- syslog-ng - lists.balabit.hu

Re: [syslog-ng] syslog-ng Digest, Vol 60, Issue 31
by filip.nollet＠bayercropscience.com 26 Apr '10

26 Apr '10

Hi again First of all, I already used syslog-ng before, but I had no idea it was doing parsing, so this is normal :p I changed my configuration to use the no_parse function in the source driver of the webserver on which the syslog-ng client forwards the messages to the syslog server. This does the trick. I don't even have to change the configuration on the target syslog server which greatly reduces configuration file changes. Thx for the answer! Filip > Hi, > > > I have a weird problem with syslog-ng. I am setting up a syslog-ng > client on an Apache server which forward both access and error log > to a central syslog-ng server. > > First of all please note that you're trying to deal with > non-standard-compliant messages. syslog-ng tries to parse the incoming > log lines trying various known syslog formats. > > > The access log on the source has entries like this: > > 10.3.154.20 - - [23/Apr/2010:13:55:25 +0200] "GET /images/userLo... > > and this becomes like this on the syslog server: > > servername 10.3.154.20: - - [23/Apr/2010:13:55:25 +0200] "GET /images/use > > The first syslog-ng (which receives the apache log) parses the line. > There is no syslog header found so it falls back to the legacy format. > There is neither priority code nor timestamp so the IP address becomes > the program name. That's why you see it logger on the second server. > > > All ok with this one, but with the error log I get this on the webserver: > > [Fri Apr 23 13:55:25 2010] [error] [client 10.3.154.20] File doe... > > but this on the syslog server: > > servername Apr 23 13:55:25 2010] [error] [client 10.3.154.20] File do... > > > > Where is the [ character at the beginning of the timestamp gone????? > > As above, this line isn't a syslog message at all. From syslog's > perspective it's more or less random junk. The trailing '[' causes > that there is no program name at all and the parser thinks the > following string up to the closing ']' is the pid like in normal logs > eg. programname[pid] > > I don't see how could this "pid" appear on the receiving side with > only the closing brace. Please show your configs and the captured > network packet too. > > In general when an app doesn't speak syslog formats and there is no > option to format its logs properly then using the no-parse option (on > all syslog-ng servers the log passes through) or writing a small app > which reformats the logs and feeds to syslog-ng is the way to go. > > Regards, > > Sandor > ________________________________________________________________________ The information contained in this e-mail is for the exclusive use of the intended recipient(s) and may be confidential, proprietary, and/or legally privileged. Inadvertent disclosure of this message does not constitute a waiver of any privilege. If you receive this message in error, please do not directly or indirectly use, print, copy, forward, or disclose any part of this message. Please also delete this e-mail and all copies and notify the sender. Thank you. For alternate languages please go to http://bayerdisclaimer.bayerweb.com ________________________________________________________________________

1 0

syslog-ng 3.1.1 "cuts" of the first charater of the Apache error log when forwarding
by filip.nollet＠bayercropscience.com 23 Apr '10

23 Apr '10

Hi all I have a weird problem with syslog-ng. I am setting up a syslog-ng client on an Apache server which forward both access and error log to a central syslog-ng server. The access log on the source has entries like this: 10.3.154.20 - - [23/Apr/2010:13:55:25 +0200] "GET /images/userLo... and this becomes like this on the syslog server: servername 10.3.154.20: - - [23/Apr/2010:13:55:25 +0200] "GET /images/use All ok with this one, but with the error log I get this on the webserver: [Fri Apr 23 13:55:25 2010] [error] [client 10.3.154.20] File doe... but this on the syslog server: servername Apr 23 13:55:25 2010] [error] [client 10.3.154.20] File do... Where is the [ character at the beginning of the timestamp gone????? Both logs use the same type configuration; I have double checked everything, but I have no clue why syslog-ng(?) does this... In wireshark the receiving syslog server is receiving it like this, so it is send like this by syslog-ng on the source server. Any idea? Met vriendelijke groeten / Cordialement / Freundliche Grüße / Best Regards Filip Nollet Bio Information System Administrator _______________________ Bayer BioScience N.V. Bio Information Management - A&S Technologiepark 38 9052 Zwijnaarde Phone: +32-9.243.04.28 Fax: +32-9.224.06.94 E-mail: filip.nollet(a)bayercropscience.com ________________________________________________________________________ The information contained in this e-mail is for the exclusive use of the intended recipient(s) and may be confidential, proprietary, and/or legally privileged. Inadvertent disclosure of this message does not constitute a waiver of any privilege. If you receive this message in error, please do not directly or indirectly use, print, copy, forward, or disclose any part of this message. Please also delete this e-mail and all copies and notify the sender. Thank you. For alternate languages please go to http://bayerdisclaimer.bayerweb.com ________________________________________________________________________

