January 2013 - syslog-ng - lists.balabit.hu

[Bug 215] New: syslog-ng v3 - tcp() does not support no-multi-line as docs reference.
by bugzilla＠bugzilla.balabit.com 13 Feb '13

13 Feb '13

https://bugzilla.balabit.com/show_bug.cgi?id=215 Summary: syslog-ng v3 - tcp() does not support no-multi-line as docs reference. Product: syslog-ng Version: 3.3.x Platform: Other OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: balabit(a)32ths.com Type of the Report: --- Estimated Hours: 0.0 So after doing some test cases, I've noticed that on no-multi-line is not stripping newlines on v3.3.7. I've not tested previous versions yet. Here is my syslog-ng config: source s_net_tcp { tcp(ip(0.0.0.0) port(514) flags(no-multi-line)); }; destination all { file("/var/log/all"); }; log { source(s_net_tcp); destination(all); flags(final); }; I've also attempted to do this with no-parse flags passed in to no avail. When using the udp() source, it works just fine. My test case: # cat blah line1 line2 line3 # cat blah | nc -r -n myhost 514 And on "myhost" Jan 2 12:25:16 192.2.0.1 line1 Jan 2 12:25:16 192.2.0.1 line2 Jan 2 12:25:16 192.2.0.1 line3 So I assume this has something to do with it: https://bugzilla.balabit.com/show_bug.cgi?id=74 Particularly about newlines being message terminators over tcp(), however, why do the docs even say tcp() supports the no-multi-line flag? Maybe there is a way to adjust the terminator if this is the case? I must admit, I was curious what syslog-ng would do if the message size exceeded the mtu of the network. With UDP, I assume the end of the packet is the end of the message so any messages large enough to span two udp packets would actually be two log entries. I assumed it would also be the case with TCP, even if it is stream based. So the potential problems I see are: 1. tcp() doesn't really support no-multi-line (bug) or 2. the docs should be updated to not say it supports no-multi-line (bug) or 3. I've overlooked the doc references or 4. I'm missing some option (terminator?) in order to get tcp() to work with no-multi-line. (env) Thanks as always, - Mike -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

[Bug 214] New: Build / Install Issues on AIX
by bugzilla＠bugzilla.balabit.com 08 Feb '13

08 Feb '13

https://bugzilla.balabit.com/show_bug.cgi?id=214 Summary: Build / Install Issues on AIX Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: AIX Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: blentz(a)cswg.com Type of the Report: --- Estimated Hours: 0.0 More fun for the AIX platform; Using version 3.3.7, GNU Make and GCC 4.2.0 However lib/syslog-ng/libafsocket.so is installed it is installed in such a way that the dependency for libsyslog-ng-crypto.a cannot be found. Seems like some kind of libtool problem. $ ldd /opt/local/syslogng/lib/syslog-ng/libafsocket.so /opt/local/syslogng/lib/syslog-ng/libafsocket.so needs: Cannot find libsyslog-ng-crypto.a(libsyslog-ng-crypto.so) /opt/local/syslogng/lib/libssl.so /opt/local/syslogng/lib/libcrypto.so /opt/local/syslogng/lib/libglib-2.0.a(libglib-2.0.so.0) /opt/local/syslogng/lib/libevtlog.a(libevtlog.so.0) /opt/local/syslogng/lib/libsyslog-ng.a(libsyslog-ng-3.3.7.so) /usr/lib/libc.a(shr.o) /usr/lib/librtl.a(shr.o) /opt/local/syslogng/lib/libgcc_s.a(shr.o) /usr/lib/libpthreads.a(shr_xpg5.o) /usr/lib/libiconv.a(shr4.o) /usr/lib/libpthread.a(shr_comm.o) /usr/lib/libpthread.a(shr_xpg5.o) /opt/local/syslogng/lib/libintl.a(libintl.so.8) /opt/local/syslogng/lib/libgmodule-2.0.a(libgmodule-2.0.so.0) /opt/local/syslogng/lib/libgthread-2.0.a(libgthread-2.0.so.0) /opt/local/syslogng/lib/libivykis.a(libivykis.so.0) /unix /usr/lib/libcrypt.a(shr.o) /usr/lib/libpthreads.a(shr_comm.o) /usr/lib/libthread.a(shr.o) Also, be aware that shared libraries on AIX use the .a suffix, not .so. Out of the box shared libraries are archived into .a files. $ ar tv /opt/local/syslogng/lib/syslog-ng/libafsocket.a rwxr-xr-x 0/0 572423 Dec 19 20:23 2012 libafsocket-tls.so The default "make install" process leaves nothing but *.a files in lib/syslog-ng and on startup the user is greeted with many errors about missing loadable modules. The RPM that Perzl makes gets around this by running ar -X32 -x'ing all of these .a files so the system is populated with both .a and .so versions of the files. ( cd ${RPM_BUILD_ROOT}%{_libdir} for f in *.a ; do /usr/bin/ar -X32 -x ${f} done cd ${RPM_BUILD_ROOT}%{_libdir}/%{name} for f in *.a ; do /usr/bin/ar -X32 -x ${f} done ) Can this be fixed? -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 18

