December 2012 - syslog-ng - lists.balabit.hu

[Bug 211] New: dbparser pattern order breaks validation
by bugzilla＠bugzilla.balabit.com 29 May '14

29 May '14

https://bugzilla.balabit.com/show_bug.cgi?id=211 Summary: dbparser pattern order breaks validation Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 If two log lines share a common leading portion such as; xlog: backup pg_xlog/000000010000014700000076 xlog: backup pg_xlog/000000010000014700000076 failed then the order of the patterns in the pattern database xml file is important. For example, if the two patterns used are; xlog: backup pg_xlog/@SET:xid:0123456789ABCDEF@ xlog: backup pg_xlog/@SET:xid:0123456789ABCDEF@ failed and the shorter pattern is first, it will match BOTH of the above lines because it matches the leading portion of both lines. If the patterns are entered with the longer pattern first, then the longer pattern will fail on the shorter message, allowing the match to fall through to the shorter pattern matcher, but will match the longer message. I expect the behavior of the dbparser to match with the pattern containing the MOST total static content that also matches all of the parsing macros. Some method where the order is not important need to be used. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

[Bug 186] New: resettable stats
by bugzilla＠bugzilla.balabit.com 21 Dec '13

21 Dec '13

https://bugzilla.balabit.com/show_bug.cgi?id=186 Summary: resettable stats Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: szaki(a)balabit.hu Type of the Report: --- Estimated Hours: 0.0 According to https://lists.balabit.hu/pipermail/syslog-ng/2011-October/017457.html It would be a good idea to be able to reset the statistic, when needed, without full restart, or any magic like altering the config a bit and reload. So I suggest the enable_stats_reset(yes) default option, for sources and destinations (everywhere are statcounters defined), and the syslog-ng-ctl reset-stats command - to reset the statistic where the enable_stats_reset(yes) option allows this. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

Output to file in /proc
by Valentijn Sessink 13 Dec '13

13 Dec '13

Hello list, As most of the functionality of "sshguard", "fail2ban" and others is in syslog-ng, I'm trying to use syslog-ng to add entries to my Linux kernel based firewall (iptables). I'm almost ready to implement one, but I have a question about undeliverable log lines: what happens if a certain file() destination blocks? Will syslog-ng retry to deliver the same message, or will it lose the message? What I'm doing is using the "ipt_recent" module; with this module, one can check if a certain IP address was seen before. For example, the following rule will block you if you were seen 5 or more times ("hitcount 5") in the "violators" list last minute ("seconds 60): iptables -A INPUT -m recent \ --rcheck --hitcount 5 --seconds 60 --name violators -j DROP The fun part is, that you can add IP adresses by stuffing them into a file in /proc: echo '+127.0.0.1' > /proc/net/xt_recent/violators ... will add 127.0.0.1 to the "violators" with the current time. However: echo 'whatever' > /proc/net/xt_recent/violators ... gives an error: Invalid argument (22) As far as I can see, syslog-ng will not try again to deliver the same message; but is this by design? I.e. can I trust syslog-ng to not "block" because of a single malformed IP address? Because then, an implementation of sshguard could be simply swapped with a simple: destination df_ipt_recent { file ("/proc/net/xt_recent/blocker" template("+${usracct.device}\n") ); }; filter f_ipt_recent { tags("secevt") and match("REJECT" value("secevt.verdict")); }; log { source (s_all); parser(pattern_db); filter(f_addtofirewall);destination(df_addtofirewall);}; ... which would be cool! Best regards, Valentijn

6 26

[Bug 169] New: Feature Request - reconnect network also resolve dns name
by bugzilla＠bugzilla.balabit.com 10 Oct '13

10 Oct '13

https://bugzilla.balabit.com/show_bug.cgi?id=169 Summary: Feature Request - reconnect network also resolve dns name Product: syslog-ng Version: 3.3.x Platform: Other OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 When a network connection is dropped the destination name should be resolved via DNS prior to the reconnect. Every couple of years to renew the hardware supporting our core syslog service we move the IP name to a new host. The desired process is; 1. Build a new host and ensure that syslog-ng is running correctly. 2. Change the DNS for our central syslog server to the address of the new server. 3. Restart the syslog-ng service on the old syslog server. 4. All of the clients will loose the connection to the old syslog server. 5. All of the clients will reconnect to the *IP Name* in their configuration files. 6. Monitor the old syslog server to determine any hosts that have not made the transition. What really happened in step 5 was that all of the client reconnected to the old syslog server :-( To accomplish the switch over I had to visit 450 servers and manually restart the syslog service on the client. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

