June 2012 - syslog-ng - lists.balabit.hu

[Bug 144] New: incremental statistics and on reload and stop
by bugzilla＠bugzilla.balabit.com 07 Sep '12

07 Sep '12

https://bugzilla.balabit.com/show_bug.cgi?id=144 Summary: incremental statistics and on reload and stop Product: syslog-ng Version: unspecified Platform: All OS/Version: All Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: mdione.ext(a)orange.com Type of the Report: --- Estimated Hours: 0.0 syslog-ng log statistics in /var/log/messages (or some other defined destination), but it does it accumulatively. this makes it harder to make graphs, because the data collector must detect reloads and stop/starts. this most probably should not be done if the statistics are asked via syslog-ng-ctl. also, it does not print statistics on reload or stop, so the last values before the reload or stop are lost. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[Bug 178] New: Spoofed source address bug introduced in 3.3.5
by bugzilla＠bugzilla.balabit.com 10 Aug '12

10 Aug '12

https://bugzilla.balabit.com/show_bug.cgi?id=178 Summary: Spoofed source address bug introduced in 3.3.5 Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Solaris Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: marvin.nipper(a)stream.com Type of the Report: regression Estimated Hours: 0.0 Hi. Sorry if this is not the right way to do this. There was an email thread regarding this on 4/30, but I figured that the right way to do this way to simply open an official bug report. As this is my 1st one for syslog-ng, apologies if I screw it up! This all pertains to 3.3.5, on Solaris 10 x86. Per my original email, changes made between 3.3.4 and 3.3.5 have caused a situation wherein forwarded UDP packets, with spoofed source addressing, all revert to null addresses, the instant that a HUP is issued against syslog-ng (e.g. during log rotation). Also, as per that email, with Gergely's excellent (and educated) guess, I backed out the patch noted here: http://git.madhouse-project.org/debian/syslog-ng/patch/?id=a898014482f733e9…, and the result was that the null addressing issue was resolved. Obviously, as there were (no doubt) other reasons for that patch, I'm just wanting to be sure that this problem doesn't get lost in the shuffle, and that the patch gets reworked (to achieve its originally desired results, while managing to also resolve the null address problem that it caused with spoofing). Let me know if you need any further information regarding this problem. And, as always, I'm MORE than happy to be a test guinea pig, if need be. THANKS. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 21

