- syslog-ng - lists.balabit.hu

Interesting issue with syslog-ng 3.3
by Gergely Nagy 03 Sep '11

03 Sep '11

Hi! While this mail might sound a bit vague, it will - if nothing else - serve as a reminder for me to investigate the issue furhter. On one of my servers (PowerPC, running Debian Squeeze), I have a syslog-ng 3.3 running, a reasonably recent (2-3 day old) git snapshot. It works quite well, except that I was able to trace back my server's recent hangs to syslog-ng: The server had a ~120 day uptime when I upgraded from 3.1 to 3.3, and since that time, it had to be rebooted two times already, just in two weeks time. Last time, I didn't have any open connections to it, so couldn't investigate, but tonight, I had an ssh session open with a screen session inside. So I tried to look around: first, I wanted to check the logs, but knew I wouldn't find anything, as it stopped sending the logs to my other server about two hours before I noticed the problem. Even worse, when I tried to sudo, that hung, indefinitely. Weird. There was nothing in dmesg, and nothing interesting in the logs it did send before becoming unresponsive. HTTP still worked too, as did a few other services. I could do nearly anything as a user. So I tried stracing crontab, and it hung when it tried to send logs to /dev/log. Interesting! I tried logger, same happens. I suspect that for one reason or the other, /dev/log got overwhelmed, and even worse, syslog-ng ended up trying to log something aswell, which made it hang too. And thus, the queue remained full, and everything that tried to log, got stuck. HTTP continued to work, since my httpd isn't using syslog for its logs. I could poke around in my shell, since that wasn't logging, either. This never happened with 3.1, and the only thing I changed in the config is the @version, pretty much. Thus, I suspect, there's some very nasty bug in 3.3beta2 that I haven't found yet. I'm leaving a root shell open this time, so that I can poke around further next time (along with a syslog-ng compiled with debug symbols). In the meantime, I thought I'll drop a note, hoping that perhaps Bazsi or someone from the syslog-ng devel team would have an idea where to look, and what to check next time this happens. -- |8]

5 6

Redirecting logs and UDP issues
by Aldrich, Jamie S 02 Sep '11

02 Sep '11

All, I am trying to redirect a log file from an NFS mount (AIX server = source and Redhat server = target). The redirect is going to a LogLogic device over UDP, and I am seeing quite a few dropped packets in /var/log/messages. Samples below: Aug 31 07:34:16 lxfwossecp3 syslog-ng[30574]: syslog-ng starting up; version='2.1.4' Aug 31 07:44:16 lxfwossecp3 syslog-ng[30574]: Log statistics; dropped='udp(10.13.33.11:514)=0', processed='center(queued)=15', processed='center(received)=15', processed='destination(d_messages)=11', processed='destination(d_boot)=0', pro cessed='destination(d_auth)=2', processed='destination(d_cron)=1', processed='destination(d_mlal)=0', processed='destination(d_kern)=0', processed='destination(d_mesg)=1', processed='destination(d_cons)=0', processed='destination(d_spol)= 0', processed='destination(d_mail)=0', processed='source(s_sys)=4', processed='source(s_file)=11', suppressed='udp(10.13.33.11:514)=0' Aug 31 07:54:16 lxfwossecp3 syslog-ng[30574]: Log statistics; dropped='udp(10.13.33.11:514)=0', processed='center(queued)=17', processed='center(received)=17', processed='destination(d_messages)=11', processed='destination(d_boot)=0', pro cessed='destination(d_auth)=2', processed='destination(d_cron)=2', processed='destination(d_mlal)=0', processed='destination(d_kern)=0', processed='destination(d_mesg)=2', processed='destination(d_cons)=0', processed='destination(d_spol)= 0', processed='destination(d_mail)=0', processed='source(s_sys)=6', processed='source(s_file)=11', suppressed='udp(10.13.33.11:514)=0' Aug 31 08:04:16 lxfwossecp3 syslog-ng[30574]: Log statistics; dropped='udp(10.13.33.11:514)=0', processed='center(queued)=20', processed='center(received)=20', processed='destination(d_messages)=11', processed='destination(d_boot)=0', pro cessed='destination(d_auth)=2', processed='destination(d_cron)=4', processed='destination(d_mlal)=0', processed='destination(d_kern)=0', processed='destination(d_mesg)=3', processed='destination(d_cons)=0', processed='destination(d_spol)= 0', processed='destination(d_mail)=0', processed='source(s_sys)=9', processed='source(s_file)=11', suppressed='udp(10.13.33.11:514)=0' Aug 31 08:14:16 lxfwossecp3 syslog-ng[30574]: Log statistics; dropped='udp(10.13.33.11:514)=0', processed='center(queued)=22', processed='center(received)=22', processed='destination(d_messages)=11', processed='destination(d_boot)=0', pro cessed='destination(d_auth)=2', processed='destination(d_cron)=5', processed='destination(d_mlal)=0', processed='destination(d_kern)=0', processed='destination(d_mesg)=4', processed='destination(d_cons)=0', processed='destination(d_spol)= 0', processed='destination(d_mail)=0', processed='source(s_sys)=11', processed='source(s_file)=11', suppressed='udp(10.13.33.11:514)=0' Aug 31 08:24:16 lxfwossecp3 syslog-ng[30574]: Log statistics; dropped='udp(10.13.33.11:514)=0', processed='center(queued)=28', processed='center(received)=28', processed='destination(d_messages)=11', processed='destination(d_boot)=0', pro cessed='destination(d_auth)=6', processed='destination(d_cron)=6', processed='destination(d_mlal)=0', processed='destination(d_kern)=0', processed='destination(d_mesg)=5', processed='destination(d_cons)=0', processed='destination(d_spol)= 0', processed='destination(d_mail)=0', processed='source(s_sys)=17', processed='source(s_file)=11', suppressed='udp(10.13.33.11:514)=0' Here is what my syslog-ng.conf file looks like: # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # options { time_reopen (10); flush_lines (2000); flush_timeout (20000); log_fifo_size (30000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); # udp(ip(0.0.0.0) port(514)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" sync(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_kern { file("/var/log/kern"); }; destination d_mlal { usertty("*"); }; filter f_kernel { facility(kern); }; filter f_default { level(info..emerg) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_auth { facility(authpriv); }; filter f_mail { facility(mail); }; filter f_emergency { level(emerg); }; filter f_news { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_boot { facility(local7); }; filter f_cron { facility(cron); }; #log { source(s_sys); filter(f_kernel); destination(d_cons); }; log { source(s_sys); filter(f_kernel); destination(d_kern); }; log { source(s_sys); filter(f_default); destination(d_mesg); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_mail); destination(d_mail); }; log { source(s_sys); filter(f_emergency); destination(d_mlal); }; log { source(s_sys); filter(f_news); destination(d_spol); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; log { source(s_sys); filter(f_cron); destination(d_cron); }; # vim:ft=syslog-ng:ai:si:ts=4:sw=4:et: # Setup for PeopleSoft logs to transmit to Loglogic source s_file { file("/tmp/APPSRV_current.LOG" flags(no-parse)); }; destination d_messages{ udp("10.13.33.11" port(514) log_fifo_size(900000000)); }; log { source(s_file); destination(d_messages); }; Does anyone see anything wrong with the setup? Could the NFS link be an issue? Any help would be greatly appreciated! Thanks, Jamie

