September 2011 - syslog-ng - lists.balabit.hu

patterndb & windows
by Peter Czanik 06 Sep '11

06 Sep '11

Hello, A few weeks ago we posted a collection of patterns for Windows 2k8 (but most of it should work also with other releases). While there were many people downloading it, I received no feedback at all. So I'd like to ask, what are your experiences with it? Where could it be improved? Please leave your comments here or answer me in private (some UNIX admins tend to keep it secret, that they also deal with Windows machines :-) ), so we could make our Windows patterns more useful for you! For those, who missed the original announcement, you can read it at https://czanik.blogs.balabit.com/2011/07/patterns-for-windows-server-2008/ Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

3 4

syslog-ng own logs
by André Larose 06 Sep '11

06 Sep '11

Hello everybody, I have a simple question, I googled it but got sooooooooo many hits and found no answer so far I thought I would ask the experts. I only use syslog-ng to capture logs of my in-house applications but not the usual syslog messages, I leave that to the sysadm team. This means when syslog-ng sends messages about itself I am not be able to see them as they end up in the other syslog, "I think". I would like to know how I can save to file the logs generated by syslog-ng itself . Regards, André Larose Senior Systems Analyst TELUS Solutions en santé | avec l'expertise d'Emergis TELUS Health Solutions | backed by Emergis L'information contenue dans ce message, y compris les fichiers joints, est de nature exclusive et confidentielle, et ne doit être utilisée que par le destinataire. Ce message peut contenir des renseignements réservés, sujets aux dispositions des lois sur la confidentialité. En conservant et en utilisant les renseignements contenus dans ce message, le destinataire autorisé s'engage à protéger l'information qu'il contient contre la perte, la divulgation, le vol ou l'exposition à tout risque, en appliquant des précautions au moins égales à celles qu'il utilise pour la protection de ses propres renseignements personnels. Toute diffusion ou utilisation de l'information contenue dans ce message par une personne autre que son destinataire explicite constitue un acte non autorisé et potentiellement illicite. Si vous avez reçu ce message par erreur, veuillez nous aviser en répondant à l'expéditeur et détruire toutes les copies du message en votre possession. The information contained herein, including any attachments, is proprietary and confidential and is intended for the exclusive use of the addressee. It also may contain privileged information and/or personal information subject to privacy legislation. The authorized addressee of this information, by its retention and use, agrees to protect the information contained herein from loss, disclosure, theft or compromise with at least the same care it employs to protect its own confidential information. Any dissemination or use of this information by a person other than the intended recipient is unauthorized and may be illegal. If you have received this e-mail in error, please notify us immediately by reply e-mail and destroy this message.

2 1

OSX
by Peter Czanik 06 Sep '11

06 Sep '11

Hello, A quick question to anybody using OSX: do you see a demand for using OSX as a syslog client or central log server? Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

2 1

3.3 memory leaks
by Balazs Scheidler 04 Sep '11

04 Sep '11

Hi, I think I have closed the memory leaks reported on syslog-ng 3.3.0beta2, so hopefully it is now more usable now in production. All fixes pushed to the git tree. I haven't received other issues, and I saw some success reports, so we're gearing towards a final release. I'd appreciate further testing though, but if nothing major shows up, I'm going to prepare 3.3.1 in the next couple of weeks. -- Bazsi

1 0

[PATCH] str-format: Fix month name parsing in BSD timestamps
by Gergely Nagy 04 Sep '11

04 Sep '11

When parsing the month name in scan_month_abbrev(), use memcmp() in all cases to compare only the first three chars. Using strcmp() will always result in us taking the false branch on well-formed timestamps, as it will scan past the 3-char length. Signed-off-by: Gergely Nagy <algernon(a)madhouse-project.org> --- lib/str-format.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/str-format.c b/lib/str-format.c index 6c974ba..9011461 100644 --- a/lib/str-format.c +++ b/lib/str-format.c @@ -200,19 +200,19 @@ scan_month_abbrev(const gchar **buf, gint *left, gint *mon) *mon = 7; break; case 'S': - if (strcmp(*buf, "Sep") == 0) + if (memcmp(*buf, "Sep", 3) == 0) *mon = 8; break; case 'O': - if (strcmp(*buf, "Oct") == 0) + if (memcmp(*buf, "Oct", 3) == 0) *mon = 9; break; case 'N': - if (strcmp(*buf, "Nov") == 0) + if (memcmp(*buf, "Nov",3 ) == 0) *mon = 10; break; case 'D': - if (strcmp(*buf, "Dec") == 0) + if (memcmp(*buf, "Dec", 3) == 0) *mon = 11; break; default: -- 1.7.5.4

