- syslog-ng - lists.balabit.hu

[PATCH] basicfuncs: Implement a few numeric template functions.
by Gergely Nagy 03 May '11

03 May '11

From: Gergely Nagy <algernon(a)madhouse-project.org> Implement addition, substraction, multiplication, division and modulus template functions: $(+ N M), $(- N M), $(* N M), $(/ N M) and $(% N M), respectively. All of them take two numeric arguments, and log an error, if they receive less or more, or in case the number cannot be fully parsed as a number. Signed-off-by: Gergely Nagy <algernon(a)madhouse-project.org> --- modules/basicfuncs/basic-funcs.c | 106 ++++++++++++++++++++++++++++++++++++- 1 files changed, 103 insertions(+), 3 deletions(-) diff --git a/modules/basicfuncs/basic-funcs.c b/modules/basicfuncs/basic-funcs.c index a03e221..2be4584 100644 --- a/modules/basicfuncs/basic-funcs.c +++ b/modules/basicfuncs/basic-funcs.c @@ -23,7 +23,7 @@ tf_echo(LogMessage *msg, gint argc, GString *argv[], GString *result) TEMPLATE_FUNCTION_SIMPLE(tf_echo); static gboolean -tf_substr_parse_int(const gchar *s, long *d) +tf_parse_int(const gchar *s, long *d) { gchar *endptr; glong val; @@ -42,6 +42,101 @@ tf_substr_parse_int(const gchar *s, long *d) return TRUE; } +static gboolean +tf_num_parse(gint argc, GString *argv[], + const gchar *func_name, glong *n, glong *m) +{ + if (argc != 2) + { + msg_error("Template function requires two arguments.", + evt_tag_str("function", func_name), NULL); + return FALSE; + } + + if (!tf_parse_int(argv[0]->str, n)) + { + msg_error("Parsing failed, template function's first argument is not a number", + evt_tag_str("function", func_name), + evt_tag_str("arg1", argv[0]->str), NULL); + return FALSE; + } + + if (!tf_parse_int(argv[1]->str, m)) + { + msg_error("Parsing failed, template function's first argument is not a number", + evt_tag_str("function", func_name), + evt_tag_str("arg1", argv[1]->str), NULL); + return FALSE; + } + + return TRUE; +} + +static void +tf_num_plus(LogMessage *msg, gint argc, GString *argv[], GString *result) +{ + glong n, m; + + if (!tf_num_parse(argc, argv, "+", &n, &m)) + return; + + g_string_append_printf(result, "%li", n + m); +} + +TEMPLATE_FUNCTION_SIMPLE(tf_num_plus); + +static void +tf_num_minus(LogMessage *msg, gint argc, GString *argv[], GString *result) +{ + glong n, m; + + if (!tf_num_parse(argc, argv, "-", &n, &m)) + return; + + g_string_append_printf(result, "%li", n - m); +} + +TEMPLATE_FUNCTION_SIMPLE(tf_num_minus); + +static void +tf_num_multi(LogMessage *msg, gint argc, GString *argv[], GString *result) +{ + glong n, m; + + if (!tf_num_parse(argc, argv, "*", &n, &m)) + return; + + g_string_append_printf(result, "%li", n * m); +} + +TEMPLATE_FUNCTION_SIMPLE(tf_num_multi); + +static void +tf_num_div(LogMessage *msg, gint argc, GString *argv[], GString *result) +{ + glong n, m; + + if (!tf_num_parse(argc, argv, "/", &n, &m)) + return; + + g_string_append_printf(result, "%li", (glong)(n / m)); +} + +TEMPLATE_FUNCTION_SIMPLE(tf_num_div); + +static void +tf_num_mod(LogMessage *msg, gint argc, GString *argv[], GString *result) +{ + glong n, m; + + if (!tf_num_parse(argc, argv, "%", &n, &m)) + return; + + g_string_append_printf(result, "%li", n % m); +} + +TEMPLATE_FUNCTION_SIMPLE(tf_num_mod); + static void tf_substr(LogMessage *msg, gint argc, GString *argv[], GString *result) { @@ -64,14 +159,14 @@ tf_substr(LogMessage *msg, gint argc, GString *argv[], GString *result) return; /* get offset position from second argument */ - if (!tf_substr_parse_int(argv[1]->str, &start)) { + if (!tf_parse_int(argv[1]->str, &start)) { msg_error("$(substr) parsing failed, start could not be parsed", evt_tag_str("start", argv[1]->str), NULL); return; } /* if we were called with >2 arguments, third was desired length */ if (argc > 2) { - if (!tf_substr_parse_int(argv[2]->str, &len)) { + if (!tf_parse_int(argv[2]->str, &len)) { msg_error("$(substr) parsing failed, length could not be parsed", evt_tag_str("length", argv[2]->str), NULL); return; } @@ -282,6 +377,11 @@ static Plugin basicfuncs_plugins[] = TEMPLATE_FUNCTION_PLUGIN(tf_grep, "grep"), TEMPLATE_FUNCTION_PLUGIN(tf_if, "if"), TEMPLATE_FUNCTION_PLUGIN(tf_substr, "substr"), + TEMPLATE_FUNCTION_PLUGIN(tf_num_plus, "+"), + TEMPLATE_FUNCTION_PLUGIN(tf_num_minus, "-"), + TEMPLATE_FUNCTION_PLUGIN(tf_num_multi, "*"), + TEMPLATE_FUNCTION_PLUGIN(tf_num_div, "/"), + TEMPLATE_FUNCTION_PLUGIN(tf_num_mod, "%"), }; gboolean -- 1.7.2.5

2 5

[PATCH] loggen: Fix a possible division by zero.
by Gergely Nagy 03 May '11

03 May '11

In some cases where we could not send a single message, loggen tried to divide by zero shortly before printing the statistics at the end. This was trivially reproducible by using -R with a file that contained invalid syslog lines. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- tests/loggen/loggen.c | 7 ++++++- 1 files changed, 6 insertions(+), 1 deletions(-) diff --git a/tests/loggen/loggen.c b/tests/loggen/loggen.c index bf5d111..c5399a7 100644 --- a/tests/loggen/loggen.c +++ b/tests/loggen/loggen.c @@ -467,7 +467,12 @@ gen_messages(send_data_t send_func, void *send_func_ud, int thread_id, FILE *rea printf("%d;%lu.%06lu;%.2lf;%lu\n", thread_id, (long) diff_tv.tv_sec, (long) diff_tv.tv_usec, (((double) (count - last_count) * USEC_PER_SEC) / diff_usec), count); if (readfrom) - raw_message_length = sum_linelen/count; + { + if (count) + raw_message_length = sum_linelen/count; + else + raw_message_length = 0; + } free(testsdata); return count; } -- 1.7.2.5

