January 2011 - syslog-ng - lists.balabit.hu

[Bug 105] New: syslog-ng --no-caps option causes segmentation fault if compiled with caps support in hardened gentoo
by bugzilla＠bugzilla.balabit.com 11 Jan '11

11 Jan '11

https://bugzilla.balabit.com/show_bug.cgi?id=105 Summary: syslog-ng --no-caps option causes segmentation fault if compiled with caps support in hardened gentoo Product: syslog-ng Version: unspecified Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: dk(a)i-zet.ru Type of the Report: bug Estimated Hours: 0.0 syslog-ng --no-caps option causes segmentation fault if compiled with caps support on gentoo hardened system This is from the build log: syslog-ng Open Source Edition 3.1.2 configured Compiler options: compiler : x86_64-pc-linux-gnu-gcc -std=gnu99 compiler options : -O2 -pipe -fforce-addr -mtune=nocona -march=nocona -Wall -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/usr/include/eventlog -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -Wl,-O1 -Wl,--as-needed prefix : /usr linking mode : dynamic Features: Sun STREAMS support : no Sun Door support : no Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : no spoof-source support : no tcp-wrapper support : yes SSL support : yes SQL support : no Linux capability support : yes PCRE support : yes Env wrapper support : no >>> Source configured. System parameters: # syslog-ng --version syslog-ng 3.1.2 Installer-Version: 3.1.2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.1#master#8bf13c304b6ab5fc1a372b49d55c78370efe14ca Compile-Date: Dec 15 2010 21:10:17 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: off Enable-Spoof-Source: off Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: on Enable-Pcre: on # # # uname -a Linux xxxxxx 2.6.32-hardened-r29 #1 SMP Fri Dec 3 14:08:35 MSK 2010 x86_64 Intel(R) Xeon(R) CPU X5450 @ 3.00GHz GenuineIntel GNU/Linux # # gcc -v Using built-in specs. Target: x86_64-pc-linux-gnu Configured with: /var/tmp/portage/sys-devel/gcc-4.4.4-r2/work/gcc-4.4.4/configure --prefix=/usr --bindir=/usr/x86_64-pc-linux-gnu/gcc-bin/4.4.4 --includedir=/usr/lib/gcc/x86_64-pc-linux-gnu/4.4.4/include --datadir=/usr/share/gcc-data/x86_64-pc-linux-gnu/4.4.4 --mandir=/usr/share/gcc-data/x86_64-pc-linux-gnu/4.4.4/man --infodir=/usr/share/gcc-data/x86_64-pc-linux-gnu/4.4.4/info --with-gxx-include-dir=/usr/lib/gcc/x86_64-pc-linux-gnu/4.4.4/include/g++-v4 --host=x86_64-pc-linux-gnu --build=x86_64-pc-linux-gnu --disable-altivec --disable-fixed-point --without-ppl --without-cloog --disable-nls --with-system-zlib --disable-werror --enable-secureplt --enable-multilib --enable-libmudflap --disable-libssp --enable-esp --enable-libgomp --with-python-dir=/share/gcc-data/x86_64-pc-linux-gnu/4.4.4/python --enable-checking=release --disable-libgcj --enable-languages=c,c++ --enable-shared --enable-threads=posix --enable-__cxa_atexit --enable-clocale=gnu --with-bugurl=http://bugs.gentoo.org/ --with-pkgversion='Gentoo Hardened 4.4.4-r2 p1.2, pie-0.4.5' Thread model: posix gcc version 4.4.4 (Gentoo Hardened 4.4.4-r2 p1.2, pie-0.4.5) # glibc - 2.11.2-r3 Example: $ $ /usr/sbin/syslog-ng -F -v -d --no-caps Segmentation fault $ $ strace /usr/sbin/syslog-ng -F -v -d --no-caps execve("/usr/sbin/syslog-ng", ["/usr/sbin/syslog-ng", "-F", "-v", "-d", "--no-caps"], [/* 33 vars */]) = 0 brk(0) = 0x3cdf13cf10 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0cc000 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat(3, {st_mode=S_IFREG|0644, st_size=51584, ...}) = 0 mmap(NULL, 51584, PROT_READ, MAP_PRIVATE, 3, 0) = 0x3752a0bf000 close(3) = 0 open("/usr/lib/libglib-2.0.so.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320{\1\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=981792, ...}) = 0 mmap(NULL, 3079320, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x37529bc2000 mprotect(0x37529cb0000, 2097152, PROT_NONE) = 0 mmap(0x37529eb0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xee000) = 0x37529eb0000 close(3) = 0 open("/usr/lib/libevtlog.so.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\31\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=18184, ...}) = 0 mmap(NULL, 2113664, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x375299bd000 mprotect(0x375299c1000, 2093056, PROT_NONE) = 0 mmap(0x37529bc0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x37529bc0000 close(3) = 0 open("/usr/lib/libssl.so.1.0.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0Pa\1\0\0\0\0\0"..., 832) = 832 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0be000 fstat(3, {st_mode=S_IFREG|0555, st_size=386928, ...}) = 0 mmap(NULL, 2482512, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x3752975e000 mprotect(0x375297b5000, 2093056, PROT_NONE) = 0 mmap(0x375299b4000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x56000) = 0x375299b4000 close(3) = 0 open("/usr/lib/libcrypto.so.1.0.