May 2011 - syslog-ng - lists.balabit.hu

[PATCH] afmongodb: Fix a possible crash during configuration.
by Gergely Nagy 12 May '11

12 May '11

During configuration, if the user specified value-pairs(), the driver would crash, because it tried to free a NULL structure. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/afmongodb/afmongodb.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/modules/afmongodb/afmongodb.c b/modules/afmongodb/afmongodb.c index 68594d7..422058e 100644 --- a/modules/afmongodb/afmongodb.c +++ b/modules/afmongodb/afmongodb.c @@ -148,7 +148,8 @@ afmongodb_dd_set_value_pairs(LogDriver *d, ValuePairs *vp) { MongoDBDestDriver *self = (MongoDBDestDriver *)d; - value_pairs_free (self->vp); + if (self->vp) + value_pairs_free (self->vp); self->vp = vp; } -- 1.7.2.5

2 3

[PATCH] value-pairs: Use MESSAGE instead of MSG.
by Gergely Nagy 12 May '11

12 May '11

MESSAGE is the canonical name of the key, not MSG. Using MSG in the rfc3164 scope will result in both MSG and MESSAGE being present if nv-pairs is being used aswell. Using the canonical name, only MESSAGE will end up in the set, which is exactly what we'd like. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- lib/value-pairs.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/lib/value-pairs.c b/lib/value-pairs.c index f88a486..7a09812 100644 --- a/lib/value-pairs.c +++ b/lib/value-pairs.c @@ -76,7 +76,7 @@ static ValuePairSpec rfc3164[] = { "HOST" }, { "PROGRAM" }, { "PID" }, - { "MSG" }, + { "MESSAGE" }, { "DATE", "R_DATE" }, { 0 }, }; -- 1.7.2.5

2 1

syslog-ng 3.2.4 has been released
by devel＠balabit.hu 11 May '11

11 May '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.2.4 SUMMARY : new stable release DATE : May 11, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.2.4) has been released. For latest fixes in the 3.2.x branch you are recommended to upgrade to this version. CHANGES: 3.2.4 Thu, 05 May 2011 23:10:52 +0200 Highlights: This maintenance release fixes some looser ends in the last published release, 3.2.3. There's one more important bugfix here, which is triggered by PCRE newer than 8.12. Bugfixes: * Fixed build problems on Solaris & AIX. * A bug was found in the pcre implementation for subst(). If the "global" flag is specified and pcre returns an error, an infinite loop is created, consuming memory in the process. It is triggered by PCRE 8.12, but could potentially affect older versions too. * Fixed a potential use of uninitialized memory in the configuration file parser, no bug was triggered but gcc 4.6 reported it via a warning. Other changes: * Fixed most (but not all) compilation warnings when compiling with gcc 4.6 Credits: syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Sandor Geller (Morgan Stanley) Balazs Scheidler (BalaBit) Micah Anderson Jose Oliveira (Fedora) Thanks for your efforts, it is appreciated. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

Configuring Syslog-ng client to start on a specific IP
by Pramod Pillai 09 May '11

09 May '11

Hi I am using Solaris box and it has multiple IP interfaces. I need to force the syslog-ng client to run on a specific interface card i.e on a specific IP. How can I do that. Each interface card is configured to run on different subnet and they can't talk to each other. ( for security reasons ) Hence when I run my syslog-ng client I end up running on the interface where I login. I want to change it. I want the syslog-client to create a socket on the interface ( IP ) which I specify ( in the config file ). Regards Pramod

2 1

Re: [syslog-ng] [PATCH RFC] Use cap_syslog when it is available (v3)
by Gergely Nagy 08 May '11

