April 2012 - syslog-ng - lists.balabit.hu

[Bug 168] New: Solaris 10 make failure after successful configure
by bugzilla＠bugzilla.balabit.com 02 Jul '12

02 Jul '12

https://bugzilla.balabit.com/show_bug.cgi?id=168 Summary: Solaris 10 make failure after successful configure Product: syslog-ng Version: 3.3.x Platform: Other OS/Version: Solaris Status: NEW Severity: blocker Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: david.j.fenske(a)usps.gov Type of the Report: bug Estimated Hours: 0.0 1. Download, gunzip, and de-tar syslog-ng-3.3.4 2. PKG_CONFIG_PATH=/usr/local/lib/pkgconfig 3. LD_LIBRARY_PATH=/usr/local/lib 4. ./configure 5. make make all-recursive Making all in lib make: Fatal error in reader: Makefile, line 993: Unexpected end of line seen Current working directory /djftools/syslog/source/syslog-ng-3.3.4/lib *** Error code 1 The following command caused the error: fail= failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='lib modules syslog-ng scripts tests doc contrib scl debian tgz2build build'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (CDPATH="${ZSH_VERSION+.}:" && cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /djftools/syslog/source/syslog-ng-3.3.4 *** Error code 1 make: Fatal error: Command failed for target `all' -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 10

[Bug 159] New: on signal HUP program destinations are not closed
by bugzilla＠bugzilla.balabit.com 26 Jun '12

26 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=159 Summary: on signal HUP program destinations are not closed Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 In previous versions of syslog-ng, when a HUP signal was sent to syslog-ng it would close all of its destinations and reopen them. In version 3.3.4 (perhaps earlier ones) the destination to programs is not closed, but a new one is opened. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 12

[Bug 176] New: iv_event_raw module doesn't work on mips64el n32, missing include
by bugzilla＠bugzilla.balabit.com 05 Jun '12

05 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=176 Summary: iv_event_raw module doesn't work on mips64el n32, missing include Product: syslog-ng Version: 3.3.x Platform: Other OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: mads(a)ab3.no Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=57) --> (https://bugzilla.balabit.com/attachment.cgi?id=57) iv_event_raw.c patch, missing include I have a Lemote Fuloong 2F mips64el (n32) machine running Gentoo, the uname looks like this: Linux Lemote 3.3.0 #5 PREEMPT Wed Apr 18 13:25:19 CEST 2012 mips64 ICT Loongson-2 V0.3 FPU V0.1 lemote-fuloong-2f-box GNU/Linux This machine doesn't get updated that often, so I didn't discover that syslog-ng didn't work before I updated syslog-ng to version 3.3.4 and then later 3.3.5 recently. Tested with glibc 2.14 and 2.15. Running syslog-ng -d: eventfd2: Invalid argument Trying to open module; module='affile', filename='/usr/lib32/syslog-ng/libaffile.so' Trying to open module; module='afprog', filename='/usr/lib32/syslog-ng/libafprog.so' Trying to open module; module='afsocket', filename='/usr/lib32/syslog-ng/libafsocket.so' Trying to open module; module='afuser', filename='/usr/lib32/syslog-ng/libafuser.so' Trying to open module; module='basicfuncs', filename='/usr/lib32/syslog-ng/libbasicfuncs.so' Trying to open module; module='csvparser', filename='/usr/lib32/syslog-ng/libcsvparser.so' Trying to open module; module='dbparser', filename='/usr/lib32/syslog-ng/libdbparser.so' Trying to open module; module='syslogformat', filename='/usr/lib32/syslog-ng/libsyslogformat.so' Running application hooks; hook='1' Running application hooks; hook='3' syslog-ng starting up; version='3.3.5' eventfd2: Invalid argument eventfd2: Invalid argument eventfd2: Invalid argument eventfd2: Invalid argument eventfd2: Invalid argument Segmentation fault I checked the file lib/ivykis/modules/iv_event_raw.c as it was the only file calling the eventfd2 syscall, and I noticed that it defines EFD_NONBLOCK and EFD_CLOEXEC if it's not already defined by the includes. I then noticed the values existed in <sys/eventfd.h>, and that the values in that file were other values that the ones defined in iv_event_raw.c. So I just included <sys/eventfd.h>, and that fixed the problem. Attaching a patch fixing the problem for me. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 8

