December 2010 - syslog-ng - lists.balabit.hu

Host name handling : FULLHOST_FROM explanation
by Christophe Brocas 06 Dec '10

06 Dec '10

Hello I am working on the right and consistent way to store log messages in destination files. I try to obtain a single file per host, based on HOST value in log messages.. Currently, I have inconsistent values in HOST part of log messages, so destination files are also inconsistents. To answer to this problem, I am going to use at first the SOURCEIP macro in my destination file paths. But I want to improve this situation. So I would like to be sure of the understanding I have of the FULLHOST_FROM macro. If use_dns() is set to yes, does the expansion of FULLHOST_FROM macro follow this stream ? 1. Syslog-NG takes the IP address of the host sending the message 2. Syslog-NG tries to get the reverse value (as dig -x) from the IP address 3. Syslog-NG expands the macro with the FQDN obtained in point 2 (What if DNS reverse fails ? The macro returns only the IP address ?) Bye Christophe -- Christophe Brocas keyid : 3072R/0x0661CBBA ***************************************************** "Le contenu de ce courriel et ses eventuelles pièces jointes sont confidentiels. Ils s'adressent exclusivement à la personne destinataire. Si cet envoi ne vous est pas destiné, ou si vous l'avez reçu par erreur, et afin de ne pas violer le secret des correspondances, vous ne devez pas le transmettre à d'autres personnes ni le reproduire. Merci de le renvoyer à l'émetteur et de le détruire. Attention : L'Organisme de l'émetteur du message ne pourra être tenu responsable de l'altération du présent courriel. Il appartient au destinataire de vérifier que les messages et pièces jointes reçus ne contiennent pas de virus. Les opinions contenues dans ce courriel et ses éventuelles pièces jointes sont celles de l'émetteur. Elles ne reflètent pas la position de l'Organisme sauf s'il en est disposé autrement dans le présent courriel." ******************************************************

2 3

[Bug 97] New: syslog-ng crashes after SIGHUP
by bugzilla＠bugzilla.balabit.com 04 Dec '10

04 Dec '10

https://bugzilla.balabit.com/show_bug.cgi?id=97 Summary: syslog-ng crashes after SIGHUP Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: zhengxiang.pan(a)alcatel-lucent.com Type of the Report: bug Estimated Hours: 0.0 Syslog-ng 3.0.6 crashes with following trace: Program terminated with signal 11, Segmentation fault. [New process 6311] #0 0x08063558 in log_source_group_queue (s=0x8ca6e00, msg=0x8caecc0, path_options=0xbfffaf18) at sgroup.c:98 98 (*self->processed_messages)++; (gdb) bt #0 0x08063558 in log_source_group_queue (s=0x8ca6e00, msg=0x8caecc0, path_options=0xbfffaf18) at sgroup.c:98 #1 0x08070580 in log_source_queue (s=0x8cadc78, msg=0x8caecc0, path_options=0xbfffaf74) at logpipe.h:121 #2 0x08063e80 in log_reader_fd_dispatch (source=0x8cadd10, callback=0, user_data=0x0) at logpipe.h:121 #3 0x08080081 in g_main_context_dispatch () #4 0x08083103 in g_main_context_iterate () #5 0x0808327f in g_main_context_iteration () #6 0x0804b52f in main_loop_run (cfg=0xbfffb0e8) at main.c:163 #7 0x0804bbcd in main (argc=147613904, argv=0xbfffb110) at main.c:443 The problem happens from version 3.0.6 ( I did not test other version lower than that) until the lastest 3.1.3. I guess what happens is that when SIGHUP is recevied, some connections are persisted, while the persistent connections points to the already-freed pipe (via pipe_next), if there are messages coming before the freed-pipes are replaced, the messages are forwarded to the freed-pipe handler. For version 3.1.3, in logpipe.c, log_pipe_forward_msg() may add check the pipe_next flags, however this may be not enough. log_pipe_forward_msg(LogPipe *self, LogMessage *msg, const LogPathOptions *path_options) { if (self->pipe_next && self->flags&PIF_INITIALIZED) { log_pipe_queue(self->pipe_next, msg, path_options); -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

[Bug 98] New: GLIB_MIN_VERSION should be 2.13.5, not 2.10.1
by bugzilla＠bugzilla.balabit.com 03 Dec '10

