- syslog-ng - lists.balabit.hu

Structured Data
by Ou, Jimmy 01 Apr '14

01 Apr '14

Hello, I am having problem removing the structured data in the syslog message. My test logs show the following: <113>1 2014-11-25T11:00:00+00:00 10.1.1.1 RedBox - - [meta sequenceId="16"] @cee:[{"host":"10.1.1.1"}] I want it to look like the following without the sequenceId tag: <113>1 2014-11-25T11:00:00+00:00 10.1.1.1 RedBox - - - @cee:[{"host":"10.1.1.1"}] Is there an option to turn this meta data off? Thanks, Jimmy

2 2

Filter out host from netmask range
by Ian Hasund 31 Mar '14

31 Mar '14

I am trying to remove a specific set of hosts from a network range using filters. for example, I have the following: filter f_home_subnet { ( netmask("192.168.0.0/24") ); }; I now want to exclude some specific hosts, let's say 192.168.0.10 and 192.168.0.20. My attempts of adding "not host" to the above doesn't seem to work. Any pointers / suggestions would be greatly appreciated. Thanks, Ian

3 4

pattern-db parser
by Justin B 31 Mar '14

31 Mar '14

Hello I have the Syslog-ng edition that came in built with Solaris Operating system and I did not find the pattern-db.xml or the default directory where it exists. Can I still create manually and use the Pattern-db parser?? I would want to use this on the operating system logs. Appreciate your response on this -- Kaladhar

2 1

Timestamp format
by Ou, Jimmy 28 Mar '14

28 Mar '14

Hello, I am having trouble using the timestamp formatter. The document says I can use ts_format() as rfc3164, bsd, rfc3339, or iso. I've tried multiple values and have gotten the same result. I've tried putting the ts_format(rfc3339) in the global options and in the destination's syslog() and have gotten the same result. My test logs show the following no matter what ts_format I set: <113>1 2014-11-25T11:00:00+00:00 10.1.1.1 RedBox - I want it to look like the following: <113>1 2014-11-25T11:00:00.000Z 10.1.1.1 RedBox - Am I missing something? Thanks, Jimmy Ou

2 1

[Bug 274] New: 3.5.4.1 memory leak
by bugzilla＠bugzilla.balabit.com 27 Mar '14

27 Mar '14

https://bugzilla.balabit.com/show_bug.cgi?id=274 Summary: 3.5.4.1 memory leak Product: syslog-ng Version: 3.5.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 in our production environment our syslog process consumed 8GB of RAM while not queueing any messages. We take 10 minute syslog-ng-ctl stats snapshots and 15 minute process (ps -ef) style snapshots. There is definitely a memory leak there somewhere. We run multiple pattern databases, with multiple json output streams along side regular file destinations. What would you like from me to track it down? - valgrind - core dump - recompile with debuggin? If you provide the flags, I'll provide the data :-) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

How to assign specific value in a pattern
by C. L. Martinez 27 Mar '14

27 Mar '14

Hi all, I need to assign a specific value to only one pattern inside a ruleset with multiple patterns. For example, I have defined the following patterns for one ruleset: <ruleset name="kernel" id='1002'> <pattern>kernel</pattern> <rules> <rule provider="By me" class='1002' id='1002'> <patterns> <pattern>pattern1</pattern> <pattern>pattern2</pattern> <pattern>pattern3</pattern> </patterns> </rule> </rules> </ruleset> The I need to do the following: <ruleset name="kernel" id='1002'> <pattern>kernel</pattern> <rules> <rule provider="By me" class='1002' id='1002'> <patterns> <pattern>pattern1</pattern> <pattern>pattern2</pattern> <values> <value name="mytestvalue">Downloaded file</value> </values> <pattern>pattern3</pattern> </patterns> </rule> </rules> </ruleset> As you can see I need to assign "Downloaded file" value to "mytestvalue" but only for pattern2 and not the others ... At this time, value "mytestvalue" is assigned to all patterns ... Is it possible to do this??

2 4

syslog-ng Potential Memory Leak
by Tamayo, Andres 26 Mar '14

26 Mar '14

Hello, I have been testing syslog-ng under different scenarios and I noticed that when syslog-ng is trying to connect to an external syslog-ng server, it exhibits what could be called a memory leak. Let me explain how I am setting up my test. I have a syslog-ng client running collecting logs from a file (source) and sending them to an external syslog-ng server over TCP (destination). If the syslog-ng server is online, the syslog-ng client daemon process virtual memory does not increase. Now, when I kill the syslog-ng server, the syslog-ng client daemon process starts to request more and more virtual memory. Here are the details: I started both the syslog-ng client and server and started to send logs from the client to the server. At this point, the syslog-ng client daemon maintained its VmSize equal to 7144 Kbytes. This condition was stable for 4 hours while the server was online. Then, after 4 hours, I killed the syslog-ng server. As soon as I did that, the syslog-ng client daemon virtual memory size started to increate every few seconds. Started at 7144 Kbytest and after 4 hours VmSize was equal to 7752 Kbytes. So it grew 608 Kbytes over the next 4 hours. Finally, after the 4 hours I just mentioned, I restarted the syslog-ng server. All the logs that had not been sent for 4 hours were transmitted to the syslog-ng server in a few seconds. At this point, the syslog-ng client daemon virtual memory stopped growing and stayed stable for 4 hours. I think that this behavior may be related to the logs generated every time the client tries to reconnect with the server. By the way, the client time_reopen configuration was set to 15 seconds. I am worried that over a long long period of time, if the syslog-ng server is not online, the syslog-ng client daemon may be killed by the OS for using too much memory. Please let me know if you have any ideas how to fix this problem, thank you.

