- syslog-ng - lists.balabit.hu

syslog-ng 3.01 compilation error on Solaris
by Rakesh Rajasekharan 20 Feb '11

20 Feb '11

Hi, I was trying to compile the syslog-ng 3.01 on Solaris 10 Opteron machine using the mixed linking option. In the configure stage I get the below error complaining about the glib . I have compiled glib with teh enable static flag and the libglib-2.0.a library is available under the path /usr/local/lib and my PKG_CONFIG_PATH environment variable has been set correctly too. Please help me solve this. * * Below is the configure error. checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking for pthread_create in -lpthread... yes checking for LIBNET... no checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking whether to enable TCP wrapper support... no checking whether to enable spoof source support... no checking whether to enable IPv6 support... yes checking whether to enable SQL support... no checking whether to enable Linux capability support... no checking whether to enable PCRE support... no checking for pkg-config... (cached) /usr/local/bin/pkg-config checking pkg-config is at least version 0.14... yes checking for GLIB - version >= 2.10.1... yes (version 2.16.5) checking for EVTLOG... yes checking for static GLib libraries... no checking sanity checking Glib headers... yes *configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib* * * * Thanks & Regards, Rakesh *

2 4

Invitation to connect on LinkedIn
by Janez Barbic 19 Feb '11

19 Feb '11

LinkedIn ------------ Syslog-ng, I'd like to add you to my professional network on LinkedIn. - Janez Janez Barbic Student at Univerza v Ljubljani Slovenia Confirm that you know Janez Barbic https://www.linkedin.com/e/-uz7o7o-gkcu3i8u-2k/isd/2362025712/_2EaqCuR/ -- (c) 2011, LinkedIn Corporation

1 0

patterndb project?
by Valentijn Sessink 18 Feb '11

18 Feb '11

Hi, http://www.balabit.com/wiki/patterndb mentions the "patterndb project", but there is hardly any information. I have a couple of additions to the sshd patterns, does anyone know where to put/send them? Best regards, Valentijn

2 3

[Bug 112] New: Problems when using encoding in 3.1.3 ose edition
by bugzilla＠bugzilla.balabit.com 17 Feb '11

17 Feb '11

https://bugzilla.balabit.com/show_bug.cgi?id=112 Summary: Problems when using encoding in 3.1.3 ose edition Product: syslog-ng Version: 3.1.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: aseques(a)gmail.com Type of the Report: --- Estimated Hours: 0.0 Good morning, I needed to reencode some windows logs emited by snare so they are stored ad UTF on the fly. After reading the documentation, I found what seems to be the solution. Instead of creating a single source of data. I create an extra one, called src_win. source src { udp(ip("192.168.1.200") port(514)); }; source src_win { udp(ip("192.168.1.200") port(514) encoding("WINDOWS-1252")); }; Whenever I want to use the filter encoding for the logs, I will use this source instead of the generic one. log { source(src_win); filter(f_host_name); filter(f_messages); destination(name_messages); }; The problem is that as soon as I enable the source src_win for any log, it just stop logging the rest of sources. Is that a known bug or something I should fix. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

patterndb single byte optional
by Jean F. Mousinho 17 Feb '11

17 Feb '11

Hello, I was wondering if there's any way of reducing two lines of pattern, which provide a way of matching when a optional byte is present or not, into a single line. Example: JAN @STRING:.day@ 2011 JAN @STRING:.day@ 2011 Notice that this is the case when day doesn't have the leading 0 and I don't want the .day to contain any space. Just asking, this would reduce my patterns to half :) but I can live with that... Maybe a new type of STRING, like @DSTRING:.day: @ (dirty string, with dirty chars inside the optional argument) would fix it? Thanks for your time. Jean-François Mousinho

2 1

Possible destination driver question
by Bill Anderson 15 Feb '11

15 Feb '11

I've had it in my "backlog" to write a couple destinations: redis and AMQP (specifically at the moment rabbitmq). I've done the Proof-of-Concept via program() already and of course it works. With all the recent announcements of people writing to various destinations such as SMTP and MongoDB, I thought I'd throw out an email to see if someone is already working on one before getting started on one sometime in the next couple sprints/weeks. Cheers, Bill -- Bill Anderson, RHCE Linux Systems Engineer bill.anderson(a)bodybuilding.com

