- syslog-ng - lists.balabit.hu

[Bug 98] New: GLIB_MIN_VERSION should be 2.13.5, not 2.10.1
by bugzilla＠bugzilla.balabit.com 03 Dec '10

03 Dec '10

https://bugzilla.balabit.com/show_bug.cgi?id=98 Summary: GLIB_MIN_VERSION should be 2.13.5, not 2.10.1 Product: syslog-ng Version: 3.2.x Platform: PC URL: http://git.gnome.org/browse/glib/tree/NEWS?id=GLIB_2_13_ 5#n27 OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: packaging AssignedTo: folti(a)balabit.hu ReportedBy: owen.mann(a)interactivedata.com Type of the Report: bug Estimated Hours: 0.0 When building on a RHEL5 box (glib2-2.12.3-4.el5_3.1), I get: [...] libtool: link: gcc -std=gnu99 -Wno-pointer-sign -g -O2 -Wall -o .libs/pdbtool pdbtool-pdbtool.o pdbtool-patternize.o -Wl,--export-dynamic ../../lib/.libs/libsyslog-ng.so ./.libs/libdbparser.so -L/usr/kerberos/lib64 -lssl -lcrypto -lz -lrt -lnsl -L/lib64 -lgmodule-2.0 -ldl -lglib-2.0 /usr/lib64/libevtlog.so -Wl,-rpath -Wl,//lib -Wl,-rpath -Wl,//lib/syslog-ng -Wl,-rpath -Wl,/usr/lib64 ./.libs/libdbparser.so: undefined reference to `g_timeout_add_seconds' collect2: ld returned 1 exit status make[5]: *** [pdbtool] Error 1 make[5]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-3.2.1/modules/dbparser' make[4]: *** [all-recursive] Error 1 make[4]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-3.2.1/modules/dbparser' make[3]: *** [all] Error 2 make[3]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-3.2.1/modules/dbparser' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-3.2.1/modules' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-3.2.1' make: *** [all] Error 2 error: Bad exit status from /var/tmp/rpm-tmp.38499 (%build) According to http://git.gnome.org/browse/glib/tree/NEWS?id=GLIB_2_13_5#n27, the `g_timeout_add_seconds' feature was added in GLib 2.13.5 -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

syslog-ng PE benefits
by Zoltán Pallagi 03 Dec '10

03 Dec '10

Hi all, A few months ago, there was a thread about syslog-ng in corporate environment. I've just wrote a blog about the benefits of syslog-ng PE, you can read it on my blog: http://pzolee.blogs.balabit.com/en/2010/12/syslog-ng-pe-behind-the-walls/

1 0

3.2.1 fails build in modules/dbparser w/o -lssl
by Brian A. Seklecki 03 Dec '10

03 Dec '10

[Sorry if this is a dupe; mailing list delays or silent quarntine for non-subscribers] I can provide a full config.log via URL, but here's the quick summary: /bin/ksh ../../libtool --tag=CC --mode=link gcc -std=gnu99 -Wno-pointer-sign -g -O2 -Wall -o pdbtool pdbtool-pdbtool.o pdbtool-patternize.o ../../lib/libsyslog-ng.la libdbparser.la -lrt -Wl,-R/usr/pkg/lib -Wl,--export-dynamic -pthread -L/usr/pkg/lib -lgmodule-2.0 -lglib-2.0 -lintl -Wl,-R/usr/pkg/lib -L/usr/pkg/lib -levtlog -lresolv libtool: link: gcc -std=gnu99 -Wno-pointer-sign -g -O2 -Wall -o .libs/pdbtool pdbtool-pdbtool.o pdbtool-patternize.o -Wl,-R/usr/pkg/lib -Wl,--export-dynamic -pthread -Wl,-R/usr/pkg/lib ../../lib/.libs/libsyslog-ng.so -L/usr/pkg/lib ./.libs/libdbparser.so /root/syslog-ng-3.2.1/lib/.libs/libsyslog-ng.so -lrt /usr/pkg/lib/libgmodule-2.0.so /usr/pkg/lib/libglib-2.0.so /usr/pkg/lib/libpcre.so -lintl /usr/pkg/lib/libevtlog.so -lresolv -pthread -Wl,-rpath -Wl,/usr/pkg/lib -Wl,-rpath -Wl,/usr/pkg/lib/syslog-ng pdbtool-patternize.o: In function `uuid_gen_random': /root/syslog-ng-3.2.1/modules/dbparser/patternize.c:67: undefined reference to `RAND_bytes' gmake[2]: *** [pdbtool] Error 1 gmake[2]: Leaving directory `/root/syslog-ng-3.2.1/modules/dbparser' gmake[1]: *** [all-recursive] Error 1 gmake[1]: Leaving directory `/root/syslog-ng-3.2.1/modules/dbparser' gmake: *** [all] Error 2 Appending "-lssl" to the automake/libtool command makes it work fine. NetBSD metrotitan 5.99.39 NetBSD 5.99.39 (METROTITAN-$Revision: 1.993 $) #0: Wed Oct 6 13:26:31 EDT 2010 root@metrotitan:/usr/obj/sys/arch/i386/compile/METROTITAN i386 bash-4.1# openssl version OpenSSL 1.1.0-dev 10 Jul 2009 I'm doing this outside of Pkgsrc, so its possibly my fault. ~BAS

