May 2012 - syslog-ng - lists.balabit.hu

[Bug 144] New: incremental statistics and on reload and stop
by bugzilla＠bugzilla.balabit.com 07 Sep '12

07 Sep '12

https://bugzilla.balabit.com/show_bug.cgi?id=144 Summary: incremental statistics and on reload and stop Product: syslog-ng Version: unspecified Platform: All OS/Version: All Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: mdione.ext(a)orange.com Type of the Report: --- Estimated Hours: 0.0 syslog-ng log statistics in /var/log/messages (or some other defined destination), but it does it accumulatively. this makes it harder to make graphs, because the data collector must detect reloads and stop/starts. this most probably should not be done if the statistics are asked via syslog-ng-ctl. also, it does not print statistics on reload or stop, so the last values before the reload or stop are lost. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[Bug 178] New: Spoofed source address bug introduced in 3.3.5
by bugzilla＠bugzilla.balabit.com 10 Aug '12

10 Aug '12

https://bugzilla.balabit.com/show_bug.cgi?id=178 Summary: Spoofed source address bug introduced in 3.3.5 Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Solaris Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: marvin.nipper(a)stream.com Type of the Report: regression Estimated Hours: 0.0 Hi. Sorry if this is not the right way to do this. There was an email thread regarding this on 4/30, but I figured that the right way to do this way to simply open an official bug report. As this is my 1st one for syslog-ng, apologies if I screw it up! This all pertains to 3.3.5, on Solaris 10 x86. Per my original email, changes made between 3.3.4 and 3.3.5 have caused a situation wherein forwarded UDP packets, with spoofed source addressing, all revert to null addresses, the instant that a HUP is issued against syslog-ng (e.g. during log rotation). Also, as per that email, with Gergely's excellent (and educated) guess, I backed out the patch noted here: http://git.madhouse-project.org/debian/syslog-ng/patch/?id=a898014482f733e9…, and the result was that the null addressing issue was resolved. Obviously, as there were (no doubt) other reasons for that patch, I'm just wanting to be sure that this problem doesn't get lost in the shuffle, and that the patch gets reworked (to achieve its originally desired results, while managing to also resolve the null address problem that it caused with spoofing). Let me know if you need any further information regarding this problem. And, as always, I'm MORE than happy to be a test guinea pig, if need be. THANKS. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 21

[Bug 168] New: Solaris 10 make failure after successful configure
by bugzilla＠bugzilla.balabit.com 02 Jul '12

02 Jul '12

https://bugzilla.balabit.com/show_bug.cgi?id=168 Summary: Solaris 10 make failure after successful configure Product: syslog-ng Version: 3.3.x Platform: Other OS/Version: Solaris Status: NEW Severity: blocker Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: david.j.fenske(a)usps.gov Type of the Report: bug Estimated Hours: 0.0 1. Download, gunzip, and de-tar syslog-ng-3.3.4 2. PKG_CONFIG_PATH=/usr/local/lib/pkgconfig 3. LD_LIBRARY_PATH=/usr/local/lib 4. ./configure 5. make make all-recursive Making all in lib make: Fatal error in reader: Makefile, line 993: Unexpected end of line seen Current working directory /djftools/syslog/source/syslog-ng-3.3.4/lib *** Error code 1 The following command caused the error: fail= failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='lib modules syslog-ng scripts tests doc contrib scl debian tgz2build build'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (CDPATH="${ZSH_VERSION+.}:" && cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /djftools/syslog/source/syslog-ng-3.3.4 *** Error code 1 make: Fatal error: Command failed for target `all' -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 10

[Bug 181] New: Daemon stops reading from unix-dgram source following charset decoding error
by bugzilla＠bugzilla.balabit.com 29 Jun '12

29 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=181 Summary: Daemon stops reading from unix-dgram source following charset decoding error Product: syslog-ng Version: 3.3.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=674099 OS/Version: Linux Status: ASSIGNED Severity: blocker Priority: unspecified Component: syslog-ng AssignedTo: algernon(a)balabit.hu ReportedBy: algernon(a)balabit.hu Type of the Report: bug Estimated Hours: 0.0 As explained in the Debian bug report (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=674099) when we have an unix-dgram() source with encoding set, and we send invalid data there, no further messages will be processed. It's easy to reproduce, and only seems to happen with unix-dgram (tcp at least does not exhibit this problem). I'm not quite sure yet why this happens - the source is kept open, just doesn't seem to be handled at all. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

[Bug 159] New: on signal HUP program destinations are not closed
by bugzilla＠bugzilla.balabit.com 26 Jun '12