2 1

[PATCH] systemd integration, take two
by Gergely Nagy 15 Feb '11

15 Feb '11

Hi! After a short session with Bazsi the other day, the earlier systemd integration patches were reworked slightly. Bazsi refactored the patch, I cleaned it up a little afterwards, and tested it to the best of my knowledge (also thanks to Peter Czanik for testing the new patches aswell). The patches are available on the integration/systemd branch of my repositories: git://git.balabit.hu/algernon/syslog-ng-3.3.git and git://git.balabit.hu/algernon/syslog-ng-3.2.git (for 3.3 and 3.2, respectively). The change in this patchset is that the way systemd sockets are recognised has been reworked, which made my previous GSockAddr changes unnecessary (and thus, those changes were dropped). As a side effect, unix-stream sockets should be working too, alongside of unix-dgram, and extending this to other socket types should be a lot easier than before. I'd like to call for some more testing, and if all goes well, then this version could be merged to the official tree. -- |8]

2 1

syslog-ng Insider - February 2011
by Peter Czanik 11 Feb '11

11 Feb '11

Dear syslog-ng users, This is the first issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com FEATURED NEWS BalaBit has been invited to the CEE Board ----------------------------------------- Common Event Expression (CEE) for Event Interoperability is a US govermental task force aiming to standardize the way computer events are described, logged, and exchanged. A part of CEE will define a generic dictionary for event fields, which will be handy for the syslog-ng patterndb project. More information on CEE: http://cee.mitre.org/about.html Current members of CEE Board: http://cee.mitre.org/board.html Related blog posts: * http://bazsi.blogs.balabit.com/2010/11/patterndb-goes-cee/ * http://czanik.blogs.balabit.com/2010/11/cee/ FOSDEM - Free and Open Source Developers European Meeting ---------------------------------------------------------- Peter Czanik from the syslog-ng upstream attended the conference to help include the most recent syslog-ng versions into the main distributions. Read his blog post at http://czanik.blogs.balabit.com/2011/02/fosdem/ Support the syslog-ng project with your testimonial! ---------------------------------------------------- We have launched a public site for collecting user feedbacks and testimonials. Please help us to improve syslog-ng and tell us your opinion (both negative and positive), experience, feature request, or why you use syslog-ng at http://www.balabit.com/testimonials/send OTHER SHORT NEWS * A new syslog-ng driver for the mongodb() NOSQL database is available in 3.3 alpha1: http://asylum.madhouse-project.org/projects/syslog-ng/mongodb/ * systemd support for recent operating systems: https://lists.balabit.hu/pipermail/syslog-ng/2011-February/015876.html * Debian 6.0 repositories include syslog-ng OSE 3.1: http://packages.debian.org/search?keywords=syslog-ng&searchon=names&suite=s… NEW RELEASES OF THE SYSLOG-NG PRODUCT FAMILY * syslog-ng OSE 3.3 alpha1 - http://bazsi.blogs.balabit.com/2010/12/threading-epoll-on-3-3-mainline/ * syslog-ng PE 4.0 - http://attila.blogs.balabit.com/2011/02/balabit%e2%80%99s-syslog-ng-premium… RECENT WHITEPAPERS * Message Classification with syslog-ng (Free download) http://www.balabit.com/whitepapers/log-classification * Performance measurements of syslog-ng Premium Edition 4.0 (Requires registration at balabit.com) http://www.balabit.com/support/documentation/syslog-ng-pe-v4.0-whitepaper-p… * PCI compliance and forensics in auditing remote server access (Free download) http://www.balabit.com/sites/default/files/scb-v3.0-whitepaper-pci-complian…

2 1

Syslog-ng Windows Agent & WIN2008 Event Forwarding Subscription
by Szilárd Szabó 08 Feb '11

