March 2017 - syslog-ng - lists.balabit.hu

syslog-ng buffer and reload
by Fabien Wernli 13 Apr '17

13 Apr '17

Hi, I'm using the disk queue to buffer the writes to elasticsearch. I notices the following behaviour: When reloading the configuration (`syslog-ng-ctl reload`), syslog-ng stops processing incoming messages (they appear as `dropped` in stats) and starts emptying the queue. It only starts accepting new messages when the queue is completely empty. I understand this is probably an expected behaviour, but in the following scenario (I just experienced) it poses a problem: 1. some application goes bananas logging at zillions of events per second 2. syslog-ng queue starts filling up 3. crazy app identified: I modify syslog-ng.conf in order to filter out the app 4. syslog-ng-ctl reload 5. syslog-ng starts dropping all new messages and emptying the queue 6. I have to wait for the queue to be empty (which can take a long time) Wouldn't it be saner to continue accepting messages when intercepting the HUP?

4 6

syslog-ng on FreeBSD
by Czanik, Péter 29 Mar '17

29 Mar '17

Hi, Last weekend syslog-ng 3.9.1 became available on FreeBSD in the sysutils/syslog-ng-devel port. The default syslog-ng port, sysutils/syslog-ng still points to syslog-ng 3.7. If you use syslog-ng on FreeBSD, please test 3.9.1 as I plan to promote 3.9.1 as the default syslog-ng version in ports. (I am only aware of a single problem when upgrading from earlier versions to 3.9.1, but that's Linux only: https://github.com/balabit/syslog-ng/issues/1395) Let me know, if you run into any troubles with 3.9.1, so it can be fixed before the change. Thanks, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0

patterndb Joining rulesets with mismatching program name sets
by Fabien Wernli 29 Mar '17

29 Mar '17

Hi, It seems somewhere between 3.7 and 3.8 my patterndb broke validation tests. When running `pdbtool test` I now get: Joining rulesets with mismatching program name sets This helpful message seems to be right if I understand it correctly: <ruleset name='pam_unix' id='72d75cb0-0107-4d12-b0bf-cea36ddf7f38'> <patterns> <pattern>sshd</pattern> <pattern>crond</pattern> <pattern>imap</pattern> <pattern>imapd</pattern> <pattern>login</pattern> <pattern>pam</pattern> <pattern>pure-ftpd</pattern> <pattern>proftpd</pattern> <pattern>su</pattern> <pattern>sudo</pattern> <ruleset name='cron' id='3a8efec5-6974-4b4a-b203-3247fe235812'> <patterns> <pattern>crond</pattern> <pattern>CROND</pattern> </patterns> Since when, and why is this illegal now? Thanks

