October 2011 - syslog-ng - lists.balabit.hu

Request: GitHub mirror of git bazsi/syslog-ng-3.2.git and bazsi/syslog-ng-3.3.git
by Eric Lindvall 26 Oct '11

26 Oct '11

Hello, GitHub has the ability to setup an automated mirror of a remote git repository to allow for users of GitHub to interact with the code more easily. I would really appreciate having such a mirror setup for syslog-ng to make development easier to track in how I work day-to-day. To get the mirror setup, a free Organization needs to be created for "syslog-ng", and then someone needs to send an email to support(a)github.comasking to setup the mirrors. If this is something that interests anyone, I would be more than willing to help out in getting the process completed. Thanks, Eric

2 2

Cannot install syslog-ng 3.2.4 under cygwin with Oracle support
by Hery Fanomezantsoa 26 Oct '11

26 Oct '11

Hi all, Prior to installing syslog-ng on cygwin, i installed libdbi and libdbi-drivers with oracle instant client on windows. After that, i installed eventlog Finally i tried to install syslog-ng and it failed. Here is my configure: ./configure EVTLOG_CFLAGS="-I/usr/local/eventlog/include/eventlog" \ > EVTLOG_LIBS="-L/usr/local/eventlog/lib -levtlog" \ > GLIB_CFLAGS="-I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include" \ > GLIB_LIBS="-L/usr/lib -lglib-2.0 -lintl" \ > LIBDBI_CFLAGS="-I/usr/local/libdbi/include/dbi-0.8" \ > LIBDBI_LIBS="-L/usr/local/libdbi/lib" \ > --enable-sql I've got this warning: *** Warning: This system can not link to static lib archive /usr/local/eventlog/lib/libevtlog.la. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. *** Warning: linker path does not have real file for library -lrt. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have *** because I did check the linker path looking for a file starting *** with librt and none of the candidates passed a file format test *** using a file magic. Last file checked: /lib/librt.a *** Warning: linker path does not have real file for library -lresolv. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have *** because I did check the linker path looking for a file starting *** with libresolv and none of the candidates passed a file format test *** using a file magic. Last file checked: /lib/libresolv.a *** Warning: linker path does not have real file for library -ldl. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have *** because I did check the linker path looking for a file starting *** with libdl and none of the candidates passed a file format test *** using a file magic. Last file checked: /lib/libdl.a *** The inter-library dependencies that have been dropped here will be *** automatically added whenever a program is linked with this library *** or is declared to -dlopen it. *** Since this library must not contain undefined symbols, *** because either the platform does not support them or *** it was explicitly requested with -no-undefined, *** libtool will only create a static version of it. And this error ../../lib/.libs/libsyslog-ng.a(plugin.o): In function `plugin_load_module': /cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4/lib/plugin.c:154: undefined reference to `_g_module_symbol' /cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4/lib/plugin.c:172: undefined reference to `_g_module_build_path' /cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4/lib/plugin.c:206: undefined reference to `_g_module_open' /cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4/lib/plugin.c:217: undefined reference to `_g_module_make_resident' /cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4/lib/plugin.c:219: undefined reference to `_g_module_symbol' /cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4/lib/plugin.c:221: undefined reference to `_g_module_error' /cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4/lib/plugin.c:210: undefined reference to `_g_module_error' /cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4/lib/plugin.c:146: undefined reference to `_g_module_open' collect2: ld returned 1 exit status make[5]: *** [pdbtool.exe] Error 1 make[5]: Leaving directory `/cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4/modules/dbparser' make[4]: *** [all-recursive] Error 1 make[4]: Leaving directory `/cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4/modules/dbparser' make[3]: *** [all] Error 2 make[3]: Leaving directory `/cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4/modules/dbparser' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4/modules' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4' make: *** [all] Error 2 What do I miss? Thanks in advance.

2 3

Using RS and GS field seperator
by Omer Faruk SEN 25 Oct '11

25 Oct '11

Hi, Is there an option I can use non-printable chars as field seperators on template() I want to use RS and GS at the and. 035 29 1D GS (group separator) 135 93 5D ] 036 30 1E RS (record separator) 136 94 5E ^ Regards.

