January 2011 - syslog-ng - lists.balabit.hu

syslog-ng 3.1.4 has been released
by devel＠balabit.hu 14 Jan '11

14 Jan '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.1.4 SUMMARY : new stable release DATE : Jan 14, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.1.4) has been released. For latest fixes in the 3.1.x feature branch you are recommended to upgrade to this version. CHANGES: 3.1.4 Sun, 02 Jan 2011 13:06:13 +0100 Bugfixes: * Fixed hostname resolution in case normalize_hostnames() is enabled. In this case syslog-ng didn't properly NUL terminate the string causing binary characters to be emitted in log messages. * Fixed a possible security issue on FreeBSD and on platforms where mode_t is an unsigned 16 bit value. On these platforms syslog-ng may be using 0xFFFF as the permission bits causing log files to be world readable/writable/executable/setuid. * Fixed handling the port() options for SQL destinations. * Fixed a possible segmentation fault when the port number is changed for a TCP source, the configuration is reloaded and there were open connections for the old port, which send messages after the SIGHUP. This behaviour has been broken since 3.0.1. * The configure script has been changed to properly honour the value of ${exec_prefix} in case the env wrapper is enabled (--enable-env-wrapper). Configurations not using the env wrapper or using the same value for exec_prefix & prefix should not be affected. Other Changes: * Added explicit patterndb version check, in order to inform the user that a patterndb file is meant to be used by a newer syslog-ng version. * Increase YYMAXDEPTH value to make it possible to process larger configuration files. * Clarified the message on the deprecated use of use_time_recvd() Credits: Paul Krizak, Mukarram Syed, Philippe LEBRETON, Zhengxiang Pan, Matthew Hall, Craig Bell, Gergely Nagy, Laszlo Boszormenyi, Peter Czanik and Steven Chamberlain for reporting the bugs fixed in this release. Patches were authored by by Attila Nagy (BalaBit) and Balazs Scheidler (BalaBit). DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

syslog-ng 3.0.10 has been released
by devel＠balabit.hu 14 Jan '11

14 Jan '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.0.10 SUMMARY : new stable release DATE : Jan 14, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.0.10) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.10 Sun, 02 Jan 2011 12:43:46 +0100 Bugfixes: * Fixed handling the port() options for SQL destinations. * Fixed a possible segmentation fault when the port number is changed for a TCP source, the configuration is reloaded and there were open connections for the old port, which send messages after the SIGHUP. This behaviour has been broken since 3.0.1. * The configure script has been changed to properly honour the value of ${exec_prefix} in case the env wrapper is enabled (--enable-env-wrapper). Configurations not using the env wrapper or using the same value for exec_prefix & prefix should not be affected. * Fixed a possible security issue on Debian/kFreeBSD and on platforms where mode_t is an unsigned 16 bit value. On these platforms syslog-ng may be using 0xFFFF as the permission bits. Credits: Philippe LEBRETON, Zhengxiang Pan, Matthew Hall and Steven Chamberlain for reporting the bugs fixed in this release. Patches were authored by by Attila Nagy (BalaBit) and Balazs Scheidler (BalaBit). DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system…

1 0

Tailing a file
by maillists0＠gmail.com 14 Jan '11

14 Jan '11

I need to tail a bunch of application logs that aren't in syslog format and send them to a remote server. I've configured this: source s_tail { file(/var/log/chaotic_debug_log follow_freq(1) flags(no-parse)); }; destination remote { tcp("my_syslogserver.com" port(514)); }; log { source(s_tail); destination(remote); }; syslog-ng starts successfully and doesn't complain, but nothing happens... no logs appear remotely. I did a tcpdump on the syslog server and nothing is showing up from this box, so I did an strace on syslog-ng and didn't see the log files being opened. Running lsof on those files didn't show anything but the writing program. syslog-ng just isn't reading the files. Is something wrong with my config? How might I troubleshoot this? The syslog-ng version is 2.1.4 on CentOS 5.4. Also, to have syslog tail multiple files, do I just add multiple entries, like this? source s_tail { file(/var/log/chaotic_debug_log1 follow_freq(1) flags(no-parse)); }; source s_tail { file(/var/log/chaotic_debug_log2 follow_freq(1) flags(no-parse)); }; source s_tail { file(/var/log/chaotic_debug_log3 follow_freq(1) flags(no-parse)); }; Any help is appreciated. Thanks!

