April 2010 - syslog-ng - lists.balabit.hu

[Bug 42] New: capabilities, chown, chmod
by bugzilla＠bugzilla.balabit.com 20 Dec '12

20 Dec '12

https://bugzilla.balabit.com/show_bug.cgi?id=42 Summary: capabilities, chown, chmod Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: zbyniu(a)pld-linux.org Type of the Report: bug Estimated Hours: 0.0 Let's take a look at syslog-ng-3.0.1/src/affile.c lines 60-83 1. CAP_SYS_ADMIN is needed only for /proc/kmsg, it is added w/o check 2. CAP_DAC_READ_SEARCH should be added only if open fail with errno 13 2a. CAP_DAC_OVERRIDE should be added only if open fail with errno 13 and with CAP_DAC_READ_SEARCH set 3. fchown needs CAP_CHOWN unconditionaly 4. fchmod needs CAP_FOWNER if file owner != euid (root here) 5. all caps should be restored summary: - CAP_SYS_ADMIN and CAP_DAC_OVERRIDE are set always even if unnecessary, and permanently - owner, group and perm doesn't work -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 10

[Bug 14] New: Maintain symlinks to current and previous log output files...
by bugzilla＠bugzilla.balabit.com 28 Sep '11

28 Sep '11

https://bugzilla.balabit.com/show_bug.cgi?id=14 Summary: Maintain symlinks to current and previous log output files... Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=218688 OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: enhancement Estimated Hours: 0.0 >From bugs.debian.org: I'm hoping that upstream might consider adding functionality to syslog-ng to allow it to track current and previous log files and maintain symlinks to them, as a user option. This replicates one of the options that I (and others) find useful in cronolog. This has been previously discussed on the syslog-ng mailing list, though apparently nothing fully came of it. The archive of that discussion is at: https://lists.balabit.hu/pipermail/syslog-ng/2002-June/003452.html Obviously, it's probably somewhat of a low priority, but it would be nice. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

filter/parse based on certificate attributes?
by Christian Tramnitz 22 Feb '11

22 Feb '11

With syslog 3.0 and ssl support using mutual certificate authentication is it possible to parse/filter/tag based on attributes in the certificate? I'd like to have a common listener and then relay or append messages based on client-cert attribute values... (Sorry if this message is arriving more than once, I seem to have problems with posting through Gmane.) Regards, Christian

4 4

FreeBSD 8 LOG_SECURITY and LOG_AUTH confused
by Brian A. Seklecki 23 Jun '10

23 Jun '10

Guys something shit the bed with 3.0.3 on 8.0-PL: ----- config ---------------- source src { unix-dgram("/var/run/log"); filter f_security { facility(security); }; filter f_auth { facility(auth); }; destination security { file("/var/log/security" template(cfi_template)); }; destination authlog { file("/var/log/auth.log" template(cfi_template)); }; log { source(src); filter(f_security); destination(security); flags(final); }; log { source(src); filter(f_auth); destination(authlog); flags(final); }; ------------------------- # /usr/local/sbin/syslog-ng -p /var/run/syslog.pid -tevdF Syslog connection established; fd='5', server='AF_INET(192.168.128.XXX:514)', local='AF_INET(0.0.0.0:0)' Running application hooks; hook='1' Running application hooks; hook='3' syslog-ng starting up; version='3.0.3' ^Z [5]+ Stopped /usr/local/sbin/syslog-ng -p /var/run/syslog.pid -tevdF [root@cfi-db-corp ~]# bg [root@cfi-db-corp ~]# echo test | logger -p auth.info Incoming log entry; line='<38>Mar 18 15:57:40 bseklecki: test' Filter rule evaluation begins; filter_rule='f_ams' Filter node evaluation result; filter_result='not-match', filter_type='level' Filter node evaluation result; filter_result='not-match', filter_type='AND' Filter node evaluation result; filter_result='not-match', filter_type='AND' Filter rule evaluation result; filter_result='not-match', filter_rule='f_ams' Filter rule evaluation begins; filter_rule='f_auth' Filter node evaluation result; filter_result='match', filter_type='facility' Filter rule evaluation result; filter_result='match', filter_rule='f_auth' Filter rule evaluation begins; filter_rule='f_ams' Filter node evaluation result; filter_result='not-match', filter_type='level' Filter node evaluation result; filter_result='not-match', filter_type='AND' Filter node evaluation result; filter_result='not-match', filter_type='AND' Filter rule evaluation result; filter_result='not-match', filter_rule='f_ams' Filter rule evaluation begins; filter_rule='f_authpriv' Filter node evaluation result; filter_result='not-match', filter_type='facility' Filter rule evaluation result; filter_result='not-match', filter_rule='f_authpriv' Filter rule evaluation begins; filter_rule='f_kern' Filter node evaluation result; filter_result='not-match', filter_type='facility' Filter rule evaluation result; filter_result='not-match', filter_rule='f_kern' Filter rule evaluation begins; filter_rule='f_user' Filter node evaluation result; filter_result='not-match', filter_type='facility' Filter rule evaluation result; filter_result='not-match', filter_rule='f_user' Filter rule evaluation begins; filter_rule='f_mail' Filter node evaluation result; filter_result='not-match', filter_type='facility' Filter rule evaluation result; filter_result='not-match', filter_rule='f_mail' Filter rule evaluation begins; filter_rule='f_security' Filter node evaluation result; filter_result='match', filter_type='facility' Filter rule evaluation result; filter_result='match', filter_rule='f_security' Initializing destination file writer; template='/var/log/security', filename='/var/log/security' The two fixes I can find are: - Move: "log { source(src); filter(f_security);.." below "log { source(src); filter(f_auth);..." ...wait, what?! - Remove reference to LOG_SECURITY /usr/include/syslog.h defines for Facility->index mappings haven't changed since RELENG_6, so I'm not sure what to make of this. Very strange, ~BAS

