March 2014 - syslog-ng - lists.balabit.hu

[Bug 275] New: lib/filter/filter-in-list. c does not compile under Solaris 10
by bugzilla＠bugzilla.balabit.com 28 Aug '14

28 Aug '14

https://bugzilla.balabit.com/show_bug.cgi?id=275 Summary: lib/filter/filter-in-list.c does not compile under Solaris 10 Product: syslog-ng Version: 3.5.x Platform: PC OS/Version: Solaris Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: michael.hocke(a)nyu.edu Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=93) --> (https://bugzilla.balabit.com/attachment.cgi?id=93) diff for misc.c and misc.h lib/filter/filter-in-list.c uses getline() that is not available in Solaris 10. I worked around it by adding code snippets to lib/misc.h and lib/misc.c that implement getdelim and getline that I took from another project. I was ablt to make it work but I assume it wasn't the most elegant solution and should be integrated into autoconfig etc. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

[Bug 211] New: dbparser pattern order breaks validation
by bugzilla＠bugzilla.balabit.com 29 May '14

29 May '14

https://bugzilla.balabit.com/show_bug.cgi?id=211 Summary: dbparser pattern order breaks validation Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 If two log lines share a common leading portion such as; xlog: backup pg_xlog/000000010000014700000076 xlog: backup pg_xlog/000000010000014700000076 failed then the order of the patterns in the pattern database xml file is important. For example, if the two patterns used are; xlog: backup pg_xlog/@SET:xid:0123456789ABCDEF@ xlog: backup pg_xlog/@SET:xid:0123456789ABCDEF@ failed and the shorter pattern is first, it will match BOTH of the above lines because it matches the leading portion of both lines. If the patterns are entered with the longer pattern first, then the longer pattern will fail on the shorter message, allowing the match to fall through to the shorter pattern matcher, but will match the longer message. I expect the behavior of the dbparser to match with the pattern containing the MOST total static content that also matches all of the parsing macros. Some method where the order is not important need to be used. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

CSV-Parser Conditions
by Justin B 20 Apr '14

20 Apr '14

Need information on this.I am using the CSV-PARSER and I want to put a condition that if a column is empty do not apply the CSV-PARSER but write the line. Primarily i get the application logs and i dont want to apply the CSV-Parser on those log lines where the whole error stack is there. Can someone help on this?? -- Kaladhar

2 5

[Bug 261] New: DOCBUG: --rekey
by bugzilla＠bugzilla.balabit.com 15 Apr '14

15 Apr '14

https://bugzilla.balabit.com/show_bug.cgi?id=261 Summary: DOCBUG: --rekey Product: syslog-ng Version: 3.5.x Platform: PC OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.balabit(a)faxm0dem.org Type of the Report: --- Estimated Hours: 0.0 In Example 2.3. (Using the rekey() option) from §2.10.1. (Specifying data types in value-pairs) the documentation claims: "The rekey() option can be used with the format-json template-function as well, using the following syntax: $(format-json --key .cee.* --rekey --shift 4 --add-prefix events.)" However, when using this syntax, the config parser fails with the following error: "Error parsing config, Error compiling template (Error parsing value-pairs: expected an equal sign in key=value pair)" The correct syntax (which works, as suggested by algeron on IRC) would be the following: $(format-json --rekey .cee.* --add-prefix events. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

Stats on destinations with macro's ?
by Scot 09 Apr '14

09 Apr '14

Is there a trick to get stats on destinations with macros ? I get stats on my FIFO, local, net work destinations but not on the destinations with macros. Also I don't see any difference in the stats output using any level level 1,2,3. Syslog-ng restarted after each conf change Sent from my iPad

6 11

[Bug 276] New: bundled rabbitmq-c does not compile on Solaris
by bugzilla＠bugzilla.balabit.com 07 Apr '14

