- syslog-ng - lists.balabit.hu

[Bug 103] New: Refresh of files in contrib/cygwin-packaging
by bugzilla＠bugzilla.balabit.com 14 Jan '11

14 Jan '11

https://bugzilla.balabit.com/show_bug.cgi?id=103 Summary: Refresh of files in contrib/cygwin-packaging Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Other Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: vinschen(a)redhat.com Type of the Report: --- Estimated Hours: 0.0 Created an attachment (id=29) --> (https://bugzilla.balabit.com/attachment.cgi?id=29) changes to contrib/cygwin-packaging files Hi, the latest version of syslog-ng requires a couple of changes to the files in contrib/cygwin-packaging. I've attached a patch consisting of the changes to the existing files as well as a new file contrib/cygwin-packaging/syslog-ng.sh Please make sure the new file has execute permissions by default. Thanks, Corinna -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 6

syslog-ng 3.1.4 has been released
by devel＠balabit.hu 14 Jan '11

14 Jan '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.1.4 SUMMARY : new stable release DATE : Jan 14, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.1.4) has been released. For latest fixes in the 3.1.x feature branch you are recommended to upgrade to this version. CHANGES: 3.1.4 Sun, 02 Jan 2011 13:06:13 +0100 Bugfixes: * Fixed hostname resolution in case normalize_hostnames() is enabled. In this case syslog-ng didn't properly NUL terminate the string causing binary characters to be emitted in log messages. * Fixed a possible security issue on FreeBSD and on platforms where mode_t is an unsigned 16 bit value. On these platforms syslog-ng may be using 0xFFFF as the permission bits causing log files to be world readable/writable/executable/setuid. * Fixed handling the port() options for SQL destinations. * Fixed a possible segmentation fault when the port number is changed for a TCP source, the configuration is reloaded and there were open connections for the old port, which send messages after the SIGHUP. This behaviour has been broken since 3.0.1. * The configure script has been changed to properly honour the value of ${exec_prefix} in case the env wrapper is enabled (--enable-env-wrapper). Configurations not using the env wrapper or using the same value for exec_prefix & prefix should not be affected. Other Changes: * Added explicit patterndb version check, in order to inform the user that a patterndb file is meant to be used by a newer syslog-ng version. * Increase YYMAXDEPTH value to make it possible to process larger configuration files. * Clarified the message on the deprecated use of use_time_recvd() Credits: Paul Krizak, Mukarram Syed, Philippe LEBRETON, Zhengxiang Pan, Matthew Hall, Craig Bell, Gergely Nagy, Laszlo Boszormenyi, Peter Czanik and Steven Chamberlain for reporting the bugs fixed in this release. Patches were authored by by Attila Nagy (BalaBit) and Balazs Scheidler (BalaBit). DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

syslog-ng 3.0.10 has been released
by devel＠balabit.hu 14 Jan '11

14 Jan '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.0.10 SUMMARY : new stable release DATE : Jan 14, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.0.10) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.10 Sun, 02 Jan 2011 12:43:46 +0100 Bugfixes: * Fixed handling the port() options for SQL destinations. * Fixed a possible segmentation fault when the port number is changed for a TCP source, the configuration is reloaded and there were open connections for the old port, which send messages after the SIGHUP. This behaviour has been broken since 3.0.1. * The configure script has been changed to properly honour the value of ${exec_prefix} in case the env wrapper is enabled (--enable-env-wrapper). Configurations not using the env wrapper or using the same value for exec_prefix & prefix should not be affected. * Fixed a possible security issue on Debian/kFreeBSD and on platforms where mode_t is an unsigned 16 bit value. On these platforms syslog-ng may be using 0xFFFF as the permission bits. Credits: Philippe LEBRETON, Zhengxiang Pan, Matthew Hall and Steven Chamberlain for reporting the bugs fixed in this release. Patches were authored by by Attila Nagy (BalaBit) and Balazs Scheidler (BalaBit). DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system…

1 0

Tailing a file
by maillists0＠gmail.com 14 Jan '11

14 Jan '11

I need to tail a bunch of application logs that aren't in syslog format and send them to a remote server. I've configured this: source s_tail { file(/var/log/chaotic_debug_log follow_freq(1) flags(no-parse)); }; destination remote { tcp("my_syslogserver.com" port(514)); }; log { source(s_tail); destination(remote); }; syslog-ng starts successfully and doesn't complain, but nothing happens... no logs appear remotely. I did a tcpdump on the syslog server and nothing is showing up from this box, so I did an strace on syslog-ng and didn't see the log files being opened. Running lsof on those files didn't show anything but the writing program. syslog-ng just isn't reading the files. Is something wrong with my config? How might I troubleshoot this? The syslog-ng version is 2.1.4 on CentOS 5.4. Also, to have syslog tail multiple files, do I just add multiple entries, like this? source s_tail { file(/var/log/chaotic_debug_log1 follow_freq(1) flags(no-parse)); }; source s_tail { file(/var/log/chaotic_debug_log2 follow_freq(1) flags(no-parse)); }; source s_tail { file(/var/log/chaotic_debug_log3 follow_freq(1) flags(no-parse)); }; Any help is appreciated. Thanks!

2 2

ld.so.1 problem during upgrade to 3.1.2
by Zeek Anow 14 Jan '11

14 Jan '11

I just upgraded to syslog-ng Solaris 10 on a Sun server. When I went to test my syslog-ng.conf file I am getting the following error: ld.so.1: syslog-ng: fatal: relocation error: file /.alt.Solaris10/usr/local/sbin/syslog-ng: symbol g_malloc_n: referenced symbol not found It looks as though something is missing from a library or maybe a path is not set correctly. Here are the packages I installed: libiconv-1.13.1-sol10-sparc-local glib-2.25.13-sol10-sparc-local libintl-3.4.0-sol10-sparc-local libgcc-3.4.6-sol10-sparc-local pcre-8.10-sol10-sparc-local eventlog-0.2.12-sol10-sparc-local libpcap-1.1.1-sol10-sparc-local tcpdump-4.1.1-sol10-sparc-local syslogng-3.1.2-sol10-sparc-local I had originally installed gcc-3.4.6-sol10-sparc-local too, but then uninstalled all packages and then reinstalled everything except gcc-3.4.6-sol10-sparc-local. The instructions says one or the other. Anyone have any ideas on how to fix this? Thanks

