June 2014 - syslog-ng - lists.balabit.hu

[Bug 275] New: lib/filter/filter-in-list. c does not compile under Solaris 10
by bugzilla＠bugzilla.balabit.com 28 Aug '14

28 Aug '14

https://bugzilla.balabit.com/show_bug.cgi?id=275 Summary: lib/filter/filter-in-list.c does not compile under Solaris 10 Product: syslog-ng Version: 3.5.x Platform: PC OS/Version: Solaris Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: michael.hocke(a)nyu.edu Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=93) --> (https://bugzilla.balabit.com/attachment.cgi?id=93) diff for misc.c and misc.h lib/filter/filter-in-list.c uses getline() that is not available in Solaris 10. I worked around it by adding code snippets to lib/misc.h and lib/misc.c that implement getdelim and getline that I took from another project. I was ablt to make it work but I assume it wasn't the most elegant solution and should be integrated into autoconfig etc. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

[Bug 280] New: Memory leak in value-pairs.c
by bugzilla＠bugzilla.balabit.com 08 Jul '14

08 Jul '14

https://bugzilla.balabit.com/show_bug.cgi?id=280 Summary: Memory leak in value-pairs.c Product: syslog-ng Version: 3.5.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sgounaro(a)optonline.net Type of the Report: bug Estimated Hours: 0.0 Hi , it looks like vp_walker_name_value_split_add_name_token has a memory leak in g_strndup call. Running syslog-ng with a lot of messages coming in about ~800 per sec , starts with 139m of memory and ends up with 9gig of memory in a day being used. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

Properly forwarding syslog messages
by James Lay 07 Jul '14

07 Jul '14

Hey all, So I've looked around and I'm just not sure what the best method is for forwarding syslog messages. I have a current setup that is working well. I'd like to try and get all the messages forward to another machine using standard udp 514. I'd like the messages to appear as if they are coming from the originating machine, not the syslog server. I did see a couple sites that say I have to compile with spoofing. Can anyone point me to some resources to do this? Thank you. James

2 3

[ANN] syslog-ng 3.5 and 3.6 release plans
by Gergely Nagy 24 Jun '14

24 Jun '14

Hi! I described my plans for syslog-ng maintainance last October[1], and promised that I will give ample warning when 3.6 is about to hit beta. Here's the warning: I plan to release either an alpha, or a beta of 3.6 in early September (I will aim for beta, with an alpha in August), at which point, the 3.3 branch will no longer be maintained, and will be removed from my Debian repository[2] too. At that point, 3.4 will become a maintainance release, 3.5 will be stable, and 3.6 will be the feature branch. [1]: https://lists.balabit.hu/pipermail/syslog-ng/2013-October/020831.html [2]: http://asylum.madhouse-project.org/projects/debian/ However, I'd like to cut down on my tasks, and trying to maintain three versions of syslog-ng is quite a big burden, and I feel I'm not really doing a good job of taking care of the oldest version. Therefore, I'll try to deprecate 3.4 much quicker, and came up with the following plan: * When 3.5.5 is released (mid-July, if all goes well), I will switch the "syslog-ng" component of my Debian repo to 3.5. "syslog-ng-devel" will point to the same place. The 3.4 branch will remain available under the "syslog-ng-3.4" component, of course. One reason I feel this is safe to do, is because most distros migrated to 3.5 already, so 3.4 is not really in use. Also, with 3.5, you get the Incubator as a bonus, and increasing Incubator use would be great, too. * When 3.6 hits, I'd like to declare 3.4 "deprecated", and stop supporting it in a few months. This means that in 2015, I'd like to maintain only 3.5 and 3.6. This could all change, mind you, if there's enough demand for the maintainance of three versions. If you have good reasons for using 3.4, or wishing there were three maintained branches, do let me know! -- |8]

1 0

New release: puppet module for patterndb
by Fabien Wernli 23 Jun '14

23 Jun '14

Hi, I'm proud to announce the availability of version 2.0.0 of the patterndb puppet module. This new release adds the possibility to manage multiple pattern parsers, and fixes a number of bugs. cheers https://forge.puppetlabs.com/ccin2p3/patterndb

1 0

[Bug 279] New: Syslog-ng central loging server seg fault gentoo
by bugzilla＠bugzilla.balabit.com 23 Jun '14