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@U\6\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0555, st_size=1845904, ...}) = 0 mmap(NULL, 3956384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x37529398000 mprotect(0x37529538000, 2093056, PROT_NONE) = 0 mmap(0x37529737000, 147456, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x19f000) = 0x37529737000 mmap(0x3752975b000, 11936, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x3752975b000 close(3) = 0 open("/lib/libwrap.so.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@1\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=35552, ...}) = 0 mmap(NULL, 2132968, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x3752918f000 mprotect(0x37529197000, 2093056, PROT_NONE) = 0 mmap(0x37529396000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x7000) = 0x37529396000 close(3) = 0 open("/lib/libcap.so.2", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\26\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=18408, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0bd000 mmap(NULL, 2113856, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x37528f8a000 mprotect(0x37528f8e000, 2093056, PROT_NONE) = 0 mmap(0x3752918d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x3752918d000 close(3) = 0 open("/lib/libpcre.so.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\200\30\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=198368, ...}) = 0 mmap(NULL, 2293824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x37528d59000 mprotect(0x37528d89000, 2093056, PROT_NONE) = 0 mmap(0x37528f88000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2f000) = 0x37528f88000 close(3) = 0 open("/lib/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0~\354\1\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=1354792, ...}) = 0 mmap(NULL, 3463976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x37528a0b000 mprotect(0x37528b4f000, 2097152, PROT_NONE) = 0 mmap(0x37528d4f000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x144000) = 0x37528d4f000 mmap(0x37528d54000, 19240, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x37528d54000 close(3) = 0 open("/lib/libdl.so.2", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\r\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=14320, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0bc000 mmap(NULL, 2109600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x37528807000 mprotect(0x37528809000, 2097152, PROT_NONE) = 0 mmap(0x37528a09000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x37528a09000 close(3) = 0 open("/lib/libz.so.1", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p \0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=87936, ...}) = 0 mmap(NULL, 2183312, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x375285f1000 mprotect(0x37528606000, 2093056, PROT_NONE) = 0 mmap(0x37528805000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x14000) = 0x37528805000 close(3) = 0 open("/lib/libattr.so.1", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\25\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=22360, ...}) = 0 mmap(NULL, 2117664, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x375283eb000 mprotect(0x375283ef000, 2097152, PROT_NONE) = 0 mmap(0x375285ef000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4000) = 0x375285ef000 close(3) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0bb000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0ba000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0b9000 arch_prctl(ARCH_SET_FS, 0x3752a0ba700) = 0 mprotect(0x375285ef000, 4096, PROT_READ) = 0 mprotect(0x37528805000, 4096, PROT_READ) = 0 mprotect(0x37528a09000, 4096, PROT_READ) = 0 mprotect(0x37528d4f000, 16384, PROT_READ) = 0 mprotect(0x37528f88000, 4096, PROT_READ) = 0 mprotect(0x3752918d000, 4096, PROT_READ) = 0 mprotect(0x37529396000, 4096, PROT_READ) = 0 mprotect(0x37529737000, 106496, PROT_READ) = 0 mprotect(0x375299b4000, 16384, PROT_READ) = 0 mprotect(0x37529bc0000, 4096, PROT_READ) = 0 mprotect(0x37529eb0000, 4096, PROT_READ) = 0 mprotect(0x3cdf136000, 8192, PROT_READ) = 0 mprotect(0x3752a0ce000, 4096, PROT_READ) = 0 munmap(0x3752a0bf000, 51584) = 0 brk(0) = 0x3cdf13cf10 brk(0x3cdf15df10) = 0x3cdf15df10 brk(0x3cdf15e000) = 0x3cdf15e000 setrlimit(RLIMIT_NOFILE, {rlim_cur=4*1024, rlim_max=4*1024}) = 0 setsid() = 13612 prctl(PR_SET_KEEPCAPS, 1) = 0 capget(0x20080522, 0, NULL) = -1 EFAULT (Bad address) --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ Segmentation fault $ It is quite possible, that it is hardened gentoo specific bug. I could not reproduce it on non-hardened system. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 92] New: Allow user to specify SSL/TLS cipher suite for connections
by bugzilla＠bugzilla.balabit.com 11 Jan '11

