- syslog-ng - lists.balabit.hu

Convert logstash filters to syslog-ng
by C. L. Martinez 26 Apr '17

26 Apr '17

Hi all, I would like to drop Logstash collector from our ELK infrastructure and use syslog-ng instead. This ELK infrastructure collects, report and show dashboards about security devices: firewalls, anti-spam devices, etc. Most of these logs arrives from rsyslog collectors (deployed in several linux and BSD machines). I have seen in Balabit's blog page how this could be done: https://www.balabit.com/blog/how-to-parse-data-with-syslog-ng-store-in-elas… and https://www.balabit.com/blog/collecting-and-parsing-suricata-logs-using-sys…. The most important point here is to test all configured logstash filters inside syslog-ng: GeoIP patterns, some substitution params, etc. Any tips or tricks to accomplish this type of change? Many thanks. -- Greetings, C. L. Martinez

4 3

Getting log statistics file every 10 minutes.
by Jordan Ladora 25 Apr '17

25 Apr '17

Hello, After running normally for 6 or 7 days, starting at midnight, on my syslog-ng server running freebsd 11-Rel and syslog-ng 3.7.3_7 (installed with pkg), I started getting a Log statistics record every 10 minutes, which is excessive. This is only happening with a local log file designated in the .conf file like so- source s_local { system(); internal(); }; destination d_local { file("/var/log/sng_local"); }; log { source(s_local); destination(d_local); }; This is one of the entries I'm getting every 10min in the /var/log/sng_local file- Apr 25 12:00:02 logbox syslog-ng[370]: Log statistics; processed='source(s_network)=2602643', processed='destination(security)=18', processed='center(received)=2912379', processed='destination(ppp)=0', processed='src.internal(s_local#3)=894', stamp='src.internal(s_local#3)=1493139002', processed='center(queued)=3235133', processed='destination(console)=15635', processed='src.none()=0', stamp='src.none()=0', processed='destination(audit)=18', processed='destination(messages)=2595805', processed='destination(xferlog)=0', processed='global(payload_reallocs)=1703', processed='global(sdata_updates)=27054', processed='destination(allusers)=0', processed='destination(authlog)=391', processed='destination(maillog)=299021', processed='destination(consolelog)=0', processed='destination(lpd-errs)=0', processed='destination(cron)=14282', processed='destination(slip)=0', processed='global(msg_clones)=0', processed='source(s_local)=309736', processed='destination(d_local)=309736', processed='destination(debuglog)=227', processed='global(internal_queue_length)=0' What did I do to deserve this every 10 minutes?

2 2

Re: [syslog-ng] Unable to Filter Based On Facility into Different Files
by james.r.hendrick 21 Apr '17

21 Apr '17

flags (final) stops the professing in the first statement Sent from my Verizon, Samsung Galaxy smartphone -------- Original message --------From: wiskbroom(a)hotmail.com Date: 4/21/17 9:37 AM (GMT-05:00) To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Unable to Filter Based On Facility into Different Files Greetings! I am trying to rewrite syslog-ng.conf to create files based on facilities; one way for non-auth messages, another for all authentication messages (ssh, su, sudo, and console logins). I believe I have two issues with my statements below: 1. My ${HOST}- might be incorrect. 2. Am I able to write two filters for a single source? My single source in this case are Linux boxes, all sending their syslog traffic to my syslog-NG server with *.*. My statements below, comments and criticism very welcome. filter f_linux_secure { facility(authpriv) and level(info..emerg); }; filter f_linux_messages { level(info..emerg); }; destination d_linux_secure { file("/data/Linux/${HOST}-secure.log" owner("root") group("systems") perm(0640) dir_perm(0750) create_dirs(yes)); destination d_linux_messages { file("/data/Linux/${HOST}-messages.log" owner("root") group("systems") perm(0640) dir_perm(0750) create_dirs(yes)); log { source(s_remote); filter(f_linux_secure); destination(d_linux_secure); flags(final); }; log { source(s_remote); filter(f_linux_messages); destination(d_linux_messages); flags(final); }; Regards, Vadim Anatoly Pushkin

3 3

Unable to Filter Based On Facility into Different Files
by wiskbroom＠hotmail.com 21 Apr '17

21 Apr '17

Greetings! I am trying to rewrite syslog-ng.conf to create files based on facilities; one way for non-auth messages, another for all authentication messages (ssh, su, sudo, and console logins). I believe I have two issues with my statements below: 1. My ${HOST}- might be incorrect. 2. Am I able to write two filters for a single source? My single source in this case are Linux boxes, all sending their syslog traffic to my syslog-NG server with *.*. My statements below, comments and criticism very welcome. filter f_linux_secure { facility(authpriv) and level(info..emerg); }; filter f_linux_messages { level(info..emerg); }; destination d_linux_secure { file("/data/Linux/${HOST}-secure.log" owner("root") group("systems") perm(0640) dir_perm(0750) create_dirs(yes)); destination d_linux_messages { file("/data/Linux/${HOST}-messages.log" owner("root") group("systems") perm(0640) dir_perm(0750) create_dirs(yes)); log { source(s_remote); filter(f_linux_secure); destination(d_linux_secure); flags(final); }; log { source(s_remote); filter(f_linux_messages); destination(d_linux_messages); flags(final); }; Regards, Vadim Anatoly Pushkin

1 0

RSS memory grows when disk is full
by Arnob Ghosh 20 Apr '17

20 Apr '17

Hi, We are currently using syslog-ng version 3.3.6 . We are observing RSS memory growing issue for syslog-ng when destination disk is full. Is that an expected behavior , as the incoming message gets queued up in system RAM and thus RSS also will grow for syslog-ng process. Please correct me if I am wrong in understanding the same. Thanks, Arnob

1 0

down network during reload leads to blocking syslog() calls
by Nathan Parrish 18 Apr '17

18 Apr '17

Hi there, we are using syslog-ng 3.6.4 on Linux. we had an incident where the network port used for remote logging was inadvertently disabled for a couple hours, and during this time a critical process which logged via syslog() calls experienced threads hanging for seconds to minutes at a time. after some investigation and reproduction efforts, it looks like the problem is a combination of: - remote logging to server specified by hostname (vs. IP) - loss of management interface (e.g. that used for syslog traffic and DNS resolution) - log rotate triggering syslog-ng reload when I reproduce the problem (seems to take some considerable amount of logging load and a minute or so), I can see that writes to /dev/log hang: root@escort-ct0:/etc# strace -ttT logger test ^C 19:38:46.064830 execve("/usr/bin/logger", ["logger", "test"], [/* 26 vars */]) = 0 <0.000135> ... 19:38:46.069757 socket(PF_LOCAL, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 1 <0.000015> 19:38:46.069806 connect(1, {sa_family=AF_LOCAL, sun_path="/dev/log"}, 110) = 0 <0.000010> 19:38:46.069850 sendto(1, "<13>Mar 20 19:38:46 root: test", 30, MSG_NOSIGNAL, NULL, 0) = 30 <11.627190> 19:38:57.697110 close(1)= 0 <0.000490> meanwhile I see the main thread timing out name resolution: 19:48:18.214182 stat("/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=148, ...}) = 0 <0.000008> 19:48:18.214234 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 31 <0.000012> 19:48:18.214279 connect(31, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("10.15.83.11")}, 16) = 0 <0.000024> 19:48:18.214332 poll([{fd=31, events=POLLOUT}], 1, 0) = 1 ([{fd=31, revents=POLLOUT}]) <0.000006> 19:48:18.214370 sendto(31, "\343\235\1\0\0\1\0\0\0\0\0\0\rescdev-syslog\3dev\vpurestorage\3com\0\0\1\0\1", 51, MSG_NOSIGNAL, NULL, 0) = 51 <0.000047> 19:48:18.214444 poll([{fd=31, events=POLLIN}], 1, 5000) = 0 (Timeout) <5.005040> this repeats with the other DNS servers configured. I cannot reproduce the issue if I configure an IP instead of hostname for the syslog server. we are using UDP and no flow-control configuration, with the expectation that syslog() will never block. and, indeed, until the reload, it works as expected. however, after reload I guess we re-establish the socket for the remote connection, requiring us to resolve the hostname; I don’t pretend to understand how this ultimately backs up processing of /dev/log (note that internal() and kernel messages are coming through just fine during this time). I guess my question is whether this is a known/expected issue, and/or if there’s a resolution other than specifying remote syslog servers by IP or hardcoding the name resolution in /etc/hosts and pointing to that with dns-cache-hosts(). basically, I’d like syslog-ng to simply give up if it can’t resolve remote syslog server hostnames, rather than allow this to interfere with servicing of /dev/log, with ramifications to callers. thanks in advance, nathan

