- syslog-ng - lists.balabit.hu

Using RS and GS field seperator
by Omer Faruk SEN 25 Oct '11

25 Oct '11

Hi, Is there an option I can use non-printable chars as field seperators on template() I want to use RS and GS at the and. 035 29 1D GS (group separator) 135 93 5D ] 036 30 1E RS (record separator) 136 94 5E ^ Regards.

2 1

[Bug 140] New: syslog-ng ignores filter boolean logic
by bugzilla＠bugzilla.balabit.com 24 Oct '11

24 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=140 Summary: syslog-ng ignores filter boolean logic Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: lisaev(a)umail.iu.edu Type of the Report: --- Estimated Hours: 0.0 Created an attachment (id=42) --> (https://bugzilla.balabit.com/attachment.cgi?id=42) syslog-ng 3.3.1 config file I am running syslog-ng 3.3.1 (arch linux), and noticed that my iptables logs go into every possible logfile, i.e. /var/log/{messages,kernel,iptables}.log. For example: cur_work$ tail -n1 /var/log/kernel.log Oct 23 12:43:18 linhost kernel: [ 5372.600518] firewall: IN=wlan0 OUT= MAC=00:26:c6:d7:27:6a:00:17:0f:70:b1:00:08:00 SRC=74.125.65.108 DST=96.125.23.251 LEN=40 TOS=0x00 PREC=0x00 TTL=43 ID=28546 PROTO=TCP SPT=993 DPT=52331 WINDOW=0 RES=0x00 RST URGP=0 This is despite the fact that syslog-ng.conf contains filter f_iptables { match("IN=" value("MESSAGE")) and match("OUT=" value("MESSAGE")); }; filter f_kernel { facility(kern) and not filter(f_iptables); }; I also tried modifying f_iptables as filter f_iptables { match("firewall" value("MESSAGE")); }; but still get firewall logs everywhere :( I add the full syslog-ng.conf as an attachment. Thanks. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

[Bug 129] New: Add ability to synchronously flush logs on demand
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=129 Summary: Add ability to synchronously flush logs on demand Product: syslog-ng Version: 1.6.x Platform: All OS/Version: FreeBSD Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: fermulator(a)sympatico.ca Type of the Report: enhancement Estimated Hours: 0.0 As per the below e-mail thread with Bazsi, I was trying to figure out why syslog-ng doesn't write logs immediately. As I discovered syslog-ng by default has the concept of “flush_timeout” and “flush_lines”, where flush_timeout is how frequently we'll write logs (default 10s), and flush_lines is the maximum number of lines we'll hold in the buffer before writing (default 10,000). Currently, there is no way to synchronously force syslog-ng to "write logs now". This ticket is an enhancement to syslog-ng to add the ability, in a synchronous way, ask syslog-ng to flush the buffer now, writing all logs in the queue/buffer immediately/ASAP, and block until the operation is completed. Version Information: * syslog-ng 1.6.8 * FreeBSD 6.1 ----------- From: bazsi(a)balabit.hu To: fermulator(a)sympatico.ca Subject: Re: Flush (write logs now) for syslog-ng? Date: Fri, 22 Jul 2011 06:31:36 +0200 hi, we do have a bugzilla at bugzilla.balabit.com, however it's primarily used for bug reports. you can file enhancement requests though. ----- Original message ----- > Thanks for the reply. > > I tried SIGHUP, and as you mentioned, it's not synchronous. syslog-ng > does write the logs, but only after a few seconds (presumably this is > less than the timeout though at least). > > Do you have any "ticket system", that has the "enhancement" to do this > synchronously that I could reference? > > ~Matt > > > -------- Original Message -------- > From: Balazs Scheidler <bazsi(a)balabit.hu> > Sent: Thu 21 Jul 2011 02:31:24 PM EST > To: Fermulator Fermulator <fermulator(a)sympatico.ca> > Cc: > Subject: Re: Flush (write logs now) for syslog-ng? > > > hi, > > > > sending a SIGHUP should flush all buffers. this is not synchronous > > though, so you have to sleep some time to let syslog-ng do the thing. > > > > we have plans to add both on-demand synchronous reloads and config > > file flushes. > > > > ----- Original message ----- > > > > > > > > > > > > Hi Bazsi, > > > > > > > > > > > > I hope you don’t mind, I was trying to search for this in > > > the syslog-ng mail archives, but couldn’t find my answer, and found > > > your e-mail in the process. > > > > > > > > > > > > > > > As I understand it, syslog-ng has “flush_timeout” and “flush_lines” > > > parameters which determine how often we write out the buffer/queue of > > > log messages, and what the maximum number of lines is that we’ll > > > buffer, respectively. > > > > > > > > > > > > > > > > > > I’m trying to figure out: How can I tell syslog-ng to “write > > > logs now” on demand? (i.e. I > > > have a script that upon failure, scrapes some log files … but > > > instead of waiting for the flush_timeout, I’d rather “poke” > > > syslog-ng to “write all logs now” (i.e. temporarily set the > > > flush_timeout to 0, or temporarily set the flush_lines to 0) > > > > > > > > > > > > Is it possible? > > > > > > > > > > > > Thanks so much > > > > > > > > > ~Fermulator > > > (Matt Callaghan) > > > > > -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 115] New: libsyslog-ng.so is not linked with glib/cap but uses glib/ cap symbols
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=115 Summary: libsyslog-ng.so is not linked with glib/cap but uses glib/cap symbols Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: --- Estimated Hours: 0.0 [arekm@carme-pld ~/rpm/BUILD/syslog-ng-3.2.2/lib]$ ldd .libs/libsyslog-ng.so linux-vdso.so.1 => (0x00007fff46f80000) libc.so.6 => /lib64/libc.so.6 (0x00007fb64c4b8000) /lib64/ld-linux-x86-64.so.2 (0x0000003fba800000) but libsyslog-ng.so uses many glib and cap symbols: libtool: link: x86_64-pld-linux-gcc -std=gnu99 -I../../../lib -I../../../lib -I../../../modules/dbparser -I.. -Wno-pointer-sign -O2 -fno-strict-aliasing -fwrapv -march=x86-64 -gdwarf-3 -g2 -Wall .libs/test_patterndbS.o -Wl,--as-needed -Wl,--no-copy-dt-needed-entries -Wl,-z -Wl,relro -Wl,-z -Wl,combreloc -o .libs/test_patterndb test_patterndb.o ../.libs/patternize.o -Wl,-Bstatic -Wl,--whole-archive -Wl,--export-dynamic -pthread -Wl,--no-whole-archive -Wl,-Bdynamic ../../syslogformat/.libs/libsyslogformat.so ../../../lib/.libs/libsyslog-ng.so ../.libs/libsyslog-ng-patterndb.so /home/users/arekm/rpm/BUILD/syslog-ng-3.2.2/lib/.libs/libsyslog-ng.so -lssl -lcrypto -lresolv /usr/lib64/libgmodule-2.0.so /usr/lib64/libgthread-2.0.so -lpthread /usr/lib64/libglib-2.0.so /usr/lib64/libevtlog.so /usr/lib64/libpcre.so -lcap -ldl -lrt -pthread -Wl,-rpath -Wl,/lib64/syslog-ng ../../../lib/.libs/libsyslog-ng.so: undefined reference to `cap_set_proc' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `cap_from_text' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `g_module_build_path' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `cap_free' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `g_module_make_resident' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `g_thread_init' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `g_module_symbol' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `g_module_open' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `g_module_error' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `cap_set_flag' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `cap_to_text' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `cap_get_proc' That's in mixed linking, CORE_DEPS_LIBS is then empty. CORE_DEPS_LIBS should contain static linking to glib and dynamic to cap then. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 5

