December 2012 - syslog-ng - lists.balabit.hu

mongodb and TTL collections
by Lucas, Sascha 28 Jan '13

28 Jan '13

Hi, Mongodb 2.2 has a new feature called TTL collections (expire data by setting a TTL). An analogy to the classic logrotate. One constraint is, that you index a field of date BSON type[1]. As far as I know, atm syslog-ng can only store strings? Or how can it be done to store one field as date? [1] http://docs.mongodb.org/manual/tutorial/expire-data/ TIA, Sascha. Vorsitzender des Aufsichtsrates: Ralf Hiltenkamp Geschäftsführung: Michael Krüger (Sprecher), Stephan Drescher Sitz der Gesellschaft: Halle/Saale Registergericht: Amtsgericht Stendal | Handelsregister-Nr. HRB 208414 UST-ID-Nr. DE 158253683 Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Empfänger sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail oder des Inhalts dieser Mail sind nicht gestattet. Diese Kommunikation per E-Mail ist nicht gegen den Zugriff durch Dritte geschützt. Die GISA GmbH haftet ausdrücklich nicht für den Inhalt und die Vollständigkeit von E-Mails und den gegebenenfalls daraus entstehenden Schaden. Sollte trotz der bestehenden Viren-Schutzprogramme durch diese E-Mail ein Virus in Ihr System gelangen, so haftet die GISA GmbH - soweit gesetzlich zulässig - nicht für die hieraus entstehenden Schäden.

2 6

[Bug 208] New: Memory leak when enabling debug logging
by bugzilla＠bugzilla.balabit.com 22 Jan '13

22 Jan '13

https://bugzilla.balabit.com/show_bug.cgi?id=208 Summary: Memory leak when enabling debug logging Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: koldaevav(a)gmail.com Type of the Report: bug Estimated Hours: 0.0 syslog-ng, all default configuration root@test-syslog-02:~# uname -a Linux test-syslog-02 2.6.32-44-server #98-Ubuntu SMP Mon Sep 24 17:41:33 UTC 2012 x86_64 GNU/Linux root@test-syslog-02:~# cat /etc/issue Ubuntu 10.04.4 LTS \n \l root@test-syslog-02:~# dpkg -l | grep syslog ii libsyslog-ng-3.3.6 3.3.6-1~mhp1~lucid Next generation system logging daemon (private librar ii libsyslog-ng-3.3.6.91 3.3.6.91-1~mhp1~lucid Next generation system logging daemon (private librar ii syslog-ng 3.3.6.91-1~mhp1 Next generation system logging daemon (metapackage) ii syslog-ng-core 3.3.6.91-1~mhp1~lucid Next generation system logging daemon (core) ii syslog-ng-mod-json 3.3.6.91-1~mhp1~lucid Next generation system logging daemon (JSON plugin) ii syslog-ng-mod-mongodb 3.3.6.91-1~mhp1~lucid Next generation system logging daemon (MongoDB plugin ii syslog-ng-mod-sql 3.3.6.91-1~mhp1~lucid Next generation system logging daemon (SQL plugin) root@test-syslog-02:~# syslog-ng-ctl debug --set=on && strace -f -c -p `pgrep -f '/usr/sbin/syslog-ng'` Process 30701 attached with 2 threads - interrupt to quit Process 30704 detached % time seconds usecs/call calls errors syscall ------ ----------- ----------- --------- --------- ---------------- 100.00 0.150000 16667 9 epoll_wait 0.00 0.000000 0 2 read 0.00 0.000000 0 5 write 0.00 0.000000 0 2 close 0.00 0.000000 0 22129 brk 0.00 0.000000 0 1 madvise 0.00 0.000000 0 1 accept 0.00 0.000000 0 1 setsockopt 0.00 0.000000 0 4 fcntl 0.00 0.000000 0 3 futex 0.00 0.000000 0 4 epoll_ctl ------ ----------- ----------- --------- --------- ---------------- 100.00 0.150000 22161 total It uses all available memory and swap, and being killed by oom_killer: Oct 26 13:44:24 test-syslog-02 kernel: : [107460.493074] Out of memory: kill process 30701 (syslog-ng) score 186140 or a child Oct 26 13:44:24 test-syslog-02 kernel: : [107460.648697] Killed process 30701 (syslog-ng) root@test-syslog-02:~# syslog-ng-ctl debug --set=on; strace -f -o ./syslog-ng.strace.log -p `pgrep -f '/usr/sbin/syslog-ng'` root@test-syslog-02:~# grep -v brk ./syslog-ng.strace.log 31364 epoll_wait(18, <unfinished ...> 31365 epoll_wait(21, <unfinished ...> 31365 <... epoll_wait resumed> {}, 1, 3194) = 0 31364 <... epoll_wait resumed> {}, 1, 3193) = 0 31365 epoll_ctl(21, EPOLL_CTL_DEL, 22, {0, {u32=3357993160, u64=139959162300616}} <unfinished ...> 31364 futex(0x7f4ac813fc20, FUTEX_WAIT_PRIVATE, 2, NULL <unfinished ...> 31365 <... epoll_ctl resumed> ) = 0 31365 close(22) = 0 31365 futex(0x7f4ac813fc20, FUTEX_WAKE_PRIVATE, 1) = 1 31364 <... futex resumed> ) = 0 31365 close(21 <unfinished ...> 31364 epoll_ctl(18, EPOLL_CTL_DEL, 19, {0, {u32=3357942664, u64=139959162250120}} <unfinished ...> 31365 <... close resumed> ) = 0 31364 <... epoll_ctl resumed> ) = 0 31365 write(6, "\1\0\0\0\0\0\0\0", 8 <unfinished ...> 31364 close(19 <unfinished ...> 31365 <... write resumed> ) = 8 31364 <... close resumed> ) = 0 31365 madvise(0x7f4ac1b9c000, 8359936, MADV_DONTNEED <unfinished ...> 31364 futex(0x7f4ac813fc20, FUTEX_WAKE_PRIVATE, 1 <unfinished ...> 31365 <... madvise resumed> ) = 0 31364 <... futex resumed> ) = 0 31365 _exit(0) = ? 31364 close(18) = 0 31364 write(6, "\1\0\0\0\0\0\0\0", 8) = 8 31364 madvise(0x7f4ac239d000, 8359936, MADV_DONTNEED) = 0 31364 _exit(0) = ? 31362 +++ killed by SIGKILL +++ I'll be happy to provide any additional info you need. I'm not able to debug my syslog-ng problems because if this bug. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 22