2 1

When forwarding apache error_log the first character ([) of each message is removed
by filip.nollet＠bayercropscience.com 23 Apr '10

23 Apr '10

Hi all I have a weird problem with syslog-ng. I am setting up a syslog-ng client on an Apache server which forward both access and error log to a central syslog-ng server. The access log on the source has entries like this: 10.3.154.20 - - [23/Apr/2010:13:55:25 +0200] "GET /images/userLo... and this becomes like this on the syslog server: servername 10.3.154.20: - - [23/Apr/2010:13:55:25 +0200] "GET /images/use All ok with this one, but with the error log I get this on the webserver: [Fri Apr 23 13:55:25 2010] [error] [client 10.3.154.20] File doe... but this on the syslog server: servername Apr 23 13:55:25 2010] [error] [client 10.3.154.20] File do... Where is the [ character at the beginning of the timestamp gone????? Both logs use the same type configuration; I have double checked everything, but I have no clue why syslog-ng(?) does this... In wireshark the receiving syslog server is receiving it like this, so it is send like this by syslog-ng on the source server. Any idea? Met vriendelijke groeten / Cordialement / Freundliche Grüße / Best Regards Filip Nollet ________________________________________________________________________ The information contained in this e-mail is for the exclusive use of the intended recipient(s) and may be confidential, proprietary, and/or legally privileged. Inadvertent disclosure of this message does not constitute a waiver of any privilege. If you receive this message in error, please do not directly or indirectly use, print, copy, forward, or disclose any part of this message. Please also delete this e-mail and all copies and notify the sender. Thank you. For alternate languages please go to http://bayerdisclaimer.bayerweb.com ________________________________________________________________________

1 0

Process stored logs
by noel anderson 22 Apr '10

22 Apr '10

I'm building an infra across the geo's to collect logs at a central repository. I have set up syslog-ng in 3 geo's (say for e.g X, Y, Z) to collect logs form servers in respective Geo. A forurth server (say for eg. A) where the logs are forwarded from the 3 log servers to aggregate all the logs from all GEO's. The problem where I fail to understand is, if my aggregator server (A) goes down, how do i process my stored logs on (X,) (Y), (Z), so that i do not loose any logs during my downtime. Is it possible to process backlog of logs on the server or do i have to change my infra so that i do not loose these logs? Thanks Noel (hsxtrt)