2 1

--libdir misbehaves
by Matthew Hall 02 Dec '10

02 Dec '10

I'm compiling syslog-ng 3.2 beta 1. I'm going to update to 3.2 release briefly, maybe it's fixed in there? Even though I used: --libdir=/home/opt/lib64 The syslog-ng plugins are still going into lib. I can't make an internal package of the app to use here until I figure out how to fix it. The files in question are: /home/opt/lib/syslog-ng /home/opt/lib/syslog-ng/libafsocket-tls.la /home/opt/lib/syslog-ng/libafprog.la /home/opt/lib/syslog-ng/libaffile.la /home/opt/lib/syslog-ng/libaffile.so /home/opt/lib/syslog-ng/libpacctformat.so /home/opt/lib/syslog-ng/libsyslogformat.so /home/opt/lib/syslog-ng/libafsql.so /home/opt/lib/syslog-ng/libbasicfuncs.so /home/opt/lib/syslog-ng/libafsocket.so /home/opt/lib/syslog-ng/libafsocket-notls.la /home/opt/lib/syslog-ng/libdbparser.la /home/opt/lib/syslog-ng/libafuser.la /home/opt/lib/syslog-ng/libconvertfuncs.la /home/opt/lib/syslog-ng/libbasicfuncs.la /home/opt/lib/syslog-ng/libcsvparser.la /home/opt/lib/syslog-ng/libafprog.so /home/opt/lib/syslog-ng/libafsql.la /home/opt/lib/syslog-ng/libpacctformat.la /home/opt/lib/syslog-ng/libafsocket-tls.so /home/opt/lib/syslog-ng/libdbparser.so /home/opt/lib/syslog-ng/libdummy.la /home/opt/lib/syslog-ng/libcsvparser.so /home/opt/lib/syslog-ng/libconvertfuncs.so /home/opt/lib/syslog-ng/libafsocket-notls.so /home/opt/lib/syslog-ng/libconfgen.so /home/opt/lib/syslog-ng/libafuser.so /home/opt/lib/syslog-ng/libsyslogformat.la /home/opt/lib/syslog-ng/libconfgen.la /home/opt/lib/syslog-ng/libdummy.so

2 4

Extra Lines Truncated
by Ian Lesperance 02 Dec '10

02 Dec '10

When logging multiline messages (simple strings with in-line newlines) our logs only show the first line. Everything after the first newline character is gone. We're on 3.0.5 and we don't seem to be using the no_multi_line option anywhere. What else could explain this behavior? Ian

4 5

hostname incorrect after upgrade to 3.1.2
by w3euu 01 Dec '10

01 Dec '10

I have used syslog-ng for many years and have been a faithful reader of the mailing list, but do not believe I have ever had occasion to post. Thank you for an excellent product and for the great support you have provided. I have always been able to solve problems by reading the archives...until now. I just completed an upgrade from source on several (6) systems from syslog-ng 3.1.1 (OSE) to 3.1.2 and then 3.1.3. All of them went smoothly, without error. However, after the upgrade to 3.1.2, one of the systems began reporting the hostname as "localhost" rather than the correct host name. The problem persisted when I upgraded to 3.1.3. When I roll it back to 3.1.1 it reports the hostname correctly. All of the systmes are fedora. Some are fc13, some are fc14. The system that failed is fc14. It is forwarding its logs to a central logger via tcp. I have checked the following: hosts file is OK. Contains only 127.0.0.1 entry as localhost dig -x returns the correct hostname hostname returns the correct hostname tcpdump confirms that syslog-ng is reporting "localhost" I was unable to correct the problem by changing global options. Global options are: options { flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); check_hostname(yes); chain_hostnames(no); keep_hostname (no); stats_freq (43200); mark_freq (1200); keep_timestamp (no); # send_time_zone (-04:00); }; I have googled but have not found anything that seemed relavant. Not sure how to procede to correct this situation. Any ideas would be appreciated. I would be happy to post additional data that will help.