2 1

[new shared lib] libsyslog-ng-crypto.so
by Balazs Scheidler 03 May '11

03 May '11

Hi, I just wanted to give a heads-up for people doing development on syslog-ng code, that I've introduced libsyslog-ng-crypto.so in the core, which is to contain core code that depends on libssl. You probably know, that one of the driving factors for modularizing syslog-ng was to make the core of syslog-ng independent of OpenSSL, since that is not available during early boot on a number of systems. Anyhow, there's a lot of code, that should be shared between plugins, but would depend on OpenSSL. To resolve this problem, I've now created libsyslog-ng-crypto.so, installed into $prefix/lib/syslog-ng (e.g. a private lib, which lives in the same place as the plugins), which is now responsible for: - seeding the random number generator - TLS transport code (tlstransport.c, earlier in the afsocket module) - TLS context code (tlscontext.c, -"-) I guess some others may follow. Plugins that would use openssl, should _always_ link against libsyslog-ng-crypto.so, as the random number generator is seeded when this library is loaded. (of course not all platforms need explicit PRNG seeding, but some do). Now as I'm reviewing the patch again, it is quite dirty, contains some unrelated changes, so don't take it as an example, but now a lot of others have accumulated on top of it, so I don't want to rebase and change the history. This is the patch I'm talking about: Author: Balazs Scheidler <bazsi(a)balabit.hu> 2011-04-30 20:17:44 Committer: Balazs Scheidler <bazsi(a)balabit.hu> 2011-04-30 20:17:44 Parent: adff96aa401c8ef398a617c14daf7dc45f85cab7 (logreader: fixed parsing flags containing dashes or underscores) Child: 2b65655028da7cc216aa747d0bb206fe28b93955 (logwriter: initialize the queue_filled event earlier) Branches: master, remotes/origin/master Follows: v3.3.0alpha2 Precedes: libsyslog-ng-crypto.so: This patch introduces a new shared object where openssl dependent core goes The TLS code is sufficiently independent from the afsocket plugin, however currently they go in the afsocket module directory. This patch introduces a new shared object called libsyslog-ng-crypto.so, which contains TLS code, random number initialization and basically everything that would introduce an openssl dependency. Signed-off-by: Balazs Scheidler <bazsi(a)balabit.hu> -- Bazsi

1 0

rewrite problem
by Micah Anderson 03 May '11

03 May '11

Hi, I've been trying to use the rewrite functionality using 3.1.3, but I am having some problems: 1. when having a rewrite setup, I can denial of service syslog-ng :( if I do this: rewrite r_ip { subst("([[:digit:]]{1,3}\.){3}[[:digit:]]{1,3}", "\[REDACTED\]", value("MESSAGE"), type("pcre"), flags("global")); }; filter f_mail { facility(mail) and not facility(local1) and not program("^postfix/"); }; destination df_mail { file("/var/log/mail.log"); }; log { source(s_src); filter(f_mail); rewrite(r_ip); destination(df_mail); flags(final); }; and then I do: $ logger -p mail.info hi syslog-ng starts going crazy, it eats 100% of the CPU and the memory. If you are lucky, the OOM killer kicks in and stops it before your system goes down. I originally thought that this was due to a bad regexp I had, but the above regexp works fine for normal mail syslog messages. However, in the process of trying to make a better rewrite rule, I found that I've created ones where normal mail messages do this too. 2. \. doesn't match literal periods Using the above rewrite, one would expect that the regexp would match three times a number containing 1-3 digits, each time followed by a literal period. Then a number containing 1-3 digits. A basic, and not very complete IPv4 regexp, that would match something like: 192.168.25.1. In fact, it does match that IPv4 address, but it is also matching other things that do not have periods in them. For example: rewrite r_ip { subst("([[:digit:]]{1,3}\.){3}[[:digit:]]{1,3}", "\[REDACTED\]", value("MESSAGE"), type("pcre"), flags("global")); }; $ logger -i -p mail.info 'Apr 21 20:38:58 algae postfix/smtp[14817]: EB4A2168: to=<482092-subscribe(a)bugs.debian.org>, relay=192.168.164.34[192.168.164.34]:587, delay=2.9, delays=0.19/0.14/2/0.58, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 6722214C119)' I would expect that the two IP addressesw in the above to be matched and replaced, but this is what happens: Apr 22 12:45:11 algae logger[6234]: Apr [REDACTED] algae postfix/smtp[14817]: EB4A2168: to=<482092-subscribe(a)bugs.debian.org>, relay=[REDACTED][[REDACTED]]:587, delay=2.9, delays=[REDACTED]/2/0.58, dsn=2.0.0, status=sent ([REDACTED] Ok: queued as [REDACTED]) Its matching the queue ID 'EB4A2168' and its also matching '6722214C119', neither of those have periods in them, and EB4A2168 is not 0-9, which is what :digit: should be matching. I tried to replace [[:digit:]] with \d, but that caused issue #1 to happen. micah --