[Bug 114] New: configure strips -ldl -lrt for static linking but doesn' t add back with dynamic linking
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=114 Summary: configure strips -ldl -lrt for static linking but doesn't add back with dynamic linking Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: --- Estimated Hours: 0.0 configure.in when detecting glib strips -ldl and -lrt to prevent static linking with these libraries. # strip out -ldl & -lrt as it cannot be linked statically GLIB_LIBS=`echo $GLIB_LIBS | tr ' ' '\n' | egrep -v "^(-ldld?)|(-lrt)$" | tr '\n' ' '` This is fine. Unfortunately it doesn't add -ldl and -lrt back with dynamic linking and that causes newer glib detection to fail: configure:14223: checking for g_hash_table_new configure:14223: x86_64-pld-linux-gcc -std=gnu99 -o conftest -O2 -fno-strict-aliasing -fwrapv -march=x86-64 -gdwarf-3 -g2 -Wall -D_FORTIFY_SOURCE=2 -Wl,--as-needed -Wl,--no-copy-dt-needed-entries -Wl,-z,relro -Wl,-z,combreloc conftest.c -Wl,-Bstatic -Wl,--export-dynamic -pthread -lgmodule-2.0 -lgthread-2.0 -lglib-2.0 -Wl,-Bdynamic >&5 /usr/lib64/gcc/x86_64-pld-linux/4.5.2/../../../../lib64/libglib-2.0.a(gmain.o): In function `g_get_monotonic_time': (.text+0x2e12): undefined reference to `clock_gettime' collect2: ld returned 1 exit status -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

[Bug 108] New: 2.6.38+ will require CAP_SYSLOG (CAP_SYS_ADMIN not enough)
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=108 Summary: 2.6.38+ will require CAP_SYSLOG (CAP_SYS_ADMIN not enough) Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: enhancement Estimated Hours: 0.0 2.6.38+ kernels (linus git) reports: [ 9.890305] WARNING: at kernel/printk.c:430 do_syslog+0x427/0x452() [ 9.890318] Hardware name: 2764CTO [ 9.890320] Attempt to access syslog with CAP_SYS_ADMIN but no CAP_SYSLOG (deprecated and denied). when syslog tries to do syslogging. Additionally I'm geting: [root@t400 ~]# /usr/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf Error opening file for reading; filename='/proc/kmsg', error='Operation not permitted (1)' Error initializing source driver; source='s_sys', id='s_sys#0' Error initializing message pipeline; which likely is due to the same problem. Commit: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h… -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 44

[Bug 107] New: when trying to log to postgres database if port is not specified it gets defaulted to 0
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=107 Summary: when trying to log to postgres database if port is not specified it gets defaulted to 0 Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jhnsmth64(a)gmail.com Type of the Report: bug Estimated Hours: 0.0 syslog-ng.conf ... destination d_pgsql { sql(type(pgsql) host("localhost") username("user") password("pass") ... }; ... If destination stays defined like above, without port specified explicitly, syslog sends log messages to port 0 instead defaulting port to the Postgres port (5432). Destination settings below works: ... destination d_pgsql { sql(type(pgsql) host("localhost") port(5432) username("user") password("pass") ... }; ... -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 4