2 6

Syslog-Ng on NetBSD after GSoC changes for RFC5424 Changes
by Brian A. Seklecki 01 Dec '10

01 Dec '10

For the sake of the mailing list archives / google searches, the following flags() argument is needed to parse the new message format from local socket: source src { unix-dgram("/var/run/log" flags(syslog-protocol) ); unix-dgram("/var/run/logpriv" perm(0600)); internal(); file("/dev/klog"); }; Also, syslog-ng v. 3 or greater is needed (1.6x in pkgsrc, 2.x in pkgsrc-wip) If/when Other*BSD imports the IETF syslog support, the same will be true there. ~BAS

1 0

New syslog-ng poll: how many platforms do you use?
by Robert Fekete 30 Nov '10

30 Nov '10

Continuing our survey to get a picture about how you use syslog-ng, our next poll is online. The question is, how many different platforms do you use syslog-ng on? Please count every distribution or architecture separately. For example, if you are running syslog-ng on 200 identical servers that all run the 64-bit version of RHEL 5, that's only a single platform. If you are using both the 32-bit and 64-bit version of the same distro, that's two platforms. If you have a mix of RHEL 4, 5, 6 servers and have 32-bit and 64-bit versions of each, that's already 6 platforms, and so on. You find the poll at <a href="http://www.balabit.com/poll/ syslog_ng_platforms">http://www.balabit.com/poll/syslog_ng_platforms</ a> The results of the <a href="http://www.balabit.com/poll/ syslog_ng_admin_guide">latest poll</a> show that the vast majority of you use the PDF version of the syslog-ng admin guide - I suspected this, but haven't thought that the HTML versions will lag behind so badly. Though if I have some time, I'll compare this to the download statistics. Thanks for voting!

1 0

providing Windows Event Viewer logs into syslog
by Oguz Yilmaz 30 Nov '10

30 Nov '10

Hi, I wanted to start a thread to see alternatives for providing Windows logs into a linux based syslog server. I would be grateful to see my alternatives, as free software as propriatery software. Regards, -- Oguz YILMAZ

3 2

syslog-ng 3.1.3 has been released
by devel＠balabit.hu 30 Nov '10

30 Nov '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.1.3 SUMMARY : new stable release DATE : Nov 26, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.1.3) has been released. For latest fixes in the 3.1.x feature branch you are recommended to upgrade to this version. CHANGES: 3.1.3 Thu, 18 Nov 2010 07:50:42 +0100 Bugfixes: * csv-parser() defaults to "escape-none" mode even if it is not specified. * Fixed a possible CPU spinning in case mark_freq() is changed from a non-zero value to zero and syslog-ng is reloaded. * Fixed a flow control problem for the internal() source possibly causing an assertion to fail, e.g. syslog-ng to crash voluntarily. * Make it possible to use a literal '$' character by using two of them. * Make it possible to use binary characters within strings in configuration files by using a C-like \xHH, \oOOO syntax. * Attempt to flush the messages sitting in output queues a bit harder at shutdown. * Handle ESTALE errors in the file source for NFS file systems, which might cause a spin on the CPU otherwise. * Fixed a possible use-after-free problem potentially causing crashes or misbehaviour. No concrete errors were reported though. * The SQL driver didn't honour the port() option, this was fixed. * Fixed program_override() option, previously it overrode the hostname instead because of a typo. * Accept 3.1 as configuration version, previously it only accepted 3.0. * Fixed internal() message loop detection in case an error happened on the log writer flush path. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

