April 2012 - syslog-ng - lists.balabit.hu

[PATCH] contrib/systemd: Alias the service to syslog.service
by Gergely Nagy 01 May '12

01 May '12

In order to be considered a syslog service, we need to Alias ourselves to syslog.service. Doing this will make systemd consider syslog-ng a valid syslogd service, without the alias, one has to do something similar manually. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- contrib/systemd/syslog-ng.service | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/contrib/systemd/syslog-ng.service b/contrib/systemd/syslog-ng.service index 85c91e5..f9b9fe2 100644 --- a/contrib/systemd/syslog-ng.service +++ b/contrib/systemd/syslog-ng.service @@ -10,3 +10,4 @@ StandardOutput=null [Install] WantedBy=multi-user.target +Alias=syslog.service -- 1.7.9.1

2 1

File permission in syslog-ng
by Ankit Mahawar 01 May '12

01 May '12

Hi All, If the file permission is not specified in syslog-ng.conf file then it uses the file permission as default which is 600 . I noticed it and want to confirm this behavior of syslog-ng . Also if we define the permission as perm(644) in options tag of syslog-ng.conf then does that permission is set for all the files ? Please provide your inputs as I am understanding this utility. Thanks Ankit =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

2 1

Antw: [PATCH] afinter: Make the parent class LogSrcDriver, instead of LogDriver.
by Peter Eisenlohr 01 May '12

01 May '12

Hi, since the large NVTable patch has been re-applied (1c3a37764d), this patch should be committed soon, as syslog-ng currently still crashes when a mark is logged. Peter Dipl.-Inf. Peter Eisenlohr Geschäftsbereich Logistik INFORM GmbH, Pascalstr. 23, 52076 Aachen, Germany Telefon: (+49) 2408 9456-6000 E-Mail: peter.eisenlohr(a)inform-software.com, Web: http://www.inform-software.com INFORM Institut fur Operations Research und Management GmbH Registered AmtsG Aachen HRB1144 Gfhr. Adrian Weiler >>> Gergely Nagy 06.04.12 11.36 Uhr >>> The parent of AFInterSourceDriver should be LogSrcDriver, because that's the struct we pass down to it anyway, and other parts of the code will cast it back to LogSrcDriver, too. But if its parent is LogDriver, as it was, we were corrupting the later parts of the original LogSrcDriver, with values from AFInterSourceDriver. Many thanks to Peter Eisenlohr for initial debugging, and for pinpointing mark messages as the triggers. Reported-by: Peter Czanik Signed-off-by: Gergely Nagy --- lib/afinter.c | 10 +++++----- lib/afinter.h | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/lib/afinter.c b/lib/afinter.c index 23b1c82..b9d0ddf 100644 --- a/lib/afinter.c +++ b/lib/afinter.c @@ -304,7 +304,7 @@ afinter_source_new(AFInterSourceDriver *owner, LogSourceOptions *options) AFInterSource *self = g_new0(AFInterSource, 1); log_source_init_instance(&self->super); - log_source_set_options(&self->super, options, 0, SCS_INTERNAL, owner->super.id, NULL, FALSE); + log_source_set_options(&self->super.super, options, 0, SCS_INTERNAL, owner->super.super.id, NULL, FALSE); afinter_source_init_watches(self); self->super.super.init = afinter_source_init; self->super.super.deinit = afinter_source_deinit; @@ -328,7 +328,7 @@ afinter_sd_init(LogPipe *s) return FALSE; } - log_source_options_init(&self->source_options, cfg, self->super.group); + log_source_options_init(&self->source_options, cfg, self->super.super.group); self->source = afinter_source_new(self, &self->source_options); log_pipe_append(&self->source->super, s); log_pipe_init(&self->source->super, cfg); @@ -370,9 +370,9 @@ afinter_sd_new(void) AFInterSourceDriver *self = g_new0(AFInterSourceDriver, 1); log_src_driver_init_instance((LogSrcDriver *)&self->super); - self->super.super.init = afinter_sd_init; - self->super.super.deinit = afinter_sd_deinit; - self->super.super.free_fn = afinter_sd_free; + self->super.super.super.init = afinter_sd_init; + self->super.super.super.deinit = afinter_sd_deinit; + self->super.super.super.free_fn = afinter_sd_free; log_source_options_defaults(&self->source_options); return (LogDriver *)&self->super.super; } diff --git a/lib/afinter.h b/lib/afinter.h index 108475f..1cd9d78 100644 --- a/lib/afinter.h +++ b/lib/afinter.h @@ -33,7 +33,7 @@ */ typedef struct _AFInterSourceDriver { - LogDriver super; + LogSrcDriver super; LogSource *source; LogSourceOptions source_options; } AFInterSourceDriver; -- 1.7.9.1 ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