08 May '11

(forwarding the original mail, as it looks like it never made to the list) Serge Hallyn <serge.hallyn(a)canonical.com> writes: > (A-ha - great idea from Andrew - we *can* figure out whether the > kernel knows about CAP_SYSLOG, using the bounding set API) > > If cap_syslog exists, the kernel will complain (once) that we only > have cap_sys_admin. Additionally, using cap_syslog instead of > cap_sys_admin significantly lowers the unneeded privs we are > using. > > Changelog: > v2: At startup, detect whether libcap knows about CAP_SYSLOG. > (Thanks to Gergely Nagy for pointing out that case) > v3: Andrew Morgan pointed out a nice way to detect whether > the kernel has CAP_SYSLOG. Thanks, Andrew! > > Signed-off-by: Serge Hallyn <serge.hallyn(a)ubuntu.com> > --- > lib/gprocess.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++- > lib/gprocess.h | 2 +- > modules/affile/affile.c | 4 +++ > syslog-ng/main.c | 10 ++------ > 4 files changed, 55 insertions(+), 9 deletions(-) > > diff --git a/lib/gprocess.c b/lib/gprocess.c > index d9a2dfb..f9bda7b 100644 > --- a/lib/gprocess.c > +++ b/lib/gprocess.c > @@ -98,6 +98,7 @@ static gint startup_result_pipe[2] = { -1, -1 }; > static gint init_result_pipe[2] = { -1, -1 }; > static GProcessKind process_kind = G_PK_STARTUP; > static gboolean stderr_present = TRUE; > +static int have_capsyslog = FALSE; > > /* global variables */ > static struct > @@ -210,6 +211,14 @@ g_process_cap_modify(int capability, int onoff) > if (!process_opts.caps) > return TRUE; > > +#ifdef CAP_SYSLOG > + /* > + * if libcap or kernel doesn't support cap_syslog, then resort to > + * cap_sys_admin > + */ > + if (capability == CAP_SYSLOG && !have_capsyslog) > + capability = CAP_SYS_ADMIN; > +#endif > caps = cap_get_proc(); > if (!caps) > return FALSE; > @@ -416,7 +425,7 @@ g_process_set_working_dir(const gchar *cwd) > * capability set. The process will change its capabilities to this value > * during startup, provided it has enough permissions to do so. > **/ > -void > +static void > g_process_set_caps(const gchar *caps) > { > if (!process_opts.caps) > @@ -879,6 +888,43 @@ g_process_change_dir(void) > } > > /** > + * g_process_setup_caps(void) > + * > + * NOTE: polling /proc/kmsg requires cap_sys_admin, otherwise it'll always > + * indicate readability. Enabling/disabling cap_sys_admin on every poll > + * invocation seems to be too expensive. So I enable it for now. > + */ > +void > +g_process_setup_caps(void) > +{ > + int ret; > + gchar * capsstr = "cap_net_bind_service,cap_net_broadcast,cap_net_raw," > + "cap_dac_read_search,cap_dac_override,cap_chown,cap_fowner=p " > + "cap_sys_admin=ep"; > +#ifdef CAP_SYSLOG > + cap_t caps; > + > + /* Check whether cap_syslog exists. If not, get cap_sys_admin, else get > + * cap_syslog */ > + caps = cap_from_text("cap_syslog=p"); > + if (caps) { > + cap_free(caps); > + /* libcap knows it, does the kernel? */ > + ret = prctl(PR_CAPBSET_READ, CAP_SYSLOG); > + if (ret != -1) { > + /* kernel knows cap_syslog! Use it */ > + capsstr = "cap_net_bind_service,cap_net_broadcast,cap_net_raw," > + "cap_dac_read_search,cap_dac_override,cap_chown,cap_fowner=p " > + "cap_syslog=ep"; > + have_capsyslog = TRUE; > + } > + } > +#endif > + > + g_process_set_caps(capsstr); > +} > + > +/** > * g_process_send_result: > * @ret_num: exit code of the process > * > diff --git a/lib/gprocess.h b/lib/gprocess.h > index cda35b0..4ad0866 100644 > --- a/lib/gprocess.h > +++ b/lib/gprocess.h > @@ -66,7 +66,7 @@ void g_process_set_chroot(const gchar *chroot); > void g_process_set_pidfile(const gchar *pidfile); > void g_process_set_pidfile_dir(const gchar *pidfile_dir); > void g_process_set_working_dir(const gchar *cwd); > -void g_process_set_caps(const gchar *caps); > +void g_process_setup_caps(void); > void g_process_set_argv_space(gint argc, gchar **argv); > void g_process_set_use_fdlimit(gboolean use); > void g_process_set_check(gint check_period, gboolean (*check_fn)(void)); > diff --git a/modules/affile/affile.c b/modules/affile/affile.c > index a713bfc..358a083 100644 > --- a/modules/affile/affile.c > +++ b/modules/affile/affile.c > @@ -59,7 +59,11 @@ affile_open_file(gchar *name, gint flags, > if (privileged) > { > g_process_cap_modify(CAP_DAC_READ_SEARCH, TRUE); > +#ifdef CAP_SYSLOG > + g_process_cap_modify(CAP_SYSLOG, TRUE); > +#else > g_process_cap_modify(CAP_SYS_ADMIN, TRUE); > +#endif > } > else > { > diff --git a/syslog-ng/main.c b/syslog-ng/main.c > index 7e81f2f..5e62c1f 100644 > --- a/syslog-ng/main.c > +++ b/syslog-ng/main.c > @@ -167,13 +167,9 @@ main(int argc, char *argv[]) > > g_process_set_argv_space(argc, (gchar **) argv); > > - /* NOTE: polling /proc/kmsg requires cap_sys_admin, otherwise it'll always > - * indicate readability. Enabling/disabling cap_sys_admin on every poll > - * invocation seems to be too expensive. So I enable it for now. */ > - > - g_process_set_caps("cap_net_bind_service,cap_net_broadcast,cap_net_raw," > - "cap_dac_read_search,cap_dac_override,cap_chown,cap_fowner=p " > - "cap_sys_admin=ep"); > + /* Set up the minimal privilege we'll need */ > + g_process_setup_caps(); > + > ctx = g_option_context_new("syslog-ng"); > g_process_add_option_group(ctx); > msg_add_option_group(ctx); -- |8]