3 3

chained hostnames format broken in v3.1.2?
by Paul Krizak 30 Nov '10

30 Nov '10

Hi, all. Hopefully this is a quick and easy one -- I am working on upgrading our grid from syslog-ng 2.1.4 to 3.1.2. But it looks like chained hostnames are broken now. Here's what a typical message looked like in 2.1.4: Nov 19 12:24:58 s_internal@svvspd02 syslog-ng[4083]: syslog-ng starting up; version='2.1.4' And in v3, it now looks like this: Nov 22 09:17:39 s_self@svvspd02@F<D5> ^G syslog-ng[2527]: syslog-ng starting up; version='3.1.2' Notice the stray characters after the hostname (this is pasted from 'less' so the nonprintable chars have been expanded). This looks suspiciously like a strcpy() gone awry -- like a NULL didn't get tacked onto the end of the hostname when the chained hostname string was built up. Is this a known bug? If so, is there a patch posted in git that I can pull down and rebuild? Thanks! -- Paul Krizak 7171 Southwest Pkwy MS B200.3A MTS Systems Engineer Austin, TX 78735 Advanced Micro Devices Desk: (512) 602-8775 Linux/Unix Systems Engineering Cell: (512) 791-0686 Global IT Infrastructure Fax: (512) 602-0468

3 7

Bazsi's blog: syslog-ng 3.2.1 released
by Balazs Scheidler 30 Nov '10

30 Nov '10

syslog-ng 3.2.1 released Hi, After 2 alpha and a beta release I’ve decided to declare that syslog-ng OSE 3.2 is now stable, and thus I’ve released 3.2.1, the first in the 3.2.x series. This version has the largest list of features even since the syslog-ng project was born, so make sure you check out all the goodies. The key features were already covered on this blog in earlier posts, the most important ones in my opinion are: * licensing change to LGPL/GPL combo, without the need to sign a contributory agreement * plugins * log message correllation support in db-parser * automatic pattern generation for existing log files with pdbtool patternize * template functions Read the changelog and/or the documentation for more information. The diffstat between 3.1 and 3.2 are quite big: 407 files changed, 50305 insertions(+), 36487 deletions(-) Considering that OSE 3.2 has 70k lines (more specifically 70163) in its git repository, this is quite a lot. Source code: https://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.2.1… The list of changes are summarised in the changelog here: https://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.2.1… The updated documentation is also available here: https://www.balabit.com/support/documentation/documents/syslog-ng-ose-v3.2-… Happy logging!

2 2

unable to setup syslog-ng for log monitoring
by Supratik Goswami 30 Nov '10

30 Nov '10

Hi I am using syslog-ng 3.0 and I am trying to monitor log files. If there is word "attackalert" found in the log file syslog-ng should invoke a script. I created "/root/workspace/test" a bash script only with a simple echo statement to check if it is working correctly or not. The problem is whenever I start syslog-ng the script starts executing even if the word "attackalert" is not recorded. The following is my syslog-ng.conf configuration. Is there anything I am missing here ? Please advice. options { flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_file { file("/root/workspace/app_desktop/sup.log.php");}; destination d_prog { program("/root/workspace/test"); }; filter f_attack_alert { match("attackalert" value("MESSAGE")); }; log { source(s_file); filter(f_attack_alert); destination(d_prog); }; -- Warm Regards Supratik

3 3

configuring a redis syslog-ng destination
by Jacob Vorreuter 27 Nov '10

27 Nov '10

I'd like to configure syslog-ng to send logs to redis via a unix socket. This would require implementing the redis protocol as a template or rewrite rule. The only trick is getting the size in bytes of the message being processed. Is there a macro for this or some other way of determining message size? The protocol would look like this (pretending there existed a macro, MSG_SIZE): *3 (number of arguments) $5 (size in bytes of argument 1) RPUSH (operation) $4 (size in bytes of argument 2) logs (key) $${MSG_SIZE} (size in bytes of argument 3) $MSG (value) or as a string: *3\r\n$5\r\nRPUSH\r\n$4\r\nlogs\r\n$${MSG_SIZE}\r\n$MSG\r\n and finally as a destination with template: destination d_redis { unix-stream("/tmp/redis.sock") template("*3\r\n$5\r\nRPUSH\r\n$4\r\nlogs\r\n$${MSG_SIZE}\r\n$MSG\r\n"); }; Does anyone have suggestions of how to accomplish this? Thanks, Jake