[Bug 157] New: syslog-ng 3.2.x/3.3.x: test_sql.py and 64-bit systems
by bugzilla＠bugzilla.balabit.com 01 Jun '12

01 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=157 Summary: syslog-ng 3.2.x/3.3.x: test_sql.py and 64-bit systems Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Mac OS Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jpo(a)di.uminho.pt Type of the Report: --- Estimated Hours: 0.0 Created an attachment (id=45) --> (https://bugzilla.balabit.com/attachment.cgi?id=45) Add '/usr/lib64/dbd/' to the search paths Hi, In 64-bits systems we need to add lib64 directories to the libdbi/libdbdsqlite3 module search path in order to successfully run the test_sql functional test. Location of libdbdsqlite3.so in 64-bit Fedora/RHEL: ---------- $ rpm -ql libdbi-dbd-sqlite /usr/lib64/dbd/libdbdsqlite3.so ---------- Affected syslog-ng versions: At least the 3.2 and 3.3 branches (I haven't check the 3.4 development branch). Fix: The attached patch adds the '/usr/lib64/dbd/' directory to the search path. Adding '/usr/local/lib64/dbd' should also make sense (but it is not done by the attached patch). /jpo -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

[Bug 143] New: syslog-ng supervisor dies on SIGHUP
by bugzilla＠bugzilla.balabit.com 31 May '12

31 May '12

https://bugzilla.balabit.com/show_bug.cgi?id=143 Summary: syslog-ng supervisor dies on SIGHUP Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.syslogng(a)feystorm.net Type of the Report: --- Estimated Hours: 0.0 The process which supervises syslog-ng and restarts it in the event of a crash dies when it receives a SIGHUP. This is a problem as when sending a HUP to syslog-ng to have it reload its config, the HUP will get sent to both the supervisor process and the worker process if doing something like `pkill -HUP syslog-ng`. I attached a gdb to the supervisor and its not a segfault or anything, it just quits. I'm guessing the supervisor doesnt have a signal handler for HUP, so it uses the default action which is to quit. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

[Bug 175] New: syslog-ng doesnt perform fsync() with fsync option enabled on file destinations
by bugzilla＠bugzilla.balabit.com 31 May '12

31 May '12

https://bugzilla.balabit.com/show_bug.cgi?id=175 Summary: syslog-ng doesnt perform fsync() with fsync option enabled on file destinations Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.syslogng(a)feystorm.net Type of the Report: --- Estimated Hours: 0.0 While trying to track down an issue on our production system where our box would experience hanging issues every 30 seconds, I discovered this was because syslog-ng wasnt flushing its data, and so when the linux pdflush woke up, it would flush out a ton of data to NFS causing syslog and other applications to hang until the flush completed. Ultimately this was causing messages to be dropped as input buffers were filling up while syslog-ng was hung. This shouldnt have been happening as I have syslog-ng configured with the flush option enabled on the file destination which writes to NFS. I have a workaround in place by forcing pdflush to run more frequently, and have also increased several of the input buffers so they dont fill up so fast. I confirmed this issue by building syslog-ng-3.3.5 and putting a gdb break point on lib/logtransport.c:170, and the break point never triggers. I do have a question about the fsync option as well. Does this option tell syslog-ng to flush() after every write, or after all lines have been written (like from the flush_lines or flush_timeout() options)? If it flushes after every write, would it be possible to get an option to flush only once all the messages in the batch have been written? This is the stripped down configuration I have duplicated the issue with: @version: 3.3 options { keep_hostname(yes); chain_hostnames(no); normalize_hostnames(yes); use_dns(no); use_fqdn(yes); stats_freq(0); mark_freq(0); create_dirs(yes); dir_perm(0755); perm(0644); }; source s_sys { unix-dgram("/dev/log" max-connections(256)); internal(); file("/proc/kmsg"); }; destination d_default { file("/var/log/$FACILITY" flush_lines(1) fsync(yes)); }; log { source(s_sys); destination(d_default); flags(fallback); }; -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 7

Problem with Syslog-NG 3.2.5 on Aix 7.1 ... It coredumps..
by Jonathan Kaufman 16 May '12