2 3

[PATCH] afsocket: Compile against libsystemd-daemon, if present.
by Gergely Nagy 02 Sep '11

02 Sep '11

systemd v31+ comes with a libsystemd-daemon shared library. If systemd is enabled, try to detect this library, and use it if present. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- configure.in | 2 ++ modules/afsocket/Makefile.am | 12 ++++++++---- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/configure.in b/configure.in index 2685568..b6c95cf 100644 --- a/configure.in +++ b/configure.in @@ -895,6 +895,7 @@ if test "x$enable_systemd" = "xauto"; then fi if test "x$enable_systemd" = "xyes"; then + PKG_CHECK_MODULES(libsystemd_daemon, libsystemd-daemon >= 31,with_libsystemd="yes",with_libsystemd="no") if test "x$with_systemdsystemunitdir" = "xyes"; then # no arguments, just --with-systemdsystemunitdir systemdsystemunitdir=$($PKG_CONFIG --variable=systemdsystemunitdir systemd); @@ -1064,6 +1065,7 @@ AM_CONDITIONAL(ENABLE_SUN_STREAMS, [test "$enable_sun_streams" = "yes"]) AM_CONDITIONAL(ENABLE_PACCT, [test "$enable_pacct" = "yes"]) AM_CONDITIONAL(ENABLE_MONGODB, [test "$enable_mongodb" = "yes"]) AM_CONDITIONAL(ENABLE_JSON, [test "$enable_json" = "yes"]) +AM_CONDITIONAL(WITH_LIBSYSTEMD, [test "$with_libsystemd" = "yes"]) # substitution into manual pages expanded_sysconfdir=[`patheval $sysconfdir | sed -e 's/-/\\\\-/g'`] diff --git a/modules/afsocket/Makefile.am b/modules/afsocket/Makefile.am index 08ffc19..79f9c99 100644 --- a/modules/afsocket/Makefile.am +++ b/modules/afsocket/Makefile.am @@ -3,7 +3,11 @@ AM_CPPFLAGS = -I$(top_srcdir)/lib -I../../lib export top_srcdir if ENABLE_SYSTEMD +if WITH_LIBSYSTEMD +SYSTEMD_SOURCES = +else SYSTEMD_SOURCES = sd-daemon.c sd-daemon.h +endif else SYSTEMD_SOURCES = endif @@ -14,8 +18,8 @@ libafsocket_notls_la_SOURCES = \ afsocket.c afsocket.h afunix.c afunix.h afinet.c afinet.h \ afsocket-grammar.y afsocket-parser.c afsocket-parser.h afsocket-plugin.c \ $(SYSTEMD_SOURCES) -libafsocket_notls_la_CPPFLAGS = $(AM_CPPFLAGS) -libafsocket_notls_la_LIBADD = $(MODULE_DEPS_LIBS) $(LIBNET_LIBS) $(LIBWRAP_LIBS) +libafsocket_notls_la_CPPFLAGS = $(AM_CPPFLAGS) $(libsystemd_daemon_CFLAGS) +libafsocket_notls_la_LIBADD = $(MODULE_DEPS_LIBS) $(LIBNET_LIBS) $(LIBWRAP_LIBS) $(libsystemd_daemon_LIBS) libafsocket_notls_la_LDFLAGS = $(MODULE_LDFLAGS) if ENABLE_SSL @@ -24,8 +28,8 @@ libafsocket_tls_la_SOURCES = \ afsocket.c afsocket.h afunix.c afunix.h afinet.c afinet.h \ afsocket-grammar.y afsocket-parser.c afsocket-parser.h afsocket-plugin.c \ $(SYSTEMD_SOURCES) -libafsocket_tls_la_CPPFLAGS = $(AM_CPPFLAGS) -DENABLE_SSL=1 -libafsocket_tls_la_LIBADD = $(MODULE_DEPS_LIBS) ../../lib/libsyslog-ng-crypto.la $(OPENSSL_LIBS) $(ZLIB_LIBS) $(LIBNET_LIBS) $(LIBWRAP_LIBS) +libafsocket_tls_la_CPPFLAGS = $(AM_CPPFLAGS) $(libsystemd_daemon_CFLAGS) -DENABLE_SSL=1 +libafsocket_tls_la_LIBADD = $(MODULE_DEPS_LIBS) ../../lib/libsyslog-ng-crypto.la $(OPENSSL_LIBS) $(ZLIB_LIBS) $(LIBNET_LIBS) $(LIBWRAP_LIBS) $(libsystemd_daemon_LIBS) libafsocket_tls_la_LDFLAGS = $(MODULE_LDFLAGS) endif -- 1.7.5.4

2 1

[PATCH 0/2] Various stuff for easier packaging
by Gergely Nagy 02 Sep '11

02 Sep '11

Two patches will follow, that make it slightly easier to package syslog-ng and to build external modules against it. The first will change the SONAME of libsyslog-ng, from libsyslog-ng.so.0 to libsyslog-ng-${VERSION} (as of this writing, this would be libsyslog-ng-3.3.0beta2.so). The rationale behind this, is that at the moment, there are no guarantees that either ABI or API will be preserved between versions, so it's easier and more straightforward to tie the library to a particular syslog-ng version instead. The other patch adds moduledir to the pkg-config file, so that external modules can easily figure out where to install themselves, without resorting to guessing and parsing syslog-ng --help output (where syslog-ng might not even be available in the build chroot..).