3 7

differing linking options
by Balazs Scheidler 03 May '11

03 May '11

Hi, @Corinna: I'm ccing you because of a cygwin question at the end of this email. Thanks for answering it if you have time. While cherry-picking changes from your tree at git://git.balabit.hu/syslog-ng-team/syslog-ng-core-4.1.git I've noticed that you are changing linking command lines for modules, which would break mixed linking mode used by Linux distributions in their native packages. Since it's bad to differ on things like this, I've figured it might make sense to come to a solution that's good for both of us. This is the patch that adds the new libraries: commit 23ca7a66c5a612ee7135c2543d707c7e484571a1 Author: Tamas Pal <folti(a)balabit.hu> Date: Tue Mar 29 11:42:00 2011 +0200 [autoconfuse]: make system specific libafsocket symlink with the proper shlib extension. Added proper LIBS dependencies, to prevent linking error in case libtool fails to parse .la files properly And this is the hunk that is (for instance) problematic: -libafsocket_notls_la_LIBADD = ../../lib/libsyslog-ng.la $(LIBNET_LIBS) $(LIBWRAP_LIBS) +libafsocket_notls_la_LIBADD = ../../lib/libsyslog-ng.la $(LIBNET_LIBS) $(LIBWRAP_LIBS) $(GLIB_LIBS) $(EVTLOG_LIBS) $(IVYKIS_LIBS) The technical issue at hand is that glib, evtlog and ivykis can all be static libraries in mixed mode, which would result in their inclusion into each module shared object, causing trouble at runtime. (not to mention that the static libs are probably not compiled with -fPIC so they cannot be linked into .so files). I do have a problem with AIX linking with 3.2 now, which is probably the root cause that you've added these libraries into the Makefiles in the first place. AIX linker is quite restrictive on how symbols are reexported from the main executable, but I do remember I could successfully create a linking mode that worked on AIX and wasn't broken on Linux in mixed mode. Clearly adding the libraries to that command line unconditionally is not such a combination. Mixed mode doesn't need to be supported on AIX, (I wouldn't dare to try to support that with non-GNU linkers). I think the breakage is rooted by the addition of -no-undefined to the libtool command line, which causes the AIX linker to ignore symbols exported by the main executable. -no-undefined was added to catch errors on Cygwin, which doesn't allow to link DLLs with undefined symbols in them. The questions are: 1) Since last time we've checked that OSE 3.2 built on cygwin, which doesn't include those libs, I think the cygwin linker would accept symbols exported by the dependencies of libsyslog-ng.so. Is that right Corinna? 2) AIX seems to have worked without -no-undefined (I've just retried that with 3.2.3, and confirmed that works). 3) @syslog-ng-team: Are there any other reasons you've included the libs explicitly on those command lines? So I'm proposing to make -no-undefined conditional, and only include it on non-AIX versions, and skip the listing of libs provided by libsyslog-ng.so from LIBADD. What do you think? -- Bazsi

2 1

Re: [syslog-ng] [PATCH] Use CAP_SYSLOG instead of CAP_SYS_ADMIN, if available.
by Gergely Nagy 02 May '11

02 May '11

Serge Hallyn <serge.hallyn(a)canonical.com> writes: > Quoting Balazs Scheidler (bazsi(a)balabit.hu) >> Hi, >> >> Thanks for the great stuff, it is really appreciated. >> >> I've some notes, please let me know if you or Serge would like to do >> that, or I should. > > Thanks, by all means please go ahead, your suggestions certainly sound > cleaner, and I'd probably end up producing something that ended up > requiring at least one more review cycle :) In that case, I'll have a round of fun with it (in a day or two, if all goes well). -- |8]

1 0

syslog-ng 3.2.3 build failure
by Sandor Geller 02 May '11

02 May '11

Hello, The below change breaks linking syslog-ng-ctl on OSes where the resolver library provides inet_aton so the -lresolv linker flag is needed. So far I ran into the issue only on Solaris 8 which isn't a modern OS I know... --- syslog-ng-3.2.2/syslog-ng/Makefile.in 2011-01-15 17:15:10.000000000 +0100 +++ syslog-ng-3.2.3/syslog-ng/Makefile.in 2011-05-01 21:47:51.000000000 +0200 @@ -60,7 +60,7 @@ syslog_ng_DEPENDENCIES = am_syslog_ng_ctl_OBJECTS = syslog-ng-ctl.$(OBJEXT) syslog_ng_ctl_OBJECTS = $(am_syslog_ng_ctl_OBJECTS) -syslog_ng_ctl_DEPENDENCIES = ../lib/libsyslog-ng.la +syslog_ng_ctl_DEPENDENCIES = ../lib/gsocket.lo ../lib/gsockaddr.lo am_syslog_ng_wrapper_OBJECTS = wrapper.$(OBJEXT) syslog_ng_wrapper_OBJECTS = $(am_syslog_ng_wrapper_OBJECTS) syslog_ng_wrapper_LDADD = $(LDADD) The fix seems to be trivial and hopefully doesn't have side-effects on any OS: --- syslog-ng-3.2.3/configure.in 2011-05-01 21:46:51.000000000 +0200 +++ syslog-ng-3.2.3-hacked/configure.in 2011-05-02 14:06:27.000000000 +0200 @@ -845,6 +845,7 @@ AC_SUBST(SOURCE_REVISION) AC_SUBST(PACKAGE_FILES_SUFFIX) AC_SUBST(PACKAGE_SUFFIX) +AC_SUBST(RESOLV_LIBS) AC_OUTPUT(dist.conf diff -urN syslog-ng-3.2.3/syslog-ng/Makefile.am syslog-ng-3.2.3-hacked/syslog-ng/Makefile.am --- syslog-ng-3.2.3/syslog-ng/Makefile.am 2011-02-23 11:15:06.000000000 +0100 +++ syslog-ng-3.2.3-hacked/syslog-ng/Makefile.am 2011-05-02 13:53:44.000000000 +0200 @@ -19,7 +19,7 @@ syslog_ng_wrapper_SOURCES = wrapper.c syslog_ng_ctl_SOURCES = syslog-ng-ctl.c -syslog_ng_ctl_LDADD = ../lib/gsocket.lo ../lib/gsockaddr.lo @BASE_LIBS@ @GLIB_LIBS@ +syslog_ng_ctl_LDADD = ../lib/gsocket.lo ../lib/gsockaddr.lo @BASE_LIBS@ @GLIB_LIBS@ @RESOLV_LIBS@ if ENABLE_ENV_WRAPPER Regards, Sandor

2 2

PCRE subst example from documentation produces error
by Daniel Maher 02 May '11

02 May '11

Hello, While following the example given here : http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.2-gui… I copied and pasted the string, then attempted to restart the daemon; unfortunately, this was the result : --- Error parsing rewrite expression, syntax error, unexpected LL_IDENTIFIER, expecting ')' in /etc/syslog-ng/syslog-ng.conf at line 354, column 27: {subst("a*", "?", field("message") type("pcre") flags("utf8" "global")); }; ^^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng Cannot load /etc/syslog-ng/syslog-ng.conf --- Have I managed to paste incorrectly, or is the documentation incorrect, or is it something else entirely ? # syslog -V syslog-ng 3.2.2 Installer-Version: 3.2.2 Revision: Compile-Date: Apr 20 2011 16:19:28 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: on Enable-Pacct: off Thank you. -- Daniel Maher « can't talk, too busy calculating computrons. »