3 4

Re: [syslog-ng] odd behavior writing "binary" logfiles - followup data
by jrhendri＠roadrunner.com 25 Mar '14

25 Mar '14

and in the self-inflicted wounds category... I did some additional digging on the box and discovered what certainly *appears* to be the cause: [a0142566@vxpip-eeisl001 ~]$ grep host /etc/nsswitch.conf #hosts: db files nisplus nis dns hosts: files dns [a0142566@vxpip-eeisl001 ~]$ [a0142566@vxpip-eeisl001 ~]$ diff /etc/hosts /etc/hosts.03162014 2c2 < 10.177.74.55 vxpip-eeisl001 --- > 10.177.74.55 . vxpip-eeisl001 [a0142566@vxpip-eeisl001 ~]$ I fixed this and then re-ran some tests using the attached syslog-ng.conf.DEBUG and the following invocation: sudo strace /usr/local/sbin/syslog-ng -vde -f /usr/local/etc/syslog-ng.conf.DEBUG > /tmp/syslog-ng-DEBUG-strace 2>&1 and things look MUCH better. [a0142566@vxpip-eeisl001 etc]$ file /var/log/debug* /var/log/debug.messages.vxpip-eeisl001.auth.info: ASCII text /var/log/debug.messages.vxpip-eeisl001.authpriv.notice: ASCII text /var/log/debug.messages.vxpip-eeisl001.cron.info: ASCII text /var/log/debug.network_messages.vddp13e-0d6b677: ASCII text /var/log/debug.template_messages: ASCII text [a0142566@vxpip-eeisl001 etc]$ Note: I also found another system that has the same config error: [a0142566@vxkip-eeisl001 ~]$ cat /etc/hosts 127.0.0.1 localhost.localdomain localhost 10.181.73.32 . vxkip-eeisl001 and ran a quick test through a resolver perl script that does (basically) this: my $iaddr = inet_aton($thingy); if (my $name = gethostbyaddr($iaddr,AF_INET)) { print "$thingy,\t$name\n"; } [a0142566@vxkip-eeisl001 ~]$ echo 10.181.73.32 | ~/bin/resolve.pl 10.181.73.32, . Sorry again for bothering the list (I really should have caught that!!... And yes – I will be bringing this to the OS team’s attention :-) Although it does raise a point that (maybe) a default value like "please_fix_my_hostname" could be used in case this happens elsewhere? Just a thought. Thank you again!! Jim ---- Jim Hendrick <jrhendri(a)roadrunner.com> wrote: > I will take some time today and re-run this with various debugging flags. > > (just realized I should have... ) > > On 03/15/2014 09:37 PM, jrhendri(a)roadrunner.com wrote: > > Odd - I do not see any gethost calls at all in the strace > > > > this is from "sudo strace /usr/local/sbin/syslog-ng -f /usr/local/etc/syslog-ng.conf > syslog-strace 2>&1" > > > > > > I include the config.status and config.log also to see if that may help. > > > > Jim > > > > > > ---- Balazs Scheidler <bazsi77(a)gmail.com> wrote: > >> During startup syslog-ng queries the hostname using gethostname. Can you > >> strace syslog-ng and look for this call to see what it returns? > >> > >> We are also resolving this using the dns which is also interesting. > >> > >> Thanks > >> On Mar 13, 2014 7:08 PM, <jrhendri(a)roadrunner.com> wrote: > >> > >>> OK - after much poking around (including testing this on a different host > >>> with this morning's latest source) here's what I found > >>> > >>> I believe that syslog-ng is (for some reason) unable to come up with a > >>> correct hostname for the local system. > >>> I would really like to know why this is happening > >>> I would also really like to know if any of the source options I tried > >>> should have worked (I was kind of desperate with some of the combinations...) > >>> > >>> That said - here's my summary: > >>> > >>> Examining the "binary" files, It was always writing 256 bytes of "0" where > >>> ${HOST} should have been. > >>> > >>> It *never* happened with a network source (tried with Kiwi sysloggen using > >>> RCF and non RCF messages) > >>> It *always* happened with any local source including all the ones > >>> commented out (I tested each separately) > >>> > >>> source s_local { > >>> unix-dgram("/dev/log"); # standard Linux log source (this is the default > >>> place for the syslog() function to send logs to) > >>> #!# unix-stream("/dev/log"); # standard Linux log source (this is the > >>> default place for the syslog() function to send logs to) > >>> #!# system(); > >>> #!# internal(); > >>> }; > >>> > >>> Once I identified this behavior, I tried a number of options / > >>> combinations to work around this including (each separately) > >>> source s_local { > >>> system(); > >>> #!# system( keep_hostname(no) host_override("localhost") ); > >>> #!# system( keep_hostname(yes) host_override("localhost") ); > >>> #!# system( flags(no-parse) host_override("localhost") ); > >>> #!# system( flags(no-hostname) host_override("localhost") ); > >>> #!# system( flags(no-parse) ); > >>> #!# system( flags(no-hostname) ); > >>> #!# internal( ); > >>> }; > >>> > >>> And nothing worked. > >>> > >>> Finally I kinda punted... I am now doing something really kludgy as a work > >>> around: > >>> source s_local { > >>> system(); > >>> internal( ); > >>> }; > >>> > >>> source s_network { > >>> udp(); > >>> }; > >>> > >>> destination d_local_template { > >>> > >>> file("/data/syslog-ng/$YEAR/$MONTH/$DAY/localhost/localhost.$FACILITY.$PRIORITY.$DATE" > >>> template("${ISODATE} localhost ${PROGRAM} ${MESSAGE}\n") ); > >>> }; > >>> > >>> > >>> destination d_network { > >>> > >>> file("/data/syslog-ng/$YEAR/$MONTH/$DAY/$HOST_FROM/$HOST_FROM.$FACILITY.$PRIORITY.