- syslog-ng - lists.balabit.hu

Syslog-ng and tcpd
by Liam Kirsher 25 Mar '09

25 Mar '09

Hi -- I'm noticing lot's of these in the /var/log/messages file: > Mar 24 15:16:07 domU-12-31-39-00-09-F2 syslog-ng[25138]: warning: > /etc/hosts.allow, line 17: host name/name mismatch: > ec2-67-202-53-122.compute-1.amazonaws.com != > domU-12-31-35-00-04-A1.z-2.compute-1.internal > Mar 24 15:16:07 domU-12-31-39-00-09-F2 syslog-ng[25138]: Syslog > connection rejected by tcpd; from='AF_INET(67.202.53.122:48703)' > Mar 24 15:16:17 domU-12-31-39-00-09-F2 syslog-ng[25138]: Syslog > connection accepted; fd='22', client='AF_INET(67.202.53.122:48187)', > local='AF_INET(0.0.0.0:5000)' Apparently, access is being denied, as it should be. It's just a little disconcerting to see the "connection accepted" message after it has been rejected. > telnet this.domain.com 5000 > Trying 171.122.232.186... > Connected to this.domain.com. > Escape character is '^]'. > Connection closed by foreign host. Is this the expected behavior? Is there some way to prevent all these messages from showing up in the log file? Liam -- Liam Kirsher PGP: http://liam.numenet.com/pgp/

3 2

Syntax error due to include files in syslog-ng.conf
by Ritesh Sood 25 Mar '09

25 Mar '09

Hi all, I've built syslog-ng V 3.0.1 from the released source and have the following at the top of syslog-ng.conf ----- @version:3.0 include "/etc/syslog-ng/options.inc"; include "/etc/syslog-ng/src-dest-defs.inc"; include "/etc/syslog-ng/filter-defs.inc"; include "/etc/syslog-ng/common-log-defs.inc"; ------ syntax checking as # syslog-ng -s returns with syntax error at line 3. Here are the relevant portion from the syslog-ng-admin-guide.pdf ----- Every syslog-ng configuration file must begin with a line containing the version infor mation of syslog-ng. For syslog- ng version 3.0, this line looks like: @version:3.0 . . . The syslog-ng application supports including external files in its configuration file, so parts of its configuration can be managed separately. To include the contents of a file in the syslog- ng configuration, use the following syntax include "filename"; This imports the entire file into the configuration of syslog-ng, at the location of the include statement. If you specify a directory, syslog-ng will try to include every file in alphabetic order. When including configuration files, consider the following points: ---- The config file works okay if I copy-paste the corresponding files in place of the include statements so the included files themselves are syntactically correct. So I don't see where I'm making an error. I hope there isn't a bug in the source. I'm not counting out that possibility since there was a bug in the released source for which I had to obtain a patch from the git repo: https://lists.balabit.hu/pipermail/syslog-ng/2009-January/012400.html Help much appreciated ! Ritesh

2 2

[Bug 40] New: Cisco ASA format is not understood
by bugzilla＠bugzilla.balabit.com 23 Mar '09

23 Mar '09

https://bugzilla.balabit.com/show_bug.cgi?id=40 Summary: Cisco ASA format is not understood Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: vincent.panel(a)telindus.be Type of the Report: --- Estimated Hours: 0.0 Syslog-ng receives messages like this from Cisco ASA devices : <PRI>MM DD YYYY HH:mm:ss HOSTNAME %MSGID: CONTENT "YYYY" part is not conform to BSD-style syslog timestamp : it shouldn't exist. Unfortunately, it can't be changed on the ASA side. Syslog-ng does not see any header in this message and think "MM" is the process sending the message, hence adds ":" behind it. Additionnaly, syslog-ng prepends its own header which leads to a total mess in the destination syslog... On the other hand, syslog-ng also receives messages from another Cisco device (FWSM) like this : <PRI>MM DD YYYY HH:mm:ss %MSGID: CONTENT Note the hostname is not specified. And this format is well understood by syslog-ng (no prepended header, no ":" after the month) ! I've also read here : http://www.balabit.com/dl/html/syslog-ng-v3.0-guide-admin-en.html/ch02s17.h… syslog-ng should be able to understand "PIX extended format" but I can't find anywhere in the documentation nor on the internet what it refers to... So would it be possible to make sure the first format is well understood by syslog-ng ? Regards, Vincent Panel -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

binary packages success/failure reports
by Balazs Scheidler 23 Mar '09

23 Mar '09

Hi, I'd be eager to hear any success/failure reports with the binary installation packages I've posted about last week. I'd really like to do a release of syslog-ng 3.0.2, but since I want to do that together with the binary packages and I don't want to be ashamed for the binary packages, I'd really be interested in some field testing. Thanks in advance. -- Bazsi

