February 2013 - syslog-ng - lists.balabit.hu

sysutils/syslog-ng-devel is now 3.4.1
by Peter Czanik 08 Feb '13

08 Feb '13

Hello, Just a heads up: the FreeBSD sysutils/syslog-ng-devel is now updated to 3.4.1. I plan to update the sysutils/syslog-ng port from 3.3 to 3.4 once 3.4.2 is available. Until that please use the -devel port to get known with 3.4 and let us know any problems you run into. Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

which eventlog version ?
by Guillaume Rousse 08 Feb '13

08 Feb '13

Hello. I'm sorry if that was explained in the release announcement, but I can't understand why syslog-ng 3.4.1 download pages include a link to an eventlog release with a mysterious 0.2.12+20120504+1700 version number, whereas 3.4.0rc1 had 0.2.13 release instead ? Has any kind of regression found, that couldn't be fixed with a regular 0.2.14 or 0.2.13.1 release instead ? -- BOFH excuse #144: Too few computrons available.

2 1

Compilation issue with syslog-ng 3.4.1
by Guillaume Rousse 07 Feb '13

07 Feb '13

Hello list. I'm facing some compilation issue with the pacct plugin: libtool: compile: gcc -std=gnu99 -DHAVE_CONFIG_H -I. -I../.. -I../../lib -I../../lib -pthread -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/usr/include/eventlog -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -I/usr/include -I../../lib/ivykis/src/include -I../../lib/ivykis/src/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -g -pipe -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fstack-protector --param=ssp-buffer-size=4 -fPIC -Wall -pthread -MT libpacctformat_la-pacct-format-plugin.lo -MD -MP -MF .deps/libpacctformat_la-pacct-format-plugin.Tpo -c pacct-format-plugin.c -fPIC -DPIC -o .libs/libpacctformat_la-pacct-format-plugin.o pacct-format-plugin.c:38:3: warning: initialization from incompatible pointer type [enabled by default] pacct-format-plugin.c:38:3: warning: (near initialization for 'pacct_format_plugin.construct') [enabled by default] mv -f .deps/libpacctformat_la-pacct-format-plugin.Tpo .deps/libpacctformat_la-pacct-format-plugin.Plo pacct-format.c:155:1: error: unknown type name 'LogProtoOptions' pacct-format.c:155:98: error: conflicting types for 'options' pacct-format.c:155:41: note: previous definition of 'options' was here pacct-format.c: In function 'pacct_construct_proto': pacct-format.c:157:3: warning: implicit declaration of function 'log_proto_binary_record_server_new' [-Wimplicit-function-declaration] pacct-format.c:157:3: warning: 'return' with a value, in function returning void [enabled by default] pacct-format.c: At top level: pacct-format.c:162:3: error: unknown field 'alter_proto_options' specified in initializer pacct-format.c:162:26: error: 'pacct_alter_proto_options' undeclared here (not in a function) pacct-format.c:164:1: warning: initialization from incompatible pointer type [enabled by default] pacct-format.c:164:1: warning: (near initialization for 'pacct_handler.parse') [enabled by default] make[3]: *** [libpacctformat_la-pacct-format.lo] Erreur 1 This is a mageia cauldron system, 64 bits, with gcc 4.7.2. -- BOFH excuse #368: Failure to adjust for daylight savings time.