[Bug 155] New: Compilation failure in 3.3.3: the Darwin linker does not accept "--whole-archive"
by bugzilla＠bugzilla.balabit.com 26 Aug '13

26 Aug '13

https://bugzilla.balabit.com/show_bug.cgi?id=155 Summary: Compilation failure in 3.3.3: the Darwin linker does not accept "--whole-archive" Product: syslog-ng Version: 3.3.x Platform: Macintosh OS/Version: Mac OS Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jacknagel(a)gmail.com Type of the Report: bug Estimated Hours: 0.0 Trying to compile 3.3.3 on Mac OS X 10.6.8/XCode 4.2, I get this: libtool: link: /usr/bin/llvm-gcc -std=gnu99 -dynamiclib -o .libs/libsyslog-ng-3.3.3.dylib [...] ld: unknown option: --whole-archive collect2: ld returned 1 exit status some cursory googling reveals that the Darwin linker does not accept "--whole-archive". I'd be happy to help test a patch. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 11

[Bug 173] New: Compile issues with syslog-ng_3.3.4.tar.gz
by bugzilla＠bugzilla.balabit.com 26 Aug '13

26 Aug '13

https://bugzilla.balabit.com/show_bug.cgi?id=173 Summary: Compile issues with syslog-ng_3.3.4.tar.gz Product: syslog-ng Version: 3.3.x Platform: Other OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: mark.ulmer(a)apollogrp.edu Type of the Report: bug Estimated Hours: 0.0 Bazsi, I've been working to get a version of 3.3.x compiled on our RHEL 5.6 server for quite some time. I finally have found part of what I think is an issue that might need to be resolved on my side. I don't know. So the latest eventlog-0.2.12 compiles, makes and installs fine. Then in compiling syslog-ng-3.3.4 I get the following error: checking sanity checking Glib headers... no configure: error: Glib headers inconsistent with current compiler setting. You might be using 32 bit Glib with a 64 bit compiler, check PKG_CONFIG_PATH I see in the config.log it's looing for include files in /usr/include/glib-2.0/glib-2.0. The path on my server only has one level glib-2.0. I've tried work arounds and this still gets replicated to lower modules with the same duplicated path level. Go you have a suggestion for me to get past this? Thanks in advance for your assistance. Mark Ulmer Phoenix, AZ, USA -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

4 9

syslog-ng 3.3.6 Hangs on Solaris 8 sparc
by Rakesh Rajasekharan 02 May '13

02 May '13

Hi All, I have compiled the syslog-ng version 3.3.6 on a Solaris Sparc machine . The compilation went through fine but when I try to run syslog-ng .. though the daemon gets running somehow the unix prompt is not returned.. and it hangs... For ex:- # ps -ef|grep -i syslog root 14073 11758 0 07:11:37 pts/4 0:00 vi syslog-ng.d root 14097 13526 0 07:15:48 pts/1 0:00 grep -i syslog Now if I start the daemon using the below options... # /opt/soe/local/syslog-ng-3.3.6/sbin/syslog-ng -f /opt/soe/local/syslog_ng/etc/syslog-ng/syslog-ng.conf -p /var/run/syslog-ng.pid I never get back the prompt.. but if on another window I check.. the daemon has started.. ps -ef|grep -i syslog root 14099 11758 0 07:16:17 pts/4 0:00 grep -i syslog root 14098 13526 23 07:16:04 pts/1 0:13 /opt/soe/local/syslog-ng-3.3.6/sbin/syslog-ng -f /opt/soe/local/syslog_ng/etc/s though I guess... i should expect one more child to this... can someone please help me address this issue please... Thanks, Rkaesh.

3 10

[Bug 172] New: tcp() destination driver ignores ts_format() parameter
by bugzilla＠bugzilla.balabit.com 13 Feb '13

13 Feb '13

https://bugzilla.balabit.com/show_bug.cgi?id=172 Summary: tcp() destination driver ignores ts_format() parameter Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: chiestand(a)salk.edu Type of the Report: bug Estimated Hours: 0.0 The documentation (http://www.balabit.com/sites/default/files/syslog-ng-ose-v3.3-guide-admin-e…) states that you may use the ts_format() paramater to modify the timestamp format. However this parameter does not work, rfc3164 format seems to be used no matter what you specify in ts_format(). So either the documentation is wrong or there is a bug. I am running 3.3.4 on Debian Wheezy. I also had the problem running 3.1 in Debian Squeeze. my driver: destination My_Syslog { tcp("syslog.server.salk.edu" port(514) ts_format(iso) ); }; log { source(s_src); destination(My_Syslog); }; tcpdump: @.m..<hw<86>Apr 6 01:24:01 host CRON[1923]: pam_unix(cron:session): session closed for user root I emailed the mailing list on this issue, the thread can be viewed here: https://lists.balabit.hu/pipermail/syslog-ng/2012-April/018638.html -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