[Bug 121] New: After service syslog-ng reload, the first log don' t transfer to remote servicer via TLS
by bugzilla＠bugzilla.balabit.com 08 Feb '13

08 Feb '13

https://bugzilla.balabit.com/show_bug.cgi?id=121 Summary: After service syslog-ng reload, the first log don't transfer to remote servicer via TLS Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: critical Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: yong.zheng(a)nsn.com Type of the Report: bug Estimated Hours: 0.0 The version:syslog-ng 3.0.5 options { flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); stats_freq (3600); }; I will upload the logs to remote syslog-ng server via TLS, I encounter a issue, On client: after reload the configure via below command: #service syslog-ng reload. I write a log: #logger -p local1.info "this is test" but I don't see the log to transfer to server immediately, I wait many minutes, still don't see. I must write the second log to triger that client send the 2 logs to server #logger -p local1.info "this is test 2" the 2 logs have transfered to server immediately successfully, I can see the 2 logs on server. It is 100% reproduced. Is this a known issue, or not ? Thanks. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

syslog-ng 3.4.1 has been released
by devel＠balabit.hu 02 Feb '13

02 Feb '13

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.4.1 SUMMARY : new stable release DATE : Jan 31, 2013 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.4.1) has been released. For latest fixes in the 3.4.x feature branch you are recommended to upgrade to this version. CHANGES: 3.4.1 Thu, 31 Jan 2013 11:00:00 +0100 This is the first stable release in the 3.4 series adding a number of features compared to 3.3, a culmination of more than a year's worth of development. Major features since 3.3 ======================== * New plugins: AMQP & SMTP destinations, JSON parser. See the following links for more details about them: http://git.io/mgF_sA (AMQP), http://git.io/Os9qpA (SMTP) and http://git.io/7MerYA (JSON parser) * New parsers for patterndb: HOSTNAME, EMAIL, PCRE and LLADDR. * It is now possible to control what db-parser() sees as its input via it's new template() option. (Defaults to $MESSAGE) See http://git.io/YZHPtg for more details. * value-pairs() gained support for programmatically rewriting key names in bulk, via the rekey() method. See http://git.io/VylQUg for more details. * The network() driver is introduced, unifying and extending tcp(), udp(), syslog(), unix-dgram() and unix-stream(). The old drivers are still available, but migrating over to network() is encouraged. See http://git.io/0Xjlhg for more details. * Support for junctions & channels were added, which improve the flexibility of the syslog-ng configuration language. This allows combining sources with their closely tied processing functionality (like parser, rewrite and filter statements). Read this blog post for more information: http://goo.gl/T8Txa In the final form of the functionality the "log" keyword as described in the blog post above was replaced with "channel". Changes since 3.4.0rc2: ======================= Bugfixes ======== * PatternDB allows a wider range of characters in a class value now. Newly allowed chars are: %, :, @, +, !, ^, / and \. * The fsync() and flush-lines() functionality was restored in the file() destination, both work as expected and correctly now. * The set() and subst() rewrite operations were fixed to work even when referenced from multiple places (and in a number of different corner-cases too). Credits: ======== syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Balazs Scheidler <bazsi(a)balabit.hu> Evan Rempel <erempel(a)uvic.ca> Gergely Nagy <algernon(a)balabit.hu> Johnson, Chris <chris.johnson3(a)hp.com> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