2 1

[PATCH 0/3]: value-pairs() & related patches
by Gergely Nagy 01 May '11

01 May '11

Hi! For a multitude of reasons, ranging from the feature freeze looming over my head to hope that discrete patches are easier to review and merge than my awfully chaotic git tree, I'll be posting a couple of patches in a short while, as soon as I figure out what magic arguments I need to give to git send-email to make it send the batch the way I imagined. value-pairs() ============= The first one will be the value-pairs() implementation (also available on my integration/value-pairs branch), which is the base of the two others that will follow. While the value-pairs() implementation could still use some work, especially in the performance department, I believe it's good enough for initial use, and the benefits of having it (so that the mongodb driver can make use of it) far outweight the downsides. The implementation itself is reasonably light, it hardly touches anything outside it's own two files: the grammar and the makefile only, to hook itself in. If not used by a driver, then it does not change functionality at all. Therefore, I believe this could go in before the feature freeze. afmongodb value-pairs() port ============================ The next patch will be the port of the already existing mongodb destination driver to use value-pairs(). Also available on my integration/afmongodb-vp branch. This means that the driver will finally be able to do what it's good at: store arbitrary information in the database: whether that information comes via SDATA or patterndb, it doesn't matter, it will be stored in a structured manner. In my opinion, this is the major selling point of the mongodb destination driver at the moment (I have some other grand plans with it in the future, but that's more invasive, less important, and can easily wait 'till 3.4 ;). Without value-pairs(), afmongodb is pretty much useless. tfson() ======= For extra fun & profit, Balint Kovacs' format_json has been ported to use value-pairs(), and this will be the third patch in the series, and is also available on my integration/tfjson branch. This one's the least important, though it's dead simple, therefore I'd be very happy if it made past the feature freeze aswell. -- |8]

3 15

syslog-ng 3.2.3 has been released
by devel＠balabit.hu 01 May '11

01 May '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.2.3 SUMMARY : new stable release DATE : May 1, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.2.3) has been released. For latest fixes in the 3.2.x feature branch you are recommended to upgrade to this version. CHANGES: 3.2.3 Sun, 01 May 2011 19:05:32 +0200 Highlights: This is a maintenance release for the 3.2 branch, which contains several important functionality fixes in the db-parser() correllation code, an important security fix for FreeBSD & HP-UX (CVE-2011-0343) and build fixes for cygwin and mixed mode linking. Security fixes: * Fixed a possible security issue on Debian/kFreeBSD and on platforms where mode_t is an unsigned 16 bit value (FreeBSD, HP-UX). On these platforms syslog-ng may be using 0xFFFF as the permission bits. (CVE-2011-0343) Bugfixes: * Fixes an y2k38 problem that causes syslog-ng to use 100% CPU time in case mark messages are enabled and the UNIX timestamps overflows a signed 32 bit counter, which happens in 19th, January 2038 * Fixed file() destination to work on device nodes (e.g. files in /dev). Without this change, syslog-ng started using 100% CPU time if given devices as destinations that couldn't always consume data. * The code to restore the last file position for source files will not accept file-position past the file size, and will restart the file from the beginning instead. * Don't attempt to remember the current file position for source files that are read with follow-freq(0), e.g. /dev/klog and /proc/kmsg. These are special files which do not have the notion of file position, so no need to remember them. Regular files should always be read with follow-freq() set to nonzero, which is the default. * Fixed linking unit tests and other tools in mixed linking mode. * Fixed compilation on cygwin, especially lot of efforts went into linker compatibility. * Fixed building on platforms where PCRE is not in the standard include path. * Accept catch-all flag on log statements as well as catchall, as this was incorrectly documented in the past. db-parser() & pdbtool bugfixes: * Fixed @XX style message reference parsing used in correllation rules. * Fixed a segfault in the $(grep) template function when processing the parameters failed. * Fixed segfault in "pdbtool match --debug-pattern" in case the pattern doesn't match. * Fixed "pdbtool test" as previously all patterndb.xml files were reported to be invalid, even valid ones. * Fixed correllation timer related issue that caused some timers not to expire in rare cases. db-parser() & pdbtool changes: * Added support for enclosing template function arguments in parenthesis, in which case the quotes within the parentheses are not removed. For example: $(grep ('$FACILITY' == 'syslog')) This makes writing $(grep) and $(if) arguments much easier. * dbparser() the @NUMBER@ and @FLOAT@ parsers are able to parse negative numbers. * Added debug messages to dbparser() correllation so that it becomes easier to diagnose db-parser() problems. * Added -d (for --debug) and -v (for --verbose) options to pdbtool in order to make patterndb debugging easier. * Added --no-parse option to "pdbtool patternize" in order to read files without syslog-style parsing. Other changes: * Added error messages on DBI initialization failures. * Added systemd socket activation support. Build related changes: * Support for old (e.g. pre 7.1 commonly found in RHEL5) PCRE versions at the cost of an inoperating "newline" regexp flag. * configure now validates flex/bison versions better, as the requirements are more strict starting with syslog-ng 3.2 * Drop the creation of libsyslog-ng-patterndb.so. * "make clean" will properly remove libafsocket.so symlink. Credits: syslog-ng is developed as a community project. All changes and improvements requires effort, and this effort is really appreciated. Writing code, testing changes or simply providing use-cases and information on one's setup will make syslog-ng better. Here are the people, listed in no specific order who made this release possible. Steven Chamberlain Roger Paul Krizak (AMD) Attila Szalay (BalaBit) Matthew Hall Marius Tomaschewski (SUSE) Gergely Nagy (BalaBit) Tom Gundersen Dalibor Toman (Fortech.cz) Corinna Vinschen (RedHat) Balazs Scheidler (BalaBit) Laszlo Boszormenyi (LSC.hu) Arkadiusz Miśkiewicz (PLD Linux) Valentijn Sessink Hendrik Visage Peter Gyongyosi (BalaBit) Zoltan Pallagi (BalaBit) Mishou Michael (US IRS) Thanks for their efforts, it is appreciated. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

[PATCH] basicfuncs: Implement a $(substr START LEN STR) template function.
by Gergely Nagy 01 May '11