1 0

Re: [syslog-ng] syslog-ng using ssl
by Hahusseau, Thomas 23 Mar '09

23 Mar '09

Hi, Maybe you should try to launch syslog-ng with debug & verbose options to see error. I had some seg fault with ssl and syslog-ng and it's now fixed thanks to a patch posted on this mailing list. Bye Thomas -----Message d'origine----- De : syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] De la part de Luigi Augello Envoyé : dimanche 22 mars 2009 17:53 À : Syslog-ng users' and developers' mailing list; syslog-ng-bounces(a)lists.balabit.hu Objet : [syslog-ng] syslog-ng using ssl Hello I try to use ssl ad I have the follow scenario: One server (192.168.1.2) with this syslog.ng.conf ########################################### @version:3.0 source s_sk{file("/var/log/messages");}; source s_ssl{ tcp(ip("0.0.0.0") port (1999) tls(key_file("/root/Scaricati/certificati/privkey.pem") cert_file("/root/Scaricati/certificati/cacert.pem")));}; destination d_file{file("/var/log/syslog-ng.log");}; log{source(s_sk);destination(d_file);}; log{source(s_ssl);destination(d_file);}; One client (192.168.1.3) with this syslog.ng.conf ################################################### @version:3.0 source s_sk{file("/var/log/messages");}; destination d_file{file("/var/log/syslog-ng.log");}; destination d_ssl{tcp("192.168.1.2" port (1999) tls(ca_dir("/root/software/ca/")));}; log{source(s_sk);destination(d_file);}; log{source(s_sk);destination(d_ssl);}; I haven't a CA certificate and I use a self-signed certificate created by these instructions opennsl genrsa -out privkey.pem opennsl req -new -x509 -key prixkey.pem -out cacert.pem -days 1095 I follow step by step the instructions on "The syslog-ng Administrators guide " page 58 and so on and I copied the cacert.pem generated in the server in the client and I use ln -s .... When I try to start the server it starts. Though the client doesn't give me any errors it doesn't start. I suppose the certificate may crate some problems. tanks for help Luigi ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng using ssl
by Luigi Augello 22 Mar '09

22 Mar '09

Hello I try to use ssl ad I have the follow scenario: One server (192.168.1.2) with this syslog.ng.conf ########################################### @version:3.0 source s_sk{file("/var/log/messages");}; source s_ssl{ tcp(ip("0.0.0.0") port (1999) tls(key_file("/root/Scaricati/certificati/privkey.pem") cert_file("/root/Scaricati/certificati/cacert.pem")));}; destination d_file{file("/var/log/syslog-ng.log");}; log{source(s_sk);destination(d_file);}; log{source(s_ssl);destination(d_file);}; One client (192.168.1.3) with this syslog.ng.conf ################################################### @version:3.0 source s_sk{file("/var/log/messages");}; destination d_file{file("/var/log/syslog-ng.log");}; destination d_ssl{tcp("192.168.1.2" port (1999) tls(ca_dir("/root/software/ca/")));}; log{source(s_sk);destination(d_file);}; log{source(s_sk);destination(d_ssl);}; I haven't a CA certificate and I use a self-signed certificate created by these instructions opennsl genrsa -out privkey.pem opennsl req -new -x509 -key prixkey.pem -out cacert.pem -days 1095 I follow step by step the instructions on "The syslog-ng Administrators guide " page 58 and so on and I copied the cacert.pem generated in the server in the client and I use ln -s .... When I try to start the server it starts. Though the client doesn't give me any errors it doesn't start. I suppose the certificate may crate some problems. tanks for help Luigi

1 0

no_multi_line - have cake, eat too
by Ross Andrus 22 Mar '09

22 Mar '09

Hi, Thanks for the great tool! I really enjoy the power and flexibility of syslog-ng, and I wanted to send along a local modification I've made to the 3.0.1 release. My situation is that I'd like to have *both* the traditional behavior in which newlines are replaced with spaces, and also the new no_multi_line feature. Basically, developers want to see the stack traces, operations wants simple scanning and analysis. So, I created a new template macro named "ONELINE" that is a variant of the MSGONLY macro, but it makes a local copy of the buffer and performs the newline replacement on it, then sends it off. I didn't put any time into thinking about performance, so I won't be surprised to here there's a better way or etc, but it works well enough so far. Regards Ross Andrus