$DATE"); > >>> }; > >>> > >>> log { > >>> source(s_local); > >>> destination(d_local_template); > >>> }; > >>> > >>> log { > >>> source(s_network); > >>> destination(d_network); > >>> }; > >>> > >>> > >>> ---- jrhendri(a)roadrunner.com wrote: > >>>> I have a really odd problem that I hope someone can assist with. > >>>> > >>>> My install is inserting a number of zeroes into the logfile between the > >>> date and the rest of the message. > >>>> Here are some details: > >>>> > >>>> System is RHEL: > >>>> > >>>> $ uname -a > >>>> Linux vxpip-eeisl001 2.6.32-358.el6.x86_64 #1 SMP Tue Jan 29 11:47:41 > >>> EST 2013 x86_64 x86_64 x86_64 GNU/Linux > >>>> $ > >>>> > >>>> > >>>> Syslog-ng was built on the box yesterday with these sources: > >>>> eventlog-0.2.12+20120504+1700 > >>>> syslog-ng-3.5.3 > >>>> > >>>> > >>>> $ /usr/local/sbin/syslog-ng --version > >>>> syslog-ng 3.5.3 > >>>> Installer-Version: 3.5.3 > >>>> Revision: ssh+git://algernon@git.balabit > >>> /var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.5#master#ccb05a22408ba4c837d998b2538854d994f845a5 > >>>> Compile-Date: Mar 12 2014 11:37:32 > >>>> Available-Modules: > >>> afmongodb,afstomp,syslogformat,affile,basicfuncs,csvparser,confgen,system-source,afamqp,linux-kmsg-format,afprog,afuser,afsocket,dbparser,cryptofuncs,afsocket-notls > >>>> Enable-Debug: off > >>>> Enable-GProf: off > >>>> Enable-Memtrace: off > >>>> Enable-IPv6: on > >>>> Enable-Spoof-Source: off > >>>> Enable-TCP-Wrapper: off > >>>> Enable-Linux-Caps: off > >>>> Enable-Pcre: off > >>>> > >>>> > >>>> > >>>> This is the default config file that came with it: > >>>> > >>>> > >>>> > >>> ############################################################################# > >>>> # Default syslog-ng.conf file which collects all local logs into a > >>>> # single file called /var/log/messages. > >>>> # > >>>> > >>>> @version: 3.5 > >>>> @include "scl.conf" > >>>> > >>>> source s_local { > >>>> system(); > >>>> internal(); > >>>> }; > >>>> > >>>> source s_network { > >>>> udp(); > >>>> }; > >>>> > >>>> destination d_local { > >>>> file("/var/log/messages"); > >>>> }; > >>>> > >>>> log { > >>>> source(s_local); > >>>> > >>>> # uncomment this line to open port 514 to receive messages > >>>> #source(s_network); > >>>> destination(d_local); > >>>> }; > >>>> > >>>> > >>>> > >>>> Here is the file: > >>>> > >>>> > >>>> $ sudo file /var/log/messages > >>>> /var/log/messages: data > >>>> $ sudo cat /var/log/messages > >>>> Mar 13 10:43:00 syslog-ng[18451]: syslog-ng starting up; version='3.5.3' > >>>> Mar 13 10:43:01 CROND[18454]: (root) CMD (/util/avail/get_avail.sh > >>> 1>/util/avail/logs/get_avail.out 2>&1) > >>>> Mar 13 10:43:16 sudo: a0142566 : TTY=pts/2 ; PWD=/home/a0142566 ; > >>> USER=root ; COMMAND=/usr/bin/file /var/log/messages > >>>> And this is a capture from vi in hex mode on that file. > >>>> > >>>> > >>>> 0000000: 4d61 7220 3133 2031 303a 3433 3a30 3020 Mar 13 10:43:00 > >>>> 0000010: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 0000020: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 0000030: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 0000040: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 0000050: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 0000060: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 0000070: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 0000080: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 0000090: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 00000a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 00000b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 00000c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 00000d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 00000e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 00000f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 0000100: 0000 0000 0000 0000 0000 0000 0000 0020 ............... > >>>> 0000110: 7379 736c 6f67 2d6e 675b 3138 3435 315d syslog-ng[18451] > >>>> 0000120: 3a20 7379 736c 6f67 2d6e 6720 7374 6172 : syslog-ng star > >>>> 0000130: 7469 6e67 2075 703b 2076 6572 7369 6f6e ting up; version > >>>> 0000140: 3d27 332e 352e 3327 0a4d 6172 2031 3320 ='3.5.3'.Mar 13 > >>>> 0000150: 3130 3a34 333a 3031 2000 0000 0000 0000 10:43:01 ....... > >>>> 0000160: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 0000170: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 0000180: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 0000190: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 00001a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 00001b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 00001c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 00001d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 00001e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 00001f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 0000200: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 0000210: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 0000220: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 0000230: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 0000240: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > >>>> 0000250: 0000 0000 0000 0000 2043 524f 4e44 5b31 ........ CROND[1 > >>>> 0000260: 3834 3534 5d3a 2028 726f 6f74 2920 434d 8454]: (root) CM > >>>> 0000270: 4420 282f 7574 696c 2f61 7661 696c 2f67 D (/util/avail/g > >>>> 0000280: 6574 5f61 7661 696c 2e73 6820 313e 2f75 et_avail.sh 1>/u > >>>> 0000290: 7469 6c2f 6176 6169 6c2f 6c6f 6773 2f67 til/avail/logs/g > >>>> 00002a0: 6574 5f61 7661 696c 2e6f 7574 2032 3e26 et_avail.out 2>& > >>>> 00002b0: 3129 0a4d 6172 2031 3320 3130 3a34 333a 1). > >>>> > >>>> > >>>> Any ideas? > >>>> Thanks in advance folks!! > >>>> Jim > >>>> > >>>> > >>>> > >>> ______________________________________________________________________________ > >>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > >>>> Documentation: > >>> http://www.balabit.com/support/documentation/?product=syslog-ng > >>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >>>> > >>> > >>> ______________________________________________________________________________ > >>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > >>> Documentation: > >>> http://www.balabit.com/support/documentation/?product=syslog-ng > >>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >>> > >>> > >>> > >>> > >>> ______________________________________________________________________________ > >>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > >>> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > >>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >>> >