syslog-ng 3.4.0alpha3 has been released
by devel＠balabit.hu 05 Jul '12

05 Jul '12

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.4.0alpha3 SUMMARY : new stable release DATE : Jun 30, 2012 ------------------------------------------------------------------------------ DESCRIPTION: A new version of syslog-ng Open Source Edition (3.4.0alpha3) has been released. For latest fixes in the 3.4.x branch you are recommended to upgrade to this version. CHANGES: 3.4.0alpha3 Fri, 29 Jun 2012 15:32:54 +0200 Features: ========= * Added set-tag() and clear-tag() rewrite rules. * Added a marker() option to the json-parser(), which indicates that a message is indeed has a json payload. Used to implement a cee-style payload parser. http://bazsi.blogs.balabit.com/2012/05/cee-prototype-and-a-show-case-for-th… * The system source automatically detectd systemd and defines the proper log socket accordingly. Also, if the system() source is not used, a workaround to use the systemd supplied log socket instead of /dev/log was applied. This kicks in if syslog-ng is running under systemd and its config version is 3.3 or less. * Support for FreeBSD's utmpx database. Featured ported from the Premium Edition ======================================== * Added 12 hour time related macros $AMPM and $HOUR12 * Added $USEC and $MSEC macros for micro and milliseconds respectively. * Added $SYSUPTIME that expands to the time since syslog-ng started in the number of 1/100th of a second (just like in the SNMP sysUptime value). * db-parser(): added field extraction to the matching or program names * Added support for Cisco extended timestamp format, one that includes time synchronity information and sequence numbers. https://github.com/bazsi/syslog-ng-3.4/commit/046f90e76137f31e61412d24b9920… * Added support for mark-mode() that allows the customization how MARK messages are generated. https://github.com/bazsi/syslog-ng-3.4/commit/c38d7ad9a2d40650e243ec29c6b3e… Bugfixes: ========= * Fixed a possible segmentation fault in threaded mode when dns-cache-hosts() is used. * Incorrect encoding of data caused UDP and unix-dgram() receives to be erroneously closed, so no further data would be received. This has been fixed. Incorrect encoding of incoming data causes the connection for connection oriented transports (like tcp() and unix-stream()) to be closed, but the same condition is ignored for datagram oriented transports (like udp() or unix-dgram()). * Accept empty source and destination object in the configuration file. * Fixed a linking issue when using the SMTP destination. * Ignore SIGHUP in the supervisor process. * Fixed fsync() behaviour for destination files. * Fixed a possible NULL deref in db-parser() correllation when context-scope is not defined. Other changes: ============== * Added a --disable-smtp configure option. * Integrated unit test refactorization changes from the BalaBit syslog-ng and SSB teams. * Added systemd alias "syslog" to the unit file. Credits: ======== syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Alexander Komyagin <komyagin(a)altell.ru> EgonB <egon(a)local.ee> Evan Rempel <erempel(a)uvic.ca> Imre Lazar <imre(a)balabit.hu> Jose Pedro Oliveira <jpo(a)di.uminho.pt> Mark Ulmer <mark.ulmer(a)apollogrp.edu> Patrick Hemmer Peter Czanik <czanik(a)balabit.hu> Attila Magyar <athos(a)balabit.hu> Attila Nagy <naat(a)balabit.hu> Balazs Scheidler <bazsi(a)balabit.hu> Gergely Nagy <algernon(a)balabit.hu> Juhasz Viktor <jviktor(a)balabit.hu> Peter Gyorko <gyorkop(a)balabit.hu> Viktor Juhasz <jviktor(a)balabit.hu> DOWNLOAD: You can download the source packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

3 6

Followed files that grow while syslog-ng is reloaded
by Francois Durand 04 Jul '12

04 Jul '12

Hi list, I'm using syslog-ng (3.2.4) to follow some nginx log files using these directives: source s_nginx_logs { file("/path/to/nginx/access.log" flags(no-parse)); } When syslog-ng is reloaded, either for its own log files rotation or because a configuration update (which happens regularly when a new site is added), it does not see new data being written in followed files while it is reloading itself, and then complains about file size having changed and retransmit the whole file to my central log file collector. Here is the warning message: syslog-ng[24608]: The current log file has a mismatching size/inode information, restarting from the beginning; state='affile_sd_curpos(/path/to/nginx/access.log) stored_inode='139419', cur_file_inode='139419', stored_size='985114', cur_file_size='997815', raw_stream_pos='1995630' I don't see how to handle that correctly. Any idea ?

4 6

[Bug 168] New: Solaris 10 make failure after successful configure
by bugzilla＠bugzilla.balabit.com 02 Jul '12

02 Jul '12

https://bugzilla.balabit.com/show_bug.cgi?id=168 Summary: Solaris 10 make failure after successful configure Product: syslog-ng Version: 3.3.x Platform: Other OS/Version: Solaris Status: NEW Severity: blocker Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: david.j.fenske(a)usps.gov Type of the Report: bug Estimated Hours: 0.0 1. Download, gunzip, and de-tar syslog-ng-3.3.4 2. PKG_CONFIG_PATH=/usr/local/lib/pkgconfig 3. LD_LIBRARY_PATH=/usr/local/lib 4. ./configure 5. make make all-recursive Making all in lib make: Fatal error in reader: Makefile, line 993: Unexpected end of line seen Current working directory /djftools/syslog/source/syslog-ng-3.3.4/lib *** Error code 1 The following command caused the error: fail= failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='lib modules syslog-ng scripts tests doc contrib scl debian tgz2build build'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (CDPATH="${ZSH_VERSION+.}:" && cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /djftools/syslog/source/syslog-ng-3.3.4 *** Error code 1 make: Fatal error: Command failed for target `all' -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 10