4 7

Syslog-ng/Rsyslog "message" differences (?)
by Champ Clark III [Softwink] 14 Jan '11

14 Jan '11

Hello all! I've got a bit of a strange problem. I've been developing software (Shameless plug: http://sagan.softwink.com) that does log analysis. This software is mostly used with Syslog-ng and Rsyslog. We recently started testing some log normalization, and I'm seeing different results from syslog-ng's $MSG string and rsyslog %msg%. For example: template("$MSG\n") template-escape(no)); }; --------------- Syslog-ng: template("$MSG\n") template-escape(no)); }; Output: sshd[20657]: Invalid user champtest from 66.177.167.194 --------------- Rsyslog: $template sagan, "%msg%\n" Output: Invalid user champtest from 66.177.167.194 --------------- Whitespacing aside, with syslog-ng I get the program information within the message field. I should point out that most of the systems in the network are Syslog-ng and reporting to Rsyslog (which I can switch out with Syslog-ng for testing). I guess my questions are: 1. Does this sound like a Syslog-ng/Rsyslog interoperability issue? 2. Or do the two just see the "message" formats differently? 3. Maybe it's just my setup (syslog-ng/rsyslog versions)? I have a "work around" with Rsyslog, but was wondering if there where any thoughts on this issue? Thanks -- Champ Clark III | Softwink, Inc | 800-538-9357 x 101 http://www.softwink.com GPG Key ID: 58A2A58F Key fingerprint = 7734 2A1C 007D 581E BDF7 6AD5 0F1F 655F 58A2 A58F If it wasn't for C, we'd be using BASI, PASAL and OBOL.

3 5

Issues while using Syslog destination driver
by Amit Khare 13 Jan '11

13 Jan '11

Hi, I am getting a weird issues while using the syslog destination driver. I am sending an xml message to syslog (syslog-ng 3.1) and forwarding the message over to another destination. The relevant entries in my syslog.conf look as following: filter f_atna { facility(local7); }; destination d_loghost { syslog("19.16.2.9" transport("tcp") port(6514) template("$MESSAGE")); }; log { source(src); filter(f_atna); destination(d_loghost); }; The problem I am running into is that the xml message is not getting processed on the other side because I am getting some weird characters are getting added in the xml message: <?xml - - - version="1.0" encoding="UTF-8"?> The above xml tag is constant in my program and therefore I am not inserting it and I don't even see it in /var/log/localmessages Dec 28 11:01:07 10.15.1.1 <?xml version="1.0" encoding="UTF-8"?> but when I do see it in my tcpdump I do see it. I am not seeing these weird dashes when I use the tcp destination driver but the message is not in the required format so it blows up on the other side. Has anyone seen this issue before? Any help will be greatly appreciated. Thanks, Amit

2 1

Broken Debug Behavior in libdbi
by Matthew Hall 13 Jan '11

13 Jan '11

Hello, Sorry about the cross-post, this came up in the interaction of two different pieces of software used together. libdbi's configure.in and other files contain some broken code which is preventing me from debugging a segfault in dbi_initialize when this function is called by syslog-ng. 1) The code is stripping the libraries of debug symbols when 'make install' is called which violates the GNU coding standards. To fix this, I want to disable library stripping that it is doing which is not in line with the standards and would appreciate advice on how to do this. 2) I could work around it using the make debug target, but then the could would ignore my CFLAGS which are: -m32 -g -I /home/y/include Ignoring these causes it to try to generate a 64-bit library which won't be compatible with the syslog-ng binary I want to build. To fix this, I want to make sure that the DEBUG target is not ignoring or overriding the 'upstream' user flags, but merely adding to them, so that my '-m32' and my '-I' are not lost, which causes build breakage for me, and my '-g' gets duplicated. 3) To work around these problems for now I'm going to patch configure.in and rerun autoconf unless there is an alternative proposal. Thanks, Matthew Hall. Here is the problematic flag setup being done in configure.in: if test -z "$GCC"; then case $host in *-*-irix*) if test -z "$CC"; then CC=cc fi DEBUG="-g -signed" CFLAGS="-O2 -w -signed" PROFILE="-p -g3 -O2 -signed" ;; sparc-sun-solaris*) DEBUG="-v -g" CFLAGS="-xO4 -fast -w -fsimple -native -xcg92" PROFILE="-v -xpg -g -xO4 -fast -native -fsimple -xcg92 -Dsuncc" ;; *) DEBUG="-g" CFLAGS="-O" PROFILE="-g -p" ;; esac else case $host in *-*-linux*) DEBUG="-g -Wall -D_REENTRANT -D__NO_MATH_INLINES -fsigned-char -std=gnu99" CFLAGS="-O20 -ffast-math -D_REENTRANT -fsigned-char -std=gnu99" PROFILE="-pg -g -O20 -ffast-math -D_REENTRANT -fsigned-char -std=gnu99";; sparc-sun-*) DEBUG="-g -Wall -D__NO_MATH_INLINES -fsigned-char -mv8 -std=gnu99" CFLAGS="-O20 -ffast-math -D__NO_MATH_INLINES -fsigned-char -mv8 -std=gnu99" PROFILE="-pg -g -O20 -D__NO_MATH_INLINES -fsigned-char -mv8 -std=gnu99" ;; *) DEBUG="-g -Wall -D__NO_MATH_INLINES -fsigned-char -std=gnu99" CFLAGS="-O20 -D__NO_MATH_INLINES -fsigned-char -std=gnu99" PROFILE="-O20 -g -pg -D__NO_MATH_INLINES -fsigned-char -std=gnu99" ;; esac fi