2 1

syslog-ng ports in FreeBSD
by Peter Czanik 25 Mar '14

25 Mar '14

Hi, Right now syslog-ng 3.4 is the default syslog-ng port in FreeBSD (sysutils/syslog-ng) and 3.5 is available as sysutils/sysog-ng-devel. With the latest bugfix release I consider 3.5 good enough to become the default. Before making the switch, I'd wait one more week and would like you to test the 3.5 port and share your experiences. Using 3.5 also has the additional benefit, that one can use the freshly introduced sysutils/syslog-ng-incubator port. The incubator adds many interesting modules to syslog-ng: https://github.com/balabit/syslog-ng-incubator , this port supports most of it, except for Riemann. Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 1

GSoC2014: Information for students
by Gergely Nagy 20 Mar '14

20 Mar '14

Hi! I believe I contacted everyone who submitted a proposal by now, but I know there are some, who are still writing it, and I'd like to reach out to everyone interested and involved: since we would like to allow our students to improve their proposal past the application deadline, and would also like to re-use the same page for progress reports and other informations (such as repo urls) during the programme itself, I'd like to ask all of you, to write your proposals on our GitHub wiki[1], and on Melange, the content of the proposal should be a link to the created wiki page. [1]: https://github.com/balabit/syslog-ng/wiki/GSoC2014-Proposals If you already wrote a proposal on Melange, copying it over should be simple, as both Melange and GitHub accept Markdown. But if you need help, and the linked page above isn't clear or complete enough, please let me know, and I'll do my best to help. Apologies for the inconvenience! Also, all students who submitted a proposal will receive a small, topic-related task this afternoon, which we would like you to complete. It shouldn't take more than an afternoon, I hope, but I'll be available on all the usual channels (IRC, twitter, email, etc) to answer any questions. Cheers, and thanks in advance! -- |8]

1 0

GSoC: Proposal Submitted
by Rajul Srivastava 17 Mar '14

17 Mar '14

Hello, I have submitted my proposal regarding ' Type Hinting from the start' for GSoC 2014. It is at the link https://www.google-melange.com/gsoc/proposal/review/student/google/gsoc2014… I shall request you all to review it and make some suggestions and comments on how I can improve it. I am particularly worried about the timeline, if I have not given ample time to tasks. Any suggestion or criticism is more that welcome. Regards, Rajul -- Rajul Final year Undergraduate Student, Department of Chemistry, Indian Institute of Technology Kharagpur