08 Feb '11

Üdv mindenkinek, Van egy kis problémám. Adott egy Windows Server 2008 melyen Event Forwarding Subscription van beállítva a következőek szerint: http://blogs.technet.com/b/wincat/archive/2008/08/11/quick-and-dirty-large-… Az hozzáadtam pár klienst. Az események megérkeznek a Windows Server 2008-ra hiba nélkül a ForwardedEvents -be. A Problémám a következő: A Windows Server 2008-ra telepítettem egy Syslog-ng Windows Agent 3.2.1 verziót, és beállítottam a log továbbítást egy Syslog-ng PE-felé. Az események megérkeznek, de felettéb érdekesen :) Jan 20 16:06:34 COMPUTER1 NT: AUTHORITY\ANONYMOUS LOGON: ForwardedEvents Security: [] (EventID 538) Jan 20 16:06:34 COMPUTER2 NT: AUTHORITY\ANONYMOUS LOGON: ForwardedEvents Security: [] (EventID 538) Jan 20 16:06:34 COMPUTER3 NT: AUTHORITY\ANONYMOUS LOGON: ForwardedEvents Security: [] (EventID 538) A Windows 2008 továbbá 64bites, tehát AD-ból van menedzselve. Ez most Agent probléma lehet, vagy a Event Forwarding Subscription-nal van a baj? Üdv Szilárd

5 11

[RFC] value-pairs(), take #3
by Gergely Nagy 07 Feb '11

07 Feb '11

Hi! Based on the feedback from this list, we've had a little discussion with Bazsi on how to improve value-pairs(), and we came up with something that is hopefully more consistent and easier to use than my last proposal. The Syntax ========== We'd have two syntaxes, one for the configuration file itself (usable by the drivers), and one for template functions (eg, tfjson): they'll share most properties, the difference will be in how they appear. See the example below: config file: ------------ value-pairs( scope(nv_pairs core syslog all_macros selected_macros everything) exclude("R_*") exclude("S_*") key(".SDATA.meta.sequenceId") pair("MSGHDR" "$PROGRAM[$PID]: ") ) template function: ------------------ $(format-json --scope nv_pairs,core,syslog,all_macros,selected_macros,everything \ --exclude R_* --exclude S_* --key .SDATA.meta.sequenceId \ --pair MSGHDR="$PROGRAM[$PID]: ") Explanation ----------- The above examples would start with a full set of name-value pairs (due to having "everything" in the scope; we could start with selected_macros instead [see below]). The scope can only be extended by subsequent calls to scope(), but even then, the set will be built only once, at the beginning. We'll likely end up with throwing a syntax error during parse if more than one scope() statement is seen, or if it's not the first statement within value-pairs(). However, explicitly specifying a key-value pair (either via key() or pairs()) will use the full set, regardless what scope() was selected. This, however, might change, if people find this too confusing. But changing this will complicate the code quite a lot, and remove some of the flexibility. >From this set, we exclude every pair where the key begins with "R_" or "S_", then we explicitly include .SDATA.meta.sequenceId (though, in this example, this is useless, as it's already included due to the scope, and wasn't excluded). Then add a custom key-value pair. Syntax Details -------------- The starting name-value pair set will be defined by the scope() statement, which can have the following values: * nv_pairs: The name-value pair database, including some frequently used builtins (currently: HOST, HOST_FROM, MESSAGE, PROGRAM, PID, MSGID, SOURCE and LEGACY_MSGHDR) * rfc3164, alias core, alias base: The basic pairs from RFC3164: $FACILITY, $SEVERITY (= $LEVEL), $DATE(=$S_DATE), $HOST, $PROGRAM, $PID, and $MSG. * rfc5424, alias syslog: The pairs from rfc3164 plus $SDATA and $MSGID. * all_macros: All macros known to syslog-ng (including all of the above, pretty much) * selected_macros: rfc5424 + $TAGS, $SOURCEIP, $SEQNUM * everything: all of the above, combined Each key is added to the set only once, naturally. scope() was introduced as a replacement for builtins(), which was unclear and inflexible. scope() does the job far better, and is - in my opinion - a lot clearer too. Apart from scope(), we have a few more statements: * select() / exclude(): We wanted to rename select() to include(), but syslog-ng already has an include() statement, and I ran into problems during the rename. It's undecided whether we'll remain with select() or adjust the parser to treat the two include statements differently (I'd opt for select()). The difference between the previous implementation's select()/exclude() is that in the new implementation, the first match will matter. This gets rid of the confusing priority stuff, and is still flexible enough (especially with the introduction of scope()) for all cases we could come up with. * key(): One can list macros with this statement. It does the same thing "$HOST" and friends did in the previous implementation, one just needs to use a statement this time, for clarity's sake. * pairs(): Same thing as the previous implementation's ("key" "value") construct. Current shortcomings: * List separation: at the moment, list values need to be space separated, and the key-value pairs (see pairs()) need a space separator too. In the long run, we'd like to allow commas as separators too. Another example --------------- value-pairs( scope(selected_macros nv_pairs) select(.*) select("usracct.*") select("secevt.*") select(".SDATA.*") exclude("*") key("SEVERITY") key("HOST") key("PROGRAM") key("PID") key("MSG") key("TAGS") pair("timestamp" "$UNIXTIME") ); This will start with a base set of selected_macros and nv_pairs, select a few specified patterns, and exclude everything else. Then it will explicitly add a few keys (which does not need to be part of the original set!), and a custom key-value pair. I hope this was understandable, and better than the previous proposal. As soon as I start working on implementing this proposal, the code will be available from the work/value-pairs/base branch of my git tree: git://git.madhouse-project.org/syslog-ng/syslog-ng-3.3.git (or browsable on the web at: http://git.madhouse-project.org/syslog-ng/syslog-ng-3.3/log/?h=work/value-p…) And as always, Your feedback is most appreciated! Nothing is set in stone yet, and I'd love to hear your opinion. -- |8]