2 1

[PATCH (3.4)] configure.in: Add --disable-smtp support.
by Gergely Nagy 01 May '12

01 May '12

Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- configure.in | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/configure.in b/configure.in index f21e130..2d56bbd 100644 --- a/configure.in +++ b/configure.in @@ -178,6 +178,10 @@ AC_ARG_ENABLE(json, [ --disable-json Disable JSON support (default: auto)], [case "${enableval}" in yes) with_json="auto";; *) with_json="${enableval}";; esac],with_json="auto") +AC_ARG_ENABLE(smtp, + [ --disable-smtp Disable SMTP support (default: auto)], + ,,enable_smtp="auto") + AC_ARG_WITH(libesmtp, AC_HELP_STRING([--with-libesmtp=DIR], [use libesmtp library from (prefix) directory DIR]),,) -- 1.7.9.1

2 1

[PATCH] afinter: Make the parent class LogSrcDriver, instead of LogDriver.
by Gergely Nagy 01 May '12

01 May '12

The parent of AFInterSourceDriver should be LogSrcDriver, because that's the struct we pass down to it anyway, and other parts of the code will cast it back to LogSrcDriver, too. But if its parent is LogDriver, as it was, we were corrupting the later parts of the original LogSrcDriver, with values from AFInterSourceDriver. Many thanks to Peter Eisenlohr <peter.eisenlohr(a)inform-software.com> for initial debugging, and for pinpointing mark messages as the triggers. Reported-by: Peter Czanik <czanik(a)balabit.hu> Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- lib/afinter.c | 10 +++++----- lib/afinter.h | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/lib/afinter.c b/lib/afinter.c index 23b1c82..b9d0ddf 100644 --- a/lib/afinter.c +++ b/lib/afinter.c @@ -304,7 +304,7 @@ afinter_source_new(AFInterSourceDriver *owner, LogSourceOptions *options) AFInterSource *self = g_new0(AFInterSource, 1); log_source_init_instance(&self->super); - log_source_set_options(&self->super, options, 0, SCS_INTERNAL, owner->super.id, NULL, FALSE); + log_source_set_options(&self->super.super, options, 0, SCS_INTERNAL, owner->super.super.id, NULL, FALSE); afinter_source_init_watches(self); self->super.super.init = afinter_source_init; self->super.super.deinit = afinter_source_deinit; @@ -328,7 +328,7 @@ afinter_sd_init(LogPipe *s) return FALSE; } - log_source_options_init(&self->source_options, cfg, self->super.group); + log_source_options_init(&self->source_options, cfg, self->super.super.group); self->source = afinter_source_new(self, &self->source_options); log_pipe_append(&self->source->super, s); log_pipe_init(&self->source->super, cfg); @@ -370,9 +370,9 @@ afinter_sd_new(void) AFInterSourceDriver *self = g_new0(AFInterSourceDriver, 1); log_src_driver_init_instance((LogSrcDriver *)&self->super); - self->super.super.init = afinter_sd_init; - self->super.super.deinit = afinter_sd_deinit; - self->super.super.free_fn = afinter_sd_free; + self->super.super.super.init = afinter_sd_init; + self->super.super.super.deinit = afinter_sd_deinit; + self->super.super.super.free_fn = afinter_sd_free; log_source_options_defaults(&self->source_options); return (LogDriver *)&self->super.super; } diff --git a/lib/afinter.h b/lib/afinter.h index 108475f..1cd9d78 100644 --- a/lib/afinter.h +++ b/lib/afinter.h @@ -33,7 +33,7 @@ */ typedef struct _AFInterSourceDriver { - LogDriver super; + LogSrcDriver super; LogSource *source; LogSourceOptions source_options; } AFInterSourceDriver; -- 1.7.9.1

2 1

ts_format(iso) bug or misunderstanding?
by Chris Hiestand 01 May '12

01 May '12

So I'm using iso timezone format for my syslog clients: options { … ts_format(iso); … }; I expected this to use the iso format for all syslog entries. However, I've found that it only uses iso format for local syslog entries. syslog entries sent to the syslog-ng collector are in old rfc3164 format. > chiestand@host:~$ logger -t my-test asdlfkjasdfasdf which sends (3 local entries, 1 remote entry): > sudo strace -ff -p 13658 > ... > write(10, "2012-04-05T18:14:37-07:00 host "..., 64) = 64 > write(11, "2012-04-05T18:14:37-07:00 host "..., 64) = 64 > write(9, "<13>Apr 5 18:25:09 host my-test"..., 58) = 58 > write(14, "2012-04-05T18:14:37-07:00 host "..., 64) = 64 or viewing with tcpdump: > chiestand@host:/var/log$ sudo tcpdump -A host syslog.server.salk.edu > … > .va<13>Apr 5 18:20:31 host my-test: asdlfkjasdfasdf I would expect the iso format to be sent to the syslog-ng collector as well. Is this a bug or expected behavior? I checked bugzilla and debian bug tracker and didn't see anything. I'm running syslog-ng v3.1 on Debian squeeze. Thanks, Chris

