June 2011 - syslog-ng - lists.balabit.hu

Auto-reply
by ago＠lsc.hu 30 Jun '11

30 Jun '11

Tisztelt Hölgyem/Uram! 2011.07.3-ig szabadságon tartózkodom. Ajánlatkérés vagy egyéb üzleti levelezés esetén írjon Tóth László kollégámnak, az info(a)lsc.hu címre. Támogatási kérdés esetén használja support felületünket a megadott felhasználónév-jelszó párossal. Üdvözlettel, Deim Ágoston

1 0

Auto-reply
by ago＠lsc.hu 29 Jun '11

29 Jun '11

Tisztelt Hölgyem/Uram! 2011.07.3-ig szabadságon tartózkodom. Ajánlatkérés vagy egyéb üzleti levelezés esetén írjon Tóth László kollégámnak, az info(a)lsc.hu címre. Támogatási kérdés esetén használja support felületünket a megadott felhasználónév-jelszó párossal. Üdvözlettel, Deim Ágoston

1 0

SYSLOG-NG and AIX packages.
by dbarry＠princesscruises.com 28 Jun '11

28 Jun '11

Greetings all: (Although it looks like this list is mostly populated by devs, the descriptor describes it as a user mailiong list as well, so I hope this message is OK here. If not, my apologies, and hopefully I can be re-directed.) I've had minor experience with personal experimentation with syslog-ng in a simple Redhat enviroment, where all I had to do was download the package. However, I'm trying to encourage my work environment to move to syslog-ng in our production environment. My work enivo consists of some AIX boxes, versions 5.3L, 6.x, and now 7.1. I believe our AIX team would be comfortable deploying standard packages, however, from what I can see in the evaluation section, it looks like the latest AIX packages I see is syslog-ng-2.0.10-1.aix5.2.ppc I see packages for other distros, but I think that is all for AIX.. >From what I know, our AIX team doesn't typically build and complile, the mostly install and run pre-packaged items on them, such as webservers, databases, etc. In my poking around, I see that there is active development with AIX in mind, but if I am understanding correctly, there are no current AIX packaged distros --- they have to be built by the end user. Is this correct? Can we purchase compiled packages and binaries for our environment? Or is compiling a build/package something that is trivial? (I suspect not). For now, these boxes would only really be "clients", if that makes any difference at all. And if I am wrong, and should be looking elsewhere for more recent AIX binaries/packages I would really appreciate a point in the right direction. I'd really be grateful for some guidance here. At this point, I'd be remiss not to thank all the folks behind the project. From my personal usage, its clear what a phenomenal project this is. Thanks much, d. The information contained in this email and any attachment may be confidential and/or legally privileged and has been sent for the sole use of the intended recipient. If you are not an intended recipient, you are not authorized to review, use, disclose or copy any of its contents. If you have received this email in error please reply to the sender and destroy all copies of the message. Thank you.

2 1

TCP vs. UDP
by Josu Lazkano 27 Jun '11

27 Jun '11

Hello again, I am reading on internet about syslog-ng. Next week I will start to change all my syslog configuration. I have 50 servers with rsyslog on client side and syslog-ng on the server side. The logs goes with UDP on the LAN. Is it better TCP? I am on a secure LAN so I don't going to apply SSL yet. Is there any important advantage using TCP? Any recommendation¿? Thanks for all your help and best regards.

2 2

Re: [syslog-ng] TCP vs. UDP
by Deim Ágoston 27 Jun '11

27 Jun '11

hi, TCP provides reliable transport because of TCP. Beside that there's no harm if you use TLS and there's no such thing that secure network if the clients connect to the net or there's public services opened to the internet. If you want to ensure that nobody impersonate the log clients or the log server use TLS. regards, Ago > Hello again, I am reading on internet about syslog-ng. Next week I will > start to change all my syslog configuration. I have 50 servers with > rsyslog on client side and syslog-ng on the server side. The logs goes > with UDP on the LAN. > > Is it better TCP? I am on a secure LAN so I don't going to apply SSL yet. > > Is there any important advantage using TCP? Any recommendationż? > > Thanks for all your help and best regards. > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >

1 0

[Bug 124] New: [regression] broken $FULLHOST after upgrade to 3.2.4
by bugzilla＠bugzilla.balabit.com 27 Jun '11