2 3

Background/foreground problem
by Hardcastle, Iain (CBC - Hamilton) 17 Mar '14

17 Mar '14

Hi all, Odd one I've come across, cant find any clues on the web so figured I'd post here. Trying to get syslog-ng integrated into the Observium NMS package. Not sure whether the problem lies with syslog-ng, PHP or the sucking of data into Observium. Let me explain: With syslog-ng started in foreground mode 'syslog-ng -Fevd' everything works as expected. I see syslog packets coming in via tcpdump, I see the log flash up on the terminal and it correctly routes into the right part of the Observium front end. With syslog-ng started as a daemon (from boot - the desired config setup - or with 'service syslog-ng start'), nothing gets to Observium. I can still see the syslog packets in tcpdump obviously but I'm blind as to what happens to the messages after that. One thing I have noticed is that when running syslog-ng in foreground mode, I see "Starting destination program; cmdline='/opt/observium/syslog.php'" in the startup messages and a corresponding process in the 'ps -lax' output "php /opt/observium/syslog.php" With syslog-ng started as a daemon, I do not see this php process in the ps output.. Bit stuck as to where to look next. Has anyone seen this behavior before? Centos6.5 and standard packages and configs. System works great otherwise. Syslog-ng config file in its entirety below: options { chain_hostnames(0); flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (1); }; source s_net { udp(); }; destination d_observium { program("/opt/observium/syslog.php" template ("$HOST||$FACILITY||$PRIORITY||$LEVEL||$TAG||$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC||$MS G||$PROGRAM\n") template-escape(yes)); }; log { source(s_net); destination(d_observium); }; Any ideas? iain Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee, and its network of member firms, each of which is a legally separate and independent entity. Please see http://www.deloitte.com/about for a detailed description of the legal structure of Deloitte Touche Tohmatsu Limited and its member firms.

2 2

odd behavior writing "binary" logfiles
by jrhendri＠roadrunner.com 17 Mar '14

17 Mar '14

I have a really odd problem that I hope someone can assist with. My install is inserting a number of zeroes into the logfile between the date and the rest of the message. Here are some details: System is RHEL: $ uname -a Linux vxpip-eeisl001 2.6.32-358.el6.x86_64 #1 SMP Tue Jan 29 11:47:41 EST 2013 x86_64 x86_64 x86_64 GNU/Linux $ Syslog-ng was built on the box yesterday with these sources: eventlog-0.2.12+20120504+1700 syslog-ng-3.5.3 $ /usr/local/sbin/syslog-ng --version syslog-ng 3.5.3 Installer-Version: 3.5.3 Revision: ssh+git://algernon@git.balabit/var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.5#master#ccb05a22408ba4c837d998b2538854d994f845a5 Compile-Date: Mar 12 2014 11:37:32 Available-Modules: afmongodb,afstomp,syslogformat,affile,basicfuncs,csvparser,confgen,system-source,afamqp,linux-kmsg-format,afprog,afuser,afsocket,dbparser,cryptofuncs,afsocket-notls Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-Linux-Caps: off Enable-Pcre: off This is the default config file that came with it: ############################################################################# # Default syslog-ng.conf file which collects all local logs into a # single file called /var/log/messages. # @version: 3.5 @include "scl.conf" source s_local { system(); internal(); }; source s_network { udp(); }; destination d_local { file("/var/log/messages"); }; log { source(s_local); # uncomment this line to open port 514 to receive messages #source(s_network); destination(d_local); }; Here is the file: $ sudo file /var/log/messages /var/log/messages: data $ sudo cat /var/log/messages Mar 13 10:43:00 syslog-ng[18451]: syslog-ng starting up; version='3.5.3' Mar 13 10:43:01 CROND[18454]: (root) CMD (/util/avail/get_avail.sh 1>/util/avail/logs/get_avail.out 2>&1) Mar 13 10:43:16 sudo: a0142566 : TTY=pts/2 ; PWD=/home/a0142566 ; USER=root ; COMMAND=/usr/bin/file /var/log/messages And this is a capture from vi in hex mode on that file. 0000000: 4d61 7220 3133 2031 303a 3433 3a30 3020 Mar 13 10:43:00 0000010: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000020: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000030: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000040: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000050: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000060: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000070: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000080: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000090: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000100: 0000 0000 0000 0000 0000 0000 0000 0020 ............... 0000110: 7379 736c 6f67 2d6e 675b 3138 3435 315d syslog-ng[18451] 0000120: 3a20 7379 736c 6f67 2d6e 6720 7374 6172 : syslog-ng star 0000130: 7469 6e67 2075 703b 2076 6572 7369 6f6e ting up; version 0000140: 3d27 332e 352e 3327 0a4d 6172 2031 3320 ='3.5.3'.Mar 13 0000150: 3130 3a34 333a 3031 2000 0000 0000 0000 10:43:01 ....... 0000160: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000170: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000180: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000190: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00001a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00001b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00001c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00001d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00001e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00001f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000200: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000210: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000220: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000230: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000240: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000250: 0000 0000 0000 0000 2043 524f 4e44 5b31 ........ CROND[1 0000260: 3834 3534 5d3a 2028 726f 6f74 2920 434d 8454]: (root) CM 0000270: 4420 282f 7574 696c 2f61 7661 696c 2f67 D (/util/avail/g 0000280: 6574 5f61 7661 696c 2e73 6820 313e 2f75 et_avail.sh 1>/u 0000290: 7469 6c2f 6176 6169 6c2f 6c6f 6773 2f67 til/avail/logs/g 00002a0: 6574 5f61 7661 696c 2e6f 7574 2032 3e26 et_avail.out 2>& 00002b0: 3129 0a4d 6172 2031 3320 3130 3a34 333a 1). Any ideas? Thanks in advance folks!! Jim