2 4

[PATCH] afmongodb: Fix a possible crash during configuration.
by Gergely Nagy 08 May '11

08 May '11

During configuration, if the user specified value-pairs(), the driver would crash, because it tried to free a NULL structure. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/afmongodb/afmongodb.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/modules/afmongodb/afmongodb.c b/modules/afmongodb/afmongodb.c index 68594d7..422058e 100644 --- a/modules/afmongodb/afmongodb.c +++ b/modules/afmongodb/afmongodb.c @@ -148,7 +148,8 @@ afmongodb_dd_set_value_pairs(LogDriver *d, ValuePairs *vp) { MongoDBDestDriver *self = (MongoDBDestDriver *)d; - value_pairs_free (self->vp); + if (self->vp) + value_pairs_free (self->vp); self->vp = vp; } -- 1.7.2.5

1 0

3.3.0alpha2(git) escape \ with postgresql 9.0.4
by Hendrik Visage 05 May '11

05 May '11

Hi there (1) Thanks for the default value in the afsql ;) (2)warning seen: Running SQL query; query='INSERT INTO SystemEvents (ID, ReceivedAt, DeviceReportedTime, Facility, Priority, FromHost, Message, InfoUnitID, SysLogTag, CustomerID, NTSeverity, Importance, EventSource, EventUser, EventCategory, EventID, EventBinaryData, MaxAvailable, CurrUsage, MinUsage, MaxUsage, EventLogType, GenericFileName, SystemID) VALUES (DEFAULT, \'2011-05-05T16:45:58+02:00\', \'2011-05-05T16:45:58+02:00\', \'5\', \'3\', \'pint02\', \' 5 16:27:23 pint02 syslog-ng[1788]: I/O error occurred while writing; fd=\'\'23\'\', error=\'\'Can\\\'\'t assign requested address (227)\'\'\', \'1\', \'May \', NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL)' WARNING: nonstandard use of \\ in a string literal LINE 1: ... '2011-05-05T16:45:58+02:00', '5', '3', 'pint02', ' 5 16:27:... ^ HINT: Use the escape string syntax for backslashes, e.g., E'\\'.

2 1

[Bug 119] New: Compiling syslog-ng 3.2.3 with gcc 4.6: warnings
by bugzilla＠bugzilla.balabit.com 04 May '11

