October 2012 - syslog-ng - lists.balabit.hu

[Bug 42] New: capabilities, chown, chmod
by bugzilla＠bugzilla.balabit.com 20 Dec '12

20 Dec '12

https://bugzilla.balabit.com/show_bug.cgi?id=42 Summary: capabilities, chown, chmod Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: zbyniu(a)pld-linux.org Type of the Report: bug Estimated Hours: 0.0 Let's take a look at syslog-ng-3.0.1/src/affile.c lines 60-83 1. CAP_SYS_ADMIN is needed only for /proc/kmsg, it is added w/o check 2. CAP_DAC_READ_SEARCH should be added only if open fail with errno 13 2a. CAP_DAC_OVERRIDE should be added only if open fail with errno 13 and with CAP_DAC_READ_SEARCH set 3. fchown needs CAP_CHOWN unconditionaly 4. fchmod needs CAP_FOWNER if file owner != euid (root here) 5. all caps should be restored summary: - CAP_SYS_ADMIN and CAP_DAC_OVERRIDE are set always even if unnecessary, and permanently - owner, group and perm doesn't work -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 10

syslog uses wrong and weird hostnames
by Daniel Neubacher 28 Nov '12

28 Nov '12

Hello there, My syslog-ng is logging fine from 700 servers but a few times per day it is logging into a wrong folder which is created by the $HOST variable. Normally syslog should use a hostname like host-1.worker.foobar.com but a few times a day it creates a folder names like: 4.22 p6-allrouter? p6-localnet p6-mc? p6-mcastpref p6-mcastpref? host-1.worker.foobar.xcom and other weird names... It only logs one or two lines and then uses the right folder again. Does anyone have a clue where I have to look for the problem? Here are the option line from the server and the client: Client: @version: 3.3 options { threaded(yes); use_dns(yes); use_fqdn(yes); dns_cache(yes); dns_cache_size(16384); dns_cache_expire(3600); dns_cache_expire_failed(10); log_msg_size(256000); log_fifo_size(100000); normalize_hostnames(yes); check_hostname(yes); bad_hostname("^gconfd$"); create_dirs(yes); owner("root"); group("root"); perm(0640); time_reopen(30); }; Server: options { threaded(yes); owner("root"); group("root"); perm(0660); dir_owner("root"); dir_group("root"); dir_perm(0770); create_dirs(yes); chain_hostnames(no); normalize_hostnames(yes); check_hostname(yes); keep_hostname(no); use_fqdn(yes); dns_cache(yes); dns_cache_size(16384); dns_cache_expire(3600); dns_cache_expire_failed(60); log_msg_size(256000); log_fifo_size(1000000); }; Destination example: destination d_syslog { file("/log/syslog/${R_YEAR}/${R_MONTH}/${R_DAY}/$HOST/$PROGRAM"); }; -- Daniel Neubacher, Network Administrator daniel.neubacher(a)xing.com<mailto:daniel.neubacher@xing.com> XING AG Gaensemarkt 43, 20354 Hamburg, Germany Tel. +49 40 419131-28, Fax +49 40 419131-11 Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 98807 Exec. Board (Vorstand): Dr. Stefan Groß-Selbeck (Vorsitzender), Dr. Thomas Vollmoeller, Ingo Chu, Dr. Helmut Becker, Jens Pape Chairman of the Supervisory Board (Aufsichtsratsvorsitzender): Dr. Neil Sunderland This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorised copying, disclosure or distribution of the material in this e-mail is strictly forbidden and may be unlawful.

