f000) = 0x37529737000 mmap(0x3752975b000, 11936, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x3752975b000 close(3) = 0 open("/lib/libwrap.so.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@1\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=35552, ...}) = 0 mmap(NULL, 2132968, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x3752918f000 mprotect(0x37529197000, 2093056, PROT_NONE) = 0 mmap(0x37529396000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x7000) = 0x37529396000 close(3) = 0 open("/lib/libcap.so.2", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\26\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=18408, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0bd000 mmap(NULL, 2113856, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x37528f8a000 mprotect(0x37528f8e000, 2093056, PROT_NONE) = 0 mmap(0x3752918d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x3752918d000 close(3) = 0 open("/lib/libpcre.so.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\200\30\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=198368, ...}) = 0 mmap(NULL, 2293824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x37528d59000 mprotect(0x37528d89000, 2093056, PROT_NONE) = 0 mmap(0x37528f88000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2f000) = 0x37528f88000 close(3) = 0 open("/lib/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0~\354\1\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=1354792, ...}) = 0 mmap(NULL, 3463976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x37528a0b000 mprotect(0x37528b4f000, 2097152, PROT_NONE) = 0 mmap(0x37528d4f000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x144000) = 0x37528d4f000 mmap(0x37528d54000, 19240, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x37528d54000 close(3) = 0 open("/lib/libdl.so.2", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\r\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=14320, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0bc000 mmap(NULL, 2109600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x37528807000 mprotect(0x37528809000, 2097152, PROT_NONE) = 0 mmap(0x37528a09000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x37528a09000 close(3) = 0 open("/lib/libz.so.1", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p \0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=87936, ...}) = 0 mmap(NULL, 2183312, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x375285f1000 mprotect(0x37528606000, 2093056, PROT_NONE) = 0 mmap(0x37528805000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x14000) = 0x37528805000 close(3) = 0 open("/lib/libattr.so.1", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\25\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=22360, ...}) = 0 mmap(NULL, 2117664, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x375283eb000 mprotect(0x375283ef000, 2097152, PROT_NONE) = 0 mmap(0x375285ef000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4000) = 0x375285ef000 close(3) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0bb000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0ba000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0b9000 arch_prctl(ARCH_SET_FS, 0x3752a0ba700) = 0 mprotect(0x375285ef000, 4096, PROT_READ) = 0 mprotect(0x37528805000, 4096, PROT_READ) = 0 mprotect(0x37528a09000, 4096, PROT_READ) = 0 mprotect(0x37528d4f000, 16384, PROT_READ) = 0 mprotect(0x37528f88000, 4096, PROT_READ) = 0 mprotect(0x3752918d000, 4096, PROT_READ) = 0 mprotect(0x37529396000, 4096, PROT_READ) = 0 mprotect(0x37529737000, 106496, PROT_READ) = 0 mprotect(0x375299b4000, 16384, PROT_READ) = 0 mprotect(0x37529bc0000, 4096, PROT_READ) = 0 mprotect(0x37529eb0000, 4096, PROT_READ) = 0 mprotect(0x3cdf136000, 8192, PROT_READ) = 0 mprotect(0x3752a0ce000, 4096, PROT_READ) = 0 munmap(0x3752a0bf000, 51584) = 0 brk(0) = 0x3cdf13cf10 brk(0x3cdf15df10) = 0x3cdf15df10 brk(0x3cdf15e000) = 0x3cdf15e000 setrlimit(RLIMIT_NOFILE, {rlim_cur=4*1024, rlim_max=4*1024}) = 0 setsid() = 13612 prctl(PR_SET_KEEPCAPS, 1) = 0 capget(0x20080522, 0, NULL) = -1 EFAULT (Bad address) --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ Segmentation fault $ It is quite possible, that it is hardened gentoo specific bug. I could not reproduce it on non-hardened system. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 92] New: Allow user to specify SSL/TLS cipher suite for connections
by bugzilla＠bugzilla.balabit.com 11 Jan '11