Re: [syslog-ng] syslog_ng 3.3.4 make error on HPUX HPPA 11.11
by Rakesh Rajasekharan 02 Jul '12

02 Jul '12

Hello Pal, I do not have all of the patches you listed out , installed on my mahcine. I still, tried to compile it with the other suggestion you had put forward but. still was stuck with the same error. I am trying these patches installed and will give it a try thereafer. Will keep you posted. Thanks, Rakesh. On Fri, Jun 1, 2012 at 3:06 AM, Pal Tamas <folti(a)balabit.hu> wrote: > On Thu, May 31, 2012 at 02:13:28PM +0530, Rakesh Rajasekharan wrote: > > Hello Pal, > > > > I was able to get the PHCO_33282 patch and applied it on my 11.11 > machine. > > PHCO_37940 is fo rthe 11.23 HPUX versions hence can't install that. > > > > # swlist -a patch_state *,c=patch |grep PHCO_33282 > > # PHCO_33282 > > PHCO_33282.C-MIN-32ALIB applied > > PHCO_33282.C-MIN-64ALIB applied > > PHCO_33282.CORE-64SLIB applied > > PHCO_33282.CORE-SHLIBS applied > > PHCO_33282.PAUX-ENG-A-MAN applied > > # > > But, even after applying this, I still get the same errors regarding > pthread. > > > > I am curious to know if I should actually be compiling on this 11.11 > machine at > > the first place. > > I mean, is the syslog-ng 3.3.4 compatible with the 11.11 version. The > previous > > version that I was using on this machine is 3.0.7. > > Is there a place I can check the compatible OS's . > Hi, > > dug into the problem a bit more, syslog-ng OSE 3.3 (probably 3.4 too) > needs some porting work before it can be compiled under HP-UX. The > underlying problem is that syslog-ng has been re-written to be > multi-threaded, modular application in 3.2, from it's original single > threaded monolithic architecure. The rewrite added new dependencies > (ivykis) and other required features from the compilers > (Thread-local storage support), which made porting to older systems a > challenge, although the work has been already done, but not every piece > has been added to syslog-ng OSE from the PE branch and not publicly > documented. > > What I managed to solve for now: > - need the following patches: > PHCO_24402 1.0 libc cumulative header file > patch > PHCO_38279 1.0 libc cumulative patch > PHKL_31918 1.0 fsadm;ACL;locking order;8K > mount;readdir > PHSS_30049 1.0 ld(1) and linker tools > cumulative patch > > - download and install GCC for HPUX[1] and make sure it's location > (/opt/hp-gcc/bin) is in PATH, prepeding every other gcc location you > have. > > - edit configure.in and remove all occurences of -Wl,-whole-archive and > -Wl,-no-whole-archive and regenerate configure with autoconf 2.68. If you > don't have autoconf 2.68, edit directly configure and remove the > strings. > > - add the following to lib/compat.h: > #ifndef CLOCK_MONOTONIC > #define CLOCK_MONOTONIC CLOCK_REALTIME > #endif > > - cd lib/ivykis and compile, build and install the bundled ivykis by hand. > > - re-run your configure command with the following options added: > --with-ivykis=system --disable-mongodb > > Hopefully it compiles properly, but I too tired to check it now. > Good luck, > > [1]: > http://h21007.www2.hp.com/portal/site/dspp/menuitem.863c3e4cbcdc3f3515b49c1… > -- > Pal Tamas/Folti > folti(a)balabit.hu > >

2 2

[Bug 185] New: Use upstream ivykis (>= 0.30) instead of a fork
by bugzilla＠bugzilla.balabit.com 01 Jul '12