3 2

hi
by R. Wiegand 31 Jan '13

31 Jan '13

check it out http://bit.ly/VxCmvI R.

1 0

SYSLOG-NG 3.4.1 on ARM target
by Deepak Gaur 31 Jan '13

31 Jan '13

Hi, Got following error while launching syslog-ng 3.4.1 on ARM target. Earlier version 3.4.0alpha3 working . Development environment is same. lib/message.c compilation seems to be missing in Makefile Starting system-ng log daemon: syslog-ngError opening plugin module; module='system-source', error='/lib/syslog-ng/libsystem-source.so: undefined symbol: ms' Error opening plugin module; module='syslogformat', error='/lib/syslog-ng/libsyslogformat.so: undefined symbol: last_msg_format_options' Error opening plugin module; module='afsocket-notls', error='/lib/syslog-ng/libafsocket-notls.so: undefined symbol: last_msg_format_options' Error opening plugin module; module='afuser', error='/lib/syslog-ng/libafuser.so: undefined symbol: msg_event_suppress_recursions_and_send' Error opening plugin module; module='basicfuncs', error='/lib/syslog-ng/libbasicfuncs.so: undefined symbol: msg_event_suppress_recursions_and_send' Error opening plugin module; module='confgen', error='/lib/syslog-ng/libconfgen.so: undefined symbol: msg_event_suppress_recursions_and_send' Error opening plugin module; module='dbparser', error='/lib/syslog-ng/libsyslog-ng-crypto.so: undefined symbol: msg_event_suppress_recursions_and_send' Error opening plugin module; module='syslog-ng-crypto', error='/lib/syslog-ng/libsyslog-ng-crypto.so: undefined symbol: msg_event_suppress_recursions_and_se' Error opening plugin module; module='tfuuid', error='/lib/syslog-ng/libsyslog-ng-crypto.so: undefined symbol: msg_event_suppress_recursions_and_send' Error opening plugin module; module='afamqp', error='/lib/syslog-ng/libafamqp.so: undefined symbol: msg_event_suppress_recursions_and_send' Error opening plugin module; module='cryptofuncs', error='/lib/syslog-ng/libsyslog-ng-crypto.so: undefined symbol: msg_event_suppress_recursions_and_send' Error opening plugin module; module='afmongodb', error='/lib/syslog-ng/libafmongodb.so: undefined symbol: value_pairs_walk' Error opening plugin module; module='afsocket-tls', error='/lib/syslog-ng/libsyslog-ng-crypto.so: undefined symbol: msg_event_suppress_recursions_and_send' Error opening plugin module; module='afprog', error='/lib/syslog-ng/libafprog.so: undefined symbol: msg_event_suppress_recursions_and_send' Error opening plugin module; module='afsocket', error='/lib/syslog-ng/libsyslog-ng-crypto.so: undefined symbol: msg_event_suppress_recursions_and_send' Error opening plugin module; module='system-source', error='/lib/syslog-ng/libsystem-source.so: undefined symbol: msg_event_suppress_recursions_and_send' Error opening plugin module; module='affile', error='/lib/syslog-ng/libaffile.so: undefined symbol: last_msg_format_options' Error opening plugin module; module='csvparser', error='/lib/syslog-ng/libcsvparser.so: undefined symbol: msg_event_suppress_recursions_and_send' Error opening plugin module; module='confgen', error='/lib/syslog-ng/libconfgen.so: undefined symbol: msg_event_suppress_recursions_and_send' Error parsing source, source plugin system not found in /etc/syslog-ng/syslog-ng.conf at line 10, column 2: system(); ^^^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng with regards, Deepak Gaur -------------------------------------------------------------------------------- ::Disclaimer:: -------------------------------------------------------------------------------- The contents of this email and any attachment(s) are confidential and intended for the named recipient(s) only. It shall not attach any liability on C-DOT. Any views or opinions presented in this email are solely those of the author and may not necessarily reflect the opinions of C-DOT. Any form of reproduction, dissemination, copying, disclosure, modification, distribution and / or publication of this message without the prior written consent of the author of this e-mail is strictly prohibited. If you have received this email in error please delete it and notify the sender immediately. --------------------------------------------------------------------------------