2 2

ld.so.1 problem during upgrade to 3.1.2
by Zeek Anow 14 Jan '11

14 Jan '11

I just upgraded to syslog-ng Solaris 10 on a Sun server. When I went to test my syslog-ng.conf file I am getting the following error: ld.so.1: syslog-ng: fatal: relocation error: file /.alt.Solaris10/usr/local/sbin/syslog-ng: symbol g_malloc_n: referenced symbol not found It looks as though something is missing from a library or maybe a path is not set correctly. Here are the packages I installed: libiconv-1.13.1-sol10-sparc-local glib-2.25.13-sol10-sparc-local libintl-3.4.0-sol10-sparc-local libgcc-3.4.6-sol10-sparc-local pcre-8.10-sol10-sparc-local eventlog-0.2.12-sol10-sparc-local libpcap-1.1.1-sol10-sparc-local tcpdump-4.1.1-sol10-sparc-local syslogng-3.1.2-sol10-sparc-local I had originally installed gcc-3.4.6-sol10-sparc-local too, but then uninstalled all packages and then reinstalled everything except gcc-3.4.6-sol10-sparc-local. The instructions says one or the other. Anyone have any ideas on how to fix this? Thanks

4 7

Syslog-ng/Rsyslog "message" differences (?)
by Champ Clark III [Softwink] 14 Jan '11

14 Jan '11

Hello all! I've got a bit of a strange problem. I've been developing software (Shameless plug: http://sagan.softwink.com) that does log analysis. This software is mostly used with Syslog-ng and Rsyslog. We recently started testing some log normalization, and I'm seeing different results from syslog-ng's $MSG string and rsyslog %msg%. For example: template("$MSG\n") template-escape(no)); }; --------------- Syslog-ng: template("$MSG\n") template-escape(no)); }; Output: sshd[20657]: Invalid user champtest from 66.177.167.194 --------------- Rsyslog: $template sagan, "%msg%\n" Output: Invalid user champtest from 66.177.167.194 --------------- Whitespacing aside, with syslog-ng I get the program information within the message field. I should point out that most of the systems in the network are Syslog-ng and reporting to Rsyslog (which I can switch out with Syslog-ng for testing). I guess my questions are: 1. Does this sound like a Syslog-ng/Rsyslog interoperability issue? 2. Or do the two just see the "message" formats differently? 3. Maybe it's just my setup (syslog-ng/rsyslog versions)? I have a "work around" with Rsyslog, but was wondering if there where any thoughts on this issue? Thanks -- Champ Clark III | Softwink, Inc | 800-538-9357 x 101 http://www.softwink.com GPG Key ID: 58A2A58F Key fingerprint = 7734 2A1C 007D 581E BDF7 6AD5 0F1F 655F 58A2 A58F If it wasn't for C, we'd be using BASI, PASAL and OBOL.

3 5

Issues while using Syslog destination driver
by Amit Khare 13 Jan '11

13 Jan '11

Hi, I am getting a weird issues while using the syslog destination driver. I am sending an xml message to syslog (syslog-ng 3.1) and forwarding the message over to another destination. The relevant entries in my syslog.conf look as following: filter f_atna { facility(local7); }; destination d_loghost { syslog("19.16.2.9" transport("tcp") port(6514) template("$MESSAGE")); }; log { source(src); filter(f_atna); destination(d_loghost); }; The problem I am running into is that the xml message is not getting processed on the other side because I am getting some weird characters are getting added in the xml message: <?xml - - - version="1.0" encoding="UTF-8"?> The above xml tag is constant in my program and therefore I am not inserting it and I don't even see it in /var/log/localmessages Dec 28 11:01:07 10.15.1.1 <?xml version="1.0" encoding="UTF-8"?> but when I do see it in my tcpdump I do see it. I am not seeing these weird dashes when I use the tcp destination driver but the message is not in the required format so it blows up on the other side. Has anyone seen this issue before? Any help will be greatly appreciated. Thanks, Amit