2 3

Authentication problem
by Fabien Bagard 13 Jan '11

13 Jan '11

Hi all, I am trying to set up a centralized syslog server, with encryption and authentication over TCP. Communication is ok, encryption too, but I can't get the authentication to work. Here is my actual configuration, reduced to what is needed : _Client :_ source s_src { unix-dgram("/dev/log"); internal(); file("/proc/kmsg" program_override("kernel")); }; ... destination d_net { tcp("192.168.0.42" port(4242) tls( ca_dir("/etc/rsyslog.d/certs/CA/") cert_file("/etc/rsyslog.d/certs/client.crt") key_file("/etc/rsyslog.d/certs/client.key") peer_verify(optional-untrusted) ) log_fifo_size(1000) ); }; ... log { source(s_src); destination(d_net); }; _Server :_ source s_src { # Local logging unix-dgram("/dev/log"); file("/proc/kmsg" program_override("kernel")); # Remote logging tcp( port(4242) tls( ca_dir("/etc/syslog-ng/certs/CA/") cert_file("/etc/syslog-ng/certs/server.crt") key_file("/etc/syslog-ng/certs/server.key") peer_verify(optional-untrusted) ) ); }; The CA which was used to sign these certificates is world readable and located in /etc/syslog-ng/certs/CA/ This setup works : server is getting client's logs, and cypherred on the wire. When I replace /peer_verify(optional-untrusted)/ by /peer_verify(required-trusted)/, in order to get mutual authentication, I get this error : ==> /var/log/error <== Jan 6 14:42:09 client syslog-ng[11086]: Certificate validation failed; subject='emailAddress=email(a)address.com, CN=server.fqdn, OU=Org Unit, O=Company, L=City, ST=Crountry, C=ID', issuer='emailAddress=email(a)address.com, CN=Root CA, OU=Org Unit, O=Company Root CA, L=City, ST=Country, C=ID', error='unable to get local issuer certificate', depth='0' Jan 6 14:42:09 client syslog-ng[11086]: SSL error while writing stream; tls_error='SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed' Jan 6 14:42:09 client syslog-ng[11086]: I/O error occurred while writing; fd='9', error='Broken pipe (32)' ==> /var/log/messages <== Jan 6 14:42:09 client syslog-ng[11086]: Syslog connection broken; fd='9', server='AF_INET(192.168.0.42:4242)', time_reopen='60' But my certificates are good : openssl verify -CAfile /etc/syslog-ng/certs/CA/ca.crt -purpose any /etc/syslog-ng/certs/client.crt /etc/syslog-ng/certs/client.crt: OK openssl verify -CAfile /etc/syslog-ng/certs/CA/ca.crt -purpose any /etc/syslog-ng/certs/server.crt /etc/syslog-ng/certs/server.crt: OK More informations : root@[client|server]:~ # syslog-ng -V syslog-ng 3.1.3 Installer-Version: 3.1.3 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.1#master#def34661b08109f8148904b860457d5747c425b3 Compile-Date: Nov 28 2010 12:29:35 Enable-Threads: on Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: on Enable-Linux-Caps: on Enable-Pcre: on Does someone has any clue on what's going wrong ? -- Fabien Bagard IT Department tel + 33 (0)1 48 03 60 40 -------------------------------------------------------------------------------- Parrot SA 174, Quai de Jemmapes | 75010 Paris - France tel + 33 (0)1 48 03 60 60 | fax + 33 (0)1 48 03 70 08 http://www.parrot.com -------------------------------------------------------------------------------- This e-mail message and any attached document(s) are for the sole use of the intended recipient(s)and may contain confidential and legally privileged information. Any unauthorized review, copy, use and/or disclosure is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original.

3 4

destination based on custom field question
by Christopher Barry 13 Jan '11

13 Jan '11

Greetings, I'm new to syslog-ng, and I'm trying to key off of a custom field in a log entry, and put the message in a particular directory named for the field. a sample log entry would look like this: Dec 16 14:08:51 u910-05 testapp: \ 00000000000000a7:00007f62d170a910:DEBUG :part.cpp : 183: \ | PartitionInfo [0x275f720] '\' denotes line continuation. The field I want to key off in this line is: 00000000000000a7 I created a filter to only get stuff from 'testapp', but now I want to make the destination be tied to the field. The field is positional, but can have any value, and cannot be known a priori. Not sure how to go about it. Any links to examples or where to start would be very much appreciated. -- Thanks, -Christopher

5 8

Re: [syslog-ng] syslog-ng 3.2.1 compile error
by Eric Berggren 13 Jan '11

13 Jan '11

> I'm trying to compile syslog-ng 3.2.1 on CentOS 5.3 which is running glib > 2.12.3-4, and get this error: > > ./.libs/libdbparser.so: undefined reference to `g_timeout_add_seconds' > collect2: ld returned 1 exit status > Using the older API is Bazsi's decision, but I have doubts about it's > feasibility. My recommendation is building a GLIB 2.14 and installing > it to an alternative directory and link to it(see below). If it doesn't > work, I recommend trying the pre-compiled OSE installers built by > BalaBit, which bring all their dependencies with them. You can download > them from > http://www.balabit.com/downloads/files?path=/syslog-ng/sources/3.2.1/setups For EL5 builds, I added the following to syslog-ng-3.2.1/modules/dbparser/dbparser.h : #define g_timeout_add_seconds(i,c,u) g_timeout_add(i*1000,c,u) Admittedly, I'm not particularly familiar with this and related functions, nor am I using the dbparser component, so haven't verified the behavior. Otherwise using it successfully with 2200 hosts shooting UDP at it . Curious what the implications are for this ... -eric

2 1

[Bug 105] New: syslog-ng --no-caps option causes segmentation fault if compiled with caps support in hardened gentoo
by bugzilla＠bugzilla.balabit.com 11 Jan '11