2 1

Re: [syslog-ng] Rediecting logs
by Zoltán Pallagi 21 Apr '10

21 Apr '10

abhay singh wrote: > Hi, > > Yes, it worked when i changed underscore(_) to hyphen(-). > But again if you check > "destination d_stunnel{ > file("/data/extract/syslogs/$HOST/$HOST_syslog.log" " > in this line am creating directory of $HOST first then log file name, > this should work right? Yes, excepting that you are using "_" instead of "-" again. If you insist on using underscore, use with the following form: /data/extract/syslogs/${HOST}/${HOST}_syslog.log > > > On Tue, Apr 20, 2010 at 4:08 PM, Zoltán Pallagi <pzolee(a)balabit.hu > <mailto:pzolee@balabit.hu>> wrote: > > Hi, > > Replace $HOST_syslog.log to $HOST-syslog.log and it will work. > Syslog-ng seems to be handling wrong if underscore character is > after macroname. > Report a bug about it, please (https://bugzilla.balabit.com/) > > > abhay singh wrote: >> I have made that changes and restarted syslog services even >> though its not working/// >> Now its like this >> >> options { >> long_hostnames(off); >> sync(0); >> perm(0640); >> stats(3600); >> keep_hostname(yes); >> }; >> source s_external { >> udp(port(514)); >> #udp(ip("192.168.114.129") port(514)); >> #udp(ip("0.0.0.0") port(514)); >> }; # Specific >> source s_stunnel { >> tcp(ip("127.0.0.1") >> port(514) >> max-connections(1)); >> }; >> destination d_external { >> file("/data/extract/syslogs/$HOST_syslog.log" \ >> owner(cubot) group(users) perm(0600) dir_perm(0700) >> create_dirs(yes) >> template("$DATE $FULLHOST $PROGRAM $TAG [$FACILITY.$LEVEL] >> $MESSAGE \n") ); >> }; >> >> destination d_stunnel{ >> file("/data/extract/syslogs/$HOST/$HOST_syslog.log" \ >> owner(cubot) group(users) perm(0600) dir_perm(0700) >> create_dirs(yes) >> template("$DATE $FULLHOST $PROGRAM $TAG [$FACILITY.$LEVEL] >> $MESSAGE \n") ); >> }; >> >> log { source(s_external); destination(d_external); }; >> log { source(s_stunnel); destination(d_stunnel); }; >> >> >> >> On Tue, Apr 20, 2010 at 1:55 PM, Alan McKinnon >> <Alan.McKinnon(a)is.co.za <mailto:Alan.McKinnon@is.co.za>> wrote: >> >> On Tuesday 20 April 2010 08:38:51 abhay singh wrote: >> > Hi All, >> > >> > I have made changes in syslog-ng.conf to redirect logs >> coming from other >> > server to some specified log file and in some format >> > >> > source s_external { >> > udp(port(514)); >> > }; >> > source s_stunnel { >> > tcp(ip(127.0.0.1) port(514)); >> > }; >> > >> > destination s_external { >> file("/mydir/syslogs/$HOST_syslog.log" \ >> > owner(user) group(group) perm(0600) dir_perm(0700) >> create_dirs(yes)); >> > }; >> > >> > destination s_stunnel { >> file("/mydir/syslogs/$HOST/syslog.log" \ >> > owner(user) group(group) perm(0600) dir_perm(0700) >> create_dirs(yes)); >> > }; >> > >> > log { source(s_external); destination(s_external); }; >> > log { source(s_stunnel); destination(s_stunnel); }; >> > >> > But my log file is being created with name "syslog.log" and >> not as >> > "<hostnmae/ip>_syslog.log" neither $HOST directory made, >> what may be the >> > issue? >> > >> > Globle options are >> > >> > option{ >> > >> > long_hostname(off); >> > sync(0); >> > } >> >> >> Your sources and destinations have the same name. That is not >> allowed. >> >> Rename the destinations to d_<something> >> >> -- >> Alan McKinnon >> Systems Engineer^W Technician >> Infrastructure Services >> Internet Solutions >> >> +27 11 575 7585 >> >> Please note: This email and its content are subject to the >> disclaimer as displayed at the following link >> http://www.is.co.za/legal/E-mail+Confidentiality+Notice+and+Disclaimer.htm. >> Should you not have Web access, send a mail to >> disclaimers(a)is.co.za <mailto:disclaimers@is.co.za> and a copy >> will be emailed to you. >> ______________________________________________________________________________ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: >> http://www.balabit.com/support/documentation/?product=syslog-ng >> FAQ: http://www.campin.net/syslog-ng/faq.html >> >> >> >> >> -- >> Regards.. >> Abhay Singh.. >> 91-98804-55587 >> Sr. Software Engineer. >> Robust Designs India Pvt Ltd. >> Bangalore >> ------------------------------------------------------------------------ >> ______________________________________________________________________________ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: >> http://www.balabit.com/support/documentation/?product=syslog-ng >> FAQ: http://www.campin.net/syslog-ng/faq.html > > > -- > pzolee > > > > > > -- > Regards.. > Abhay Singh.. > 91-98804-55587 > Sr. Software Engineer. > Robust Designs India Pvt Ltd. > Bangalore -- pzolee

