- syslog-ng - lists.balabit.hu

distro URLs for syslog-ng
by Peter Czanik 29 Nov '11

29 Nov '11

Hello, Please take a look at http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… It has now information for many Linux distributions, where up-to-date syslog-ng package information is available, unofficial repositories with latest and/or backported syslog-ng, bugreporting, etc. Let me know, if you have info or links to additional distributions or repositories! Bye, -- Peter Czanik (CzP)<czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

[Bug 147] New: missing share/xsd/patterndb-4.xsd schema definition
by bugzilla＠bugzilla.balabit.com 29 Nov '11

29 Nov '11

https://bugzilla.balabit.com/show_bug.cgi?id=147 Summary: missing share/xsd/patterndb-4.xsd schema definition Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 Is OSE 3.3.3 I downloaded the source and installed, but only go schema definitions for database formats 1,2 and 3. The manual for Syslog-ng 3.3.3 has a secion on "What's new in the syslog-ng pattern database format V4" so I can only assume that the version 4 schema should be present. Can you provide one? -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

[Bug 148] New: .classifier. unknown not set when patterndb unable to classify message
by bugzilla＠bugzilla.balabit.com 29 Nov '11

29 Nov '11

https://bugzilla.balabit.com/show_bug.cgi?id=148 Summary: .classifier.unknown not set when patterndb unable to classify message Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 filter f_tag_unknown { tags(".classifier.unknown"); }; Using this filter results in no messages going to a destination, but using filter f_tag_unknown { not tags(".classifier.system"); }; logs all of the unclassified messages. The problem is that I am going to have a lot more than just .classifier.system in my pattern database, so this is not a viable workaround. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

[Bug 145] New: Comilation on Solaris 10 with gcc 3.4.3 fails
by bugzilla＠bugzilla.balabit.com 29 Nov '11

29 Nov '11

https://bugzilla.balabit.com/show_bug.cgi?id=145 Summary: Comilation on Solaris 10 with gcc 3.4.3 fails Product: syslog-ng Version: 3.3.x Platform: Other OS/Version: Solaris Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: andyh(a)nominet.org.uk Type of the Report: bug Estimated Hours: 0.0 Hi, Trying to compile 3.3.3 from source on Solaris 10 with gcc 3.4.4 and get this: libtool: compile: /usr/sfw/bin/gcc -DHAVE_CONFIG_H -I. -I.. -D_GNU_SOURCE -I../lib/include -I../lib/include -I../lib -I../modules/include -Wall -m64 -mcpu=v9 -D_REENTRANT -D_POSIX_C_SOURCE=199506L -D_POSIX_PTHREAD_SEMANTICS -D_XPG4_2 -MT iv_event.lo -MD -MP -MF .deps/iv_event.Tpo -c iv_event.c -fPIC -DPIC -o iv_event.o iv_event.c: In function `iv_event_run_pending_events': iv_event.c:74: error: unrecognizable insn: (insn 80 79 81 2 (set (reg:DI 139) (lo_sum:DI (reg:DI 139) (unspec:DI [ (symbol_ref:DI ("__tls") [flags 0xa] <var_decl fefbb480 __tls>) ] 0))) -1 (nil) (nil)) iv_event.c:74: internal compiler error: in extract_insn, at recog.c:2083 Please submit a full bug report, with preprocessed source if appropriate. See <URL:http://gcc.gnu.org/bugs.html> for instructions. It appears (http://gcc.gnu.org/bugzilla/show_bug.cgi?id=21613) that there may be a workaround, but I'm not a developer and can't understand hwo to apply the workaround -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

Problems with custom patterndb
by Clements, Frank 29 Nov '11

29 Nov '11

Hello Everyone! I've been trying to get some custom patterns put together to do some log correlation and I'm having one hell of a time getting a working pattern. I think I need a second, third, forth set of eyes on this ... Any help is appreciated! Message: Nov 25 12:02:27 GENERATED NAT-UDP-C: 192.168.107.132:12260 -> 207.44.101.104:12260 to 48.70.67.223:940 Pattern: @IPvANY:.dict.insideAddr@:@NUMBER:.dict.insidePort@ -> @IPvANY:.dict.outsideAddr@:@NUMBER:.dict.outsidePort@ to @IPvANY:.dict.destAddr@:@NUMBER:.dict.destPort@ I've looked at a few examples from the community patterns, but nothing in this stands out as being "wrong". Thanks - Frank W Clements

2 4

Multi-threaded in open source?
by Avleen Vig 25 Nov '11

25 Nov '11

Hi everyone, I'm running an infrastructure with several hundred hosts logging many hundreds of Gb of logs to a central server. Syslog-ng on the central server is using 100% CPU on a single core, and I see here: http://bazsi.blogs.balabit.com/2011/07/syslog-ng-multithreaded-performance/ that there is some multi-threading option available! Is this only in the PE version or is there an OSE edition with this feature?