2 1

[Bug 140] New: syslog-ng ignores filter boolean logic
by bugzilla＠bugzilla.balabit.com 24 Oct '11

24 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=140 Summary: syslog-ng ignores filter boolean logic Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: lisaev(a)umail.iu.edu Type of the Report: --- Estimated Hours: 0.0 Created an attachment (id=42) --> (https://bugzilla.balabit.com/attachment.cgi?id=42) syslog-ng 3.3.1 config file I am running syslog-ng 3.3.1 (arch linux), and noticed that my iptables logs go into every possible logfile, i.e. /var/log/{messages,kernel,iptables}.log. For example: cur_work$ tail -n1 /var/log/kernel.log Oct 23 12:43:18 linhost kernel: [ 5372.600518] firewall: IN=wlan0 OUT= MAC=00:26:c6:d7:27:6a:00:17:0f:70:b1:00:08:00 SRC=74.125.65.108 DST=96.125.23.251 LEN=40 TOS=0x00 PREC=0x00 TTL=43 ID=28546 PROTO=TCP SPT=993 DPT=52331 WINDOW=0 RES=0x00 RST URGP=0 This is despite the fact that syslog-ng.conf contains filter f_iptables { match("IN=" value("MESSAGE")) and match("OUT=" value("MESSAGE")); }; filter f_kernel { facility(kern) and not filter(f_iptables); }; I also tried modifying f_iptables as filter f_iptables { match("firewall" value("MESSAGE")); }; but still get firewall logs everywhere :( I add the full syslog-ng.conf as an attachment. Thanks. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

[Bug 129] New: Add ability to synchronously flush logs on demand
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=129 Summary: Add ability to synchronously flush logs on demand Product: syslog-ng Version: 1.6.x Platform: All OS/Version: FreeBSD Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: fermulator(a)sympatico.ca Type of the Report: enhancement Estimated Hours: 0.0 As per the below e-mail thread with Bazsi, I was trying to figure out why syslog-ng doesn't write logs immediately. As I discovered syslog-ng by default has the concept of “flush_timeout” and “flush_lines”, where flush_timeout is how frequently we'll write logs (default 10s), and flush_lines is the maximum number of lines we'll hold in the buffer before writing (default 10,000). Currently, there is no way to synchronously force syslog-ng to "write logs now". This ticket is an enhancement to syslog-ng to add the ability, in a synchronous way, ask syslog-ng to flush the buffer now, writing all logs in the queue/buffer immediately/ASAP, and block until the operation is completed. Version Information: * syslog-ng 1.6.8 * FreeBSD 6.1 ----------- From: bazsi(a)balabit.hu To: fermulator(a)sympatico.ca Subject: Re: Flush (write logs now) for syslog-ng? Date: Fri, 22 Jul 2011 06:31:36 +0200 hi, we do have a bugzilla at bugzilla.balabit.com, however it's primarily used for bug reports. you can file enhancement requests though. ----- Original message ----- > Thanks for the reply. > > I tried SIGHUP, and as you mentioned, it's not synchronous. syslog-ng > does write the logs, but only after a few seconds (presumably this is > less than the timeout though at least). > > Do you have any "ticket system", that has the "enhancement" to do this > synchronously that I could reference? > > ~Matt > > > -------- Original Message -------- > From: Balazs Scheidler <bazsi(a)balabit.hu> > Sent: Thu 21 Jul 2011 02:31:24 PM EST > To: Fermulator Fermulator <fermulator(a)sympatico.ca> > Cc: > Subject: Re: Flush (write logs now) for syslog-ng? > > > hi, > > > > sending a SIGHUP should flush all buffers. this is not synchronous > > though, so you have to sleep some time to let syslog-ng do the thing. > > > > we have plans to add both on-demand synchronous reloads and config > > file flushes. > > > > ----- Original message ----- > > > > > > > > > > > > Hi Bazsi, > > > > > > > > > > > > I hope you don’t mind, I was trying to search for this in > > > the syslog-ng mail archives, but couldn’t find my answer, and found > > > your e-mail in the process. > > > > > > > > > > > > > > > As I understand it, syslog-ng has “flush_timeout” and “flush_lines” > > > parameters which determine how often we write out the buffer/queue of > > > log messages, and what the maximum number of lines is that we’ll > > > buffer, respectively. > > > > > > > > > > > > > > > > > > I’m trying to figure out: How can I tell syslog-ng to “write > > > logs now” on demand? (i.e. I > > > have a script that upon failure, scrapes some log files … but > > > instead of waiting for the flush_timeout, I’d rather “poke” > > > syslog-ng to “write all logs now” (i.e. temporarily set the > > > flush_timeout to 0, or temporarily set the flush_lines to 0) > > > > > > > > > > > > Is it possible? > > > > > > > > > > > > Thanks so much > > > > > > > > > ~Fermulator > > > (Matt Callaghan) > > > > > -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 115] New: libsyslog-ng.so is not linked with glib/cap but uses glib/ cap symbols
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=115 Summary: libsyslog-ng.so is not linked with glib/cap but uses glib/cap symbols Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: --- Estimated Hours: 0.0 [arekm@carme-pld ~/rpm/BUILD/syslog-ng-3.2.2/lib]$ ldd .libs/libsyslog-ng.so linux-vdso.so.1 => (0x00007fff46f80000) libc.so.6 => /lib64/libc.so.6 (0x00007fb64c4b8000) /lib64/ld-linux-x86-64.so.2 (0x0000003fba800000) but libsyslog-ng.so uses many glib and cap symbols: libtool: link: x86_64-pld-linux-gcc -std=gnu99 -I../../../lib -I../../../lib -I../../../modules/dbparser -I.. -Wno-pointer-sign -O2 -fno-strict-aliasing -fwrapv -march=x86-64 -gdwarf-3 -g2 -Wall .libs/test_patterndbS.o -Wl,--as-needed -Wl,--no-copy-dt-needed-entries -Wl,-z -Wl,relro -Wl,-z -Wl,combreloc -o .libs/test_patterndb test_patterndb.o ../.libs/patternize.o -Wl,-Bstatic -Wl,--whole-archive -Wl,--export-dynamic -pthread -Wl,--no-whole-archive -Wl,-Bdynamic ../../syslogformat/.libs/libsyslogformat.so ../../../lib/.libs/libsyslog-ng.so ../.libs/libsyslog-ng-patterndb.so /home/users/arekm/rpm/BUILD/syslog-ng-3.2.2/lib/.libs/libsyslog-ng.so -lssl -lcrypto -lresolv /usr/lib64/libgmodule-2.0.so /usr/lib64/libgthread-2.0.so -lpthread /usr/lib64/libglib-2.0.so /usr/lib64/libevtlog.so /usr/lib64/libpcre.so -lcap -ldl -lrt -pthread -Wl,-rpath -Wl,/lib64/syslog-ng ../../../lib/.libs/libsyslog-ng.so: undefined reference to `cap_set_proc' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `cap_from_text' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `g_module_build_path' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `cap_free' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `g_module_make_resident' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `g_thread_init' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `g_module_symbol' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `g_module_open' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `g_module_error' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `cap_set_flag' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `cap_to_text' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `cap_get_proc' That's in mixed linking, CORE_DEPS_LIBS is then empty. CORE_DEPS_LIBS should contain static linking to glib and dynamic to cap then. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 5