3 2

please help spread the word about syslog-ng
by Balazs Scheidler 26 Nov '10

26 Nov '10

Dear syslog-ng users, You probably know that the motivation behind free software development is in most cases the joy of seeing the use of our work by others. The feedback you can give us and all the information you share about your affair with syslog-ng. I'm watching google alerts, reading blog posts where syslog-ng is mentioned, because that's the fuel that keeps me going. You probably know that running a commercial company and still keeping an open source project alive has a lot of conflicts. It is a tricky business to balance the needs of the community and the interests of an enterprise. We may have made our mistakes in the past but we are really trying to learn. (see my blog posts [1] and LWN articles [2] on the topic). One thing is sure: syslog-ng wouldn't be the thing it is today without your support, ideas and your _use_ of syslog-ng. In this spirit, I'd like to ask your involvement: 1) provide feedback, either positive/negative, on this list, or on my blog or even in private email. 2) please help spread the word on syslog-ng, tell the world how and why you are using it. If I get asked what my profession is, I always get into trouble. Some times I'm a developer, sometimes I'm a manager here at BalaBit, other times I'm just a system administrator. But I'm not really good at words and I definitely have less than enough time to advocate syslog-ng. So please help me in this regard. The easiest way is to put the "I love syslog-ng" badge on your blog or website. [3] Somewhat more time is needed to produce a blog post or a FAQ entry. If you ever spared a cent on using syslog-ng instead of something else, please contribute back. Thanks. It is appreciated. [1] http://bazsi.blogs.balabit.com/2010/08/syslog_ng_and_open_core_why_we_think… [2] http://lwn.net/Articles/402298/ [3] http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… -- Bazsi

1 0

3.2 beta 1 configure script help typo
by Matthew Hall 26 Nov '10

26 Nov '10

The following text appears in the ./configure --help output: --with-pidfile-dir=path Use path as the directory for storing pidfiles --with-module-dir=path Use path as the directory for storing pidfiles Having both of these seems either redundant, or incorrect. Or they are different but it's not clearly explained. Either way, probably worth fixing before final 3.2 is released. Matthew.

2 1

syslog-ng 3.0.9 has been released
by devel＠balabit.hu 26 Nov '10

26 Nov '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.0.9 SUMMARY : new stable release DATE : Nov 26, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.0.9) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.9 Thu, 18 Nov 2010 06:43:49 +0100 Bugfixes: * csv-parser() defaults to "escape-none" mode even if it is not specified. * Fixed a possible CPU spinning in case mark_freq() is changed from a non-zero value to zero and syslog-ng is reloaded. * Fixed a flow control problem for the internal() source possibly causing an assertion to fail, e.g. syslog-ng to crash voluntarily. * Make it possible to use a literal '$' character by using two of them. * Make it possible to use binary characters within strings in configuration files by using a C-like \xHH, \oOOO syntax. * Attempt to flush the messages sitting in output queues a bit harder at shutdown. * Handle ESTALE errors in the file source for NFS file systems, which might cause a spin on the CPU otherwise. * Fixed a possible use-after-free problem potentially causing crashes or misbehaviour. No concrete errors were reported though. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system…

1 0

non syslog files
by maillists0＠gmail.com 22 Nov '10

22 Nov '10

I have some homegrown application logs that are not in syslog format. I want to have syslog-ng tail those files and forward them to a syslog server (well, really a Splunk server.) In this case, does syslog-ng care what format the file is in? If so, is there a way around it?

2 1

use_fqdn()
by Brian A. Seklecki 22 Nov '10

22 Nov '10

Quick question: How does use_fqdn() interact with the various HOST, HOST_FROM, FULLHOST, FULLHOST_FROM? My understanding is that $FULLHOST and $FULLHOST_FROM are the only ones that will include the FQDN. Does use_fqdn() override that? Is the ideal config to have use_fqdn(yes) + use_dns(yes) + keep_hostname(no) and set $FULLHOST_FROM or $FULLHOST everywhere you want a FQDN so long as DNS is there? That doesnt seem to be working for me, use_fqdn(no) just kills all FQDNs everywhere regardless of $HOST* variable. I'm running the latest 2.x because I suck so much; maybe this is fixed in 3.x Thanks, ~BAS