3 4

Re: [syslog-ng] odd behavior writing "binary" logfiles - followup data
by Jim Hendrick 14 Mar '14

14 Mar '14

Will do. Probably tomorrow at the earliest. Jim Sent from my Verizon Wireless 4G LTE Smartphone -------- Original message -------- From: Balazs Scheidler <bazsi77(a)gmail.com> Date:03/14/2014 5:33 PM (GMT-05:00) To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] odd behavior writing "binary" logfiles - followup data During startup syslog-ng queries the hostname using gethostname. Can you strace syslog-ng and look for this call to see what it returns? We are also resolving this using the dns which is also interesting. Thanks On Mar 13, 2014 7:08 PM, <jrhendri(a)roadrunner.com> wrote: OK - after much poking around (including testing this on a different host with this morning's latest source) here's what I found I believe that syslog-ng is (for some reason) unable to come up with a correct hostname for the local system. I would really like to know why this is happening

1 0

error while loading shared libraries
by Pete Perreault 14 Mar '14

14 Mar '14

Hi- I had syslog-ng 3.5.3 operational without an issue. I wanted to implement the smtp driver so installed libesmtp and then re-compiled both enventlog and syslog-ng. The only difference was my configure arguments for syslog-ng, which was configure --with-libesmtp=/usr/local/lib. Everything looked good afterwards. syslog-ng Open Source Edition 3.5.3 configured Compiler options: compiler : gcc -std=gnu99 compiler options : -g -O2 -Wall -pthread -pthread -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -I$(top_srcdir)/lib/ivykis/src/include -I$(top_builddir)/lib/ivykis/src/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : prefix : /usr/local linking mode : dynamic embedded crypto : no __thread keyword : yes Submodules: ivykis : internal libmongo-client : internal librabbitmq : internal Features: Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : yes spoof-source support : no tcp-wrapper support : no Linux capability support : no PCRE support : yes Env wrapper support : no systemd support : no (unit dir: none) Modules: Module search path : /usr/local/lib/syslog-ng Sun STREAMS support (module): no SSL support (module) : yes SQL support (module) : no PACCT module (EXPERIMENTAL) : no MongoDB destination (module): yes JSON support (module) : no SMTP support (module) : yes AMQP destination (module) : yes STOMP destination (module) : yes GEOIP support (module) : no Redis support (module) : no Yet, now when I attempt to start syslog-ng I receive the following error. /usr/local/sbin/syslog-ng: error while loading shared libraries: libsyslog-ng-3.5.3.so: cannot open shared object file: No such file or directory However, the file looks good also. ls -l /usr/local/lib/libsyslog-ng-3.5.3.so -rwxr-xr-x 1 root root 2227624 Mar 12 08:47 /usr/local/lib/ libsyslog-ng-3.5.3.so any thoughts as to what might be wrong? Thanks,

2 1

Google Summer of Code proposals
by Tusa Viktor 14 Mar '14

14 Mar '14

Dear Google Summer of Code Applicants! Please note that you have only one week left for submitting your proposals. Please register in www.google-melange.com as a student, upload the necessary document, and you can start writing your proposal. Some of you already knows, that we will give you a small task which will test your eligibility for the project. We will give these tasks after your proposal submission, but not before March 17 (Monday). If you need a few tips about how to write a good proposal, here is a blog post about it: http://www.di.ens.fr/~baghdadi/TXT_blog/5_advices_to_get_your_proposal_acce… Happy Coding! Best Regards, Viktor Tusa

1 0

AUTO: James B Horwath is out of the office (returning 03/18/2014)
by James B Horwath 14 Mar '14

14 Mar '14

I am out of the office until 03/18/2014. I will be out of the office until 03/18/2013 with limited access to e-mail. If you have an urgent issue please contact Sunil Gupta at (610)-807-6710 or Dylan Yoder at (610)-807-7230. Regards Jim Horwath IT Security Services & Governance, Corporate BTS and IT Security/Risk Tel 610-807-8795 Mobile 610-533-6972 3900 Burgess Place, Bethlehem, Pa. 18017 Jim_Horwath(a)glic.com Note: This is an automated response to your message "syslog-ng Digest, Vol 107, Issue 29" sent on 3/14/2014 6:40:24. This is the only notification you will receive while this person is away. ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

1 0

syslog-ng news: GSoC, incubator, conferences
by Peter Czanik 14 Mar '14

14 Mar '14

Hi, Yesterday the syslog-ng newsletter went out with broken links and for some users it ended up in the spam folder for gmail users (and possibly others). I'm still debugging the cause of these problems. Until a good solution is found, here is a link to the on-line version: https://insider.blogs.balabit.com/2014/03/gsoc-incubator-conferences/ Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Config visualization - concrete task
by Sandeep K Chaudhary 14 Mar '14

14 Mar '14

Hi guys, I have installed syslog-ng on my system, and have been looking at this[1] repository a little. I think I can start doing something concrete now. Can someone please give me the task so that I can start working on it? I hope that [1] is the correct repo to look at. [1] https://github.com/balabit/syslog-ng-3.5 Thanks, Sandeep.