26 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=159 Summary: on signal HUP program destinations are not closed Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 In previous versions of syslog-ng, when a HUP signal was sent to syslog-ng it would close all of its destinations and reopen them. In version 3.3.4 (perhaps earlier ones) the destination to programs is not closed, but a new one is opened. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 12

syslog-ng maintenance changes
by Balazs Scheidler 15 Jun '12

15 Jun '12

Hi, I had a decreasing amount of time to work on syslog-ng in the past year, as you may have noticed by my absense on the mailing list, and the relative rarity of my blog posts. More and more is done by Algernon (aka Gergely Nagy), and I felt it to be incorrect to be the bottleneck in a number of cases. Even though Algernon is emloyed by BalaBit, his daily job didn't and doesn't mandate such close relationship with syslog-ng. That was his own motivation, and I think that is a key to maintaining or developing open source software. After talking to him in real life, we've decided to make a shift, he is going to maintain the 3.3 tree and making releases instead of myself. This will make 3.3 maintenance smoother, and free some precious time for me, which I'd use to work on the 3.4 features. The location of the syslog-ng trees will change too, they would be available at: git://github.com/balabit/syslog-ng-3.3.git git://github.com/balabit/syslog-ng-3.4.git or the web interface at: http://github.com/balabit I am certain that this change is for the better of syslog-ng, and I hope the conclusion of the community will be the same in a few months. I really thank him for helping me out. Cheers, Bazsi

4 5

[Bug 176] New: iv_event_raw module doesn't work on mips64el n32, missing include
by bugzilla＠bugzilla.balabit.com 05 Jun '12

05 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=176 Summary: iv_event_raw module doesn't work on mips64el n32, missing include Product: syslog-ng Version: 3.3.x Platform: Other OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: mads(a)ab3.no Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=57) --> (https://bugzilla.balabit.com/attachment.cgi?id=57) iv_event_raw.c patch, missing include I have a Lemote Fuloong 2F mips64el (n32) machine running Gentoo, the uname looks like this: Linux Lemote 3.3.0 #5 PREEMPT Wed Apr 18 13:25:19 CEST 2012 mips64 ICT Loongson-2 V0.3 FPU V0.1 lemote-fuloong-2f-box GNU/Linux This machine doesn't get updated that often, so I didn't discover that syslog-ng didn't work before I updated syslog-ng to version 3.3.4 and then later 3.3.5 recently. Tested with glibc 2.14 and 2.15. Running syslog-ng -d: eventfd2: Invalid argument Trying to open module; module='affile', filename='/usr/lib32/syslog-ng/libaffile.so' Trying to open module; module='afprog', filename='/usr/lib32/syslog-ng/libafprog.so' Trying to open module; module='afsocket', filename='/usr/lib32/syslog-ng/libafsocket.so' Trying to open module; module='afuser', filename='/usr/lib32/syslog-ng/libafuser.so' Trying to open module; module='basicfuncs', filename='/usr/lib32/syslog-ng/libbasicfuncs.so' Trying to open module; module='csvparser', filename='/usr/lib32/syslog-ng/libcsvparser.so' Trying to open module; module='dbparser', filename='/usr/lib32/syslog-ng/libdbparser.so' Trying to open module; module='syslogformat', filename='/usr/lib32/syslog-ng/libsyslogformat.so' Running application hooks; hook='1' Running application hooks; hook='3' syslog-ng starting up; version='3.3.5' eventfd2: Invalid argument eventfd2: Invalid argument eventfd2: Invalid argument eventfd2: Invalid argument eventfd2: Invalid argument Segmentation fault I checked the file lib/ivykis/modules/iv_event_raw.c as it was the only file calling the eventfd2 syscall, and I noticed that it defines EFD_NONBLOCK and EFD_CLOEXEC if it's not already defined by the includes. I then noticed the values existed in <sys/eventfd.h>, and that the values in that file were other values that the ones defined in iv_event_raw.c. So I just included <sys/eventfd.h>, and that fixed the problem. Attaching a patch fixing the problem for me. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 8