2 3

[Bug 132] New: Timestamp issue with negative offset
by bugzilla＠bugzilla.balabit.com 02 Sep '11

02 Sep '11

https://bugzilla.balabit.com/show_bug.cgi?id=132 Summary: Timestamp issue with negative offset Product: syslog-ng Version: 3.2.x Platform: Other OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: mjrmedina(a)gmail.com Type of the Report: bug Estimated Hours: 0.0 Hi: I have syslog-ng 3.2.4 installed in Red Hat EL 6. My timezone is GMT-04:30 (Caracas,Venezuela) and I'm using ISO8601 timestamp format in syslog-ng. The timestamp format of the syslog-ng using my timezone is like follow: 2011-08-31T12:32:25-04:-30 2011-08-31T12:32:31-04:-30 See that before the "30" there is a second "-", because the first "-" is before "04". This issue is presented with all the negative time zones that has "30" in the minute offset (I test with Newfoundland,Canada too). Too I have tested this syslog-ng version in RHEL5 and the behaviour is the same. I think that this should be a kind of BUG. Rigth? Any workaround to handle this? Thanks in advanced... Mario -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 4

[PATCH] afmongodb: Fix threaded operation.
by Gergely Nagy 02 Sep '11

02 Sep '11

Ported a patch from afsql to afmongodb, that makes the writer thread wake up only when it's synced. This makes threaded(yes) work more reliably. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/afmongodb/afmongodb.c | 18 ++++++++++++++++-- 1 files changed, 16 insertions(+), 2 deletions(-) diff --git a/modules/afmongodb/afmongodb.c b/modules/afmongodb/afmongodb.c index 9e155ed..0f01f05 100644 --- a/modules/afmongodb/afmongodb.c +++ b/modules/afmongodb/afmongodb.c @@ -497,6 +497,17 @@ afmongodb_dd_free(LogPipe *d) } static void +afmongodb_dd_queue_notify(gpointer user_data) +{ + MongoDBDestDriver *self = (MongoDBDestDriver *)user_data; + + g_mutex_lock(self->queue_mutex); + g_cond_signal(self->writer_thread_wakeup_cond); + log_queue_reset_parallel_push(self->queue); + g_mutex_unlock(self->queue_mutex); +} + +static void afmongodb_dd_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, gpointer user_data) { MongoDBDestDriver *self = (MongoDBDestDriver *)s; @@ -509,12 +520,15 @@ afmongodb_dd_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_optio g_mutex_lock(self->queue_mutex); self->last_msg_stamp = cached_g_current_time_sec (); queue_was_empty = log_queue_get_length(self->queue) == 0; - log_queue_push_tail(self->queue, msg, path_options); g_mutex_unlock(self->queue_mutex); + + log_queue_push_tail(self->queue, msg, path_options); g_mutex_lock(self->suspend_mutex); if (queue_was_empty && !self->writer_thread_suspended) - g_cond_signal(self->writer_thread_wakeup_cond); + { + log_queue_set_parallel_push(self->queue, 1, afmongodb_dd_queue_notify, self, NULL); + } g_mutex_unlock(self->suspend_mutex); } -- 1.7.0.4

2 1

log for patterns
by Peter Czanik 02 Sep '11

02 Sep '11

Hello, While my previous post was about Windows, we did not forget about our UNIX/Linux users :) I'd like to extend our pattern database with new patterns. So I have some related questions: - Until now we dealt mostly with login/logut events of different applications, as this is one of the most interesting information on servers. Is it OK with you, or we should cover also other events? (Which?) - Which applications are you mostly interested in? - Creating logs in a "lab" environment just for pattern creation is very time consuming. It would be very helpful for us, if you could send logs in exchange for patterns. Just make sure, that there is no sensitive data left in the logs, as the result will be published to make it available for the whole syslog-ng community. I published a blog ( http://czanik.blogs.balabit.com/2010/11/log-sample-collecting-project/ ), how I collect logs for pattern creation, but of course, any logs are welcome! Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

4 3

License for syslog-ng OSE v 3.2.x
by Yu Watanabe 01 Sep '11

01 Sep '11

Hello all. I would like to ask question for the license of syslog-ng. syslog-ng is licensed under the combination of the GPL and LGPL licenses. The syslog-ng core (src/ subdirectory) is licensed under the Lesser General Public License as described in the file LGPL.txt The syslog-ng modules (src/xxxx/ subdirectories) are licensed under the General Public License as described in the file GPL.txt Would it be correct to understand as below? LGPL = LGPLv2.1 GPL = GNU General Public License, version 1 I couldn't find the both text in the tarball so asked this question. Thanks! Yu