2 1

Re: [syslog-ng] seeking for a help
by dhanesh m 20 Mar '09

20 Mar '09

friend, Thanks for ur reply iam very happy and i got sum confidence too there are few friends around me to help expecting the same with regards, dhanesh m Connect with friends all over the world. Get Yahoo! India Messenger at http://in.messenger.yahoo.com/?wm=n/

1 0

why i have to restart syslog to have the new apache log??
by gatfi sami 19 Mar '09

19 Mar '09

hi i am using syslog-ng 2.0.9.1 on open suse 11.0 i configured this littele script in /etc/syslog-ng/syslog-ng.conf source my_src { file("/var/log/apache2/error_log"); }; > > #filter my_filter { }; > > destination my_dest{ file("/var/log/Sami/$HOST/messages" owner("root") > group("root") perm(0640) dir_perm(0750) create_dirs(yes)); > }; > > log { source(my_src); #filter(my_filter); > destination(my_dest); }; > the problem is when i restart apache2 while using the *tail -f /var/log/Sami/$HOST/messages *nothing happens i have to restart syslog-ng to see those errors by the way i stoped the apparmor to avoid a permission denied on the destination driver i need help plz tks

4 8

s_tail not working
by Nikunj Shah 18 Mar '09

18 Mar '09

Hi, I am using syslog-ng 2.0.9 on my opensuse 11.1 box. I was trying to configure my apache log to be logged in syslog-ng. I used below syntax: source s_tail { file("/var/log/apache2/access_log" follow_freq(1) flags(no-parse));}; destination logserver { tcp("192.168.1.184" port(1470)); }; log { source(s_tail); destination(logserver); }; It gave me below error: >Mar 18 04:08:09 sugar3 syslog-ng[22107]: Follow-mode file source not found, deferring open; filename='/var/log/apache2/access_log' Help would be appreciated. Regards, Nikunj

1 0

seeking for a help
by dhanesh m 18 Mar '09

18 Mar '09

freind, iam a redhat certified engineer , now iam concentrating on suse linux, and i wanna configure syslog-ng server in suse i gone through google search and got some idea i tried but its not coming juss tell me wat all entries i hav to give in server and client normal entries for remote logging hope some1 will help me...................................... Add more friends to your messenger and enjoy! Go to http://messenger.yahoo.com/invite/

2 1

[Bug 39] New: Memory exhaustion when using UDP destination to send to a remote server.
by bugzilla＠bugzilla.balabit.com 16 Mar '09

16 Mar '09

https://bugzilla.balabit.com/show_bug.cgi?id=39 Summary: Memory exhaustion when using UDP destination to send to a remote server. Product: syslog-ng Version: 2.1.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: gillespiem(a)pa.net Type of the Report: --- Estimated Hours: 0.0 I have noticed that if syslog-ng receives an ICMP Type 3 / Code 3 message from a syslog-ng server configured as a remote destination (using UDP as the transport), the syslog-ng process starts consuming more and more memory, finally exhausting all resources. I've found this issue can be consistently replicated. Centos 5.2 (Final) syslog-ng 2.1.3 syslog-ng.conf (snippet from sending server) destination d_syslog_rtr0 {udp("syslog-server.blah.com" port(514));}; Config on receiving server doesn't matter, you can send the packets to a blackhole when replicating the issue. Steps to replicate: Using tcpdump, determine the port the sending server is using to send messages. Then, using sing (or any packetcrafting tool), do the following (or similar): sing -du -S <receiving syslog server IP> -x port-unreach -prot udp -psrc <Sending server source port (determined above)> --pdst 514 <Sending syslog server> When viewing processes using "top", it's apparent that memory usage of the syslog-ng process starts increasing every ~2 seconds, until the server has exhausted all memory. (I can replicate this on 3 separate servers) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