3 4

syslog-ng performance tuning
by Zoltán Pallagi 07 Feb '11

07 Feb '11

Hi all, I've just measured the performance of syslog-ng PE and written a blog about syslog-ng performance tuning. Perhaps, it will be useful for OSE, too: http://pzolee.blogs.balabit.com/en/2011/02/syslog-ng-performance-tuning -- pzolee

1 0

syslog-ng af_sql driver experiencing segfault
by Matthew Hall 07 Feb '11

07 Feb '11

Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0xf7b12b90 (LWP 23608)] 0x00c5c7dc in memcpy () from /lib/libc.so.6 (gdb) bt #0 0x00c5c7dc in memcpy () from /lib/libc.so.6 #1 0xf7e21fed in g_string_insert_len () from /home/y/lib/libglib-2.0.so.0 #2 0xf7e223e8 in g_string_append_len () from /home/y/lib/libglib-2.0.so.0 #3 0xf7edc1d6 in result_append (result=0x8cc1780, sstr=0x910ffaf "", len=3160627, escape=0) at templates.c:213 #4 0xf7ede535 in log_template_append_format_with_context (self=0x8ba0098, messages=0xf7b12204, num_messages=1, opts=0x8bb8aec, tz=1, seq_num=945, result=0x8cc1780) at templates.c:1058 #5 0xf7ede83f in log_template_append_format (self=0x8ba0098, lm=0x90d93b0, opts=0x8bb8aec, tz=1, seq_num=945, result=0x8cc1780) at templates.c:1109 #6 0xf7ede898 in log_template_format (self=0x8ba0098, lm=0x90d93b0, opts=0x8bb8aec, tz=1, seq_num=945, result=0x8cc1780) at templates.c:1116 #7 0xf7b459e6 in afsql_dd_insert_db (self=0x8bb8a58) at afsql.c:681 #8 0xf7b45fd9 in afsql_dd_database_thread (arg=0x8bb8a58) at afsql.c:823 #9 0xf7ed1405 in worker_thread_func (st=0x8ba4238) at misc.c:593 #10 0xf7e28c51 in ?? () from /home/y/lib/libglib-2.0.so.0 #11 0x08ba4238 in ?? () #12 0x08ba4248 in ?? () #13 0x00000005 in ?? () #14 0xf7e28b06 in ?? () from /home/y/lib/libglib-2.0.so.0 #15 0x00d352c6 in ?? () from /lib/libpthread.so.0 #16 0x00000000 in ?? () (gdb) Looks like I am running into problems with the database code. I'll investigate but it's going to take a while so I hope somebody else might have an idea. This is 3.2 verion 2010-01-31 git. Thanks, Matthew.