1 0

bugzilla items not forwarded to this list
by Evan Rempel 20 Apr '10

20 Apr '10

I have opened a couple of bugs via the bugzilla.balabit.com system and the bugs have not come through to the mailing list. Evan.

4 8

[Bug 80] New: Missing RPM dependency
by bugzilla＠bugzilla.balabit.com 20 Apr '10

20 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=80 Summary: Missing RPM dependency Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: packaging AssignedTo: folti(a)balabit.hu ReportedBy: alexandra(a)walford.id.au Type of the Report: bug Estimated Hours: 0.0 Hi, Regarding the RHEL5 RPMs which you provide for syslog-ng-client 3.0.6, would you consider adding coreutils as a dependency: it looks like the %post script tries to run the syslog-ng initscript, which in turn calls uname. Background: we are attempting to install syslog-ng-client during a kickstart'd RHEL 5.5 build. Since syslog-ng-client doesn't explicitly depend upon coreutils, anaconda is attempting to install syslog-ng-client first: ... Installing syslog-ng-client-3.0.6-1.rhel5.x86_64 warning: syslog-ng-client-3.0.6-1.rhel5: Header V4 DSA signature: NOKEY, key ID 2aa28252 /var/tmp/rpm-tmp.82027: line 90: uname: command not found /var/tmp/rpm-tmp.82027: line 90: [: =: unary operator expected /var/tmp/rpm-tmp.82027: line 97: uname: command not found ... Installing coreutils-5.97-23.el5_4.1.x86_64 ... Thanks, Alexandra -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

Re: [syslog-ng] pattern matching against raw input?
by Robert Fekete 19 Apr '10

19 Apr '10

Hi Glen, Try setting the flags(no-parse) option on your source (http://www.balabit.com/dl/html/syslog-ng-ose-v3.1-guide-admin-en.html/ch06s…) That way syslog-ng will put all incoming data into the MESSAGE part without parsing, and add a syslog header (timestamp, etc.). I think that was what you meant. Regards, Robert On Thursday, April 15, 2010 21:09 CEST, Glen Johnson <gfjohnson(a)alaska.edu> wrote: > Is there a way to parse against raw input, with syslog-ng? > > I'm writing patterns for Cisco devices and the PROGRAM macro appears > to be gobbling (and then removing) the %FACILITY-SEVERITY-MNEMONIC > text, prior to the parser getting access [to the message], for Cisco > ASA devices. In other cases, PROGRAM gobbles the log sequence number > (from cisco ios) and leaves the date/time and FAC-SEV-MNEMONIC code > intact. > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > >

1 0

pattern matching against raw input?
by Glen Johnson 17 Apr '10

17 Apr '10

Is there a way to parse against raw input, with syslog-ng? I'm writing patterns for Cisco devices and the PROGRAM macro appears to be gobbling (and then removing) the %FACILITY-SEVERITY-MNEMONIC text, prior to the parser getting access [to the message], for Cisco ASA devices. In other cases, PROGRAM gobbles the log sequence number (from cisco ios) and leaves the date/time and FAC-SEV-MNEMONIC code intact.