[Bug 106] New: Syslog-ng memory strdup and g_malloc leaks
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=106 Summary: Syslog-ng memory strdup and g_malloc leaks Product: syslog-ng Version: 3.2.x Platform: Other OS/Version: Solaris Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: daniel_novak(a)kb.cz Type of the Report: refactorization Estimated Hours: 0.0 We tried to compile a few last git version of syslog-3.2.1(syslog-ng-3.2.git-5f25ce47ab57774f8fe8df17bc96a006e535cb53) as well as 3.2.1 stable release. Everything is running well, but there are several minor memory leaks.We run on Solaris 10/08 on sparc platform.With libumem.so in memory debug mode MDB output is following : > ::findleaks CACHE LEAKED BUFCTL CALLER 00052288 2 00110d98 libc.so.1`strdup+0xc 00052788 1 0007de00 libglib-2.0.so.0.2513.0`g_malloc0+0x64 ---------------------------------------------------------------------- Total 3 buffers, 64 bytes =========================================================================================== > ::findleaks -dvf findleaks: maximum buffers => 4121 findleaks: actual buffers => 3967 mdb: [fef80000, fef84000): couldn't read 16384 bytes at fef80000: no mapping for address findleaks: findleaks: potential pointers => 341574 findleaks: dismissals => 196071 (57.4%) findleaks: misses => 130325 (38.1%) findleaks: dups => 11214 ( 3.2%) findleaks: follows => 3964 ( 1.1%) findleaks: findleaks: elapsed wall time => 0 seconds findleaks: CACHE LEAKED BUFCTL CALLER 00052288 2 00110d98 libc.so.1`strdup+0xc 00052788 1 0007de00 libglib-2.0.so.0.2513.0`g_malloc0+0x64 ---------------------------------------------------------------------- Total 3 buffers, 64 bytes umem_alloc_16 leak: 2 buffers, 16 bytes each, 32 bytes total ADDR BUFADDR TIMESTAMP THREAD CACHE LASTLOG CONTENTS 110d98 1097e0 1b08cf3fb0c96c 1 52288 43af4 0 libumem.so.1`umem_cache_alloc+0x210 libumem.so.1`umem_alloc+0x60 libumem.so.1`malloc+0x28 libc.so.1`strdup+0xc libsyslog-ng.so.0.0.0`cfg_lexer_lookup_keyword+0xf0 libsyslog-ng.so.0.0.0`_cfg_lexer_lex+0x18a4 libsyslog-ng.so.0.0.0`cfg_lexer_lex+0x284 libsyslog-ng.so.0.0.0`main_lex+0x1c libsyslog-ng.so.0.0.0`main_parse+0x7a4 libsyslog-ng.so.0.0.0`cfg_parser_parse+0xcc libsyslog-ng.so.0.0.0`cfg_run_parser+0x1ac libsyslog-ng.so.0.0.0`cfg_read_config+0x98 initial_init+0x5c main+0x244 _start+0x5c umem_alloc_32 leak: 1 buffer, 32 bytes ADDR BUFADDR TIMESTAMP THREAD CACHE LASTLOG CONTENTS 7de00 77b98 1b08cf406e21b0 1 52788 373ec 0 libumem.so.1`umem_cache_alloc+0x210 libumem.so.1`umem_alloc+0x60 libumem.so.1`malloc+0x28 libumem.so.1`calloc+0x58 libglib-2.0.so.0.2513.0`g_malloc0+0x64 libsyslog-ng.so.0.0.0`serialize_file_archive_new+0x1c libsyslog-ng.so.0.0.0`persist_state_load+0x54 libsyslog-ng.so.0.0.0`persist_state_start+0x34 libsyslog-ng.so.0.0.0`cfg_initial_init+0x28 initial_init+0xbc main+0x244 _start+0x5c ========================================================================= findleaks: using cached results (-f will force a full run) CACHE LEAKED BUFCTL CALLER 00052288 2 00110d98 libc.so.1`strdup+0xc 00052788 1 0007de00 libglib-2.0.so.0.2513.0`g_malloc0+0x64 ---------------------------------------------------------------------- Total 3 buffers, 64 bytes > 00110d98::umem_verify mdb: cache 110d98 () does not have redzone checking enabled > 00052288::umem_verify Summary for cache 'umem_alloc_16' clean > 00052788::umem_verify Summary for cache 'umem_alloc_32' clean ============================================================================= -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

[Bug 104] New: Add libtool option -module
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=104 Summary: Add libtool option -module Product: syslog-ng Version: 3.2.x Platform: All OS/Version: All Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: vinschen(a)redhat.com Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=30) --> (https://bugzilla.balabit.com/attachment.cgi?id=30) Patch to add libtool option -module Libtool 2.2.6 and later provides an option -module which should be used when creating shared libraries which are supposed to be used as modules which get loaded via dlopen. See the "Building modules to dlopen" chapter in `info libtool'. For Cygwin the additional benefit is that the modules are not copied into a parallel "bin" directory at installation time, which is the default otherwise to accommodate the DLL search algorithm on Windows. The attached patch just adds the -module option to each of the Makefile.am files in the modules subdir. Corinna -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 4

[Bug 120] New: afsql. c afsql_dd_format_* routines should include table in persist_name string
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=120 Summary: afsql.c afsql_dd_format_* routines should include table in persist_name string Product: syslog-ng Version: 3.2.x Platform: Other URL: https://lists.balabit.hu/pipermail/syslog-ng/2011- February/015913.html OS/Version: Other Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jtk(a)cymru.com Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=36) --> (https://bugzilla.balabit.com/attachment.cgi?id=36) include table name in persist_name As originally discovered in the syslog-ng list post entitled "[syslog-ng] duplicate config elements in sql destinations" by John Kristoff on 2011-02-11, syslog-ng will complain, when multiple destinations all point to the same database, but different tables with the message: Internal error, duplicate configuration elements refer to the same persistent config; name='afsql_dd(pgsql,127.0.0.1,,bar)' Balazs responded describing the potential problems with counters being swapped and a fix that appears to work in testing. A Patch for syslog-ng 3.2.4 is attached, but similar patch should work for earlier versions as indicated by Balazs' posting. Thank you, John -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