16 May '12

Hello All, I am hoping someone out there has a working installation of 3.2.5 on Aix 7.1 and can help me get mine working. I am currently trying to use a self-compiled version of 3.2.5 on an Power7 CPU Aix 7.1 TL1 SP3 box. I was able to get Syslog-NG to compile on Aix 7.1 after I mangled a new libtool release into the source so it would compile shared objects. Unfortunately, when I start syslog-ng it core dumps repeatedly. Core dumps start filling up /sftw/syslog-ng/var and a ps -ef shows only the "supervising syslog-ng process". a dbx syslog-ng gives this output... [root@mlwitt71]:[/sftw/syslog-ng/sbin] > dbx syslog-ng Type 'help' for help. [using memory image in core.10092546.01150742] reading symbolic information ... Segmentation fault in alloca at 0xd2970930 ($t1) 0xd2970930 (alloca+0x8) 800c0000 lwz r0,0x0(r12) (dbx) where alloca() at 0xd2970930 evt_str_append_escape_bs() at 0xd2970520 evtrec_format_plain() at 0xd296feb4 evt_format() at 0xd2970104 msg_event_send(e = 0x00000005), line 166 in "messages.c" main_loop_run(cfg = (nil)), line 148 in "main.c" main(argc = 1, argv = 0x2ff227f4), line 470 in "main.c" (dbx) I have also tried using the Syslog-ng rpm's from perzl & Bull. Both of them core dump as well, so I went back to trying to get a self-compiled release to work as I have some control over that. I used IBM VisualAge C/C++ v11.1.0.9 as the C compiler. [root@mlwitt71]:[/sftw/syslog-ng/sbin] > lslpp -L | grep vac vac.Bnd 11.1.0.1 C F XL C for AIX Media Defined vac.C 11.1.0.9 C F IBM XL C Compiler vac.aix53.lib 11.1.0.9 C F XL C for AIX Libraries for AIX vac.include 11.1.0.9 C F IBM XL C Compiler Include vac.lib 11.1.0.9 C F XL C for AIX Libraries vacpp.Bnd 11.1.0.1 C F IBM XL C/C++ Media Defined vacpp.cmp.aix53.lib 11.1.0.9 C F IBM XL C/C++ Libraries for AIX vacpp.cmp.core 11.1.0.9 C F IBM XL C/C++ Compiler vacpp.cmp.include 11.1.0.9 C F IBM XL C/C++ Compiler Include vacpp.cmp.lib 11.1.0.9 C F IBM XL C/C++ Libraries vacpp.cmp.rte 11.1.0.9 C F IBM XL C/C++ Compiler vacpp.cmp.tools 11.1.0.9 C F IBM XL C/C++ Tools vacpp.tnb 11.1.0.1 C F IBM XL C/C++ Evaluation I mangled libtool 2.4.2 into the source directories so it would detect/compile shared libraries (it wouldn't otherwise). I compiled and installed eventlog 0.2.12 in /sftw/syslog-ng, I also compiled OpenSSL 1.0.0g into it staticly. I am initially trying to start it using the default configuration files. There were no errors during the compile, and a syslog-ng -s did NOT coredump. I believe syslog-ng is using the following libraries and their locations (dynamically linked). [root@mlwitt71]:[/sftw/syslog-ng/sbin] > ldd syslog-ng syslog-ng needs: /sftw/syslog-ng/lib/libsyslog-ng.a(libsyslog-ng.so.0) /usr/lib/libnsl.a(shr.o) /opt/freeware/lib/libgmodule-2.0.so /opt/freeware/lib/libglib-2.0.so /usr/lib/libpthread.a(shr_xpg5.o) /usr/lib/libc.a(shr.o) /sftw/syslog-ng/lib/libevtlog.a(libevtlog.so.0) /usr/lib/librtl.a(shr.o) /opt/freeware/lib/libpcre.a(libpcre.so.0) /usr/lib/libthread.a(shr.o) /usr/lib/libpthreads_compat.a(shr.o) /usr/lib/libpthreads.a(shr_xpg5.o) /usr/lib/libtli.a(shr.o) /opt/freeware/lib/libglib-2.0.a(libglib-2.0.so.0) /opt/freeware/lib/libintl.a(libintl.so.1) /usr/lib/libiconv.a(shr4.o) /usr/lib/libpthreads.a(shr_comm.o) /unix /usr/lib/libcrypt.a(shr.o) /usr/lib/libpthreads.a(shr.o) /usr/lib/libc.a(pse.o) and the configure command when compiling from source was: ./configure --prefix=/sftw/syslog-ng \ --disable-spoof-source \ --enable-dynamic-linking \ --enable-debug \ --enable-ssl and I added -g to the CFLAGS I am using glib2-2.28.6-1 from perzl as well.. I plan on removing the --enable-debug if I can get it working Any ideas? Jonathan Kaufman