01 Jul '12

https://bugzilla.balabit.com/show_bug.cgi?id=185 Summary: Use upstream ivykis (>= 0.30) instead of a fork Product: syslog-ng Version: 3.3.x Platform: All OS/Version: All Status: ASSIGNED Severity: blocker Priority: unspecified Component: syslog-ng AssignedTo: algernon(a)balabit.hu ReportedBy: algernon(a)balabit.hu Type of the Report: enhancement Estimated Hours: 0.0 With upstream ivykis 0.30 having everything the syslog-ng internal fork had, and more, it's time to drop the fork, and compile with upstream ivykis as-is. This would mean that the embedded copy (which we will still ship) is replaced by ivykis 0.30, and syslog-ng will become compileable against upstream ivykis. The bulk of the work is already done on my feature/3.3/ivykis-upstream branch, only a few issues remain (see below) before this can be merged to 3.3 master, and this bug report is here to keep track of progress. While trying to merge the branch, I conducted a series of tests, and it appears that somewhere along the way the file destination broke (and most likely everything else that is based on logwriter), and it deadlocks. I do not yet know why, but this feature can't be merged until this problem is solved. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 13

make error syslog-ng 3.3.4 AIX 5.2
by Rakesh Rajasekharan 29 Jun '12

29 Jun '12

I am getting an error during the make stage for syslog-ng 3.3.4. complaining about libiconv. I have compiled libiconv and the library is available under /usr/local/lib # ls -ltr /usr/local/lib/libiconv* -rw-r--r-- 1 root system 890 Jun 17 23:35 /usr/local/lib/ libiconv.la -rw-r--r-- 1 root system 1724284 Jun 17 23:35 /usr/local/lib/libiconv.a ykis-modules.a -lc -Wl,-bnoentry -O2 -pthread -Wl,-brtl -pthread -Wl,--whole-archive -Wl,--no-whole-archive -pthread -Wl,-bE:.libs/libsyslog-ng.exp -Wl,-bernotok /usr/local/lib/libglib-2.0.a(gconvert.o):gconvert.c:(.pr+0x12c): undefined reference to `.libiconv_open' /usr/local/lib/libglib-2.0.a(gconvert.o):gconvert.c:(.pr+0x358): undefined reference to `.libiconv' /usr/local/lib/libglib-2.0.a(gconvert.o):gconvert.c:(.pr+0x39c): undefined reference to `.libiconv_close' collect2: ld returned 1 exit status The compilaiton of glib was fine but not sure why the make fails. Below is my configure options. ./configure --enable-dynamic-linking --prefix=/opt/soe/local/syslog-ng-3.3.4 \ --with-ld-library-path=/opt/soe/local/syslog-ng-3.3.4/lib \ --libdir=/opt/soe/local/syslog-ng-3.3.4/lib --enable-mongodb=no -with-libmongo-client=no Any valuable inputs on this please? Thanks , Rakesh.

4 6

syslog-ng 3.2.5 HPUX 11.11 /usr/ccs/bin/ld: Unsatisfied symbols:
by Divya Vikraman 29 Jun '12

