October 2011 - syslog-ng - lists.balabit.hu

[Bug 104] New: Add libtool option -module
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=104 Summary: Add libtool option -module Product: syslog-ng Version: 3.2.x Platform: All OS/Version: All Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: vinschen(a)redhat.com Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=30) --> (https://bugzilla.balabit.com/attachment.cgi?id=30) Patch to add libtool option -module Libtool 2.2.6 and later provides an option -module which should be used when creating shared libraries which are supposed to be used as modules which get loaded via dlopen. See the "Building modules to dlopen" chapter in `info libtool'. For Cygwin the additional benefit is that the modules are not copied into a parallel "bin" directory at installation time, which is the default otherwise to accommodate the DLL search algorithm on Windows. The attached patch just adds the -module option to each of the Makefile.am files in the modules subdir. Corinna -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 4

[Bug 120] New: afsql. c afsql_dd_format_* routines should include table in persist_name string
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=120 Summary: afsql.c afsql_dd_format_* routines should include table in persist_name string Product: syslog-ng Version: 3.2.x Platform: Other URL: https://lists.balabit.hu/pipermail/syslog-ng/2011- February/015913.html OS/Version: Other Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jtk(a)cymru.com Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=36) --> (https://bugzilla.balabit.com/attachment.cgi?id=36) include table name in persist_name As originally discovered in the syslog-ng list post entitled "[syslog-ng] duplicate config elements in sql destinations" by John Kristoff on 2011-02-11, syslog-ng will complain, when multiple destinations all point to the same database, but different tables with the message: Internal error, duplicate configuration elements refer to the same persistent config; name='afsql_dd(pgsql,127.0.0.1,,bar)' Balazs responded describing the potential problems with counters being swapped and a fix that appears to work in testing. A Patch for syslog-ng 3.2.4 is attached, but similar patch should work for earlier versions as indicated by Balazs' posting. Thank you, John -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

[Bug 139] New: syslog-ng crashes on SIGHUP when rewrite used in multiple log{} declarations
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=139 Summary: syslog-ng crashes on SIGHUP when rewrite used in multiple log{} declarations Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.syslogng(a)feystorm.net Type of the Report: --- Estimated Hours: 0.0 This is for version 3.3.1 which isnt an available version in the bug tracker. I've managed to create a situation where syslog-ng crashes when it receives a SIGHUP, and a certain rewrite has been used in at least 3 different log{} declarations. Below is the extremely stripped down configuration I've created which duplicates the issue. With the below configuration, when syslog-ng receives a HUP, it will get a segfault in malloc_consolidate(). Additionally, the process which monitors syslog-ng for crashing doesnt appear to have a signal handler for SIGHUP, so the monitor process will die when it gets a HUP. This is a problem, at least on redhat as the redhat init script sends a HUP to both the monitor process and the real worker process when the init script is called with `reload` @version: 3.3 @include "scl.conf" source s_local { system(); }; rewrite r_fext { #set("$LEVEL",value('FEXT')); subst('foo','bar', value('FEXT') type('string')); }; log { source(s_local); rewrite(r_fext); }; log { source(s_local); rewrite(r_fext); }; log { source(s_local); rewrite(r_fext); }; -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

syslog-ng 3.3.1 dying after SIGHUP
by Patrick H. 23 Oct '11

23 Oct '11

Is anyone else having issues with syslog-ng 3.3 dying when it gets a sighup? When the syslog-ng monitor process gets a HUP, it seems to die immediately, as if there were no signal handler. Strace shows absolutely nothing between getting the signal, and it exiting. When the actual syslog-ng worker process gets a HUP, it does a bunch of stuff, and then segfaults. It looks like it segfaults immediately after closing /var/log/syslog 4362 17:28:44.964645 stat("/var/log", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 4362 17:28:44.964729 stat("/var/log/syslog", {st_mode=S_IFREG|0644, st_size=3905, ...}) = 0 4362 17:28:44.964813 open("/var/log/syslog", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK, 0644) = 26 4362 17:28:44.964879 fcntl(26, F_GETFD) = 0 4362 17:28:44.964936 fcntl(26, F_SETFD, FD_CLOEXEC) = 0 4362 17:28:44.964993 capget(0x19980330, 0, {CAP_DAC_OVERRIDE|CAP_SYS_ADMIN, CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN, 0}) = 0 4362 17:28:44.965082 capset(0x19980330, 0, {CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_SYS_ADMIN, CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN, 0}) = 0 4362 17:28:44.965148 capget(0x19980330, 0, {CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_SYS_ADMIN, CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN, 0}) = 0 4362 17:28:44.965213 capset(0x19980330, 0, {CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_FOWNER|CAP_SYS_ADMIN, CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN, 0}) = 0 4362 17:28:44.965279 fchown(26, 0, 4294967295) = 0 4362 17:28:44.965344 fchown(26, 4294967295, 0) = 0 4362 17:28:44.965404 fchmod(26, 0644) = 0 4362 17:28:44.965464 capset(0x19980330, 0, {CAP_SYS_ADMIN, CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN, 0}) = 0 4362 17:28:44.965532 close(21) = 0 4362 17:28:44.966122 --- SIGSEGV (Segmentation fault) @ 0 (0) --- I'm going to try and track this down further, but was wondering if anyone else was seeing this behavior. Running this on RHEL5