[Bug 139] New: syslog-ng crashes on SIGHUP when rewrite used in multiple log{} declarations
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=139 Summary: syslog-ng crashes on SIGHUP when rewrite used in multiple log{} declarations Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.syslogng(a)feystorm.net Type of the Report: --- Estimated Hours: 0.0 This is for version 3.3.1 which isnt an available version in the bug tracker. I've managed to create a situation where syslog-ng crashes when it receives a SIGHUP, and a certain rewrite has been used in at least 3 different log{} declarations. Below is the extremely stripped down configuration I've created which duplicates the issue. With the below configuration, when syslog-ng receives a HUP, it will get a segfault in malloc_consolidate(). Additionally, the process which monitors syslog-ng for crashing doesnt appear to have a signal handler for SIGHUP, so the monitor process will die when it gets a HUP. This is a problem, at least on redhat as the redhat init script sends a HUP to both the monitor process and the real worker process when the init script is called with `reload` @version: 3.3 @include "scl.conf" source s_local { system(); }; rewrite r_fext { #set("$LEVEL",value('FEXT')); subst('foo','bar', value('FEXT') type('string')); }; log { source(s_local); rewrite(r_fext); }; log { source(s_local); rewrite(r_fext); }; log { source(s_local); rewrite(r_fext); }; -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

syslog-ng 3.3.1 dying after SIGHUP
by Patrick H. 23 Oct '11

23 Oct '11

Is anyone else having issues with syslog-ng 3.3 dying when it gets a sighup? When the syslog-ng monitor process gets a HUP, it seems to die immediately, as if there were no signal handler. Strace shows absolutely nothing between getting the signal, and it exiting. When the actual syslog-ng worker process gets a HUP, it does a bunch of stuff, and then segfaults. It looks like it segfaults immediately after closing /var/log/syslog 4362 17:28:44.964645 stat("/var/log", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 4362 17:28:44.964729 stat("/var/log/syslog", {st_mode=S_IFREG|0644, st_size=3905, ...}) = 0 4362 17:28:44.964813 open("/var/log/syslog", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK, 0644) = 26 4362 17:28:44.964879 fcntl(26, F_GETFD) = 0 4362 17:28:44.964936 fcntl(26, F_SETFD, FD_CLOEXEC) = 0 4362 17:28:44.964993 capget(0x19980330, 0, {CAP_DAC_OVERRIDE|CAP_SYS_ADMIN, CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN, 0}) = 0 4362 17:28:44.965082 capset(0x19980330, 0, {CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_SYS_ADMIN, CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN, 0}) = 0 4362 17:28:44.965148 capget(0x19980330, 0, {CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_SYS_ADMIN, CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN, 0}) = 0 4362 17:28:44.965213 capset(0x19980330, 0, {CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_FOWNER|CAP_SYS_ADMIN, CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN, 0}) = 0 4362 17:28:44.965279 fchown(26, 0, 4294967295) = 0 4362 17:28:44.965344 fchown(26, 4294967295, 0) = 0 4362 17:28:44.965404 fchmod(26, 0644) = 0 4362 17:28:44.965464 capset(0x19980330, 0, {CAP_SYS_ADMIN, CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN, 0}) = 0 4362 17:28:44.965532 close(21) = 0 4362 17:28:44.966122 --- SIGSEGV (Segmentation fault) @ 0 (0) --- I'm going to try and track this down further, but was wondering if anyone else was seeing this behavior. Running this on RHEL5

2 3

[PATCH] afsocket: Fix compilation with libsystemd-daemon
by Gergely Nagy 22 Oct '11

22 Oct '11

When the libsystemd-daemon library is used, we need to use the header provided by the library, otherwise linking will likely fail. To do that, configure sets WITH_LIBSYSTEMD as appropriate, and depending on that value, we either include <systemd/sd-daemon.h> or "sd-daemon.h". Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- configure.in | 1 + modules/afsocket/afunix.c | 5 +++++ 2 files changed, 6 insertions(+), 0 deletions(-) diff --git a/configure.in b/configure.in index 13bc874..1e3a09a 100644 --- a/configure.in +++ b/configure.in @@ -1059,6 +1059,7 @@ AC_DEFINE_UNQUOTED(ENABLE_LINUX_CAPS, `enable_value $enable_linux_caps`, [Enable AC_DEFINE_UNQUOTED(ENABLE_PCRE, `enable_value $enable_pcre`, [Enable PCRE support]) AC_DEFINE_UNQUOTED(ENABLE_ENV_WRAPPER, `enable_value $enable_env_wrapper`, [Enable environment wrapper support]) AC_DEFINE_UNQUOTED(ENABLE_SYSTEMD, `enable_value $enable_systemd`, [Enable systemd support]) +AC_DEFINE_UNQUOTED(WITH_LIBSYSTEMD, `enable_value $with_libsystemd`, [Compile with libsystemd-daemon]) AM_CONDITIONAL(ENABLE_ENV_WRAPPER, [test "$enable_env_wrapper" = "yes"]) AM_CONDITIONAL(ENABLE_SYSTEMD, [test "$enable_systemd" = "yes"]) diff --git a/modules/afsocket/afunix.c b/modules/afsocket/afunix.c index 57ae213..2d57078 100644 --- a/modules/afsocket/afunix.c +++ b/modules/afsocket/afunix.c @@ -25,7 +25,12 @@ #include "misc.h" #include "messages.h" #include "gprocess.h" + +#if WITH_LIBSYSTEMD +#include <systemd/sd-daemon.h> +#else #include "sd-daemon.h" +#endif #include <string.h> #include <sys/types.h> -- 1.7.7

2 1

feature request: clear stats counters after diplayed
by syslogng＠feystorm.net 18 Oct '11

18 Oct '11

I was wondering if it would be possible to clear the stats generated by syslog-ng after theyre logged from the stats_freq setting. Basically so every set of stats that gets displayed will be the numbers since the last time stats were displayed, not for the whole lifetime of the process. Largely, this is just so that one can easily tell if processing has changed in a certain time period without having to do the math. Additionally it also would help a great deal with system health monitoring software. For example, something could look to see if syslog-ng has dropped any messages, but as it currently is it would have to compare the most recent stats with the previous set of stats just to see if the dropped counter went up.