[Bug 198] New: debug-info fails to extract info from libsyslog-ng-crypto.so
by bugzilla＠bugzilla.balabit.com 18 Jan '13

18 Jan '13

https://bugzilla.balabit.com/show_bug.cgi?id=198 Summary: debug-info fails to extract info from libsyslog-ng- crypto.so Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: packaging AssignedTo: folti(a)balabit.hu ReportedBy: svensken(a)jla.rutgers.edu Type of the Report: bug Estimated Hours: 0.0 The syslog-ng package fails to build on Centos6 using mock with version 3.3.6 source code and a syslog-ng-3.2.5-3.el6 spec file. The problem seems to involve the debug info package, provided by rpm-4.8.0-27.el6.x86_64 and rpm-build-4.8.0-27.el6.x86_64 Seemingly, debug info cannot be extracted from libsyslog-ng-crypto.so, whether the .so or the 'debugedit' binary is doing something incorrectly. Here's the relevant part of the build log: --------- ... + /usr/lib/rpm/find-debuginfo.sh --strict-build-id /builddir/build/BUILD/syslog-ng-3.3.6 extracting debug info from /builddir/build/BUILDROOT/syslog-ng-3.3.6-2.ru6.x86_64/usr/bin/pdbtool extracting debug info from /builddir/build/BUILDROOT/syslog-ng-3.3.6-2.ru6.x86_64/usr/bin/loggen extracting debug info from /builddir/build/BUILDROOT/syslog-ng-3.3.6-2.ru6.x86_64/lib64/libsyslog-ng-3.3.6.so extracting debug info from /builddir/build/BUILDROOT/syslog-ng-3.3.6-2.ru6.x86_64/lib64/syslog-ng/libcsvparser.so extracting debug info from /builddir/build/BUILDROOT/syslog-ng-3.3.6-2.ru6.x86_64/lib64/syslog-ng/libdbparser.so extracting debug info from /builddir/build/BUILDROOT/syslog-ng-3.3.6-2.ru6.x86_64/lib64/syslog-ng/libsyslog-ng-crypto.so error: Bad exit status from /var/tmp/rpm-tmp.BZBLBe (%install) Bad exit status from /var/tmp/rpm-tmp.BZBLBe (%install) RPM build errors: Child returncode was: 1 ... --------- Throwing "%define debug_package %{nil}" into the spec will make the rpm build without errors. So it looks like the script "/usr/lib/rpm/find-debuginfo.sh" is failing to 'extract debug info' from "libsyslog-ng-crypto.so" The lack of an error message is no surprise; here's the function (inside find-debuginfo.sh) that's actually doing the debug info extraction: --------- 202 echo "extracting debug info from $f" 203 id=$(/usr/lib/rpm/debugedit -b "$RPM_BUILD_DIR" -d /usr/src/debug \ 204 -i -l "$SOURCEFILE" "$f") || exit 205 if [ -z "$id" ]; then 206 echo >&2 "*** ${strict_error}: No build ID note found in $f" 207 $strict && exit 2 208 fi --------- I tried modifying it, and found that the "exit" function is never even reached, since (as it turns out) /usr/lib/rpm/debugedit returns "Segmentation fault" when run on libsyslog-ng-crypto.so... Running /usr/lib/rpm/debugedit on the libraries that seem to be working (e.g. libcsvparser.so and libdbparser.so) without extra arguments returns no errors, however. I've found that the library itself, libsyslog-ng-crypto.so, seems to have a debug info format different from the other libraries' that succeeded in the build. As I understand it, the following command will display the debug info for a shared library: `readelf -w /path/to/library.so` It seems that the libcsvparser.so and libdbparser.so libraries both use an ".eh_frame section" to store their debug info, while libsyslog-ng-crypto.so seems to put its info into a ".debug_info section" (with hex line numbers of some sort), with an empty ".eh_frame section" section. I noticed that this crypto library was added fairly recently in the change logs, so perhaps it uses a newish format for its debug-info that is not yet supported by the debugedit binary, which is owned by rpm-build-4.8.0-27.el6.x86_64 Could there be a problem on my end, or is this an issue with the library itself? Could it be both? -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