11 Jan '11

https://bugzilla.balabit.com/show_bug.cgi?id=105 Summary: syslog-ng --no-caps option causes segmentation fault if compiled with caps support in hardened gentoo Product: syslog-ng Version: unspecified Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: dk(a)i-zet.ru Type of the Report: bug Estimated Hours: 0.0 syslog-ng --no-caps option causes segmentation fault if compiled with caps support on gentoo hardened system This is from the build log: syslog-ng Open Source Edition 3.1.2 configured Compiler options: compiler : x86_64-pc-linux-gnu-gcc -std=gnu99 compiler options : -O2 -pipe -fforce-addr -mtune=nocona -march=nocona -Wall -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/usr/include/eventlog -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -Wl,-O1 -Wl,--as-needed prefix : /usr linking mode : dynamic Features: Sun STREAMS support : no Sun Door support : no Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : no spoof-source support : no tcp-wrapper support : yes SSL support : yes SQL support : no Linux capability support : yes PCRE support : yes Env wrapper support : no >>> Source configured. System parameters: # syslog-ng --version syslog-ng 3.1.2 Installer-Version: 3.1.2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.1#master#8bf13c304b6ab5fc1a372b49d55c78370efe14ca Compile-Date: Dec 15 2010 21:10:17 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: off Enable-Spoof-Source: off Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: on Enable-Pcre: on # # # uname -a Linux xxxxxx 2.6.32-hardened-r29 #1 SMP Fri Dec 3 14:08:35 MSK 2010 x86_64 Intel(R) Xeon(R) CPU X5450 @ 3.00GHz GenuineIntel GNU/Linux # # gcc -v Using built-in specs. Target: x86_64-pc-linux-gnu Configured with: /var/tmp/portage/sys-devel/gcc-4.4.4-r2/work/gcc-4.4.4/configure --prefix=/usr --bindir=/usr/x86_64-pc-linux-gnu/gcc-bin/4.4.4 --includedir=/usr/lib/gcc/x86_64-pc-linux-gnu/4.4.4/include --datadir=/usr/share/gcc-data/x86_64-pc-linux-gnu/4.4.4 --mandir=/usr/share/gcc-data/x86_64-pc-linux-gnu/4.4.4/man --infodir=/usr/share/gcc-data/x86_64-pc-linux-gnu/4.4.4/info --with-gxx-include-dir=/usr/lib/gcc/x86_64-pc-linux-gnu/4.4.4/include/g++-v4 --host=x86_64-pc-linux-gnu --build=x86_64-pc-linux-gnu --disable-altivec --disable-fixed-point --without-ppl --without-cloog --disable-nls --with-system-zlib --disable-werror --enable-secureplt --enable-multilib --enable-libmudflap --disable-libssp --enable-esp --enable-libgomp --with-python-dir=/share/gcc-data/x86_64-pc-linux-gnu/4.4.4/python --enable-checking=release --disable-libgcj --enable-languages=c,c++ --enable-shared --enable-threads=posix --enable-__cxa_atexit --enable-clocale=gnu --with-bugurl=http://bugs.gentoo.org/ --with-pkgversion='Gentoo Hardened 4.4.4-r2 p1.2, pie-0.4.5' Thread model: posix gcc version 4.4.4 (Gentoo Hardened 4.4.4-r2 p1.2, pie-0.4.5) # glibc - 2.11.2-r3 Example: $ $ /usr/sbin/syslog-ng -F -v -d --no-caps Segmentation fault $ $ strace /usr/sbin/syslog-ng -F -v -d --no-caps execve("/usr/sbin/syslog-ng", ["/usr/sbin/syslog-ng", "-F", "-v", "-d", "--no-caps"], [/* 33 vars */]) = 0 brk(0) = 0x3cdf13cf10 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0cc000 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat(3, {st_mode=S_IFREG|0644, st_size=51584, ...}) = 0 mmap(NULL, 51584, PROT_READ, MAP_PRIVATE, 3, 0) = 0x3752a0bf000 close(3) = 0 open("/usr/lib/libglib-2.0.so.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320{\1\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=981792, ...}) = 0 mmap(NULL, 3079320, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x37529bc2000 mprotect(0x37529cb0000, 2097152, PROT_NONE) = 0 mmap(0x37529eb0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xee000) = 0x37529eb0000 close(3) = 0 open("/usr/lib/libevtlog.so.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\31\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=18184, ...}) = 0 mmap(NULL, 2113664, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x375299bd000 mprotect(0x375299c1000, 2093056, PROT_NONE) = 0 mmap(0x37529bc0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x37529bc0000 close(3) = 0 open("/usr/lib/libssl.so.1.0.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0Pa\1\0\0\0\0\0"..., 832) = 832 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0be000 fstat(3, {st_mode=S_IFREG|0555, st_size=386928, ...}) = 0 mmap(NULL, 2482512, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x3752975e000 mprotect(0x375297b5000, 2093056, PROT_NONE) = 0 mmap(0x375299b4000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x56000) = 0x375299b4000 close(3) = 0 open("/usr/lib/libcrypto.so.1.0.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@U\6\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0555, st_size=1845904, ...}) = 0 mmap(NULL, 3956384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x37529398000 mprotect(0x37529538000, 2093056, PROT_NONE) = 0 mmap(0x37529737000, 147456, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x19f000) = 0x37529737000 mmap(0x3752975b000, 11936, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x3752975b000 close(3) = 0 open("/lib/libwrap.so.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@1\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=35552, ...}) = 0 mmap(NULL, 2132968, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x3752918f000 mprotect(0x37529197000, 2093056, PROT_NONE) = 0 mmap(0x37529396000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x7000) = 0x37529396000 close(3) = 0 open("/lib/libcap.so.2", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\26\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=18408, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0bd000 mmap(NULL, 2113856, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x37528f8a000 mprotect(0x37528f8e000, 2093056, PROT_NONE) = 0 mmap(0x3752918d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x3752918d000 close(3) = 0 open("/lib/libpcre.so.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\200\30\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=198368, ...}) = 0 mmap(NULL, 2293824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x37528d59000 mprotect(0x37528d89000, 2093056, PROT_NONE) = 0 mmap(0x37528f88000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2f000) = 0x37528f88000 close(3) = 0 open("/lib/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0~\354\1\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=1354792, ...}) = 0 mmap(NULL, 3463976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x37528a0b000 mprotect(0x37528b4f000, 2097152, PROT_NONE) = 0 mmap(0x37528d4f000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x144000) = 0x37528d4f000 mmap(0x37528d54000, 19240, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x37528d54000 close(3) = 0 open("/lib/libdl.so.2", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\r\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=14320, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0bc000 mmap(NULL, 2109600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x37528807000 mprotect(0x37528809000, 2097152, PROT_NONE) = 0 mmap(0x37528a09000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x37528a09000 close(3) = 0 open("/lib/libz.so.1", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p \0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=87936, ...}) = 0 mmap(NULL, 2183312, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x375285f1000 mprotect(0x37528606000, 2093056, PROT_NONE) = 0 mmap(0x37528805000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x14000) = 0x37528805000 close(3) = 0 open("/lib/libattr.so.1", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\25\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=22360, ...}) = 0 mmap(NULL, 2117664, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x375283eb000 mprotect(0x375283ef000, 2097152, PROT_NONE) = 0 mmap(0x375285ef000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4000) = 0x375285ef000 close(3) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0bb000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0ba000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0b9000 arch_prctl(ARCH_SET_FS, 0x3752a0ba700) = 0 mprotect(0x375285ef000, 4096, PROT_READ) = 0 mprotect(0x37528805000, 4096, PROT_READ) = 0 mprotect(0x37528a09000, 4096, PROT_READ) = 0 mprotect(0x37528d4f000, 16384, PROT_READ) = 0 mprotect(0x37528f88000, 4096, PROT_READ) = 0 mprotect(0x3752918d000, 4096, PROT_READ) = 0 mprotect(0x37529396000, 4096, PROT_READ) = 0 mprotect(0x37529737000, 106496, PROT_READ) = 0 mprotect(0x375299b4000, 16384, PROT_READ) = 0 mprotect(0x37529bc0000, 4096, PROT_READ) = 0 mprotect(0x37529eb0000, 4096, PROT_READ) = 0 mprotect(0x3cdf136000, 8192, PROT_READ) = 0 mprotect(0x3752a0ce000, 4096, PROT_READ) = 0 munmap(0x3752a0bf000, 51584) = 0 brk(0) = 0x3cdf13cf10 brk(0x3cdf15df10) = 0x3cdf15df10 brk(0x3cdf15e000) = 0x3cdf15e000 setrlimit(RLIMIT_NOFILE, {rlim_cur=4*1024, rlim_max=4*1024}) = 0 setsid() = 13612 prctl(PR_SET_KEEPCAPS, 1) = 0 capget(0x20080522, 0, NULL) = -1 EFAULT (Bad address) --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ Segmentation fault $ It is quite possible, that it is hardened gentoo specific bug. I could not reproduce it on non-hardened system. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 92] New: Allow user to specify SSL/TLS cipher suite for connections
by bugzilla＠bugzilla.balabit.com 11 Jan '11