11 Jan '11

https://bugzilla.balabit.com/show_bug.cgi?id=92 Summary: Allow user to specify SSL/TLS cipher suite for connections Product: syslog-ng Version: 3.1.x Platform: PC OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: brett.edgar(a)truedigitalsecurity.com Type of the Report: enhancement Estimated Hours: 0.0 Created an attachment (id=22) --> (https://bugzilla.balabit.com/attachment.cgi?id=22) Patch to allow user to specify acceptable TLS cipher suites. Some compliance regimens (e.g., the PCI DSS) require SSL/TLS connections to disable weak (<128 bit key length) ciphers and old protocols like SSLv2. Syslog-ng already disables SSLv2 by default, but there is no way to disable the weak ciphers without modifying the source with every new release. I have developed a very small patch that adds a configuration file line with the tls { } stanza to specify which TLS ciphers can be used. Example: source tlssrc { tcp(ip(1.2.3.4) port(514) max-connections(32) tls( key_file("/etc/syslog-ng/server.key") cert_file("/etc/syslog-ng/server.crt") cipher_suite("ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:!SSLv2") peer_verify(optional-untrusted)) ); }; -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

Re: [syslog-ng] syslog-ng 3.0.8, 3.0.9 not sending logs to centralized log host
by Jarrett Lee 22 Dec '10

22 Dec '10

As I stated before, I ran tcpdump to monitor the network traffic leaving the client system and then attempted to generate some logs, there was no network traffic beyond SSH and some VMware stuff, so I know it wasn't networking, at least not yet, as the syslog-ng client daemon was not even generating network traffic. Anyway, I did figure out the issue. I was editing the wrong conf file, silly me! I was editing /etc/syslog-ng.conf when I should have been editing /opt/syslog-ng/etc/syslog-ng.conf. A coworker showed me this, proving that I had just been staring at the problem for too long to be able to see the answer ;) Thank you for your help guys! It helped us get the gears in our heads moving again! On Dec 21, 2010, at 17:09, Alan McKinnon wrote: > Your config appears correct - I use a similar setup on a wide variety of > logging clients using all sorts of versions of sysloggers. > > So I imagine your problem is more network and less syslog. You don't mention > basic networking tests you might have done, such as can you ping the log host > and can you telnet to the port and get a sensible result? I'd like to > establish that packets can at least go from client to server. And don't forget > to check silly things /etc/hosts - I once had a server listed there with > address 127.0.0.1..... that took an awfully long time to find. [I see your > config implies you send to an ip not a hostname. But still, basic checks are > good.] > > > > Apparently, though unproven, at 00:03 on Wednesday 22 December 2010, Jarrett > Lee did opine thusly: > >> This is the client side that I'm having issues with, not the syslog server, >> or loghost, side. Does it really need network configuration information in >> the source statement? I thought that was on the server side to show it >> which interface/port to listen on for clients. >> >> On Dec 21, 2010, at 16:59, Clayton Dukes wrote: >> >> Looks like you need to define UDP or TCP (or both) in your src statement. >> >> Here's a short (hopefully helpful) link to a video for syslog-ng >> configuration: http://www.logzilla.info/SearchResults.asp?Cat=49 >> >> <http://www.logzilla.info/SearchResults.asp?Cat=49>Full disclosure, >> LogZilla is my log analysis software, but hopefully the video helps. >> >> >> ______________________________________________________________ >> >> Clayton Dukes >> ______________________________________________________________ >> >> >> On Tue, Dec 21, 2010 at 4:43 PM, Jarrett Lee >> <jarrett.lee(a)oversightsystems.com<mailto:jarrett.lee@oversightsystems.com> >>> wrote: I have syslog-ng 3.0.9 (also tried 3.0.8) on a CentOS 5.5 system, >> firewall (iptables) turned off, and SELinux disabled. For some reason it >> refuses to send logs to my log host, though it will put them in my >> messages file. I've even broken out tcpdump to monitor the port while >> generating logs to see if I can see any network traffic generated, but >> it's crickets on the wire. >> >> Anybody have this problem? Is there something I'm missing, perhaps I've >> been looking at it for too long and need fresh eyes? I've had this working >> before on other platforms, Solaris and other distros of Linux, but this >> time it's kicking my butt... >> >> Here's my syslog-ng.conf (with IP and port redacted): >> #### BEGIN syslog-ng.conf #### >> @version: 3.0 >> >> options { >> }; >> >> source src { >> internal(); >> unix-stream("/dev/log"); >> file("/proc/kmsg" program_override("kernel: ")); >> }; >> >> destination local { >> file("/var/log/messages"); >> }; >> destination loghost { >> tcp("IPADDR" port(PORT)); >> }; >> >> log { >> source(src); >> destination(local); >> }; >> log { >> source(src); >> destination(loghost); >> }; >> #### END syslog-ng.conf #### >> >> >> Thanks, >> Jarrett >> >> Jarrett Lee, UNIX Administrator >> OVERSIGHT SYSTEMS | >> www.oversightsystems.com<http://www.oversightsystems.com/> >> __________________________________________________________________________ >> ____ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: >> http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: >> http://www.campin.net/syslog-ng/faq.html >> >> >> ___________________________________________________________________________ >> ___ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: >> http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: >> http://www.campin.net/syslog-ng/faq.html > > -- > alan dot mckinnon at gmail dot com