11 Jan '11

https://bugzilla.balabit.com/show_bug.cgi?id=92 Summary: Allow user to specify SSL/TLS cipher suite for connections Product: syslog-ng Version: 3.1.x Platform: PC OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: brett.edgar(a)truedigitalsecurity.com Type of the Report: enhancement Estimated Hours: 0.0 Created an attachment (id=22) --> (https://bugzilla.balabit.com/attachment.cgi?id=22) Patch to allow user to specify acceptable TLS cipher suites. Some compliance regimens (e.g., the PCI DSS) require SSL/TLS connections to disable weak (<128 bit key length) ciphers and old protocols like SSLv2. Syslog-ng already disables SSLv2 by default, but there is no way to disable the weak ciphers without modifying the source with every new release. I have developed a very small patch that adds a configuration file line with the tls { } stanza to specify which TLS ciphers can be used. Example: source tlssrc { tcp(ip(1.2.3.4) port(514) max-connections(32) tls( key_file("/etc/syslog-ng/server.key") cert_file("/etc/syslog-ng/server.crt") cipher_suite("ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:!SSLv2") peer_verify(optional-untrusted)) ); }; -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

syslog-ng 3.2.1 compile error
by Lutz Mutz 11 Jan '11

11 Jan '11

Hey everyone, I'm trying to compile syslog-ng 3.2.1 on CentOS 5.3 which is running glib 2.12.3-4, and get this error: ./.libs/libdbparser.so: undefined reference to `g_timeout_add_seconds' collect2: ld returned 1 exit status make[5]: *** [pdbtool] Error 1 make[5]: Leaving directory `/usr/local/src/syslog-ng-3.2.1/modules/dbparser' make[4]: *** [all-recursive] Error 1 make[4]: Leaving directory `/usr/local/src/syslog-ng-3.2.1/modules/dbparser' make[3]: *** [all] Error 2 make[3]: Leaving directory `/usr/local/src/syslog-ng-3.2.1/modules/dbparser' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng-3.2.1/modules' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/local/src/syslog-ng-3.2.1' make: *** [all] Error 2 As I understand g_timeout_add_seconds was added to glib 2.14, which CentOS doesn't support yet. Now my question is, there was a big filed a while ago about this, does balabit plan on implementing the old api for glib to support 3.2.1 for glib < 2.14 ? Knowing the fact that CentOS is such a popular and wide distribution, why not make it easy for us and patch it? Is my other choice to just compile it statically on a system running glib >= 2.14 and then install the binary on the CentOS system? Thanks, Lutz

2 1

Signed-off-by usage
by Balazs Scheidler 10 Jan '11

10 Jan '11

Hi, You probably know that starting with 3.2 the license for syslog-ng has changed and BalaBit has given up copyright assignment paperwork when accepting patches into the source tree. However I feel it very important to track who contributed what, and using the git "Author" field is just painful. So I'd like to start using a "standard" procedure what all the kernel folks use, more specifically the "signed-off-by" line added to each submitted patch. All it takes is to add a Signed-off-by: Random Developer <random(a)developer.org> after understanding the implications. The implications are documented in the kernel source tree (Documentation/SubmittingPatches), copied below for simplicity's sake. I hope this will make it easier for me to give credits where credits are due. :) I also updated the webpage on https://www.balabit.com/network-security/syslog-ng/opensource-logging-syste… For accumulated stuff, I may ask you to add a signed-off-by line for an already submitted patch, in this case, all I need is a reply, posted on the public mailing list, quoting the patch and adding a Signed-off-by line, that I can copy-paste into the commit message. Thanks. PS: I still need to read my backlog of syslog-ng messages that got accumulated during the winter holidays, but I haven't forgotten them, I just got distracted. ---- quoted SubmittingPatches file ---- 11) Sign your work To improve tracking of who did what, especially with patches that can percolate to their final resting place in the kernel through several layers of maintainers, we've introduced a "sign-off" procedure on patches that are being emailed around. The sign-off is a simple line at the end of the explanation for the patch, which certifies that you wrote it or otherwise have the right to pass it on as a open-source patch. The rules are pretty simple: if you can certify the below: Developer's Certificate of Origin 1.1 By making a contribution to this project, I certify that: (a) The contribution was created in whole or in part by me and I have the right to submit it under the open source license indicated in the file; or (b) The contribution is based upon previous work that, to the best of my knowledge, is covered under an appropriate open source license and I have the right under that license to submit that work with modifications, whether created in whole or in part by me, under the same open source license (unless I am permitted to submit under a different license), as indicated in the file; or (c) The contribution was provided directly to me by some other person who certified (a), (b) or (c) and I have not modified it. (d) I understand and agree that this project and the contribution are public and that a record of the contribution (including all personal information I submit with it, including my sign-off) is maintained indefinitely and may be redistributed consistent with this project or the open source license(s) involved. then you just add a line saying Signed-off-by: Random J Developer <random(a)developer.org> Some people also put extra tags at the end. They'll just be ignored for now, but you can do this to mark internal company procedures or just point out some special detail about the sign-off. -- Bazsi