8 10

[Bug 170] New: feature request: include only load *.conf files
by bugzilla＠bugzilla.balabit.com 07 May '12

07 May '12

https://bugzilla.balabit.com/show_bug.cgi?id=170 Summary: feature request: include only load *.conf files Product: syslog-ng Version: 3.3.x Platform: Other OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: enhancement Estimated Hours: 0.0 When an rpm package is used to place a configuration file in an include directory and the package is later updated, a file of the name *.conf.rpmnew or *.conf.rpmsave but the contents of this file will be a conflict with the *.conf file and syslog-ng will not start. Syslog-ng should only load the *.conf files so that it can work seamlessly with the rpm method. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

[ANN]: balabit.logstore - Open Source LogStore reader API
by Gergely Nagy 04 May '12

04 May '12

--------------------------------------------------------------- PACKAGE : com.balabit/logstore VERSION : 0.0.1 SUMMARY : First alpha release DATE : 2012 April 24 HOMEPAGE : http://algernon.github.com/balabit.logstore --------------------------------------------------------------- DESCRIPTION: The balabit.logstore project is a library written in Clojure, that tries to provide a convenient API to read syslog-ng PE LogStore files. The reason behind the implementation is to have an independent, open source reader for the LogStore file format, so that one is not tied to syslog-ng to read one's logs stored in this format. An open implementation makes it possible to read these logs on systems where syslog-ng is not installed, or where the lgstool program is not available. LogStore itself is a storage format for log messages, supporting encryption, compression, secure timestamps, serialized messages (think name-value pairs as opposed to just a plain, formatted string) and a lot more. This format is being opened, and this library is meant to provide an implenetation for a LogStore reader, that will eventually support reading all kinds of LogStore files. EXAMPLE: (ns example (:require [balabit.logstore :as logstore])) (defn lgstool-cat ([] (lgstool-cat "resources/logstores/short.compressed.store")) ([filename] (logstore/with-file filename (let [indexed-records (zipmap (range (count (logstore/records))) (logstore/records)) chunk-records (keys (filter #(= :chunk (:type (val %))) indexed-records)) print-msgs (fn [index] (dorun (map println (:messages (logstore/nth-record index)))))] (dorun (map print-msgs chunk-records)))))) (lgstool-cat "/path/to/logstore/messages.store") More examples can be found bundled with the sources, and as part of the documentation: http://algernon.github.com/balabit.logstore/#balabit.logstore.examples FEATURES: The library - being in very early alpha stage - can already read some LogStore files, and transparently decompress them, collect meta-data about both the logstore, and the information stored within. It comes with an extensive test suite and a lot of examples. FUTURE DIRECTION: We are working on making the library able to deserialize name-value pairs, to make it support decrypting logstores, and paralell to that, we're working on a Java API, so that it can be used from a more familiar language, and still provide a convenient, easy to use API. In the future, we also plan to publish ready to use JAR files that one can easily use from any Java or Clojure project. DOWNLOADS: The source is available from the git repository at github: git://github.com/algernon/balabit.logstore.git Documentation and more information about the library is available on its homepage at http://algernon.github.com/balabit.logstore/. People interested in the development of the library can also look at the developer docs at: http://algernon.github.com/balabit.logstore/developer-api.html -- |8]

2 2

[PATCH 0/2] systemd enhancements
by Gergely Nagy 04 May '12

04 May '12

The two patches that follow improve syslog-ng's support for systemd-enabled platforms. The first patch simply teaches the system() source to prefer /run/systemd/journal/syslog over /dev/log if running under systemd. That alone makes configs that use system() work under both sysvinit and systemd without any change at all to the config. However, for configs that use /dev/log hard-coded, the upgrade path isn't that smooth. In that case, we still check whether running under systemd, and if so, but we couldn't accept any of the offered fds, we check again with /run/systemd/journal/syslog as the filename, and replace the hard-coded one if the other filename worked. The second patch implements the above - I'm not entirely sold on the idea, and haven't explored the possible side-effects yet, but I believe it's reasonably safe for the vast majority of cases. For now, the second patch is mostly meant as a proposal, and will need a review before it can be considered for a merge.

2 5