3 3

syslog-ng 3.0.8, 3.0.9 not sending logs to centralized log host
by Jarrett Lee 21 Dec '10

21 Dec '10

I have syslog-ng 3.0.9 (also tried 3.0.8) on a CentOS 5.5 system, firewall (iptables) turned off, and SELinux disabled. For some reason it refuses to send logs to my log host, though it will put them in my messages file. I've even broken out tcpdump to monitor the port while generating logs to see if I can see any network traffic generated, but it's crickets on the wire. Anybody have this problem? Is there something I'm missing, perhaps I've been looking at it for too long and need fresh eyes? I've had this working before on other platforms, Solaris and other distros of Linux, but this time it's kicking my butt... Here's my syslog-ng.conf (with IP and port redacted): #### BEGIN syslog-ng.conf #### @version: 3.0 options { }; source src { internal(); unix-stream("/dev/log"); file("/proc/kmsg" program_override("kernel: ")); }; destination local { file("/var/log/messages"); }; destination loghost { tcp("IPADDR" port(PORT)); }; log { source(src); destination(local); }; log { source(src); destination(loghost); }; #### END syslog-ng.conf #### Thanks, Jarrett Jarrett Lee, UNIX Administrator OVERSIGHT SYSTEMS | www.oversightsystems.com

2 3

(no subject)
by carl andreasson 19 Dec '10

19 Dec '10

http://www.cookie.purespace.de/rew.html

2 1

Re: [syslog-ng] Newer libtool and autoconf versions?
by Matthew Hall 18 Dec '10

18 Dec '10

They are related only because my issue happened in exactly the same line and I thought it might be nice to fix both at the same time. ;-) Matthew. Sent from my mobile device Corinna Vinschen <vinschen(a)redhat.com> wrote: >On Dec 17 11:00, Matthew Hall wrote: >> On Fri, Dec 17, 2010 at 02:07:51PM +0100, Corinna Vinschen wrote: >> > Here's how you avoid the warning: >> > >> > diff --git a/configure.in b/configure.in >> > index ea671be..0e534f8 100644 >> > --- a/configure.in >> > +++ b/configure.in >> > @@ -156,7 +156,7 @@ AC_PROG_YACC >> > AM_PROG_LEX >> > AC_PROG_MAKE_SET >> > PKG_PROG_PKG_CONFIG >> > -LT_INIT([disable-static]) >> > +LT_INIT([dlopen disable-static]) >> > >> > dnl *************************************************************************** >> > dnl Validate yacc >> > diff --git a/modules/dbparser/Makefile.am b/modules/dbparser/Makefile.am >> > index 2a08c29..76a6cef 100644 >> > --- a/modules/dbparser/Makefile.am >> > +++ b/modules/dbparser/Makefile.am >> > @@ -26,7 +26,7 @@ libdbparser_la_LDFLAGS = -avoid-version -module >> > bin_PROGRAMS = pdbtool >> > pdbtool_SOURCES = pdbtool.c patternize.c patternize.h >> > pdbtool_CPPFLAGS = $(AM_CPPFLAGS) @OPENSSL_CFLAGS@ >> > -pdbtool_LDADD = ../../lib/libsyslog-ng.la libdbparser.la @OPENSSL_LIBS@ @DEPS_LIBS@ >> > +pdbtool_LDADD = ../../lib/libsyslog-ng.la -dlpreopen libdbparser.la @OPENSSL_LIBS@ @DEPS_LIBS@ >> > >> > BUILT_SOURCES = dbparser-grammar.y dbparser-grammar.c dbparser-grammar.h >> > EXTRA_DIST = $(BUILT_SOURCES) radix-find.c dbparser-grammar.ym >> >> Hi Corinna, >> >> Funny you should mention this one. >> >> I had a similar problem here where listing the OpenSSL ahead of listing >> the DEPS_LIBS caused me to pick up the system OpenSSL instead of the >> more updated OpenSSL in the install prefix. >> >> So it seems I'm not the only one who ran into it. >> >> For what it's worth on my end I worked around it using LIBS env var >> which gets subbed into the linker args ahead of