2 1

[PATCH] syslog-ng: Add a -q/--silent-module-load option
by Gergely Nagy 15 Oct '11

15 Oct '11

With the -q/--silent-module-load option set (defaults to off), no warnings will be printed when a module cannot be found. If it's found, but cannot be loaded, a message is still printed. If it is used later in the config, that's still handled correctly. The flag only suppresses the warning, and nothing else. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- lib/globals.c | 1 + lib/plugin.c | 9 +++++---- lib/syslog-ng.h | 1 + syslog-ng/main.c | 1 + 4 files changed, 8 insertions(+), 4 deletions(-) diff --git a/lib/globals.c b/lib/globals.c index b2afec7..b3b2121 100644 --- a/lib/globals.c +++ b/lib/globals.c @@ -28,3 +28,4 @@ GlobalConfig *configuration; int cfg_parser_debug; gchar *module_path = MODULE_PATH; gchar *default_modules = DEFAULT_MODULES; +gboolean silent_module_load = FALSE; diff --git a/lib/plugin.c b/lib/plugin.c index 5239974..cce549a 100644 --- a/lib/plugin.c +++ b/lib/plugin.c @@ -179,10 +179,11 @@ plugin_dlopen_module(const gchar *module_name, const gchar *module_path) g_strfreev(module_path_dirs); if (!plugin_module_name) { - msg_error("Plugin module not found in 'module-path'", - evt_tag_str("module-path", module_path), - evt_tag_str("module", module_name), - NULL); + if (!silent_module_load) + msg_error("Plugin module not found in 'module-path'", + evt_tag_str("module-path", module_path), + evt_tag_str("module", module_name), + NULL); return NULL; } msg_debug("Trying to open module", diff --git a/lib/syslog-ng.h b/lib/syslog-ng.h index 4bd79c2..edb8a4d 100644 --- a/lib/syslog-ng.h +++ b/lib/syslog-ng.h @@ -66,5 +66,6 @@ typedef struct _GlobalConfig GlobalConfig; extern GlobalConfig *configuration; extern gchar *module_path; extern gchar *default_modules; +extern gboolean silent_module_load; #endif diff --git a/syslog-ng/main.c b/syslog-ng/main.c index c682e44..e414321 100644 --- a/syslog-ng/main.c +++ b/syslog-ng/main.c @@ -75,6 +75,7 @@ static GOptionEntry syslogng_options[] = { "module-registry", 0, 0, G_OPTION_ARG_NONE, &display_module_registry, "Display module information", NULL }, { "default-modules", 0, 0, G_OPTION_ARG_STRING, &default_modules, "Set the set of auto-loaded modules, default=" DEFAULT_MODULES, "<module-list>" }, { "seed", 'S', 0, G_OPTION_ARG_NONE, &dummy, "Does nothing, the need to seed the random generator is autodetected", NULL}, + { "silent-module-load", 'q', 0, G_OPTION_ARG_NONE, &silent_module_load, "Load modules silently, not printing a warning when one's not found", NULL}, #ifdef YYDEBUG { "yydebug", 'y', 0, G_OPTION_ARG_NONE, &cfg_parser_debug, "Enable configuration parser debugging", NULL }, #endif -- 1.7.7

2 2

[Bug 138] New: Compilation failure in 3.3.1: CLOCK_MONOTONIC undeclared
by bugzilla＠bugzilla.balabit.com 15 Oct '11

15 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=138 Summary: Compilation failure in 3.3.1: CLOCK_MONOTONIC undeclared Product: syslog-ng Version: unspecified Platform: Macintosh OS/Version: Mac OS Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jacknagel(a)gmail.com Type of the Report: bug Estimated Hours: 0.0 Attempting to compile syslog-ng v3.3.1 from source on Mac OS X 10.6.8 fails with logsource.c: In function ‘log_source_msg_ack’: logsource.c:85: error: ‘CLOCK_MONOTONIC’ undeclared (first use in this function) logsource.c:85: error: (Each undeclared identifier is reported only once logsource.c:85: error: for each function it appears in.) I believe this is because OS X does not define CLOCK_MONOTONIC. Actually, afaik, OS X doesn't implement clock_gettime() either. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[PATCH] Fix compilation without OpenSSL.
by Gergely Nagy 15 Oct '11

15 Oct '11

While most places where OpenSSL was used were guarded by ENABLE_SSL ifs, some were not. This patch adds those guards to lib/crypto.c, modules/afsql/afsql.c and tests/loggen/loggen.c. It also makes sure that OPENSSL_LIBS gets emptied when enable_ssl is set to no. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- configure.in | 4 ++++ lib/crypto.c | 4 ++++ modules/afsql/afsql.c | 3 +++ tests/loggen/loggen.c | 3 +++ 4 files changed, 14 insertions(+), 0 deletions(-) diff --git a/configure.in b/configure.in index 13bc874..686911e 100644 --- a/configure.in +++ b/configure.in @@ -679,6 +679,10 @@ else enable_ssl="no" fi +if test "x$enable_ssl" = "xno"; then + OPENSSL_LIBS="" +fi + dnl dnl Right now, openssl is never linked statically as it is only used by the dnl TLS build of the afsocket plugin which is loaded dynamically anyway. diff --git a/lib/crypto.c b/lib/crypto.c index 702609c..ac4d070 100644 --- a/lib/crypto.c +++ b/lib/crypto.c @@ -29,6 +29,8 @@ #include "crypto.h" #include "apphook.h" +#if ENABLE_SSL + #include <openssl/rand.h> #include <openssl/ssl.h> #include <stdio.h> @@ -124,3 +126,5 @@ crypto_init(void) } /* the crypto options (seed) are handled in main.c */ + +#endif diff --git a/modules/afsql/afsql.c b/modules/afsql/afsql.c index eb59b57..02b9f83 100644 --- a/modules/afsql/afsql.c +++ b/modules/afsql/afsql.c @@ -35,7 +35,10 @@ #include <dbi/dbi.h> #include <string.h> + +#if ENABLE_SSL #include <openssl/md5.h> +#endif /* field flags */ enum diff --git a/tests/loggen/loggen.c b/tests/loggen/loggen.c index c5399a7..bf11a1e 100644 --- a/tests/loggen/loggen.c +++ b/tests/loggen/loggen.c @@ -14,11 +14,14 @@ #include <glib.h> #include <signal.h> +#if ENABLE_SSL #include <openssl/crypto.h> #include <openssl/x509.h> #include <openssl/pem.h> #include <openssl/ssl.h> #include <openssl/err.h> +#endif + #include <unistd.h> #define MAX_MESSAGE_LENGTH 8192 -- 1.7.0.4

2 1

Special characters in syslogng filters
by Jay 15 Oct '11

15 Oct '11

Hello If the filter specified in syslog-ng.conf contains the ( character or ) character, then is it correct to prefix them with \\. For example, if I need to filter a syslog containing the string (abcd) then in syslog-ng.conf, I would need to specify the filter as \$abcd\$ Could someone confirm, if this is the correct way of specifying the filter, please ? If not, please let me know the correct way of specifying the filter. Thanks in advance for your help.