01 May '11

This implements the $(substr) template function - a fairly primitive one: it does error checking, but there's no error reporting present, therefore invalid function calls will just get ignored. Usage should be straightforward. Reported-By: Jakub Jankowski <shasta(a)toxcorp.com> Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/basicfuncs/basic-funcs.c | 46 ++++++++++++++++++++++++++++++++++++++ 1 files changed, 46 insertions(+), 0 deletions(-) diff --git a/modules/basicfuncs/basic-funcs.c b/modules/basicfuncs/basic-funcs.c index 44b8af3..542c2ec 100644 --- a/modules/basicfuncs/basic-funcs.c +++ b/modules/basicfuncs/basic-funcs.c @@ -4,6 +4,9 @@ #include "filter-expr-parser.h" #include "cfg.h" +#include <stdlib.h> +#include <errno.h> + static void tf_echo(LogMessage *msg, gint argc, GString *argv[], GString *result) { @@ -19,6 +22,48 @@ tf_echo(LogMessage *msg, gint argc, GString *argv[], GString *result) TEMPLATE_FUNCTION_SIMPLE(tf_echo); +static gboolean +tf_substr_parse_int(const gchar *s, long *d) +{ + gchar *endptr; + glong val; + + errno = 0; + val = strtoll(s, &endptr, 10); + + if ((errno == ERANGE && (val == LONG_MAX || val == LONG_MIN)) + || (errno != 0 && val == 0)) + return FALSE; + + if (endptr == s || *endptr != '\0') + return FALSE; + + *d = val; + return TRUE; +} + +static void +tf_substr(LogMessage *msg, gint argc, GString *argv[], GString *result) +{ + glong start, len; + + if (argc != 3) + return; + + if (!tf_substr_parse_int (argv[0]->str, &start)) + return; + if (!tf_substr_parse_int (argv[1]->str, &len)) + return; + + if (start > argv[2]->len || + start + len >= argv[2]->len) + return; + + g_string_append_len (result, argv[2]->str + start - 1, len); +} + +TEMPLATE_FUNCTION_SIMPLE(tf_substr); + typedef struct _TFCondState { FilterExprNode *filter; @@ -158,6 +203,7 @@ static Plugin basicfuncs_plugins[] = TEMPLATE_FUNCTION_PLUGIN(tf_echo, "echo"), TEMPLATE_FUNCTION_PLUGIN(tf_grep, "grep"), TEMPLATE_FUNCTION_PLUGIN(tf_if, "if"), + TEMPLATE_FUNCTION_PLUGIN(tf_substr, "substr"), }; gboolean -- 1.7.2.5

3 8

SSL certificate verification
by Peter Eckel 30 Apr '11

30 Apr '11

Hi all, I am currently setting up a remote logging facility for a customer who requires encryption and mutual authentication. After having run Syslog NG over Stunnel for several years, I am looking into the option to do the same withot stunnel, by using Syslog NG with the TLS option. My current version is 3.2.2, installed from the binary provided on the Syslog NG web site, on CentOS 5.5. My setup on the server side (stripped to the minimum): source s_remote { tcp( ip( 192.168.42.184 ) port( 601 ) tls( key_file("/opt/syslog-ng/etc/ssl/server_key.pem") cert_file("/opt/syslog-ng/etc/ssl/server_crt.pem") ca_dir( "/opt/syslog-ng/etc/ssl" ) peer_verify( required-trusted ) ) ); }; destination d_remote { file( "/var/log/remote" owner(root) group(root) perm(0600) ); }; log { source(s_remote); destination(d_remote); }; On the client side: source s_local { internal(); unix-stream( "/dev/log" ); file( "/proc/kmsg" ); }; destination d_remote { tcp( "192.168.42.184" port( 601 ) tls( key_file("/opt/syslog-ng/etc/ssl/client1_key.pem") cert_file("/opt/syslog-ng/etc/ssl/client1_crt.pem") ca_dir( "/opt/syslog-ng/etc/ssl" ) ) ); }; log { source(s_local); destination(d_remote); }; With the appropriate and valid client cert, it works perfrctly: [root@server1 ssl]# openssl x509 -noout -text < client1_crt.pem Certificate: Data: Version: 1 (0x0) Serial Number: 2 (0x2) Signature Algorithm: sha256WithRSAEncryption Issuer: O=xxx, OU=Client 1/emailAddress=xxx, L=xxx, ST=xxx, C=xx, CN=xxx Validity Not Before: Mar 8 15:53:24 2011 GMT Not After : Mar 7 15:53:24 2014 GMT Subject: C=xx, ST=xx, O=xx, OU=xx, CN=client1 Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) ... However, I copied over the cert of another client machine to client1, reconfigure Syslog NG to use it, and it works as well, though IMHO it shouldn't: [root@server1 ssl]# openssl x509 -noout -text < client2_crt.pem Certificate: Data: Version: 1 (0x0) Serial Number: 3 (0x3) Signature Algorithm: sha256WithRSAEncryption Issuer: O=xxx, OU=Client 2/emailAddress=xxx, L=xxx, ST=xxx, C=xx, CN=xxx Validity Not Before: Mar 8 15:54:35 2011 GMT Not After : Mar 7 15:54:35 2014 GMT Subject: C=xx, ST=xxx, O=xxx, OU=Client 2, CN=client2 Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) Modulus (2048 bit): ... Swapping certificates (client2's instead of server's in this case) on the server breaks trust (as expected): Mar 8 18:19:45 client1 syslog-ng[2991]: Syslog connection established; fd='10', server='AF_INET(192.168.42.184:601)', local='AF_INET(0.0.0.0:0)' Mar 8 18:20:13 client1 syslog-ng[2991]: Certificate subject does not match configured hostname; hostname='server', certificate='client2' Mar 8 18:20:13 client1 syslog-ng[2991]: SSL error while writing stream; tls_error='SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed' Mar 8 18:20:13 client1 syslog-ng[2991]: I/O error occurred while writing; fd='10', error='Broken pipe (32)' Doing the same on the client, however, does not. The Syslog NG server does not seem to validate the CN. Is this expected behaviour or a bug? Best regards, Peter.