2 2

How to stop repeated messages in Syslog-ng?
by Wagner Pereira 06 Feb '11

06 Feb '11

Hi, folks. I am using Syslog-ng as a Cacti's plugin. There are some messages which had been logged since last months. I'd like to ignore these specific messages, I mean, stop to login them. I tried to turn ON two variables in the php.ini... ignore_repeated_source = On ignore_repeated_errors = On ...but unsuccesfully (at least, I changed them and didn't restart any service...is it required?) Is that possible to stop them? Att, -- Wagner Pereira PoP-SP/RNP - Ponto de Presença da RNP em São Paulo CCE/USP - Centro de Computação Eletrônica da Universidade de São Paulo http://www.pop-sp.rnp.br Tel. +55 11 3091-8901 fone@RNP: 10158902

3 2

Testing structured data syslog messages
by Lance Laursen 06 Feb '11

06 Feb '11

Hello list, I am currently trying to test structured data log messages with syslog-ng. I'm running syslog-ng-3.1.2-1.rhel5. Setup is very simple, with a udp source and a destination to /var/log/messages. Here's the line i'm trying to use to test with, which according to the RFC, should be fine: echo -n '<165>1 2011-02-03T22:14:15.003Z superhostomg process - ID47 [exampleSDID@32473 iut="9" eventSource="rawr" eventID="69"] Message portion. Test log with structured data.' | nc -w 1 -u localhost 514 Unfortunately it is showing up in logs as this: 2011-02-03T22:45:30+00:00 localhost 1 2011-02-03T22:14:15.003Z superhostomg process - ID47 [exampleSDID@32473 iut="9" eventSource="rawr" eventID="69"] Message portion. Test log with structured data. So all of the metadata is being printed to $MSG. What am I doing wrong? Thanks,

4 4

Enhancement Request For program(...) Destination
by Matthew Hall 06 Feb '11

06 Feb '11

Could the program dest driver be enhanced to allow specifying the working directory? This would simplify the process of making movable software.

2 1

[PATCH] support for older PCRE
by Matthew Hall 06 Feb '11

06 Feb '11

Can we get this one added for older PCRE support? Bazsi made the old version, I tested and I updated it to apply cleanly on 3.2 master. Signed-off-by: Matthew Hall <mhall(a)mhcomputing.net> --- diff --git a/configure.in b/configure.in index 0c6cef2..f574f48 100644 --- a/configure.in +++ b/configure.in @@ -25,6 +25,8 @@ EVTLOG_MIN_VERSION="0.2" OPENSSL_MIN_VERSION="0.9.8" LIBDBI_MIN_VERSION="0.8.0" PCRE_MIN_VERSION="7.3" +dnl mhall allow older pcre +PCRE_MIN_VERSION="6.1" dnl *************************************************************************** dnl Initial setup diff --git a/lib/logmatcher.c b/lib/logmatcher.c index f0a822c..d003c58 100644 --- a/lib/logmatcher.c +++ b/lib/logmatcher.c @@ -520,8 +520,13 @@ log_matcher_pcre_re_compile(LogMatcher *s, const gchar *re) if (self->super.flags & LMF_ICASE) flags |= PCRE_CASELESS; + +/* mhall allow older pcre */ +#ifdef PCRE_NEWLINE_ANYCRLF if (self->super.flags & LMF_NEWLINE) flags |= PCRE_NEWLINE_ANYCRLF; +#endif + if (self->super.flags & LMF_UTF8) { gint support;

2 1

Re: [syslog-ng] Upgrade gotchas?
by Lay, James 06 Feb '11

06 Feb '11

This upgrade went fine with some minor issues. Thanks for all the great assistance from the folks on this list. James From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Lay, James Sent: Friday, January 28, 2011 3:26 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Upgrade gotchas? Hey All! I'm about to do an upgrade from 3.0.1, to 3.2.2. Any surprises or gotchas I should be aware of? I've done some searching online and didn't see too much in the way of what I needed to do, if anything, besides ./configure make and make install of eventlog and syslog-ng. My config below is what I am workin with: @version:3.0 options { use_dns(no); }; source s_local { unix-stream("/dev/log"); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(50000)); file("/proc/kmsg"); }; destination d_file { file("/syslogs/messages"); }; log { source(s_local); destination(d_file); }; Anything besides changing the version number? Thanks all. James