2 2

Interesting issue with syslog-ng 3.3
by Gergely Nagy 03 Sep '11

03 Sep '11

Hi! While this mail might sound a bit vague, it will - if nothing else - serve as a reminder for me to investigate the issue furhter. On one of my servers (PowerPC, running Debian Squeeze), I have a syslog-ng 3.3 running, a reasonably recent (2-3 day old) git snapshot. It works quite well, except that I was able to trace back my server's recent hangs to syslog-ng: The server had a ~120 day uptime when I upgraded from 3.1 to 3.3, and since that time, it had to be rebooted two times already, just in two weeks time. Last time, I didn't have any open connections to it, so couldn't investigate, but tonight, I had an ssh session open with a screen session inside. So I tried to look around: first, I wanted to check the logs, but knew I wouldn't find anything, as it stopped sending the logs to my other server about two hours before I noticed the problem. Even worse, when I tried to sudo, that hung, indefinitely. Weird. There was nothing in dmesg, and nothing interesting in the logs it did send before becoming unresponsive. HTTP still worked too, as did a few other services. I could do nearly anything as a user. So I tried stracing crontab, and it hung when it tried to send logs to /dev/log. Interesting! I tried logger, same happens. I suspect that for one reason or the other, /dev/log got overwhelmed, and even worse, syslog-ng ended up trying to log something aswell, which made it hang too. And thus, the queue remained full, and everything that tried to log, got stuck. HTTP continued to work, since my httpd isn't using syslog for its logs. I could poke around in my shell, since that wasn't logging, either. This never happened with 3.1, and the only thing I changed in the config is the @version, pretty much. Thus, I suspect, there's some very nasty bug in 3.3beta2 that I haven't found yet. I'm leaving a root shell open this time, so that I can poke around further next time (along with a syslog-ng compiled with debug symbols). In the meantime, I thought I'll drop a note, hoping that perhaps Bazsi or someone from the syslog-ng devel team would have an idea where to look, and what to check next time this happens. -- |8]