2 1

Insider 2017-04: Docker; Splunk HEC; Suricata; videos; upcoming events;
by Czanik, Péter 13 Apr '17

13 Apr '17

Dear syslog-ng users, This is the 57th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Central log server in Docker ---------------------------- Containerization, and Docker in particular, changed the way we distribute and run applications. Your central log server can also run in a Docker container. If you wish to deploy your log server running syslog-ng in a Docker container, it is available as a ready-to-use image from the Docker Hub, already passing 500K pulls. Read how at https://www.balabit.com/blog/central-log-server-docker/ Feeding the Splunk HTTP event collector --------------------------------------- Using the HTTP destination of syslog-ng, you can feed the Splunk HTTP event collector (HEC) with log messages. This can simplify your logging architecture, because there is no need to store data in files and to use a Splunk forwarder. Read more about how to configure it on the Splunk website at https://www.splunk.com/blog/2017/03/30/syslog-ng-and-hec-scalable-aggregate… syslog-ng PE 7.0.2 available ---------------------------- The latest syslog-ng Premium Edition release adds two interesting new features: you can write message parsers and template functions in Python and the monitoring() source allows you to granularly select which statistics of syslog-ng PE you want to monitor. https://www.balabit.com/blog/monitor-your-syslog-ng-architecture-easier/ Collecting and parsing Suricata logs ------------------------------------ You can use syslog-ng to collect and parse the JSON-based log messages of Suricata. Learn how you can send these logs to Loggly or Elasticsearch for further analysis or configure simple alerting within syslog-ng: https://www.balabit.com/blog/collecting-and-parsing-suricata-logs-using-sys… Tutorial videos --------------- Patrick Bailey (https://twitter.com/whiteboardcoder) created a couple of tutorial videos about syslog-ng. These cover installation and initial configuration on Ubuntu, opening a network port for collecting log messages and sending JSON-based log messages: - https://www.youtube.com/watch?v=DrfBU9nBeoE - https://www.youtube.com/watch?v=YAYfBteY0kg - https://www.youtube.com/watch?v=Uejb0agO2NU UPCOMING EVENTS You can learn about syslog-ng at a growing number of events: HEPIX Spring Workshop: https://indico.cern.ch/event/595396/ Big Data Universe: https://bdu.hu/ openSUSE conference: https://events.opensuse.org/conference/oSC17 NEW RELEASES syslog-ng PE 7.0.2: https://www.balabit.com/documents/syslog-ng-pe-7.0-guides/en/syslog-ng-pe-g… Your feedback and news, or tips about the next issue are welcome at documentation(a)balabit.com. To read this newsletter online, visit: https://syslog-ng.org/ Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0

syslog-ng buffer and reload
by Fabien Wernli 13 Apr '17

13 Apr '17

Hi, I'm using the disk queue to buffer the writes to elasticsearch. I notices the following behaviour: When reloading the configuration (`syslog-ng-ctl reload`), syslog-ng stops processing incoming messages (they appear as `dropped` in stats) and starts emptying the queue. It only starts accepting new messages when the queue is completely empty. I understand this is probably an expected behaviour, but in the following scenario (I just experienced) it poses a problem: 1. some application goes bananas logging at zillions of events per second 2. syslog-ng queue starts filling up 3. crazy app identified: I modify syslog-ng.conf in order to filter out the app 4. syslog-ng-ctl reload 5. syslog-ng starts dropping all new messages and emptying the queue 6. I have to wait for the queue to be empty (which can take a long time) Wouldn't it be saner to continue accepting messages when intercepting the HUP?

4 6

is it exist some way to extract the filename listened by file() ?
by Jorge Pereira 08 Apr '17

08 Apr '17

Hi Team, Well, I am working on a POC using the syslog-ng 3.7.1, basically, I have many of log files that the filename is /path/<file> and I need to append the file name into the syslog payload. My current approach is. 1. I have the below destination() receiving the file name as a parameter. <snip> block destination d_collector_with_fn(__filename("")) { tcp("192.168.2.44" port(514) keep-alive(on) template("$DATE $HOST $MSGHDR $(format-json --scope selected_macros \ --exclude TAGS \ --exclude DATE \ --exclude PRIORITY \ --exclude FACILITY \ --exclude SOURCEIP \ --exclude PROGRAM \ --pair SYSLOG_WEBAPP_DOMAIN='`__filename`' \ --pair SOURCE=${SOURCE} )\n") template-escape(no) ); }; </snip> 2. My simple script called by confgen create some dynamic "log {}" statements listening to the files and appending the filename as a parameter to the d_collector_with_fn() <snip> log { source { file("/path/thisisafile001.net" program_override("mytag") follow_freq(1) flags(no-parse) ); }; destination { d_collector_with_fn(__filename("thisisafile001.net")); }; }; log { source { file("caipirinha4ever.net" program_override("mytag") follow_freq(1) flags(no-parse) ); }; destination { d_collector_with_fn(__filename("caipirinha4ever.net")); }; }; ......................... </snip> But, I have more than 5k files and my current approach creating multiples log { } statement resulting in one connection to the collector by each file!!! in this case, I have 5k connections... this is terrible, someone has some other suggestion? exist some way to catch the filename by some internal ${variable} and pass for a single destination()? -- Jorge Pereira

3 7

set mysql charset & collation
by Nik Ambrosch 04 Apr '17

04 Apr '17

I’m having a hard time getting the charset and collation of mysql tables set with syslog-ng: it needs to be utf8 (or utf8mb4) and from the documentation I’m under the impression that I can do something like this in order to set session variables: session-statements("set character_set_database=utf8mb4","set collation_database=utf8mb4_unicode_ci”) …however it’s not working - new tables are still being created as latin1. As far as I’m aware there’s also not a way to specify the charset/collation of a new table via syslog-ng either, right? Any ideas?