3 5

Fwd: Memory Leak in syslog-ng 3.9.1
by Arnob Ghosh 28 Mar '17

28 Mar '17

Hi, We are observing memory leak with syslog-ng 3.9.1 while testing with Valgrind in x86 system. Please find attached valgrind report with below command. G_SLICE=always-malloc valgrind -v --log-file=valgrind.log --leak-check=full --show-leak-kinds=all syslog-ng -F --enable-core ==2104== Memcheck, a memory error detector ==2104== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al. ==2104== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info ==2104== Command: syslog-ng -F --enable-core ==2104== Parent PID: 2103 ==2104== --2104-- --2104-- Valgrind options: --2104-- -v --2104-- --log-file=valgrind.log --2104-- --leak-check=full --2104-- Contents of /proc/version: --2104-- Linux version 3.10.104.cge-rt117 (ferret@bamboo) (gcc version 4.7.0 (MontaVista Linux G++ 4.7-170301090024) ) #1 SMP PREEMPT Thu Mar 9 08:50:32 IST 2017 --2104-- Arch and hwcaps: AMD64, LittleEndian, amd64-cx16-lzcnt-rdtscp-sse3-avx-avx2-bmi --2104-- Page sizes: currently 4096, max supported 4096 --2104-- Valgrind library directory: /usr/lib64/valgrind --2104-- Reading syms from /usr/sbin/syslog-ng --2104-- Considering /usr/sbin/syslog-ng .. --2104-- .. CRC mismatch (computed 6ecb1f66 wanted 2175c4e1) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/valgrind/memcheck-amd64-linux --2104-- Considering /usr/lib64/valgrind/memcheck-amd64-linux .. --2104-- .. CRC mismatch (computed a66f1e19 wanted 8057359b) --2104-- object doesn't have a symbol table --2104-- object doesn't have a dynamic symbol table --2104-- Reading syms from /lib64/ld-2.16.so --2104-- Considering /lib64/ld-2.16.so .. --2104-- .. CRC mismatch (computed bcd9793b wanted d7ac4eab) --2104-- Considering /lib64/.debug/ld-2.16.so .. --2104-- .. CRC is valid --2104-- Scheduler: using generic scheduler lock implementation. --2104-- Reading suppressions file: /usr/lib64/valgrind/default.supp ==2104== embedded gdbserver: reading from /tmp/vgdb-pipe-from-vgdb-to-2104-by-root-on-??? ==2104== embedded gdbserver: writing to /tmp/vgdb-pipe-to-vgdb-from-2104-by-root-on-??? ==2104== embedded gdbserver: shared mem /tmp/vgdb-pipe-shared-mem-vgdb-2104-by-root-on-??? ==2104== ==2104== TO CONTROL THIS PROCESS USING vgdb (which you probably ==2104== don't want to do, unless you know exactly what you're doing, ==2104== or are doing some strange experiment): ==2104== /usr/lib64/valgrind/../../bin/vgdb --pid=2104 ...command... ==2104== ==2104== TO DEBUG THIS PROCESS USING GDB: start GDB like this ==2104== /path/to/gdb syslog-ng ==2104== and then give GDB the following command ==2104== target remote | /usr/lib64/valgrind/../../bin/vgdb --pid=2104 ==2104== --pid is optional if only one valgrind process is running ==2104== --2104-- REDIR: 0x3331417930 (ld-linux-x86-64.so.2:strlen) redirected to 0x380742d1 (???) --2104-- Reading syms from /usr/lib64/valgrind/vgpreload_core-amd64-linux.so --2104-- Considering /usr/lib64/valgrind/vgpreload_core-amd64-linux.so .. --2104-- .. CRC mismatch (computed 12fcda0f wanted d650c1e1) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so --2104-- Considering /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so .. --2104-- .. CRC mismatch (computed 112626bf wanted 5a5b2993) --2104-- object doesn't have a symbol table ==2104== WARNING: new redirection conflicts with existing -- ignoring it --2104-- old: 0x3331417930 (strlen ) R-> (0000.0) 0x380742d1 ??? --2104-- new: 0x3331417930 (strlen ) R-> (2007.0) 0x04a09500 strlen --2104-- REDIR: 0x3331417880 (ld-linux-x86-64.so.2:index) redirected to 0x4a090e0 (index) --2104-- REDIR: 0x3331417900 (ld-linux-x86-64.so.2:strcmp) redirected to 0x4a0a5b0 (strcmp) --2104-- REDIR: 0x3331418940 (ld-linux-x86-64.so.2:mempcpy) redirected to 0x4a0ce90 (mempcpy) --2104-- Reading syms from /usr/lib64/libsyslog-ng-3.9.so.0.0.0 --2104-- Considering /usr/lib64/libsyslog-ng-3.9.so.0.0.0 .. --2104-- .. CRC mismatch (computed 145c4fb7 wanted 143409f9) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/libssl.so.1.0.0 --2104-- Considering /usr/lib64/libssl.so.1.0.0 .. --2104-- .. CRC mismatch (computed bff95ff2 wanted e1f317f8) --2104-- object doesn't have a symbol table --2104-- Reading syms from /lib64/libcrypto.so.1.0.0 --2104-- Considering /lib64/libcrypto.so.1.0.0 .. --2104-- .. CRC mismatch (computed 0f7afdd4 wanted 67e91cbf) --2104-- object doesn't have a symbol table --2104-- Reading syms from /lib64/libuuid.so.1.3.0 --2104-- Considering /lib64/libuuid.so.1.3.0 .. --2104-- .. CRC mismatch (computed e44bde93 wanted bee5b57e) --2104-- object doesn't have a symbol table --2104-- Reading syms from /lib64/libnsl-2.16.so --2104-- Considering /lib64/libnsl-2.16.so .. --2104-- .. CRC mismatch (computed a4a8f693 wanted c21578ab) --2104-- Considering /lib64/.debug/libnsl-2.16.so .. --2104-- .. CRC is valid --2104-- Reading syms from /usr/lib64/libgmodule-2.0.so.0.3400.3 --2104-- Considering /usr/lib64/libgmodule-2.0.so.0.3400.3 .. --2104-- .. CRC mismatch (computed 56b50299 wanted 0faed9bb) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/libgthread-2.0.so.0.3400.3 --2104-- Considering /usr/lib64/libgthread-2.0.so.0.3400.3 .. --2104-- .. CRC mismatch (computed e16c9722 wanted 49f05f96) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/libglib-2.0.so.0.3400.3 --2104-- Considering /usr/lib64/libglib-2.0.so.0.3400.3 .. --2104-- .. CRC mismatch (computed 8b7f406d wanted d25a28ff) --2104-- object doesn't have a symbol table --2104-- Reading syms from /lib64/libpthread-2.16.so --2104-- Considering /lib64/libpthread-2.16.so .. --2104-- .. CRC mismatch (computed c0d22d21 wanted b4f3247d) --2104-- Considering /lib64/.debug/libpthread-2.16.so .. --2104-- .. CRC is valid --2104-- Reading syms from /lib64/librt-2.16.so --2104-- Considering /lib64/librt-2.16.so .. --2104-- .. CRC mismatch (computed 2d230dcc wanted efd16a99) --2104-- Considering /lib64/.debug/librt-2.16.so .. --2104-- .. CRC is valid --2104-- Reading syms from /usr/lib64/libevtlog.so.0.0.0 --2104-- Considering /usr/lib64/libevtlog.so.0.0.0 .. --2104-- .. CRC mismatch (computed 6a1cc924 wanted 5502f762) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/libpcre.so.1.2.7 --2104-- Considering /usr/lib64/libpcre.so.1.2.7 .. --2104-- .. CRC mismatch (computed 610e8772 wanted b6a438f6) --2104-- object doesn't have a symbol table --2104-- Reading syms from /lib64/libdl-2.16.so --2104-- Considering /lib64/libdl-2.16.so .. --2104-- .. CRC mismatch (computed 6231c842 wanted 8e630476) --2104-- Considering /lib64/.debug/libdl-2.16.so .. --2104-- .. CRC is valid --2104-- Reading syms from /lib64/libc-2.16.so --2104-- Considering /lib64/libc-2.16.so .. --2104-- .. CRC mismatch (computed 89e7ac0b wanted 542d8abb) --2104-- Considering /lib64/.debug/libc-2.16.so .. --2104-- .. CRC is valid --2104-- REDIR: 0x3331885e60 (libc.so.6:strcasecmp) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331882210 (libc.so.6:strnlen) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331888130 (libc.so.6:strncasecmp) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x33318822f0 (libc.so.6:strncmp) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331880600 (libc.so.6:strcmp) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331883c00 (libc.so.6:__GI_strrchr) redirected to 0x4a08df0 (__GI_strrchr) --2104-- REDIR: 0x3331882130 (libc.so.6:__GI_strlen) redirected to 0x4a09460 (__GI_strlen) --2104-- REDIR: 0x3331882330 (libc.so.6:__GI_strncmp) redirected to 0x4a09bf0 (__GI_strncmp) --2104-- REDIR: 0x333187c210 (libc.so.6:malloc) redirected to 0x4a088a0 (malloc) --2104-- REDIR: 0x33318820e0 (libc.so.6:strlen) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x333194ca10 (libc.so.6:__strlen_sse2_pminub) redirected to 0x4a09440 (strlen) --2104-- REDIR: 0x333188a810 (libc.so.6:memcpy@@GLIBC_2.14) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331931dd0 (libc.so.6:__memcpy_ssse3_back) redirected to 0x4a0a980 (memcpy@@GLIBC_2.14) --2104-- REDIR: 0x333187cbc0 (libc.so.6:calloc) redirected to 0x4a06730 (calloc) --2104-- REDIR: 0x33319244c0 (libc.so.6:__strcasecmp_avx) redirected to 0x4a09d40 (strcasecmp) --2104-- REDIR: 0x3331883ca0 (libc.so.6:strpbrk) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331924230 (libc.so.6:__strpbrk_sse42) redirected to 0x4a0d240 (strpbrk) --2104-- REDIR: 0xffffffffff600000 (???:???) redirected to 0x380742b3 (???) --2104-- REDIR: 0x3331899810 (libc.so.6:strstr) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x333191f060 (libc.so.6:__strstr_sse42) redirected to 0x4a0d1b0 (__strstr_sse42) --2104-- REDIR: 0x3331880540 (libc.so.6:index) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x333191d080 (libc.so.6:__strchr_sse42) redirected to 0x4a08fe0 (index) --2104-- REDIR: 0x3331883b80 (libc.so.6:strncpy) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x33318905e0 (libc.so.6:__strncpy_sse2_unaligned) redirected to 0x4a09a50 (__strncpy_sse2_unaligned) --2104-- REDIR: 0x333191d130 (libc.so.6:__strcmp_sse42) redirected to 0x4a0a560 (__strcmp_sse42) --2104-- REDIR: 0x333187c800 (libc.so.6:free) redirected to 0x4a07600 (free) --2104-- REDIR: 0x3331885cc0 (libc.so.6:stpcpy) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x33318915c0 (libc.so.6:__stpcpy_sse2_unaligned) redirected to 0x4a0c0a0 (__stpcpy_sse2_unaligned) --2104-- REDIR: 0x333187c890 (libc.so.6:realloc) redirected to 0x4a08aa0 (realloc) --2104-- REDIR: 0x3331884c40 (libc.so.6:memset) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331884c80 (libc.so.6:__GI_memset) redirected to 0x4a0c440 (memset) --2104-- REDIR: 0x333188bd10 (libc.so.6:strchrnul) redirected to 0x4a0cab0 (strchrnul) --2104-- REDIR: 0x333188a860 (libc.so.6:__GI_memcpy) redirected to 0x4a0aee0 (__GI_memcpy) --2104-- REDIR: 