2 3

Syslog-ng error
by Rakesh Pillai 22 Nov '10

22 Nov '10

Hi, I am trying to compile syslog-ng-2.1.3 using the --enable-static-linking option in the cnfigure part. But, while trying to do the make , I get the below error. /usr/lib/gcc/s390x-redhat-linux/4.1.2/../../../../lib64/libwrap.a(options.o): In function `group_option': (.text+0x85a): warning: Using 'endgrent' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking libsyslog-ng.a(misc.o): In function `resolve_user': /tmp/TEST/WORK/syslog-ng-2.1.3/src/misc.c:258: warning: Using 'getpwnam' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/local/lib/libglib-2.0.a(gutils.o): In function `g_get_any_init_do': /tmp/TEST/WORK/glib-2.16.5/glib/gutils.c:1645: warning: Using 'getpwuid' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /tmp/TEST/WORK/glib-2.16.5/glib/gutils.c:1644: warning: Using 'setpwent' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /tmp/TEST/WORK/glib-2.16.5/glib/gutils.c:1646: warning: Using 'endpwent' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /tmp/TEST/WORK/glib-2.16.5/glib/gutils.c:1588: warning: Using 'getpwnam_r' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /tmp/TEST/WORK/glib-2.16.5/glib/gutils.c:1591: warning: Using 'getpwuid_r' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking libsyslog-ng.a(afinet.o): In function `afinet_resolve_name': /tmp/TEST/WORK/syslog-ng-2.1.3/src/afinet.c:103: warning: Using 'getaddrinfo' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking libsyslog-ng.a(misc.o): In function `resolve_hostname': /tmp/TEST/WORK/syslog-ng-2.1.3/src/misc.c:166: warning: Using 'gethostbyaddr' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking Can you please help me out here. Regards, Rakesh. CSC • This is a PRIVATE message. If you are not the intended recipient, please delete without copying and kindly advise us by e-mail of the mistake in delivery. NOTE: Regardless of content, this e-mail shall not operate to bind CSC to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of e-mail for such purpose • Computer Sciences Corporation India Pvt Ltd • 7th, Floor, Block 1B, DLF IT Park, Sivaji Garden, Nandambakkam Post, Ramapuram, Chennai-600 089.

2 3

log sample collecting project
by Peter Czanik 19 Nov '10

19 Nov '10

Hello, As part of the patterndb project, we plan to start a log sample collecting project. At http://czanik.blogs.balabit.com/2010/11/log-sample-collecting-project/ you can read a document, which describes it. It has three main parts: 1. background / what is it good for 2. methods 3. technical requirements It still has some "FIXME" parts in it, but already enough to get started. Please let us know what you think about it, if you have any questions, miss any information, etc.! Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

2 2

Re: [syslog-ng] Better performance between udp, unix-stream or pipe ?
by Matthew Hall 18 Nov '10