Statistics summary
by Anton Koldaev 30 Dec '12

30 Dec '12

Is there a nice way to get total numbers of processed/stored/dropped messages in syslog-ng v3.3? >From docs: > The *center(received)* entry shows the total number of messages received from every configured sources. But in my stats center() shows zero almost for every host. I see zero in some other examples in docs too. -- Best regards, Koldaev Anton

3 7

SYSLOG-NG 3.4 exiting without any error print
by Deepak Gaur 28 Dec '12

28 Dec '12

Hello, I have cross-compiled syslog-ng for ARM target but it is exiting without showing any error code (on target). I am attaching strace output (syslog.txt). If anyone can help me out # syslog-ng -V syslog-ng 3.4.0alpha3 Installer-Version: 3.4.0alpha3 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.4#master#709ab1252920063e6d4d0d610ad5c1ee5ebdfb75 Compile-Date: Nov 27 2012 14:59:53 Available-Modules: syslogformat,afsocket-notls,afuser,basicfuncs,confgen,dbparser,tfuuid,afmongodb,afsocket-tls,afprog,afsocket,affile,csvparser Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-Linux-Caps: off Enable-Pcre: on ATTACHMENT syslog.txt

2 2

Re: [syslog-ng] syslog-ng 3.4.0beta1 has been released
by Evan Rempel 27 Dec '12

27 Dec '12

I thought that 3.4 was going to include - junctions so that results of multiple parsers could be combined - the ability to run a parser against a user defined macro rather than always parsing the complete MESSAGE marcro. Did these features fail to make it into 3.4 or is the documentation just missing these items? Thanks, -- Evan Rempel Senior Systems Administrator, Data Centre Services University of Victoria 250.721.7691

4 6

syslog-ng 3.3.6 make error on solaris 8
by Rakesh Rajasekharan 24 Dec '12

24 Dec '12

syslog-ng 3.3.6 on a Solaris 8 sparc machine gives the below error on the make stage.. I have used.. dynamic linking option... Undefined first referenced symbol in file __sync_lock_release ../../.libs/libivykis.a(iv_signal.o) __sync_lock_test_and_set ../../.libs/libivykis.a(iv_signal.o) Anyone faced a similar issue..? or if someone can help out please... Thanks, Rakesh..