04 May '11

https://bugzilla.balabit.com/show_bug.cgi?id=119 Summary: Compiling syslog-ng 3.2.3 with gcc 4.6: warnings Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jpo(a)di.uminho.pt Type of the Report: --- Estimated Hours: 0.0 Hi, This is a small report about the 42 warnings produced by gcc 4.6 when compiling syslog-ng 3.2.3 without SSL and SQL support. The target linux distribution was Fedora 16 (currently very similar to the Fedora 15 Beta). The complete build logs can be browsed here: * http://kojipkgs.fedoraproject.org/packages/syslog-ng/3.2.3/1.fc16/data/logs… * http://kojipkgs.fedoraproject.org/packages/syslog-ng/3.2.3/1.fc16/data/logs… Warnings count by type: Num : gcc_warning_type ------------------------------------- 2 : -Wcpp 1 : -Wimplicit-function-declaration 2 : -Wstrict-aliasing 18 : -Wuninitialized 9 : -Wunused-but-set-variable 10 : -Wunused-result ------------------------------------- Output of wget -q -O - http://kojipkgs.fedoraproject.org/packages/syslog-ng/3.2.3/1.fc16/data/logs… | grep "\[-W": ---------- misc.c:382:9: warning: variable 'saved_caps' set but not used [-Wunused-but-set-variable] misc.c:420:18: warning: ignoring return value of 'chown', declared with attribute warn_unused_result [-Wunused-result] misc.c:422:18: warning: ignoring return value of 'chown', declared with attribute warn_unused_result [-Wunused-result] logrewrite.c:72:11: warning: variable 'regexp_error' set but not used [-Wunused-but-set-variable] gprocess.c:920:12: warning: ignoring return value of 'write', declared with attribute warn_unused_result [-Wunused-result] gprocess.c:873:14: warning: ignoring return value of 'chdir', declared with attribute warn_unused_result [-Wunused-result] gprocess.c:881:13: warning: ignoring return value of 'getcwd', declared with attribute warn_unused_result [-Wunused-result] filter-expr-grammar.c:3538:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] block-ref-grammar.c:2943:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] cfg-grammar.c:4073:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] pragma-grammar.c:3063:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] rewrite-expr-grammar.c:3117:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] parser-expr-grammar.c:2958:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] afsocket.c:95:13: warning: variable 'saved_caps' set but not used [-Wunused-but-set-variable] afunix.c:138:9: warning: variable 'saved_caps' set but not used [-Wunused-but-set-variable] afunix.c:149:14: warning: ignoring return value of 'chown', declared with attribute warn_unused_result [-Wunused-result] afunix.c:151:14: warning: ignoring return value of 'chown', declared with attribute warn_unused_result [-Wunused-result] afinet.c:349:17: warning: variable 'saved_caps' set but not used [-Wunused-but-set-variable] afinet.c:465:36: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] afinet.c:466:36: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] afsocket-grammar.c:5597:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] afsocket.c:1080:29: warning: 'source' may be used uninitialized in this function [-Wuninitialized] affile.c:47:9: warning: variable 'saved_caps' set but not used [-Wunused-but-set-variable] affile.c:109:15: warning: ignoring return value of 'fchown', declared with attribute warn_unused_result [-Wunused-result] affile.c:111:15: warning: ignoring return value of 'fchown', declared with attribute warn_unused_result [-Wunused-result] affile-grammar.c:3734:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] afprog-grammar.c:3455:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] afuser-grammar.c:2916:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] csvparser.c:348:3: warning: implicit declaration of function 'log_column_parser_free_method' [-Wimplicit-function-declaration] csvparser-grammar.c:3055:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] syslog-format.c:664:9: warning: variable 'sd_param_len' set but not used [-Wunused-but-set-variable] patternize.c:85:2: warning: #warning "openssl seems to be missing on your system, UUID generation will be disabled in pdbtool patternize" [-Wcpp] patternize.c:85:2: warning: #warning "openssl seems to be missing on your system, UUID generation will be disabled in pdbtool patternize" [-Wcpp] dbparser-grammar.c:2929:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] patterndb.c:421:12: warning: variable 'class_tag' set but not used [-Wunused-but-set-variable] patterndb.c:421:12: warning: variable 'class_tag' set but not used [-Wunused-but-set-variable] dummy-grammar.c:2950:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] loggen.c:183:12: warning: ignoring return value of 'fgets', declared with attribute warn_unused_result [-Wunused-result] loggen.c:350:17: warning: 'pos_seq' may be used uninitialized in this function [-Wuninitialized] loggen.c:329:21: warning: 'pos_timestamp2' may be used uninitialized in this function [-Wuninitialized] loggen.c:328:21: warning: 'pos_timestamp1' may be used uninitialized in this function [-c] loggen.c:215:1: warning: 'linelen' may be used uninitialized in this function [-Wuninitialized] ---------- Note: The warning "csvparser.c:348:3: warning: implicit declaration of function 'log_column_parser_free_method' [-Wimplicit-function-declaration]" appears to already be eliminated by a recent commit. Would it be possible to have some of these warnings eliminated? In particular the ones of the -Wuninitialized type? jpo -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

3.2.4 to be released in the coming days
by Balazs Scheidler 04 May '11

04 May '11

Hi, Since the release of 3.2.3 spurred some activity around the 3.2.x branch again, I accumulated some changes that either fix build related issues and fixes for a bug or two. I'm going to prepare a release later today, or latest tomorrow, so if you have an 3.2.x related issue, it's best to speak up now, so that I can perhaps fix it before doing a release. Thanks, -- Bazsi

1 0

Integrating syslog-ng on Solaris 10
by Pramod Pillai 04 May '11

04 May '11

Hi On Solaris machine the legacy logging is done by SMF system-log. And there are many Solaris SMF which depends on system-log SMF. If I want to integrate syslog-ng to Solaris box , should I disable system-log SMF ? But disabling "system-log" will cause few legacy SMF to go down. I can't have system-log SMF and syslog-ng enabled at the same time since it would result in logging twice. Can any one suggest alternative approach for integrating syslog-ng to Solaris box. Regards Pramod

5 4