August 2010 - syslog-ng - lists.balabit.hu

[Bug 42] New: capabilities, chown, chmod
by bugzilla＠bugzilla.balabit.com 20 Dec '12

20 Dec '12

https://bugzilla.balabit.com/show_bug.cgi?id=42 Summary: capabilities, chown, chmod Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: zbyniu(a)pld-linux.org Type of the Report: bug Estimated Hours: 0.0 Let's take a look at syslog-ng-3.0.1/src/affile.c lines 60-83 1. CAP_SYS_ADMIN is needed only for /proc/kmsg, it is added w/o check 2. CAP_DAC_READ_SEARCH should be added only if open fail with errno 13 2a. CAP_DAC_OVERRIDE should be added only if open fail with errno 13 and with CAP_DAC_READ_SEARCH set 3. fchown needs CAP_CHOWN unconditionaly 4. fchmod needs CAP_FOWNER if file owner != euid (root here) 5. all caps should be restored summary: - CAP_SYS_ADMIN and CAP_DAC_OVERRIDE are set always even if unnecessary, and permanently - owner, group and perm doesn't work -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 10

[Bug 14] New: Maintain symlinks to current and previous log output files...
by bugzilla＠bugzilla.balabit.com 28 Sep '11

28 Sep '11

https://bugzilla.balabit.com/show_bug.cgi?id=14 Summary: Maintain symlinks to current and previous log output files... Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=218688 OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: enhancement Estimated Hours: 0.0 >From bugs.debian.org: I'm hoping that upstream might consider adding functionality to syslog-ng to allow it to track current and previous log files and maintain symlinks to them, as a user option. This replicates one of the options that I (and others) find useful in cronolog. This has been previously discussed on the syslog-ng mailing list, though apparently nothing fully came of it. The archive of that discussion is at: https://lists.balabit.hu/pipermail/syslog-ng/2002-June/003452.html Obviously, it's probably somewhat of a low priority, but it would be nice. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

filter/parse based on certificate attributes?
by Christian Tramnitz 22 Feb '11

22 Feb '11

With syslog 3.0 and ssl support using mutual certificate authentication is it possible to parse/filter/tag based on attributes in the certificate? I'd like to have a common listener and then relay or append messages based on client-cert attribute values... (Sorry if this message is arriving more than once, I seem to have problems with posting through Gmane.) Regards, Christian

4 4

[Bug 92] New: Allow user to specify SSL/TLS cipher suite for connections
by bugzilla＠bugzilla.balabit.com 11 Jan '11

11 Jan '11

https://bugzilla.balabit.com/show_bug.cgi?id=92 Summary: Allow user to specify SSL/TLS cipher suite for connections Product: syslog-ng Version: 3.1.x Platform: PC OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: brett.edgar(a)truedigitalsecurity.com Type of the Report: enhancement Estimated Hours: 0.0 Created an attachment (id=22) --> (https://bugzilla.balabit.com/attachment.cgi?id=22) Patch to allow user to specify acceptable TLS cipher suites. Some compliance regimens (e.g., the PCI DSS) require SSL/TLS connections to disable weak (<128 bit key length) ciphers and old protocols like SSLv2. Syslog-ng already disables SSLv2 by default, but there is no way to disable the weak ciphers without modifying the source with every new release. I have developed a very small patch that adds a configuration file line with the tls { } stanza to specify which TLS ciphers can be used. Example: source tlssrc { tcp(ip(1.2.3.4) port(514) max-connections(32) tls( key_file("/etc/syslog-ng/server.key") cert_file("/etc/syslog-ng/server.crt") cipher_suite("ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:!SSLv2") peer_verify(optional-untrusted)) ); }; -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

3.2 alpha 2 build error
by Matthew Hall 13 Sep '10

13 Sep '10

When building using debian/rules binary on 3.2 alpha 2 my build fails here. Any advice on this one? Thanks, Matthew. /bin/bash ../../libtool --tag=CC --mode=compile gcc -std=gnu99 -DHAVE_CONFIG_H -I. -I../.. -I../../src -I.. -DENABLE_SQL=1 -pthread -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/eventlog -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -I/usr/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -MT libafsql_la-afsql.lo -MD -MP -MF .deps/libafsql_la-afsql.Tpo -c -o libafsql_la-afsql.lo `test -f 'afsql.c' || echo './'`afsql.c libtool: compile: gcc -std=gnu99 -DHAVE_CONFIG_H -I. -I../.. -I../../src -I.. -DENABLE_SQL=1 -pthread -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/eventlog -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -I/usr/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -MT libafsql_la-afsql.lo -MD -MP -MF .deps/libafsql_la-afsql.Tpo -c afsql.c -fPIC -DPIC -o .libs/libafsql_la-afsql.o afsql.c:120: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘dbi_instance’ afsql.c: In function ‘afsql_dd_insert_db’: afsql.c:583: warning: implicit declaration of function ‘dbi_conn_new_r’ afsql.c:583: error: ‘dbi_instance’ undeclared (first use in this function) afsql.c:583: error: (Each undeclared identifier is reported only once afsql.c:583: error: for each function it appears in.) afsql.c: In function ‘afsql_dd_init’: afsql.c:1007: warning: implicit declaration of function ‘dbi_initialize_r’ afsql.c:1007: error: ‘dbi_instance’ undeclared (first use in this function)