23 Jun '14

https://bugzilla.balabit.com/show_bug.cgi?id=279 Summary: Syslog-ng central loging server seg fault gentoo Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: critical Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: hlavacek(a)gmx.com Type of the Report: bug Estimated Hours: 0.0 Hello, we have set up the following topology: OS gentoo: Linux syslog1 3.8.12-hardened #1 SMP Wed Sep 18 16:30:57 CEST 2013 x86_64 Intel(R) Xeon(TM) CPU 3.00GHz GenuineIntel GNU/Linux syslog: syslog server v3.4.7 and 40 syslog clients v3.x.x. problem: After a few days (5 or 10) server experienced segfault: [309942.605750] syslog-ng[17117]: segfault at 8 ip 00007fdb01e66609 sp 00007fdafe1ccac0 error 6 in libsyslog-ng-3.4.7.so[7fdb01e2b000+8f000] and then after two days with any error syslog-ng freezed in loop (cpu 100%), strace: futex(0x7fdc64009ca0, FUTEX_WAIT_PRIVATE, 2, NULL This scenario is being periodicaly repeated. We have faced this problem also with version 3.3 of syslog. BACKTRACE after segfault: syslog1 run # gdb syslog-ng -c core.syslog.201422041822 GNU gdb (Gentoo 7.6.2 p1) 7.6.2 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-pc-linux-gnu". For bug reporting instructions, please see: <http://bugs.gentoo.org/>... Reading symbols from /usr/sbin/syslog-ng...(no debugging symbols found)...done. [New LWP 26604] [New LWP 24631] [New LWP 1932] [New LWP 1933] [New LWP 1710] [New LWP 1456] [New LWP 1931] [New LWP 1713] [New LWP 1749] warning: Could not load shared library symbols for linux-vdso.so.1. Do you need "set solib-search-path" or "set sysroot"? [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". Core was generated by `syslog-ng --enable-core -c /var/run/syslog-ng-remote.ctl --persist-file /var/li'. Program terminated with signal 11, Segmentation fault. #0 0x00007f03fdb44a59 in ?? () from /usr/lib64/libsyslog-ng-3.4.7.so (gdb) bt full #0 0x00007f03fdb44a59 in ?? () from /usr/lib64/libsyslog-ng-3.4.7.so No symbol table info available. #1 0x00007f03fdb44b6a in ?? () from /usr/lib64/libsyslog-ng-3.4.7.so No symbol table info available. #2 0x00007f03fdb4cf35 in ?? () from /usr/lib64/libsyslog-ng-3.4.7.so No symbol table info available. #3 0x00007f03fdb6d42b in ?? () from /usr/lib64/libsyslog-ng-3.4.7.so No symbol table info available. #4 0x00007f03fdb6c3c2 in iv_run_tasks () from /usr/lib64/libsyslog-ng-3.4.7.so No symbol table info available. #5 0x00007f03fdb6ee1b in iv_main () from /usr/lib64/libsyslog-ng-3.4.7.so No symbol table info available. #6 0x00007f03fdb6d21a in ?? () from /usr/lib64/libsyslog-ng-3.4.7.so No symbol table info available. #7 0x00007f03fdb6f736 in ?? () from /usr/lib64/libsyslog-ng-3.4.7.so No symbol table info available. #8 0x00007f03fd5bcbd8 in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #9 0x00007f03fd2f7bbd in clone () from /lib64/libc.so.6 No symbol table info available. (gdb) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 9

Internal error, duplicate configuration elements...
by David Hauck 15 Jun '14

15 Jun '14

Hi, I've been playing around with configuring UDP destinations. My syntax checks ('syslog-ng -s') and high-level operation appear to be sound. However, I've noticed the following "internal error" that's issued whenever I start the service: 20140604 09:54:47.780 err syslog(syslog-ng):Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_dd_connection(dgram,205.159.216.207:514)' The UDP configuration references from 'syslog-ng.conf' are as follows: destination d_NAaudit_Prio { file("/var/log/netacquire/audit_log" template(t_NAFormat_Prio)); udp("205.159.216.207" port(514) template(t_NAFormat_Prio)); }; destination d_NAmessage_Prio { udp("205.159.216.207" port(514) template(t_NAFormat_Prio)); }; Does anyone know what this message is referring too? Things seem to work fine (e.g., log statements with these destinations do, ultimately, send the filtered messages to the target system), so I'm wondering if I need to be concerned at all. Thanks, -David