2 1

rfc3195 support
by Linus Grybäck 13 Oct '11

13 Oct '11

I was wondering if syslog-ng had support for sending messages according to the rfc3195 standard? I have not found any mention of it in the documentation. I noticed that syslog-ng can send BSD style messages with TCP. From what I understood from the rfc3195 ( http://www.ietf.org/rfc/rfc3195.txt) it specifies a way to do just that. So I was wondering if syslog-ng uses this form when it sends BSD style messages over TCP? If it have support for it at all, or not? With BSD style messages I mean messages following the rfc3164, also called legacy-syslog in the documentation. // Thanks for your help, Linus

2 1

syslog-ng Insider - October 2011
by Peter Czanik 13 Oct '11

13 Oct '11

Dear syslog-ng users, This is the 7th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com <mailto:documentation@balabit.com> FEATURED NEWS syslog-ng 3.3.1 is released! ---------------------------- A new version of syslog-ng is released! It took about a year to develop as a collaboration of over 50 individuals. Major new features include: * mongodb support * JSON support * Multi-threaded architecture For a complete list of changes, please check the NEWS file at https://www.balabit.com/files/syslog-ng/open-source-edition/3.3.1/changelog… Documentation is available at: http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.3-guid… Binary packages are available are already available for several Linux distributions: * openSUSE: http://download.opensuse.org/repositories/home:/czanik:/syslog-ng33/ and is already included in Factory. * Debian and Ubuntu: http://asylum.madhouse-project.org/projects/debian/ Many other distributions have already experimental ports, ebuilds, etc. including Arch, Fedora, FreeBSD, Gentoo. Regulatory compliance and system logging ---------------------------------------- We are happy to announce our latest technical white paper titled "Regulatory compliance and system logging". The document introduces the advantages of using syslog-ng Premium Edition to collect system log (syslog) and eventlog messages for policy compliance. The white paper includes a detailed list of policy requirements, including the requirements of the Payment Card Industry Data Security Standard (PCI-DSS), COBIT 4.1, ISO 27001, and the Health Insurance Portability and Accountability Act (HIPAA) that you can address with syslog-ng Premium Edition. The document is recommended for technical experts and decision makers working on implementing centralized logging solutions, and want to improve their compliance with industry standards. In addition, the white paper discusses further features of syslog-ng PE that can come handy for you when designing and implementing your system logging architecture. While the document focuses on syslog-ng PE, part of it also applies to syslog-ng OSE. It is available at http://www.balabit.com/support/documentation/syslog-ng-v3.0-whitepaper-comp… OTHER SHORT NEWS * BalaBit IT Security contributes to Common Event Expression Board’s log standardization work: http://andrea.blogs.balabit.com/2011/09/balabit-it-security-contributes-to-… <http://andrea.blogs.balabit.com/2011/09/balabit-it-security-contributes-to-…> * Some new books mentioning syslog-ng: http://czanik.blogs.balabit.com/2011/09/syslog-ng-in-books/ NEW RELEASES * syslog-ng OSE 3.3.1: https://lists.balabit.hu/pipermail/syslog-ng/2011-October/017420.html * syslog-ng PE 4 F1: http://andrea.blogs.balabit.com/2011/10/balabit-to-announce-the-high-speed-… WHITE PAPERS Download our latest white paper titled "Business benefits of logging". >From this White Paper you can learn: * How logging-based benefits can make *the work of managers more successful.* * How logging contributes to *lowering the operational costs*of organizations while making them more efficient. * How *syslog-ng logging technology*can contribute to organizations' business requirements. It is available at http://www.balabit.com/whitepaper?wp=46820069482870468259863 ARCHIVE http://insider.blogs.balabit.com/ -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

make error on AIX 6.1
by Frank Collette 09 Oct '11

09 Oct '11

# make make all-recursive Making all in lib "Makefile", line 679: make: 1254-055 Dependency line needs colon or double colon operator. make: 1254-058 Fatal errors encountered -- cannot continue. make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 2. Stop. ---- Line 679 in lib/Makefile is- ps: ps-am I've installed the RPM and syslog-ng core dumps, so I figured trying to build from source would be a better option. Any help in getting this compiled would be appreciated! Thanks, Frank

4 9

mismatching size/inode information
by Gbe gbe 07 Oct '11

07 Oct '11

Hi everyone ! I have this message in my logs repeated several times and for different files : « syslog-ng[964]: The current log file has a mismatching size/inode information, restarting from the beginning; filename='/var/log/squid3/access.log' » This message comes from this part of the code in src/logreader.c : 644 if (cur_inode && 645 cur_inode == log_reader_get_inode(self) && 646 cur_size <= log_reader_get_size(self)) 647 { 648 /* ok, the stored state matches the current file */ 649 log_reader_update_pos(self, cur_pos); 650 return; 651 } 652 else 653 { 654 /* the stored state does not match the current file */ 655 msg_notice("The current log file has a mismatching size/inode information, restarting from the beginning", 656 evt_tag_str("filename", self->follow_filename), 657 NULL); 658 goto error; 659 } Does this mean I may have a hardware problem? Hard drive not working properly, file system damaged, … Google hasn't been really helpful so far. Greg.

