March 2010 - syslog-ng - lists.balabit.hu

[Bug 42] New: capabilities, chown, chmod
by bugzilla＠bugzilla.balabit.com 20 Dec '12

20 Dec '12

https://bugzilla.balabit.com/show_bug.cgi?id=42 Summary: capabilities, chown, chmod Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: zbyniu(a)pld-linux.org Type of the Report: bug Estimated Hours: 0.0 Let's take a look at syslog-ng-3.0.1/src/affile.c lines 60-83 1. CAP_SYS_ADMIN is needed only for /proc/kmsg, it is added w/o check 2. CAP_DAC_READ_SEARCH should be added only if open fail with errno 13 2a. CAP_DAC_OVERRIDE should be added only if open fail with errno 13 and with CAP_DAC_READ_SEARCH set 3. fchown needs CAP_CHOWN unconditionaly 4. fchmod needs CAP_FOWNER if file owner != euid (root here) 5. all caps should be restored summary: - CAP_SYS_ADMIN and CAP_DAC_OVERRIDE are set always even if unnecessary, and permanently - owner, group and perm doesn't work -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 10

[Bug 14] New: Maintain symlinks to current and previous log output files...
by bugzilla＠bugzilla.balabit.com 28 Sep '11

28 Sep '11

https://bugzilla.balabit.com/show_bug.cgi?id=14 Summary: Maintain symlinks to current and previous log output files... Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=218688 OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: enhancement Estimated Hours: 0.0 >From bugs.debian.org: I'm hoping that upstream might consider adding functionality to syslog-ng to allow it to track current and previous log files and maintain symlinks to them, as a user option. This replicates one of the options that I (and others) find useful in cronolog. This has been previously discussed on the syslog-ng mailing list, though apparently nothing fully came of it. The archive of that discussion is at: https://lists.balabit.hu/pipermail/syslog-ng/2002-June/003452.html Obviously, it's probably somewhat of a low priority, but it would be nice. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

filter/parse based on certificate attributes?
by Christian Tramnitz 22 Feb '11

22 Feb '11

With syslog 3.0 and ssl support using mutual certificate authentication is it possible to parse/filter/tag based on attributes in the certificate? I'd like to have a common listener and then relay or append messages based on client-cert attribute values... (Sorry if this message is arriving more than once, I seem to have problems with posting through Gmane.) Regards, Christian