2 1

Broken Debug Behavior in libdbi
by Matthew Hall 13 Jan '11

13 Jan '11

Hello, Sorry about the cross-post, this came up in the interaction of two different pieces of software used together. libdbi's configure.in and other files contain some broken code which is preventing me from debugging a segfault in dbi_initialize when this function is called by syslog-ng. 1) The code is stripping the libraries of debug symbols when 'make install' is called which violates the GNU coding standards. To fix this, I want to disable library stripping that it is doing which is not in line with the standards and would appreciate advice on how to do this. 2) I could work around it using the make debug target, but then the could would ignore my CFLAGS which are: -m32 -g -I /home/y/include Ignoring these causes it to try to generate a 64-bit library which won't be compatible with the syslog-ng binary I want to build. To fix this, I want to make sure that the DEBUG target is not ignoring or overriding the 'upstream' user flags, but merely adding to them, so that my '-m32' and my '-I' are not lost, which causes build breakage for me, and my '-g' gets duplicated. 3) To work around these problems for now I'm going to patch configure.in and rerun autoconf unless there is an alternative proposal. Thanks, Matthew Hall. Here is the problematic flag setup being done in configure.in: if test -z "$GCC"; then case $host in *-*-irix*) if test -z "$CC"; then CC=cc fi DEBUG="-g -signed" CFLAGS="-O2 -w -signed" PROFILE="-p -g3 -O2 -signed" ;; sparc-sun-solaris*) DEBUG="-v -g" CFLAGS="-xO4 -fast -w -fsimple -native -xcg92" PROFILE="-v -xpg -g -xO4 -fast -native -fsimple -xcg92 -Dsuncc" ;; *) DEBUG="-g" CFLAGS="-O" PROFILE="-g -p" ;; esac else case $host in *-*-linux*) DEBUG="-g -Wall -D_REENTRANT -D__NO_MATH_INLINES -fsigned-char -std=gnu99" CFLAGS="-O20 -ffast-math -D_REENTRANT -fsigned-char -std=gnu99" PROFILE="-pg -g -O20 -ffast-math -D_REENTRANT -fsigned-char -std=gnu99";; sparc-sun-*) DEBUG="-g -Wall -D__NO_MATH_INLINES -fsigned-char -mv8 -std=gnu99" CFLAGS="-O20 -ffast-math -D__NO_MATH_INLINES -fsigned-char -mv8 -std=gnu99" PROFILE="-pg -g -O20 -D__NO_MATH_INLINES -fsigned-char -mv8 -std=gnu99" ;; *) DEBUG="-g -Wall -D__NO_MATH_INLINES -fsigned-char -std=gnu99" CFLAGS="-O20 -D__NO_MATH_INLINES -fsigned-char -std=gnu99" PROFILE="-O20 -g -pg -D__NO_MATH_INLINES -fsigned-char -std=gnu99" ;; esac fi