syslog-ng OSE binary packages
by Balazs Scheidler 14 Mar '09

14 Mar '09

Hi, I'm happy to announce that BalaBit has decided to make the binary packages for syslog-ng OSE available for free. As you may know, BalaBit has various syslog-ng support packages and as a part of this service it prepared binary installation packages for different platforms. The access to these packages either required a support contract but could also be purchased separately for a yearly fee. With syslog-ng 3.0, the binary packages for syslog-ng OSE will become freely accessible. Since syslog-ng is an open source project, BalaBit planned to finish this task in the Open Source spirit: open and visible to all community members. This also means that the set of packages published with this e-mail is NOT yet release grade, rather it is more of a development snapshot of the current state of affairs. So please don't ruin your production systems with this package, it is more advisable to try them in a test environment (chroot or a dedicated test machine). With all these said, here is the link: https://www.balabit.com/network-security/syslog-ng/opensource-logging-syste… Please pick the release named "3.0HEAD". This contains a source snapshot (effectively git from two days ago), and a set of packages for SUSE 10, RHEL4/5, FreeBSD 6.x, Debian etch, and Linux generic. The binary packages contain all runtime dependencies needed to run syslog-ng, thus no further packages are required, it is an all-in-one package. The rpm/deb packages are prepared the same, they install syslog-ng in /opt/syslog-ng in order to avoid clashes with a system supplied syslog-ng daemon. There are two install kits for each platform: * one that includes database drivers (dubbed as "server") * one that does not include database drivers (dubbed as "client") Currently there are no other differences between the packages, but later on there might be. With the current infrastructure in place, I'm confident that with each syslog-ng OSE release, I can publish the source AND binary packages at the same time. I'd really appreciate success/failure reports and also any kind of comment you may have. I'd like to release 3.0.2 together with its binary packages, let's hope that I get enough feedback on these packages so that I can do that. Enjoy! -- Bazsi

2 1

question about message parsing behavior
by Joe Shaw 14 Mar '09

14 Mar '09

Hi, What happens if a parser fails to parse a message? Let's say I have a parser: csv_parser(columns("COL1", "COL2", "COL3") delimiters(",")); If I pass in "foo", does COL1 get set to "foo" and COL2 and COL3 are undefined? If I pass in "foo,bar" is just COL3 undefined? If I pass in "foo,bar,baz,quux" is COL3 "baz,quux" ? I am wondering if I can set up a filter for messages which don't meet the parsing rules, so that I can use the catch-all directive for logging rules and filter out messages that don't match the format (in lieu of the tagging that was discussed in a different thread). Thanks! Joe

2 2

installing syslog-ng on a CentOS 5.2
by Luigi Augello 14 Mar '09

14 Mar '09

Hi I have tried to install syslog-ng-3.0.1+20090312 with eventlog-0.2.9+20090312 on a CentOS 5.2 following this steps below 1) tar -xzvf eventlog-0.2.9+20090312.tar.gz 2) tar -xzvf syslog-ng-3.0.1+20090312.tar.gz 3) mkdir -p /opt/syslog-ng-3.0.1/eventlog 4) cd eventlog-0.2.9+20090312 5) ./configure --prefix=/opt/syslog-ng-3.0.1/eventlog/ 6) make&&make install 7) export PKG_CONFIG_PATH=/opt/syslog-ng-3.0.1/eventlog/lib/pkgconfig/ 8) cd syslog-ng-3.0.1+20090312 9) ./configure --prefix=/opt/syslog-ng-3.0.1/ and this is the output executing the last command checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for gawk... gawk checking whether make sets $(MAKE)... yes checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for style of include used by make... GNU checking dependency style of gcc... gcc3 checking for gcc... (cached) gcc checking whether we are using the GNU C compiler... (cached) yes checking whether gcc accepts -g... (cached) yes checking for gcc option to accept ISO C89... (cached) none needed checking dependency style of gcc... (cached) gcc3 checking for bison... no checking for byacc... no checking for flex... no checking for lex... no checking whether make sets $(MAKE)... (cached) yes checking for ranlib... ranlib checking for special C compiler options needed for large files... no checking for _FILE_OFFSET_BITS value needed for large files... 64 checking how to enable static linking for certain libraries... GNU or Solaris checking how to run the C preprocessor... gcc -E checking for grep that handles long lines and -e... /bin/grep checking for egrep... /bin/grep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dmalloc.h usability... no checking dmalloc.h presence... no checking for dmalloc.h... no checking for strings.h... (cached) yes checking getopt.h usability... yes checking getopt.h presence... yes checking for getopt.h... yes checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/strlog.h usability... no checking sys/strlog.h presence... no checking for sys/strlog.h... no checking door.h usability... no checking door.h presence... no checking for door.h... no checking sys/capability.h usability... no checking sys/capability.h presence... no checking for sys/capability.h... no checking sys/prctl.h usability... yes checking sys/prctl.h presence... yes checking for sys/prctl.h... yes checking tcpd.h usability... yes checking tcpd.h presence... yes checking for tcpd.h... yes checking whether struct tm is in sys/time.h or time.h... time.h checking for struct tm.tm_gmtoff... yes checking for I_CONSLOG... no checking for O_LARGEFILE... yes checking for struct sockaddr_storage... yes checking for struct sockaddr_in6... yes checking for PR_SET_KEEPCAPS... yes checking for door_create in -ldoor... no checking for socket in -lsocket... no checking for nanosleep in -lrt... yes checking for gethostbyname in -lnsl... yes checking for regexec in -lregex... no checking for res_init in -lresolv... no checking for cap_set_proc in -lcap... no checking for pcre_compile in -lpcre... no checking for strdup... yes checking for strtol... yes checking for strtoll... yes checking for strtoimax... yes checking for inet_aton... yes checking for inet_ntoa... yes checking for getopt_long... yes checking for getaddrinfo... yes checking for getutent... yes checking for strcasestr... yes checking for TCP wrapper library... -lwrap checking for OPENSSL... yes checking for dlsym in -ldl... yes checking for inflate in -lz... yes checking for dlsym in -ldl... (cached) yes checking for LIBDBI... no checking for dbi_initialize in -ldbi... no checking for LIBNET... no checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... yes checking whether to enable spoof source support... no checking whether to enable IPv6 support... yes checking whether to enable SQL support... no checking whether to enable Linux capability support... no checking whether to enable PCRE support... no checking for pkg-config... /usr/bin/pkg-config checking for GLIB - version >= 2.10.1... no *** Could not run GLIB test program, checking why... *** The test program failed to compile or link. See the file config.log for the *** exact error that occured. This usually means GLIB is incorrectly installed. configure: error: Cannot find GLIB version >= 2.10.1: is pkg-config in path? the latest 5 lines upon the GLIB library not updated, but mi CentOS is the latest. So, why this error? All hepls will be highly appreciated bye Luigi