2 3

[PATCH] afsocket: Fix compilation with libsystemd-daemon
by Gergely Nagy 22 Oct '11

22 Oct '11

When the libsystemd-daemon library is used, we need to use the header provided by the library, otherwise linking will likely fail. To do that, configure sets WITH_LIBSYSTEMD as appropriate, and depending on that value, we either include <systemd/sd-daemon.h> or "sd-daemon.h". Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- configure.in | 1 + modules/afsocket/afunix.c | 5 +++++ 2 files changed, 6 insertions(+), 0 deletions(-) diff --git a/configure.in b/configure.in index 13bc874..1e3a09a 100644 --- a/configure.in +++ b/configure.in @@ -1059,6 +1059,7 @@ AC_DEFINE_UNQUOTED(ENABLE_LINUX_CAPS, `enable_value $enable_linux_caps`, [Enable AC_DEFINE_UNQUOTED(ENABLE_PCRE, `enable_value $enable_pcre`, [Enable PCRE support]) AC_DEFINE_UNQUOTED(ENABLE_ENV_WRAPPER, `enable_value $enable_env_wrapper`, [Enable environment wrapper support]) AC_DEFINE_UNQUOTED(ENABLE_SYSTEMD, `enable_value $enable_systemd`, [Enable systemd support]) +AC_DEFINE_UNQUOTED(WITH_LIBSYSTEMD, `enable_value $with_libsystemd`, [Compile with libsystemd-daemon]) AM_CONDITIONAL(ENABLE_ENV_WRAPPER, [test "$enable_env_wrapper" = "yes"]) AM_CONDITIONAL(ENABLE_SYSTEMD, [test "$enable_systemd" = "yes"]) diff --git a/modules/afsocket/afunix.c b/modules/afsocket/afunix.c index 57ae213..2d57078 100644 --- a/modules/afsocket/afunix.c +++ b/modules/afsocket/afunix.c @@ -25,7 +25,12 @@ #include "misc.h" #include "messages.h" #include "gprocess.h" + +#if WITH_LIBSYSTEMD +#include <systemd/sd-daemon.h> +#else #include "sd-daemon.h" +#endif #include <string.h> #include <sys/types.h> -- 1.7.7

2 1

feature request: clear stats counters after diplayed
by syslogng＠feystorm.net 18 Oct '11

18 Oct '11

I was wondering if it would be possible to clear the stats generated by syslog-ng after theyre logged from the stats_freq setting. Basically so every set of stats that gets displayed will be the numbers since the last time stats were displayed, not for the whole lifetime of the process. Largely, this is just so that one can easily tell if processing has changed in a certain time period without having to do the math. Additionally it also would help a great deal with system health monitoring software. For example, something could look to see if syslog-ng has dropped any messages, but as it currently is it would have to compare the most recent stats with the previous set of stats just to see if the dropped counter went up.

2 1

[PATCH] syslog-ng: Add a -q/--silent-module-load option
by Gergely Nagy 15 Oct '11

15 Oct '11

With the -q/--silent-module-load option set (defaults to off), no warnings will be printed when a module cannot be found. If it's found, but cannot be loaded, a message is still printed. If it is used later in the config, that's still handled correctly. The flag only suppresses the warning, and nothing else. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- lib/globals.c | 1 + lib/plugin.c | 9 +++++---- lib/syslog-ng.h | 1 + syslog-ng/main.c | 1 + 4 files changed, 8 insertions(+), 4 deletions(-) diff --git a/lib/globals.c b/lib/globals.c index b2afec7..b3b2121 100644 --- a/lib/globals.c +++ b/lib/globals.c @@ -28,3 +28,4 @@ GlobalConfig *configuration; int cfg_parser_debug; gchar *module_path = MODULE_PATH; gchar *default_modules = DEFAULT_MODULES; +gboolean silent_module_load = FALSE; diff --git a/lib/plugin.c b/lib/plugin.c index 5239974..cce549a 100644 --- a/lib/plugin.c +++ b/lib/plugin.c @@ -179,10 +179,11 @@ plugin_dlopen_module(const gchar *module_name, const gchar *module_path) g_strfreev(module_path_dirs); if (!plugin_module_name) { - msg_error("Plugin module not found in 'module-path'", - evt_tag_str("module-path", module_path), - evt_tag_str("module", module_name), - NULL); + if (!silent_module_load) + msg_error("Plugin module not found in 'module-path'", + evt_tag_str("module-path", module_path), + evt_tag_str("module", module_name), + NULL); return NULL; } msg_debug("Trying to open module", diff --git a/lib/syslog-ng.h b/lib/syslog-ng.h index 4bd79c2..edb8a4d 100644 --- a/lib/syslog-ng.h +++ b/lib/syslog-ng.h @@ -66,5 +66,6 @@ typedef struct _GlobalConfig GlobalConfig; extern GlobalConfig *configuration; extern gchar *module_path; extern gchar *default_modules; +extern gboolean silent_module_load; #endif diff --git a/syslog-ng/main.c b/syslog-ng/main.c index c682e44..e414321 100644 --- a/syslog-ng/main.c +++ b/syslog-ng/main.c @@ -75,6 +75,7 @@ static GOptionEntry syslogng_options[] = { "module-registry", 0, 0, G_OPTION_ARG_NONE, &display_module_registry, "Display module information", NULL }, { "default-modules", 0, 0, G_OPTION_ARG_STRING, &default_modules, "Set the set of auto-loaded modules, default=" DEFAULT_MODULES, "<module-list>" }, { "seed", 'S', 0, G_OPTION_ARG_NONE, &dummy, "Does nothing, the need to seed the random generator is autodetected", NULL}, + { "silent-module-load", 'q', 0, G_OPTION_ARG_NONE, &silent_module_load, "Load modules silently, not printing a warning when one's not found", NULL}, #ifdef YYDEBUG { "yydebug", 'y', 0, G_OPTION_ARG_NONE, &cfg_parser_debug, "Enable configuration parser debugging", NULL }, #endif -- 1.7.7