27 Jun '11

https://bugzilla.balabit.com/show_bug.cgi?id=124 Summary: [regression] broken $FULLHOST after upgrade to 3.2.4 Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: enrico.scholz(a)informatik.tu-chemnitz.de Type of the Report: --- Estimated Hours: 0.0 syslog-ng 3.2.4 sets the chained hostname from local sources always to 'hostname/hostname'. Previous version (2.x and 3.1.4) used 'localhost@hostname' for this resp. '<sourcename>@hostname'. This breaks existing setups because * destination filenames which contain $FULLHOST can not be used anymore because the '/' prevents their creation; e.g. my remote logserver has | destination d_iptables { file("/var/log/remote/IPTABLES/log.$FULLHOST" sync(10)); }; which created e.g. 'log.localhost@walther'. Now, it fails with | Error opening file for writing; filename='/var/log/remote/IPTABLES/log.walther/walther', error='No such file or directory (2)' * originating sources can not be identified anymore; e.g. I use syslog-ng to log events within chroot environments. E.g. I have | source kerberos { unix-dgram ("/vservers/kerberos/dev/log" keep-alive(no)); }; | source ldap { unix-dgram ("/vservers/ldap/dev/log" keep-alive(no)); }; Previously, messages could be identified because they were reported to come from 'kerberos@<host>' or 'ldap@<host>'. Now, the source is reported as '<host>/<host>' for both environments. 'strace' shows that the syslog client creates '<host>/<host>' strings. The syslog-ng client is configured as ----- @version:3.2 ################################################################### #### #### DO NOT EDIT THIS FILE! #### This file is managed by cfengine; any manual changes will be overridden #### ################################################################### options { flush_lines (0); time_reopen (10); log_fifo_size (16384); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); chain_hostnames (yes); }; source localhost { unix-stream ("/dev/log"); file("/proc/kmsg" program_override("kernel")); internal(); }; destination stunnel { tcp("127.0.0.1" port(520)); tcp("127.0.0.1" port(521)); }; ## Common block for kernel-logging filter f_kern { facility(kern); }; filter f_min_emerg { level(emerg); }; filter f_min_alert { level(alert..emerg); }; filter f_min_crit { level(crit..emerg); }; filter f_min_err { level(err..emerg); }; filter f_min_warn { level(warn..emerg); }; filter f_kern_err { filter(f_kern) and filter(f_min_warn); }; filter f_kern_crit { filter(f_kern) and filter(f_min_crit); }; destination d_kern { file("/var/log/kernel" fsync(yes) perm(0644)); }; destination d_cons { file("/dev/console"); }; log { filter(f_kern_err); source(localhost); destination(d_kern); }; log { filter(f_kern_crit); source(localhost); destination(d_cons); }; ## End kernel-logging block} log { destination(stunnel); flags(catch-all); }; ----- I am using the syslog-ng package from Fedora EPEL6 (http://koji.fedoraproject.org/koji/buildinfo?buildID=245187) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

AUTO: James B Horwath/TheGuardian is out of the office. (returning 07/05/2011)
by James B Horwath 25 Jun '11

25 Jun '11

I am out of the office until 07/05/2011. I am out of the office until Wednesday, July 6, 2011 with limited access to e-mail. If there are Nitro issues please contact Dante Rodino at 212-919-2819 or Sunil Gupta at 610-807-6710. Any other issues please contact Christopher Clarke manager of Security Operations Thanks, Jim Note: This is an automated response to your message "syslog-ng Digest, Vol 74, Issue 34" sent on 6/25/11 6:00:02. This is the only notification you will receive while this person is away. ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

1 0

Disk based buffering for syslog-ng v3.2.4 OSE
by Yu Watanabe 24 Jun '11

24 Jun '11

Hello all. I would like to ask question to all. Has any one implemented a disk based buffering logic in syslog-ng? Since the log_disk_fifo_size has been deprecated, I am considering to implementing with other way. In the manual v3.2, I found couple of examples with flow control but none with the disk buffering. It would be helpful if anyone can share their thoughts about this. Thanks, Yu

3 3

[Bug 125] New: [systemd] refuses stop request from systemctl on socket activated start
by bugzilla＠bugzilla.balabit.com 24 Jun '11