18 Nov '10

As a connectionless protocol UDP cannot always detect existing listeners on all platforms. However if you think about it it's clear why this wouldn't work. How would it know which messages should be parse or noparse? It can't read your mind! ;) Matthew. Sent from my mobile device "Yann I." <yann.frm(a)gmail.com> wrote: >> >> Does this work? >> >> source s_udp_not_parsed { udp(port(514) flags(no-parse)); }; >> source s_udp { udp(port(514)); }; >> >> (...) >> >> >I tried that solution few days ago and it didn't work. Two processes >"syslog-ng" listened on port UDP/514 : the messages are not handled >correctly. They would be handled by "s_udp_not_parsed" or "s_udp". > >nb : it's strange that two processes can listen on the same port (for the >protocol UDP) isn't it ? This is the same behaviour with "netcat". I tried >with netcat (example : nc -l -u 1234) and I have two processes which listen >the port UDP/1234. Messages send by "nc" on the port 1234 are received by >the last "netcat" which has been started. > > >For passing yourself back the reparsed message I would recommend >> unix-dgram. AF_UNIX is usually better than pipes for me at least. >> > >Thank you ! I'll use AF_UNIX. > >Regards, > >Yann I. > > >2010/11/16 Matthew Hall <mhall(a)mhcomputing.net> > >> For passing yourself back the reparsed message I would recommend >> unix-dgram. AF_UNIX is usually better than pipes for me at least. >> >> Matthew. >> >> On Tue, Nov 16, 2010 at 12:14:53PM -0600, Martin Holste wrote: >> > Does this work? >> > >> > source s_udp_not_parsed { udp(port(514) flags(no-parse)); }; >> > source s_udp { udp(port(514)); }; >> > >> > log { >> > source(s_udp); >> > parser(db-parser()); >> > destination(d_parsed); >> > }; >> > log { >> > source(s_udp_not_parsed); >> > destination(d_not_parsed); >> > }; >> > >> > Otherwise, try reassembling a no-parse like message with a different >> > output template. >> > >> > On Tue, Nov 16, 2010 at 11:13 AM, Yann I. <yann.frm(a)gmail.com> wrote: >> > > Well I'm not sure because of the flag I used for the UDP source which >> is set >> > > to "no-parse". >> > > >> > > Here is my problem. From the UDP source, I may receive logs which are >> not >> > > "syslog compliance". So I'm using the flag 'no-parse' then I rewrite >> the >> > > message. After that rewrite, I forward the new message to the same >> syslog-ng >> > > server. >> > > Then... I can apply filter, parser, etc on that new message which is >> now >> > > "syslog compliance" :-) >> > > >> > > So, I think I can't use log statement. I need to use that mecanism... >> > > There might be another solution but this one seems to be a good >> solution. >> > > >> > > >> > > 2010/11/16 Martin Holste <mcholste(a)gmail.com> >> > >> >> > >> Ok, then this should be accomplished with a standard log statement >> > >> like you've already begun to write. What do your destinations look >> > >> like? >> > >> >> > >> On Tue, Nov 16, 2010 at 10:58 AM, Yann I. <yann.frm(a)gmail.com> wrote: >> > >> > In fact, this is the same process... There is only one process. >> > >> > >> > >> > >> > >> > 2010/11/16 Martin Holste <mcholste(a)gmail.com> >> > >> >> >> > >> >> Why do you need separate syslog-ng processes running? >> > >> >> >> > >> >> On Tue, Nov 16, 2010 at 10:49 AM, Yann I. <yann.frm(a)gmail.com> >> wrote: >> > >> >> > Hi ! >> > >> >> > >> > >> >> > I have a question about the use of udp, unix-stream or pipe. I >> would >> > >> >> > like to >> > >> >> > forward a syslog message to the same syslog server like this : >> > >> >> > >> > >> >> > | log { >> > >> >> > | source (s_r_udp); (<-- listen on UDP/514) >> > >> >> > | >> > >> >> > | filter (....); >> > >> >> > | filter (....); >> > >> >> > | parser (...); >> > >> >> > | >> > >> >> > | destination (d_local_syslog); (<-- send the message to a >> local >> > >> >> > syslog >> > >> >> > by using unix-stream, udp or pipe mecanism) >> > >> >> > | }; >> > >> >> > >> > >> >> > (...) >> > >> >> > >> > >> >> > | log { >> > >> >> > | source (s_local_syslog); (<--- here I receive the >> messages >> > >> >> > sent >> > >> >> > by >> > >> >> > the "d_syslog_loop") >> > >> >> > | >> > >> >> > | filter (...); >> > >> >> > | filter (...); >> > >> >> > | parser (...); >> > >> >> > | >> > >> >> > | destination (d_remote_syslog); >> > >> >> > >> > >> >> > I'm looking for the better way to send syslog message to the same >> > >> >> > syslog >> > >> >> > server : which mecanism provides the better performances : pipe, >> udp >> > >> >> > (by >> > >> >> > using network) or unix-stream ? >> > >> >> > Maybe the "pipe" is the better solution ?... >> > >> >> > >> > >> >> > I'm using the syslog-ng OSE 3.1.2 on CentOS. >> > >> >> > >> > >> >> > Regards, >> > >> >> > >> > >> >> > Yann I. >> > >> >> > >> > >> >> > >> > >> >> > >> > >> >> > >> ______________________________________________________________________________ >> > >> >> > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> > >> >> > Documentation: >> > >> >> > http://www.balabit.com/support/documentation/?product=syslog-ng >> > >> >> > FAQ: http://www.campin.net/syslog-ng/faq.html >> > >> >> > >> > >> >> > >> > >> >> > >> > >> >> >> > >> >> >> > >> >> >> ______________________________________________________________________________ >> > >> >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> > >> >> Documentation: >> > >> >> http://www.balabit.com/support/documentation/?product=syslog-ng >> > >> >> FAQ: http://www.campin.net/syslog-ng/faq.html >> > >> >> >> > >> > >> > >> > >> > >> >> > >> >> ______________________________________________________________________________ >> > >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> > >> Documentation: >> > >> http://www.balabit.com/support/documentation/?product=syslog-ng >> > >> FAQ: http://www.campin.net/syslog-ng/faq.html >> > >> >> > > >> > > >> > >> ______________________________________________________________________________ >> > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> > Documentation: >> http://www.balabit.com/support/documentation/?product=syslog-ng >> > FAQ: http://www.campin.net/syslog-ng/faq.html >> > >>

2 3

syslog-ng Open Source Edition 3.2 Administrator Guide – First Edition
by Fekete Robert 18 Nov '10

18 Nov '10

Hi, The administrator guide for version 3.2 of syslog-ng OSE is available at the BalaBit Documentation Page at http://www.balabit.com/support/documentation/?product_line=46&product_t…. Actually, it is mostly the same as the latest draft, except that I incorporated Bazsi's comments and corrected some minor typos and errors. The main new features of syslog-ng OSE 3.2 are listed in the 'Summary of changes' section of the guide (http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.2-gui…) As always, comments and other feedback is greatly appreciated. Regards, Robert