2 1

Need help upgrading from 2.0.4 to 3.2.5
by Edward Bailey 07 Feb '13

07 Feb '13

We have moved from OEL4 to OEL6 and I need help moving the 2.0.4 functionality to the new version of syslog-ng. I am having issues with our custom application logging which has very large messages and long stack traces. I am not seeing the same behavior in 3.2.5. In 3.2.5 I am seeing truncated messages and the first line of the stack trace is being logged to the correct facility local5 while the rest of the stack trace is being logged to /var/log/messages. Also the stack trace is not being preserved anymore. Instead every line is being treated as a new line and a new syslog entry. Our custom app logging is not the best and contains carriage returns which used to be stripped by 2.0.4 but that is not happening now. Can these behaviors from 2.0.4 be preserved in 3.2.5? Any suggestions are appreciated. Here is what I am trying to work with in 3.2.5 options { flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); stats_freq (50000); log_msg_size(8192); }; source s_sys { pipe("/proc/kmsg" log_prefix("kernel: ")); unix-dgram ("/dev/log" flags("no-multi-line")); internal(); udp(ip(127.0.0.1) port(514)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages" perm(0644)); }; destination d_mesgr { udp("remote syslog server" port(514)); }; destination d_auth { file("/var/log/secure"); }; destination d_authr { udp("remote syslog server" port(514)); }; destination d_mail { file("/var/log/maillog" flush_lines(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_cronr { udp("remote syslog server" port(514)); }; destination d_cust_app { file("/var/log/cust_app.log" owner("test") group("test") perm(0644)); }; destination d_kern { file("/var/log/kern"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info..emerg) and not (facility(mail) or facility(authpriv) or facility(cron) or facility(local5)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter9 { facility(local5); }; filter f_filter8 { facility(cron); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter1); destination(d_kern); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter2); destination(d_mesgr); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter3); destination(d_authr); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; log { source(s_sys); filter(f_filter8); destination(d_cronr); }; log { source(s_sys); filter(f_filter9); destination(d_cust_app); };

2 1

Host behind a NAT and multiple log files
by KERNEL - Mauricio Améndola 06 Feb '13

06 Feb '13

Hi everyone I've recently configured a syslog's server using syslog-ng and i have an issue to log from hosts that are outside my network in some place on internet. This is the thing, i have a few APs and a pfsense firewall/router. Each AP can log to a remote syslog server with a specific port. In my syslog server i add a new source, filter, destination and target and in pfsense box i create the rule to let pass trafic to the internal ap's IP. But the problem comes when i do the same for another AP, i configure another port but the syslog server doesn' t log. There is a way to log from remote multiple hosts that are behind just one public IP? Thanks in advance and sorry for my english. Regards, -- -- Mauricio Améndola Communications / Technical Department KERNEL Consultores Zabala 1327/402 , 11000, Montevideo, Uruguay T+(598-2) 915 6563 / (598-2) 915 9336

3 3

syslog-ng 3.4.1 has been released
by devel＠balabit.hu 02 Feb '13

02 Feb '13

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.4.1 SUMMARY : new stable release DATE : Jan 31, 2013 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.4.1) has been released. For latest fixes in the 3.4.x feature branch you are recommended to upgrade to this version. CHANGES: 3.4.1 Thu, 31 Jan 2013 11:00:00 +0100 This is the first stable release in the 3.4 series adding a number of features compared to 3.3, a culmination of more than a year's worth of development. Major features since 3.3 ======================== * New plugins: AMQP & SMTP destinations, JSON parser. See the following links for more details about them: http://git.io/mgF_sA (AMQP), http://git.io/Os9qpA (SMTP) and http://git.io/7MerYA (JSON parser) * New parsers for patterndb: HOSTNAME, EMAIL, PCRE and LLADDR. * It is now possible to control what db-parser() sees as its input via it's new template() option. (Defaults to $MESSAGE) See http://git.io/YZHPtg for more details. * value-pairs() gained support for programmatically rewriting key names in bulk, via the rekey() method. See http://git.io/VylQUg for more details. * The network() driver is introduced, unifying and extending tcp(), udp(), syslog(), unix-dgram() and unix-stream(). The old drivers are still available, but migrating over to network() is encouraged. See http://git.io/0Xjlhg for more details. * Support for junctions & channels were added, which improve the flexibility of the syslog-ng configuration language. This allows combining sources with their closely tied processing functionality (like parser, rewrite and filter statements). Read this blog post for more information: http://goo.gl/T8Txa In the final form of the functionality the "log" keyword as described in the blog post above was replaced with "channel". Changes since 3.4.0rc2: ======================= Bugfixes ======== * PatternDB allows a wider range of characters in a class value now. Newly allowed chars are: %, :, @, +, !, ^, / and \. * The fsync() and flush-lines() functionality was restored in the file() destination, both work as expected and correctly now. * The set() and subst() rewrite operations were fixed to work even when referenced from multiple places (and in a number of different corner-cases too). Credits: ======== syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Balazs Scheidler <bazsi(a)balabit.hu> Evan Rempel <erempel(a)uvic.ca> Gergely Nagy <algernon(a)balabit.hu> Johnson, Chris <chris.johnson3(a)hp.com> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

3 2