5 6

Redirecting logs and UDP issues
by Aldrich, Jamie S 02 Sep '11

02 Sep '11

All, I am trying to redirect a log file from an NFS mount (AIX server = source and Redhat server = target). The redirect is going to a LogLogic device over UDP, and I am seeing quite a few dropped packets in /var/log/messages. Samples below: Aug 31 07:34:16 lxfwossecp3 syslog-ng[30574]: syslog-ng starting up; version='2.1.4' Aug 31 07:44:16 lxfwossecp3 syslog-ng[30574]: Log statistics; dropped='udp(10.13.33.11:514)=0', processed='center(queued)=15', processed='center(received)=15', processed='destination(d_messages)=11', processed='destination(d_boot)=0', pro cessed='destination(d_auth)=2', processed='destination(d_cron)=1', processed='destination(d_mlal)=0', processed='destination(d_kern)=0', processed='destination(d_mesg)=1', processed='destination(d_cons)=0', processed='destination(d_spol)= 0', processed='destination(d_mail)=0', processed='source(s_sys)=4', processed='source(s_file)=11', suppressed='udp(10.13.33.11:514)=0' Aug 31 07:54:16 lxfwossecp3 syslog-ng[30574]: Log statistics; dropped='udp(10.13.33.11:514)=0', processed='center(queued)=17', processed='center(received)=17', processed='destination(d_messages)=11', processed='destination(d_boot)=0', pro cessed='destination(d_auth)=2', processed='destination(d_cron)=2', processed='destination(d_mlal)=0', processed='destination(d_kern)=0', processed='destination(d_mesg)=2', processed='destination(d_cons)=0', processed='destination(d_spol)= 0', processed='destination(d_mail)=0', processed='source(s_sys)=6', processed='source(s_file)=11', suppressed='udp(10.13.33.11:514)=0' Aug 31 08:04:16 lxfwossecp3 syslog-ng[30574]: Log statistics; dropped='udp(10.13.33.11:514)=0', processed='center(queued)=20', processed='center(received)=20', processed='destination(d_messages)=11', processed='destination(d_boot)=0', pro cessed='destination(d_auth)=2', processed='destination(d_cron)=4', processed='destination(d_mlal)=0', processed='destination(d_kern)=0', processed='destination(d_mesg)=3', processed='destination(d_cons)=0', processed='destination(d_spol)= 0', processed='destination(d_mail)=0', processed='source(s_sys)=9', processed='source(s_file)=11', suppressed='udp(10.13.33.11:514)=0' Aug 31 08:14:16 lxfwossecp3 syslog-ng[30574]: Log statistics; dropped='udp(10.13.33.11:514)=0', processed='center(queued)=22', processed='center(received)=22', processed='destination(d_messages)=11', processed='destination(d_boot)=0', pro cessed='destination(d_auth)=2', processed='destination(d_cron)=5', processed='destination(d_mlal)=0', processed='destination(d_kern)=0', processed='destination(d_mesg)=4', processed='destination(d_cons)=0', processed='destination(d_spol)= 0', processed='destination(d_mail)=0', processed='source(s_sys)=11', processed='source(s_file)=11', suppressed='udp(10.13.33.11:514)=0' Aug 31 08:24:16 lxfwossecp3 syslog-ng[30574]: Log statistics; dropped='udp(10.13.33.11:514)=0', processed='center(queued)=28', processed='center(received)=28', processed='destination(d_messages)=11', processed='destination(d_boot)=0', pro cessed='destination(d_auth)=6', processed='destination(d_cron)=6', processed='destination(d_mlal)=0', processed='destination(d_kern)=0', processed='destination(d_mesg)=5', processed='destination(d_cons)=0', processed='destination(d_spol)= 0', processed='destination(d_mail)=0', processed='source(s_sys)=17', processed='source(s_file)=11', suppressed='udp(10.13.33.11:514)=0' Here is what my syslog-ng.conf file looks like: # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # options { time_reopen (10); flush_lines (2000); flush_timeout (20000); log_fifo_size (30000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); # udp(ip(0.0.0.0) port(514)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" sync(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_kern { file("/var/log/kern"); }; destination d_mlal { usertty("*"); }; filter f_kernel { facility(kern); }; filter f_default { level(info..emerg) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_auth { facility(authpriv); }; filter f_mail { facility(mail); }; filter f_emergency { level(emerg); }; filter f_news { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_boot { facility(local7); }; filter f_cron { facility(cron); }; #log { source(s_sys); filter(f_kernel); destination(d_cons); }; log { source(s_sys); filter(f_kernel); destination(d_kern); }; log { source(s_sys); filter(f_default); destination(d_mesg); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_mail); destination(d_mail); }; log { source(s_sys); filter(f_emergency); destination(d_mlal); }; log { source(s_sys); filter(f_news); destination(d_spol); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; log { source(s_sys); filter(f_cron); destination(d_cron); }; # vim:ft=syslog-ng:ai:si:ts=4:sw=4:et: # Setup for PeopleSoft logs to transmit to Loglogic source s_file { file("/tmp/APPSRV_current.LOG" flags(no-parse)); }; destination d_messages{ udp("10.13.33.11" port(514) log_fifo_size(900000000)); }; log { source(s_file); destination(d_messages); }; Does anyone see anything wrong with the setup? Could the NFS link be an issue? Any help would be greatly appreciated! Thanks, Jamie

2 3

[PATCH] afsocket: Compile against libsystemd-daemon, if present.
by Gergely Nagy 02 Sep '11