1 0

syslog-ng on FreeBSD
by Czanik, Péter 29 Mar '17

29 Mar '17

Hi, Last weekend syslog-ng 3.9.1 became available on FreeBSD in the sysutils/syslog-ng-devel port. The default syslog-ng port, sysutils/syslog-ng still points to syslog-ng 3.7. If you use syslog-ng on FreeBSD, please test 3.9.1 as I plan to promote 3.9.1 as the default syslog-ng version in ports. (I am only aware of a single problem when upgrading from earlier versions to 3.9.1, but that's Linux only: https://github.com/balabit/syslog-ng/issues/1395) Let me know, if you run into any troubles with 3.9.1, so it can be fixed before the change. Thanks, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0

patterndb Joining rulesets with mismatching program name sets
by Fabien Wernli 29 Mar '17

29 Mar '17

Hi, It seems somewhere between 3.7 and 3.8 my patterndb broke validation tests. When running `pdbtool test` I now get: Joining rulesets with mismatching program name sets This helpful message seems to be right if I understand it correctly: <ruleset name='pam_unix' id='72d75cb0-0107-4d12-b0bf-cea36ddf7f38'> <patterns> <pattern>sshd</pattern> <pattern>crond</pattern> <pattern>imap</pattern> <pattern>imapd</pattern> <pattern>login</pattern> <pattern>pam</pattern> <pattern>pure-ftpd</pattern> <pattern>proftpd</pattern> <pattern>su</pattern> <pattern>sudo</pattern> <ruleset name='cron' id='3a8efec5-6974-4b4a-b203-3247fe235812'> <patterns> <pattern>crond</pattern> <pattern>CROND</pattern> </patterns> Since when, and why is this illegal now? Thanks

