March 2011 - syslog-ng - lists.balabit.hu

[Bug 104] New: Add libtool option -module
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=104 Summary: Add libtool option -module Product: syslog-ng Version: 3.2.x Platform: All OS/Version: All Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: vinschen(a)redhat.com Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=30) --> (https://bugzilla.balabit.com/attachment.cgi?id=30) Patch to add libtool option -module Libtool 2.2.6 and later provides an option -module which should be used when creating shared libraries which are supposed to be used as modules which get loaded via dlopen. See the "Building modules to dlopen" chapter in `info libtool'. For Cygwin the additional benefit is that the modules are not copied into a parallel "bin" directory at installation time, which is the default otherwise to accommodate the DLL search algorithm on Windows. The attached patch just adds the -module option to each of the Makefile.am files in the modules subdir. Corinna -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 4

[Bug 14] New: Maintain symlinks to current and previous log output files...
by bugzilla＠bugzilla.balabit.com 28 Sep '11

28 Sep '11

https://bugzilla.balabit.com/show_bug.cgi?id=14 Summary: Maintain symlinks to current and previous log output files... Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=218688 OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: enhancement Estimated Hours: 0.0 >From bugs.debian.org: I'm hoping that upstream might consider adding functionality to syslog-ng to allow it to track current and previous log files and maintain symlinks to them, as a user option. This replicates one of the options that I (and others) find useful in cronolog. This has been previously discussed on the syslog-ng mailing list, though apparently nothing fully came of it. The archive of that discussion is at: https://lists.balabit.hu/pipermail/syslog-ng/2002-June/003452.html Obviously, it's probably somewhat of a low priority, but it would be nice. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

SSL certificate verification
by Peter Eckel 30 Apr '11

30 Apr '11

Hi all, I am currently setting up a remote logging facility for a customer who requires encryption and mutual authentication. After having run Syslog NG over Stunnel for several years, I am looking into the option to do the same withot stunnel, by using Syslog NG with the TLS option. My current version is 3.2.2, installed from the binary provided on the Syslog NG web site, on CentOS 5.5. My setup on the server side (stripped to the minimum): source s_remote { tcp( ip( 192.168.42.184 ) port( 601 ) tls( key_file("/opt/syslog-ng/etc/ssl/server_key.pem") cert_file("/opt/syslog-ng/etc/ssl/server_crt.pem") ca_dir( "/opt/syslog-ng/etc/ssl" ) peer_verify( required-trusted ) ) ); }; destination d_remote { file( "/var/log/remote" owner(root) group(root) perm(0600) ); }; log { source(s_remote); destination(d_remote); }; On the client side: source s_local { internal(); unix-stream( "/dev/log" ); file( "/proc/kmsg" ); }; destination d_remote { tcp( "192.168.42.184" port( 601 ) tls( key_file("/opt/syslog-ng/etc/ssl/client1_key.pem") cert_file("/opt/syslog-ng/etc/ssl/client1_crt.pem") ca_dir( "/opt/syslog-ng/etc/ssl" ) ) ); }; log { source(s_local); destination(d_remote); }; With the appropriate and valid client cert, it works perfrctly: [root@server1 ssl]# openssl x509 -noout -text < client1_crt.pem Certificate: Data: Version: 1 (0x0) Serial Number: 2 (0x2) Signature Algorithm: sha256WithRSAEncryption Issuer: O=xxx, OU=Client 1/emailAddress=xxx, L=xxx, ST=xxx, C=xx, CN=xxx Validity Not Before: Mar 8 15:53:24 2011 GMT Not After : Mar 7 15:53:24 2014 GMT Subject: C=xx, ST=xx, O=xx, OU=xx, CN=client1 Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) ... However, I copied over the cert of another client machine to client1, reconfigure Syslog NG to use it, and it works as well, though IMHO it shouldn't: [root@server1 ssl]# openssl x509 -noout -text < client2_crt.pem Certificate: Data: Version: 1 (0x0) Serial Number: 3 (0x3) Signature Algorithm: sha256WithRSAEncryption Issuer: O=xxx, OU=Client 2/emailAddress=xxx, L=xxx, ST=xxx, C=xx, CN=xxx Validity Not Before: Mar 8 15:54:35 2011 GMT Not After : Mar 7 15:54:35 2014 GMT Subject: C=xx, ST=xxx, O=xxx, OU=Client 2, CN=client2 Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) Modulus (2048 bit): ... Swapping certificates (client2's instead of server's in this case) on the server breaks trust (as expected): Mar 8 18:19:45 client1 syslog-ng[2991]: Syslog connection established; fd='10', server='AF_INET(192.168.42.184:601)', local='AF_INET(0.0.0.0:0)' Mar 8 18:20:13 client1 syslog-ng[2991]: Certificate subject does not match configured hostname; hostname='server', certificate='client2' Mar 8 18:20:13 client1 syslog-ng[2991]: SSL error while writing stream; tls_error='SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed' Mar 8 18:20:13 client1 syslog-ng[2991]: I/O error occurred while writing; fd='10', error='Broken pipe (32)' Doing the same on the client, however, does not. The Syslog NG server does not seem to validate the CN. Is this expected behaviour or a bug? Best regards, Peter.