03 Dec '10

https://bugzilla.balabit.com/show_bug.cgi?id=98 Summary: GLIB_MIN_VERSION should be 2.13.5, not 2.10.1 Product: syslog-ng Version: 3.2.x Platform: PC URL: http://git.gnome.org/browse/glib/tree/NEWS?id=GLIB_2_13_ 5#n27 OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: packaging AssignedTo: folti(a)balabit.hu ReportedBy: owen.mann(a)interactivedata.com Type of the Report: bug Estimated Hours: 0.0 When building on a RHEL5 box (glib2-2.12.3-4.el5_3.1), I get: [...] libtool: link: gcc -std=gnu99 -Wno-pointer-sign -g -O2 -Wall -o .libs/pdbtool pdbtool-pdbtool.o pdbtool-patternize.o -Wl,--export-dynamic ../../lib/.libs/libsyslog-ng.so ./.libs/libdbparser.so -L/usr/kerberos/lib64 -lssl -lcrypto -lz -lrt -lnsl -L/lib64 -lgmodule-2.0 -ldl -lglib-2.0 /usr/lib64/libevtlog.so -Wl,-rpath -Wl,//lib -Wl,-rpath -Wl,//lib/syslog-ng -Wl,-rpath -Wl,/usr/lib64 ./.libs/libdbparser.so: undefined reference to `g_timeout_add_seconds' collect2: ld returned 1 exit status make[5]: *** [pdbtool] Error 1 make[5]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-3.2.1/modules/dbparser' make[4]: *** [all-recursive] Error 1 make[4]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-3.2.1/modules/dbparser' make[3]: *** [all] Error 2 make[3]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-3.2.1/modules/dbparser' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-3.2.1/modules' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-3.2.1' make: *** [all] Error 2 error: Bad exit status from /var/tmp/rpm-tmp.38499 (%build) According to http://git.gnome.org/browse/glib/tree/NEWS?id=GLIB_2_13_5#n27, the `g_timeout_add_seconds' feature was added in GLib 2.13.5 -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

syslog-ng PE benefits
by Zoltán Pallagi 03 Dec '10

03 Dec '10

Hi all, A few months ago, there was a thread about syslog-ng in corporate environment. I've just wrote a blog about the benefits of syslog-ng PE, you can read it on my blog: http://pzolee.blogs.balabit.com/en/2010/12/syslog-ng-pe-behind-the-walls/

1 0

3.2.1 fails build in modules/dbparser w/o -lssl
by Brian A. Seklecki 03 Dec '10

03 Dec '10

[Sorry if this is a dupe; mailing list delays or silent quarntine for non-subscribers] I can provide a full config.log via URL, but here's the quick summary: /bin/ksh ../../libtool --tag=CC --mode=link gcc -std=gnu99 -Wno-pointer-sign -g -O2 -Wall -o pdbtool pdbtool-pdbtool.o pdbtool-patternize.o ../../lib/libsyslog-ng.la libdbparser.la -lrt -Wl,-R/usr/pkg/lib -Wl,--export-dynamic -pthread -L/usr/pkg/lib -lgmodule-2.0 -lglib-2.0 -lintl -Wl,-R/usr/pkg/lib -L/usr/pkg/lib -levtlog -lresolv libtool: link: gcc -std=gnu99 -Wno-pointer-sign -g -O2 -Wall -o .libs/pdbtool pdbtool-pdbtool.o pdbtool-patternize.o -Wl,-R/usr/pkg/lib -Wl,--export-dynamic -pthread -Wl,-R/usr/pkg/lib ../../lib/.libs/libsyslog-ng.so -L/usr/pkg/lib ./.libs/libdbparser.so /root/syslog-ng-3.2.1/lib/.libs/libsyslog-ng.so -lrt /usr/pkg/lib/libgmodule-2.0.so /usr/pkg/lib/libglib-2.0.so /usr/pkg/lib/libpcre.so -lintl /usr/pkg/lib/libevtlog.so -lresolv -pthread -Wl,-rpath -Wl,/usr/pkg/lib -Wl,-rpath -Wl,/usr/pkg/lib/syslog-ng pdbtool-patternize.o: In function `uuid_gen_random': /root/syslog-ng-3.2.1/modules/dbparser/patternize.c:67: undefined reference to `RAND_bytes' gmake[2]: *** [pdbtool] Error 1 gmake[2]: Leaving directory `/root/syslog-ng-3.2.1/modules/dbparser' gmake[1]: *** [all-recursive] Error 1 gmake[1]: Leaving directory `/root/syslog-ng-3.2.1/modules/dbparser' gmake: *** [all] Error 2 Appending "-lssl" to the automake/libtool command makes it work fine. NetBSD metrotitan 5.99.39 NetBSD 5.99.39 (METROTITAN-$Revision: 1.993 $) #0: Wed Oct 6 13:26:31 EDT 2010 root@metrotitan:/usr/obj/sys/arch/i386/compile/METROTITAN i386 bash-4.1# openssl version OpenSSL 1.1.0-dev 10 Jul 2009 I'm doing this outside of Pkgsrc, so its possibly my fault. ~BAS