[Bug 114] New: configure strips -ldl -lrt for static linking but doesn' t add back with dynamic linking
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=114 Summary: configure strips -ldl -lrt for static linking but doesn't add back with dynamic linking Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: --- Estimated Hours: 0.0 configure.in when detecting glib strips -ldl and -lrt to prevent static linking with these libraries. # strip out -ldl & -lrt as it cannot be linked statically GLIB_LIBS=`echo $GLIB_LIBS | tr ' ' '\n' | egrep -v "^(-ldld?)|(-lrt)$" | tr '\n' ' '` This is fine. Unfortunately it doesn't add -ldl and -lrt back with dynamic linking and that causes newer glib detection to fail: configure:14223: checking for g_hash_table_new configure:14223: x86_64-pld-linux-gcc -std=gnu99 -o conftest -O2 -fno-strict-aliasing -fwrapv -march=x86-64 -gdwarf-3 -g2 -Wall -D_FORTIFY_SOURCE=2 -Wl,--as-needed -Wl,--no-copy-dt-needed-entries -Wl,-z,relro -Wl,-z,combreloc conftest.c -Wl,-Bstatic -Wl,--export-dynamic -pthread -lgmodule-2.0 -lgthread-2.0 -lglib-2.0 -Wl,-Bdynamic >&5 /usr/lib64/gcc/x86_64-pld-linux/4.5.2/../../../../lib64/libglib-2.0.a(gmain.o): In function `g_get_monotonic_time': (.text+0x2e12): undefined reference to `clock_gettime' collect2: ld returned 1 exit status -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

[Bug 108] New: 2.6.38+ will require CAP_SYSLOG (CAP_SYS_ADMIN not enough)
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=108 Summary: 2.6.38+ will require CAP_SYSLOG (CAP_SYS_ADMIN not enough) Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: enhancement Estimated Hours: 0.0 2.6.38+ kernels (linus git) reports: [ 9.890305] WARNING: at kernel/printk.c:430 do_syslog+0x427/0x452() [ 9.890318] Hardware name: 2764CTO [ 9.890320] Attempt to access syslog with CAP_SYS_ADMIN but no CAP_SYSLOG (deprecated and denied). when syslog tries to do syslogging. Additionally I'm geting: [root@t400 ~]# /usr/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf Error opening file for reading; filename='/proc/kmsg', error='Operation not permitted (1)' Error initializing source driver; source='s_sys', id='s_sys#0' Error initializing message pipeline; which likely is due to the same problem. Commit: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h… -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 44