3 5

Fwd: Memory Leak in syslog-ng 3.9.1
by Arnob Ghosh 28 Mar '17

28 Mar '17

Hi, We are observing memory leak with syslog-ng 3.9.1 while testing with Valgrind in x86 system. Please find attached valgrind report with below command. G_SLICE=always-malloc valgrind -v --log-file=valgrind.log --leak-check=full --show-leak-kinds=all syslog-ng -F --enable-core ==2104== Memcheck, a memory error detector ==2104== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al. ==2104== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info ==2104== Command: syslog-ng -F --enable-core ==2104== Parent PID: 2103 ==2104== --2104-- --2104-- Valgrind options: --2104-- -v --2104-- --log-file=valgrind.log --2104-- --leak-check=full --2104-- Contents of /proc/version: --2104-- Linux version 3.10.104.cge-rt117 (ferret@bamboo) (gcc version 4.7.0 (MontaVista Linux G++ 4.7-170301090024) ) #1 SMP PREEMPT Thu Mar 9 08:50:32 IST 2017 --2104-- Arch and hwcaps: AMD64, LittleEndian, amd64-cx16-lzcnt-rdtscp-sse3-avx-avx2-bmi --2104-- Page sizes: currently 4096, max supported 4096 --2104-- Valgrind library directory: /usr/lib64/valgrind --2104-- Reading syms from /usr/sbin/syslog-ng --2104-- Considering /usr/sbin/syslog-ng .. --2104-- .. CRC mismatch (computed 6ecb1f66 wanted 2175c4e1) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/valgrind/memcheck-amd64-linux --2104-- Considering /usr/lib64/valgrind/memcheck-amd64-linux .. --2104-- .. CRC mismatch (computed a66f1e19 wanted 8057359b) --2104-- object doesn't have a symbol table --2104-- object doesn't have a dynamic symbol table --2104-- Reading syms from /lib64/ld-2.16.so --2104-- Considering /lib64/ld-2.16.so .. --2104-- .. CRC mismatch (computed bcd9793b wanted d7ac4eab) --2104-- Considering /lib64/.debug/ld-2.16.so .. --2104-- .. CRC is valid --2104-- Scheduler: using generic scheduler lock implementation. --2104-- Reading suppressions file: /usr/lib64/valgrind/default.supp ==2104== embedded gdbserver: reading from /tmp/vgdb-pipe-from-vgdb-to-2104-by-root-on-??? ==2104== embedded gdbserver: writing to /tmp/vgdb-pipe-to-vgdb-from-2104-by-root-on-??? ==2104== embedded gdbserver: shared mem /tmp/vgdb-pipe-shared-mem-vgdb-2104-by-root-on-??? ==2104== ==2104== TO CONTROL THIS PROCESS USING vgdb (which you probably ==2104== don't want to do, unless you know exactly what you're doing, ==2104== or are doing some strange experiment): ==2104== /usr/lib64/valgrind/../../bin/vgdb --pid=2104 ...command... ==2104== ==2104== TO DEBUG THIS PROCESS USING GDB: start GDB like this ==2104== /path/to/gdb syslog-ng ==2104== and then give GDB the following command ==2104== target remote | /usr/lib64/valgrind/../../bin/vgdb --pid=2104 ==2104== --pid is optional if only one valgrind process is running ==2104== --2104-- REDIR: 0x3331417930 (ld-linux-x86-64.so.2:strlen) redirected to 0x380742d1 (???) --2104-- Reading syms from /usr/lib64/valgrind/vgpreload_core-amd64-linux.so --2104-- Considering /usr/lib64/valgrind/vgpreload_core-amd64-linux.so .. --2104-- .. CRC mismatch (computed 12fcda0f wanted d650c1e1) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so --2104-- Considering /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so .. --2104-- .. CRC mismatch (computed 112626bf wanted 5a5b2993) --2104-- object doesn't have a symbol table ==2104== WARNING: new redirection conflicts with existing -- ignoring it --2104-- old: 0x3331417930 (strlen ) R-> (0000.0) 0x380742d1 ??? --2104-- new: 0x3331417930 (strlen ) R-> (2007.0) 0x04a09500 strlen --2104-- REDIR: 0x3331417880 (ld-linux-x86-64.so.2:index) redirected to 0x4a090e0 (index) --2104-- REDIR: 0x3331417900 (ld-linux-x86-64.so.2:strcmp) redirected to 0x4a0a5b0 (strcmp) --2104-- REDIR: 0x3331418940 (ld-linux-x86-64.so.2:mempcpy) redirected to 0x4a0ce90 (mempcpy) --2104-- Reading syms from /usr/lib64/libsyslog-ng-3.9.so.0.0.0 --2104-- Considering /usr/lib64/libsyslog-ng-3.9.so.0.0.0 .. --2104-- .. CRC mismatch (computed 145c4fb7 wanted 143409f9) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/libssl.so.1.0.0 --2104-- Considering /usr/lib64/libssl.so.1.0.0 .. --2104-- .. CRC mismatch (computed bff95ff2 wanted e1f317f8) --2104-- object doesn't have a symbol table --2104-- Reading syms from /lib64/libcrypto.so.1.0.0 --2104-- Considering /lib64/libcrypto.so.1.0.0 .. --2104-- .. CRC mismatch (computed 0f7afdd4 wanted 67e91cbf) --2104-- object doesn't have a symbol table --2104-- Reading syms from /lib64/libuuid.so.1.3.0 --2104-- Considering /lib64/libuuid.so.1.3.0 .. --2104-- .. CRC mismatch (computed e44bde93 wanted bee5b57e) --2104-- object doesn't have a symbol table --2104-- Reading syms from /lib64/libnsl-2.16.so --2104-- Considering /lib64/libnsl-2.16.so .. --2104-- .. CRC mismatch (computed a4a8f693 wanted c21578ab) --2104-- Considering /lib64/.debug/libnsl-2.16.so .. --2104-- .. CRC is valid --2104-- Reading syms from /usr/lib64/libgmodule-2.0.so.0.3400.3 --2104-- Considering /usr/lib64/libgmodule-2.0.so.0.3400.3 .. --2104-- .. CRC mismatch (computed 56b50299 wanted 0faed9bb) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/libgthread-2.0.so.0.3400.3 --2104-- Considering /usr/lib64/libgthread-2.0.so.0.3400.3 .. --2104-- .. CRC mismatch (computed e16c9722 wanted 49f05f96) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/libglib-2.0.so.0.3400.3 --2104-- Considering /usr/lib64/libglib-2.0.so.0.3400.3 .. --2104-- .. CRC mismatch (computed 8b7f406d wanted d25a28ff) --2104-- object doesn't have a symbol table --2104-- Reading syms from /lib64/libpthread-2.16.so --2104-- Considering /lib64/libpthread-2.16.so .. --2104-- .. CRC mismatch (computed c0d22d21 wanted b4f3247d) --2104-- Considering /lib64/.debug/libpthread-2.16.so .. --2104-- .. CRC is valid --2104-- Reading syms from /lib64/librt-2.16.so --2104-- Considering /lib64/librt-2.16.so .. --2104-- .. CRC mismatch (computed 2d230dcc wanted efd16a99) --2104-- Considering /lib64/.debug/librt-2.16.so .. --2104-- .. CRC is valid --2104-- Reading syms from /usr/lib64/libevtlog.so.0.0.0 --2104-- Considering /usr/lib64/libevtlog.so.0.0.0 .. --2104-- .. CRC mismatch (computed 6a1cc924 wanted 5502f762) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/libpcre.so.1.2.7 --2104-- Considering /usr/lib64/libpcre.so.1.2.7 .. --2104-- .. CRC mismatch (computed 610e8772 wanted b6a438f6) --2104-- object doesn't have a symbol table --2104-- Reading syms from /lib64/libdl-2.16.so --2104-- Considering /lib64/libdl-2.16.so .. --2104-- .. CRC mismatch (computed 6231c842 wanted 8e630476) --2104-- Considering /lib64/.debug/libdl-2.16.so .. --2104-- .. CRC is valid --2104-- Reading syms from /lib64/libc-2.16.so --2104-- Considering /lib64/libc-2.16.so .. --2104-- .. CRC mismatch (computed 89e7ac0b wanted 542d8abb) --2104-- Considering /lib64/.debug/libc-2.16.so .. --2104-- .. CRC is valid --2104-- REDIR: 0x3331885e60 (libc.so.6:strcasecmp) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331882210 (libc.so.6:strnlen) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331888130 (libc.so.6:strncasecmp) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x33318822f0 (libc.so.6:strncmp) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331880600 (libc.so.6:strcmp) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331883c00 (libc.so.6:__GI_strrchr) redirected to 0x4a08df0 (__GI_strrchr) --2104-- REDIR: 0x3331882130 (libc.so.6:__GI_strlen) redirected to 0x4a09460 (__GI_strlen) --2104-- REDIR: 0x3331882330 (libc.so.6:__GI_strncmp) redirected to 0x4a09bf0 (__GI_strncmp) --2104-- REDIR: 0x333187c210 (libc.so.6:malloc) redirected to 0x4a088a0 (malloc) --2104-- REDIR: 0x33318820e0 (libc.so.6:strlen) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x333194ca10 (libc.so.6:__strlen_sse2_pminub) redirected to 0x4a09440 (strlen) --2104-- REDIR: 0x333188a810 (libc.so.6:memcpy@@GLIBC_2.14) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331931dd0 (libc.so.6:__memcpy_ssse3_back) redirected to 0x4a0a980 (memcpy@@GLIBC_2.14) --2104-- REDIR: 0x333187cbc0 (libc.so.6:calloc) redirected to 0x4a06730 (calloc) --2104-- REDIR: 0x33319244c0 (libc.so.6:__strcasecmp_avx) redirected to 0x4a09d40 (strcasecmp) --2104-- REDIR: 0x3331883ca0 (libc.so.6:strpbrk) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331924230 (libc.so.6:__strpbrk_sse42) redirected to 0x4a0d240 (strpbrk) --2104-- REDIR: 0xffffffffff600000 (???:???) redirected to 0x380742b3 (???) --2104-- REDIR: 0x3331899810 (libc.so.6:strstr) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x333191f060 (libc.so.6:__strstr_sse42) redirected to 0x4a0d1b0 (__strstr_sse42) --2104-- REDIR: 0x3331880540 (libc.so.6:index) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x333191d080 (libc.so.6:__strchr_sse42) redirected to 0x4a08fe0 (index) --2104-- REDIR: 0x3331883b80 (libc.so.6:strncpy) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x33318905e0 (libc.so.6:__strncpy_sse2_unaligned) redirected to 0x4a09a50 (__strncpy_sse2_unaligned) --2104-- REDIR: 0x333191d130 (libc.so.6:__strcmp_sse42) redirected to 0x4a0a560 (__strcmp_sse42) --2104-- REDIR: 0x333187c800 (libc.so.6:free) redirected to 0x4a07600 (free) --2104-- REDIR: 0x3331885cc0 (libc.so.6:stpcpy) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x33318915c0 (libc.so.6:__stpcpy_sse2_unaligned) redirected to 0x4a0c0a0 (__stpcpy_sse2_unaligned) --2104-- REDIR: 0x333187c890 (libc.so.6:realloc) redirected to 0x4a08aa0 (realloc) --2104-- REDIR: 0x3331884c40 (libc.so.6:memset) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331884c80 (libc.so.6:__GI_memset) redirected to 0x4a0c440 (memset) --2104-- REDIR: 0x333188bd10 (libc.so.6:strchrnul) redirected to 0x4a0cab0 (strchrnul) --2104-- REDIR: 0x333188a860 (libc.so.6:__GI_memcpy) redirected to 0x4a0aee0 (__GI_memcpy) --2104-- REDIR: 