07 Apr '14

https://bugzilla.balabit.com/show_bug.cgi?id=276 Summary: bundled rabbitmq-c does not compile on Solaris Product: syslog-ng Version: 3.5.x Platform: PC OS/Version: Solaris Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: michael.hocke(a)nyu.edu Type of the Report: --- Estimated Hours: 0.0 Created an attachment (id=94) --> (https://bugzilla.balabit.com/attachment.cgi?id=94) patch for Makefile.in and amqp_private.h The bundled rabbitmq-c library needs htonll and ntohll that do not exist in Solaris 10. I added a couple defines to modules/afamqp/rabbitmq-c/librabbitmq/amqp_private.h that implement those two functions. I also had to force the linker to add -lsocket and -lnsl for a successful compile. This is probably more of a problem with rabbitmq-c but since it is bundled with syslog-ng I thought I should report it here. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

syslog-ng: lua, monitoring
by Peter Czanik 04 Apr '14

04 Apr '14

Hi, As not everyone is subscribed to the BalaBit blog rss feed, here are a couple of interesting blogs how to use syslog-ng in even more situations: Extending syslog-ng with lua scripts as destination: https://talien.blogs.balabit.com/2014/03/lua-destination-examples/ Monitoring with syslog-ng: https://talien.blogs.balabit.com/2014/03/monitoring-with-syslog-ng/ Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

2 1

SQL destination - inserting data into ARRAY column
by Tomáš Novosad 02 Apr '14

02 Apr '14

Hello everyone, i'm using syslog-ng to parse/store some logs into PostgreSQL database. I've got full control of the data being logged, because it is produced in my perl code. Data are logged into syslog and written unchanged into file, and in separate log statement, data are parsed into macros and inserted into database. There is a column which hold a list of email addresses. The column in database is defined as array of text (mail_to TEXT[]). This works fine, as the value is being parsed into macro, and this is enclosed in brackets. In detail log statement looks like: mail_to="addr1,addr2" which is parsed with pattern db into a macro ${mflog.to} then the macro is surrounded by brackets - this is done with set statement: set("{${mfstat.to}}", value("mfstat.to")); Syslog then insert this value into postgres:'{addr1,addr2}' Postgres successfuly parses the string and store it as two-element array [addr1,addr2]. This works just fine, but now to my problem. I also want to store another ARRAY colum, which is not of TEXT type, but a custom data type. The definition in database looks like: (parts part_data[]) where part_data is my custom type defined in postgres. Problems comes when i try to insert such data via syslog. My perl program produces this line which is sent to syslog: parts="(part1,20,bla),(part2,234,bli)" this is again parsed into macro and macro is again surronded by brackets. So syslog tries to insert this '{(part1,20,bla),(part2,234,bli)}' which fails because target column if of type part_data[], but postgres parses the string as text[]. Therfore i need to explicitly instruct postgres to do a data conversion. This can be easily achieved by adding the conversion to input string '{(part1,20,bla),(part2,234,bli)}'::part_data[] however i do no know how to achieve this, as the literal text '::part_data[]' is just outside the single qutes. I just do not know how to instruct syslog-ng to add extra text ::part_data[] just after the last single quote. All the inserted values are simple strings and i do not know how to add some extramodifications to that strings. Is there any way to do such thing? Similar thing would be for example running some function on inserted value. Let's say i would like the insert to look like this "INSERT into table (col1) VALUES (some_postgres_func(val1))" How do i set the sql destination in syslog-ng to achieve this? Many thanks for any ideas. -- Tomáš Novosad

2 2

Structured Data
by Ou, Jimmy 01 Apr '14

01 Apr '14

Hello, I am having problem removing the structured data in the syslog message. My test logs show the following: <113>1 2014-11-25T11:00:00+00:00 10.1.1.1 RedBox - - [meta sequenceId="16"] @cee:[{"host":"10.1.1.1"}] I want it to look like the following without the sequenceId tag: <113>1 2014-11-25T11:00:00+00:00 10.1.1.1 RedBox - - - @cee:[{"host":"10.1.1.1"}] Is there an option to turn this meta data off? Thanks, Jimmy

2 2

Filter out host from netmask range
by Ian Hasund 31 Mar '14

31 Mar '14

I am trying to remove a specific set of hosts from a network range using filters. for example, I have the following: filter f_home_subnet { ( netmask("192.168.0.0/24") ); }; I now want to exclude some specific hosts, let's say 192.168.0.10 and 192.168.0.20. My attempts of adding "not host" to the above doesn't seem to work. Any pointers / suggestions would be greatly appreciated. Thanks, Ian

3 4