4 4

FreeBSD 8 LOG_SECURITY and LOG_AUTH confused
by Brian A. Seklecki 23 Jun '10

23 Jun '10

Guys something shit the bed with 3.0.3 on 8.0-PL: ----- config ---------------- source src { unix-dgram("/var/run/log"); filter f_security { facility(security); }; filter f_auth { facility(auth); }; destination security { file("/var/log/security" template(cfi_template)); }; destination authlog { file("/var/log/auth.log" template(cfi_template)); }; log { source(src); filter(f_security); destination(security); flags(final); }; log { source(src); filter(f_auth); destination(authlog); flags(final); }; ------------------------- # /usr/local/sbin/syslog-ng -p /var/run/syslog.pid -tevdF Syslog connection established; fd='5', server='AF_INET(192.168.128.XXX:514)', local='AF_INET(0.0.0.0:0)' Running application hooks; hook='1' Running application hooks; hook='3' syslog-ng starting up; version='3.0.3' ^Z [5]+ Stopped /usr/local/sbin/syslog-ng -p /var/run/syslog.pid -tevdF [root@cfi-db-corp ~]# bg [root@cfi-db-corp ~]# echo test | logger -p auth.info Incoming log entry; line='<38>Mar 18 15:57:40 bseklecki: test' Filter rule evaluation begins; filter_rule='f_ams' Filter node evaluation result; filter_result='not-match', filter_type='level' Filter node evaluation result; filter_result='not-match', filter_type='AND' Filter node evaluation result; filter_result='not-match', filter_type='AND' Filter rule evaluation result; filter_result='not-match', filter_rule='f_ams' Filter rule evaluation begins; filter_rule='f_auth' Filter node evaluation result; filter_result='match', filter_type='facility' Filter rule evaluation result; filter_result='match', filter_rule='f_auth' Filter rule evaluation begins; filter_rule='f_ams' Filter node evaluation result; filter_result='not-match', filter_type='level' Filter node evaluation result; filter_result='not-match', filter_type='AND' Filter node evaluation result; filter_result='not-match', filter_type='AND' Filter rule evaluation result; filter_result='not-match', filter_rule='f_ams' Filter rule evaluation begins; filter_rule='f_authpriv' Filter node evaluation result; filter_result='not-match', filter_type='facility' Filter rule evaluation result; filter_result='not-match', filter_rule='f_authpriv' Filter rule evaluation begins; filter_rule='f_kern' Filter node evaluation result; filter_result='not-match', filter_type='facility' Filter rule evaluation result; filter_result='not-match', filter_rule='f_kern' Filter rule evaluation begins; filter_rule='f_user' Filter node evaluation result; filter_result='not-match', filter_type='facility' Filter rule evaluation result; filter_result='not-match', filter_rule='f_user' Filter rule evaluation begins; filter_rule='f_mail' Filter node evaluation result; filter_result='not-match', filter_type='facility' Filter rule evaluation result; filter_result='not-match', filter_rule='f_mail' Filter rule evaluation begins; filter_rule='f_security' Filter node evaluation result; filter_result='match', filter_type='facility' Filter rule evaluation result; filter_result='match', filter_rule='f_security' Initializing destination file writer; template='/var/log/security', filename='/var/log/security' The two fixes I can find are: - Move: "log { source(src); filter(f_security);.." below "log { source(src); filter(f_auth);..." ...wait, what?! - Remove reference to LOG_SECURITY /usr/include/syslog.h defines for Facility->index mappings haven't changed since RELENG_6, so I'm not sure what to make of this. Very strange, ~BAS

2 2

[Bug 38] New: Setting values of the Structured Data block.
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=38 Summary: Setting values of the Structured Data block. Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: c.haase(a)ifu.com Type of the Report: enhancement Estimated Hours: 0.0 Please add the functionality to set values inside the Structured Data block. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 37] New: Syslog-ng macros don't work in filters
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=37 Summary: Syslog-ng macros don't work in filters Product: syslog-ng Version: 3.0.x Platform: Other OS/Version: Other Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: vincent.panel(a)telindus.be Type of the Report: --- Estimated Hours: 0.0 Several documented macros don't work when used in filters. It's the case for $SEC, $MSGHDR. Already reported on the syslog-ng mailing list and acknowleged as a syslog-ng bug. I've tried it on Sparc/Solaris (but can't choose it in the platform menu of bugzilla...) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

commit with the oracle sql driver
by Patrick H. 10 Apr '10

10 Apr '10

So, extensive googling has failed me on this. I'm using the sql driver to output to an oracle database, with debugging mode, I can see that the insert queries are indeed being executed, however my tables remain empty. I've been through the source code, and it doesnt look like a commit is being performed anywhere. Though my google efforts, I did find one reference where someone patched the libdbi-drivers oracle driver to do a commit on success after every query, but that is insanely expensive (and ugly). I have started modifying the code to add the flush_lines and flush_timeout option to the sql driver. But before I got too carried away, I was wondering why this is the way it is the way it is, or if I'm missing something.

3 5

syslog-ng 3.0.4 not adjusting for daylight savings time
by Chris Fabri 05 Apr '10

05 Apr '10

I have a red hat 3 system running 3.0.4 It did not successfully adjust for daylight savings time. Everything else on the system is fine - syslog is showing the correct time stamps, the system reports the correct time. Restart of syslog-ng, and shutting down both syslog and syslog-ng did not help. I didn't see anything in the lists addressing this, here are details of my syslog-ng: [fabric@netlog dhcp]$ sudo /usr/local/sbin/syslog-ng -V syslog-ng 3.0.4 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.0#master#1b5d618e301ad94aa20e692ffba16469dece8d10 Compile-Date: Aug 24 2009 16:54:31 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: on Enable-SSL: off Enable-SQL: off Enable-Linux-Caps: on Enable-Pcre: off I didn't see anything in the man page for adjusting for time. I have keep_timestamp(no) configured in my conf file. The systems sending the syslog files time is correctly adjusted for daylight savings. Is this a bug in this particular version, or am I just missing the right flag or something? chris