2 1

[PATCH] Extend the parsing of NUMBER and FLOAT type in patterndb
by SZALAY Attila 06 Feb '11

06 Feb '11

Hi! At the weekend I tried to create patterndb rules to spamassassin message and realised that it fail in to way. First when spamassasin add negative spam score result. This negative number is not recognised. Second issue is when I use bayes. Sometimes bayes give a very small probabaility number (ie 10^-13 as the order of magnitude) In this situation the exponent is appear in the log (ie.: bayes=1.11022302462516e-16) which not handled by patterndb very good either. SZALAY Attila (1): Added two feature into NUMBER and FLOAT parsing src/radix.c | 37 ++++++++++++++++++++++++++++++------- tests/unit/test_radix.c | 31 +++++++++++++++++++++++++++++++ 2 files changed, 61 insertions(+), 7 deletions(-)

2 2

Upgrade gotchas?
by Lay, James 06 Feb '11

06 Feb '11

Hey All! I'm about to do an upgrade from 3.0.1, to 3.2.2. Any surprises or gotchas I should be aware of? I've done some searching online and didn't see too much in the way of what I needed to do, if anything, besides ./configure make and make install of eventlog and syslog-ng. My config below is what I am workin with: @version:3.0 options { use_dns(no); }; source s_local { unix-stream("/dev/log"); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(50000)); file("/proc/kmsg"); }; destination d_file { file("/syslogs/messages"); }; log { source(s_local); destination(d_file); }; Anything besides changing the version number? Thanks all. James

2 1

Impossibility to use multiple occurences of the same parser
by Guillaume Rousse 06 Feb '11

06 Feb '11

Hello list. My syslog-ng configuration is modular, so as to be easily deployed on all our hosts. There is a main configuration files, and one additional included file by service. Our LDAP and Kerberos servers are hosted on the same host (LDAP is our Kerberos backend). Main file has: parser p_db { db-parser(); }; filter f_drop { tags("dropthis"); }; destination d_drop { }; LDAP file has: log { source(s_sys); filter(f_ldap); parser(p_db); log { filter(f_drop); destination(d_drop); flags(final); }; log { destination(d_ldap); flags(final); }; }; Kerberos file has: log { source(s_sys); filter(f_kerberos); parser(p_db); log { filter(f_drop); destination(d_drop); flags(final); }; log { destination(d_kerberos); flags(final); }; }; This is incorrect, because parser(p_db) is used in two different log statements, and syslog-ng doesn't start with a cryptic message: Error initializing message pipeline; If I try to use the parser only once, in the main file, tagging doesn't occur. The only solution I found was to declare two different parsers, for each of the two files. As they both use a different pattern db fragment, it reduce the interest of merging them into a single pattern db file with update-patterndb. -- BOFH excuse #179: multicasts on broken packets

3 2

[fyi] ivykis reference handling
by Balazs Scheidler 06 Feb '11

06 Feb '11

Hi, Those experimenting with the 3.3 tree may have noticed that syslog-ng is using ivykis, a main loop implementation by Lennert Buytenhek. Since this library is not in wide-spread use in distributions, I've decided to embed it into the syslog-ng source code / git repository. Source code releases include a lib/ivykis directory, that is automatically compiled when syslog-ng is compiled except if --with-ivykis=system is specified. The git repository contains a submodule reference to the ivykis repo, which points to my ivykis repository on git.balabit.hu. The way it is implemented in git, is that it contains a sha1 reference to the exact imported commit. Since I don't intend to fork ivykis, this ivykis repo is rebased from time-to-time to its upstream. Rebasing causes commits to be changed (e.g. their sha1 changes), thus the submodule reference from the syslog-ng repo could break. To avoid this, I'm going to tag each and every "import" into the syslog-ng repository with a tag in the form "syslog-ng-3.3-refXXX", where XXX is a kind of version number, increased by one every time. By putting this tag in the ivykis repository, I can ensure that any import I make will still be available. I intend to do the same with libmongo-client, used by the mongodb driver. -- Bazsi