2 2

patches recently backported from PE
by Balazs Scheidler 14 Mar '09

14 Mar '09

Hi, As promised earlier, here comes a mail that describes what patches were ported from syslog-ng Premium Edition to OSE. I find this important because otherwise these patches would not be mentioned on this mailing list at all, so I hope to get more transparency in this field. Since there were some reports recently about bugs that I've previously fixed in Premium Edition, I went through the complete diff between OSE and PE (about 20k lines) and resynced the two in order to minimize the differences. Here's the list of patches (not necessarily in cronological order, I've removed references to patches that were already present on the mailing list), for more information you can always check the git repository at git.balabit.hu: Balazs Scheidler: [debian] fixed build-dependencies to work with packages in lenny [func_test] use SNDTIMEO on Linux platforms only as it does not work everywhere [tgz2build] fixed etc/install.dat generation [func_test] enhanced functional test program [unit tests] udapted to the changed log_msg_new() prototype [init script] balabit-initscripts fixes [afsocket] the member used to hold target hostname was moved to afsocket [afsocket] properly drop connections in case SSL handshake fails [afsocket] clarified log messages [afsql] recognize "mssql" as an alias to "freetds" [config parser] add an error message if the user requests to rewrite using "glob" [child manager] don't call destroy notify if one is not set [logmsg] fixed signed comparison problems [logmsg] rename log_msg_ack_func and remove static [db-parser] move the patterndb file checking into log_db_parser_reload_database() [logwriter] fixed write suspend in case the GSource instance is replaced [messages] added support for sending the internal messages to syslog() [radix] stylistic changes [loggen] readded sequence number & timestamp generation [loggen] don't allow message sizes that'd cause stack overflo [loggen] report the effective bandwidth used at the end of the run [templates] removed dead code [func_test] removed time.sleep() calls scattered around the code [tgz2build] accept 1 successful "make check" run out of 3 enough for success [compat.h] include config.h instead of syslog-ng.h updated copyright notices [configure] minor updates As it seems it was worth to review the set of differences as there were some important patches missing: [afsocket] properly drop connections in case SSL handshake fails Without this patch, you can DoS an SSL enabled listener with handshake failures. [logmsg] fixed signed comparison problems This could cause segfaults on platforms where it is common to have pointer values with the highest bit set (e.g. negative when interpreted as a signed number). I also find it important that the functional test program (ran when you issue "make check") was enhanced significantly. The other patches mostly move the two codebases in-line to make porting patches between the two easier. -- Bazsi