3 3

[PATCH] [pdbtool] debug-id option
by Balint Kovacs 31 Aug '11

31 Aug '11

Hi, While working with `pdbtool test`, I found that it's quite uncomfortable to find problems with non-matching messages, as it only displays the ID of the erroneous pattern. Right now you would need to copy the example message and program name, and pass it to `pdbtool match` as arguments to find out what's the exact issue and get a nice colorized output pointing to the problematic part of the pattern. To make that easier, I've done a small enhancement to pdbtool, an option to do a full, colorized debug output on a given rule by only supplying its ID. This would look something like (coloring lost in email): blint@lyra:~/blah/syslog-ng-ose-mainline-3.4$ ./bin/pdbtool debug-id -p /var/tmp/patterndb/system-bind.xml -r "b57a384f-c8be-41e9-bc10-735695dc63e7" Pattern matching part: unexpected RCODE (REFUSED) resolving @QSTRING:.dict.arpa=hushmail.com/AAAA/IN@:@QSTRING:.dict.src=203.197.12.30@deliberately freaked up test message 53 Matching part: unexpected RCODE (REFUSED) resolving 'hushmail.com/AAAA/IN': 203.197.12.30# Values: MESSAGE=unexpected RCODE (REFUSED) resolving 'hushmail.com/AAAA/IN': 203.197.12.30#deliberately freaked up test message 53 PROGRAM=named .classifier.class=unknown The patch is against 3.4, but should apply to 3.3 as well. Balint commit 93ca04700f8706643fedea51936af02daa314766 Author: Balint Kovacs<blint(a)balabit.hu> Date: Mon Aug 15 11:07:50 2011 +0200 [pdbtool] Implemented debug-id option Added a new option to pdbtool to test a specific rule against its example message with colorizing debug turned on. Signed-off-by: Balint Kovacs<blint(a)balabit.hu> diff --git a/modules/dbparser/pdbtool.c b/modules/dbparser/pdbtool.c index 64ccd17..f64012d 100644 --- a/modules/dbparser/pdbtool.c +++ b/modules/dbparser/pdbtool.c @@ -640,6 +640,75 @@ static GOptionEntry match_options[] = { NULL, 0, 0, G_OPTION_ARG_NONE, NULL, NULL } }; +static gchar *rule_id = NULL; + +static gboolean +pdbtool_debug_id(int argc, char *argv[]) +{ + PatternDB *patterndb; + PDBExample *example; + GList *examples = NULL; + gboolean id_is_found = FALSE; + + debug_pattern = TRUE; + debug_pattern_parse = FALSE; + color_out = TRUE; + colors = full_colors; + + if (!rule_id) + { + printf("Please specify a rule ID to be tested against its example message!\n"); + return FALSE; + } + + patterndb = pattern_db_new(); + if (!pdb_rule_set_load(patterndb->ruleset, configuration, patterndb_file,&examples)) + { + pattern_db_free(patterndb); + return FALSE; + } + + while (examples) + { + example = examples->data; + + if (strcmp(example->rule->rule_id, rule_id) != 0) + { + examples = g_list_delete_link(examples, examples); + continue; + } + + id_is_found = TRUE; + + if (example->message&& example->program) + { + match_message = example->message; + match_program = example-> program; + pdbtool_match(argc, argv); + } + examples = g_list_delete_link(examples, examples); + } + + pattern_db_free(patterndb); + + if (!id_is_found) + { + printf("Could not find a corresponding ID in the patterndb file or the rule does not have an example message.\n"); + return FALSE; + } + + return TRUE; +} + +static GOptionEntry debug_id_options[] = +{ + { "pdb", 'p', 0, G_OPTION_ARG_STRING,&patterndb_file, + "Name of the patterndb file", "<patterndb_file>" }, + { "ruleid", 'r', 0, G_OPTION_ARG_STRING,&rule_id, + "ID of the patterndb rule to debug", "<rule_id>" }, + { NULL, 0, 0, G_OPTION_ARG_NONE, NULL, NULL } +}; + static gboolean test_validate = FALSE; static gboolean @@ -934,6 +1003,7 @@ static struct { "dump", dump_options, "Dump pattern datebase tree", pdbtool_dump }, { "merge", merge_options, "Merge pattern databases", pdbtool_merge }, { "test", test_options, "Test pattern databases", pdbtool_test }, + { "debug-id", debug_id_options, "Test pattern databases", pdbtool_debug_id }, { "patternize", patternize_options, "Create a pattern database from logs", pdbtool_patternize }, { NULL, NULL }, };

2 7

Duplicate Hostnames entries in syslog-ng
by Swati4 M/TVM/TCS 30 Aug '11

30 Aug '11

Hi, My client machine is running syslog-ng 3.0 version and remote server is running syslog. On logging messages from client to server,I am encountering duplicate entries for hostnames in the remote syslog messages and an extra colon. In local log files running syslog-ng,there are no duplicate entries. Have tried the following options,but no luck:- keep_hostname(yes); chain_hostnames(no); long_hostnames(no); For "extra colon" seen in remote messages,I have tried attaching some templates to filter my messages. Since,I guess in syslog-ng 3.0 the macro $MSG has been changed to $MSGHDR. Remote Output :- Aug 12 03:42:49 base0-0-0-1-0-11-1 base0-0-0-1-0-11-1 kernel: : device eth0 left promiscuous mode Expected Output :- Aug 12 03:42:49 base0-0-0-1-0-11-1 kernel:device eth0 left promiscuous mode Can anybody please help me with the issue ? Thanks in advance. Regards This is a snippet of my syslog-ng.conf file :- options { flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

1 0

UDP Dropping packets
by Aldrich, Jamie S 30 Aug '11

30 Aug '11

I am trying to send the output from an application log to a LogLogic device, and it appears we are getting UDP drops repeatedly. Any ideas on what I can do to fix them? Aug 25 15:24:55 lxfwossecp3 syslog-ng[2297]: Log statistics; dropped='udp(10.13.33.11:514)=0', processed='center(queued)=6376', processed='center(received)=6376', processed='destination(d_messages)=6374', processed='destination(d_bo ot)=0', processed='destination(d_auth)=0', processed='destination(d_cron)=1', processed='destination(d_mlal)=0', processed='destination(d_kern)=0', processed='destination(d_mesg)=1', processed='destination(d_cons)=0', processed='des tination(d_spol)=0', processed='destination(d_mail)=0', processed='source(s_sys)=2', processed='source(s_file)=6374', suppressed='udp(10.13.33.11:514)=0' Aug 25 15:34:55 lxfwossecp3 syslog-ng[2297]: Log statistics; dropped='udp(10.13.33.11:514)=0', processed='center(queued)=6378', processed='center(received)=6378', processed='destination(d_messages)=6374', processed='destination(d_bo ot)=0', processed='destination(d_auth)=0', processed='destination(d_cron)=2', processed='destination(d_mlal)=0', processed='destination(d_kern)=0', processed='destination(d_mesg)=2', processed='destination(d_cons)=0', processed='des tination(d_spol)=0', processed='destination(d_mail)=0', processed='source(s_sys)=4', processed='source(s_file)=6374', suppressed='udp(10.13.33.11:514)=0' Jamie