4 14

logic and duplicate suppression
by John Kristoff 03 Sep '10

03 Sep '10

I have a couple of scenarios where I'm looking to enhance how I handle and process some logs. I'm looking for suggestions on what my options are, but maybe these are potential feature requests? 1. In using a parser (cvs or the patterndb), I'd like to use some conditionals based on a resultant macro value. So for example, if I have an sshd authentication log message with a source address in a macro and that address is contained w/in a specific prefix, I'd like to handle that message differently. Perhaps not log it all or set another MACRO to a certain value. 2. I'd like to be able to suppress duplicate messages even if they are not necessarily contiguous at the destination. So for example, if I have a SSH client that generates a log of its SSH client protocol and software, I don't need to see that over and over again (e.g. as you might commonly see today in SSH brute force attacks). John

4 10

Insert hostname instead of overwrite ?
by stucky 03 Sep '10

03 Sep '10

Guys I'm trying to log to a loadbalanced VIP. It seems to work ok except that the loadbalancer uses SNAT so I loose my source IP. This means I cannot use dns or even the source ip to get the source host as all logs appear to come from the same source (the loadbalancer). This means I have no choice but to rely on the hostname field which works about 98% of the time but some stuff like Dell OpenManage skips the hostname field. So I'd get logs like this on host "cage" f.e. Aug 16 21:47:22 Server Administrator: Storage Service EventID: 2242 The Patrol Read has started.: Controller 0 (PERC 5/i Integrated) I fixed that by telling the syslog-ng client to force itself to figure out a proper hostname and now the log looks like this Aug 17 13:51:10 cage Administrator[]: Instrumentation Service EventID: 1000 Server Administrator starting I thought syslog-ng inserts the hostname but by the looks of it it simply replaces whatever is in the expected field with the hostname it has just figured out. As you can see it overwrote the entry "Server". No biggie in the above case but what if this field contained valuable information ? I'd loose that. Any way to squeeze in the hostname so to speak ? -- stucky

5 12

SNMP Traps?
by Clayton Dukes 03 Sep '10

03 Sep '10

Hey guys, A while back, I though I read that syslog-ng would process traps as well in v3.x, was I just imagining that or did it happen? ______________________________________________________________ Clayton Dukes ______________________________________________________________