2 1

Re-Starting syslog servicesio.c: bind_inet_socket() bind failed
by abhay singh 15 Apr '10

15 Apr '10

Hi All I am configuring syslog-ng confile to receive logs from different m/c of network. I have added these in my syslog-ng.conf file source s_external { udp(ip("xxx.xxx.xxx.xxx") port(514)); }; destination s_external { file("/mydir/syslogs/$HOST_syslog.log" \ owner(user) group(group) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(s_external); destination(s_external); }; Also made entry in iptable iptables -A INPUT -p udp -i eth1 -s xxx.xxx.xxx.xxx -d yyy.yyy.yyy.yyy --dport 514 -j ACCEPT When i restart syslog service it gives this error /etc/init.d/syslog restart Shutting down syslog services done Re-Starting syslog servicesio.c: bind_inet_socket() bind failed xxx.xxx.xxx.xxx:514 Cannot assign requested address Error initializing configuration, exiting. \\startproc <file://startproc/>: exit status of parent of /sbin/syslog-ng: 1 failed What is wrong in this? -- Regards.. Abhay Singh..

3 3

change log facility number?
by fedora fedora 14 Apr '10

14 Apr '10

When using as a log forwarding unit, can syslog-ng change the local facility when forwarding the logs to another unit? thanks

2 1

ESTRING terminated by a colon?
by Glen Johnson 14 Apr '10

14 Apr '10

Hello, Hopefully this is a new question. I've been trying to write patterns for error messages sent by Cisco IOS devices. For example: 20: *Feb 28 15:00:08.556 AKST: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to up A pattern that works: @NUMBER:seqno@: @ESTRING:CISCO.DATE: %@LINEPROTO-5-UPDOWN: Line protocol on Interface @ESTRING:arg1:,@ changed state to @ANYSTRING:arg2@ But to avoid capturing the colon an space, the end-match needs to be ": " (i.e. colon space), like so: @ESTRING:CISCO.DATE:: @ However, I'm unsure how to quote the colon, when it's already the ESTRING param delimiter? Thanks