11 Jan '11

https://bugzilla.balabit.com/show_bug.cgi?id=92 Summary: Allow user to specify SSL/TLS cipher suite for connections Product: syslog-ng Version: 3.1.x Platform: PC OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: brett.edgar(a)truedigitalsecurity.com Type of the Report: enhancement Estimated Hours: 0.0 Created an attachment (id=22) --> (https://bugzilla.balabit.com/attachment.cgi?id=22) Patch to allow user to specify acceptable TLS cipher suites. Some compliance regimens (e.g., the PCI DSS) require SSL/TLS connections to disable weak (<128 bit key length) ciphers and old protocols like SSLv2. Syslog-ng already disables SSLv2 by default, but there is no way to disable the weak ciphers without modifying the source with every new release. I have developed a very small patch that adds a configuration file line with the tls { } stanza to specify which TLS ciphers can be used. Example: source tlssrc { tcp(ip(1.2.3.4) port(514) max-connections(32) tls( key_file("/etc/syslog-ng/server.key") cert_file("/etc/syslog-ng/server.crt") cipher_suite("ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:!SSLv2") peer_verify(optional-untrusted)) ); }; -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

syslog-ng 3.2.1 compile error
by Lutz Mutz 11 Jan '11

11 Jan '11

Hey everyone, I'm trying to compile syslog-ng 3.2.1 on CentOS 5.3 which is running glib 2.12.3-4, and get this error: ./.libs/libdbparser.so: undefined reference to `g_timeout_add_seconds' collect2: ld returned 1 exit status make[5]: *** [pdbtool] Error 1 make[5]: Leaving directory `/usr/local/src/syslog-ng-3.2.1/modules/dbparser' make[4]: *** [all-recursive] Error 1 make[4]: Leaving directory `/usr/local/src/syslog-ng-3.2.1/modules/dbparser' make[3]: *** [all] Error 2 make[3]: Leaving directory `/usr/local/src/syslog-ng-3.2.1/modules/dbparser' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng-3.2.1/modules' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/local/src/syslog-ng-3.2.1' make: *** [all] Error 2 As I understand g_timeout_add_seconds was added to glib 2.14, which CentOS doesn't support yet. Now my question is, there was a big filed a while ago about this, does balabit plan on implementing the old api for glib to support 3.2.1 for glib < 2.14 ? Knowing the fact that CentOS is such a popular and wide distribution, why not make it easy for us and patch it? Is my other choice to just compile it statically on a system running glib >= 2.14 and then install the binary on the CentOS system? Thanks, Lutz