29 Jun '12

Hello, I ma compiling syslog-ng 3.2.5 version on an HPUX 11.11 hppa machine.But, in the make stage , I get the below error. libtool: link: gcc -std=gnu99 -Wno-pointer-sign -g -O2 -Wall -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -o .libs/pdbtool pdbtool-pdbtool.o -Wl,-E -L/opt/soe/local/syslog-ng-3.2.5/lib:/opt/soe/local/syslog-ng-3.2.5/eventlog/lib libsyslog-ng-patterndb.a -L../../lib/.libs -lsyslog-ng -lcl -L/usr/local/lib -L/opt/soe/local/syslog-ng-3.2.5/eventlog/lib -lrt -lnsl -lgmodule-2.0 -lglib-2.0 -lintl -liconv -levtlog -lpcre -ltermcap -Wl,+b -Wl,/compile/syslog/syslog-ng-3.2.5/lib/.libs:/usr/local/lib:/opt/soe/local/syslog-ng-3.2.5/lib /usr/ccs/bin/ld: Unsatisfied symbols: evt_tag_long (first referenced in libsyslog-ng-patterndb.a(libsyslog_ng_patterndb_a-patterndb.o)) (code) collect2: ld returned 1 exit status make[5]: *** [pdbtool] Error 1 make[5]: Leaving directory `/compile/syslog/syslog-ng-3.2.5/modules/dbparser' make[4]: *** [all-recursive] Error 1 make[4]: Leaving directory `/compile/syslog/syslog-ng-3.2.5/modules/dbparser' make[3]: *** [all] Error 2 make[3]: Leaving directory `/compile/syslog/syslog-ng-3.2.5/modules/dbparser' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/compile/syslog/syslog-ng-3.2.5/modules' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/compile/syslog/syslog-ng-3.2.5' make: *** [all] Error 2 I have compiled eventlog -0.2.12 wiht the following ooptions. ./configure --prefix=/opt/soe/local/syslog-ng-3.2.5/eventlog and have also set the PKG_CONFIG_PATH correclty PKG_CONFIG_PATH=/opt/soe/local/syslog-ng-3.2.5/eventlog/lib/pkgconfig:/usr/local/lib/pkgconfig and in the Makefile i have EVTLOG_CFLAGS = -I/opt/soe/local/syslog-ng-3.2.5/eventlog/include/eventlog EVTLOG_LIBS = -L/opt/soe/local/syslog-ng-3.2.5/eventlog/lib -levtlog Can someone pleas help me out to fix this. Thanks, Divya.

2 1

syslog-ng-3.4.0alpha2 syslog-ng binary failure forserver instance.
by Balla, Hithendra (EXT-Other - IN/Bangalore) 29 Jun '12

29 Jun '12

Hi all, Can somebody unblock us in the below issue.? Thanks Hithendra From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ext anju.raveendrannair(a)wipro.com Sent: Friday, June 08, 2012 5:16 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng-3.4.0alpha2 syslog-ng binary failure forserver instance. Hi, We are using syslog-ng-3.4.0alpha2 binary and trying to run the syslog-ng server configuration file, but its not starting the syslog ng server. We are getting the following error incase of f__nonconsole_access filter when we ran the syslog-ng binary in debug mode. Filter rule evaluation result; result='match', rule='f_nonconsole_access', location='/ne_data/conf/syslogng/syslog-ng_server.conf:58:29' ** ERROR:logmsg.c:535:log_msg_set_value_indirect: assertion failed: (!log_msg_is_write_protected(self)) Abort (core dumped) PFA the debug.log The server conf is having the following line for the above mentioned filter, template ltemgr_msg_template { template("$S_ISODATE $HOST $FACILITY_NUM/$LEVEL_NUM $MSG\n"); }; #To strip of the msg_id introduced by syslogd rewrite rw_msg{subst("\\[.*\\] <file:///\\[.*\%5d> ", "", value("MESSAGE"));}; source s_LTEMGR_SYSLOG_CLIENTS{ tcp (ip (27.132.98.69) port(6515) max-connections(4) tls( key_file("/ne_data/conf/certificates/MOCM/MOCM_key.pem") cert_file("/ne_data/conf/certificates/MOCM/MOCM_SB_server.pem") ca_dir("/ne_data/conf/certificates/SYSLOGNG") cipher_suite("ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:!SS Lv2") peer_verify(optional-untrusted) ) ); }; ....... destination d_ltemgr_nonconsoleaccess_log {file("/ne_data/syslog/ems" perm(0644) template(ltemgr_msg_template)); }; ...... filter f_nonconsole_access { level(info..notice) and facility(auth) and ( match("Accepted password for" value("MESSAGE")) or match("Failed password for" value("MESSAGE")) ); }; ..... log { source(s_LTEMGR_SYSLOG_CLIENTS); filter(f_nonconsole_access); rewrite(rw_msg); destination(d_ltemgr_nonconsoleaccess_log); }; Without debug mode, we were able to run the server but central logging is not happening when tried with logger command. Thanks, Anju Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

2 1