- syslog-ng - lists.balabit.hu

[Bug 270] New: deadlock with patterndb and format-json ( debug NOT enabled in compilation)
by bugzilla＠bugzilla.balabit.com 12 Mar '14

12 Mar '14

https://bugzilla.balabit.com/show_bug.cgi?id=270 Summary: deadlock with patterndb and format-json (debug NOT enabled in compilation) Product: syslog-ng Version: 3.5.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.balabit(a)faxm0dem.org Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=90) --> (https://bugzilla.balabit.com/attachment.cgi?id=90) syslog-ng configuration and patterndb file This one was hard to isolate. Using the minimal attached configuration, it's very easy to lock the system down by running the following command (bourne shell): $ i=0; while echo 'sshd: Received disconnect from 1.2.3.4: 11: disconnected by user' > /var/tmp/syslo g-ng.src.fifo; do printf .$i.; i=$(($i+1)); done .0..1..2..3..4..5..6..7..8..9..10..11..12..13..14..15..16..17..18..19..20..21..22..23..24..25..26..27..28 [...] 124..125 [DEADLOCK] After that, syslog-ng is completely locked. command used to run syslog-ng: /sbin/syslog-ng -f /home/faxm0dem/syslog-ng-bug/syslog-ng.conf -R /tmp/syslog-ng.persist -p /tmp/syslog-ng.pid Most importantly, this does *only* happen when --enable-debug is *not* switched during compilation. Moreover, an example pattern in the provided patterndb shows how this can be avoided by renaming the variables. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 7

GSoC Introduction
by Tibor Benke 11 Mar '14

11 Mar '14

Dear All, My name is Tibor Benke, I'm a first year MSc student at Budapest University of Technology and Economics, where I study Computer Science. I heard about GSoC and the most interesting organization was the syslog-ng project. I've professional experience in C/C++, Java, Python and worked with git. Since my childhood I always wanted to be an engineer. After graduating I got a certificate of "IT network installer and operator". Then I went to university, where I specialize in Networks and services, but I concentrate on designing and writing networked applications. My BSc thesis was to write a web based network management application in Python. During the academic years I participated in some competitions. What I'm most proud of is the national EuroSkills 2013 qualifying rounds, where my team earned the sixth place in which I was the Linux specialist. I also have work experience: one summer I patched a network driver in the Linux kernel, then did some research in the field of Hadoop and Big Data. In 2013 I contributed to some open source projects, like Log4j2, Logback and syslog-ng. Along with my studies I lead a group of 60 volunteer students, who operate the network and server of my faculty's dormitory, write games, mobile- and other applications. The project I'm most interested in is "Integration with config management systems". Since I wrote my thesis in Python, so the Salt part shouldn't be so hard. I like to learn new languages, so I'm looking forward to enhance my knowledge by learning Ruby. Regards, Tibor Benke

2 1

[GSOC 2014] Interested in working on "XMPP Destination"
by Shonali Balakrishna 11 Mar '14

11 Mar '14

Hi all, I am Shonali Balakrishna from Bangalore, India. I am going to be starting graduate school(MSc.) at TU Delft this fall and wish to participate in Google Summer of Code 2014 as a part of Syslog-ng. I am an Electronics and Telecommunications engineering graduate(2008-2012) from PESIT, Bangalore and I'm currently working in Oracle India, on automation/scripting for refresh(cloning) tasks in their Cloud Division. I am proficient in programming/scripting in C, Java and Perl. I have hands on experience with working on XML and XMPP through an automation project at work. I have user level familiarity with syslog-ng. Most importantly, I enjoy learning and am always willing to learning something new. I am interested in working on "XMPP Destination" and intend to apply for this project through GSOC 2014. I have been familiarizing myself with Syslog-ng source code in the last couple of weeks. I am working on a project proposal for the same and would like to run it by you for feedback when I'm done. I would be extremely grateful for any pointers or leads to resources you could provide me with, that would help me with this project. Thank you for your time. Best Regards, -- Shonali Balakrishna

2 1

GSoC - ZMQ transport
by Laci Mészáros 11 Mar '14

11 Mar '14

Hello, I am Laszlo Meszaros a student at Szechenyi Istvan University, studying Software Engineering.I have read the GSoC idea list and "ZMQ transport" idea. I think it is a good idea either it is source, destination, transport or all of them. There are use cases when people can use that to make their everyday job easier. (e.g.: salt monitoring, to build scaled systems, or in case of zmq transport use multiple syslog-ng on different nodes)I hope I have most of the skills that is necessary for that, but not all of them. I would like to gather the missing ones during GSoC. (e.g.: I know syslog-ng code base on a basic level, but I would like to get deeper knowledge.) I have programming knowledge in python, C and very minimal in unix shell which I think are enough to complete the project during the summer. So I would like to participate to GSoC as student who undertake to solve ZMQ transport idea. Best Regards, Laci

2 1

GSOC 2014 - ZMQ transport
by Sanidhya Kashyap 11 Mar '14

11 Mar '14

Hello everyone, I am a prospective GSOC applicant and I am quite interested in working on the project idea titled - 'ZMQ transport'. Since, neither was Viktor online nor was Gergely available while I was online, so I thought I should sent a mail on the mailing list. A bit of introduction about me. I am a Masters student studying at IIIT Hyderabad, where I have worked on live migration of virtual machines. There, I have also used ZMQ for one of my sub-projects where I was required to do some distributed data transfer across multiple physical machines. Hoping to hear from you people soon. Thanks, Sanidhya