4 6

3.3 git
by Peter Czanik 30 Aug '11

30 Aug '11

Hello, Just tested the current 3.3 git on openSUSE and FreeBSD. I made a 'make dist' and then used the resulting tgz for builds. I also did some quick functionality tests. While file names mention beta2 everywhere, it's actually a git checkout from this morning. Work in progress openSUSE packages for 11.4 and Factory are available at http://download.opensuse.org/repositories/home:/czanik:/syslog-ng33/ (it fails at post build checks on 11.3 and it does not compile on SLES). openSUSE package sources are available at https://build.opensuse.org/package/files?package=syslog-ng&project=home%3Ac… It's almost the same as the beta2 version included in factory, but I could remove all the patches hand picked from git. If you want to build syslog-ng 3.3 git on FreeBSD, you can download the source from the above URL, copy it to /usr/ports/distfiles/syslog-ng_3.3.0beta2.tar.gz and "rm distinfo" from /usr/ports/sysutils/syslog-ng3-devel, as it contains info about the original sources. Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

malformed syslog packets?
by Matt Zagrabelny 30 Aug '11

30 Aug '11

Hi! I've got a central log server running the OSE 3.1.3 version of syslog-ng: dpkg -l syslog-ng Desired=Unknown/Install/Remove/Purge/Hold | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad) ||/ Name Version Description +++-========================================-========================================-================================================================================================ ii syslog-ng 3.1.3-3 Next generation logging daemon I have dns lookup turned on via: options { use_dns(yes); dns_cache(2000); dns_cache_expire(87600); }; And this seems to work just fine...except for a certain type of device on our network. We have a number of UPSes that log to our central log server and it seems that the dns look ups do not work for those (types of devices). % cd /var/log/syslog-ng/remote_clients % ls -d 10.* 10.25.32.4 10.25.5.15 10.25.5.19 10.25.5.26 10.25.5.35 10.25.5.4 10.25.5.44 10.25.5.51 10.25.5.6 10.25.5.65 10.25.5.69 10.25.5.76 10.25.5.1 10.25.5.16 10.25.5.2 10.25.5.27 10.25.5.36 10.25.5.40 10.25.5.49 10.25.5.52 10.25.5.60 10.25.5.66 10.25.5.7 10.25.5.79 10.25.5.10 10.25.5.17 10.25.5.20 10.25.5.28 10.25.5.37 10.25.5.41 10.25.5.5 10.25.5.55 10.25.5.61 10.25.5.67 10.25.5.72 10.25.5.81 10.25.5.14 10.25.5.18 10.25.5.23 10.25.5.3 10.25.5.38 10.25.5.43 10.25.5.50 10.25.5.58 10.25.5.62 10.25.5.68 10.25.5.75 10.25.5.9 When I look up those IP addresses, they are *all* APC batteries (UPSes). For instance: % dig -x 10.25.5.43 +short kplz246Abat1.d.umn.edu. Is it possible that they are sending some sort of munged data to the log server and syslog-ng is not able to perform the (reverse) name lookup? Any advice? Thanks, much! -Matt Zagrabelny

3 5

syslog-ng.persist file error
by Scott McLane Gardner 29 Aug '11

29 Aug '11

Hello, When I came in this morning, syslog-ng was not running, and the following error is produced when trying to start it with init script: >Error loading persistent configuration file; name='//var/syslog-ng.persist' I'm guessing that additional forward slash is not supposed to be there, but I have no idea how this is getting set or where to change it. Can anyone help me? Thanks, Scott

3 3

[PATCH] templates: Add a C_* family of timestamp macros.
by Gergely Nagy 29 Aug '11

29 Aug '11

The C_* family of timestamp macros work very similarly to R_ (received) and S_ (stamp), except C_ uses the current system time as of the macro expansion. The patch below uses cached_g_current_time() for performance reasons, but in case the minor caching is undesired, it's easy to convert to something else. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- lib/templates.c | 39 +++++++++++++++++++++++++++++++++++++-- 1 files changed, 37 insertions(+), 2 deletions(-) diff --git a/lib/templates.c b/lib/templates.c index cb0c1b5..63000a3 100644 --- a/lib/templates.c +++ b/lib/templates.c @@ -86,6 +86,7 @@ enum M_RECVD_OFS = M_TIME_MACROS_MAX, M_STAMP_OFS = 2 * M_TIME_MACROS_MAX, + M_CSTAMP_OFS = 3 * M_TIME_MACROS_MAX, }; #define M_TIME_MACROS 15 @@ -171,6 +172,29 @@ LogMacroDef macros[] = { "S_TZ", M_STAMP_OFS + M_TZ }, { "S_UNIXTIME", M_STAMP_OFS + M_UNIXTIME }, + { "C_DATE", M_CSTAMP_OFS + M_DATE }, + { "C_FULLDATE", M_CSTAMP_OFS + M_FULLDATE }, + { "C_ISODATE", M_CSTAMP_OFS + M_ISODATE }, + { "C_STAMP", M_CSTAMP_OFS + M_STAMP }, + { "C_YEAR", M_CSTAMP_OFS + M_YEAR }, + { "C_YEAR_DAY", M_CSTAMP_OFS + M_YEAR_DAY }, + { "C_MONTH", M_CSTAMP_OFS + M_MONTH }, + { "C_MONTH_WEEK", M_CSTAMP_OFS + M_MONTH_WEEK }, + { "C_MONTH_ABBREV", M_CSTAMP_OFS + M_MONTH_ABBREV }, + { "C_MONTH_NAME", M_CSTAMP_OFS + M_MONTH_NAME }, + { "C_DAY", M_CSTAMP_OFS + M_DAY }, + { "C_HOUR", M_CSTAMP_OFS + M_HOUR }, + { "C_MIN", M_CSTAMP_OFS + M_MIN }, + { "C_SEC", M_CSTAMP_OFS + M_SEC }, + { "C_WEEKDAY", M_CSTAMP_OFS + M_WEEK_DAY_ABBREV }, /* deprecated */ + { "C_WEEK_DAY", M_CSTAMP_OFS + M_WEEK_DAY }, + { "C_WEEK_DAY_ABBREV",M_CSTAMP_OFS + M_WEEK_DAY_ABBREV }, + { "C_WEEK_DAY_NAME", M_CSTAMP_OFS + M_WEEK_DAY_NAME }, + { "C_WEEK", M_CSTAMP_OFS + M_WEEK }, + { "C_TZOFFSET", M_CSTAMP_OFS + M_TZOFFSET }, + { "C_TZ", M_CSTAMP_OFS + M_TZ }, + { "C_UNIXTIME", M_CSTAMP_OFS + M_UNIXTIME }, + { "SDATA", M_SDATA }, { "MSGHDR", M_MSGHDR }, { "SOURCEIP", M_SOURCE_IP }, @@ -421,7 +445,7 @@ log_macro_expand(GString *result, gint id, gboolean escape, LogTemplateOptions * gchar buf[64]; gint length; time_t t; - LogStamp *stamp; + LogStamp *stamp, sstamp; glong zone_ofs; if (id >= M_TIME_FIRST && id <= M_TIME_LAST) @@ -438,7 +462,18 @@ log_macro_expand(GString *result, gint id, gboolean escape, LogTemplateOptions * id -= M_STAMP_OFS; stamp = &msg->timestamps[LM_TS_STAMP]; } - else + else if (id >= M_TIME_FIRST + M_CSTAMP_OFS && id <= M_TIME_LAST + M_CSTAMP_OFS) + { + GTimeVal tv; + + id -= M_CSTAMP_OFS; + cached_g_current_time(&tv); + sstamp.tv_sec = tv.tv_sec; + sstamp.tv_usec = tv.tv_usec; + sstamp.zone_offset = -1; + stamp = &sstamp; + } + else { g_assert_not_reached(); break; -- 1.7.0.4