2 2

Tests using loggen - not receiving all the packets
by Clayton Dukes 14 May '10

14 May '10

Hi Folks, I'm trying to run a test to check insert rates. If I run this command: ./loggen -r 5000 -D -I 10 127.0.0.1 514 The output shows: average rate = 5441.60 msg/sec, count=54420, time=10.007, msg size=256, bandwidth=1360.40 kB/sec But, my stats don't show that many messages received: syslog-ng[6660]: Log statistics; dropped=\'pipe(/dev/xconsole)=0\', processed=\'center(queued)=24232\', processed=\'center(received)=8077, processed=\'destination(df_logzilla)=8077\' As you can see, it sent 55k messages, but I only received 8k. Am I doing something wrong? Here are my options in the syslog-ng config: options { long_hostnames(off); log_msg_size(8192); flush_lines(1); log_fifo_size(16384); time_reopen(10); use_dns(yes); dns_cache(yes); use_fqdn(yes); keep_hostname(yes); chain_hostnames(no); perm(0644); stats_freq(60); }; -- ______________________________________________________________ Clayton Dukes ______________________________________________________________

7 23

syslog-ng can not work with oracle backend
by Dmitry Sedov 10 May '10

10 May '10

Hello! I took stable binary rpm with open source syslog-ng version 3.0.6 on balabit.hu and install it on rhel 4u7. For some reason it does not want to work with oracle backend. I try next bekend description in syslog-ng.conf: destination d_oracle_syslog { sql(type(oracle) username("login") password("password") database("database") table("table") columns("DATE varchar2(24)", "facility number(2)", "LEVEL number(1)", "host varchar2(128)", "program varchar2(64)", "pid number(8)", "message varchar2(1024)") indexes( "DATE","facility","host") ); }; And after start syslog-ng post in /var/log/messages notes about failure: Apr 30 18:35:47 vm-dc-syslog syslog-ng[9815]: No such DBI driver; type='oracle' Apr 30 18:35:47 vm-dc-syslog syslog-ng[9815]: No such DBI driver; type='oracle' Apr 30 18:35:47 vm-dc-syslog syslog-ng[9815]: No such DBI driver; type='oracle' After this issue appear, I compile libdbi and libdbi-drivers version 0.8.3. But it did not help: syslog-ng continue write "No such DBI driver; type='oracle'". And the same happens with the syslog-ng versions 3.1.1 and 3.1.0. I install syslog-ng with binary rpm's from www.balabit.com. Tell me, please, how I may fix this issue. Regards, Dmitry Sedov.

3 6

Want to down load NCsysng-1.6.7-1.pkg.gz
by sasanka.sahu＠wipro.com 10 May '10

10 May '10

want to download NCsysng-1.6.7-1.pkg.gz but the package is NOT available on the site ( http://www.campin.net/download/NCsysng-1.6.7-1.pkg.gz <http://www.campin.net/download/NCsysng-1.6.7-1.pkg.gz> ) so please provide me the exact link for downloading the same . Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

2 1

Rediecting logs
by abhay singh 10 May '10

10 May '10

Hi All, I have made changes in syslog-ng.conf to redirect logs coming from other server to some specified log file and in some format source s_external { udp(port(514)); }; source s_stunnel { tcp(ip(127.0.0.1) port(514)); }; destination s_external { file("/mydir/syslogs/$HOST_syslog.log" \ owner(user) group(group) perm(0600) dir_perm(0700) create_dirs(yes)); }; destination s_stunnel { file("/mydir/syslogs/$HOST/syslog.log" \ owner(user) group(group) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(s_external); destination(s_external); }; log { source(s_stunnel); destination(s_stunnel); }; But my log file is being created with name "syslog.log" and not as "<hostnmae/ip>_syslog.log" neither $HOST directory made, what may be the issue? Globle options are option{ long_hostname(off); sync(0); } -- Regards.. Abhay Singh.. 91-98804-55587 Sr. Software Engineer. Robust Designs India Pvt Ltd. Bangalore

5 6

Syslog-ng Agent for Windows 3.1 " Customizing file messages"
by John MacDonald 28 Apr '10

28 Apr '10

I am trying to follow the following procedure: Procedure 3.18. Customizing file messages 1. Start the configuration interface of the syslog-ng Agent for Windows application. 2. Select syslog-ng Agent Settings, right-click on File Sources and select Properties. 3. Type the message format into the Message Template field. You can use date- and file-related macros (see Section 3.6.2, "Macros available in the syslog-ng Agent" (p. 26) for a list of macros). The message customized here is included in the server-specific templates using the MESSAGE macro. By default, the following is sent about file messages: $FILE_NAME: $FILE_MESSAGE. 4. Select Apply, then OK. To activate the changes, restart the syslog-ng Agent service. My issue is on File Sources>Properties there isn't a Message Template field. Can you tell me if there is another procedure for this? Thanks. John

2 1

syslig-ng Agent for Windows supported OS
by John MacDonald 27 Apr '10

27 Apr '10

Issue resolved I was running the run installer. John

1 0