1 0

[PATCH][ivykis] configure.gnu: Quote $@, so that parameters are passed correctly.
by Gergely Nagy 05 Feb '11

05 Feb '11

When a parent configure calls ivykis' configure.gnu, some parameters might contain spaces (for example, CFLAGS="-ggdb3 -O0"), and without quoting $@, these will end up as separate options passed down to the real configure. With quoting, however, the parameters will be passed along as-is, without breaking them up. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- configure.gnu | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/configure.gnu b/configure.gnu index 99dd8a7..4fb578f 100644 --- a/configure.gnu +++ b/configure.gnu @@ -4,4 +4,4 @@ echo $0 configure="`dirname $0`/`basename $0 .gnu`" echo "Running: " $configure $@ --disable-shared --enable-static --with-pic -$SHELL $configure $@ --disable-shared --enable-static --with-pic +$SHELL $configure "$@" --disable-shared --enable-static --with-pic -- 1.7.0.4

2 1

syslog-ng deadlock if /dev/console locks?
by Paul Krizak 05 Feb '11

05 Feb '11

Hi, we're using syslog-ng 3.1.2 and have run into what appears to be a bug, but I'd like to get the community's opinion before we dig further into it. We have a bunch of HP servers with iLO2 and iLO3 devices, configured with their virtual serial ports on COM1 (ttyS0). We subsequently have the OS (RHEL4, RHEL5) configured to use COM1 as its console (e.g. /dev/console). This is a very standard configuration that allows us to get remote access to the machines without having to purchase the iLO Advanced KVM feature. It also lets us use the Magic SysRq keys to probe dead systems and stuff, so in general it's not something we're keen to change. What we have found, however, is that there are some cases where the iLO will freeze and requires a reboot. When the iLO reboots, however, the kernel's connection to /dev/console (through the virtual serial port) hangs and blocks. Any traffic to /dev/console just sits in the kernel's buffer and is never delivered. Once the buffer is full, the kernel simply blocks on any write to /dev/console. Now this is a Bad Thing in general, and we're working with HP to try and remedy this bug. However, what concerns me is that syslog-ng, when faced with this behavior, also blocks, even for log messages not bound for /dev/console. What we have observed is that a system with syslog-ng will keep delivering the occasional console message to /dev/console (ex. *.emerg messages) and meanwhile the file-based log paths keep working. But once /dev/console blocks, the next time a console message is delivered, *all* of syslog-ng blocks waiting for that message to be delivered, and all of the file-based paths block as well. The result is that pretty much everything on the system stops working. For example, you can't log in, even as root, because the login process blocks on the syslog command that writes to /var/log/secure. Anything that uses syslog suddenly blocks. Is this expected behavior? I would think that syslog-ng would be able to continue accepting and delivering messages, even if one of the log paths is stalled on a blocked write. -- Paul Krizak 7171 Southwest Pkwy MS B200.3A MTS Systems Engineer Austin, TX 78735 Advanced Micro Devices Desk: (512) 602-8775 Linux/Unix Systems Engineering Cell: (512) 791-0686 Global IT Infrastructure Fax: (512) 602-0468

6 15

Heavy memory leak using correlation or patterndb
by Guillaume Rousse 05 Feb '11

05 Feb '11

Hello. Since I installed the rules dedicated to dropping LDAP probe connection traces, the memory usage of my ldap server exploded. top confirms than syslog-ng is the culprit, using 60% of the available memory. Here is a weekly munin graph presenting the issue: http://www.zarb.org/~guillomovitch/memory-week.png The rules have been installed on 19th, and I restarted syslog-ng yesterday. I'm using syslog-ng 3.2.1, on mandriva 2010.0, 64 bits. Here are the exact rules used, if that matters (I couldn't try latest Balazs suggestions yet). The context-timeout for the first rule is quite low, because the probe checks every two seconds. By any chance, doesn't the second timeout, set to 0, set an illimited session expiration time ? If not the case, I'd gladly try any needed experiment, such as running syslog-ng under valgrind, to identify the leak source. -- BOFH excuse #400: We are Microsoft. What you are experiencing is not a problem; it is an undocumented feature.