2 1

Need help with filtering messages - new user with syslog-ng
by Cosmin Neagu 29 Aug '11

29 Aug '11

Hello, First of all, i started to use syslog-ng on Ubuntu a few days ago and it seams a great syslog server. But today i stumble on a problem. I configured snmptrapd with TRAPDOPTS='-Lsd ' and this means that snmptrapd will send the trap received to syslog-ng. Now, syslog-ng puts those traps by default in /var/log/syslog because of this default configurations: source s_src { unix-dgram("/dev/log"); internal(); file("/proc/kmsg" program_override("kernel")); destination d_syslog { file("/var/log/syslog"); }; filter f_syslog3 { not facility(auth, authpriv, mail) and not filter(f_debug); }; log { source(s_src); filter(f_syslog3); destination(d_syslog); }; What i want to acomplish is to have traps from diferent host put in diferent files, not all together in the same file like it happens now. At first i tried to filter based on the host's ip address that was sending the trap, but i realized that the snmptrapd process is the one that sends the trap to syslog-ng process, not the device directly: Aug 29 11:42:48 Dell *snmptrapd*[3801]: 2011-08-29 11:42:43 10.90.0.252 [UDP: [10.90.0.252]:49364->[192.168.53.151]]: iso.3.6.1.2.1.1.3.0 = Timeticks: (1563318974) 180 days, 22:33:09.74 iso.3.6.1.6.3.1.1.4.1.0 = OID: iso.3.6.1.4.1.9.9.41.2.0.1 iso.3.6.1.4.1.9.9.41.1.2.3.1.2.31 = STRING: "LINK" iso.3.6.1.4.1.9.9.41.1.2.3.1.3.31 = INTEGER: 4 iso.3.6.1.4.1.9.9.41.1.2.3.1.4.31 = STRING: "UPDOWN" iso.3.6.1.4.1.9.9.41.1.2.3.1.5.31 = STRING: "Interface Serial0/0/0, changed state to down" iso.3.6.1.4.1.9.9.41.1.2.3.1.6.31 = Timeticks: (1563318974) 180 days, 22:33:09.74 So maibe you have done this - how can i filter based on the program that it sending the message (like snmptrapd). And also, can filters based on the text itself can be used? Like: - if the mesage contains "10.90.0.252 [UDP: [10.90.0.252]:XXXXX->[192.168.53.151]" put the mesage in "this" file - if the mesage contains "10.90.1.22 [UDP: [10.90.1.22]:XXXXX->[192.168.53.151]" put the mesage in "that" file Thanks --

2 1

[PATCH] tfjson: Typo (& build) fix.
by Gergely Nagy 28 Aug '11

28 Aug '11

My previous patch contained a typo (an extra . at the end of a line) which resulted in breaking compilation. This patch fixes that typo. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/tfjson/tfjson.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/modules/tfjson/tfjson.c b/modules/tfjson/tfjson.c index 3d54201..65daadd 100644 --- a/modules/tfjson/tfjson.c +++ b/modules/tfjson/tfjson.c @@ -160,7 +160,7 @@ const ModuleInfo module_info = { .canonical_name = "tfjson", .version = VERSION, - .description = "The tfjson module provides a JSON formatting template function for syslog-ng.",. + .description = "The tfjson module provides a JSON formatting template function for syslog-ng.", .core_revision = SOURCE_REVISION, .plugins = builtin_tmpl_func_plugins, .plugins_len = G_N_ELEMENTS(builtin_tmpl_func_plugins), -- 1.7.2.5