0x333191dee0 (libc.so.6:__strncmp_sse42) redirected to 0x4a09cd0 (__strncmp_sse42) --2104-- REDIR: 0x3331885d00 (libc.so.6:__GI_stpcpy) redirected to 0x4a0bf00 (__GI_stpcpy) --2104-- REDIR: 0x3331884630 (libc.so.6:bcmp) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331947340 (libc.so.6:__memcmp_sse4_1) redirected to 0x4a0bd40 (__memcmp_sse4_1) --2104-- REDIR: 0xffffffffff600400 (???:???) redirected to 0x380742bd (???) --2104-- REDIR: 0x33318994b0 (libc.so.6:__GI_strstr) redirected to 0x4a0d120 (__strstr_sse2) --2104-- REDIR: 0x33318842e0 (libc.so.6:memchr) redirected to 0x4a0a650 (memchr) --2104-- REDIR: 0x333188f970 (libc.so.6:__GI_strncpy) redirected to 0x4a097f0 (__GI_strncpy) --2104-- REDIR: 0x3331925b30 (libc.so.6:__strncasecmp_avx) redirected to 0x4a09e20 (strncasecmp) --2104-- REDIR: 0x3331880640 (libc.so.6:__GI_strcmp) redirected to 0x4a0a4c0 (__GI_strcmp) --2104-- Reading syms from /lib64/libnss_files-2.16.so --2104-- Considering /lib64/libnss_files-2.16.so .. --2104-- .. CRC mismatch (computed b7fe16f9 wanted c162f3cb) --2104-- Considering /lib64/.debug/libnss_files-2.16.so .. --2104-- .. CRC is valid --2104-- REDIR: 0x3331881ad0 (libc.so.6:__GI_strcpy) redirected to 0x4a095f0 (__GI_strcpy) --2104-- REDIR: 0x333188bac0 (libc.so.6:rawmemchr) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x333188bb00 (libc.so.6:__GI___rawmemchr) redirected to 0x4a0cb00 (__GI___rawmemchr) --2104-- Reading syms from /lib64/libnss_mdns4_minimal.so.2 --2104-- Considering /lib64/libnss_mdns4_minimal.so.2 .. --2104-- .. CRC mismatch (computed ede24083 wanted 0166de0d) --2104-- object doesn't have a symbol table --2104-- Reading syms from /lib64/libnss_dns-2.16.so --2104-- Considering /lib64/libnss_dns-2.16.so .. --2104-- .. CRC mismatch (computed 581b33f0 wanted efff06f8) --2104-- Considering /lib64/.debug/libnss_dns-2.16.so .. --2104-- .. CRC is valid --2104-- Reading syms from /lib64/libresolv-2.16.so --2104-- Considering /lib64/libresolv-2.16.so .. --2104-- .. CRC mismatch (computed 2b73909b wanted 4a30a1ca) --2104-- Considering /lib64/.debug/libresolv-2.16.so .. --2104-- .. CRC is valid --2104-- Reading syms from /lib64/libnss_mdns4.so.2 --2104-- Considering /lib64/libnss_mdns4.so.2 .. --2104-- .. CRC mismatch (computed 0cc691af wanted d88c289b) --2104-- object doesn't have a symbol table --2104-- REDIR: 0x3331884a70 (libc.so.6:__GI_memmove) redirected to 0x4a0c740 (__GI_memmove) --2104-- Reading syms from /usr/lib64/syslog-ng/libaffile.so --2104-- Considering /usr/lib64/syslog-ng/libaffile.so .. --2104-- .. CRC mismatch (computed 75ff58c4 wanted 6ceb6e1a) --2104-- object doesn't have a symbol table --2104-- REDIR: 0x3331418a90 (ld-linux-x86-64.so.2:stpcpy) redirected to 0x4a0c240 (stpcpy) --2104-- Discarding syms at 0x5a52eb0-0x5a580c8 in /usr/lib64/syslog-ng/libaffile.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libafprog.so --2104-- Considering /usr/lib64/syslog-ng/libafprog.so .. --2104-- .. CRC mismatch (computed 33d79891 wanted 38df833f) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a50c50-0x5a53ae8 in /usr/lib64/syslog-ng/libafprog.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libkvformat.so --2104-- Considering /usr/lib64/syslog-ng/libkvformat.so .. --2104-- .. CRC mismatch (computed a685392d wanted 0d0a3f36) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4fe80-0x5a520b8 in /usr/lib64/syslog-ng/libkvformat.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libadd-contextual-data.so --2104-- Considering /usr/lib64/syslog-ng/libadd-contextual-data.so .. --2104-- .. CRC mismatch (computed 3905c9b5 wanted 05577ff3) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a50cb0-0x5a53248 in /usr/lib64/syslog-ng/libadd-contextual-data.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libcef.so --2104-- Considering /usr/lib64/syslog-ng/libcef.so .. --2104-- .. CRC mismatch (computed 4be76a8f wanted c38742c5) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4dcb0-0x5a4e238 in /usr/lib64/syslog-ng/libcef.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libdate.so --2104-- Considering /usr/lib64/syslog-ng/libdate.so .. --2104-- .. CRC mismatch (computed 2879a739 wanted bf0a6250) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4f9f0-0x5a52168 in /usr/lib64/syslog-ng/libdate.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libcryptofuncs.so --2104-- Considering /usr/lib64/syslog-ng/libcryptofuncs.so .. --2104-- .. CRC mismatch (computed ca734dd6 wanted 6492f3d6) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4e070-0x5a4e508 in /usr/lib64/syslog-ng/libcryptofuncs.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libpseudofile.so --2104-- Considering /usr/lib64/syslog-ng/libpseudofile.so .. --2104-- .. CRC mismatch (computed 6a282fe2 wanted 2aaa9e3f) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4f6e0-0x5a51118 in /usr/lib64/syslog-ng/libpseudofile.