4 10

diskqueue framework patch
by Nagy Attila 08 Apr '11

08 Apr '11

Hi all, due to the need for disk queue usage in PE 4.1 we had to extend the syslog-ng sources, in order to be able write plugins that implement this feature. This patch contains these modifications. Basically it extends the 'class' hierarchy (and 'virtual' functions, see the new LogDestDriver) so that plugins can define their own queue mechanisms (as some do this in PE modules) and these special queues can be assigned to destinations. -Attila NAGY (syslog-ng-dev)

3 5

Convert UTC to local time zone using syslog-ng
by Pramod Pillai 07 Apr '11

07 Apr '11

Hi I receive syslog from remote note with timezone set as UTC. I need to convert these timestamp to local time zone Can some one suggest how can i achive it. Regards Pramod

4 5

Blog post on ELSA
by Martin Holste 01 Apr '11

01 Apr '11

I just put up an entry on my blog (http://ossectools.blogspot.com) describing the Enterprise Log Search and Archive Project (http://code.google.com/p/enterprise-log-search-and-archive) I've been working on which uses Syslog-NG >= 3.1 and pattern-db at its core. There are a lot of other open-source log collection frameworks out there that are easier to install, such as Logzilla (php-syslog-ng), but if you're trying to log > 1k messages/sec (common in large orgs) and need something GPL licensed, installing ELSA will probably be worth your while. We're using it to index 15k messages/sec with basic hardware. It's currently storing tens of billions logs, and full-text, ad-hoc queries complete in about 1/2 to 2 seconds, including group-by queries on arbitrary fields for reporting. I put a few screenshots and a feature list in the post. The documentation is pretty basic right now, but I'm happy to assist if you run into issues. ELSA is also open to plugin creation, so if you find ELSA useful and create plugins, please let me know and I can add them to the project. Also, patterns for the pattern-db are more than welcome! I've included patterns for Cisco FWSM connections and denies, Snort logs, Windows logs from Eventlog-to-Syslog as well as Snare, and URL's from my httpry wrapper, which is available on the project site as well as in the tarball/source code. Comments and feedback are welcome! Thanks, Martin

6 8

how to push sulogs/utmpx/wtmpx to central logserver
by Tony MacDoodle 31 Mar '11

31 Mar '11

Hello All, I would like to push only the following log files to a central syslog-ng server. All clients are Solaris 10 and the syslog-ng server is also Solaris 10. IS it possible to push only this information? wtmpx utmpx sulog Thanks

4 3

Make Errors on Solaris 10
by Tony MacDoodle 31 Mar '11

31 Mar '11

Hello, I am trying to compile syslog-ng 3.2.2 for Solaris 10 Sparc and getting the following errors when I run a make: ./configure --enable-tcp-wrapper syslog-ng Open Source Edition 3.2.2 configured Compiler options: compiler : gcc -std=gnu99 compiler options : -g -O2 -Wall -D_REENTRANT -D_PTHREADS -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -lpthread prefix : /usr/local linking mode : dynamic Features: Sun STREAMS support (module): yes Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : yes spoof-source support : no tcp-wrapper support : yes SSL support (module) : no SQL support (module) : no Linux capability support : no PCRE support : no Env wrapper support : no PACCT module (EXPERIMENTAL) : no root:~/syslog/syslog-ng-3.2.2#* make* make all-recursive Making all in lib make: Fatal error in reader: Makefile, line 637: Unexpected end of line seen Current working directory /root/syslog/syslog-ng-3.2.2/lib *** Error code 1 The following command caused the error: fail= failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='lib modules syslog-ng scripts tests doc contrib scl debian tgz2build'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (CDPATH="${ZSH_VERSION+.}:" && cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /root/syslog/syslog-ng-3.2.2 *** Error code 1 make: Fatal error: Command failed for target `all' Thanks