2 3

RFC: syslog-parser
by Balazs Scheidler 22 Nov '12

22 Nov '12

Hi, I've figured it is not nice from me that I keep pushing stuff to "master" without getting proper review from the list. So here's a attempt to change that. I've just pushed an experimental patch to the "syslog-parser" branch on github that allows the syslog parsing functionality to be used as a syslog-ng parser: https://github.com/balabit/syslog-ng-3.4/tree/syslog-parser Here's a short description on why this is useful (quoting the commit message): This patch creates a new parser, to explicitly parse messages as syslog messages. This can be used to selectively parse these messages based on some filters. Imagine this use-case: log { source { udp(port(2000) flags(no-parse)); }; parser { log { junction { log { filter { netmask("127.0.0.1/32"); }; parser { syslog-parser(); }; flags(final); }; log { filter { netmask("127.0.0.2/32"); }; parser { csv-parser(columns("C1", "C2", "C3")); }; flags(final); }; }; }; }; destination { file("/home/bazsi/logs/qqq" template("$(format-json --key *)\n")); }; }; Messages from 127.0.0.1 will get parsed as syslog messages, while 127.0.0.2 as a csv-parser() style messages. I'd welcome any kind of feedback, code or functionality wise. I still have some stuff to fix in this, but after initial feedback I'm going to merge it to master. Thanks in advance. -- Bazsi

6 8

[Bug 205] New: Docs for macro MSGHDR incorrect
by bugzilla＠bugzilla.balabit.com 10 Nov '12

10 Nov '12

https://bugzilla.balabit.com/show_bug.cgi?id=205 Summary: Docs for macro MSGHDR incorrect Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 The docs state; MSGHDR Description: The name and the pid of the program that sent the log message in PROGRAM: PID format. Includes a trailing whitespace. Note that the macro returns an empty value if both the program and pid fields of the message are empty. When this macro is used the format is PROGRAM[PID]: including a trailing space. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[Bug 204] New: dbparser docs not clear for @NUMBER@
by bugzilla＠bugzilla.balabit.com 10 Nov '12

10 Nov '12

https://bugzilla.balabit.com/show_bug.cgi?id=204 Summary: dbparser docs not clear for @NUMBER@ Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: packaging AssignedTo: folti(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 the @NUMBER@ parser should state that a leading minus sign is handled for non-hex numbers and that commas are not permitted. Alternatively, making @NUMBER@ accept commas would be nice, or allowing parameters for additional characters, although comma would be the only one I could think of. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

syslog-ng 3.3.7 has been released
by devel＠balabit.hu 31 Oct '12

31 Oct '12

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.3.7 SUMMARY : new stable release DATE : Oct 30, 2012 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.3.7) has been released. For latest fixes in the 3.3.x feature branch you are recommended to upgrade to this version. CHANGES: 3.3.7 Wed, 31 Oct 2012 10:00:00 +0200 Highlights ========== This release is a bug-fix release, correcting a handful of issues discovered after the previous version was tagged. Bugfixes ======== * The bundled ivykis has been updated, fixing the following issues: * Fixed a Solaris-specific issue relating to TCP sources [#190] * Fixed a spinlock issue, triggered on at least FreeBSD [#193] * Workaround an issue with kqueue() on /dev/klog [#201] * The file source was corrected to properly handle character devices. This, and the ivykis update fixes a CPU spinning issue on FreeBSD. [#201] * The sun-streams module had a file descriptor leak, which has been corrected too. [#151] * The glob-based configuration file inclusion was fixed to behave similarly to including a whole directory, to include files alphabetically. [#191] The @include mechanism was also updated to not fail silently, but report an error in certain cases (such as permission errors, or missing files in case of an explicit, non-glob include). [#209] * Fixed a crash when trying to display the available modules in debug mode. [#189] * Fixed the building of afsocket-notls, so that it is correctly built without TLS support. [#188] * Fix compilation without spoof-source. [#192] * Avoid a feedback loop when emitting debug (and trace) messages. [#208] * Various minor fixes around the build system. Features ======== * The stats will now list the filename of unix domain sockets. [#195] Credits ======= syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Anton Koldaev <koldaevav(a)gmail.com> Attila Nagy <bra(a)fsn.hu> Balazs Scheidler <bazsi(a)balabit.hu> Cy Schubert <cy(a)FreeBSD.org> Dave Reisner <dreisner(a)archlinux.org> Evan Rempel <erempel(a)uvic.ca> Gergely Nagy <algernon(a)balabit.hu> Jose Pedro Oliveira <jpo(a)di.uminho.pt> Lennert Buytenhek <buytenh(a)wantstofly.org> Marvin Nipper <marvin.nipper(a)stream.com> Michael Hocke <michael.hocke(a)nyu.edu> Peter Czanik <czanik(a)balabit.hu> Tamas Pal <folti(a)balabit.hu> Yorick Peterse DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