0x333191dee0 (libc.so.6:__strncmp_sse42) redirected to 0x4a09cd0 (__strncmp_sse42) --2104-- REDIR: 0x3331885d00 (libc.so.6:__GI_stpcpy) redirected to 0x4a0bf00 (__GI_stpcpy) --2104-- REDIR: 0x3331884630 (libc.so.6:bcmp) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331947340 (libc.so.6:__memcmp_sse4_1) redirected to 0x4a0bd40 (__memcmp_sse4_1) --2104-- REDIR: 0xffffffffff600400 (???:???) redirected to 0x380742bd (???) --2104-- REDIR: 0x33318994b0 (libc.so.6:__GI_strstr) redirected to 0x4a0d120 (__strstr_sse2) --2104-- REDIR: 0x33318842e0 (libc.so.6:memchr) redirected to 0x4a0a650 (memchr) --2104-- REDIR: 0x333188f970 (libc.so.6:__GI_strncpy) redirected to 0x4a097f0 (__GI_strncpy) --2104-- REDIR: 0x3331925b30 (libc.so.6:__strncasecmp_avx) redirected to 0x4a09e20 (strncasecmp) --2104-- REDIR: 0x3331880640 (libc.so.6:__GI_strcmp) redirected to 0x4a0a4c0 (__GI_strcmp) --2104-- Reading syms from /lib64/libnss_files-2.16.so --2104-- Considering /lib64/libnss_files-2.16.so .. --2104-- .. CRC mismatch (computed b7fe16f9 wanted c162f3cb) --2104-- Considering /lib64/.debug/libnss_files-2.16.so .. --2104-- .. CRC is valid --2104-- REDIR: 0x3331881ad0 (libc.so.6:__GI_strcpy) redirected to 0x4a095f0 (__GI_strcpy) --2104-- REDIR: 0x333188bac0 (libc.so.6:rawmemchr) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x333188bb00 (libc.so.6:__GI___rawmemchr) redirected to 0x4a0cb00 (__GI___rawmemchr) --2104-- Reading syms from /lib64/libnss_mdns4_minimal.so.2 --2104-- Considering /lib64/libnss_mdns4_minimal.so.2 .. --2104-- .. CRC mismatch (computed ede24083 wanted 0166de0d) --2104-- object doesn't have a symbol table --2104-- Reading syms from /lib64/libnss_dns-2.16.so --2104-- Considering /lib64/libnss_dns-2.16.so .. --2104-- .. CRC mismatch (computed 581b33f0 wanted efff06f8) --2104-- Considering /lib64/.debug/libnss_dns-2.16.so .. --2104-- .. CRC is valid --2104-- Reading syms from /lib64/libresolv-2.16.so --2104-- Considering /lib64/libresolv-2.16.so .. --2104-- .. CRC mismatch (computed 2b73909b wanted 4a30a1ca) --2104-- Considering /lib64/.debug/libresolv-2.16.so .. --2104-- .. CRC is valid --2104-- Reading syms from /lib64/libnss_mdns4.so.2 --2104-- Considering /lib64/libnss_mdns4.so.2 .. --2104-- .. CRC mismatch (computed 0cc691af wanted d88c289b) --2104-- object doesn't have a symbol table --2104-- REDIR: 0x3331884a70 (libc.so.6:__GI_memmove) redirected to 0x4a0c740 (__GI_memmove) --2104-- Reading syms from /usr/lib64/syslog-ng/libaffile.so --2104-- Considering /usr/lib64/syslog-ng/libaffile.so .. --2104-- .. CRC mismatch (computed 75ff58c4 wanted 6ceb6e1a) --2104-- object doesn't have a symbol table --2104-- REDIR: 0x3331418a90 (ld-linux-x86-64.so.2:stpcpy) redirected to 0x4a0c240 (stpcpy) --2104-- Discarding syms at 0x5a52eb0-0x5a580c8 in /usr/lib64/syslog-ng/libaffile.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libafprog.so --2104-- Considering /usr/lib64/syslog-ng/libafprog.so .. --2104-- .. CRC mismatch (computed 33d79891 wanted 38df833f) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a50c50-0x5a53ae8 in /usr/lib64/syslog-ng/libafprog.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libkvformat.so --2104-- Considering /usr/lib64/syslog-ng/libkvformat.so .. --2104-- .. CRC mismatch (computed a685392d wanted 0d0a3f36) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4fe80-0x5a520b8 in /usr/lib64/syslog-ng/libkvformat.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libadd-contextual-data.so --2104-- Considering /usr/lib64/syslog-ng/libadd-contextual-data.so .. --2104-- .. CRC mismatch (computed 3905c9b5 wanted 05577ff3) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a50cb0-0x5a53248 in /usr/lib64/syslog-ng/libadd-contextual-data.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libcef.so --2104-- Considering /usr/lib64/syslog-ng/libcef.so .. --2104-- .. CRC mismatch (computed 4be76a8f wanted c38742c5) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4dcb0-0x5a4e238 in /usr/lib64/syslog-ng/libcef.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libdate.so --2104-- Considering /usr/lib64/syslog-ng/libdate.so .. --2104-- .. CRC mismatch (computed 2879a739 wanted bf0a6250) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4f9f0-0x5a52168 in /usr/lib64/syslog-ng/libdate.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libcryptofuncs.so --2104-- Considering /usr/lib64/syslog-ng/libcryptofuncs.so .. --2104-- .. CRC mismatch (computed ca734dd6 wanted 6492f3d6) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4e070-0x5a4e508 in /usr/lib64/syslog-ng/libcryptofuncs.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libpseudofile.so --2104-- Considering /usr/lib64/syslog-ng/libpseudofile.so .. --2104-- .. CRC mismatch (computed 6a282fe2 wanted 2aaa9e3f) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4f6e0-0x5a51118 in /usr/lib64/syslog-ng/libpseudofile.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/liblinux-kmsg-format.so --2104-- Considering /usr/lib64/syslog-ng/liblinux-kmsg-format.so .. --2104-- .. CRC mismatch (computed cc160b54 wanted 2547ea5a) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4dbc0-0x5a4e7e8 in /usr/lib64/syslog-ng/liblinux-kmsg-format.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libsyslogformat.so --2104-- Considering /usr/lib64/syslog-ng/libsyslogformat.so .. --2104-- .. CRC mismatch (computed 8799a4da wanted 3a04cfa7) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4fd40-0x5a53138 in /usr/lib64/syslog-ng/libsyslogformat.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libcsvparser.so --2104-- Considering /usr/lib64/syslog-ng/libcsvparser.so .. --2104-- .. CRC mismatch (computed 991af95b wanted f7306355) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4fc00-0x5a517d8 in /usr/lib64/syslog-ng/libcsvparser.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libdbparser.so --2104-- Considering /usr/lib64/syslog-ng/libdbparser.so .. --2104-- .. CRC mismatch (computed c7d22793 wanted 2dc4d4e8) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a56860-0x5a62a98 in /usr/lib64/syslog-ng/libdbparser.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libdisk-buffer.so --2104-- Considering /usr/lib64/syslog-ng/libdisk-buffer.so .. --2104-- .. CRC mismatch (computed 6b87b880 wanted 75803ff5) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a510d0-0x5a56588 in /usr/lib64/syslog-ng/libdisk-buffer.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libafuser.so --2104-- Considering /usr/lib64/syslog-ng/libafuser.so .. --2104-- .. CRC mismatch (computed be65199f wanted f4d26998) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4f340-0x5a50918 in /usr/lib64/syslog-ng/libafuser.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libconfgen.so --2104-- Considering /usr/lib64/syslog-ng/libconfgen.so .. --2104-- .. CRC mismatch (computed 0236a91a wanted 8d6d9a19) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4dd50-0x5a4e208 in /usr/lib64/syslog-ng/libconfgen.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libafstomp.so --2104-- Considering /usr/lib64/syslog-ng/libafstomp.so .. --2104-- .. CRC mismatch (computed ab8d437d wanted f040ecae) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a51000-0x5a54108 in /usr/lib64/syslog-ng/libafstomp.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libgraphite.so --2104-- Considering /usr/lib64/syslog-ng/libgraphite.so .. --2104-- .. CRC mismatch (computed 5f29ba28 wanted d29a0f96) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4df90-0x5a4e5a8 in /usr/lib64/syslog-ng/libgraphite.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libafsocket.so --2104-- Considering /usr/lib64/syslog-ng/libafsocket.so .. --2104-- .. CRC mismatch (computed 9ce8515e wanted cbb9d1f4) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a557a0-0x5a5cac8 in /usr/lib64/syslog-ng/libafsocket.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libbasicfuncs.so --2104-- Considering /usr/lib64/syslog-ng/libbasicfuncs.so .. --2104-- .. CRC mismatch (computed cd95d630 wanted 6620ef09) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4ff40-0x5a52058 in /usr/lib64/syslog-ng/libbasicfuncs.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libsystem-source.so --2104-- Considering /usr/lib64/syslog-ng/libsystem-source.so .. --2104-- .. CRC mismatch (computed e87f0e6c wanted dd3a8c65) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4df10-0x5a4e9d8 in /usr/lib64/syslog-ng/libsystem-source.so due to munmap() --2104-- Reading syms from /lib64/libnss_compat-2.16.so --2104-- Considering /lib64/libnss_compat-2.16.so .. --2104-- .. CRC mismatch (computed 66a1b543 wanted eea82e2f) --2104-- Considering /lib64/.debug/libnss_compat-2.16.so .. --2104-- .. CRC is valid --2104-- REDIR: 0x3331880580 (libc.so.6:__GI_strchr) redirected to 0x4a08f20 (__GI_strchr) --2104-- Reading syms from /usr/lib64/syslog-ng/libafsocket.so --2104-- Considering /usr/lib64/syslog-ng/libafsocket.so .. --2104-- .. CRC mismatch (computed 9ce8515e wanted cbb9d1f4) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/syslog-ng/libaffile.so --2104-- Considering /usr/lib64/syslog-ng/libaffile.so .. --2104-- .. CRC mismatch (computed 75ff58c4 wanted 6ceb6e1a) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/syslog-ng/libafuser.so --2104-- Considering /usr/lib64/syslog-ng/libafuser.so .. --2104-- .. CRC mismatch (computed be65199f wanted f4d26998) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/syslog-ng/libsyslogformat.so --2104-- Considering /usr/lib64/syslog-ng/libsyslogformat.so .. --2104-- .. CRC mismatch (computed 8799a4da wanted 3a04cfa7) --2104-- object doesn't have a symbol table --2104-- REDIR: 0x3331884bf0 (libc.so.6:memcpy@GLIBC_2.2.5) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331937370 (libc.so.6:__memmove_ssse3_back) redirected to 0x4a0a720 (memcpy(a)GLIBC_2.2.5) ==2104== Thread 3: ==2104== Invalid read of size 8 ==2104== at 0x3334043DFA: g_list_prepend (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x33348334D8: dns_caching_thread_deinit (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482CCC8: app_thread_stop (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x33348423F8: main_loop_worker_thread_stop (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871C70: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871EDF: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871122: iv_run_tasks (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873403: iv_main (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871C12: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873B56: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3332007DFE: start_thread (pthread_create.c:308) ==2104== by 0x33318E639C: clone (clone.S:114) ==2104== Address 0x4db9e40 is 16 bytes inside a block of size 24 free'd ==2104== at 0x4A0766C: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==2104== by 0x333406306F: g_slice_free_chain_with_offset (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x3334833564: dns_caching_global_deinit (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482CC89: app_shutdown (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x40171F: main (in /usr/sbin/syslog-ng) ==2104== ==2104== Invalid write of size 8 ==2104== at 0x3334043E0B: g_list_prepend (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x33348334D8: dns_caching_thread_deinit (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482CCC8: app_thread_stop (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x33348423F8: main_loop_worker_thread_stop (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871C70: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871EDF: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871122: iv_run_tasks (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873403: iv_main (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871C12: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873B56: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3332007DFE: start_thread (pthread_create.c:308) ==2104== by 0x33318E639C: clone (clone.S:114) ==2104== Address 0x4db9e40 is 16 bytes inside a block of size 24 free'd ==2104== at 0x4A0766C: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==2104== by 0x333406306F: g_slice_free_chain_with_offset (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x3334833564: dns_caching_global_deinit (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482CC89: app_shutdown (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x40171F: main (in /usr/sbin/syslog-ng) ==2104== --2104-- Discarding syms at 0x50211e0-0x50281d8 in /lib64/libnss_files-2.16.so due to munmap() --2104-- Discarding syms at 0x522caf0-0x522d768 in /lib64/libnss_mdns4_minimal.so.2 due to munmap() --2104-- Discarding syms at 0x542f0b0-0x5432198 in /lib64/libnss_dns-2.16.so due to munmap() --2104-- Discarding syms at 0x5637a30-0x5643ed8 in /lib64/libresolv-2.16.so due to munmap() --2104-- Discarding syms at 0x584bbb0-0x584c938 in /lib64/libnss_mdns4.so.2 due to munmap() --2104-- Discarding syms at 0x5a52370-0x5a56d28 in /lib64/libnss_compat-2.16.so due to munmap() ==2104== ==2104== HEAP SUMMARY: ==2104== in use at exit: 121,871 bytes in 3,300 blocks ==2104== total heap usage: 11,707 allocs, 8,407 frees, 829,833 bytes allocated ==2104== ==2104== Searching for pointers to 3,300 not-freed blocks ==2104== Checked 17,360,560 bytes ==2104== ==2104== Thread 1: ==2104== 502 (128 direct, 374 indirect) bytes in 1 blocks are definitely lost in loss record 678 of 725 ==2104== at 0x4A08910: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==2104== by 0x333404D290: g_malloc (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x3334834D53: g_process_set_argv_space (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x4015AC: main (in /usr/sbin/syslog-ng) ==2104== ==2104== 608 bytes in 2 blocks are possibly lost in loss record 683 of 725 ==2104== at 0x4A067B0: calloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==2104== by 0x3331410EF9: allocate_dtv (dl-tls.c:296) ==2104== by 0x333141163D: _dl_allocate_tls (dl-tls.c:460) ==2104== by 0x33320085F4: allocate_stack (allocatestack.c:570) ==2104== by 0x33320085F4: pthread_create@@GLIBC_2.2.5 (pthread_create.c:460) ==2104== by 0x3334873C8B: iv_thread_create (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871B0E: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334872290: iv_work_pool_submit_work (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871122: iv_run_tasks (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873403: iv_main (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334841E53: main_loop_run (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x401713: main (in /usr/sbin/syslog-ng) ==2104== ==2104== 765 (360 direct, 405 indirect) bytes in 3 blocks are definitely lost in loss record 690 of 725 ==2104== at 0x4A067B0: calloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==2104== by 0x333404D2E8: g_malloc0 (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x333485B952: log_filter_pipe_new (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x33348320D1: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334831EB6: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333483210E: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334831EB6: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334832451: cfg_tree_compile_rule (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x33348325CA: cfg_tree_compile (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334832668: cfg_tree_start (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482D3DD: cfg_init (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334841AFF: main_loop_initialize_state (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== ==2104== LEAK SUMMARY: ==2104== definitely lost: 488 bytes in 4 blocks ==2104== indirectly lost: 779 bytes in 27 blocks ==2104== possibly lost: 608 bytes in 2 blocks ==2104== still reachable: 119,996 bytes in 3,267 blocks ==2104== suppressed: 0 bytes in 0 blocks ==2104== Reachable blocks (those to which a pointer was found) are not shown. ==2104== To see them, rerun with: --leak-check=full --show-leak-kinds=all ==2104== ==2104== ERROR SUMMARY: 5 errors from 5 contexts (suppressed: 1 from 1) ==2104== ==2104== 1 errors in context 1 of 5: ==2104== Thread 3: ==2104== Invalid write of size 8 ==2104== at 0x3334043E0B: g_list_prepend (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x33348334D8: dns_caching_thread_deinit (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482CCC8: app_thread_stop (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x33348423F8: main_loop_worker_thread_stop (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871C70: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871EDF: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871122: iv_run_tasks (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873403: iv_main (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871C12: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873B56: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3332007DFE: start_thread (pthread_create.c:308) ==2104== by 0x33318E639C: clone (clone.S:114) ==2104== Address 0x4db9e40 is 16 bytes inside a block of size 24 free'd ==2104== at 0x4A0766C: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==2104== by 0x333406306F: g_slice_free_chain_with_offset (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x3334833564: dns_caching_global_deinit (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482CC89: app_shutdown (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x40171F: main (in /usr/sbin/syslog-ng) ==2104== ==2104== ==2104== 1 errors in context 2 of 5: ==2104== Invalid read of size 8 ==2104== at 0x3334043DFA: g_list_prepend (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x33348334D8: dns_caching_thread_deinit (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482CCC8: app_thread_stop (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x33348423F8: main_loop_worker_thread_stop (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871C70: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871EDF: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871122: iv_run_tasks (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873403: iv_main (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871C12: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873B56: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3332007DFE: start_thread (pthread_create.c:308) ==2104== by 0x33318E639C: clone (clone.S:114) ==2104== Address 0x4db9e40 is 16 bytes inside a block of size 24 free'd ==2104== at 0x4A0766C: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==2104== by 0x333406306F: g_slice_free_chain_with_offset (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x3334833564: dns_caching_global_deinit (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482CC89: app_shutdown (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x40171F: main (in /usr/sbin/syslog-ng) ==2104== --2104-- --2104-- used_suppression: 1 dl-hack3-cond-1 /usr/lib64/valgrind/default.supp:1206 ==2104== ==2104== ERROR SUMMARY: 5 errors from 5 contexts (suppressed: 1 from 1) When we are running logger application with emergency priority for long time we find RSS memory is getting increased very fast from 13K to 24K and syslog-ng is getting killed with OOM Killer. Thanks, Arnob

