April 2010 - syslog-ng - lists.balabit.hu

[Bug 51] check if the PID is valid before start
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=51 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED --- Comment #4 from Balazs Scheidler <bazsi(a)balabit.hu> 2010-04-12 22:28:20 --- There were related fixes, which should fix this issue. 3.0.6 should be fine in this regard. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 67] write error: Bad file descriptor
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=67 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED --- Comment #2 from Balazs Scheidler <bazsi(a)balabit.hu> 2010-04-12 22:26:39 --- this should be fixed in 3.0.6 release with this patch: Author: Juhasz Viktor <jviktor(a)balabit.hu> 2010-03-22 11:40:05 Committer: Juhasz Viktor <jviktor(a)balabit.hu> 2010-03-22 11:40:05 Parent: c4ee14878dee2573f6c33cd76cd171e093b3910d ([Old license file] Delete the license.txt from the install dir if) Child: 5a51b603ea4f9db084b2d79a28b594269068d1cc ([deb] Don't stop the syslog-ng many times in case of upgrade) Branch: Follows: Precedes: [debconf] don't use file descriptor 3 because it's owner is the debconf read the file directly ------------------- data/debian-packaging/syslog-ng/postinst ------------------- index 738df95..57d9ef6 100755 @@ -59,8 +59,6 @@ preprocess_config() if [ -f $PREPROCESSED_CONFIG_FILE ]; then rm $PREPROCESSED_CONFIG_FILE fi - exec 3<&0 - exec 0<$TEMPLATE_CONFIG_FILE while read line do case `echo $line | cut -d ':' -f 1` in @@ -85,7 +83,7 @@ preprocess_config() fi ;; esac - done + done < $TEMPLATE_CONFIG_FILE fi } -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 74] handling for multiline log messages in files
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=74 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |RESOLVED Resolution| |INVALID Severity|blocker |normal --- Comment #4 from Balazs Scheidler <bazsi(a)balabit.hu> 2010-04-12 22:23:51 --- This is not a bug, but rather a feature request and we're already working on it. I'd set the resolution to NOTABUG if we had that, but we only have INVALID, so this way this goes. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 73] sql driver does not: perform commits, doesnt support session start statements, mangles table names
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=73 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED --- Comment #2 from Balazs Scheidler <bazsi(a)balabit.hu> 2010-04-12 22:21:52 --- Hi, Just as stated on the mailing list, I've integrated your work into the 3.2 branch of syslog-ng, but I've some comments, please see inline: (In reply to comment #0) > Created an attachment (id=18) --> (https://bugzilla.balabit.com/attachment.cgi?id=18) [details] > fixes > > The main problem: When using the sql driver to output entries straight to a database, commits are not performed, so the data isnt visible outside the session > used by syslog-ng. > This was experienced when using the oracle driver of libdbi-drivers. You might be using an older version of libdbi, in my version, the Oracle driver automatically commits after every query using OCI_COMMIT_ON_SUCCESS parameter: status = OCIStmtExecute(Oconn->svc, stmt, Oconn->err, (ub4) (stmttype == OCI_STMT_SELECT ? 0 : 1), (ub4) 0, (CONST OCISnapshot *) NULL, (OCISnapshot *) NULL, stmttype == OCI_STMT_SELECT ? MY_OCI_STMT_SCROLLABLE_READONLY : OCI_COMMIT_ON_SUCCESS); But anyway, your patches are now integrated, but COMMITs need to be explicitly requested by the flags("explicit-commits") option to the SQL driver. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 79] internal statistics log can not be forwarded to syslog server.
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=79 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO --- Comment #1 from Balazs Scheidler <bazsi(a)balabit.hu> 2010-04-12 22:17:58 --- I can't see how that '!' could be added to a message and split, no such thing is performed using syslog-ng. Although while trying to verify this issue, I've found a problem: * syslog-ng 3.1 & 3.2 (the ones with the NVtable refactorization) cannot hold more than 64k in an NV pair Thus $MSG cannot be longer than 64k and the worst of it was, that it got truncated not at 64k, but at the lowest 16 bits of the length. I've fixed this in 3.2 now. However I couldn't find how syslog-ng could do what you describe. Can you elaborate? Thanks. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