2 1

Signed-off-by usage
by Balazs Scheidler 10 Jan '11

10 Jan '11

Hi, You probably know that starting with 3.2 the license for syslog-ng has changed and BalaBit has given up copyright assignment paperwork when accepting patches into the source tree. However I feel it very important to track who contributed what, and using the git "Author" field is just painful. So I'd like to start using a "standard" procedure what all the kernel folks use, more specifically the "signed-off-by" line added to each submitted patch. All it takes is to add a Signed-off-by: Random Developer <random(a)developer.org> after understanding the implications. The implications are documented in the kernel source tree (Documentation/SubmittingPatches), copied below for simplicity's sake. I hope this will make it easier for me to give credits where credits are due. :) I also updated the webpage on https://www.balabit.com/network-security/syslog-ng/opensource-logging-syste… For accumulated stuff, I may ask you to add a signed-off-by line for an already submitted patch, in this case, all I need is a reply, posted on the public mailing list, quoting the patch and adding a Signed-off-by line, that I can copy-paste into the commit message. Thanks. PS: I still need to read my backlog of syslog-ng messages that got accumulated during the winter holidays, but I haven't forgotten them, I just got distracted. ---- quoted SubmittingPatches file ---- 11) Sign your work To improve tracking of who did what, especially with patches that can percolate to their final resting place in the kernel through several layers of maintainers, we've introduced a "sign-off" procedure on patches that are being emailed around. The sign-off is a simple line at the end of the explanation for the patch, which certifies that you wrote it or otherwise have the right to pass it on as a open-source patch. The rules are pretty simple: if you can certify the below: Developer's Certificate of Origin 1.1 By making a contribution to this project, I certify that: (a) The contribution was created in whole or in part by me and I have the right to submit it under the open source license indicated in the file; or (b) The contribution is based upon previous work that, to the best of my knowledge, is covered under an appropriate open source license and I have the right under that license to submit that work with modifications, whether created in whole or in part by me, under the same open source license (unless I am permitted to submit under a different license), as indicated in the file; or (c) The contribution was provided directly to me by some other person who certified (a), (b) or (c) and I have not modified it. (d) I understand and agree that this project and the contribution are public and that a record of the contribution (including all personal information I submit with it, including my sign-off) is maintained indefinitely and may be redistributed consistent with this project or the open source license(s) involved. then you just add a line saying Signed-off-by: Random J Developer <random(a)developer.org> Some people also put extra tags at the end. They'll just be ignored for now, but you can do this to mark internal company procedures or just point out some special detail about the sign-off. -- Bazsi

1 0

mojology: syslog-ng and mongodb meet the web
by Gergely Nagy 09 Jan '11

09 Jan '11

Hi! During the past couple of nights, I was busy coming up with something that would showcase the power of syslog-ng combined with the mongodb destination, and that is how mojology was born: http://mojology.madhouse-project.org/ source available @ https://github.com/algernon/mojology To sum it up: it's a web based log browser, a reasonably simple one: one can't search, or do advanced filtering (yet!), only a few basic stuff. The interesting part comes from the fact that the logs it displays are stored in mongodb, a document store, and as such, the structure of them is very, very flexible. Although, the application does make a few assumptions (see the about page or the readme in the sources), it still retains a lot of flexibility. Without going into the gory details (that's what the source is for ;), let me show you a few interesting pages! Examples -------- * http://mojology.madhouse-project.org/log/4d28cd01f310ef4f00000024 This one was originally made with the following command: logger -i -t hi 'Hello World! This concludes our demo session." Then I went into the MongoDB shell and added a few other keys below the "dyn" sub-document, alongside the default "classifier" (courtesy of patterndb). As you can see, no matter how deep one nests, it still displays properly. It's also easy to query, even at such depths. * http://mojology.madhouse-project.org/log/4d28cba4f310ef4f0000001e Logging in from one computer to my desktop, using password authentication. This entry was made fully automatically. Other notes ----------- The database behind the demo application is fairly small, only 39 messages stored, but hey, it's a demo! The program itself is a little over a hundred lines of python + templates; built upon Flask & PyMongo. For the best experience, a recent browser is strongly advised: Chromium 6+, Firefox 4+ for best results; Firefox 3 works very well too, but some of the tiny cosmetic features do not; the site displays in IE7+ too, and can be used, but the experience is rather disappointing. I hope this little weekend hack helps demonstrate how flexible mongodb can be for logging, and how well syslog-ng can make use of that flexibility. -- |8]

3 5

[Bug 78] running multiple syslog-ng instances precludes STATS socket use
by bugzilla＠bugzilla.balabit.com 09 Jan '11

09 Jan '11

https://bugzilla.balabit.com/show_bug.cgi?id=78 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution| |FIXED Status|NEW |RESOLVED --- Comment #1 from Balazs Scheidler <bazsi(a)balabit.hu> 2011-01-09 08:59:10 --- syslog-ng 3.1 & 3.2 has a command line option to control the name of the control socket. so I'm closing this ticket. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 64] misleading error message for missing destination
by bugzilla＠bugzilla.balabit.com 09 Jan '11

09 Jan '11

https://bugzilla.balabit.com/show_bug.cgi?id=64 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution| |FIXED Status|NEW |RESOLVED --- Comment #1 from Balazs Scheidler <bazsi(a)balabit.hu> 2011-01-09 08:57:33 --- this is already integrated, I've checked 3.1.x & 3.2.x both have the change. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 56] default config file if syslog-ng was compiled from source
by bugzilla＠bugzilla.balabit.com 09 Jan '11

09 Jan '11

https://bugzilla.balabit.com/show_bug.cgi?id=56 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|--- |3.2.1 CC| |bazsi(a)balabit.hu Resolution| |FIXED Status|NEW |RESOLVED --- Comment #1 from Balazs Scheidler <bazsi(a)balabit.hu> 2011-01-09 08:54:03 --- A default configuration file is supplied from 3.2 onwards as the system dependent parts of the config file are taken care of the system() source. Also this configuration file is installed by "make install". So I'm closing this ticket with target milestone set to 3.2.1. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

Re: [syslog-ng] logging to PostgreSQL database
by Sean McAfee 06 Jan '11

06 Jan '11

On 01/05/11 16:24, Janez Barbič wrote: > using PostgreSQL 8.4 > contents of pg_hba.conf: > ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ > ... > # > # Database administrative login by UNIX sockets > local all all trust > > # TYPE DATABASE USER CIDR-ADDRESS METHOD > > # "local" is for Unix domain socket connections only > # local all all trust > # IPv4 local connections: > # host all all 127.0.0.1/32 md5 > # IPv6 local connections: > host all all ::1/128 md5 > # syslog-ng logger > # host eneraptordb eneraptor 127.0.0.1/32 > trust > ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ > As far as I understand this configuration file, any user should have full access > to any database on local machine. At this point, I am not concerned about > security issues as I plan to address them after I resolve logging problem. In this context, "local" refers to the Unix socket (typically in /tmp), not a TCP/IP socket. This is how the command-line psql connects to the host (unless otherwise specified). You should be able to confirm that it's pg_hba-related by looking in the Postgres log file. I don't know if syslog-ng would take "/tmp" as an address, but you should be able to fix it in pg_hba.conf by either: 1. Uncommenting the "eneraptordb" line 2. Uncommenting the line below "IPv4 local connections" -- Sean McAfee