2 1

Embedded log statements
by Hendrik Visage 29 Mar '11

29 Mar '11

Hi there, The example in the Administrator's Guide, looks (simplified) like this: log{ Source(source); filter(f1); destination(d1) log { filter(f1.1); destination(d1.1) log {filter(f1.1.1); destination(d1.1.1)}; }; }; ie. the equivalence of: log{ Source(source); filter(f1); destination(d1)} log{ Source(source); filter(f1); filter(f1.1); destination(d1.1)} log{ Source(source); filter(f1); filter(f1.1); filter(f1.1.1); destination(d1.1.1)}; I need to know if the following also allowed/expected behavior of embedded logs: log{ Source(source); filter(f1); destination(d1) log { filter(f1.1); destination(d1.1) log {filter(f1.1.1); destination(d1.1.1)}; }; log {filter(f1.2); destination(d1.2)}; }; ie. equivalent to: log{ Source(source); filter(f1); destination(d1)} log{ Source(source); filter(f1); filter(f1.1); destination(d1.1)} log{ Source(source); filter(f1); filter(f1.1); filter(f1.1.1); destination(d1.1.1)}; log{ Source(source); filter(f1); filter(f1.2); destination(d1.2)} And example to this nature in the documentation would be appreciated ;) Thank you Hendrik

2 2

Re: [syslog-ng] Regexp values in comparison
by Roland Kamke 29 Mar '11

29 Mar '11

Thank you, Robert. I guess since I only have syslog-ng OSE 3.0.10-1.rhel5 this regexp comparison stuff won't work anyway - that's a pity. I have to use CentOS 5 - do you know some yum repository providing newer OSE versions then 3.0.10-1.rhel5, e. g. OSE 3.3 or 3.2? Regards, Roland -----Ursprüngliche Nachricht----- Von: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] Im Auftrag von Fekete Robert Gesendet: Dienstag, 29. März 2011 11:57 An: Syslog-ng users' and developers' mailing list Betreff: Re: [syslog-ng] Regexp values in comparison Hi, yes, you can do such things in syslog-ng OSE 3.2 and 3.3, but not in earlier versions. Check out https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.2-gu… for details. Regards, Robert On 03/29/2011 10:27 AM, Roland Kamke wrote: > A newbie question: Is it possible to use values matching a regular expression in > a comparison? > > Imagine I receive messges like this: "Disk usage is 60%", "Disk usage is 80%", > etc. All match the regular expression "Disk usage is [0-9]+%". I do not want to > log all these messages, but only those where disk usage is at least 75 per cent. > Can this be achieved by proper configuration? > Where to look in the documentation? > > Currently I am stuck with this approch: > parser p_disk { > csv-parser(columns("fix.disk","fix.usage", "fix.is", "diskusage") > delimiters(" %") > ); > }; > filter f_disk_syntax { > message("Disk usage is [0-9]+%"); > }; > filter f_disk_usage { "$diskusage" > "75" }; > log l_mylog { > source(...); > filter(f_disk_syntax); > parser(p_disk); > filter(f_disk_usage); > destination(...); > }; > > Is this a useful approach? Can it be accomplished with fewer definitions? > The definition of f_disk_usage results in a syntax error. What would be the > right syntax? > filter f_disk_usage { "$diskusage" > "75" }; > filter f_disk_usage { "$diskusage" ge "75" }; > filter f_disk_usage { value("diskusage") > "75" }; > filter f_disk_usage { "$diskusage" > 75}; > filter f_disk_usage { "${diskusage}" > "75" }; > filter f_disk_usage { ${diskusage} > "75" }; > > Will I need to set up a pattern database to get rid of all unwanted messages? > > Thank you > Roland > > > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

2 1