2 1

--libdir misbehaves
by Matthew Hall 02 Dec '10

02 Dec '10

I'm compiling syslog-ng 3.2 beta 1. I'm going to update to 3.2 release briefly, maybe it's fixed in there? Even though I used: --libdir=/home/opt/lib64 The syslog-ng plugins are still going into lib. I can't make an internal package of the app to use here until I figure out how to fix it. The files in question are: /home/opt/lib/syslog-ng /home/opt/lib/syslog-ng/libafsocket-tls.la /home/opt/lib/syslog-ng/libafprog.la /home/opt/lib/syslog-ng/libaffile.la /home/opt/lib/syslog-ng/libaffile.so /home/opt/lib/syslog-ng/libpacctformat.so /home/opt/lib/syslog-ng/libsyslogformat.so /home/opt/lib/syslog-ng/libafsql.so /home/opt/lib/syslog-ng/libbasicfuncs.so /home/opt/lib/syslog-ng/libafsocket.so /home/opt/lib/syslog-ng/libafsocket-notls.la /home/opt/lib/syslog-ng/libdbparser.la /home/opt/lib/syslog-ng/libafuser.la /home/opt/lib/syslog-ng/libconvertfuncs.la /home/opt/lib/syslog-ng/libbasicfuncs.la /home/opt/lib/syslog-ng/libcsvparser.la /home/opt/lib/syslog-ng/libafprog.so /home/opt/lib/syslog-ng/libafsql.la /home/opt/lib/syslog-ng/libpacctformat.la /home/opt/lib/syslog-ng/libafsocket-tls.so /home/opt/lib/syslog-ng/libdbparser.so /home/opt/lib/syslog-ng/libdummy.la /home/opt/lib/syslog-ng/libcsvparser.so /home/opt/lib/syslog-ng/libconvertfuncs.so /home/opt/lib/syslog-ng/libafsocket-notls.so /home/opt/lib/syslog-ng/libconfgen.so /home/opt/lib/syslog-ng/libafuser.so /home/opt/lib/syslog-ng/libsyslogformat.la /home/opt/lib/syslog-ng/libconfgen.la /home/opt/lib/syslog-ng/libdummy.so

2 4

Extra Lines Truncated
by Ian Lesperance 02 Dec '10

02 Dec '10

When logging multiline messages (simple strings with in-line newlines) our logs only show the first line. Everything after the first newline character is gone. We're on 3.0.5 and we don't seem to be using the no_multi_line option anywhere. What else could explain this behavior? Ian

4 5

hostname incorrect after upgrade to 3.1.2
by w3euu 01 Dec '10

01 Dec '10

I have used syslog-ng for many years and have been a faithful reader of the mailing list, but do not believe I have ever had occasion to post. Thank you for an excellent product and for the great support you have provided. I have always been able to solve problems by reading the archives...until now. I just completed an upgrade from source on several (6) systems from syslog-ng 3.1.1 (OSE) to 3.1.2 and then 3.1.3. All of them went smoothly, without error. However, after the upgrade to 3.1.2, one of the systems began reporting the hostname as "localhost" rather than the correct host name. The problem persisted when I upgraded to 3.1.3. When I roll it back to 3.1.1 it reports the hostname correctly. All of the systmes are fedora. Some are fc13, some are fc14. The system that failed is fc14. It is forwarding its logs to a central logger via tcp. I have checked the following: hosts file is OK. Contains only 127.0.0.1 entry as localhost dig -x returns the correct hostname hostname returns the correct hostname tcpdump confirms that syslog-ng is reporting "localhost" I was unable to correct the problem by changing global options. Global options are: options { flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); check_hostname(yes); chain_hostnames(no); keep_hostname (no); stats_freq (43200); mark_freq (1200); keep_timestamp (no); # send_time_zone (-04:00); }; I have googled but have not found anything that seemed relavant. Not sure how to procede to correct this situation. Any ideas would be appreciated. I would be happy to post additional data that will help.

2 6

Syslog-Ng on NetBSD after GSoC changes for RFC5424 Changes
by Brian A. Seklecki 01 Dec '10

01 Dec '10

For the sake of the mailing list archives / google searches, the following flags() argument is needed to parse the new message format from local socket: source src { unix-dgram("/var/run/log" flags(syslog-protocol) ); unix-dgram("/var/run/logpriv" perm(0600)); internal(); file("/dev/klog"); }; Also, syslog-ng v. 3 or greater is needed (1.6x in pkgsrc, 2.x in pkgsrc-wip) If/when Other*BSD imports the IETF syslog support, the same will be true there. ~BAS

1 0