2 2

syslog-ng 3.3.6 - AIX Issue
by Manimaran kk 23 Dec '12

23 Dec '12

I have compiled the syslog-ng version 3.3.6 on a AIX 5.3 . The compilation went through fine but when I try to run syslog-ng, i am getting following error. # ./syslog-ng Error opening plugin module; module='affile', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libaffile.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Error opening plugin module; module='afprog', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libafprog.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Plugin module not found in 'module-path'; module-path='/opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng', module='afsocket' Error opening plugin module; module='afuser', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libafuser.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Error opening plugin module; module='basicfuncs', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libbasicfuncs.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Error opening plugin module; module='csvparser', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libcsvparser.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Error opening plugin module; module='dbparser', error='rtld: 0712-001 Symbol __iv_now_location was referenced\x0a from module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libdbparser.so(), but a runtime definition\x0a of the symbol was not found.' Error opening plugin module; module='syslogformat', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libsyslogformat.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Error opening plugin module; module='syslogformat', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libsyslogformat.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Error opening plugin module; module='basicfuncs', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libbasicfuncs.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Plugin module not found in 'module-path'; module-path='/opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng', module='afsocket' Error opening plugin module; module='affile', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libaffile.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Error opening plugin module; module='afprog', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libafprog.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Error opening plugin module; module='afuser', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libafuser.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Error opening plugin module; module='dbparser', error='rtld: 0712-001 Symbol __iv_now_location was referenced\x0a from module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libdbparser.so(), but a runtime definition\x0a of the symbol was not found.' Error opening plugin module; module='csvparser', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libcsvparser.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Error opening plugin module; module='confgen', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libconfgen.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Error opening plugin module; module='confgen', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libconfgen.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Error parsing source, source plugin system not found in /opt/soe/local/syslog-ng-3.3.6/etc/syslog-ng.conf at line 10, column 2: system(); ^^^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng # Compiler Option ------------------------------------- syslog-ng Open Source Edition 3.3.6 configured Compiler options: compiler : gcc -std=gnu99 compiler options : -g -O2 -Wall -pthread -D_LARGE_FILES=1 -pthread -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/opt/soe/local/syslog-ng-3.3.6/eventlog/include/eventlog -I$(top_srcdir)/lib/ivykis/lib/include -I$(top_builddir)/lib/ivykis/lib/include -I$(top_srcdir)/lib/ivykis/modules/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -L/opt/soe/local/syslog-ng-3.3.6/lib -L/usr/local/lib -L/usr/ccs/lib -L/usr/lib -lpthread -Wl,-brtl prefix : /opt/soe/local/syslog-ng-3.3.6 linking mode : dynamic __thread keyword : yes Submodules: ivykis : internal libmongo-client : internal Features: Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : yes spoof-source support : no tcp-wrapper support : no Linux capability support : no PCRE support : no Env wrapper support : yes systemd support : no (unit dir: none) Modules: Module search path : /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng Default module list : affile,afprog,afsocket,afuser,basicfuncs,csvparser,dbparser,syslogformat Sun STREAMS support (module): no SSL support (module) : no SQL support (module) : no PACCT module (EXPERIMENTAL) : no MongoDB destination (module): yes JSON support (module) : no (using no) Could any one assist please.

2 2

[Bug 212] New: strange hostnames from /etc/hosts with threaded(yes);
by bugzilla＠bugzilla.balabit.com 21 Dec '12

21 Dec '12

https://bugzilla.balabit.com/show_bug.cgi?id=212 Summary: strange hostnames from /etc/hosts with threaded(yes); Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bpkroth(a)gmail.com Type of the Report: --- Estimated Hours: 0.0 Created an attachment (id=67) --> (https://bugzilla.balabit.com/attachment.cgi?id=67) syslog-ng.conf Hi, I've backported syslog-ng 3.3.5 for Debian squeeze in order to get the threaded feature for our main syslog server, but I've found that with threaded(yes) and sending logs to directories byhost ($FROM_FULLHOST) set, then I get a few directories that are actually weird mashups from entries in /etc/hosts (eg: fqdn{tab}shortname{newline}, where {tab} is an actual tab character, similarly for newlines). As an example: 13 lager.$domain lager loghost 2.208 ldap1.$domain ldap1 Here, 13 and 2.208 are the last part of the IP listing for that host, but the rest is missing. This seems similar to Bug #183, except that I'm not getting segfaults, just goofy log file names and directory names, which in turn causes some other problems on our end. For now, I've disabled threaded (and was happy to find that the CPU load on the machine is still quite reduced, so good work on whatever other scalability improvements you've done - epoll?), but I'd like to take advantage of the slew of cores the machine has. use_dns(yes) and dns_cache(yes) are set, but it doesn't use a persistent file, but rather the system resolver is set to 127.0.0.1 and there's a local bind named slave running (which has all of the necessary reverse lookup information). Attached is my full conf file. Please let me know if you need anymore info. Thanks, Brian -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 19