2 2

[Bug 138] New: Compilation failure in 3.3.1: CLOCK_MONOTONIC undeclared
by bugzilla＠bugzilla.balabit.com 15 Oct '11

15 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=138 Summary: Compilation failure in 3.3.1: CLOCK_MONOTONIC undeclared Product: syslog-ng Version: unspecified Platform: Macintosh OS/Version: Mac OS Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jacknagel(a)gmail.com Type of the Report: bug Estimated Hours: 0.0 Attempting to compile syslog-ng v3.3.1 from source on Mac OS X 10.6.8 fails with logsource.c: In function ‘log_source_msg_ack’: logsource.c:85: error: ‘CLOCK_MONOTONIC’ undeclared (first use in this function) logsource.c:85: error: (Each undeclared identifier is reported only once logsource.c:85: error: for each function it appears in.) I believe this is because OS X does not define CLOCK_MONOTONIC. Actually, afaik, OS X doesn't implement clock_gettime() either. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[PATCH] Fix compilation without OpenSSL.
by Gergely Nagy 15 Oct '11

15 Oct '11

While most places where OpenSSL was used were guarded by ENABLE_SSL ifs, some were not. This patch adds those guards to lib/crypto.c, modules/afsql/afsql.c and tests/loggen/loggen.c. It also makes sure that OPENSSL_LIBS gets emptied when enable_ssl is set to no. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- configure.in | 4 ++++ lib/crypto.c | 4 ++++ modules/afsql/afsql.c | 3 +++ tests/loggen/loggen.c | 3 +++ 4 files changed, 14 insertions(+), 0 deletions(-) diff --git a/configure.in b/configure.in index 13bc874..686911e 100644 --- a/configure.in +++ b/configure.in @@ -679,6 +679,10 @@ else enable_ssl="no" fi +if test "x$enable_ssl" = "xno"; then + OPENSSL_LIBS="" +fi + dnl dnl Right now, openssl is never linked statically as it is only used by the dnl TLS build of the afsocket plugin which is loaded dynamically anyway. diff --git a/lib/crypto.c b/lib/crypto.c index 702609c..ac4d070 100644 --- a/lib/crypto.c +++ b/lib/crypto.c @@ -29,6 +29,8 @@ #include "crypto.h" #include "apphook.h" +#if ENABLE_SSL + #include <openssl/rand.h> #include <openssl/ssl.h> #include <stdio.h> @@ -124,3 +126,5 @@ crypto_init(void) } /* the crypto options (seed) are handled in main.c */ + +#endif diff --git a/modules/afsql/afsql.c b/modules/afsql/afsql.c index eb59b57..02b9f83 100644 --- a/modules/afsql/afsql.c +++ b/modules/afsql/afsql.c @@ -35,7 +35,10 @@ #include <dbi/dbi.h> #include <string.h> + +#if ENABLE_SSL #include <openssl/md5.h> +#endif /* field flags */ enum diff --git a/tests/loggen/loggen.c b/tests/loggen/loggen.c index c5399a7..bf11a1e 100644 --- a/tests/loggen/loggen.c +++ b/tests/loggen/loggen.c @@ -14,11 +14,14 @@ #include <glib.h> #include <signal.h> +#if ENABLE_SSL #include <openssl/crypto.h> #include <openssl/x509.h> #include <openssl/pem.h> #include <openssl/ssl.h> #include <openssl/err.h> +#endif + #include <unistd.h> #define MAX_MESSAGE_LENGTH 8192 -- 1.7.0.4

2 1

Special characters in syslogng filters
by Jay 15 Oct '11

15 Oct '11

Hello If the filter specified in syslog-ng.conf contains the ( character or ) character, then is it correct to prefix them with \\. For example, if I need to filter a syslog containing the string (abcd) then in syslog-ng.conf, I would need to specify the filter as \$abcd\$ Could someone confirm, if this is the correct way of specifying the filter, please ? If not, please let me know the correct way of specifying the filter. Thanks in advance for your help.

2 1