where LDFLAGS does so >> your stuff gets put earlier in the search path. > >Hi Matthew, > >I'm sorry, but I don't see how these two items are related. The problem >the above patch is trying to fix is to avoid a warning when linking >against a dlopen module. > > >Corinna > >-- >Corinna Vinschen >Cygwin Project Co-Leader >Red Hat >______________________________________________________________________________ >Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng >FAQ: http://www.campin.net/syslog-ng/faq.html >

1 0

Help with pattern db correlation
by Martin Holste 18 Dec '10

18 Dec '10

I'm trying to build a correlation message for Ironport similar to the Postfix example that was referred to in the discussions. Here's what I have so far, but it's not quite working: <ruleset> <rules> <rule class="10" id="10" context-id="ironport-mid" context-timeout="10" context-scope="program"> <patterns> <pattern>Info: Start MID @NUMBER:mid:@ ICID @NUMBER:icid:@</pattern> </patterns> <values> <value name="icid">$icid</value> </values> <examples> <example> <test_message program="ironport_mail_logs">Info: Start MID 144753300 ICID 696117306</test_message> </example> </examples> </rule> <rule class="10" id="10" context-id="ironport-mid" context-timeout="10" context-scope="program"> <patterns> <pattern>Info: Message finished MID @NUMBER:mid:@ done</pattern> </patterns> <actions> <action> <message> <values> <value name="MESSAGE">IronPort message complete: icid: $icid, mid: $mid</value> </values> </message> </action> </actions> <examples> <example> <test_message program="ironport_mail_logs">Info: Message finished MID 144753300 done</test_message> </example> </examples> </rule> </rules> </ruleset> I'm getting the triggered action, but the icid is null while the mid is filled in. What am I missing?

3 4

load failures in afsocket and afsql
by Matthew Hall 17 Dec '10

17 Dec '10

I am getting the following on load: Error opening plugin module; module='afsocket', error='/home/y/lib64/syslog-ng/libafsocket.so: undefined symbol: libnet_build_ipv4' Error opening plugin module; module='afsql', error='/home/y/lib64/syslog-ng/libafsql.so: undefined symbol: dbi_result_free' Error opening plugin module; module='afsocket', error='/home/y/lib64/syslog-ng/libafsocket.so: undefined symbol: libnet_build_ipv4' The rpath looks OK: megahall@logproxy2:~$ readelf -a /home/y/lib64/syslog-ng/libafsocket.so | fgrep -i rpath 0x000000000000000f (RPATH) Library rpath: [/home/y/lib64] megahall@logproxy2:~$ readelf -a /home/y/lib64/syslog-ng/libafsql.so | fgrep -i rpath 0x000000000000000f (RPATH) Library rpath: [/home/y/lib64] megahall@logproxy2:~$ megahall@logproxy2:~$ ldd /home/y/lib64/syslog-ng/libafs* | fgrep -i '(dbi|net)' megahall@logproxy2:~$ The libraries are in a reasonable location: /home/y/lib64/libdbi.so.1.0.0 /home/y/lib64/libnet.so.1.5.0 /home/y/lib64/dbd/libdbdsqlite3.so /home/y/lib64/dbd/libdbdmysql.so /home/y/lib64/libnet.so.1 /home/y/lib64/libdbi.so.1 /home/y/lib64/libdbi.so Reading through the glib docs for glib modules, it seems like the .la files are maybe not containing the right library dependencies, or something like this. However adding the library directories using LD_LIBRARY_PATH as a temporary test does not help. Because this step fails, it's not possible to use tcp, udp, or any of the other important drivers you need to collect logs. I could really use some advice on this one! Matthew.