1 0

mojology: syslog-ng and mongodb meet the web
by Gergely Nagy 09 Jan '11

09 Jan '11

Hi! During the past couple of nights, I was busy coming up with something that would showcase the power of syslog-ng combined with the mongodb destination, and that is how mojology was born: http://mojology.madhouse-project.org/ source available @ https://github.com/algernon/mojology To sum it up: it's a web based log browser, a reasonably simple one: one can't search, or do advanced filtering (yet!), only a few basic stuff. The interesting part comes from the fact that the logs it displays are stored in mongodb, a document store, and as such, the structure of them is very, very flexible. Although, the application does make a few assumptions (see the about page or the readme in the sources), it still retains a lot of flexibility. Without going into the gory details (that's what the source is for ;), let me show you a few interesting pages! Examples -------- * http://mojology.madhouse-project.org/log/4d28cd01f310ef4f00000024 This one was originally made with the following command: logger -i -t hi 'Hello World! This concludes our demo session." Then I went into the MongoDB shell and added a few other keys below the "dyn" sub-document, alongside the default "classifier" (courtesy of patterndb). As you can see, no matter how deep one nests, it still displays properly. It's also easy to query, even at such depths. * http://mojology.madhouse-project.org/log/4d28cba4f310ef4f0000001e Logging in from one computer to my desktop, using password authentication. This entry was made fully automatically. Other notes ----------- The database behind the demo application is fairly small, only 39 messages stored, but hey, it's a demo! The program itself is a little over a hundred lines of python + templates; built upon Flask & PyMongo. For the best experience, a recent browser is strongly advised: Chromium 6+, Firefox 4+ for best results; Firefox 3 works very well too, but some of the tiny cosmetic features do not; the site displays in IE7+ too, and can be used, but the experience is rather disappointing. I hope this little weekend hack helps demonstrate how flexible mongodb can be for logging, and how well syslog-ng can make use of that flexibility. -- |8]

3 5

[Bug 78] running multiple syslog-ng instances precludes STATS socket use
by bugzilla＠bugzilla.balabit.com 09 Jan '11

09 Jan '11

https://bugzilla.balabit.com/show_bug.cgi?id=78 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution| |FIXED Status|NEW |RESOLVED --- Comment #1 from Balazs Scheidler <bazsi(a)balabit.hu> 2011-01-09 08:59:10 --- syslog-ng 3.1 & 3.2 has a command line option to control the name of the control socket. so I'm closing this ticket. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 64] misleading error message for missing destination
by bugzilla＠bugzilla.balabit.com 09 Jan '11

09 Jan '11

https://bugzilla.balabit.com/show_bug.cgi?id=64 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution| |FIXED Status|NEW |RESOLVED --- Comment #1 from Balazs Scheidler <bazsi(a)balabit.hu> 2011-01-09 08:57:33 --- this is already integrated, I've checked 3.1.x & 3.2.x both have the change. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 56] default config file if syslog-ng was compiled from source
by bugzilla＠bugzilla.balabit.com 09 Jan '11

09 Jan '11

https://bugzilla.balabit.com/show_bug.cgi?id=56 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|--- |3.2.1 CC| |bazsi(a)balabit.hu Resolution| |FIXED Status|NEW |RESOLVED --- Comment #1 from Balazs Scheidler <bazsi(a)balabit.hu> 2011-01-09 08:54:03 --- A default configuration file is supplied from 3.2 onwards as the system dependent parts of the config file are taken care of the system() source. Also this configuration file is installed by "make install". So I'm closing this ticket with target milestone set to 3.2.1. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