[Bug 214] New: Build / Install Issues on AIX
by bugzilla＠bugzilla.balabit.com 08 Feb '13

08 Feb '13

https://bugzilla.balabit.com/show_bug.cgi?id=214 Summary: Build / Install Issues on AIX Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: AIX Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: blentz(a)cswg.com Type of the Report: --- Estimated Hours: 0.0 More fun for the AIX platform; Using version 3.3.7, GNU Make and GCC 4.2.0 However lib/syslog-ng/libafsocket.so is installed it is installed in such a way that the dependency for libsyslog-ng-crypto.a cannot be found. Seems like some kind of libtool problem. $ ldd /opt/local/syslogng/lib/syslog-ng/libafsocket.so /opt/local/syslogng/lib/syslog-ng/libafsocket.so needs: Cannot find libsyslog-ng-crypto.a(libsyslog-ng-crypto.so) /opt/local/syslogng/lib/libssl.so /opt/local/syslogng/lib/libcrypto.so /opt/local/syslogng/lib/libglib-2.0.a(libglib-2.0.so.0) /opt/local/syslogng/lib/libevtlog.a(libevtlog.so.0) /opt/local/syslogng/lib/libsyslog-ng.a(libsyslog-ng-3.3.7.so) /usr/lib/libc.a(shr.o) /usr/lib/librtl.a(shr.o) /opt/local/syslogng/lib/libgcc_s.a(shr.o) /usr/lib/libpthreads.a(shr_xpg5.o) /usr/lib/libiconv.a(shr4.o) /usr/lib/libpthread.a(shr_comm.o) /usr/lib/libpthread.a(shr_xpg5.o) /opt/local/syslogng/lib/libintl.a(libintl.so.8) /opt/local/syslogng/lib/libgmodule-2.0.a(libgmodule-2.0.so.0) /opt/local/syslogng/lib/libgthread-2.0.a(libgthread-2.0.so.0) /opt/local/syslogng/lib/libivykis.a(libivykis.so.0) /unix /usr/lib/libcrypt.a(shr.o) /usr/lib/libpthreads.a(shr_comm.o) /usr/lib/libthread.a(shr.o) Also, be aware that shared libraries on AIX use the .a suffix, not .so. Out of the box shared libraries are archived into .a files. $ ar tv /opt/local/syslogng/lib/syslog-ng/libafsocket.a rwxr-xr-x 0/0 572423 Dec 19 20:23 2012 libafsocket-tls.so The default "make install" process leaves nothing but *.a files in lib/syslog-ng and on startup the user is greeted with many errors about missing loadable modules. The RPM that Perzl makes gets around this by running ar -X32 -x'ing all of these .a files so the system is populated with both .a and .so versions of the files. ( cd ${RPM_BUILD_ROOT}%{_libdir} for f in *.a ; do /usr/bin/ar -X32 -x ${f} done cd ${RPM_BUILD_ROOT}%{_libdir}/%{name} for f in *.a ; do /usr/bin/ar -X32 -x ${f} done ) Can this be fixed? -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 18

[Bug 121] New: After service syslog-ng reload, the first log don' t transfer to remote servicer via TLS
by bugzilla＠bugzilla.balabit.com 08 Feb '13

08 Feb '13

https://bugzilla.balabit.com/show_bug.cgi?id=121 Summary: After service syslog-ng reload, the first log don't transfer to remote servicer via TLS Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: critical Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: yong.zheng(a)nsn.com Type of the Report: bug Estimated Hours: 0.0 The version:syslog-ng 3.0.5 options { flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); stats_freq (3600); }; I will upload the logs to remote syslog-ng server via TLS, I encounter a issue, On client: after reload the configure via below command: #service syslog-ng reload. I write a log: #logger -p local1.info "this is test" but I don't see the log to transfer to server immediately, I wait many minutes, still don't see. I must write the second log to triger that client send the 2 logs to server #logger -p local1.info "this is test 2" the 2 logs have transfered to server immediately successfully, I can see the 2 logs on server. It is 100% reproduced. Is this a known issue, or not ? Thanks. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6