3 3

insider 2014-03: GSoC; Incubator; Conferences;
by Peter Czanik 13 Mar '14

13 Mar '14

Dear syslog-ng users, This is the 32th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. FEATURED NEWS Google Summer of Code (GsoC) ---------------------------- This year the syslog-ng project was accepted to GSoC as a mentoring organization. We vould like to thank to the Debian and openSUSE projects for vouching for us and openSUSE to let us participate previous years under the openSUSE umbrella. We don't know yet the number of students we can mentor, but we already have a nice number of project ideas and students who expressed interest. It's not yet too late to browse the ideas page _https://github.com/balabit/syslog-ng/wiki/GSoC2014-Idea-&-Project-list_ and write a project proposal to the syslog-ng mailing list. Contact information is available at _https://github.com/balabit/syslog-ng/wiki/GSoC2014_ syslog-ng incubator updates --------------------------- The syslog-ng incubator is a collection of tools and modules which are not (yet) part of the official repository. Version 0.2.1 was released recently with many bugfixes, advanced LUA related features, support for FreeBSD and a python script based ElasticSearch destination. The syslog-ng incubator is available in many ways. First of all, the source is available in git at _https://github.com/balabit/syslog-ng-incubator_and as a release tgz at _http://packages.madhouse-project.org/syslog-ng/incubator/syslog-ng-incubat… There are also packages for openSUSE and Fedora with riemann support available in a subpackage. To use it, visit one of the below web pages and add the necessary repositories, which also have syslog-ng 3.5 and the riemann C client available. Fedora: _http://copr.fedoraproject.org/coprs/czanik/syslog-ng35/_ openSUSE: _https://build.opensuse.org/project/show/home:czanik:syslog-ng35_ A FreeBSD port is also work in progress, once ready, it will be committed to sysutils/syslog-ng-incubator. Riemann support is not included. syslog-ng at conferences ------------------------ The next confirmed events are: * Open Source Data Center Conference, 8-10 April, Berlin, Germany: _http://www.netways.de/osdc/_, Giving a talk titled "Monitoring with syslog-ng, Riemann and Kibana" There will be two developers present, so if anyone attends, and has Incubator, Lua, Riemann, etc. related questions, we'll be happy to answer. * Linux Open Admin Days, 5-6 April, Antwerp, Belgium: _http://loadays.org/_, Giving a talk titled “Babel Fish for DevOps: syslog-ng”. Those, who visited FOSDEM will be familiar with the basis of the presentation, but this time with a lot more details and configuration examples thanks to the more available time. * Infosecurity Europe, 29 April - 1 May, London, United Kingdom: _http://www.infosec.co.uk/_, Giving a talk titled "Finding method in the madness: the challenges of the automatic classification of log messages". The talk will be given by Balazs Scheidler (Bazsi) who you will also be able to find at the BalaBit booth at the event. * LinuxTag, 8-10 May, Berlin, Germany: _http://linuxtag.org <http://linuxtag.org/>_, Giving a talk titled "Finding method in the madness: the challenges of the automatic classification of log messages". BalaBit will also be sponsoring the event so you'll be able to find us and get T-shirts and talk with our engineers. The talk will be a revised version of the talk given a week before at Infosecurity Europe. NEW RELEASES * syslog-ng incubator 0.2.1: _https://github.com/balabit/syslog-ng-incubator/blob/master/NEWS_ * syslog-ng OSE 3.5.4: _https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-March/000182.html_ * syslog-ng OSE 3.5.4.1: _https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-March/000183.html_ * syslog-ng PE 4.0.7: _https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-March/000181.html_ Your feedback and news tips about the next issue is welcome at _documentation(a)balabit.com <mailto:documentation@balabit.com>_To read this newsletter on-line, visit: _http://insider.blogs.balabit.com/_ -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

syslog-ng 3.5.4.1 has been released
by devel＠balabit.hu 13 Mar '14

13 Mar '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.5.4.1 SUMMARY : new stable release DATE : Mar 13, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.5.4.1) has been released. For latest fixes in the 3.5.x feature branch you are recommended to upgrade to this version if you are running on a 32-bit platform. CHANGES: 3.5.4.1 Thu, 13 Mar 2014 10:46:07 +0100 This is the fourth bug-fix release for the 3.5.x series, with a single fix for 32-bit platforms. Upgrading to this version is highly recommended for people using 32-bit platforms, others are not affected. Bugfixes ======== * The basic template functions (substr, +, -, etc) were fixed to work correctly on 32-bit platforms, following up on a previous change that changed how numbers are parsed. Credits ======= syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Gergely Nagy <algernon(a)balabit.hu> Peter Czanik <czanik(a)balabit.hu> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