3 13

Problem using tags with syslog-ng 3.1
by Hoenig, Stefan, VF-Group 04 Apr '10

04 Apr '10

Hi all, I got a problem to get the "tags" feature working on our syslog-ng 3.1. I want to collect messages from 3 different files on the source system and want to separate them again on the central logging server. The client configuration looks like this: ------------------------------------------------------------------------ ---------------------------- source s_app { file("/var/log/log1.log"); file("/opt//log/log2.log" tags("log2")); file("/opt/log/log3.log" tags("log3")); }; options { }; destination d_app { tcp("logrelay01.domain.com" port(13074)); }; log { source(s_app); destination(d_app); }; ------------------------------------------------------------------------ ---------------------------- The log relay does nothing than forward the messages to the central logging server with the following config: ------------------------------------------------------------------------ ---------------------------- options { time_sleep(20); log_fifo_size(1000); dns_cache(2000); dns_cache_expire(87600); keep_hostname(yes); }; source s_remote { tcp(ip("0.0.0.0") port(13074)); }; destination remote_tcp { tcp("centrallog01.domain.com" port(13074)); }; log { source(s_remote); destination(remote_tcp); }; ------------------------------------------------------------------------ ---------------------------- On the central logging server I use filters to separate the logfiles again: ------------------------------------------------------------------------ ---------------------------- @version: 3.0 include "/opt/config/syslogng-inc.conf"; options { time_sleep(20); dns_cache(2000); dns_cache_expire(87600); keep_hostname(yes); create_dirs(yes); }; source s_remote { tcp (ip("0.0.0.0") port(13074) keep-alive(yes)); }; ============================================ This is the confoguration in /opt/config/syslogng-inc.conf # Filter filter f_log1 { host("web00(09|10)"); }; filter f_log2 { host("web00(09|10)") and tags("log2"); }; filter f_log3 { host("web00(09|10)") and tags("log3"); }; #Configuration for Destinations destination d_log1 { file("/var/logs/log1/combined.log" perm(0755) dir_perm(0755)); }; destination d_log2 { file("/var/logs/log2/combined.log" perm(0755) dir_perm(0755)); }; destination d_log3 { file("/var/logs/log3/combined.log" perm(0755) dir_perm(0755)); }; # Logfile log1 log { source(s_remote); filter(f_log1); destination(d_log1); }; # Logfile log2 log { source(s_remote); filter(f_log2); destination(d_log2); }; # Logfile log3 log { source(s_remote); filter(f_log3); destination(d_log3); }; ------------------------------------------------------------------------ ---------------------------- Does anybody have an idea, why it does not work as expected. Thanks for any suggestion and/or idea. Best regards Stefan

6 10

Tailing tomcat catalina.out
by BoOnSiOnG 30 Mar '10

30 Mar '10

Hello all, Good day, I have configure syslog-ng to checks catalina.out every second, but syslog-ng will append date time and machine name to the log, I would like to know is it possible to configure syslog-ng do not alter the original log? my config, source s_tomcat_catalina { file("/srv/tomcat/logs/catalina.out" default-facility(local3) default-priority(info)); }; log output, Mar 29 21:43:38 forward Mar: 29, 2010 9:43:37 PM org.apache.coyote.http11.Http11Protocol start Mar 29 21:43:38 forward INFO: Starting Coyote HTTP/1.1 on http-8080 Mar 29 21:43:38 forward Mar: 29, 2010 9:43:37 PM org.apache.jk.common.ChannelSocket init Mar 29 21:43:38 forward INFO: JK: ajp13 listening on /0.0.0.0:8009 Mar 29 21:43:38 forward Mar: 29, 2010 9:43:37 PM org.apache.jk.server.JkMain start Mar 29 21:43:38 forward INFO: Jk running ID=0 time=0/14 config=null Mar 29 21:43:38 forward Mar: 29, 2010 9:43:37 PM org.apache.catalina.startup.Catalina start Mar 29 21:43:38 forward INFO: Server startup in 428 ms Thanks. :)

3 5