2 3

[Bug 110] New: Advancing the system date and time beyond 2038 causes flood of messages
by bugzilla＠bugzilla.balabit.com 05 Feb '11

05 Feb '11

https://bugzilla.balabit.com/show_bug.cgi?id=110 Summary: Advancing the system date and time beyond 2038 causes flood of messages Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: gaudet(a)verizon.net Type of the Report: bug Estimated Hours: 0.0 On a 64-bit Linux system (SLES 11 SP1), if the date and time are advanced beyond January 19, 2038 @ 03:14:07, syslog begins flooding the log with MARK messages. It is possible that this is due to the so-called Year 2038 or Unix Millenium bug (see http://www.deepsky.com/~merovech/2038.html) The test: - Set the syslog mark frequency to 2 seconds and restart the syslog service - Tail the log - From another window, set the date to January 19, 2038 @ 03:14:00 - Observe the mark messages are correct until the clock moves beyond 03:14:07 # Display the starting date/time plus seconds since epoch $ date ; date +%s Tue Jan 25 02:10:00 UTC 2011 1295921228 # Set the date and time to January 19, 2038 @ 03:14:00 $ date 011903142038 Tue Jan 19 03:14:00 UTC 2038 # Display the new date/time and note that seconds since epoch have advanced beyond the 32-bit unsigned integer maximum $ date ; date +%s Tue Jan 19 03:14:10 UTC 2038 2147483650 $ tail -f /var/log/messages Jan 25 02:10:00 localhost -- MARK -- Jan 25 02:10:02 localhost -- MARK -- Jan 25 02:10:04 localhost -- MARK -- Jan 25 02:10:06 localhost -- MARK -- Jan 25 02:10:08 localhost -- MARK -- Jan 25 02:10:10 localhost -- MARK -- Jan 25 02:10:12 localhost -- MARK -- Jan 25 02:10:14 localhost -- MARK -- Jan 25 02:10:16 localhost -- MARK -- Jan 25 02:10:18 localhost -- MARK -- Jan 25 02:10:20 localhost -- MARK -- Jan 19 03:14:00 localhost -- MARK -- Jan 19 03:14:00 localhost syslog-ng[4961]: Log statistics; dropped='pipe(/dev/xconsole)=0', dropped='pipe(/dev/tty10)=0', processed='center(queued)=71', processed='center(received)=65', processed='destination(messages)=65', processed='destination(mailinfo)=0', processed='destination(mailwarn)=0', processed='destination(localmessages)=0', processed='destination(newserr)=0', processed='destination(mailerr)=0', processed='destination(netmgm)=0', processed='destination(warn)=2', processed='destination(console)=2', processed='destination(null)=0', processed='destination(mail)=0', processed='destination(xconsole)=2', processed='destination(firewall)=0', processed='destination(acpid)=0', processed='destination(newscrit)=0', processed='destination(newsnotice)=0', processed='source(src)=65' Jan 19 03:14:02 localhost -- MARK -- Jan 19 03:14:04 localhost -- MARK -- Jan 19 03:14:06 localhost -- MARK -- Jan 19 03:14:06 localhost -- MARK -- Jan 19 03:14:06 localhost -- MARK -- Jan 19 03:14:06 localhost -- MARK -- Jan 19 03:14:06 localhost -- MARK -- Jan 19 03:14:06 localhost -- MARK -- Jan 19 03:14:06 localhost -- MARK -- Jan 19 03:14:06 localhost -- MARK -- Jan 19 03:14:06 localhost -- MARK -- Jan 19 03:14:06 localhost -- MARK -- Jan 19 03:14:06 localhost -- MARK -- Jan 19 03:14:06 localhost -- MARK -- Jan 19 03:14:06 localhost -- MARK -- In a very short period of time, there are thousands of the "Jan 19 03:14:06..." messages in the log. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3