3 2

[Bug 203] New: patterndb rule tag can not have a hyphen in the class attribute
by bugzilla＠bugzilla.balabit.com 28 Oct '12

28 Oct '12

https://bugzilla.balabit.com/show_bug.cgi?id=203 Summary: patterndb rule tag can not have a hyphen in the class attribute Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 Just seems odd that the rule tag can not have a hyphen in the class attribute. The error is element rule: Schemas validity error : Element 'rule', attribute 'class': [facet 'pattern'] The value 'sm-mta' is not accepted by the pattern '[a-zA-Z0-9_\.]+'. I would expect (and prefer) that the pattern should be '[a-zA-Z0-9_/\.+:-]' <ruleset name="sm-mta" id="RS-8e86ff39-2db4-48b6-bbe0-f980d9afebf0"> <pattern>sm-mta</pattern> <rules> <rule id="8e86ff39-2db4-48b6-bbe0-f980d9afebf0" class="sm-mta" provider="UVic"> <patterns> <pattern>whatever pattern</pattern> </patterns> </rule> </rules> </ruleset"> will reproduce this error. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

6 16

syslog-ng running help
by saeed salim 28 Oct '12

28 Oct '12

dear all, am new to the list and i want a help . i installed syslog-ng on ubuntu 11.10 when i run the application ,i got this error message ( Excess of number arguments ) any help? Thanks

3 7

[Bug 210] New: syslog-ng drops its capabilities before reading the config files
by bugzilla＠bugzilla.balabit.com 27 Oct '12

27 Oct '12

https://bugzilla.balabit.com/show_bug.cgi?id=210 Summary: syslog-ng drops its capabilities before reading the config files Product: syslog-ng Version: 3.3.x Platform: All OS/Version: All Status: ASSIGNED Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: algernon(a)balabit.hu ReportedBy: algernon(a)balabit.hu Type of the Report: --- Estimated Hours: 0.0 When reading config files, syslog-ng should be running with full capabilities (or at least enough to read root owned 0600 files), whether that happens during initial startup or on reload. (Via Yorick Peterse) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[Bug 209] New: @include can silently fail
by bugzilla＠bugzilla.balabit.com 27 Oct '12

27 Oct '12

https://bugzilla.balabit.com/show_bug.cgi?id=209 Summary: @include can silently fail Product: syslog-ng Version: 3.3.x Platform: All OS/Version: All Status: ASSIGNED Severity: major Priority: unspecified Component: syslog-ng AssignedTo: algernon(a)balabit.hu ReportedBy: algernon(a)balabit.hu Type of the Report: --- Estimated Hours: 0.0 With the glob-based @includes, we can silently ignore files that could not be opened, which can very well hide problems. Case in point: /etc/syslog-ng/conf.d/ with 0750 mode and a single file within it, syslog-ng.conf has @include "/etc/syslog-ng/conf.d/some-file.conf" In this case, we never see some-file.conf being tried, even though it is explicitly included (it still goes through the glob code), and glob() returns GLOB_NOMATCH, with errno set to EPERM. In this case, we should abort. An @include should only succeed if there was nothing to include (in case of a globby include), or if everything went well. That we can't read a file, is an error, and should be treated as such. (Via Yorick Peterse on twitter) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2