2 1

mongodb and TTL collections
by Lucas, Sascha 28 Jan '13

28 Jan '13

Hi, Mongodb 2.2 has a new feature called TTL collections (expire data by setting a TTL). An analogy to the classic logrotate. One constraint is, that you index a field of date BSON type[1]. As far as I know, atm syslog-ng can only store strings? Or how can it be done to store one field as date? [1] http://docs.mongodb.org/manual/tutorial/expire-data/ TIA, Sascha. Vorsitzender des Aufsichtsrates: Ralf Hiltenkamp Geschäftsführung: Michael Krüger (Sprecher), Stephan Drescher Sitz der Gesellschaft: Halle/Saale Registergericht: Amtsgericht Stendal | Handelsregister-Nr. HRB 208414 UST-ID-Nr. DE 158253683 Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Empfänger sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail oder des Inhalts dieser Mail sind nicht gestattet. Diese Kommunikation per E-Mail ist nicht gegen den Zugriff durch Dritte geschützt. Die GISA GmbH haftet ausdrücklich nicht für den Inhalt und die Vollständigkeit von E-Mails und den gegebenenfalls daraus entstehenden Schaden. Sollte trotz der bestehenden Viren-Schutzprogramme durch diese E-Mail ein Virus in Ihr System gelangen, so haftet die GISA GmbH - soweit gesetzlich zulässig - nicht für die hieraus entstehenden Schäden.

2 6

hi
by R. Wiegand 28 Jan '13

28 Jan '13

hard to believe this lol http://msn.msnbc.com-im4.net/finance/ R.

1 0

(no subject)
by satish pattar 24 Jan '13

24 Jan '13

http://vitriolconsult.com/wp3/wp-content/plugins/zajnuxpdoes/google.html

1 0

[Bug 217] New: Poor single thraded performance reading from a pip
by bugzilla＠bugzilla.balabit.com 22 Jan '13

22 Jan '13

https://bugzilla.balabit.com/show_bug.cgi?id=217 Summary: Poor single thraded performance reading from a pip Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 syslog-ng 3.4.0rc2 ./configure --prefix=%{_prefix} --libdir=%{_libdir} --with-module-dir=%{_libdir}/syslog-ng --mandir=%{_mandir} --infodir=%{_prefix}/share/info \ --sysconfdir=%{_sysconfdir}/syslog-ng --localstatedir=/var/lib/syslog-ng \ --enable-pcre PKG_CONFIG_PATH=%{_libdir}/pkgconfig:%{_prefix}/share/pkgconfig \ --disable-tcp-wrapper Using the attached config file on a Linux Redhat Server 6.3 I can only get approx 2,000 messages per second cat ~/some.log >> /var/log/syslog.pipes/test Using the same config file (with @version 3.3) using 3.3.7 I can process 50,000+ messages per second. By enabling threaded(yes) I can get 50,000+ messages per second. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 9