3 5

Spoofed source bug introduced in 3.3.5
by Marvin Nipper 30 Apr '12

30 Apr '12

Hi. All of this pertains to a Solaris 10 (x86) environment.... I tried, at the end of the week, to jump up to the new 3.3.5 release, mostly to get up to a version that already included all of the memory leak fixes that I had manually deployed to 3.3.4. It all compiled fine, and seemed to work fine.... Until this weekend. When my log rotation script ran this weekend, all hell broke loose. The specific issue is that the instant that syslog-ng 3.3.5 receives the HUP (from my rotation script), all of the packets that are being forwarded (via UDP, with source spoofing) instantly start being forwarded with null (0.0.0.0) destination addresses. (And, FYI, I can easily recreate, and see this behavior.) Unfortunately, instead of _only_ resulting in the destination server not receiving these packets, the effect is actually far worse, because a null destination address is (at least on Solaris) interpreted as an old form of a broadcast packet, and all of these packets actually create an exponential feedback loop. I.E. they are seen by this same syslog-ng server's UDP listener, as valid inbound packets, which (of course), then are forwarded, outbound (by syslog-ng, as part of the spoofed forwarding), which then (of course) causes them to be seen (yet again) by syslog-ng as inbound packets. And "very quickly" the whole thing piles up on itself, causing the server to pretty much collapse under the weight of an ever increasing volume of "perceived" inbound UDP syslog packets. So... I'm hoping that someone will say "ah ha", and have some idea about what code might have changed between 3.3.4 and 3.3.5, that might have (accidentally) resulted in this behavior. Certainly, I've dropped back (for now) to 3.3.4 (as it does not have the problem), but if there is some sort of debugging that you need me to do (i.e. "if it's not obvious what coding change may have introduced this bug"), I'm more than willing to deploy the 3.3.5 code in a test environment, and do whatever testing that you might need. Again, it's easily reproducible with a simple HUP. Sorry to bring you a new/different issue. Any and all input/help would be appreciated. As always, THANKS for your help!! Marvin Nipper This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden.

2 2

Pattern Matching Help
by Rob Cameron 27 Apr '12

27 Apr '12

Team syslog-ng, I am attempting to write a parser to break apart a structured syslog message and break it into values that I will ultimately forward to MongoDB. I am unable to get the parsing to work. Below is a link to my parser database file and I have built in a simple test case. If someone could assist me by matching at least one field of the test log found in my example PDB I would be most appreciative for the help. I will also contribute my PDB back to the community. https://github.com/RobWC/syslog-ng-SRX/blob/master/junos-sme-12.1.pdb Thanks again for your help. -- Rob

2 1

Glib libraries issue syslog_ng 3.3.4
by Rakesh Rajasekharan 27 Apr '12

27 Apr '12

Hello Guys, I am trying to compile syslog_ng on solaris 10 opteron with mixed linking option. I was able to successfully compile glib-2.16.5 statically. in my configure stage of syslog_ng 3.3.4 , I get he below error. configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib libglib-2.0.a is present under /usr/local/lib . When I checked the config.log, I have the following errors. configure:5326: checking lex library configure:5340: gcc -std=gnu99 -o conftest -g -O2 conftest.c >&5 Undefined first referenced symbol in file yywrap /var/tmp//cc2KbW8B.o ld: fatal: Symbol referencing errors. No output written to conftest collect2: ld returned 1 exit status configure:5340: $? = 1 configure: failed program was: | /* confdefs.h */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | #define PACKAGE_URL "" | /* end confdefs.h. */ | | #line 3 "lex.yy.c" | | #define YY_INT_ALIGNED short int | | /* A lexical scanner generat Any inputs on how can i fix this please? Best Regards, Rakesh

2 4

(no subject)
by pedro castro 26 Apr '12

26 Apr '12

Single m0m makes real m0ney w0rking fr0m h0me http://cgm-web.com/pertmoun.php?bunpagge=38 Thu, 26 Apr 2012 20:44:00 ______________ " We shan't see a bit of it, worse luck! Nota sniff we shan't get!2The naval situation in the North Atlantic at that time was apeculiar one" (c) adalberto yule

1 0