1 0

throttle parser
by Fabien Wernli 27 Mar '17

27 Mar '17

Hi, How would you suggest to throttle matching messages in a log path? I know there's the `throttle` option in many destinations, but I'd like to be able to do this upstream, e.g. in patterndb or better in the path directly. It would be awesome to be able to do: log { source(…); junction { channel { filter(…); throttle(100); }; channel { flags(fallback); }; }; destination(…); }; wouldn't it?

1 0

Does Syslog-NG Support Multiline Messages
by Traiano Welcome 26 Mar '17

26 Mar '17

Hi Does syslog-ng support multiline log messages? Thanks, Traiano

4 5

Syslog-ng time stamp reporting issue.
by vijay amruth 24 Mar '17

24 Mar '17

Hello guys, Hope everyone is doing great. I have run into a issue where syslog-ng reports time in MST when the source is in UTC and we want in UTC, how do we control this ? Source (UTC) --------> Syslog-ng server (UTC) but syslog is writing logs in MST. Any help is appreciated. Thank you, Vijay Amrut.

2 1

Re: [syslog-ng] Is it possible to include a external python script?
by Jorge Pereira 22 Mar '17

22 Mar '17

Hi Balázs, Thanks for the answer. But, My question is: It is possible to include a external python script. e.g: $ cat foobar.conf: python { @include "caipirinha.py" } template-function foobar "$(python foobar)" $ cat caipirinha.py from foobar import foobar_template_function # my python class/code is separated ........... $ got it? maybe using the "confgen" module? -- Jorge Pereira On Mon, Mar 20, 2017 at 2:35 AM, Scheidler, Balázs < balazs.scheidler(a)balabit.com> wrote: > Hi, > > The example Python code should be unindented, or you see a different error? > > Also, you can always import code in the python block. > > With destinations you can specify a path to a python file, so the python > block is not needed. But with template functions I've figured the $(python) > call would be too crowded if we were passing explicit filename parameters. > > But you can encapsulate the python code as well as a wrapper to the python > code into a separate file. > > Foobar.conf: > > python { > > from foobar import foobar_template_function > > } > > template-function foobar "$(python foobar)" > > ---------- > > Then you can use: > > @include "Foobar.conf" > > ... > template("$(foobar)"); > ... > > Unfortunately then template function declarations cant take parameters yet > from the callsite, which may be a serious limitation in your use-case. But > with a conceot above you can completely hide implementation details your > actual config. > > On Mar 20, 2017 03:53, "Jorge Pereira" <jpereiran(a)gmail.com> wrote: > >> Well, based on this[1] document. We should use the *python {}* statement. >> But, I would like to keep my python script externally in a separated file >> and do something like. >> >> python filter_001 { >> /my/script/python001.py >> } >> >> log { >> .... >> filter(filter_001); >> .... >> }; >> >> p.s: Btw, this sample https://www.balabit.com >> /documents/syslog-ng-ose-3.7-guides/en/syslog-ng-ose-guide- >> admin/html-single/index.html#example-python-template-functions >> don't work in the syslog-ng 3.9.1 >> >> [1] https://www.balabit.com/sites/default/files/documents/syslog >> -ng-ose-3.7-guides/en/syslog-ng-ose-v3.7-guide-admin/html-si >> ngle/index.html#example-python-template-functions >> -- >> Jorge Pereira >> >> ____________________________________________________________ >> __________________ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: http://www.balabit.com/support/documentation/?product= >> syslog-ng >> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >> >> >> > ____________________________________________________________ > __________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/? > product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > >

4 6

Is it possible to include a external python script?
by Jorge Pereira 20 Mar '17

20 Mar '17

Well, based on this[1] document. We should use the *python {}* statement. But, I would like to keep my python script externally in a separated file and do something like. python filter_001 { /my/script/python001.py } log { .... filter(filter_001); .... }; p.s: Btw, this sample https://www.balabit.com/documents/syslog-ng-ose-3.7-guides/en/syslog-ng-ose… don't work in the syslog-ng 3.9.1 [1] https://www.balabit.com/sites/default/files/documents/ syslog-ng-ose-3.7-guides/en/syslog-ng-ose-v3.7-guide- admin/html-single/index.html#example-python-template-functions -- Jorge Pereira

2 1

syslog-ng 3.9.x & mod-lua is deprecated?
by Jorge Pereira 20 Mar '17

20 Mar '17

Hi, syslog-ng 3.9.x & mod-lua is deprecated? btw, is it possible to enable the mod-lua in the 3.9.x? I am asking because using Lua is more easy to port the Lua scripts/decoder/encoders from the heka to syslog-ng. -- Jorge Pereira

2 2

Insider 2017-03: Docker; Central Log Management; Hadoop & Kafka performance; SCALE 2017;
by Czanik, Péter 16 Mar '17

16 Mar '17

Dear syslog-ng users, This is the 56th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Docker: 500K+ pulls ------------------- There are over 500K pulls for the syslog-ng image from the Docker hub at https://hub.docker.com/u/balabit/. You can use one of the -dev images if you want to compile syslog-ng yourself. If you use any of these images, share your use case and experiences with us. Gartner & RSA: Central Log Management ------------------------------------- With the increased reliance on analytics to drive security operations, IT security professionals are paying particular attention to one of the oldest tools in their toolbox, log management. A recently released report by Gartner focuses on the role of Central Log Management (CLM) in improving threat monitoring and detection: https://www.balabit.com/blog/renaissance-central-log-management/ The key takaway from the RSA conference was also CLM: https://www.balabit.com/blog/key-takeaways-about-central-log-management-fro… Upcoming webinar about CLM: https://pages2.balabit.com/central-log-management-webinar/ Hadoop and Kafka performance ---------------------------- The syslog-ng application has been supporting Hadoop and Kafka destinations for some time now, as it is an integral part of a versatile central log management solution. Seamless integration is great, but what about performance? Read our blogs to learn more: Hadoop: https://www.balabit.com/blog/testing-performace-log-streaming-hdfs-syslog-n… Kafka: https://www.balabit.com/blog/testing-the-performance-of-log-streaming-to-ka… SCALE 2017 ---------- It is the third year that syslog-ng has participated at Southern California Linux Expo or, as better known to many, SCALE ‒ the largest Linux event in the USA. Balabit had a booth in the expo area and on Sunday I gave a presentation on how to deal with security logs using syslog-ng. Read more at https://www.balabit.com/blog/syslog-ng-scale-2017/ Your feedback and news, or tips about the next issue are welcome at documentation(a)balabit.com. To read this newsletter online, visit: https://syslog-ng.org/ Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0