1 0

[PATCH] scl: Add support for GNU/kFreeBSD
by Gergely Nagy 28 Aug '11

28 Aug '11

GNU/kFreeBSD is GNU userland (including libc) on top of a FreeBSD kernel. It's very similar to FreeBSD, but not completely. On GNU/kFreeBSD, the system log source is /var/run/log, while the kernel messages go to /dev/klog, in correctly formatted legacy BSD format. Tested on Debian GNU/kFreeBSD (squeeze). Signed-off-by: Gergely Nagy <algernon(a)madhouse-project.org> --- scl/system/generate-system-source.sh | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/scl/system/generate-system-source.sh b/scl/system/generate-system-source.sh index fab7135..1088b63 100755 --- a/scl/system/generate-system-source.sh +++ b/scl/system/generate-system-source.sh @@ -75,6 +75,12 @@ unix-dgram("/var/run/logpriv" perm(0600)); file("/dev/klog" follow-freq(0) program-override("kernel") flags(no-parse)); EOF ;; + GNU/kFreeBSD) + cat <<EOF +unix-dgram("/var/run/log"); +file("/dev/klog" follow-freq(0) program-override("kernel")); +EOF + ;; HP-UX) cat <<EOF pipe("/dev/log" pad_size(2048)); -- 1.7.2.5

2 1

[PATCH] tfjson: Add module_info.
by Gergely Nagy 28 Aug '11

28 Aug '11

In order for syslog-ng --module-registry to be able to display meaningful information about a module, module_info must be set in said modules. Add that to tfjson, as it was lacking one. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/tfjson/tfjson.c | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-) diff --git a/modules/tfjson/tfjson.c b/modules/tfjson/tfjson.c index 39a6cdb..3d54201 100644 --- a/modules/tfjson/tfjson.c +++ b/modules/tfjson/tfjson.c @@ -155,3 +155,13 @@ tfjson_module_init(GlobalConfig *cfg, CfgArgs *args) plugin_register(cfg, builtin_tmpl_func_plugins, G_N_ELEMENTS(builtin_tmpl_func_plugins)); return TRUE; } + +const ModuleInfo module_info = +{ + .canonical_name = "tfjson", + .version = VERSION, + .description = "The tfjson module provides a JSON formatting template function for syslog-ng.",. + .core_revision = SOURCE_REVISION, + .plugins = builtin_tmpl_func_plugins, + .plugins_len = G_N_ELEMENTS(builtin_tmpl_func_plugins), +}; -- 1.7.2.5

2 1

[PATCH] lib/Makefile.am: Include cfg-grammar.h in the package headers too.
by Gergely Nagy 28 Aug '11

28 Aug '11

cfg-grammar.h is included by some of the public headers we install, therefore cfg-grammar.h should be installed alongside aswell. Signed-off-by: Gergely Nagy <algernon(a)madhouse-project.org> --- lib/Makefile.am | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/lib/Makefile.am b/lib/Makefile.am index d941a8d..6527bc8 100644 --- a/lib/Makefile.am +++ b/lib/Makefile.am @@ -24,6 +24,7 @@ pkginclude_HEADERS = \ block-ref-parser.h \ center.h \ cfg.h \ + cfg-grammar.h \ cfg-lexer.h \ cfg-parser.h \ children.h \ -- 1.7.2.5

2 1

[Bug 131] New: XML tags being stripped
by bugzilla＠bugzilla.balabit.com 28 Aug '11

28 Aug '11

https://bugzilla.balabit.com/show_bug.cgi?id=131 Summary: XML tags being stripped Product: syslog-ng Version: 3.0.x Platform: All OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jsu2(a)emory.edu Type of the Report: bug Estimated Hours: 0.0 Is there a known bug where syslog-ng arbitrarily strips xml tags from log messages? That is, some of our logs output xml, and syslog-ng seems to be stripping some of these tags before writing them. In particular, we have syslog-ng client configured to read from a local log file, send the log file to the syslog-ng server. The server does some basic csv parsing before writing it out. If this problem is fixed in a newer version, please let me know which version. Here's what the original log file should look like: 2011-08-24 12:00:02,685 INFO [Thread-35674] - [MessageIdentificationSyncCommand] Processing message <?xml version="1.0" encoding="UTF-8"?> <PurchaseOrderMessage version="2.2"> <Header> <MessageId>3125206c-5063-4465-a020-0131fc850885</MessageId> <Timestamp>2011-08-24T12:00:02.183-04:00</Timestamp> <Authentication> <Identity>Emory</Identity> <SharedSecret>PO$xport</SharedSecret> </Authentication> </Header> <PurchaseOrder> <POHeader id="16972984"> <WorkflowStatus status="Completed" /> <SupplierStatus status="SentToSupplier"> <HasBackorderedItems>false</HasBackorderedItems> <HasCancelledItems>false</HasCancelledItems> <HasSupplierEdits>false</HasSupplierEdits> <HasShippedItems>false</HasShippedItems> </SupplierStatus> <APStatus status="Close" /> <RevisionNumber>1</RevisionNumber> <RevisionDate>2011-08-24T11:54:10.745-04:00</RevisionDate> <PONumber>S660540</PONumber> <AlternatePONumber /> <Requestor> <UserProfile username="nbonus"> <FirstName>Nancy</FirstName> <LastName>Doe</LastName> <Email>ndoe(a)mydomain.bogus</Email> <Phone> <TelephoneNumber> <CountryCode>1</CountryCode> <AreaCode>555</AreaCode> <Number>5552765</Number> </TelephoneNumber> </Phone> <Department>My Department</Department> But, it shows up on syslog-ng server as: intesbprod1 [10857]: Error processing log message: <PurchaseOrderMessage version="2.2"> intesbprod1 : intesbprod1 : intesbprod1 : 00:02.183-04:00</Timestamp> intesbprod1 : intesbprod1 : intesbprod1 : intesbprod1 : intesbprod1 : intesbprod1 : intesbprod1 : id="16972984"> intesbprod1 : status="Completed" /> intesbprod1 : status="SentToSupplier"> intesbprod1 : intesbprod1 : intesbprod1 : intesbprod1 : intesbprod1 : intesbprod1 : status="Close" /> intesbprod1 : intesbprod1 : 54:10.745-04:00</RevisionDate> intesbprod1 : intesbprod1 : /> intesbprod1 : intesbprod1 : username="ndoe"> intesbprod1 : intesbprod1 : intesbprod1 : intesbprod1 : intesbprod1 : intesbprod1 : intesbprod1 : intesbprod1 : intesbprod1 : intesbprod1 : intesbprod1 : My Department</Department> Here's how the client is configured: source s_RoutingService { file("/opt/openeai/dev/logs/RoutingService.log" program_override("EnterpriseServiceBus RoutingService.log dev ")); }; source s_axis2 { file("/var/log/jboss/axis2.log" program_override("JBoss axis2.log qa ")); }; ###################### # logging rules # ###################### log { source(s_RoutingService); destination(d_net);} ; log { source(s_axis2); destination(d_net);} ; Here's how the server is configured: filter f_apps { program("EnterpriseServiceBus" flags ("ignore-case")) or program("JBoss" flags ("ignore-case")) or program("SonicMQ" flags ("ignore-case")); }; template t_apps { template("$SHOST ${ESB.MSG}\n"); }; parser p_apps { csv-parser(columns("ESB.LOG","ESB.DIR","ESB.MSG") delimiters(" ") flags(greedy, escape-none)); }; destination d_apps { file("/var/UTS/actv/$R_YEAR-$R_MONTH-$R_DAY/apps/$PROGRAM/${ESB.DIR}/${ESB.LOG}" create_dirs(yes) template(t_apps)); }; log { source(s_net); parser(p_shost); log { filter(f_systems); . . . log { filter(f_apps); parser(p_apps); destination(d_apps); flags(final); }; log { destination(d_srvr_mesg); flags(final); }; }; }; -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 2