1 0

logging to PostgreSQL database
by Janez Barbič 05 Jan '11

05 Jan '11

Hi, I am a student of Computer Science at University of Ljubljana. Recently I started working on some project which includes logging into PostgreSQL database. I came across some problem which I can't resolve myself. No matter what I do, syslog-ng refuses to log into local PostgreSQL database. Here is my current configuration: using syslog-ng 3.2 server contents of syslog-ng.conf ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ @version: 3.2 #Default configuration file for syslog-ng. # # For a description of syslog-ng configuration file directives, please read # the syslog-ng Administrator's guide at: # # http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/bk01-toc.html # options { time_reap(30); mark_freq(10); keep_hostname(yes); }; ###### # sources source s_local { # message generated by Syslog-NG internal(); # standard Linux log source (this is the default place for the syslog() # function to send logs to) unix-stream("/dev/log"); # messages from the kernel file("/proc/kmsg" program_override("kernel")); }; # source s_syslog { syslog(ip(127.0.0.1) port(1999) transport("tcp")); }; ######################## # Filters ######################## # Here's come the filter options. With this rules, we can set which # message go where. # messages for eneraptor should have priority level LOG_MAIL and contain keyword "eneraptor" filter f_mail_eneraptor { facility(mail) and match("eneraptor"); }; ###### # destinations destination d_messages { file("/var/log/messages"); }; destination filtered_messages { file("/var/log/messages_filtered"); }; # # SQL logging support # destination d_pgsql { sql(type(pgsql) host("localhost") username("eneraptor") password("eneraptor") database("eneraptordb") table("logs") columns("datetime varchar(16)", "host varchar(32)", "program varchar(8)", "pid varchar(8)", "message varchar(200)") values("$R_DATE", "$HOST", "$PROGRAM", "$PID", "$MSG") indexes("datetime", "host", "program", "pid", "message")); }; log { source(s_local); destination(d_messages); # destination(d_pgsql); }; log { source(s_local); filter(f_mail_eneraptor); destination(filtered_messages); destination(d_pgsql); }; ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ using PostgreSQL 8.4 contents of pg_hba.conf: ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ... # # Database administrative login by UNIX sockets local all all trust # TYPE DATABASE USER CIDR-ADDRESS METHOD # "local" is for Unix domain socket connections only # local all all trust # IPv4 local connections: # host all all 127.0.0.1/32 md5 # IPv6 local connections: host all all ::1/128 md5 # syslog-ng logger # host eneraptordb eneraptor 127.0.0.1/32 trust ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ As far as I understand this configuration file, any user should have full access to any database on local machine. At this point, I am not concerned about security issues as I plan to address them after I resolve logging problem. postgresql.conf: Below are included only lines I uncommented or changed. ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ... listen_addresses = 'localhost' # what IP address(es) to listen on; ... password_encryption = on ... ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ This is the error I get, logged by syslog-ng: *Jan 5 22:00:38 computerName syslog-ng[11080]: Error establishing SQL connection; type='pgsql', host='localhost', port='', username='eneraptor', database='eneraptordb', error='could not connect to server: Connection refused\x0a\x09Is the server running on host "localhost" and accepting\x0a\x09TCP/IP connections on port 0?\x0a'* * * Database has also been created, properly named and has the right user. Message I am trying to log is being sent by test program written in C, line that sends message is (every few seconds): *syslog(LOG_MAIL, "eneraptor test: %d", counter);* >From what I could gather is that syslog-ng probably can't connect to database, but I am running out of options on how to resolve this issue. I would be very grateful if you could help me resolve this issue. Best regards, Janez Barbic

3 4

Re: [syslog-ng] syslog-ng 3.0.8, 3.0.9 not sending logs to centralized log host
by Jarrett Lee 22 Dec '10

22 Dec '10

As I stated before, I ran tcpdump to monitor the network traffic leaving the client system and then attempted to generate some logs, there was no network traffic beyond SSH and some VMware stuff, so I know it wasn't networking, at least not yet, as the syslog-ng client daemon was not even generating network traffic. Anyway, I did figure out the issue. I was editing the wrong conf file, silly me! I was editing /etc/syslog-ng.conf when I should have been editing /opt/syslog-ng/etc/syslog-ng.conf. A coworker showed me this, proving that I had just been staring at the problem for too long to be able to see the answer ;) Thank you for your help guys! It helped us get the gears in our heads moving again! On Dec 21, 2010, at 17:09, Alan McKinnon wrote: > Your config appears correct - I use a similar setup on a wide variety of > logging clients using all sorts of versions of sysloggers. > > So I imagine your problem is more network and less syslog. You don't mention > basic networking tests you might have done, such as can you ping the log host > and can you telnet to the port and get a sensible result? I'd like to > establish that packets can at least go from client to server. And don't forget > to check silly things /etc/hosts - I once had a server listed there with > address 127.0.0.1..... that took an awfully long time to find. [I see your > config implies you send to an ip not a hostname. But still, basic checks are > good.] > > > > Apparently, though unproven, at 00:03 on Wednesday 22 December 2010, Jarrett > Lee did opine thusly: > >> This is the client side that I'm having issues with, not the syslog server, >> or loghost, side. Does it really need network configuration information in >> the source statement? I thought that was on the server side to show it >> which interface/port to listen on for clients. >> >> On Dec 21, 2010, at 16:59, Clayton Dukes wrote: >> >> Looks like you need to define UDP or TCP (or both) in your src statement. >> >> Here's a short (hopefully helpful) link to a video for syslog-ng >> configuration: http://www.logzilla.info/SearchResults.asp?Cat=49 >> >> <http://www.logzilla.info/SearchResults.asp?Cat=49>Full disclosure, >> LogZilla is my log analysis software, but hopefully the video helps. >> >> >> ______________________________________________________________ >> >> Clayton Dukes >> ______________________________________________________________ >> >> >> On Tue, Dec 21, 2010 at 4:43 PM, Jarrett Lee >> <jarrett.lee(a)oversightsystems.com<mailto:jarrett.lee@oversightsystems.com> >>> wrote: I have syslog-ng 3.0.9 (also tried 3.0.8) on a CentOS 5.5 system, >> firewall (iptables) turned off, and SELinux disabled. For some reason it >> refuses to send logs to my log host, though it will put them in my >> messages file. I've even broken out tcpdump to monitor the port while >> generating logs to see if I can see any network traffic generated, but >> it's crickets on the wire. >> >> Anybody have this problem? Is there something I'm missing, perhaps I've >> been looking at it for too long and need fresh eyes? I've had this working >> before on other platforms, Solaris and other distros of Linux, but this >> time it's kicking my butt... >> >> Here's my syslog-ng.conf (with IP and port redacted): >> #### BEGIN syslog-ng.conf #### >> @version: 3.0 >> >> options { >> }; >> >> source src { >> internal(); >> unix-stream("/dev/log"); >> file("/proc/kmsg" program_override("kernel: ")); >> }; >> >> destination local { >> file("/var/log/messages"); >> }; >> destination loghost { >> tcp("IPADDR" port(PORT)); >> }; >> >> log { >> source(src); >> destination(local); >> }; >> log { >> source(src); >> destination(loghost); >> }; >> #### END syslog-ng.conf #### >> >> >> Thanks, >> Jarrett >> >> Jarrett Lee, UNIX Administrator >> OVERSIGHT SYSTEMS | >> www.oversightsystems.com<http://www.oversightsystems.com/> >> __________________________________________________________________________ >> ____ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: >> http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: >> http://www.campin.net/syslog-ng/faq.html >> >> >> ___________________________________________________________________________ >> ___ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: >> http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: >> http://www.campin.net/syslog-ng/faq.html > > -- > alan dot mckinnon at gmail dot com