hashing and verify
by Domenico Vitali 15 Mar '17

15 Mar '17

Dear all, I am writing a syslog-ng configuration able to rewrite (or templating) the MESSAGE macro of a syslog entry in such way that it includes its own hash. Consider for example the line: Mar 15 08:23:15 void systemd[1]: Started System Logger Daemon. i would like to rewrite the message obtaining this output: Mar 15 08:23:15 void systemd[1]: Started System Logger Daemon. hash: 87602bdc780a764ae26f30ddc3f09176 where "8ba7a67ce6ac67b9facb6a14b3095960" is the hash of the line (md5, sha1 or other hash funcition). I evaluate both the use of the template function as well as the use of the rewrite module. Unfortunatelly, once i got the line with the hash i can't understand how to verify if the hash is correct. In contrast, when I evalute the hash using the command line, the hash values mismatch. $ echo "Mar 15 08:23:15 void systemd[1]: Started System Logger Daemon." | md5sum - 8ba7a67ce6ac67b9facb6a14b3095960 - In order to perform my test I'm using this configuration: --------------------------------------------------------------------------- source sourcetest { file("/var/log/md5/input.log" flags(no-parse)); }; rewrite msghashing { set("$(md5 $MESSAGE)", value("MYMESS")); set ("-$MESSAGE- hash: $MYMESS", value("MESSAGE"), on-error("fallback-to-string")); }; destination testdestination { file("/var/log/md5/output.log"); }; log { source( sourcetest ); rewrite( msghashing ); # rewrite( r_rewrite_host ); destination( testdestination ); }; --------------------------------------------------------------------------- i can't find any hint in the documentation files, does anybody knows how can i correctly verify the hash ? Is the syslog-ng software using a salt by default ? thanks a lot, -- Domenico

2 1

syslog-ng in docker
by Czanik, Péter 13 Mar '17

13 Mar '17

Hi, Recently I figured out, that there are 500K+ pulls for syslog-ng from the docker hub: https://hub.docker.com/u/balabit/ On the other hand I don't know a single actual user of it yet. If you are one of them, let me know your use case and experiences! Also, if you are on Twitter, help spreading the word and re-tweet: https://twitter.com/PCzanik/status/841192391512059906 Thanks, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0

Increase file descriptors for syslog-ng.
by vijay amruth 11 Mar '17

11 Mar '17

Hello everyone, Hope you are all doing great. I am running into some issues with syslog-ng file descriptors, I have tried to set up ulimit -n value to 65535, *open files (-n) 65535* set the parameter to the follwoing in /etc/sysctl.conf, *fs.file-max = 512000* and tried raising the value with syslog-ng --fd-limit <number>, I get the following error ####syslog-ng --fd-limit 8192 WARNING: Configuration file format is too old, syslog-ng is running in compatibility mode Please update it to use the syslog-ng 3.5 format at your time of convinience, compatibility mode can operate less efficiently in some cases. To upgrade the configuration, please review the warnings about incompatible changes printed by syslog-ng, and once completed change the @version header at the top of the configuration file.; WARNING: global: the default value of log_fifo_size() has changed to 10000 in syslog-ng 3.3 to reflect log_iw_size() changes for tcp()/udp() window size changes; Using a global log-fetch-limit() option was removed, please use a per-source log-fetch-limit(); WARNING: window sizing for tcp sources were changed in syslog-ng 3.3, the configuration value was divided by the value of max-connections(). The result was too small, clamping to 100 entries. Ensure you have a proper log_fifo_size setting to avoid message loss.; orig_log_iw_size='0', new_log_iw_size='100', min_log_fifo_size='1300000' and I am unable to stop the syslog-ng service using systemctl, it immediately re-starts, I am using centOS 7.2, I have noticed few other people on the internet had the same problem, please advice, any help is appreciated. *OS: CentOS 7.2* *Hardware : VM* *Problems : 1) Unable to increase the file descriptors for syslog-ng. 2) Unable to stop the service using systemctl stop command, it automatically restarts right after with a new pid.* Thanks, Vijay Amrut.

4 4

Can't get basic syslog to work for my firewall logs?
by Tim Tyler 10 Mar '17

10 Mar '17

Syslog-ng experts. I am very new to syslog-ng. I installed syslog-ng on a fresh Redhat 7.3 server. It defaults working with internal logging. So I configured my firewall to send syslog with facility set to log_user. I turned on Wireshark on the syslog-ng server and observed the firewall sending traffic to the server on udp 514. But the syslog server never created the directory structure and logs. I disabled the redhat firewall just to eliminate it as a possibility. Still no logging. So I don’t know what I am doing wrong at this point. I don’t know if this is a permission problem or some other configuration issue. I found someone that had posted a very basic syslog-ng configuration for firewalls. So I copied It into a firewall.conf I put in conf.d. Can anyone see what might be wrong with it? #################### options { create_dirs(yes); owner(root); group(root); perm(0640); dir_owner(root); dir_group(root); dir_perm(0750); }; ################################################## source s_udp { udp(port(514)); }; #Template for a new firewall in the firewalls.conf file #Entries to be changed: NAMEOFTHEFIREWALL and IPOFTHEFIREWALL ################################################## filter f_NAMEOFTHEFIREWALL { host("192.168.30.1"); }; destination d_NAMEOFTHEFIREWALL { file("/var/log/firewalls/PA/$YEAR/$MONTH/$YEAR-$MONTH-$DAY.PA.log"); }; log { source(s_udp); filter(f_NAMEOFTHEFIREWALL); destination(d_NAMEOFTHEFIREWALL); }; Tim Tyler Network Engineer Beloit College

6 8

syslog-ng lock ups
by Evan Rempel 07 Mar '17

07 Mar '17

I have been having a problem with syslog-ng where is just stops processing all input. There are destinations that receive and count all of the messages that come out of syslog-ng and they stop getting any messages. This is occurring on two syslog servers that have similar configurations. One is a superset of the simpler one. On these hosts we run two syslog-ng instances. One for the regular OS log messages from /dev/lo, /proc/kmsg, localhost:1514 and the second one which only listens on the network port(s) which we call our syslog server. The syslog server has its internal log messages going to localhost:1514 so any internal events such as new connections etc should be logged to the "OS syslog" instance. We had this problem on 3.7.x and after upgrading to 3.9.1 we still encounter this problem. The OS is now the latest Redhat 6 (6.8), but the same problem occurred on any Redhat 6.x system. Our host monitoring shows that the syslog-ng process did NOT increase its memory footprint which indicates that it stopped reading its source. All of the hosts that send logs to syslog server showed increased message queueing which confirms that the source stopped being read. The CPU consumption by the syslog-ng process is zero during this time period. Our network monitoring infrastructure opens a connection to the syslog server every 30 seconds. This gets logged via the localhost:1514 connection. These accepted and closed log lines are missing during our problem window even though the monitoring tool WAS able to connect through the entire problem window. We have configured the syslog stats log line to be sent to an external program which invokes syslog-ng-ctl stats and it processes this data. This process did not get any such stats line, so the exact syslog-ng stats counters are unavailable during this problem window. The syslog-ng-ctl program was NOT hung on the socket. Attempting a graceful shutdown of the syslog-ng process either with syslog-ng-ctl or with a kill -TERM appears to have no affect. I assume this is because syslog-ng is unable to flush its buffers so it does not terminate. Killing syslog-ng and restarting it starts processing again correctly. Has anyone else had this symptom? Has anyone found a solution to this? I realize that this is all anecdotal but was hoping it would trigger someone's memory. Thanks in advance. Evan.

2 1