2 3

Authentication problem
by Fabien Bagard 13 Jan '11

13 Jan '11

Hi all, I am trying to set up a centralized syslog server, with encryption and authentication over TCP. Communication is ok, encryption too, but I can't get the authentication to work. Here is my actual configuration, reduced to what is needed : _Client :_ source s_src { unix-dgram("/dev/log"); internal(); file("/proc/kmsg" program_override("kernel")); }; ... destination d_net { tcp("192.168.0.42" port(4242) tls( ca_dir("/etc/rsyslog.d/certs/CA/") cert_file("/etc/rsyslog.d/certs/client.crt") key_file("/etc/rsyslog.d/certs/client.key") peer_verify(optional-untrusted) ) log_fifo_size(1000) ); }; ... log { source(s_src); destination(d_net); }; _Server :_ source s_src { # Local logging unix-dgram("/dev/log"); file("/proc/kmsg" program_override("kernel")); # Remote logging tcp( port(4242) tls( ca_dir("/etc/syslog-ng/certs/CA/") cert_file("/etc/syslog-ng/certs/server.crt") key_file("/etc/syslog-ng/certs/server.key") peer_verify(optional-untrusted) ) ); }; The CA which was used to sign these certificates is world readable and located in /etc/syslog-ng/certs/CA/ This setup works : server is getting client's logs, and cypherred on the wire. When I replace /peer_verify(optional-untrusted)/ by /peer_verify(required-trusted)/, in order to get mutual authentication, I get this error : ==> /var/log/error <== Jan 6 14:42:09 client syslog-ng[11086]: Certificate validation failed; subject='emailAddress=email(a)address.com, CN=server.fqdn, OU=Org Unit, O=Company, L=City, ST=Crountry, C=ID', issuer='emailAddress=email(a)address.com, CN=Root CA, OU=Org Unit, O=Company Root CA, L=City, ST=Country, C=ID', error='unable to get local issuer certificate', depth='0' Jan 6 14:42:09 client syslog-ng[11086]: SSL error while writing stream; tls_error='SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed' Jan 6 14:42:09 client syslog-ng[11086]: I/O error occurred while writing; fd='9', error='Broken pipe (32)' ==> /var/log/messages <== Jan 6 14:42:09 client syslog-ng[11086]: Syslog connection broken; fd='9', server='AF_INET(192.168.0.42:4242)', time_reopen='60' But my certificates are good : openssl verify -CAfile /etc/syslog-ng/certs/CA/ca.crt -purpose any /etc/syslog-ng/certs/client.crt /etc/syslog-ng/certs/client.crt: OK openssl verify -CAfile /etc/syslog-ng/certs/CA/ca.crt -purpose any /etc/syslog-ng/certs/server.crt /etc/syslog-ng/certs/server.crt: OK More informations : root@[client|server]:~ # syslog-ng -V syslog-ng 3.1.3 Installer-Version: 3.1.3 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.1#master#def34661b08109f8148904b860457d5747c425b3 Compile-Date: Nov 28 2010 12:29:35 Enable-Threads: on Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: on Enable-Linux-Caps: on Enable-Pcre: on Does someone has any clue on what's going wrong ? -- Fabien Bagard IT Department tel + 33 (0)1 48 03 60 40 -------------------------------------------------------------------------------- Parrot SA 174, Quai de Jemmapes | 75010 Paris - France tel + 33 (0)1 48 03 60 60 | fax + 33 (0)1 48 03 70 08 http://www.parrot.com -------------------------------------------------------------------------------- This e-mail message and any attached document(s) are for the sole use of the intended recipient(s)and may contain confidential and legally privileged information. Any unauthorized review, copy, use and/or disclosure is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original.

3 4

destination based on custom field question
by Christopher Barry 13 Jan '11

13 Jan '11

Greetings, I'm new to syslog-ng, and I'm trying to key off of a custom field in a log entry, and put the message in a particular directory named for the field. a sample log entry would look like this: Dec 16 14:08:51 u910-05 testapp: \ 00000000000000a7:00007f62d170a910:DEBUG :part.cpp : 183: \ | PartitionInfo [0x275f720] '\' denotes line continuation. The field I want to key off in this line is: 00000000000000a7 I created a filter to only get stuff from 'testapp', but now I want to make the destination be tied to the field. The field is positional, but can have any value, and cannot be known a priori. Not sure how to go about it. Any links to examples or where to start would be very much appreciated. -- Thanks, -Christopher

5 8

Re: [syslog-ng] syslog-ng 3.2.1 compile error
by Eric Berggren 13 Jan '11

13 Jan '11

> I'm trying to compile syslog-ng 3.2.1 on CentOS 5.3 which is running glib > 2.12.3-4, and get this error: > > ./.libs/libdbparser.so: undefined reference to `g_timeout_add_seconds' > collect2: ld returned 1 exit status > Using the older API is Bazsi's decision, but I have doubts about it's > feasibility. My recommendation is building a GLIB 2.14 and installing > it to an alternative directory and link to it(see below). If it doesn't > work, I recommend trying the pre-compiled OSE installers built by > BalaBit, which bring all their dependencies with them. You can download > them from > http://www.balabit.com/downloads/files?path=/syslog-ng/sources/3.2.1/setups For EL5 builds, I added the following to syslog-ng-3.2.1/modules/dbparser/dbparser.h : #define g_timeout_add_seconds(i,c,u) g_timeout_add(i*1000,c,u) Admittedly, I'm not particularly familiar with this and related functions, nor am I using the dbparser component, so haven't verified the behavior. Otherwise using it successfully with 2200 hosts shooting UDP at it . Curious what the implications are for this ... -eric

2 1