4 9

Salt plugin for syslog-ng config file generation
by Tibor Benke 11 Jun '14

11 Jun '14

Hi All, My name is Tibor Benke and I'm a participant of GSoC 2014. I wrote a state module for Salt which is able to generate syslog-ng configuration from YAML format. With this approach, you can deploy syslog-ng configurations simultaneously on thousands of computers based on their operating system or other parameters. It's in beta state, but the configuration generation works. If you want to try it, you can find a HOWTO here: https://github.com/ihrwein/salt/wiki/Syslog-ng-state-HOWTO And my blog here: http://btibi.blogspot.hu/ Regards, Tibi

1 0

Syslog-NG directory name with IP address instead of hostname
by Justin B 11 Jun '14

11 Jun '14

Hi When I receive the application messaged from a different server to my syslog-ng server it is trying to create the messages under the directory name with IP address instead of the Application Server Hostname. What can be done baout this?? i used the following options in syslog-ng.conf options { use_fqdn(no); flush_lines(0); keep_hostname(yes); check_hostname(yes); chain_hostnames(yes); create_dirs(yes); dir_owner(root); dir_group(test); dir_perm(0750); #use_dns(persist_only); use_dns(yes); #dns_cache_hosts(/etc/hosts); dns_cache(yes); dns_cache_expire(87600); ts_format(iso); # keep_timestamp(no); }; -- Appreciate your quick help.. Kaladhar

3 4

syslog-ng 3.4.8 has been released
by devel＠balabit.hu 06 Jun '14

06 Jun '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.4.8 SUMMARY : new stable release DATE : Jun 6, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.4.8) has been released. For latest fixes in the 3.4.x feature branch you are recommended to upgrade to this version. CHANGES: 3.4.8 Fri, 6 Jun 2014 12:05:59 +0200 This is the seventh bug-fix release for the 3.4.x series, with a set of important fixes over 3.4.7 released last December. Upgrading to this release is highly recommended. Features ======== * Support for tzif3 format timezone files (used by recent releases of the tzdata package) was implemented. * SDATA enterprise IDs are now handled correctly when using value-pairs, they will not be needlessly split up into smaller chunks. Bugfixes ======== * Drivers using value-pairs() (mongodb, format-json, etc) were made more robust, and will not behave strangely anymore when using higher compiler optimisation levels. * The DATE macro in most value-pairs() scopes will now always contain the stamp time, as opposed to sometimes the received or the stamp time. * The syslog-proto (rfc5424) scope of value-pairs() now includes SDATA too. * The $SEQNUM macro is now correctly handled by the $(format-json) template function. * Drivers using value-pairs() will now work correctly when a macro is specified in a key() statement. * When using the same json-parser() in multiple log paths, syslog-ng no longer crashes when no marker was set. * When a GeoIP lookup fails, handle it gracefully, avoiding an annoying glib warning. * When running in a FreeBSD jail, the system() source will not use /dev/klog. * Various memory leaks were plugged (related to internal locking, and value-pairs). * When building from Git, the grammar files are now build-able with bison 3+. Builds from tarballs are unaffected. Miscellaneous changes ===================== * The host() and port() options of the MongoDB destination driver have been labelled as deprecated. They already were, just not marked so. * The username() and password() options of the AMQP driver were made mandatory. Credits ======= syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Andras Mitzki <micek(a)balabit.hu> Balazs Scheidler <bazsi(a)balabit.hu> Daniel Gados <gdani(a)balabit.hu> Fabien Wernli Gergely Nagy <algernon(a)balabit.hu> Igor Ippolitov <iippolitov(a)gmail.com> Laszlo Meszaros <lmesz(a)balabit.hu> Nick Alcock <nix(a)esperi.org.uk> Peter Czanik <czanik(a)balabit.hu> Tibor Benke <btibi(a)balabit.hu> Viktor Tusa <tusa(a)balabit.hu> Xufeng Zhang <xufeng.zhang(a)windriver.com> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0