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/liblinux-kmsg-format.so --2104-- Considering /usr/lib64/syslog-ng/liblinux-kmsg-format.so .. --2104-- .. CRC mismatch (computed cc160b54 wanted 2547ea5a) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4dbc0-0x5a4e7e8 in /usr/lib64/syslog-ng/liblinux-kmsg-format.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libsyslogformat.so --2104-- Considering /usr/lib64/syslog-ng/libsyslogformat.so .. --2104-- .. CRC mismatch (computed 8799a4da wanted 3a04cfa7) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4fd40-0x5a53138 in /usr/lib64/syslog-ng/libsyslogformat.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libcsvparser.so --2104-- Considering /usr/lib64/syslog-ng/libcsvparser.so .. --2104-- .. CRC mismatch (computed 991af95b wanted f7306355) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4fc00-0x5a517d8 in /usr/lib64/syslog-ng/libcsvparser.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libdbparser.so --2104-- Considering /usr/lib64/syslog-ng/libdbparser.so .. --2104-- .. CRC mismatch (computed c7d22793 wanted 2dc4d4e8) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a56860-0x5a62a98 in /usr/lib64/syslog-ng/libdbparser.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libdisk-buffer.so --2104-- Considering /usr/lib64/syslog-ng/libdisk-buffer.so .. --2104-- .. CRC mismatch (computed 6b87b880 wanted 75803ff5) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a510d0-0x5a56588 in /usr/lib64/syslog-ng/libdisk-buffer.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libafuser.so --2104-- Considering /usr/lib64/syslog-ng/libafuser.so .. --2104-- .. CRC mismatch (computed be65199f wanted f4d26998) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4f340-0x5a50918 in /usr/lib64/syslog-ng/libafuser.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libconfgen.so --2104-- Considering /usr/lib64/syslog-ng/libconfgen.so .. --2104-- .. CRC mismatch (computed 0236a91a wanted 8d6d9a19) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4dd50-0x5a4e208 in /usr/lib64/syslog-ng/libconfgen.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libafstomp.so --2104-- Considering /usr/lib64/syslog-ng/libafstomp.so .. --2104-- .. CRC mismatch (computed ab8d437d wanted f040ecae) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a51000-0x5a54108 in /usr/lib64/syslog-ng/libafstomp.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libgraphite.so --2104-- Considering /usr/lib64/syslog-ng/libgraphite.so .. --2104-- .. CRC mismatch (computed 5f29ba28 wanted d29a0f96) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4df90-0x5a4e5a8 in /usr/lib64/syslog-ng/libgraphite.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libafsocket.so --2104-- Considering /usr/lib64/syslog-ng/libafsocket.so .. --2104-- .. CRC mismatch (computed 9ce8515e wanted cbb9d1f4) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a557a0-0x5a5cac8 in /usr/lib64/syslog-ng/libafsocket.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libbasicfuncs.so --2104-- Considering /usr/lib64/syslog-ng/libbasicfuncs.so .. --2104-- .. CRC mismatch (computed cd95d630 wanted 6620ef09) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4ff40-0x5a52058 in /usr/lib64/syslog-ng/libbasicfuncs.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libsystem-source.so --2104-- Considering /usr/lib64/syslog-ng/libsystem-source.so .. --2104-- .. CRC mismatch (computed e87f0e6c wanted dd3a8c65) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4df10-0x5a4e9d8 in /usr/lib64/syslog-ng/libsystem-source.so due to munmap() --2104-- Reading syms from /lib64/libnss_compat-2.16.so --2104-- Considering /lib64/libnss_compat-2.16.so .. --2104-- .. CRC mismatch (computed 66a1b543 wanted eea82e2f) --2104-- Considering /lib64/.debug/libnss_compat-2.16.so .. --2104-- .. CRC is valid --2104-- REDIR: 0x3331880580 (libc.so.6:__GI_strchr) redirected to 0x4a08f20 (__GI_strchr) --2104-- Reading syms from /usr/lib64/syslog-ng/libafsocket.so --2104-- Considering /usr/lib64/syslog-ng/libafsocket.so .. --2104-- .. CRC mismatch (computed 9ce8515e wanted cbb9d1f4) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/syslog-ng/libaffile.so --2104-- Considering /usr/lib64/syslog-ng/libaffile.so .. --2104-- .. CRC mismatch (computed 75ff58c4 wanted 6ceb6e1a) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/syslog-ng/libafuser.so --2104-- Considering /usr/lib64/syslog-ng/libafuser.so .. --2104-- .. CRC mismatch (computed be65199f wanted f4d26998) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/syslog-ng/libsyslogformat.so --2104-- Considering /usr/lib64/syslog-ng/libsyslogformat.so .. --2104-- .. CRC mismatch (computed 8799a4da wanted 3a04cfa7) --2104-- object doesn't have a symbol table --2104-- REDIR: 0x3331884bf0 (libc.so.6:memcpy@GLIBC_2.2.5) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331937370 (libc.so.6:__memmove_ssse3_back) redirected to 0x4a0a720 (memcpy(a)GLIBC_2.2.5) ==2104== Thread 3: ==2104== Invalid read of size 8 ==2104== at 0x3334043DFA: g_list_prepend (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x33348334D8: dns_caching_thread_deinit (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482CCC8: app_thread_stop (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x33348423F8: main_loop_worker_thread_stop (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871C70: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871EDF: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871122: iv_run_tasks (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873403: iv_main (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871C12: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873B56: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3332007DFE: start_thread (pthread_create.c:308) ==2104== by 0x33318E639C: clone (clone.S:114) ==2104== Address 0x4db9e40 is 16 bytes inside a block of size 24 free'd ==2104== at 0x4A0766C: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==2104== by 0x333406306F: g_slice_free_chain_with_offset (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x3334833564: dns_caching_global_deinit (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482CC89: app_shutdown (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x40171F: main (in /usr/sbin/syslog-ng) ==2104== ==2104== Invalid write of size 8 ==2104== at 0x3334043E0B: g_list_prepend (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x33348334D8: dns_caching_thread_deinit (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482CCC8: app_thread_stop (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x33348423F8: main_loop_worker_thread_stop (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871C70: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871EDF: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871122: iv_run_tasks (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873403: iv_main (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871C12: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873B56: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3332007DFE: start_thread (pthread_create.c:308) ==2104== by 0x33318E639C: clone (clone.S:114) ==2104== Address 0x4db9e40 is 16 bytes inside a block of size 24 free'd ==2104== at 0x4A0766C: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==2104== by 0x333406306F: g_slice_free_chain_with_offset (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x3334833564: dns_caching_global_deinit (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482CC89: app_shutdown (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x40171F: main (in /usr/sbin/syslog-ng) ==2104== --2104-- Discarding syms at 0x50211e0-0x50281d8 in /lib64/libnss_files-2.16.so due to munmap() --2104-- Discarding syms at 0x522caf0-0x522d768 in /lib64/libnss_mdns4_minimal.so.2 due to munmap() --2104-- Discarding syms at 0x542f0b0-0x5432198 in /lib64/libnss_dns-2.16.so due to munmap() --2104-- Discarding syms at 0x5637a30-0x5643ed8 in /lib64/libresolv-2.16.so due to munmap() --2104-- Discarding syms at 0x584bbb0-0x584c938 in /lib64/libnss_mdns4.so.2 due to munmap() --2104-- Discarding syms at 0x5a52370-0x5a56d28 in /lib64/libnss_compat-2.16.so due to munmap() ==2104== ==2104== HEAP SUMMARY: ==2104== in use at exit: 121,871 bytes in 3,300 blocks ==2104== total heap usage: 11,707 allocs, 8,407 frees, 829,833 bytes allocated ==2104== ==2104== Searching for pointers to 3,300 not-freed blocks ==2104== Checked 17,360,560 bytes ==2104== ==2104== Thread 1: ==2104== 502 (128 direct, 374 indirect) bytes in 1 blocks are definitely lost in loss record 678 of 725 ==2104== at 0x4A08910: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==2104== by 0x333404D290: g_malloc (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x3334834D53: g_process_set_argv_space (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x4015AC: main (in /usr/sbin/syslog-ng) ==2104== ==2104== 608 bytes in 2 blocks are possibly lost in loss record 683 of 725 ==2104== at 0x4A067B0: calloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==2104== by 0x3331410EF9: allocate_dtv (dl-tls.c:296) ==2104== by 0x333141163D: _dl_allocate_tls (dl-tls.c:460) ==2104== by 0x33320085F4: allocate_stack (allocatestack.c:570) ==2104== by 0x33320085F4: pthread_create@@GLIBC_2.2.5 (pthread_create.c:460) ==2104== by 0x3334873C8B: iv_thread_create (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871B0E: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334872290: iv_work_pool_submit_work (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871122: iv_run_tasks (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873403: iv_main (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334841E53: main_loop_run (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x401713: main (in /usr/sbin/syslog-ng) ==2104== ==2104== 765 (360 direct, 405 indirect) bytes in 3 blocks are definitely lost in loss record 690 of 725 ==2104== at 0x4A067B0: calloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==2104== by 0x333404D2E8: g_malloc0 (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x333485B952: log_filter_pipe_new (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x33348320D1: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334831EB6: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333483210E: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334831EB6: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334832451: cfg_tree_compile_rule (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x33348325CA: cfg_tree_compile (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334832668: cfg_tree_start (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482D3DD: cfg_init (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334841AFF: main_loop_initialize_state (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== ==2104== LEAK SUMMARY: ==2104== definitely lost: 488 bytes in 4 blocks ==2104== indirectly lost: 779 bytes in 27 blocks ==2104== possibly lost: 608 bytes in 2 blocks ==2104== still reachable: 119,996 bytes in 3,267 blocks ==2104== suppressed: 0 bytes in 0 blocks ==2104== Reachable blocks (those to which a pointer was found) are not shown. ==2104== To see them, rerun with: --leak-check=full --show-leak-kinds=all ==2104== ==2104== ERROR SUMMARY: 5 errors from 5 contexts (suppressed: 1 from 1) ==2104== ==2104== 1 errors in context 1 of 5: ==2104== Thread 3: ==2104== Invalid write of size 8 ==2104== at 0x3334043E0B: g_list_prepend (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x33348334D8: dns_caching_thread_deinit (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482CCC8: app_thread_stop (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x33348423F8: main_loop_worker_thread_stop (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871C70: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871EDF: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871122: iv_run_tasks (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873403: iv_main (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871C12: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873B56: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3332007DFE: start_thread (pthread_create.c:308) ==2104== by 0x33318E639C: clone (clone.S:114) ==2104== Address 0x4db9e40 is 16 bytes inside a block of size 24 free'd ==2104== at 0x4A0766C: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==2104== by 0x333406306F: g_slice_free_chain_with_offset (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x3334833564: dns_caching_global_deinit (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482CC89: app_shutdown (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x40171F: main (in /usr/sbin/syslog-ng) ==2104== ==2104== ==2104== 1 errors in context 2 of 5: ==2104== Invalid read of size 8 ==2104== at 0x3334043DFA: g_list_prepend (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x33348334D8: dns_caching_thread_deinit (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482CCC8: app_thread_stop (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x33348423F8: main_loop_worker_thread_stop (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871C70: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871EDF: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871122: iv_run_tasks (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873403: iv_main (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871C12: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873B56: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3332007DFE: start_thread (pthread_create.c:308) ==2104== by 0x33318E639C: clone (clone.S:114) ==2104== Address 0x4db9e40 is 16 bytes inside a block of size 24 free'd ==2104== at 0x4A0766C: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==2104== by 0x333406306F: g_slice_free_chain_with_offset (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x3334833564: dns_caching_global_deinit (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482CC89: app_shutdown (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x40171F: main (in /usr/sbin/syslog-ng) ==2104== --2104-- --2104-- used_suppression: 1 dl-hack3-cond-1 /usr/lib64/valgrind/default.supp:1206 ==2104== ==2104== ERROR SUMMARY: 5 errors from 5 contexts (suppressed: 1 from 1) When we are running logger application with emergency priority for long time we find RSS memory is getting increased very fast from 13K to 24K and syslog-ng is getting killed with OOM Killer. Thanks, Arnob