5 6

[PATCH (3.4)] value-pairs: Fix the error handling in the command-line parser.
by Gergely Nagy 25 Nov '11

25 Nov '11

When an error occurs during command-line parsing, do not attempt to free argv: it's not owned by us anymore. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- lib/value-pairs.c | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) diff --git a/lib/value-pairs.c b/lib/value-pairs.c index fcaa401..c58d294 100644 --- a/lib/value-pairs.c +++ b/lib/value-pairs.c @@ -465,7 +465,6 @@ value_pairs_new_from_cmdline (GlobalConfig *cfg, { value_pairs_free (vp); g_option_context_free (ctx); - g_free (argv); return NULL; } g_option_context_free (ctx); -- 1.7.7.3

2 1

[PATCH] logproto: Fix compilation on systems without IOV_MAX.
by Gergely Nagy 25 Nov '11

25 Nov '11

Since IOV_MAX is not defined on Hurd its usage is made conditional. Errors are handled by g_malloc0() which aborts on failure, so no return value has to be checked. Reported-By: Svante Signell <svante.signell(a)telia.com> Patch-From: Svante Signell <svante.signell(a)telia.com> Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- lib/logproto.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/lib/logproto.c b/lib/logproto.c index 282064c..16ca0d7 100644 --- a/lib/logproto.c +++ b/lib/logproto.c @@ -420,9 +420,11 @@ log_proto_file_writer_new(LogTransport *transport, gint flush_lines) if (flush_lines == 0) /* the flush-lines option has not been specified, use a default value */ flush_lines = 1; +#ifdef IOV_MAX if (flush_lines > IOV_MAX) /* limit the flush_lines according to the current platform */ flush_lines = IOV_MAX; +#endif /* allocate the structure with the proper number of items at the end */ LogProtoFileWriter *self = (LogProtoFileWriter *)g_malloc0(sizeof(LogProtoFileWriter) + sizeof(struct iovec)*flush_lines); -- 1.7.7.3

2 1

[PATCH] logrewrite: Fix the logrewrite cloning functions.
by Gergely Nagy 25 Nov '11

25 Nov '11

Repair the rewrite clone funcions, to correctly clone the value_handle and conditions aswell. Without this, if we use rewrite in multiple logpaths, only the first will behave correctly, the cloned ones will all rewrite the $MESSAGE macro instead, because that's the default. Signed-off-By: Zoltan Fried <deirf(a)balabit.hu> Signed-off-By: Gergely Nagy <algernon(a)balabit.hu> --- lib/logrewrite.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/lib/logrewrite.c b/lib/logrewrite.c index d282f6f..a578439 100644 --- a/lib/logrewrite.c +++ b/lib/logrewrite.c @@ -165,6 +165,8 @@ log_rewrite_subst_clone(LogProcessPipe *s) cloned = (LogRewriteSubst *) log_rewrite_subst_new(self->replacement->template); cloned->matcher = log_matcher_ref(self->matcher); + cloned->super.value_handle = self->super.value_handle; + cloned->super.condition = self->super.condition; return &cloned->super.super.super; } @@ -227,6 +229,8 @@ log_rewrite_set_clone(LogProcessPipe *s) LogRewriteSet *cloned; cloned = (LogRewriteSet *) log_rewrite_set_new(self->value_template->template); + cloned->super.value_handle = self->super.value_handle; + cloned->super.condition = self->super.condition; return &cloned->super.super.super; } -- 1.7.7.3

2 1

[PATCH] Fixed compounded filter initialization.
by Szalay Attila 25 Nov '11

25 Nov '11

If a filter link to an other filter an init function called to set up this link. But if this filter is compunded then this callback is not called so the filter is not initialized but silently evaluated to false. For example in the following situation the f_message is always true: filter f_auth { facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_mail { facility(mail); }; filter f_messages { not filter(f_auth) and not filter(f_cron) and not filter(f_mail); }; Signed-off-by: Szalay Attila <sasa(a)balabit.hu> --- lib/filter.c | 39 +++++++++++++++++++++++++++++++++++++++ 1 files changed, 39 insertions(+), 0 deletions(-)

2 1