syslog_ng 3.3.4 make error on HPUX HPPA 11.11
by Rakesh Rajasekharan 01 Jun '12

01 Jun '12

Hi, I am trying to compile syslog-ng 3.3.4 version on an HPUX HPPA 11.11 machine. The configure options I used were. ./configure --enable-dynamic-linking --prefix=/opt/soe/local/syslog-ng-3.3.4 Compiler options: compiler : gcc -std=gnu99 compiler options : -g -O2 -Wall -pthread -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -D_REENTRANT -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/opt/soe/local/syslog-ng-3.3.4/eventlog/include/eventlog -I/usr/local/include -I$(top_srcdir)/lib/ivykis/lib/include -I$(top_builddir)/lib/ivykis/lib/include -I$(top_srcdir)/lib/ivykis/modules/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -lcl prefix : /opt/soe/local/syslog-ng-3.3.4 linking mode : dynamic __thread keyword : no Submodules: ivykis : internal libmongo-client : internal Features: Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : yes spoof-source support : no tcp-wrapper support : no Linux capability support : no PCRE support : yes Env wrapper support : no systemd support : no (unit dir: none) Modules: Module search path : /opt/soe/local/syslog-ng-3.3.4/lib/syslog-ng Default module list : affile,afprog,afsocket,afuser,basicfuncs,csvparser,dbparser,syslogformat Sun STREAMS support (module): no SSL support (module) : no SQL support (module) : no PACCT module (EXPERIMENTAL) : no MongoDB destination (module): yes JSON support (module) : no (using no) The make though fails with the below error. /bin/sh ../../libtool --tag=CC --mode=link gcc -Wall -g -O2 -o client client.o ../libivykis.la -lpthread libtool: link: gcc -Wall -g -O2 -o client client.o ../.libs/libivykis.a -lpthread /usr/ccs/bin/ld: Unsatisfied symbols: pthread_sigmask (first referenced in ../.libs/libivykis.a(iv_main.o)) (data) pthread_mutex_init (first referenced in ../.libs/libivykis.a(iv_main.o)) (data) pthread_mutex_destroy (first referenced in ../.libs/libivykis.a(iv_main.o)) (data) pthread_mutex_unlock (first referenced in ../.libs/libivykis.a(iv_main.o)) (data) pthread_mutex_lock (first referenced in ../.libs/libivykis.a(iv_main.o)) (data) /usr/ccs/bin/ld: (Warning) Linker features were used that may not be supported in future releases. The +vallcompatwarnings option can be used to display more details, and the ld(1) man page contains additional information. This warning can be suppressed with the +vnocompatwarnings option. collect2: ld returned 1 exit status make[7]: *** [client] Error 1 make[7]: Leaving directory `/compile/syslog/syslog-ng-3.3.4/lib/ivykis/lib/test' make[6]: *** [all-recursive] Error 1 make[6]: Leaving directory `/compile/syslog/syslog-ng-3.3.4/lib/ivykis/lib' make[5]: *** [all-recursive] Error 1 make[5]: Leaving directory `/compile/syslog/syslog-ng-3.3.4/lib/ivykis' make[4]: *** [all] Error 2 make[4]: Leaving directory `/compile/syslog/syslog-ng-3.3.4/lib/ivykis' make[3]: *** [all-recursive] Error 1 make[3]: Leaving directory `/compile/syslog/syslog-ng-3.3.4/lib' make[2]: *** [all] Error 2. I have compiled glib-2.16.5 statically and eventlog_0.2.12. make[2]: Leaving directory `/compile/syslog/syslog-ng-3.3.4/lib' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/compile/syslog/syslog-ng-3.3.4' make: *** [all] Error 2. Please help me fix this. I have tried tweaking with the comfigure options but could no tget anywhere. Regards, Rakesh

3 6

[Bug 157] New: syslog-ng 3.2.x/3.3.x: test_sql.py and 64-bit systems
by bugzilla＠bugzilla.balabit.com 01 Jun '12

01 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=157 Summary: syslog-ng 3.2.x/3.3.x: test_sql.py and 64-bit systems Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Mac OS Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jpo(a)di.uminho.pt Type of the Report: --- Estimated Hours: 0.0 Created an attachment (id=45) --> (https://bugzilla.balabit.com/attachment.cgi?id=45) Add '/usr/lib64/dbd/' to the search paths Hi, In 64-bits systems we need to add lib64 directories to the libdbi/libdbdsqlite3 module search path in order to successfully run the test_sql functional test. Location of libdbdsqlite3.so in 64-bit Fedora/RHEL: ---------- $ rpm -ql libdbi-dbd-sqlite /usr/lib64/dbd/libdbdsqlite3.so ---------- Affected syslog-ng versions: At least the 3.2 and 3.3 branches (I haven't check the 3.4 development branch). Fix: The attached patch adds the '/usr/lib64/dbd/' directory to the search path. Adding '/usr/local/lib64/dbd' should also make sense (but it is not done by the attached patch). /jpo -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

[Bug 180] New: README file in spec files but not in tar.gz
by bugzilla＠bugzilla.balabit.com 31 May '12

31 May '12

https://bugzilla.balabit.com/show_bug.cgi?id=180 Summary: README file in spec files but not in tar.gz Product: syslog-ng Version: 3.3.x Platform: Other OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: mark.ulmer(a)apollogrp.edu Type of the Report: bug Estimated Hours: 0.0 During rpmbuild process, I've noticed that the syslog-ng.spec and syslog-ng.spec.in files expect a README file that does not exist in the source tar.gz. Unknown if the README was intended to be removed? ./install-sh -o root -g root -m 0644 README \ ${RPM_BUILD_ROOT}/%{_prefix}/share/doc/syslog-ng-3.3.5/README I of course commented out these lines to get past the issue. Mark Ulmer -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2