December 2013 - syslog-ng - lists.balabit.hu

[Bug 211] New: dbparser pattern order breaks validation
by bugzilla＠bugzilla.balabit.com 29 May '14

29 May '14

https://bugzilla.balabit.com/show_bug.cgi?id=211 Summary: dbparser pattern order breaks validation Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 If two log lines share a common leading portion such as; xlog: backup pg_xlog/000000010000014700000076 xlog: backup pg_xlog/000000010000014700000076 failed then the order of the patterns in the pattern database xml file is important. For example, if the two patterns used are; xlog: backup pg_xlog/@SET:xid:0123456789ABCDEF@ xlog: backup pg_xlog/@SET:xid:0123456789ABCDEF@ failed and the shorter pattern is first, it will match BOTH of the above lines because it matches the leading portion of both lines. If the patterns are entered with the longer pattern first, then the longer pattern will fail on the shorter message, allowing the match to fall through to the shorter pattern matcher, but will match the longer message. I expect the behavior of the dbparser to match with the pattern containing the MOST total static content that also matches all of the parsing macros. Some method where the order is not important need to be used. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

[Bug 261] New: DOCBUG: --rekey
by bugzilla＠bugzilla.balabit.com 15 Apr '14

15 Apr '14

https://bugzilla.balabit.com/show_bug.cgi?id=261 Summary: DOCBUG: --rekey Product: syslog-ng Version: 3.5.x Platform: PC OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.balabit(a)faxm0dem.org Type of the Report: --- Estimated Hours: 0.0 In Example 2.3. (Using the rekey() option) from §2.10.1. (Specifying data types in value-pairs) the documentation claims: "The rekey() option can be used with the format-json template-function as well, using the following syntax: $(format-json --key .cee.* --rekey --shift 4 --add-prefix events.)" However, when using this syntax, the config parser fails with the following error: "Error parsing config, Error compiling template (Error parsing value-pairs: expected an equal sign in key=value pair)" The correct syntax (which works, as suggested by algeron on IRC) would be the following: $(format-json --rekey .cee.* --add-prefix events. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

Syslog-ng & Distributed File Systems??
by Jiann-Ming Su 08 Mar '14

08 Mar '14

Is there a version of syslog-ng that can properly use distributed filesystems like GlusterFS? For example, I have two nodes each running syslog-ng but also sharing a GlusterFS filesystem. Can those independent syslog-ng processes running on different servers write to the same file on the GlusterFS?

7 20

[Bug 260] New: exit with code 134
by bugzilla＠bugzilla.balabit.com 06 Mar '14

06 Mar '14

https://bugzilla.balabit.com/show_bug.cgi?id=260 Summary: exit with code 134 Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 I just did a reload on version 3.4.4 (with latest patches) and triggered 2013-11-05T21:24:33-08:00 host daemon.crit supervise/syslog-ng[25895]: Daemon exited due to a deadlock/signal/failure, restarting; exitcode='134' Is it possible that the return code of syslog-ng is somehow linked to the return code of a child program destination? core file sent to Balazs in private e-mail -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 11

patterndb
by Fabien Wernli 03 Mar '14

03 Mar '14

Hi, I'm currently organizing my patterndb files into something easily maintainable, and I ran into the following problem, best explained using an example: sshd and pam_unix. Some of sshd specific patterns reside in a specific ruleset, e.g. <ruleset name='sshd' id='A'> <patterns> <pattern>sshd</pattern </patterns> <rules> <rule> ... </rule> </rules> </ruleset> Some of sshd's messages come from pam_unix, e.g. modules/pam_unix/support.c, and are shared among other daemons: <ruleset name='pam_unix' id='B'> <patterns> <pattern>crond</pattern> <pattern>imap</pattern> <pattern>login</pattern> <pattern>pam</pattern> <pattern>pure-ftpd</pattern> <pattern>proftpd</pattern> <pattern>sshd</pattern> <pattern>su</pattern> <pattern>sudo</pattern> ... <patterns> <rules> <rule> ... </rule> </rules> </ruleset> The problem is, when a sshd message is parsed, even if it doesn't match any rules in ruleset 'A', ruleset 'B' isn't even considered for matching. So how do I properly organize my pdb tree, without duplicating rules in multiple source files? Thanks in advance

3 4

[RFC] procfile destination
by Balazs Scheidler 11 Feb '14

11 Feb '14

Hi, Based on a request I have now created a new destination driver, called "procfile". A working PoC is available on this branch: https://github.com/balabit/syslog-ng/tree/3.6/f/procfile It can be used to change kernel settings dynamically, based on a trigger within syslog-ng. The difference between procfile() and file(): - no template in the name of the file - processing is performed immediately as read by the source, no queueing is performed (e.g. no loss is possible, but takes CPU time from the source) - opens and closes the destination file after each and every write, writes to offset zero e.g. it doesn't append further data. I'd be grateful if you could provide feedback around these questions or the feature in general: - name of the driver, right now it is called procfile as it was the original use-case, however it works with stuff in /dev too, and might work with simple named pipes. - right now the file must exist and is not created (e.g. it really requires an existing file); do we need that? - do we need append mode in some cases - whether we need append mode (if we think of general files, this would probably be needed) Thanks in advance, Bazsi

5 6

[PATCH] confgen: backticks weren't processed in generated configuration part
by Juhász Viktor 28 Dec '13