4 10

filtering per device
by vijay 30 Apr '11

30 Apr '11

Hi All, I have 4 cisco devices having ip addresses for example 10.1.1.1 10.1.1.2 10.1.1.3 10.1.1.4 already i have filtering option such that only above informational level(level 6) will be captured.I have new requirement that to capture informational logs also of 10.1.1.4 not other devices.How to do that. thanks vijay

3 2

[PATCH] afmongodb: Make the collection name a simple string.
by Gergely Nagy 30 Apr '11

30 Apr '11

Instead of allowing templates in the collection name, make it a simple string instead, to allow for easily implementing bulk inserts in the future. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/afmongodb/afmongodb.c | 30 ++++++++++-------------------- 1 files changed, 10 insertions(+), 20 deletions(-) diff --git a/modules/afmongodb/afmongodb.c b/modules/afmongodb/afmongodb.c index 284066a..929d35b 100644 --- a/modules/afmongodb/afmongodb.c +++ b/modules/afmongodb/afmongodb.c @@ -47,7 +47,7 @@ typedef struct /* Shared between main/writer; only read by the writer, never written */ gchar *db; - LogTemplate *coll; + gchar *coll; gchar *host; gint port; @@ -84,11 +84,9 @@ typedef struct mongo_connection *conn; gint32 seq_num; - GString *current_namespace; - gint ns_prefix_len; + gchar *ns; GString *current_value; - bson *bson_sel, *bson_upd, *bson_set; } MongoDBDestDriver; @@ -145,8 +143,8 @@ afmongodb_dd_set_collection(LogDriver *d, const gchar *collection) { MongoDBDestDriver *self = (MongoDBDestDriver *)d; - log_template_unref(self->coll); - self->coll = log_template_new(log_pipe_get_config(&d->super), NULL, collection); + g_free(self->coll); + self->coll = g_strdup(collection); } void @@ -177,7 +175,7 @@ afmongodb_dd_format_stats_instance(MongoDBDestDriver *self) static gchar persist_name[1024]; g_snprintf(persist_name, sizeof(persist_name), - "mongodb,%s,%u,%s,%s", self->host, self->port, self->db, self->coll->template); + "mongodb,%s,%u,%s,%s", self->host, self->port, self->db, self->coll); return persist_name; } @@ -187,7 +185,7 @@ afmongodb_dd_format_persist_name(MongoDBDestDriver *self) static gchar persist_name[1024]; g_snprintf(persist_name, sizeof(persist_name), - "afmongodb(%s,%u,%s,%s)", self->host, self->port, self->db, self->coll->template); + "afmongodb(%s,%u,%s,%s)", self->host, self->port, self->db, self->coll); return persist_name; } @@ -274,10 +272,6 @@ afmongodb_worker_insert (MongoDBDestDriver *self) g_free (oid); bson_finish (self->bson_sel); - g_string_truncate(self->current_namespace, self->ns_prefix_len); - log_template_append_format(self->coll, msg, NULL, LTZ_LOCAL, - self->seq_num, NULL, self->current_namespace); - for (i = 0; i < self->num_fields; i++) { log_template_format(self->fields[i].value, msg, NULL, LTZ_SEND, @@ -292,7 +286,7 @@ afmongodb_worker_insert (MongoDBDestDriver *self) bson_append_document (self->bson_upd, "$set", self->bson_set); bson_finish (self->bson_upd); - p = mongo_wire_cmd_update (1, self->current_namespace->str, 1, + p = mongo_wire_cmd_update (1, self->ns, 1, self->bson_sel, self->bson_upd); if (!mongo_packet_send (self->conn, p)) @@ -335,12 +329,8 @@ afmongodb_worker_thread (gpointer arg) NULL); success = afmongodb_dd_connect(self, FALSE); - self->current_namespace = g_string_sized_new(64); - self->ns_prefix_len = strlen (self->db) + 1; - self->current_namespace = - g_string_append_c (g_string_assign (self->current_namespace, - self->db), '.'); + self->ns = g_string_concat (self->db, ".", self->coll, NULL); self->current_value = g_string_sized_new(256); @@ -383,7 +373,7 @@ afmongodb_worker_thread (gpointer arg) afmongodb_dd_disconnect(self); - g_string_free (self->current_namespace, TRUE); + g_free (self->ns); g_string_free (self->current_value, TRUE); bson_free (self->bson_sel); @@ -516,7 +506,7 @@ afmongodb_dd_free(LogPipe *d) g_free(self->fields); g_free(self->db); - log_template_unref(self->coll); + g_free(self->coll); g_free(self->user); g_free(self->password); g_free(self->host); -- 1.7.2.5

2 2

Formatting syslogs using syslog-ng
by Pramod Pillai 30 Apr '11

30 Apr '11

Hi I need to format the below syslog message. Apr 13 07:37:28 host-mgr dhcpd: [ID 702911 local7.error] DHCPDISCOVER to Apr 13 03:37:15 host-mgr 23 3 DHCPDISCOVER My destination config looks like this. destination sol_dest { file("/var/log/sol_syslog" perm(0644) template("$S_DATE $HOST $FACILITY_NUM $LEVEL_NUM $MSGONLY\n") template_escape(no) ); }; With the template mentioned above I am getting output as shown below. I need to remove " [ID 702911 local7.error] " . How to do it. Apr 13 03:37:15 mgr-t 23 3 [ID 702911 local7.error] DHCPDISCOVER I am running this on Solaris machine with syslong-ng 3.1.2 Regards Pramod

2 1

Not all messages getting to program destination
by Bill Anderson 30 Apr '11

30 Apr '11

Setup: v3.1 program destination: python script secondary file destination in the _same_ log block (so it should be getting everything the program destination gets), no final flag. stats turned on, 60s interval. Problem: In the script I am tallying lines parsed per minute. The lines parsed per-minute is not matching a grep -c on the file destination. stats indicate no dropped or queued messages to either destination. If I cat the file to the same destination script on the command line, I get the same counts as I do grepping the file directly. I would expect that the script would return the same results from the shell as when running as a destination in syslog. Where else can I look/what else can I turn on, to see why the discrepancy exists? Cheers, Bill -- Bill Anderson, RHCE Linux Systems Engineer bill.anderson(a)bodybuilding.com

4 7

Question about syntax for source
by Phusion 30 Apr '11

30 Apr '11

In syslog-ng 2.x versions under OpenBSD I used to use the following line for a source. source local { internal(); pipe("/dev/klog" log_prefix("kernel: ")); unix-dgram("/dev/log"); }; When trying to convert this for syslog-ng 3.x under OpenBSD. I have an error. When I use syslog-ng -s -f ../syslog-ng.conf it works, but when I run syslog-ng -p /var/run/syslog-ng.pid, I get the following error. # /usr/local/sbin/syslog-ng -p /var/run/syslog-ng.pid WARNING: you are using the pipe driver, underlying file is not a FIFO, it should be used by file(); filename='/dev/klog' Here is the current source line using syslog-ng 3.0 under OpenBSD 4.8. source local { internal(); pipe("/dev/klog" program_override("kernel: ")); unix-dgram("/dev/log"); }; Please advise. Phusion