syslog-ng 3.4.0beta1 has been released
by devel＠balabit.hu 20 Dec '12

20 Dec '12

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.4.0beta1 SUMMARY : new stable release DATE : Dec 15, 2012 ------------------------------------------------------------------------------ DESCRIPTION: A new version of syslog-ng Open Source Edition (3.4.0beta1) has been released. For latest fixes in the 3.4.x feature branch you are recommended to upgrade to this version. CHANGES: 3.4.0beta1 Sat, 15 Dec 2012 02:21:14 +0100 Features: ========= * Added support for the amqp() destination driver, which sends messages to an AMQP queue. * Added support for a new parser named syslog-parser() that can invoke the RFC3164 and RFC5424 parser outside the source driver that received the message. Delaying the syslog parsing can be advantageous in case some preprocessing or filtering needs to take place before the actual syslog parsing. * Added support for dot notation in the $(format-json) template function. * Changed the MongoDB driver to use inserts instead of upserts. * Added support for UNIX domain sockets in the MongoDB driver by using the new path() option. * Added new template functions to perform various cryptographic hash functions on data, like: $(md5), $(md4), $(sha1), $(sha256), $(sha512) * Added a couple of new parsers to db-parser() pattern format: * @PCRE@: use this to parse using a regexp * @EMAIL@: to parse email addresses * @HOSTNAME@: to parse host names * @LLADDR@: to parse link-level addresses, like ethernet MAC addresses * Added the possibility to set TCP keepalive options for TCP based transports: tcp-keepalive-time(), tcp-keepalive-probes(), tcp-keepalive-intvl(). Also added the tcp-keepalive() option as an alias to the earlier so-keepalive() parameter. TCP keepalive became enabled by default. Bugfixes: ========= * Updated with the bugfixes from v3.3.7 * Fixed SQL statement formatting used to create indexes on Oracle. The original query contained an apostrophe when specifying the column name. * Fixed an incorrect validation in the file() source, which caused the entire file to be resent in case syslog-ng was restarted and an encoding() is specified. * Increased the performance when following files with the encoding() option set. Previously, the code to check if the source encoding is fixed size was incorrect, which in turn caused syslog-ng to excercise its slow path when processing these files, instead of a faster alternative. * Fixed a memory leak issue when encoding() is used for file sources and syslog-ng was reloaded. * Fixed a bug in processing the encoding() option for udp() sources. syslog-ng incorrectly propagated the character decoding state from one frame to the next, which might have originated from different senders. * Infinite feedback loops of internal messages triggering another set of internal messages are now detected and suppressed. Earlier it was not safe to enable debug/trace messages during runtime, now it is. * Fixed a race condition in resolving IP address to hostnames, which might have caused garbage in the hostname part of messages. This is most likely mitigated by the DNS cache. Other changes: ============== * Added unit test coverage for various log transport implementations. * Reorganized the LogProto code to support plugins, the transport() option for the syslog() and network() drivers can be used to specify a transport protocol plugin. Credits: ======== syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Attila Nagy <bra(a)fsn.hu> Balazs Scheidler <bazsi(a)balabit.hu> Balint Kovacs <blint(a)balabit.hu> Brian Kroth <bpkroth(a)gmail.com> Conrad Hoffmann <ch(a)bitfehler.net> Csaba Major <csaba.major(a)balabit.com> Cy Schubert <cy(a)FreeBSD.org> Eun Kyung <ekyung01(a)googlemail.com> Evan Rempel <erempel(a)uvic.ca> Gergely Nagy <algernon(a)balabit.hu> Jose Oliveira <jpo(a)di.uminho.pt> Juhasz Viktor <jviktor(a)balabit.hu> Marvin Nipper <marvin.nipper(a)stream.com> Michael Hocke <michael.hocke(a)nyu.edu> Peter Czanik <czanik(a)balabit.hu> Peter Gyongyosi <gyp(a)balabit.hu> Sandor Geller <wildy(a)muhelybt.hu> Sergey <cloun-rulez(a)yandex.ru> shih dane <daneshih1125(a)gmail.com> Tamas Pal <folti(a)balabit.hu> Viktor Juhasz <jviktor(a)balabit.hu> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

2 2