5 6

[Bug 70] Disable storing backrefs in PCRE regexps by default
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=70 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO --- Comment #1 from Balazs Scheidler <bazsi(a)balabit.hu> 2010-04-12 22:37:35 --- Hmm.. there's no "nobackref" flag in syslog-ng, and pcre uses the same 'store-matches' flag as does the POSIX regexp. can you please elaborate where you saw this flag? thanks. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 57] syslog-ng does not start at bootup
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=57 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED CC| |bazsi(a)balabit.hu --- Comment #1 from Balazs Scheidler <bazsi(a)balabit.hu> 2010-04-12 22:32:38 --- this change was added to our init scripts, so I guess it should be fine with 3.0.6 already. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 38] New: Setting values of the Structured Data block.
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=38 Summary: Setting values of the Structured Data block. Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: c.haase(a)ifu.com Type of the Report: enhancement Estimated Hours: 0.0 Please add the functionality to set values inside the Structured Data block. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 37] New: Syslog-ng macros don't work in filters
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=37 Summary: Syslog-ng macros don't work in filters Product: syslog-ng Version: 3.0.x Platform: Other OS/Version: Other Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: vincent.panel(a)telindus.be Type of the Report: --- Estimated Hours: 0.0 Several documented macros don't work when used in filters. It's the case for $SEC, $MSGHDR. Already reported on the syslog-ng mailing list and acknowleged as a syslog-ng bug. I've tried it on Sparc/Solaris (but can't choose it in the platform menu of bugzilla...) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 51] check if the PID is valid before start
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=51 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED --- Comment #4 from Balazs Scheidler <bazsi(a)balabit.hu> 2010-04-12 22:28:20 --- There were related fixes, which should fix this issue. 3.0.6 should be fine in this regard. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 67] write error: Bad file descriptor
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=67 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED --- Comment #2 from Balazs Scheidler <bazsi(a)balabit.hu> 2010-04-12 22:26:39 --- this should be fixed in 3.0.6 release with this patch: Author: Juhasz Viktor <jviktor(a)balabit.hu> 2010-03-22 11:40:05 Committer: Juhasz Viktor <jviktor(a)balabit.hu> 2010-03-22 11:40:05 Parent: c4ee14878dee2573f6c33cd76cd171e093b3910d ([Old license file] Delete the license.txt from the install dir if) Child: 5a51b603ea4f9db084b2d79a28b594269068d1cc ([deb] Don't stop the syslog-ng many times in case of upgrade) Branch: Follows: Precedes: [debconf] don't use file descriptor 3 because it's owner is the debconf read the file directly ------------------- data/debian-packaging/syslog-ng/postinst ------------------- index 738df95..57d9ef6 100755 @@ -59,8 +59,6 @@ preprocess_config() if [ -f $PREPROCESSED_CONFIG_FILE ]; then rm $PREPROCESSED_CONFIG_FILE fi - exec 3<&0 - exec 0<$TEMPLATE_CONFIG_FILE while read line do case `echo $line | cut -d ':' -f 1` in @@ -85,7 +83,7 @@ preprocess_config() fi ;; esac - done + done < $TEMPLATE_CONFIG_FILE fi } -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 74] handling for multiline log messages in files
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=74 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |RESOLVED Resolution| |INVALID Severity|blocker |normal --- Comment #4 from Balazs Scheidler <bazsi(a)balabit.hu> 2010-04-12 22:23:51 --- This is not a bug, but rather a feature request and we're already working on it. I'd set the resolution to NOTABUG if we had that, but we only have INVALID, so this way this goes. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 73] sql driver does not: perform commits, doesnt support session start statements, mangles table names
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=73 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED --- Comment #2 from Balazs Scheidler <bazsi(a)balabit.hu> 2010-04-12 22:21:52 --- Hi, Just as stated on the mailing list, I've integrated your work into the 3.2 branch of syslog-ng, but I've some comments, please see inline: (In reply to comment #0) > Created an attachment (id=18) --> (https://bugzilla.balabit.com/attachment.cgi?id=18) [details] > fixes > > The main problem: When using the sql driver to output entries straight to a database, commits are not performed, so the data isnt visible outside the session > used by syslog-ng. > This was experienced when using the oracle driver of libdbi-drivers. You might be using an older version of libdbi, in my version, the Oracle driver automatically commits after every query using OCI_COMMIT_ON_SUCCESS parameter: status = OCIStmtExecute(Oconn->svc, stmt, Oconn->err, (ub4) (stmttype == OCI_STMT_SELECT ? 0 : 1), (ub4) 0, (CONST OCISnapshot *) NULL, (OCISnapshot *) NULL, stmttype == OCI_STMT_SELECT ? MY_OCI_STMT_SCROLLABLE_READONLY : OCI_COMMIT_ON_SUCCESS); But anyway, your patches are now integrated, but COMMITs need to be explicitly requested by the flags("explicit-commits") option to the SQL driver. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 79] internal statistics log can not be forwarded to syslog server.
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=79 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO --- Comment #1 from Balazs Scheidler <bazsi(a)balabit.hu> 2010-04-12 22:17:58 --- I can't see how that '!' could be added to a message and split, no such thing is performed using syslog-ng. Although while trying to verify this issue, I've found a problem: * syslog-ng 3.1 & 3.2 (the ones with the NVtable refactorization) cannot hold more than 64k in an NV pair Thus $MSG cannot be longer than 64k and the worst of it was, that it got truncated not at 64k, but at the lowest 16 bits of the length. I've fixed this in 3.2 now. However I couldn't find how syslog-ng could do what you describe. Can you elaborate? Thanks. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