6 12

log message difference between syslog and syslog-ng?
by Evan Baer 30 Apr '11

30 Apr '11

Hello, We switched one of our last remaining syslog servers to syslog-ng a few days ago, with no major surprises, except for one small difference in log message formatting between syslog and syslog-ng for messages from some of our network devices. The difference is in the added ':' in the 5th column, after the hostname: Apr 27 12:48:52 10.26.13.65 oob1-switch, System: Set fan speed to MED (75%) Apr 28 16:59:53 10.26.13.65 oob1-switch,: System: Set fan speed to LOW (50%) (the first line is from syslog, the second is from syslog-ng3-3.1.1, running on freebsd) For what it is worth, this formatting difference also occurs with other devices of the same manufacturer and model which have valid reverse ip entries in dns. We have a few support scripts which read the logs and are picky about the line formatting, so I'm keen to tweak the output lines in syslog-ng.conf if possible. Thoughts? Thanks in advance, -- Evan

2 1

syslog-ng and systemd
by Matthias Runge 30 Apr '11

30 Apr '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello users, Fedora 15 (and later) uses systemd as init-replacement. Currently, I'm building a fedora package for syslog-ng version 3.2.x. It is based on a git-snapshot dated April 24th. Is there a way to signal syslog-ng to reload it's configuration other than HUPing its pid? The documentation of systemd[1] says: ExecReload= should be specified for all services supporting reload. It is highly recommended to add code here that synchronously reloads the configuration file here (i.e. /bin/kill -HUP $MAINPID is usually a poor choice, due to its asynchronous nature). Omit this option if your service does not support reloading. I would highly appreciate not to maintain a pidfile. Newer linux kernels support so called cgroups. Those can be used to group processes. Systemd creates a cgroup for each service and starts in our case syslog-ng in this cgroup. When no process runs in syslog-ng cgroup, the process exited and must be restarted. systemd takes care of this. Again, is there any other way to signal syslog-ng to reload its config? Thanks, Matthias [1] https://fedoraproject.org/wiki/Systemd_Packaging_Draft#Writing_unit_files -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJNuSg1AAoJEOnz8qQwcaIWb6oIAKMjeWwi5C/qZFeWgSL0/X5Y lsMjjWQ/YvhdgjHxNLEHFpTsJT6nrFo1akLN9nL4I8j23vekEgtDrWKAeOk/A+S9 LVUmgcGYnXJC3Oshu2Xg8MLcBQIIrXVrboTeG5GHGBG3gWmRuzL0yH9PjSKbNcd0 PtHSxqEBwhHN9vOc59a5UvclElGgmSzqmYdS5Qm84fStii+j7GNwkqRQvoEGrPlw RrOSFsIPGStXnxk+SzRn8JCKrk7ueZM7l8QoJPIfghdumFqyjPhZRd2BQUlorr6z J3u3GEpXaIOyj+qyix+KTTofjiJh/TC4/SVnqmNTQgsqKLNy1hDCWHXz2X1v7TY= =M50d -----END PGP SIGNATURE-----

3 2

gmane posting problem
by Micah Anderson 30 Apr '11

30 Apr '11

My previous message that I sent to this list I tried to send three different times via GMANE, which is subscribed to this list. Usually I have no issue posting to lists through this method, but for some reason, my message was not getting posted. Typically what happens is you post to the list via gmane, the gmane autoresponder sends you an email to confirm that you are a legit person and not a spammer, and then you reply and then you are allowed to post to the list. I did all that, but my messages were not coming through. Perhaps the list is configured in a strange way where these messages are getting rejected? thanks for looking into this, micah --

2 1

Maintenance Policy update for syslog-ng Open Source Editions
by Balazs Scheidler 30 Apr '11

30 Apr '11

Dear syslog-ng users, As discussed on the syslog-ng mailing list, the current versioning policies regarding syslog-ng Open Source Edition is confusing, and with the proliferation of syslog-ng versions, their maintenance is an increasing burden on the syslog-ng project. Currently three major versions are supported (3.0, 3.1 and 3.2) and a fourth one (3.3) is in active development. A decision was made that the distinction between "feature" and "stable" releases for syslog-ng OSE releases will cease to exist: all releases will have the same status support-wise: * they will be supported for a year, or * until the next stable release is made * whichever is longer Also, the versioning of Open Source and Premium editions will become completely independent, and it is not possible to compare their functionality on the version number alone. The Premium Edition will always be based on a specific Open Source release, and provide additional functionality compared to the base version. OSE releases published after the PE release may provide additional functionality, not yet present in a PE release. The changes above cause some of our currently supported versions to be deprecated. In order to provide a time window for migration to a newer release, the following EOL dates were set: syslog-ng 3.0: 30th, June 2011. syslog-ng 3.1: 30th, June 2011. Everyone running these or earlier releases should upgrade to the latest 3.2.x release, which is currently at 3.2.2. For more information: * support periods for syslog-ng OSE versions: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… * to download the latest syslog-ng OSE sources: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The syslog-ng project, on its own doesn't provide syslog-ng binaries, except for a limited number of Linux distributions. It is expected that users compile syslog-ng on their own, or use the binary provided by the OS supplier. This change doesn't affect you, if * you run a Premium Edition of syslog-ng, * you have a support contract in place, that says otherwise Happy logging, -- Bazsi

1 0

syslog-ng to elasticsearch ?
by Daniel Maher 28 Apr '11

28 Apr '11

Hello, I am curious to know if anybody has tried (or even better, succeeded) in sending logs from Syslog-NG direct to Elasticsearch ? I see that there is already a driver for MongoDB, which is along the same lines... My first idea was to send all the incoming logs to a named pipe, then have a small script read from the pipe and trigger calls to ES for each line (not unlike the many SQL howtos out there). I suspect that this would work, but if anybody has any ideas which are more elegant, I would love to hear about it. Thanks, and have a great day ! -- Daniel Maher « can't talk, too busy calculating computrons. »