1 0

Syslog-ng not receiving messages
by keshava Veerabhadraiah 18 Nov '10

18 Nov '10

Hi I am new to syslog-ng and I have gone through other post to see if I can get a resolution to my problem. Syslog is not writing to the destination file any messages received on udp() or tcp(). I have made sure that syslog server is receiving the syslog messages as seen from the tcpdump 15:09:55.422423 IP 10.140.141.6.syslog > aspsyslog.sungardebs.com.syslog: SYSLOG local4.warning, length: 153 15:09:55.434638 IP 10.140.141.6.syslog > aspsyslog.sungardebs.com.syslog: SYSLOG local4.info, length: 184 15:09:55.470383 IP 10.140.141.6.syslog > aspsyslog.sungardebs.com.syslog: SYSLOG local4.info, length: 176 15:09:55.473519 IP 10.140.141.6.syslog > aspsyslog.sungardebs.com.syslog: SYSLOG local4.info, length: 190 15:09:55.493361 IP 10.140.141.6.syslog > aspsyslog.sungardebs.com.syslog: SYSLOG local4.info, length: 180 15:09:55.493748 IP aspsyslog.sungardebs.com.ssh > nim.sungardebs.com.42703: P 128608:129696(1088) ack 289 win 461 <nop,nop,timestamp 88706531 1310848493> 15:09:55.495519 IP 10.140.141.9.syslog > aspsyslog.sungardebs.com.syslog: SYSLOG local4.info, length: 188 15:09:55.495548 IP 10.140.141.9.syslog > aspsyslog.sungardebs.com.syslog: SYSLOG local4.debug, length: 90 15:09:55.495556 IP 10.140.141.9.syslog > aspsyslog.sungardebs.com.syslog: SYSLOG local4.debug, length: 85 15:09:55.521115 IP 10.140.141.6.syslog > aspsyslog.sungardebs.com.syslog: SYSLOG local4.debug, length: 87 15:09:55.521188 IP 10.140.141.6.syslog > aspsyslog.sungardebs.com.syslog: SYSLOG local4.info, length: 188 15:09:55.522041 IP 10.140.141.6.syslog > aspsyslog.sungardebs.com.syslog: SYSLOG local4.info, length: 175 15:09:55.522212 IP 10.140.141.7.syslog > aspsyslog.sungardebs.com.syslog: SYSLOG local4.info, length: 164 Here is how my syslog-ng config looks. @version: 3.0 #Default configuration file for syslog-ng. # # For a description of syslog-ng configuration file directives, please read # the syslog-ng Administrator's guide at: # # http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/bk01-toc.html # options { chain_hostnames(no); create_dirs (no); dir_perm(0755); dns_cache(no); keep_hostname(yes); log_fifo_size(2048); log_msg_size(1024); log_iw_size (500); long_hostnames(on); perm(0644); stats_freq(3600); flush_lines(100); time_reopen (10); use_dns(no); use_fqdn(yes); # max_connections(100); }; source s_all { udp(so_rcvbuf(2048576)); tcp(); unix-stream("/dev/log"); internal(); file("/proc/kmsg"); }; destination d_file_normal {file("/var/log/messages_syslog-ng.log"); }; log { source(s_all); destination (d_file_normal); }; Any help would be greatly appreciated. Thanks

7 16

Better performance between udp, unix-stream or pipe ?
by Yann I. 17 Nov '10

17 Nov '10

Hi ! I have a question about the use of udp, unix-stream or pipe. I would like to forward a syslog message to the same syslog server like this : | log { | source (s_r_udp); (<-- listen on UDP/514) | | filter (....); | filter (....); | parser (...); | | destination (d_local_syslog); (<-- send the message to a local syslog by using unix-stream, udp or pipe mecanism) | }; (...) | log { | source (s_local_syslog); (<--- here I receive the messages sent by the "d_syslog_loop") | | filter (...); | filter (...); | parser (...); | | destination (d_remote_syslog); I'm looking for the better way to send syslog message to the same syslog server : which mecanism provides the better performances : pipe, udp (by using network) or unix-stream ? Maybe the "pipe" is the better solution ?... I'm using the syslog-ng OSE 3.1.2 on CentOS. Regards, Yann I.

3 7