2 4

syslog-ng 3.3.1 released
by Balazs Scheidler 06 Oct '11

06 Oct '11

Hi, I'm proud to announce that syslog-ng 3.3.1 has been released. It is an important release in a number of ways: - syslog-ng architecture was completely revamped to scale properly in today's multi-core environments. I've seen it process 800000 messages / second in some scenarios. - following the licensing change in 3.2, it incorporates contributions (code, testing & feedback) from 54 individuals. In total, the development of 3.3 took about a year, producing 580 patches and the following diffstat: 294 files changed, 20314 insertions(+), 7624 deletions(-) That compared to the total number of lines in the git repository (81804 lines) is a significant change over 3.2 See the syslog-ng ohloh page for more statistics: https://www.ohloh.net/p/syslog-ng For the list of features and changes, please see the NEWS entry at the end of this email. You can download the source code from: https://www.balabit.com/network-security/syslog-ng/opensource-logging-syste… A number of distributions already carry 3.3.1 packages thanks for our faithful package maintainers. You can also get the source code from git, at http://git.balabit.hu/ I'd like to thank all contributors who have helped to make syslog-ng to be what it is today (collected from the git commit summaries): Andras Mitzki <micek(a)balabit.hu> Andy Ruch <adruch2002(a)yahoo.com> Arkadiusz Miśkiewicz <arekm(a)maven.pl> Attila Nagy <naat(a)balabit.hu> Balazs Nemeth Balazs Scheidler <bazsi(a)balabit.hu> Balint Kovacs <balint.kovacs(a)balabit.hu> Brett Edgar <brett.edgar(a)truedigitalsecurity.com> Corinna Vinschen <vinschen(a)redhat.com> Costa Farber <costaf(a)wix.com> Craig Bell Dalibor Toman <dtoman(a)fortech.cz> Dave Reisner <dreisner(a)archlinux.org> Eric Berggren Eric Duda <ericduda(a)yahoo.com> Fischhof Gyorgy <george(a)balabit.hu> Gergely Nagy <algernon(a)balabit.hu> Jakub Jankowski <shasta(a)toxcorp.com> Jose Oliveira <jpo(a)di.uminho.pt> Juhasz Viktor <jviktor(a)balabit.hu> Kevin Guthrie <Kevin.Guthrie(a)itron.com> Laszlo Boszormenyi <gcs(a)lsc.hu> LEBRETON Philippe Lennart Poettering <lennart(a)poettering.net> Marius Tomaschewski <mt(a)suse.de> Martin Holste <mcholste(a)gmail.com> Marton Illes <marci(a)balabit.hu> Matthew Hall Matthew Hall <mhall(a)mhcomputing.net> Micah Anderson <micah(a)riseup.net> Michael <codejodler(a)gmx.ch> Mishou Michael <Michael.Mishou(a)csirc.irs.gov> Nat Baldwin Nix <nix(a)esperi.org.uk> Owen Mann Pallagi Zoltan <pzolee(a)balabit.hu> Paul Krizak <paul.krizak(a)amd.com> Peter "CzP" Czanik <czanik(a)balabit.hu> Peter Eisenlohr Peter Gyongyosi <gyp(a)balabit.hu> Peter Gyorko <gyorkop(a)balabit.hu> Remy Zandwijk <remy(a)luckyhands.nl> Roger <gaudet(a)verizon.net> Sandor Geller <Sandor.Geller(a)morganstanley.com> Serge Hallyn <serge.hallyn(a)ubuntu.com> Steven Chamberlain <steven(a)pyro.eu.org> SZALAY Attila <sasa(a)balabit.hu> Tamas Pal <folti(a)balabit.hu> Tevesz Andras <ghost(a)balabit.hu> Tom Gundersen <teg(a)jklm.no> Valentijn Sessink <valentyn(a)blub.net> Viktor Juhasz <jviktor(a)balabit.hu> Zhengxiang Pan Zoltan Pallagi <pzolee(a)balabit.hu> The list of changes are below (copied verbatim from the NEWS file in the source code): 3.3.1 Sat, 01 Oct 2011 13:17:56 +0200 This is the first stable release in the 3.3 series adding a number of features compared to 3.2: - multi-core/CPU scaling: the new multi-threaded architecture allows syslog-ng to scale into the 800k msg/sec region. - MongoDB support: using MongoDB instead of SQL is faster and allows better representation of log data. - JSON support: using the $(format-json) template function it is now possible to construct JSON (JavaScript Object Notation) output for log messages. JSON is a commonly used format for exchanging information between information systems, providing a rich and extensible format for structured information. - A number of enhancements all over the place: SQL, patterndb. The most important changes in this release: - The default ports have changed. syslog-ng is using the standard RFC allocated ports in the syslog() driver. - The meaning for log-iw-size() was changed for tcp() and unix-stream() drivers. That value is _evenly_ allocated to all possible connections starting with this release, whereas previously that window was shared between actual connections. Changes since 3.3.0beta2: system() source: ================ * Added support for Debian/kFreeBSD internal() source: ================== * Added support for the tags() option pdbtool test: ============= * Added support for testing a specific rule, instead of the complete patterndb file. * Added support for match debugging with the --debug and --color-out command line options. pdbtool dictionary: =================== * New pdbtool command that displays the name-value pairs that are set by any of the rules in a patterndb XML file. $(indent-multi-line): ===================== * This template function was added to make it possible to write multi-line log messages into a file. The first line is written like a regular message, subsequent lines are indented with a tab, just like RFC822. Other features & changes: ========================= * At stats-level(3) syslog-ng keeps track how much messages get tagged with individual tags. * Added support for pad_size() option for destinations, effectively padding the output string to a fixed size. This can be used on HP-UX to send messages to the local syslogd daemon, as that expects messages to be padded to 2048 bytes. * The command-line parser of the value-pairs functionality (used by $(format-json) for instance, was changed to use an empty scope by default. Bugfixes: ========= * Fixed spoof-source support as it didn't have proper thread synchronization in the previous beta versions, causing memory leaks and crashes if spoof-source was enabled on a destination and threading is used. * Fixed a MongoDB and SQL race conditions causing stalls and failed assertions. * Fixed a possible stall of syslog-ng caused by pipe() destinations without readers (e.g. /dev/xconsole). The root cause was a flipped flow-control state: pipes have become flow-controlled even if the user didn't request it. On the other hand files have become non-flow-controlled, even though they always should be. * Fixed possible crashes during reload or shutdown. * Fixes for several, significant memory leaks: - Fixed a major memory leak, effectively causing all messages to be leaked when message contents are changed on some of the log statements (with a rewrite rule or a parser). - Fixed a memory leak in file destinations caused by the leakage of the associated queue when the given file is closed (by time-reap or otherwise). - Fixed a memory leak in the server protocol handling code, leaking a small amount of memory every time a connection is closed. - Fixed a memory leak in the log source code causing some memory to be leaked for each connection when processing a reload. - PCRE matcher has leaked its state, causing a small leak on reloads. - The configuration parser contained leaks also causing leaks when parsing the configuration file (e.g. on reloads). - The persist state handling code has leaked some memory each time the persist state file was processed (startup + reloads). * Fixed thread synchronization when registering/deregistering stats counters. Previously these were performed without caring about threads, effectively the root cause for various ill effects from invalid counters to crashes. * Fixed a timestamp parsing problems affecting timestamps with month values between and including September .. December. * Fixed a timezone representation issue for zones that have half an hour offsets from GMT in the negative direction. * Fixed pdbtool patternize to generate proper UUIDs if openssl was detected. Previously it worked as if openssl was never detected. * Fixed a possible race on MARK message timing, which could cause MARK messages to appear somewhat inconsistently. * Fixed the generation of [meta sequenceId] SDATA field. * Fixed handling of zero-sized messages which have caused a crash due to NULL deref. * The processing of included directories was changed not to include hidden files. * Reloading syslog-ng didn't reinitialize the name resolver causing etc/resolv.conf changes not to be recognized even if syslog-ng was reloaded. A res_init() call was added to match earlier behaviour and UNIX best practice. * Fixed program-override() clash with the 'store-legacy-msghdr' reader flag, which has become default in syslog-ng 3.1. If storing the legacy msghdr is enabled, overwriting the value for $PROGRAM was not reflected in the output, since instead of reconstructing it from the parsed values, syslog-ng always used what was originally in the input. If the value for $PROGRAM changes, that automatically disables the use of the 'store-legacy-msghdr' flag. * Fixed CAP_SYSLOG detection to also detect if either the kernel, or libcap is lacking some required functionality. * Fixed the handling of messages generated by AIX, which include a "message forwarded for" header that syslog-ng failed to parse properly. * Fixed proper size limitation for the data structure used to hold name-value pairs of a log message. Previously, if this structure would go over 262140 bytes syslog-ng crashed because of an unhandled integer overflow. Build changes: ============== * It is possible to request the use of the system-installed libmongo-client instead of the bundled one. At least 0.1.3 is required. * The bundled libmongo-client was updated to 0.1.4, plus some minor patches (tagged in the git.balabit.hu git repo with syslog-ng-3.3-ref2) * autogen.sh: automatically check the availability of git before trying to pull the bundled libraries from git.balabit.hu * systemd unit file redirects syslog-ng startup messages to /dev/null without a better place. * Introduced a pkg-config file for syslog-ng.pc to make it easier to build 3rd party modules for syslog-ng. * The syslog-ng version number is added to libsyslog-ng.so, which goes to $prefix/lib to indicate that binary compatibility is not guaranteed between syslog-ng versions. * Added --without-compile-date option to remove the compilation date from the binary, as SUSE Linux checks if recompilation changes the binary to detect if dependent packages need to be rebuilt or not. * It is now possible to build against libsystemd-daemon instead of using the bundled sources. Other changes: ============== * The --seed command line option has become a no-op, syslog-ng tries to detect the availability of the random seed automatically. The command line option of the syslog-ng binary is present without doing anything, but it was removed from other utilities. Credits: ======== syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: * Attila Nagy (BalaBit) * Balazs Scheidler (BalaBit) * Balint Kovacs (BalaBit) * Costa Farber (wix.com) * Eric Duda * Gergely Nagy (BalaBit) * Jakub Jankowski (SuperHost.pl) * Kevin Guthrie (itron) * Lennart Poettering (RedHat) * Martin Holste * Marton Illes (BalaBit) * Peter Czanik (BalaBit) * Peter Eisenlohr * Peter Gyorko (BalaBit) * Sandor Geller (Morgan Stanley) * Tamas Pal (BalaBit) * Viktor Juhasz (BalaBit) -- Bazsi