3 4

FW: Solaris 10_x86 server.
by sramesh.kumar＠wipro.com 27 Apr '11

27 Apr '11

<sramesh.kumar(a)wipro.com> writes: > Thanks to your mail… But I am getting below error….in solaris10 os. > Please suggest. > bash-3.00# /usr/local/sbin/syslog-ng -d -f > /etc/syslog-ng/syslog-ng.conf > > Error opening file for reading; filename='/proc/kmsg', error='No such > file or directory (2)' > > Error initializing source driver; source='s_sys' > > \bash-3.00# ls -l /proc/kmsg > > /proc/kmsg: No such file or directory > > bash-3.00# That's because /proc/kmsg is not available on Solaris: it's a Linux thing. You can safely remove it from the configuration file. I'd strongly suggest reading the documentation available at http://www.balabit.com/sites/default/files/documents/syslog-ng-v2.0-guide-a… (Also, upgrading to a more recent version of syslog-ng would perhaps be a good idea, 2.0.5 is ancient) -- |8] ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

Solaris 10_x86 server.
by sramesh.kumar＠wipro.com 27 Apr '11

27 Apr '11

Hi All, Can any body help me. Please????? I hve configured syslog-ng in X86 server. Bellow is the configuration. But Logs are not coming under /syslog-ng folder.....if I am wrong in bellow configuration, can you Please Provide step by step configuration Procedure to configure the same... # cat /etc/syslog-ng/syslog-ng.conf options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); sun-stream ("/dev/log"); internal(); }; # External Source source s_ext { # Standard Syslog udp(); # All interfaces tcp(); # All interfaces on tcp port sun-stream("/dev/log"); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/adm/messages"); }; destination d_mail { file("/var/log/syslog"); }; destination d_auth { file("/var/log/authlog"); }; destination d_mlop { usertty("operator"); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); }; destination d_ext { file("/syslog-ng/$HOST/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" \ owner(root) group(root) perm(0650) dir_perm(0750) create_dirs(yes)); create_dirs(yes)); }; filter f_filter1 { level(err) or (level(notice) and facility (auth, kern)); }; filter f_filter2 { level(err) or (facility(kern) and level(notice)) or (facility(daemon) and level(notice)) or (facility(mail) and level(crit)); }; filter f_filter3 { level(alert) or (facility(kern) and level(err)) or (facility(daemon) and level(err)); }; filter f_filter4 { level(alert); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(kern) and level(notice); }; filter f_filter7 { facility(mail) and level(debug); }; filter f_filter8 { facility(user) and level(err); }; filter f_filter9 { facility(user) and level(alert); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_mlop); }; log { source(s_sys); filter(f_filter4); destination(d_mlrt); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_auth); }; log { source(s_sys); filter(f_filter7); destination(d_mail); }; log { source(s_sys); filter(f_filter8); destination(d_cons); destination(d_mesg); }; log { source(s_ext); destination(d_ext); }; # isainfo -kv 64-bit amd64 kernel modules # cat /etc/release Solaris 10 10/08 s10x_u6wos_07b X86 Copyright 2008 Sun Microsystems, Inc. All Rights Reserved. Use is subject to license terms. Assembled 27 October 2008 # pkginfo -l SMCsyslng PKGINST: SMCsyslng NAME: syslogng CATEGORY: application ARCH: x86 VERSION: 2.0.5 BASEDIR: /usr/local VENDOR: BalaBit IT Ltd PSTAMP: Steve Christensen INSTDATE: Apr 20 2011 16:24 EMAIL: steve(a)smc.vnet.net STATUS: completely installed FILES: 64 installed pathnames 3 shared pathnames 15 directories 2 executables 2163 blocks used (approx) Thanks & Regards, Ramesh Kumar, Wipro Infotech Hyderabad, Mobile: +91 905 221 3330 * : sramesh.kumar(a)wipro.com <mailto:sramesh.kumar@wipro.com> Intensity to Win Act with Sensitivity Unyielding Integrity Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

3 4

syslog-ng 3.1.2 - Changing location of syslog-ng.pid file causes problems
by Zeek Anow 27 Apr '11

27 Apr '11

We are running Solaris 10 Update 9, syslog-ng 3.1.2 - version details at bottom of this msg. I wanted the syslog-ng.pid file to be located in swap so it would be cleared after a reboot. I also did not like the idea of creating the /usr/local/var/run directories, so: I modified the /lib/svc/method file and then validated and imported the syslog-ng.xml file. I stopped/disabled the syslog-ng process to make this change. So now, I have 3 problems, but syslog-ng is running, and I can't imagine how:)). 1. I cannot find the 2 files syslog-ng.pid or syslog-ng.ctl files anywhere on the system. I did a global find which searches the entire disk. 2. When syslog-ng started up, I got the following msg, and it is true: Error opening control socket, bind() failed; socket='/usr/local/var/syslog-ng.ctl', error='No such file or directory. 3. Before I made the change, a ps was showing: root 5769 1 7 7 0 Apr 21 ? 0:00 /usr/local/sbin/syslog-ng root 5770 5769 5770 5770 13 Apr 21 ? 5618:33 /usr/local/sbin/syslog-ng cat /usr/local/var/syslog-ng.pid 5770 As you can see, the PID is 5770. Shouldn't that be 5769?? ******End of 3 questions ******** I have this same version of syslog-ng on another server, but I have not yet changed the location of the syslog-ng.pid file. The change I made was FROM: PIDFILE=$SYSLOGNG_PREFIX/var/run/syslog-ng.pid TO: PIDFILE=/var/run/syslog-ng.pid The config part of the method file is now: #SYSLOGNG_PREFIX=/opt/syslog-ng SYSLOGNG_PREFIX=/usr/local SYSLOGNG="$SYSLOGNG_PREFIX/sbin/syslog-ng" CONFFILE=$SYSLOGNG_PREFIX/etc/syslog-ng.conf PIDFILE=/var/run/syslog-ng.pid SYSLOGPIDFILE=/var/run/syslog.pid OPTIONS= MAXWAIT=30 [root] # syslog-ng -V syslog-ng 3.1.2 Installer-Version: 3.1.2 Revision: ssh+git://bazsi@git.balabit //var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.1#master#8bf13c304b6ab5fc1a372b49d55c78370efe14ca Compile-Date: Oct 25 2010 23:56:18 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: on Enable-Sun-Door: on Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: on [root@ecrsyslg00/usr/local]#

2 6