1 0

Syslog-ng not working with tcp_wrappers
by Liam Kirsher 13 Mar '09

13 Mar '09

Syslog-ng doesn't seem to be respecting tcp_wrappers security. I compiled syslog-ng (v. 3) with $ ./configure --sysconfdir=/etc/syslog-ng/ --enable-tcp-wrapper -- enable-sql --enable-dynamic-linking Although, I do notice this warning in config.log: configure:7282: gcc -o conftest -g -O2 -Wall conftest.c -lwrap >&5 conftest.c: In function 'main': conftest.c:43: warning: control reaches end of non-void function configure:7288: $? = 0 configure:7309: result: -lwrap However, the compile is successful. My hosts.allow file is: # # hosts.allow This file describes the names of the hosts which are # allowed to use the local INET services, as decided # by the '/usr/sbin/tcpd' server. # sshd: ALL #syslog-ng: localhost, p3.mydomain.com, p4.mydomain.com # # hosts.deny This file describes the names of the hosts which are # *not* allowed to use the local INET services, as decided # by the '/usr/sbin/tcpd' server. ALL: ALL Note that the syslog-ng process is commented out, but syslog-ng still works. Apparently, it's not checking the hosts.* files. Any idea ? Liam

3 3

syslog-ng not opening file specified in source
by Vinay Kalkoti 12 Mar '09

12 Mar '09

Hi, I am using syslog-ng 2.0.10 on suse 10 sp2. my syslog-ng.conf file looks like this - source tcp_src { file("/tmp/log"); }; destination tcp_dest { tcp("<ip>" port(514)); }; log { source(tcp_src); destination(tcp_dest); }; i have given rw permissions to my file /tmp/log. I did strace syslog-ng -f syslog-ng.conf. Here is where it is failing - open("/tmp/log", O_RDONLY|O_NONBLOCK|O_NOCTTY) = -1 EACCES (Permission denied) Any help is appreciated. Thanks, Vinay

3 2

loosing Messages via Modem (GPRS/UMTS) connection
by Jens-Peter C. Hillers 12 Mar '09

12 Mar '09

Hi, I try to log to a remote Syslog Server via: destination logserver { tcp("log.mydomain.xyz" port(514) flush_lines(1) flush_timeout(10) keep-alive(yes) ); }; if I have a long period between the messages (e.g. 10 Minutes) the messsage is still logged to the local machine ( I write a second log to a local file) but no message reaches the server. all new messages are lost. if I restart the syslog deamon ill get messages again (but only new ones) I use Suse Linux 10.1 with syslog-ng (2.x) (client) I also compiled and tried 3.0.1 but git the same effect. any idea ? regards Jens-Peter C. Hillers

2 2

Appending values to Structured-Data
by Christian Haase 11 Mar '09

11 Mar '09

Hi, I want to send apache2 messages via tcp to my syslog server using syslog-ng3 with the IETF-Message format. I specified a source which uses file("/var/log/apache2/access.log" flags(no-parse) follow-freq(5)) to fetch the log data. So the orginating apache message keeps untouched and can be found in the MSG part. This message is packed into the IETF-Frame with the destination syslog("..." transport("tls") ... ) On server-side I want to "unpack" the message again to reconstruct the original format of the access.log. The main problem is to decide the source of the message to write it into the right file (multiple webservers will log this way). I wanted to solve this problem by setting the unused IETF-Message Headers to the values the identify them. For example I wanted to append a string like "www=my.web.site" to the Structured Data. These information then would be interpreted and the corresponding file will be used. Is there a way the set these fields and use them on the destination server in filters? Dear, Christian Haase -- ifu Hamburg - material flows and software ifu Institut fuer Umweltinformatik Hamburg GmbH Grosse Bergstrasse 219, 22767 Hamburg, Germany Managing Director: Jan Hedemann, Commercial Register: Hamburg, HRB 52629 www.ifu.com - www.umberto.de - www.sabento.com - www.e-sankey.com >>> e!Sankey - software for easy drawing of Sankey diagrams. >>> Visit http://www.e-sankey.com

2 1

[Bug 30] New: file() on fifo hangs syslog-ng
by bugzilla＠bugzilla.balabit.com 11 Mar '09

11 Mar '09

https://bugzilla.balabit.com/show_bug.cgi?id=30 Summary: file() on fifo hangs syslog-ng Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: enhancement Estimated Hours: 0.0 file() on fifo (made by mkfifo) causes syslog-ng to hang and eat memory. Could some checks be added to prevent such misconfiguration? -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