2 3

TCP recv bug in syslog-ng v2.09?
by Clayton Dukes 02 Sep '10

02 Sep '10

Hey guys, Are there any known bugs for syslog-ng v2.09 that won't allow a cisco router to send logs over tcp? I can see a connection established in syslog-ng. I also see the message come in via tcpdump, but nothing in syslog-ng's output. If I change the router from tcp to udp, messages come in as expected. *Router config:* logging source-interface Loopback0 logging 172.18.224.150 <tricon:40,-1|172.18.224.150;majoshi@cisco.com> logging host 172.18.224.190 <tricon:40,-1|172.18.224.190;majoshi@cisco.com>transport tcp *syslog-ng config:* source s_all { udp(); tcp(ip(11.31.130.99) port(8002) max-connections(300)); tcp(ip(172.18.224.190) port(601) max-connections(300)); }; *debug output:* I commented out the line above for the other interface (11.31.130.99), restarted and this is all I see: Syslog connection accepted; from='AF_INET(14.3.23.50<tricon:40,-1|(14.3.23.50;majoshi@cisco.com>:63845)', to='AF_INET(172.18.224.190 <tricon:40,-1|(172.18.224.190;majoshi@cisco.com> :601)' *tcpdump:* 14:13:46.914566 IP (tos 0x0, ttl 251, id 4303, offset 0, flags [none], proto TCP (6), length 134) 14.3.23.50.63845 > xxx.com.601: Flags [.], seq 230:324, ack 1, win 4128, length 94 *Router debug:* *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:19.772<tricon:40,-1|.772;majoshi@cisco.com>: %SYS-5- <tricon:40,-1|-5-;majoshi@cisco.com>CONFIG_I: Configured from console by pnoc on vty0 (172.18.224.151) <tricon:40,-1|0 (172.18.224.151);majoshi(a)cisco.com> *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:20.776<tricon:40,-1|.776;majoshi@cisco.com>: Released port 15205 <tricon:40,-1|15205;majoshi@cisco.com> in Transport Port Agent for TCP IP type 1 delay 240000 <tricon:40,-1|240000;majoshi@cisco.com> *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:20.776<tricon:40,-1|.776;majoshi@cisco.com>: TCB 0x850 <tricon:40,-1|850;majoshi@cisco.com>F9754<tricon:40,-1|9754;majoshi@cisco.com>destroyed *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCB83648 <tricon:40,-1|83648;majoshi@cisco.com>E60 created *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCB83648 <tricon:40,-1|83648;majoshi@cisco.com>E60 setting property TCP_PID (8) 845083 <tricon:40,-1|(8) 845083;majoshi(a)cisco.com>E4 *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCB83648 <tricon:40,-1|83648;majoshi@cisco.com>E60 setting property TCP_NO_DELAY (1) 845083 <tricon:40,-1|(1) 845083;majoshi(a)cisco.com>E8 *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCB83648 <tricon:40,-1|83648;majoshi@cisco.com>E60 setting property TCP keepalive timeout (17) 845084 <tricon:40,-1|(17) 845084;majoshi(a)cisco.com> A0 *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCP: Random local port generated 63845<tricon:40,-1|63845;majoshi@cisco.com>, network 1 *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCB83648 <tricon:40,-1|83648;majoshi@cisco.com>E60 bound to 14.3.23.50.63845<tricon:40,-1|14.3.23.50.63845;majoshi@cisco.com> *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: Reserved port 63845 <tricon:40,-1|63845;majoshi@cisco.com> in Transport Port Agent for TCP IP type 1 *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCP: sending SYN, seq 3300233565 <tricon:40,-1|3300233565;majoshi@cisco.com>, ack 0 *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCP0: Connection to 172.18.224.190<tricon:40,-1|172.18.224.190;majoshi@cisco.com>:601, advertising MSS 536 <tricon:40,-1|536;majoshi@cisco.com> *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.775<tricon:40,-1|.775;majoshi@cisco.com>: TCP0: state was CLOSED -> SYNSENT [63845 - <tricon:40,-1|63845 -;majoshi(a)cisco.com>> 172.18.224.190(601)<tricon:40,-1|172.18.224.190(601);majoshi@cisco.com> ] *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.779<tricon:40,-1|.779;majoshi@cisco.com>: TCP0: state was SYNSENT -> ESTAB [63845 - <tricon:40,-1|63845 -;majoshi(a)cisco.com>> 172.18.224.190(601)<tricon:40,-1|172.18.224.190(601);majoshi@cisco.com> ] *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.779<tricon:40,-1|.779;majoshi@cisco.com>: TCP: tcb 83648 <tricon:40,-1|83648;majoshi@cisco.com>E60 connection to 172.18.224.190 <tricon:40,-1|172.18.224.190;majoshi@cisco.com>:601, peer MSS 1460 <tricon:40,-1|1460;majoshi@cisco.com>, MSS is 536<tricon:40,-1|536;majoshi@cisco.com> *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.779<tricon:40,-1|.779;majoshi@cisco.com>: TCB83648 <tricon:40,-1|83648;majoshi@cisco.com>E60 connected to 172.18.224.190.601 <tricon:40,-1|172.18.224.190.601;majoshi@cisco.com> *Aug 17 17 <tricon:40,-1|17 17;majoshi(a)cisco.com>:34:25.779<tricon:40,-1|.779;majoshi@cisco.com>: %SYS-6- <tricon:40,-1|-6-;majoshi@cisco.com>LOGGINGHOST_STARTSTOP: Logging to host 172.18.224.190 <tricon:40,-1|172.18.224.190;majoshi@cisco.com> port 601 <tricon:40,-1|601;majoshi@cisco.com> started - reconnection ______________________________________________________________ Clayton Dukes ______________________________________________________________

5 15

v3.0.8: How to logging messages with non-rfc timestamps?
by Sergey V. Lobanov 02 Sep '10

02 Sep '10

I'm using syslog-ng v3.0.8(OSE) for logging messages from remote devices. There is a host which sends messages with incorrect timestamp format, for example "Jan 19 15:52:7". Syslog-ng does not store the first word in timestamp via macros $MSGHDR. For example: $ echo "<134>Jan 19 15:52:7 test" | nc -u 192.168.3.142 514 ^C But log file does not contains the word 'Jan': Aug 29 16:49:10 10.147.0.202 10.147.0.202 19 15:52:7 test Configuration file: @version: 3.0 options { use_dns(yes); }; source src_remote { udp(ip("0.0.0.0") port(514) flags(store-legacy-msghdr)); tcp(ip("0.0.0.0") port(514) flags(store-legacy-msghdr)); }; template t_remote {template("$DATE $SOURCEIP $HOST_FROM $MSGHDR$MESSAGE\n"); template_escape(no); }; destination remoteall { file("/var/log/all-remote.log" template(t_remote)); }; log { source(src_remote); destination(remoteall); }; How can I store the original timestamp from the remote host? -- wbr, Sergey V. Lobanov

2 2