syslog-ng 3.4 repo updated
by Balazs Scheidler 27 Aug '11

27 Aug '11

Hi, I just wanted to let you know, that I've forward merged all changes in 3.3 into the 3.4 tree. compiled && "make check" ran fine. I'd like start merging new functionalities from the syslog-ng PE team in BalaBit and Algernon's work. If there's anything else I should focus on, please let me know. Thanks. -- Bazsi

1 0

Variable issue with syslog-ng
by Aldrich, Jamie S 25 Aug '11

25 Aug '11

I am trying to setup syslog-ng to use the DAY and MONTH variable on the source file input. What am I doing wrong? source s_file { file("/psfs_logs/APPSRV_${MONTH}${DAY}.LOG" flags(no-parse)); }; destination d_messages{ udp("10.13.33.11"); }; log { source(s_file); destination(d_messages); }; Any help would be greatly appreciated...

2 2

[PATCH] basicfuncs: Implement a $(now) template function.
by Gergely Nagy 25 Aug '11

25 Aug '11

This implements a new basic template function: $(now), which will return the current time (seconds since the epoch) as of calling the template function. For the rare case that the time of template expansion is needed, or cached_gmtime() granularity is not enough. Signed-Off-By: Gergely Nagy <algernon(a)balabit.hu> --- modules/basicfuncs/basic-funcs.c | 12 ++++++++++++ 1 files changed, 12 insertions(+), 0 deletions(-) diff --git a/modules/basicfuncs/basic-funcs.c b/modules/basicfuncs/basic-funcs.c index 5e1fd5e..abe8c68 100644 --- a/modules/basicfuncs/basic-funcs.c +++ b/modules/basicfuncs/basic-funcs.c @@ -19,6 +19,17 @@ tf_echo(LogMessage *msg, gint argc, GString *argv[], GString *result) TEMPLATE_FUNCTION_SIMPLE(tf_echo); +static void +tf_now(LogMessage *msg, gint argc, GString *argv[], GString *result) +{ + GTimeVal tval; + + g_get_current_time(&tval); + g_string_append_printf (result, "%lu", tval.tv_sec); +} + +TEMPLATE_FUNCTION_SIMPLE(tf_now); + typedef struct _TFCondState { FilterExprNode *filter; @@ -158,6 +169,7 @@ static Plugin basicfuncs_plugins[] = TEMPLATE_FUNCTION_PLUGIN(tf_echo, "echo"), TEMPLATE_FUNCTION_PLUGIN(tf_grep, "grep"), TEMPLATE_FUNCTION_PLUGIN(tf_if, "if"), + TEMPLATE_FUNCTION_PLUGIN(tf_now, "now"), }; gboolean -- 1.7.0.4

3 5

fsf address, embedded date
by Peter Czanik 24 Aug '11

24 Aug '11

Hello, While working on the openSUSE package, I ran into this problem. Post compile checks brought up this problem: syslog-ng.x86_64: W: incorrect-fsf-address /usr/share/syslog-ng/include/scl/system/plugin.conf syslog-ng.x86_64: W: incorrect-fsf-address /usr/share/syslog-ng/include/scl/syslogconf/plugin.conf syslog-ng.x86_64: W: incorrect-fsf-address /usr/share/syslog-ng/include/scl/pacct/plugin.conf syslog-ng.x86_64: W: incorrect-fsf-address /etc/syslog-ng/scl.conf syslog-ng.x86_64: W: incorrect-fsf-address /usr/share/syslog-ng/include/scl/system/generate-system-source.sh The Free Software Foundation address in this file seems to be outdated or misspelled. Ask upstream to update the address, or if this is a license file, possibly the entire file with a new copy available from the FSF. There is another one I usually fix with a patch: syslog-ng.x86_64: W: file-contains-date-and-time /sbin/syslog-ng Your file uses __DATE and __TIME__ this causes the package to rebuild when not needed The reasoning behind this is, that if a package is recompiled for some reason, but results in the binary same files, then dependent packages are not recompiled. But if date is embedded, then it changes on each build... For syslog-ng-3.3.0beta1 it was this patch: linux-1wrf:~/home:czanik:syslog-ng33/syslog-ng # cat 1/syslog-ng-3.3.0beta1-no-datetime.diff --- syslog-ng/main.c.orig 2011-05-24 17:32:35.696000107 +0200 +++ syslog-ng/main.c 2011-05-24 17:33:04.886000067 +0200 @@ -128,7 +128,9 @@ printf(PACKAGE " " VERSION "\n" "Installer-Version: %s\n" "Revision: " SOURCE_REVISION "\n" +#if 0 "Compile-Date: " __DATE__ " " __TIME__ "\n" +#endif "Default-Modules: %s\n" "Available-Modules: ", installer_version, Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

2 2