3 3

syslog-ng 3.0.8, 3.0.9 not sending logs to centralized log host
by Jarrett Lee 21 Dec '10

21 Dec '10

I have syslog-ng 3.0.9 (also tried 3.0.8) on a CentOS 5.5 system, firewall (iptables) turned off, and SELinux disabled. For some reason it refuses to send logs to my log host, though it will put them in my messages file. I've even broken out tcpdump to monitor the port while generating logs to see if I can see any network traffic generated, but it's crickets on the wire. Anybody have this problem? Is there something I'm missing, perhaps I've been looking at it for too long and need fresh eyes? I've had this working before on other platforms, Solaris and other distros of Linux, but this time it's kicking my butt... Here's my syslog-ng.conf (with IP and port redacted): #### BEGIN syslog-ng.conf #### @version: 3.0 options { }; source src { internal(); unix-stream("/dev/log"); file("/proc/kmsg" program_override("kernel: ")); }; destination local { file("/var/log/messages"); }; destination loghost { tcp("IPADDR" port(PORT)); }; log { source(src); destination(local); }; log { source(src); destination(loghost); }; #### END syslog-ng.conf #### Thanks, Jarrett Jarrett Lee, UNIX Administrator OVERSIGHT SYSTEMS | www.oversightsystems.com

2 3

(no subject)
by carl andreasson 19 Dec '10

19 Dec '10

http://www.cookie.purespace.de/rew.html

2 1

Re: [syslog-ng] Newer libtool and autoconf versions?
by Matthew Hall 18 Dec '10

18 Dec '10

They are related only because my issue happened in exactly the same line and I thought it might be nice to fix both at the same time. ;-) Matthew. Sent from my mobile device Corinna Vinschen <vinschen(a)redhat.com> wrote: >On Dec 17 11:00, Matthew Hall wrote: >> On Fri, Dec 17, 2010 at 02:07:51PM +0100, Corinna Vinschen wrote: >> > Here's how you avoid the warning: >> > >> > diff --git a/configure.in b/configure.in >> > index ea671be..0e534f8 100644 >> > --- a/configure.in >> > +++ b/configure.in >> > @@ -156,7 +156,7 @@ AC_PROG_YACC >> > AM_PROG_LEX >> > AC_PROG_MAKE_SET >> > PKG_PROG_PKG_CONFIG >> > -LT_INIT([disable-static]) >> > +LT_INIT([dlopen disable-static]) >> > >> > dnl *************************************************************************** >> > dnl Validate yacc >> > diff --git a/modules/dbparser/Makefile.am b/modules/dbparser/Makefile.am >> > index 2a08c29..76a6cef 100644 >> > --- a/modules/dbparser/Makefile.am >> > +++ b/modules/dbparser/Makefile.am >> > @@ -26,7 +26,7 @@ libdbparser_la_LDFLAGS = -avoid-version -module >> > bin_PROGRAMS = pdbtool >> > pdbtool_SOURCES = pdbtool.c patternize.c patternize.h >> > pdbtool_CPPFLAGS = $(AM_CPPFLAGS) @OPENSSL_CFLAGS@ >> > -pdbtool_LDADD = ../../lib/libsyslog-ng.la libdbparser.la @OPENSSL_LIBS@ @DEPS_LIBS@ >> > +pdbtool_LDADD = ../../lib/libsyslog-ng.la -dlpreopen libdbparser.la @OPENSSL_LIBS@ @DEPS_LIBS@ >> > >> > BUILT_SOURCES = dbparser-grammar.y dbparser-grammar.c dbparser-grammar.h >> > EXTRA_DIST = $(BUILT_SOURCES) radix-find.c dbparser-grammar.ym >> >> Hi Corinna, >> >> Funny you should mention this one. >> >> I had a similar problem here where listing the OpenSSL ahead of listing >> the DEPS_LIBS caused me to pick up the system OpenSSL instead of the >> more updated OpenSSL in the install prefix. >> >> So it seems I'm not the only one who ran into it. >> >> For what it's worth on my end I worked around it using LIBS env var >> which gets subbed into the linker args ahead of where LDFLAGS does so >> your stuff gets put earlier in the search path. > >Hi Matthew, > >I'm sorry, but I don't see how these two items are related. The problem >the above patch is trying to fix is to avoid a warning when linking >against a dlopen module. > > >Corinna > >-- >Corinna Vinschen >Cygwin Project Co-Leader >Red Hat >______________________________________________________________________________ >Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng >FAQ: http://www.campin.net/syslog-ng/faq.html >

1 0