[Bug 107] New: when trying to log to postgres database if port is not specified it gets defaulted to 0
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=107 Summary: when trying to log to postgres database if port is not specified it gets defaulted to 0 Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jhnsmth64(a)gmail.com Type of the Report: bug Estimated Hours: 0.0 syslog-ng.conf ... destination d_pgsql { sql(type(pgsql) host("localhost") username("user") password("pass") ... }; ... If destination stays defined like above, without port specified explicitly, syslog sends log messages to port 0 instead defaulting port to the Postgres port (5432). Destination settings below works: ... destination d_pgsql { sql(type(pgsql) host("localhost") port(5432) username("user") password("pass") ... }; ... -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 4

[Bug 106] New: Syslog-ng memory strdup and g_malloc leaks
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=106 Summary: Syslog-ng memory strdup and g_malloc leaks Product: syslog-ng Version: 3.2.x Platform: Other OS/Version: Solaris Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: daniel_novak(a)kb.cz Type of the Report: refactorization Estimated Hours: 0.0 We tried to compile a few last git version of syslog-3.2.1(syslog-ng-3.2.git-5f25ce47ab57774f8fe8df17bc96a006e535cb53) as well as 3.2.1 stable release. Everything is running well, but there are several minor memory leaks.We run on Solaris 10/08 on sparc platform.With libumem.so in memory debug mode MDB output is following : > ::findleaks CACHE LEAKED BUFCTL CALLER 00052288 2 00110d98 libc.so.1`strdup+0xc 00052788 1 0007de00 libglib-2.0.so.0.2513.0`g_malloc0+0x64 ---------------------------------------------------------------------- Total 3 buffers, 64 bytes =========================================================================================== > ::findleaks -dvf findleaks: maximum buffers => 4121 findleaks: actual buffers => 3967 mdb: [fef80000, fef84000): couldn't read 16384 bytes at fef80000: no mapping for address findleaks: findleaks: potential pointers => 341574 findleaks: dismissals => 196071 (57.4%) findleaks: misses => 130325 (38.1%) findleaks: dups => 11214 ( 3.2%) findleaks: follows => 3964 ( 1.1%) findleaks: findleaks: elapsed wall time => 0 seconds findleaks: CACHE LEAKED BUFCTL CALLER 00052288 2 00110d98 libc.so.1`strdup+0xc 00052788 1 0007de00 libglib-2.0.so.0.2513.0`g_malloc0+0x64 ---------------------------------------------------------------------- Total 3 buffers, 64 bytes umem_alloc_16 leak: 2 buffers, 16 bytes each, 32 bytes total ADDR BUFADDR TIMESTAMP THREAD CACHE LASTLOG CONTENTS 110d98 1097e0 1b08cf3fb0c96c 1 52288 43af4 0 libumem.so.1`umem_cache_alloc+0x210 libumem.so.1`umem_alloc+0x60 libumem.so.1`malloc+0x28 libc.so.1`strdup+0xc libsyslog-ng.so.0.0.0`cfg_lexer_lookup_keyword+0xf0 libsyslog-ng.so.0.0.0`_cfg_lexer_lex+0x18a4 libsyslog-ng.so.0.0.0`cfg_lexer_lex+0x284 libsyslog-ng.so.0.0.0`main_lex+0x1c libsyslog-ng.so.0.0.0`main_parse+0x7a4 libsyslog-ng.so.0.0.0`cfg_parser_parse+0xcc libsyslog-ng.so.0.0.0`cfg_run_parser+0x1ac libsyslog-ng.so.0.0.0`cfg_read_config+0x98 initial_init+0x5c main+0x244 _start+0x5c umem_alloc_32 leak: 1 buffer, 32 bytes ADDR BUFADDR TIMESTAMP THREAD CACHE LASTLOG CONTENTS 7de00 77b98 1b08cf406e21b0 1 52788 373ec 0 libumem.so.1`umem_cache_alloc+0x210 libumem.so.1`umem_alloc+0x60 libumem.so.1`malloc+0x28 libumem.so.1`calloc+0x58 libglib-2.0.so.0.2513.0`g_malloc0+0x64 libsyslog-ng.so.0.0.0`serialize_file_archive_new+0x1c libsyslog-ng.so.0.0.0`persist_state_load+0x54 libsyslog-ng.so.0.0.0`persist_state_start+0x34 libsyslog-ng.so.0.0.0`cfg_initial_init+0x28 initial_init+0xbc main+0x244 _start+0x5c ========================================================================= findleaks: using cached results (-f will force a full run) CACHE LEAKED BUFCTL CALLER 00052288 2 00110d98 libc.so.1`strdup+0xc 00052788 1 0007de00 libglib-2.0.so.0.2513.0`g_malloc0+0x64 ---------------------------------------------------------------------- Total 3 buffers, 64 bytes > 00110d98::umem_verify mdb: cache 110d98 () does not have redzone checking enabled > 00052288::umem_verify Summary for cache 'umem_alloc_16' clean > 00052788::umem_verify Summary for cache 'umem_alloc_32' clean ============================================================================= -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4