2 1

[Bug 137] New: [debian #642479]: should print a warning at startup if not configured to log anything
by bugzilla＠bugzilla.balabit.com 06 Oct '11

06 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=137 Summary: [debian #642479]: should print a warning at startup if not configured to log anything Product: syslog-ng Version: unspecified Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642479 OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: algernon(a)balabit.hu Type of the Report: --- Estimated Hours: 0.0 The following report was filed in the Debian BTS against the syslog-ng package: So I was frustrated for a while by why "/var/log/messages", etc., all had a timestamp of a few months ago (which is when I last installed or reconfigured Syslog-NG on this host). The attached file does work; I'm pretty sure the problem was that I had a whole page of "log(...)" statements with no "source(...)" option and no "catchall" flag. If the start-script can prove by static analysis that it's impossible for any messages to match and be written to any destination, it should print a warning, not just start silently. In fact, a "log(...)" statement with no "source(...)" option and no "catchall" flag should probably trigger a warning. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

SQL support under cygwin?
by Fekete Robert 05 Oct '11

05 Oct '11

Hi, I assume that the SQL destination is not enabled in the cygwin package of syslog-ng. Is that correct? Someone is trying to use syslog-ng on Windows to log into a database, and I suspect that is why he fails (http://www.syslog.org/forum/index.php?topic=1224.0) Can anyone confirm that? Thank you in advance. Regards, Robert

2 2