syslog-ng 3.0.6 has been released
by devel＠balabit.hu 12 Apr '10

12 Apr '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.0.6 SUMMARY : new stable release DATE : Apr 11, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.0.6) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.6 Sun, 11 Apr 2010 10:35:46 +0200 Bugfixes: * Fixed a boundary checking error on the usertty() destination, which can cause a local buffer to be overflown if the wtmp file on the system contains more than 123 characters in its ut_line member. It is not believed to be exploitable on the following platforms: Linux (32 chars) Solaris (12 chars) AIX (64 chars) HP-UX (12 chars) FreeBSD (8 chars) OpenBSD (8 chars) * Fixed a possible loss of the last partial message in the TCP and TLS transports of the syslog() driver. * Fixed empty line handling in the syslog() driver. The parser now accepts empty lines (which it didn't, but should have) and empty lines have the required trailing space which it didn't previously. * Fixed SDATA value lookup in case the the SD-ID contains dots. * Added escaping support to the structured-data parser. * Fixed an off-by-one bug in the structured data parser. * Fixed a possible segmentation fault after initializing the configuration when using unix-stream() and unix-dgram() destinations. * Fixed the Solaris 10 SMF script to handle "refresh" calls. * Fixed the Solaris 10 SMF script to handle an existing PID file without syslog-ng running with that pid. * Fixed the Solaris init/SMF scripts to avoid ugly error messages if the dump device doesn't exist. This situation can easily happen in a chroot or a zone. * Fixed a 100% CPU usage if the pipe() driver is applied to a regular file, or a file() driver on a named pipe. * Fixed a daylight saving problem in the transition window when receiving a BSD timestamp. * syslog-ng CSV format statistics (reachable via the syslog-ng.ctl socket) is now properly escaped. Other changes: * Fixed a linking problem with the MacOSX linker. * Added automatic test coverage for RFC5424 protocol format. * The SQL driver will drop a message after 3 failed attempts to insert it into the database. * If a character set conversion problem occurs on a connection, syslog-ng will drop the connection instead of trying to read further. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system…

1 0

syslog-ng 3.1.1 has been released
by devel＠balabit.hu 12 Apr '10

12 Apr '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.1.1 SUMMARY : new stable release DATE : Apr 11, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.1.1) has been released. For latest fixes in the 3.1.x feature branch you are recommended to upgrade to this version. CHANGES: 3.1.1 Sun, 11 Apr 2010 10:26:57 +0200 Bugfixes: * Solaris 10 SMF script now checks if the pid file refers to an actual instance of syslog-ng to make sure that syslog-ng is started even after a system crash. * The System V init script used on Solaris 8/9 gave ugly error messages if the dump device doesn't exist (which happens in a chroot/zone environment), this was fixed. * Fixed a 100% CPU usage if the configuration file uses the pipe driver on a regular file or a file driver on a named pipe. * Fixed a daylight saving problem in the transition window when receiving a BSD timestamp. * syslog-ng CSV format statistics (reachable via syslog-ng-ctl) is now properly escaped. Other changes: * Added "TAGS" macro which expands to a list of comma separated message tags. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

match/program granularity
by Alex 12 Apr '10

12 Apr '10

Hi, I'm using an older version of syslog-ng for now, until I can upgrade to post-3.0, but for the time-being I'd like to be able to use the match() and program() qualifiers to redirect output from bind to a specific file, from the local host as well as from remote hosts using local3.info. Where can I find the documentation that describes the differences in usage for match() and program()? In the following line, what is considered "program" and what is considered "match"? How does this change if the line is from a remote host? Apr 10 17:16:15 smtp01 postfix/cleanup[23834]: 1F3BBE74004: message-id=<20103410231614.1F3BBE74004(a)smtp01.myhost.com> Can I match on hostname? Are there other parameters that might be helpful in classifying this information? Thanks, Alex

2 3

commit with the oracle sql driver
by Patrick H. 10 Apr '10

10 Apr '10

So, extensive googling has failed me on this. I'm using the sql driver to output to an oracle database, with debugging mode, I can see that the insert queries are indeed being executed, however my tables remain empty. I've been through the source code, and it doesnt look like a commit is being performed anywhere. Though my google efforts, I did find one reference where someone patched the libdbi-drivers oracle driver to do a commit on success after every query, but that is insanely expensive (and ugly). I have started modifying the code to add the flush_lines and flush_timeout option to the sql driver. But before I got too carried away, I was wondering why this is the way it is the way it is, or if I'm missing something.

3 5

URL for open source and premium version comparison
by Clayton Dukes 06 Apr '10

06 Apr '10

Hey folks, Someone from work asked me why they should pay for the Premium edition as opposed to using the OSE. I thought I would just point him to a URL the compares the two, but can't seem to locate it. Is it out there? -- ______________________________________________________________ Clayton Dukes ______________________________________________________________

2 2