Error in syslog-ng Open Source Edition 3.0.1 configuration stage
by Ritesh Sood 10 Mar '09

10 Mar '09

Please take a look at the following snippet that ./configure outputs. In particular, the spurious text between "compiler options" and "linker flags" is due to libnet-config. Thing is, this bit of text is creeping into the Makefiles and compilation fails. My efforts at troubleshooting follow the snippet. ----------------start code--------------------------------- checking for TCP wrapper library... -lwrap checking for OPENSSL... yes checking for dlsym in -ldl... yes checking for inflate in -lz... yes checking for dlsym in -ldl... (cached) yes checking for LIBDBI... yes checking for LIBNET... Unknown option: - Unknown option: e Unknown option: f Unknown option: - Unknown option: l yes checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable SQL support... yes checking whether to enable Linux capability support... yes checking whether to enable PCRE support... yes checking for pkg-config... (cached) /usr/bin/pkg-config checking pkg-config is at least version 0.14... yes checking for GLIB - version >= 2.10.1... yes (version 2.12.3) checking for EVTLOG... yes checking for LIBNET... Unknown option: - Unknown option: e Unknown option: f Unknown option: - Unknown option: l yes checking for static GLib libraries... yes checking sanity checking Glib headers... yes configure: creating ./config.status config.status: creating dist.conf config.status: creating Makefile config.status: creating syslog-ng.spec.bb config.status: creating src/Makefile config.status: creating doc/Makefile config.status: creating doc/docvars.xml config.status: creating contrib/Makefile config.status: creating tests/Makefile config.status: creating debian/Makefile config.status: creating tgz2build/Makefile config.status: creating tests/unit/Makefile config.status: creating tests/functional/Makefile config.status: creating tests/loggen/Makefile config.status: creating config.h config.status: config.h is unchanged config.status: executing depfiles commands syslog-ng Open Source Edition 3.0.1 configured Compiler options: compiler : gcc compiler options : -O3 -I/opt/system/include -Wall - pthread -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/opt/ system/include/eventlog -I/usr/kerberos/include daytime_hosts ftp_ext_passive 1 ftp_firewall ftp_int_passive 0 ftp_testhost inet_domain dept.univ.edu nntp_hosts ph_hosts pop3_hosts smtp_hosts snpp_hosts test_exist 1 test_hosts 1 time_hosts This script will prompt you to enter hostnames that can be used as defaults for some of the modules in the libnet distribution. To ensure that you do not enter an invalid hostname, I can perform a lookup on each hostname you enter. If your internet connection is via a dialup line then you may not want me to perform these lookups, as it will require you to be on-line. Do you want me to perform hostname lookups (y|n) ? [yes] The following questions all require a list of host names, separated with spaces. If you do not have a host available for any of the services, then enter a single space, followed by <CR>. To accept the default, hit <CR> Enter a list of available NNTP hosts : [] Enter a list of available SMTP hosts : [] Enter a list of available POP3 hosts : [] Enter a list of available SNPP hosts : [] Enter a list of available PH Hosts : [] Enter a list of available TIME Hosts : [] Enter a list of available DAYTIME Hosts : [] Do you have a firewall/ftp proxy between your machine and the internet If you use a SOCKS firewall answer no (y|n) ? [no] Normally when FTP needs a data connection the client tells the server a port to connect to, and the server initiates a connection to the client. Some setups, in particular firewall setups, can/do not work using this protocol. In these situations the client must make the connection to the server, this is called a passive transfer. Should all FTP connections be passive (y|n) ? [no] What is your local internet domain name : [dept.univ.edu] If you specified some default hosts above, it is possible for me to do some basic tests when you run `make test' This will cause `make test' to be quite a bit slower and, if your internet connection is via dialup, will require you to be on-line unless the hosts are local. Do you want me to run these tests (y|n) ? [yes] To allow Net::FTP to be tested I will need a hostname. This host should allow anonymous access and have a /pub directory What host can I use : [] Writing libnet.cfg -I/usr/dbi -I/usr/dbi/dbi -D_GNU_SOURCE - D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -L/opt/system/lib prefix : /opt Features: Sun STREAMS support : no Sun Door support : no Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : yes spoof-source support : yes tcp-wrapper support : yes SSL support : yes SQL support : yes Linux capability support : yes PCRE support : yes Env wrapper support : no ----------------end code--------------------------------- The following line in configure are responsible: ----------------start code------------------------------- { echo "$as_me:$LINENO: checking for LIBNET" >&5 echo $ECHO_N "checking for LIBNET... $ECHO_C" >&6; } if test "x$with_libnet" = "x"; then LIBNET_CONFIG="`which libnet-config`" else LIBNET_CONFIG="$with_libnet/libnet-config" fi if test -n "$LIBNET_CONFIG" -a -x "$LIBNET_CONFIG"; then LIBNET_CFLAGS="`$LIBNET_CONFIG --defines`" LIBNET_LIBS="`$LIBNET_CONFIG --libs`" { echo "$as_me:$LINENO: result: yes" >&5 echo "${ECHO_T}yes" >&6; } else LIBNET_LIBS= { echo "$as_me:$LINENO: result: no" >&5 echo "${ECHO_T}no" >&6; } fi ----------------end code--------------------------------- libnet-config it seems does not expect the arguments `` --defines" or ``--libs" and is outputting all the text above. See the following lines above? Unknown option: - Unknown option: e Unknown option: f Unknown option: - Unknown option: l Searching on the web reveals that libnet-config is outdated and should not even be present on modern linux systems. Pointers towards how to proceed from here much appreciated. Ritesh Sood