5 25

Help with db_parser()
by Giovanni Mancuso 17 Dec '10

17 Dec '10

Hi, I configure my Java application to log with log4j in syslog server, and i configure my syslog-ng to store data in mysql database, but this doen't work. My syslog-ng configuration is: @version: 3.0 options { chain_hostnames(no); stats_freq(43200); }; source src { unix-stream("/dev/log" max-connections(256)); internal(); udp(ip("127.0.0.1") port(514)); file("/proc/kmsg"); }; destination mcs { file("/var/log/mw-collaboration/mw-collaboration-loginfile.log"); }; destination mcs_sql { sql( type(mysql) host("localhost") username("syslogng") password("syslogng") database("mcslogin") table("mcslogin") columns("date varchar(32)","loginuser varchar(32) ","ipsource varchar(32)") values("${S_YEAR}-${S_MONTH}-${S_DAY} ${S_HOUR}:${S_MIN}:${S_SEC}","${LOGIN_USER}","${IP_SOURCE}") ); }; filter f_mcs { facility(local2); }; parser p_mcs { db_parser(file("/etc/syslog-ng/patterndb.d/mcs.xml")); }; log { source(src); filter(f_mcs); parser(p_mcs); destination(mcs_sql); destination(mcs); }; I created also a db_parser file that is: <patterndb version='1' pub_date='2010-12-14'> <program name='mcs'> <pattern>mcs</pattern> <rule id='mcs' class='system'> <pattern>###############Accesso dell'utente @STRING:LOGIN_USER@ da ip @IPv4:IP_SOURCE@</pattern> </rule> </program> </patterndb> With this configuration, i have that in "mcs" destination it writes all information: Dec 16 11:55:44 localhost mcs[123] ###############Accesso dell'utente xxxx(a)xxx.mailware.it da ip 111.222.333.444 Dec 16 12:53:23 localhost mcs[123] ###############Accesso dell'utente xxxx.1(a)xxx.mailware.it da ip 111.222.333.444 Dec 16 14:07:40 localhost mcs[123] ###############Accesso dell'utente xxxx.1(a)xxx.mailware.it da ip 111.222.333.444 but in "mcs_sql" destination, it writes only date: mysql> desc mcslogin; +-----------+-------------+------+-----+---------+-------+ | Field | Type | Null | Key | Default | Extra | +-----------+-------------+------+-----+---------+-------+ | date | varchar(32) | YES | MUL | NULL | | | loginuser | varchar(32) | YES | | NULL | | | ipsource | varchar(32) | YES | | NULL | | +-----------+-------------+------+-----+---------+-------+ 3 rows in set (0.00 sec) mysql> select * from mcslogin limit 10 -> ; +---------------------+-----------+----------+ | date | loginuser | ipsource | +---------------------+-----------+----------+ | 2010-12-15 11:02:16 | | | | 2010-12-15 11:11:09 | | | | 2010-12-15 17:53:01 | | | | 2010-12-15 18:11:55 | | | | 2010-12-15 18:12:54 | | | | 2010-12-15 18:35:07 | | | | 2010-12-16 11:55:36 | | | | 2010-12-16 11:55:44 | | | | 2010-12-16 11:55:44 | | | | 2010-12-16 12:53:23 | | | +---------------------+-----------+----------+ 10 rows in set (0.00 sec) Can you help me? Thanks

3 6