28 Dec '13

confgen: backticks weren't processed in generated configuration part produced by confgen module. The reason of this problem was, that the cfg_lexer_subst_args was called only for read lines from configuration files (YY_INPUT) and for the processed blocks. If process the backticks for a cfg input buffer is a must, the cfg_lexer_subst_args has to be called explicit. Now the confgen module call the it before set the include buffer to the lexer Signed-off-by: Juhász Viktor <jviktor(a)balabit.hu> --- modules/confgen/confgen-plugin.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/modules/confgen/confgen-plugin.c b/modules/confgen/confgen-plugin.c index 519a660..9831962 100644 --- a/modules/confgen/confgen-plugin.c +++ b/modules/confgen/confgen-plugin.c @@ -40,6 +40,7 @@ confgen_generate(CfgLexer *lexer, gint type, const gchar *name, CfgArgs *args, g gchar *exec = (gchar *) user_data; gsize res; gchar buf[256]; + gchar *old_value; g_snprintf(buf, sizeof(buf), "%s confgen %s", cfg_lexer_lookup_context_name_by_type(type), name); if (!cfg_args_validate(args, NULL, buf)) @@ -79,6 +80,10 @@ confgen_generate(CfgLexer *lexer, gint type, const gchar *name, CfgArgs *args, g g_free(value); return FALSE; } + + old_value=value; + value = cfg_lexer_subst_args(lexer->globals, NULL, NULL, value, &value_len); + g_free(old_value); if (!cfg_lexer_include_buffer(lexer, buf, value, value_len)) { g_free(value); -- 1.8.3.2

2 2

syslog-ng 3.5.3 has been released
by devel＠balabit.hu 25 Dec '13

25 Dec '13

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.5.3 SUMMARY : new stable release DATE : Dec 24, 2013 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.5.3) has been released. For latest fixes in the 3.5.x feature branch you are recommended to upgrade to this version. CHANGES: 3.5.3 Tue, 24 Dec 2013 19:53:05 +0100 This is the second bug-fix release for the 3.5.x series, with a number of important changes over the previous release. Upgrading to this version is highly recommended. Bugfixes ======== * Node flag propagation has been fixed, so flags(final) works the same as it did in 3.3, when embedded log statements are used too. * Improvements were made to the build system, to make it more reliable when building in parallel. * Using the value-pairs() framework, either via the $(format-json) template function or any of the destinations that make use of it, will now correctly skip and ignore empty values, even in SDATA. * The configure script will correctly detect newer versions of json-c too, without compatibility symlinks being present. * A file descriptor and memory leak has been fixed in the syslog() destination. * The pdbtool program will warn in test mode when a test message has no program attribute. [BugZilla #263] * If the PID property is overwritten, syslog-ng will now stop using the cached MSGHDR value, and therefore, use the newly set PID instead, as it was supposed to. * The localport() option of various network destinations has been restored, and will work correctly now. [BugZilla #266] * The upstart service file in contrib has been updated to use a different process mode (background), as we do not need a supervisor when running under upstart. This also means that upstart will be far less confused. * Manual pages are now always included in the tarball. Credits ======= syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Andras Mitzki <micek(a)balabit.hu> Balazs Scheidler <bazsi(a)balabit.hu> Chris Johnson <chris.johnson3(a)hp.com> Fabien Wernli <cpan(a)faxm0dem.org> Gergely Nagy <algernon(a)balabit.hu> Lucas McLane <lucas(a)clicksecurity.com> Peter Czanik <czanik(a)balabit.hu> Sebastiaan Hoogeveen <zebaz(a)xs4all.nl> Tobias Schwab <tobias.schwab(a)dynport.de> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

3 2

syslog-ng 3.4.7, 3.5.3 and incubator packages for openSUSE / SLES
by Peter Czanik 25 Dec '13

25 Dec '13

Hello, Here is my Christmas present for you: openSUSE packages for syslog-ng updated and syslog-ng incubator package added. As it's Christmas, it received only very limited testing (only openSUSE 13.1 x86_65) and incubator lacks riemann support (that needs packaging an additional support library). 3.5 man pages are still a kind of broken, so SLES support is missing there. Packages are available at: https://build.opensuse.org/project/show/home:czanik:syslog-ng34 https://build.opensuse.org/project/show/home:czanik:syslog-ng35 Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

syslog-ng 3.4.7 has been released
by devel＠balabit.hu 24 Dec '13

24 Dec '13

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.4.7 SUMMARY : new stable release DATE : Dec 24, 2013 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.4.7) has been released. For latest fixes in the 3.4.x feature branch you are recommended to upgrade to this version. CHANGES: 3.4.7 Tue, 24 Dec 2013 21:07:34 +0100 This is the sixth bug-fix release for the 3.4.x series, with a number of important fixes over the 3.4.6 release. Upgrading to this release is highly recommended. Bugfixes ======== * Node flag propagation has been fixed, so flags(final) works the same as it did in 3.3, when embedded log statements are used too. * Using the value-pairs() framework, either via the $(format-json) template function or any of the destinations that make use of it, will now correctly skip and ignore empty values, even in SDATA. * A file descriptor and memory leak has been fixed in the syslog() destination. * The pdbtool program will warn in test mode when a test message has no program attribute. [BugZilla #263] * If the PID property is overwritten, syslog-ng will now stop using the cached MSGHDR value, and therefore, use the newly set PID instead, as it was supposed to. * The localport() option of various network destinations has been restored, and will work correctly now. [BugZilla #266] * The upstart service file in contrib has been updated to use a different process mode (background), as we do not need a supervisor when running under upstart. This also means that upstart will be far less confused. Credits ======= syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Andras Mitzki <micek(a)balabit.hu> Balazs Scheidler <bazsi(a)balabit.hu> Chris Johnson <chris.johnson3(a)hp.com> Fabien Wernli <cpan(a)faxm0dem.org> Gergely Nagy <algernon(a)balabit.hu> Lucas McLane <lucas(a)clicksecurity.com> Peter Czanik <czanik(a)balabit.hu> Sebastiaan Hoogeveen <zebaz(a)xs4all.nl> Tobias Schwab <tobias.schwab(a)dynport.de> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0