1 0

throttle parser
by Fabien Wernli 27 Mar '17

27 Mar '17

Hi, How would you suggest to throttle matching messages in a log path? I know there's the `throttle` option in many destinations, but I'd like to be able to do this upstream, e.g. in patterndb or better in the path directly. It would be awesome to be able to do: log { source(…); junction { channel { filter(…); throttle(100); }; channel { flags(fallback); }; }; destination(…); }; wouldn't it?

1 0

Does Syslog-NG Support Multiline Messages
by Traiano Welcome 26 Mar '17

26 Mar '17

Hi Does syslog-ng support multiline log messages? Thanks, Traiano

4 5

Syslog-ng time stamp reporting issue.
by vijay amruth 24 Mar '17

24 Mar '17

Hello guys, Hope everyone is doing great. I have run into a issue where syslog-ng reports time in MST when the source is in UTC and we want in UTC, how do we control this ? Source (UTC) --------> Syslog-ng server (UTC) but syslog is writing logs in MST. Any help is appreciated. Thank you, Vijay Amrut.

2 1

Re: [syslog-ng] Is it possible to include a external python script?
by Jorge Pereira 22 Mar '17

22 Mar '17

Hi Balázs, Thanks for the answer. But, My question is: It is possible to include a external python script. e.g: $ cat foobar.conf: python { @include "caipirinha.py" } template-function foobar "$(python foobar)" $ cat caipirinha.py from foobar import foobar_template_function # my python class/code is separated ........... $ got it? maybe using the "confgen" module? -- Jorge Pereira On Mon, Mar 20, 2017 at 2:35 AM, Scheidler, Balázs < balazs.scheidler(a)balabit.com> wrote: > Hi, > > The example Python code should be unindented, or you see a different error? > > Also, you can always import code in the python block. > > With destinations you can specify a path to a python file, so the python > block is not needed. But with template functions I've figured the $(python) > call would be too crowded if we were passing explicit filename parameters. > > But you can encapsulate the python code as well as a wrapper to the python > code into a separate file. > > Foobar.conf: > > python { > > from foobar import foobar_template_function > > } > > template-function foobar "$(python foobar)" > > ---------- > > Then you can use: > > @include "Foobar.conf" > > ... > template("$(foobar)"); > ... > > Unfortunately then template function declarations cant take parameters yet > from the callsite, which may be a serious limitation in your use-case. But > with a conceot above you can completely hide implementation details your > actual config. > > On Mar 20, 2017 03:53, "Jorge Pereira" <jpereiran(a)gmail.com> wrote: > >> Well, based on this[1] document. We should use the *python {}* statement. >> But, I would like to keep my python script externally in a separated file >> and do something like. >> >> python filter_001 { >> /my/script/python001.py >> } >> >> log { >> .... >> filter(filter_001); >> .... >> }; >> >> p.s: Btw, this sample https://www.balabit.com >> /documents/syslog-ng-ose-3.7-guides/en/syslog-ng-ose-guide- >> admin/html-single/index.html#example-python-template-functions >> don't work in the syslog-ng 3.9.1 >> >> [1] https://www.balabit.com/sites/default/files/documents/syslog >> -ng-ose-3.7-guides/en/syslog-ng-ose-v3.7-guide-admin/html-si >> ngle/index.html#example-python-template-functions >> -- >> Jorge Pereira >> >> ____________________________________________________________ >> __________________ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: http://www.balabit.com/support/documentation/?product= >> syslog-ng >> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >> >> >> > ____________________________________________________________ > __________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/? > product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > >

4 6

Is it possible to include a external python script?
by Jorge Pereira 20 Mar '17

20 Mar '17

Well, based on this[1] document. We should use the *python {}* statement. But, I would like to keep my python script externally in a separated file and do something like. python filter_001 { /my/script/python001.py } log { .... filter(filter_001); .... }; p.s: Btw, this sample https://www.balabit.com/documents/syslog-ng-ose-3.7-guides/en/syslog-ng-ose… don't work in the syslog-ng 3.9.1 [1] https://www.balabit.com/sites/default/files/documents/ syslog-ng-ose-3.7-guides/en/syslog-ng-ose-v3.7-guide- admin/html-single/index.html#example-python-template-functions -- Jorge Pereira

2 1

syslog-ng 3.9.x & mod-lua is deprecated?
by Jorge Pereira 20 Mar '17

20 Mar '17

Hi, syslog-ng 3.9.x & mod-lua is deprecated? btw, is it possible to enable the mod-lua in the 3.9.x? I am asking because using Lua is more easy to port the Lua scripts/decoder/encoders from the heka to syslog-ng. -- Jorge Pereira

2 2