Installing multiple instances of Syslog-NG
by Shashank Rohatgi 13 Mar '14

13 Mar '14

Hi Can someone help me figure out how to install multiple instances of syslog-ng on a single server. Copying the binary and starting it with a different configuration file did spawn another instances but it wasnt independent as i saw it behaving different than what is configured in its syslog-ng file. I need a parallel instance for development alongside production. Thanks in advance regards SK

3 8

syslog-ng 3.5.4 has been released
by devel＠balabit.hu 12 Mar '14

12 Mar '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.5.4 SUMMARY : new stable release DATE : Mar 12, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.5.4) has been released. For latest fixes in the 3.5.x feature branch you are recommended to upgrade to this version. CHANGES: 3.5.4 Wed, 12 Mar 2014 13:18:36 +0100 This is the third bug-fix release for the 3.5.x series, with a number of important improvements over the previous release. Upgrading to this version is highly recommended. Bugfixes ======== * The value-pairs code had a serious bug, where under some circumstances (depending on compiler, platform and optimisation flags), it could end up in a live-lock, where the only way out was to forcibly kill the syslog-ng process. * SDATA enterprise IDs are handled better when using value-pairs (MongoDB, $(format-json), etc): the enterprise id is kept together, the possibly dotted numeric ID is not split into sub-structures anymore. * json-parser() can now be used from multiple log paths without crashing the syslog-ng process. * Options that can take a unit-suffixed number now work correctly on 32-bit big-endian platforms. * Using some time-related macros (like R_SEC) in filters do not crash syslog-ng anymore. * The internal copy of libmongo-client was updated to version 0.1.7.1, which fixes an important bug in the safe mode handling code. * The system() source learned to recognise FreeBSD jails, and will not use /dev/klog when running inside one. * The host() and port() options of the MongoDB destination have been marked obsolete (which were documented as such, but the code didn't follow). * The username() and password() options are now mandatory for the AMQP destination, and syslog-ng raises an error if either of them is unset. This is because the destination does not work without them anyway. * The timezone file parser now supports Tzif3 formatted files too. * The $(geoip) template function handles failed look-ups gracefully: it expands to an empty string then, and does not print a warning anymore. * The source code was updated to work with bison 3 and later (only affects people compiling from git, or rebuilding grammar files). * The syslog-ng pkg-config file now has an scldir and a datarootdir variable too, to help third-party packages. Credits ======= syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Andras Mitzki <micek(a)balabit.hu> Andres Tamayo <Andres.Tamayo(a)viasat.com> Balazs Scheidler <bazsi(a)balabit.hu> Daniel Gados <gdani(a)balabit.hu> Evan Rempel <erempel(a)uvic.ca> Fabien Wernli <bugzilla.balabit(a)faxm0dem.org> Gergely Nagy <algernon(a)balabit.hu> Igor Ippolitov <iippolitov(a)gmail.com> Peter Czanik <czanik(a)balabit.hu> Steve Berryman <steve(a)berryman.org.uk> Tibor Benke <btibi(a)balabit.hu> Viktor Tusa <tusa(a)balabit.hu> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

[Bug 273] New: 3.5.3 segfault on match against some macros
by bugzilla＠bugzilla.balabit.com 12 Mar '14

12 Mar '14

https://bugzilla.balabit.com/show_bug.cgi?id=273 Summary: 3.5.3 segfault on match against some macros Product: syslog-ng Version: 3.5.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 If I include any match against the time related macros, syslog-ng seg faults. Seems that *SEC and UNIXTIME are affected at the very least Very simple conf and all blows up. @version: 3.5 source s_test { internal(); } ; destination d_var_syslog { file("/var/log/syslog.log" owner("root") group("syslogs") perm(0640) ); }; filter f_one { match("1" value("R_SEC") ); }; log { source(s_test); log { filter(f_one); destination(d_var_syslog); }; }; -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[Bug 270] New: deadlock with patterndb and format-json ( debug NOT enabled in compilation)
by bugzilla＠bugzilla.balabit.com 12 Mar '14

12 Mar '14

https://bugzilla.balabit.com/show_bug.cgi?id=270 Summary: deadlock with patterndb and format-json (debug NOT enabled in compilation) Product: syslog-ng Version: 3.5.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.balabit(a)faxm0dem.org Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=90) --> (https://bugzilla.balabit.com/attachment.cgi?id=90) syslog-ng configuration and patterndb file This one was hard to isolate. Using the minimal attached configuration, it's very easy to lock the system down by running the following command (bourne shell): $ i=0; while echo 'sshd: Received disconnect from 1.2.3.4: 11: disconnected by user' > /var/tmp/syslo g-ng.src.fifo; do printf .$i.; i=$(($i+1)); done .0..1..2..3..4..5..6..7..8..9..10..11..12..13..14..15..16..17..18..19..20..21..22..23..24..25..26..27..28 [...] 124..125 [DEADLOCK] After that, syslog-ng is completely locked. command used to run syslog-ng: /sbin/syslog-ng -f /home/faxm0dem/syslog-ng-bug/syslog-ng.conf -R /tmp/syslog-ng.persist -p /tmp/syslog-ng.pid Most importantly, this does *only* happen when --enable-debug is *not* switched during compilation. Moreover, an example pattern in the provided patterndb shows how this can be avoided by renaming the variables. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 7