24 Jun '11

https://bugzilla.balabit.com/show_bug.cgi?id=125 Summary: [systemd] refuses stop request from systemctl on socket activated start Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: d(a)falconindy.com Type of the Report: bug Estimated Hours: 0.0 I'm seeing some unexpected behavior from syslog-ng when it's started by way of systemd's socket activation. The visible issue is that the process is ignoring a stop request from systemctl will will lead to systemd issuing a kill -9. An strace of the syslog-ng process when the signal is sent is as follows: 0x6e9ed0, 8192, 0, 0x7fff35fe0360, 0x7fff35fe03ec) = ? ERESTARTSYS (To be restarted) --- {si_signo=SIGTERM, si_code=SI_USER, si_pid=1, si_uid=0, si_value={int=1, ptr=0x1}} (Terminated) --- --- {si_signo=SIGCONT, si_code=SI_USER, si_pid=1, si_uid=0, si_value={int=1, ptr=0x1}} (Continued) --- rt_sigreturn(0xf) = -1 EINTR (Interrupted system call) recvfrom(3, And eventually: +++ killed by SIGKILL +++ It seems to ignore the SIGTERM. It does continue to receive messages and log them (checked via logger(1)). After the daemon is SIGKILL'ed, if I start it and then try to stop, it ends normally: ) = ? ERESTART_RESTARTBLOCK (To be restarted) --- {si_signo=SIGTERM, si_code=SI_USER, si_pid=1, si_uid=0, si_value={int=1, ptr=0x1}} (Terminated) --- --- {si_signo=SIGCONT, si_code=SI_USER, si_pid=1, si_uid=0, si_value={int=1, ptr=0x1}} (Continued) --- rt_sigreturn(0xf) = -1 EINTR (Interrupted system call) gettimeofday({1308428877, 84197}, NULL) = 0 gettimeofday({1308428877, 84385}, NULL) = 0 close(6) = 0 gettimeofday({1308428877, 84763}, NULL) = 0 poll([{fd=3, events=POLLIN}, {fd=5, events=POLLIN}, {fd=6, events=POLLIN}], 3, 0) = 1 ([{fd=6, revents=POLLNVAL}]) gettimeofday({1308428877, 85143}, NULL) = 0 gettimeofday({1308428877, 85332}, NULL) = 0 lseek(7, 0, SEEK_END) = 3013 write(7, "Jun 18 16:27:57 kweemoo syslog-n"..., 87) = 87 lseek(8, 0, SEEK_END) = 175609 write(8, "Jun 18 16:27:57 kweemoo syslog-n"..., 87) = 87 gettimeofday({1308428877, 86379}, NULL) = 0 poll([{fd=3, events=POLLIN}, {fd=5, events=POLLIN}, {fd=6, events=POLLIN}], 3, 0) = 1 ([{fd=6, revents=POLLNVAL}]) gettimeofday({1308428877, 86757}, NULL) = 0 gettimeofday({1308428877, 86946}, NULL) = 0 lseek(7, 0, SEEK_END) = 3100 write(7, "Jun 18 16:27:57 kweemoo syslog-n"..., 81) = 81 lseek(8, 0, SEEK_END) = 175696 write(8, "Jun 18 16:27:57 kweemoo syslog-n"..., 81) = 81 close(3) = 0 close(5) = 0 close(7) = 0 close(8) = 0 unlink("/var/run/syslog-ng.pid") = 0 exit_group(0) = ? If if disable the syslog-ng.service from automatically starting at boot and start it manually, it appears to behave properly. The service file I use is: ------------------- [Unit] Description=System Logger Daemon [Service] Sockets=syslog.socket ExecStartPre=/bin/systemctl stop systemd-kmsg-syslogd.service ExecStart=/usr/sbin/syslog-ng -F [Install] WantedBy=multi-user.target ------------------- Additional Info: * version: 3.2.4 * build options: --prefix=/usr --sysconfdir=/etc/syslog-ng --libexecdir=/usr/lib --localstatedir=/var/lib/syslog-ng --enable-tcp-wrapper --with-pidfile-dir=/var/run --disable-spoof-source --enable-systemd * Distro: Arch Linux * Kernel: 2.6.39.1 -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

ISO 8601 format in syslog-ng
by Pramod Pillai 24 Jun '11

24 Jun '11

Hi Need your help to understand ISO 8601 format settings on the syslog-ng server. On the syslog-ng client log the time stamp is shown as "2011-06-15T23:42:26+00:00" On the syslog-ng server log the time stamp is printed as "2011-06-15T23:42:26+05:30" The client uses $ISODATE in the template The server is using $S_ISODATE in the template As per my understanding the time stamp on the server should be "2011-06-16T05:12:26+05:30" . Is my understaning of ISO 8601 format is incorrect ? or my setting in the syslog-ng config file is wrong ? Regards Pramod

2 1