02 Sep '11

systemd v31+ comes with a libsystemd-daemon shared library. If systemd is enabled, try to detect this library, and use it if present. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- configure.in | 2 ++ modules/afsocket/Makefile.am | 12 ++++++++---- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/configure.in b/configure.in index 2685568..b6c95cf 100644 --- a/configure.in +++ b/configure.in @@ -895,6 +895,7 @@ if test "x$enable_systemd" = "xauto"; then fi if test "x$enable_systemd" = "xyes"; then + PKG_CHECK_MODULES(libsystemd_daemon, libsystemd-daemon >= 31,with_libsystemd="yes",with_libsystemd="no") if test "x$with_systemdsystemunitdir" = "xyes"; then # no arguments, just --with-systemdsystemunitdir systemdsystemunitdir=$($PKG_CONFIG --variable=systemdsystemunitdir systemd); @@ -1064,6 +1065,7 @@ AM_CONDITIONAL(ENABLE_SUN_STREAMS, [test "$enable_sun_streams" = "yes"]) AM_CONDITIONAL(ENABLE_PACCT, [test "$enable_pacct" = "yes"]) AM_CONDITIONAL(ENABLE_MONGODB, [test "$enable_mongodb" = "yes"]) AM_CONDITIONAL(ENABLE_JSON, [test "$enable_json" = "yes"]) +AM_CONDITIONAL(WITH_LIBSYSTEMD, [test "$with_libsystemd" = "yes"]) # substitution into manual pages expanded_sysconfdir=[`patheval $sysconfdir | sed -e 's/-/\\\\-/g'`] diff --git a/modules/afsocket/Makefile.am b/modules/afsocket/Makefile.am index 08ffc19..79f9c99 100644 --- a/modules/afsocket/Makefile.am +++ b/modules/afsocket/Makefile.am @@ -3,7 +3,11 @@ AM_CPPFLAGS = -I$(top_srcdir)/lib -I../../lib export top_srcdir if ENABLE_SYSTEMD +if WITH_LIBSYSTEMD +SYSTEMD_SOURCES = +else SYSTEMD_SOURCES = sd-daemon.c sd-daemon.h +endif else SYSTEMD_SOURCES = endif @@ -14,8 +18,8 @@ libafsocket_notls_la_SOURCES = \ afsocket.c afsocket.h afunix.c afunix.h afinet.c afinet.h \ afsocket-grammar.y afsocket-parser.c afsocket-parser.h afsocket-plugin.c \ $(SYSTEMD_SOURCES) -libafsocket_notls_la_CPPFLAGS = $(AM_CPPFLAGS) -libafsocket_notls_la_LIBADD = $(MODULE_DEPS_LIBS) $(LIBNET_LIBS) $(LIBWRAP_LIBS) +libafsocket_notls_la_CPPFLAGS = $(AM_CPPFLAGS) $(libsystemd_daemon_CFLAGS) +libafsocket_notls_la_LIBADD = $(MODULE_DEPS_LIBS) $(LIBNET_LIBS) $(LIBWRAP_LIBS) $(libsystemd_daemon_LIBS) libafsocket_notls_la_LDFLAGS = $(MODULE_LDFLAGS) if ENABLE_SSL @@ -24,8 +28,8 @@ libafsocket_tls_la_SOURCES = \ afsocket.c afsocket.h afunix.c afunix.h afinet.c afinet.h \ afsocket-grammar.y afsocket-parser.c afsocket-parser.h afsocket-plugin.c \ $(SYSTEMD_SOURCES) -libafsocket_tls_la_CPPFLAGS = $(AM_CPPFLAGS) -DENABLE_SSL=1 -libafsocket_tls_la_LIBADD = $(MODULE_DEPS_LIBS) ../../lib/libsyslog-ng-crypto.la $(OPENSSL_LIBS) $(ZLIB_LIBS) $(LIBNET_LIBS) $(LIBWRAP_LIBS) +libafsocket_tls_la_CPPFLAGS = $(AM_CPPFLAGS) $(libsystemd_daemon_CFLAGS) -DENABLE_SSL=1 +libafsocket_tls_la_LIBADD = $(MODULE_DEPS_LIBS) ../../lib/libsyslog-ng-crypto.la $(OPENSSL_LIBS) $(ZLIB_LIBS) $(LIBNET_LIBS) $(LIBWRAP_LIBS) $(libsystemd_daemon_LIBS) libafsocket_tls_la_LDFLAGS = $(MODULE_LDFLAGS) endif -- 1.7.5.4

2 1

[PATCH 0/2] Various stuff for easier packaging
by Gergely Nagy 02 Sep '11

02 Sep '11

Two patches will follow, that make it slightly easier to package syslog-ng and to build external modules against it. The first will change the SONAME of libsyslog-ng, from libsyslog-ng.so.0 to libsyslog-ng-${VERSION} (as of this writing, this would be libsyslog-ng-3.3.0beta2.so). The rationale behind this, is that at the moment, there are no guarantees that either ABI or API will be preserved between versions, so it's easier and more straightforward to tie the library to a particular syslog-ng version instead. The other patch adds moduledir to the pkg-config file, so that external modules can easily figure out where to install themselves, without resorting to guessing and parsing syslog-ng --help output (where syslog-ng might not even be available in the build chroot..).

2 3

[Bug 132] New: Timestamp issue with negative offset
by bugzilla＠bugzilla.balabit.com 02 Sep '11

02 Sep '11

https://bugzilla.balabit.com/show_bug.cgi?id=132 Summary: Timestamp issue with negative offset Product: syslog-ng Version: 3.2.x Platform: Other OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: mjrmedina(a)gmail.com Type of the Report: bug Estimated Hours: 0.0 Hi: I have syslog-ng 3.2.4 installed in Red Hat EL 6. My timezone is GMT-04:30 (Caracas,Venezuela) and I'm using ISO8601 timestamp format in syslog-ng. The timestamp format of the syslog-ng using my timezone is like follow: 2011-08-31T12:32:25-04:-30 2011-08-31T12:32:31-04:-30 See that before the "30" there is a second "-", because the first "-" is before "04". This issue is presented with all the negative time zones that has "30" in the minute offset (I test with Newfoundland,Canada too). Too I have tested this syslog-ng version in RHEL5 and the behaviour is the same. I think that this should be a kind of BUG. Rigth? Any workaround to handle this? Thanks in advanced... Mario -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 4