Re: [syslog-ng] logging to PostgreSQL database
by Sean McAfee 06 Jan '11

06 Jan '11

On 01/05/11 16:24, Janez Barbič wrote: > using PostgreSQL 8.4 > contents of pg_hba.conf: > ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ > ... > # > # Database administrative login by UNIX sockets > local all all trust > > # TYPE DATABASE USER CIDR-ADDRESS METHOD > > # "local" is for Unix domain socket connections only > # local all all trust > # IPv4 local connections: > # host all all 127.0.0.1/32 md5 > # IPv6 local connections: > host all all ::1/128 md5 > # syslog-ng logger > # host eneraptordb eneraptor 127.0.0.1/32 > trust > ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ > As far as I understand this configuration file, any user should have full access > to any database on local machine. At this point, I am not concerned about > security issues as I plan to address them after I resolve logging problem. In this context, "local" refers to the Unix socket (typically in /tmp), not a TCP/IP socket. This is how the command-line psql connects to the host (unless otherwise specified). You should be able to confirm that it's pg_hba-related by looking in the Postgres log file. I don't know if syslog-ng would take "/tmp" as an address, but you should be able to fix it in pg_hba.conf by either: 1. Uncommenting the "eneraptordb" line 2. Uncommenting the line below "IPv4 local connections" -- Sean McAfee

1 0

logging to PostgreSQL database
by Janez Barbič 05 Jan '11

05 Jan '11

Hi, I am a student of Computer Science at University of Ljubljana. Recently I started working on some project which includes logging into PostgreSQL database. I came across some problem which I can't resolve myself. No matter what I do, syslog-ng refuses to log into local PostgreSQL database. Here is my current configuration: using syslog-ng 3.2 server contents of syslog-ng.conf ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ @version: 3.2 #Default configuration file for syslog-ng. # # For a description of syslog-ng configuration file directives, please read # the syslog-ng Administrator's guide at: # # http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/bk01-toc.html # options { time_reap(30); mark_freq(10); keep_hostname(yes); }; ###### # sources source s_local { # message generated by Syslog-NG internal(); # standard Linux log source (this is the default place for the syslog() # function to send logs to) unix-stream("/dev/log"); # messages from the kernel file("/proc/kmsg" program_override("kernel")); }; # source s_syslog { syslog(ip(127.0.0.1) port(1999) transport("tcp")); }; ######################## # Filters ######################## # Here's come the filter options. With this rules, we can set which # message go where. # messages for eneraptor should have priority level LOG_MAIL and contain keyword "eneraptor" filter f_mail_eneraptor { facility(mail) and match("eneraptor"); }; ###### # destinations destination d_messages { file("/var/log/messages"); }; destination filtered_messages { file("/var/log/messages_filtered"); }; # # SQL logging support # destination d_pgsql { sql(type(pgsql) host("localhost") username("eneraptor") password("eneraptor") database("eneraptordb") table("logs") columns("datetime varchar(16)", "host varchar(32)", "program varchar(8)", "pid varchar(8)", "message varchar(200)") values("$R_DATE", "$HOST", "$PROGRAM", "$PID", "$MSG") indexes("datetime", "host", "program", "pid", "message")); }; log { source(s_local); destination(d_messages); # destination(d_pgsql); }; log { source(s_local); filter(f_mail_eneraptor); destination(filtered_messages); destination(d_pgsql); }; ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ using PostgreSQL 8.4 contents of pg_hba.conf: ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ... # # Database administrative login by UNIX sockets local all all trust # TYPE DATABASE USER CIDR-ADDRESS METHOD # "local" is for Unix domain socket connections only # local all all trust # IPv4 local connections: # host all all 127.0.0.1/32 md5 # IPv6 local connections: host all all ::1/128 md5 # syslog-ng logger # host eneraptordb eneraptor 127.0.0.1/32 trust ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ As far as I understand this configuration file, any user should have full access to any database on local machine. At this point, I am not concerned about security issues as I plan to address them after I resolve logging problem. postgresql.conf: Below are included only lines I uncommented or changed. ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ... listen_addresses = 'localhost' # what IP address(es) to listen on; ... password_encryption = on ... ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ This is the error I get, logged by syslog-ng: *Jan 5 22:00:38 computerName syslog-ng[11080]: Error establishing SQL connection; type='pgsql', host='localhost', port='', username='eneraptor', database='eneraptordb', error='could not connect to server: Connection refused\x0a\x09Is the server running on host "localhost" and accepting\x0a\x09TCP/IP connections on port 0?\x0a'* * * Database has also been created, properly named and has the right user. Message I am trying to log is being sent by test program written in C, line that sends message is (every few seconds): *syslog(LOG_MAIL, "eneraptor test: %d", counter);* >From what I could gather is that syslog-ng probably can't connect to database, but I am running out of options on how to resolve this issue. I would be very grateful if you could help me resolve this issue. Best regards, Janez Barbic

3 4