2 1

Re: [syslog-ng] Database field types
by Hahusseau, Thomas 09 Mar '09

09 Mar '09

Hi, I use different type of fields in my database and there is no issue with syslog-ng for writing logs inside. You just have to check that the data matches the types. Thomas -----Message d'origine----- De : syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] De la part de Liam Kirsher Envoyé : samedi 7 mars 2009 04:08 À : Syslog-ng users' and developers' mailing list Objet : [syslog-ng] Database field types Hi -- I notice that when the database tables get created all the fields are 'text' type. That is okay. However, it might in some cases be convenient for us to have different field types. Is there any problem with that? If we create the table with the desired field types, will that take care of it (assuming the data actually matches the type)? Liam -- Liam Kirsher PGP: http://liam.numenet.com/pgp/ ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

2 1

[Bug 36] New: tls crash when used as a syslog client
by bugzilla＠bugzilla.balabit.com 06 Mar '09

06 Mar '09

https://bugzilla.balabit.com/show_bug.cgi?id=36 Summary: tls crash when used as a syslog client Product: syslog-ng Version: 3.0.x Platform: All OS/Version: All Status: NEW Severity: critical Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bana(a)docisland.org Type of the Report: --- Estimated Hours: 0.0 There is a typo in the cfg-grammar.y file which prevents tls context initialization and then crash syslog-ng when used as a tls client. Here is the tiny patch: @@ -895,7 +895,7 @@ : dest_afinet_option | KW_TLS { -#if ENABLE_TLS +#if ENABLE_SSL last_tls_context = tls_context_new(TM_CLIENT); #endif } -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

Re: [syslog-ng] Syslog-ng 3.0.1 seg fault with TLS support
by Hahusseau, Thomas 05 Mar '09

05 Mar '09

Hi, Ok sorry I forgot to modify the .c source file. I don't have segmentation fault anymore. Just an issue with "unknown ca" in server logs, when client and server negotiate the tls transaction. I'll investigate it tomorrow. Thanks for your help; I suppose that you'll correct the typo in later builds of syslog-ng? Regards Thomas -----Message d'origine----- De : Hahusseau, Thomas Envoyé : jeudi 5 mars 2009 13:42 À : 'Syslog-ng users' and developers' mailing list' Objet : RE: [syslog-ng] Syslog-ng 3.0.1 seg fault with TLS support I changed it in the source and now the compilation crashed for cfg-grammar.y :( :( -----Message d'origine----- De : syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] De la part de Xavier Lapie Envoyé : jeudi 5 mars 2009 12:12 À : Syslog-ng users' and developers' mailing list Objet : Re: [syslog-ng] Syslog-ng 3.0.1 seg fault with TLS support On Thu, Mar 05, 2009 at 10:50:29AM +0100, Xavier Lapie wrote: > On Thu, Mar 05, 2009 at 10:44:03AM +0100, Hahusseau, Thomas wrote: > > Yeah I enable the debug mode and open the core file with gdb. I can see a > > huge backtrace with a lot of "index out of range" error inside. If you I can > > attach the backtrace on this mailing list. I found something which could solve your problem. The tls context is not initialized when used in client mode, there is a typo in the cfg-grammar.y file. Just go to the line 899 and replace ENABLE_TLS by ENABLE_SSL. -- Xavier ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

1 0