syslog-ng 3.0.6 has been released
by devel＠balabit.hu 12 Apr '10

12 Apr '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.0.6 SUMMARY : new stable release DATE : Apr 11, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.0.6) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.6 Sun, 11 Apr 2010 10:35:46 +0200 Bugfixes: * Fixed a boundary checking error on the usertty() destination, which can cause a local buffer to be overflown if the wtmp file on the system contains more than 123 characters in its ut_line member. It is not believed to be exploitable on the following platforms: Linux (32 chars) Solaris (12 chars) AIX (64 chars) HP-UX (12 chars) FreeBSD (8 chars) OpenBSD (8 chars) * Fixed a possible loss of the last partial message in the TCP and TLS transports of the syslog() driver. * Fixed empty line handling in the syslog() driver. The parser now accepts empty lines (which it didn't, but should have) and empty lines have the required trailing space which it didn't previously. * Fixed SDATA value lookup in case the the SD-ID contains dots. * Added escaping support to the structured-data parser. * Fixed an off-by-one bug in the structured data parser. * Fixed a possible segmentation fault after initializing the configuration when using unix-stream() and unix-dgram() destinations. * Fixed the Solaris 10 SMF script to handle "refresh" calls. * Fixed the Solaris 10 SMF script to handle an existing PID file without syslog-ng running with that pid. * Fixed the Solaris init/SMF scripts to avoid ugly error messages if the dump device doesn't exist. This situation can easily happen in a chroot or a zone. * Fixed a 100% CPU usage if the pipe() driver is applied to a regular file, or a file() driver on a named pipe. * Fixed a daylight saving problem in the transition window when receiving a BSD timestamp. * syslog-ng CSV format statistics (reachable via the syslog-ng.ctl socket) is now properly escaped. Other changes: * Fixed a linking problem with the MacOSX linker. * Added automatic test coverage for RFC5424 protocol format. * The SQL driver will drop a message after 3 failed attempts to insert it into the database. * If a character set conversion problem occurs on a connection, syslog-ng will drop the connection instead of trying to read further. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system…

1 0

syslog-ng 3.1.1 has been released
by devel＠balabit.hu 12 Apr '10

12 Apr '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.1.1 SUMMARY : new stable release DATE : Apr 11, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.1.1) has been released. For latest fixes in the 3.1.x feature branch you are recommended to upgrade to this version. CHANGES: 3.1.1 Sun, 11 Apr 2010 10:26:57 +0200 Bugfixes: * Solaris 10 SMF script now checks if the pid file refers to an actual instance of syslog-ng to make sure that syslog-ng is started even after a system crash. * The System V init script used on Solaris 8/9 gave ugly error messages if the dump device doesn't exist (which happens in a chroot/zone environment), this was fixed. * Fixed a 100% CPU usage if the configuration file uses the pipe driver on a regular file or a file driver on a named pipe. * Fixed a daylight saving problem in the transition window when receiving a BSD timestamp. * syslog-ng CSV format statistics (reachable via syslog-ng-ctl) is now properly escaped. Other changes: * Added "TAGS" macro which expands to a list of comma separated message tags. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

match/program granularity
by Alex 12 Apr '10

12 Apr '10

Hi, I'm using an older version of syslog-ng for now, until I can upgrade to post-3.0, but for the time-being I'd like to be able to use the match() and program() qualifiers to redirect output from bind to a specific file, from the local host as well as from remote hosts using local3.info. Where can I find the documentation that describes the differences in usage for match() and program()? In the following line, what is considered "program" and what is considered "match"? How does this change if the line is from a remote host? Apr 10 17:16:15 smtp01 postfix/cleanup[23834]: 1F3BBE74004: message-id=<20103410231614.1F3BBE74004(a)smtp01.myhost.com> Can I match on hostname? Are there other parameters that might be helpful in classifying this information? Thanks, Alex

2 3

commit with the oracle sql driver
by Patrick H. 10 Apr '10

10 Apr '10

So, extensive googling has failed me on this. I'm using the sql driver to output to an oracle database, with debugging mode, I can see that the insert queries are indeed being executed, however my tables remain empty. I've been through the source code, and it doesnt look like a commit is being performed anywhere. Though my google efforts, I did find one reference where someone patched the libdbi-drivers oracle driver to do a commit on success after every query, but that is insanely expensive (and ugly). I have started modifying the code to add the flush_lines and flush_timeout option to the sql driver. But before I got too carried away, I was wondering why this is the way it is the way it is, or if I'm missing something.

3 5