2 1

Re: [syslog-ng] High availabilty configuration
by Terry Slattery 11 Mar '14

11 Mar '14

Ramesh, My customers are network folks, not sysadmins. Network folks are good at networking and network troubleshooting, but not great at installing and maintaining things like DRBD. So DRBD is not an option. I don't see how you could use rsync with the log folder to make a single data set. The folders/directories become different in a split-brain situation and rsync operates on files and directories. Consider the split-brain case where two syslog-ng servers can't see each other and some network devices can still send to one of the two serves. The syslog-ng data now becomes different, with some devices able to log to one syslog-ng server, but not the other. If you're forwarding syslog data to other consumers (alerting systems, security systems, etc), only one server will typically be able to reach some of these systems. What happens depends on your architecture and the devices involved. This is what makes automatic handling difficult. Failure of the syslog-ng server itself is easy to handle; it is a network failure that creates the split-brain situation that's difficult. -tcs On 3/11/14 2:15 AM, syslog-ng-request(a)lists.balabit.hu wrote: > Date: Mon, 10 Mar 2014 14:10:24 -0400 > From: Ramesh Basukala<basukalaramesh(a)gmail.com> > Subject: Re: [syslog-ng] s High availabilty configuration > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <CABJn1Wj3TEESuNsE1CcTvHKCBEKAhwOmV6gr6y8ibzR+w+U+MQ(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi Terry, > > Thanks for your suggestion. The reason I am trying to configure high > availability with heartbeat/DRBD is data consistency. I prefer no to have 2 > different sets of data in case one of the syslog server went offline. Do > you think we might be able to rsync the log folder once in a while to make > data consistent? > > Thanks, > RB -- Terry Slattery CCIE# 1026

1 0

High availabilty configuration
by Ramesh Basukala 11 Mar '14

11 Mar '14

Hi, I am running open source version of syslog-ng server, currently I have only one server. I would like to add another server and configure high availability, such that log data will still be available in case my primary server dies. Looking at the documentation, syslog-ng itself does not support high availability configuration and has to be done at Operating System level. I need help setting up high availability, please point me to any resource or documentation to start with. Thanks for the help. -RB

6 7

Re: [syslog-ng] s High availabilty configuration
by Terry Slattery 10 Mar '14

10 Mar '14

My recommendation to customers who need high reliability is to run two instances, each in a separate data center. Configure all gear to send to both servers. If syslog forwarding to other consumers is needed, manually configure it on one of the two servers. Upon a failure, confirmed by a human, the servers are reconfigured for forwarding. Many syslog consumers can't handle more than one feed, thus the need to reconfigure upon a failure. This isn't optimum for a site that wants automatic operation. However, building a system that can properly determine and avoid split-brain failures (where the two systems can't talk with one another, but the network gear can send to them) is an "interesting challenge." It would be easy to build something to generate an alert when the two systems can't talk with one another and make this alert the highest priority. Humans can then step in to diagnose the problem and take the appropriate action. Meanwhile, both systems are logging whatever they receive, which may be the whole feed or a part of a feed, if the network becomes partitioned. -tcs On 3/8/14 2:57 AM, syslog-ng-request(a)lists.balabit.hu wrote: > Date: Fri, 07 Mar 2014 15:50:43 -0500 > From: Ramesh Basukala<basukalaramesh(a)gmail.com> > Subject: [syslog-ng] High availabilty configuration > To:syslog-ng@lists.balabit.hu > Message-ID:<531A3123.5080007(a)gmail.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hi, > > I am running open source version of syslog-ng server, currently I have > only one server. I would like to add another server and configure high > availability, such that log data will still be available in case my > primary server dies. > Looking at the documentation, syslog-ng itself does not support high > availability configuration and has to be done at Operating System level. > > I need help setting up high availability, please point me to any > resource or documentation to start with. > > Thanks for the help. > -RB -- Terry Slattery CCIE# 1026

2 1

Program() in destination driver not working for Macros defined in CSV-PARSER
by Justin B 10 Mar '14

10 Mar '14

Hello On My Apache logs I applied csv_parser() and defined the Macros. parser p_apache { csv-parser(columns("apache.ETSTAMP", "apache.TYPE", "apache.EHOSTNAME","apache.ESOURCE", "apache.EOUTCOME", "apache.EMSG","apache.EUSERID") delimiters("|") ); }; I want to launch a script whenever the UDP messages are in.So I defined the destination d_mesg (program("/tmp/test.sh" template("|${apache.ETSTAMP}|${apache.TYPE}|${apache.EHOSTNAME}|${apache.ESOURCE}|${apache.EOUTCOME}|${apache.EMSG}|${apache.EUSERID}\n")); }; script is working fine with other destination drivers. Please help -- Kale

3 7

Syslog-ng & Distributed File Systems??
by Jiann-Ming Su 08 Mar '14

08 Mar '14

Is there a version of syslog-ng that can properly use distributed filesystems like GlusterFS? For example, I have two nodes each running syslog-ng but also sharing a GlusterFS filesystem. Can those independent syslog-ng processes running on different servers write to the same file on the GlusterFS?

7 20

syslog-ng OSE 3.5.1 is not accepting global options
by Tamayo, Andres 07 Mar '14

07 Mar '14

Hello, I am experiencing problems with syslog-ng OSE 3.5.1 reading the configuration file and accepting its global options. I had problems with 2 global options specified in my syslog-ng.conf file: @version: 3.5 @include "scl.conf" options { flush_lines(0); time_reopen(10); log_fifo_size(1000); use_dns(no); use_fqdn(yes); keep_hostname(no); keep_timestamp(yes); chain_hostnames(no); perm(0640); owner("root"); group("root"); create_dirs(yes); dir_perm(0750); dir_owner("root"); dir_group("root"); }; source s_cache { file("/path/to/some/file.txt", flags(no-parse)); }; destination d_network { syslog("192.168.1.10" port(1901) transport("tcp")); }; log { source(s_cache); destination(d_network); }; The time_reopen and log_fifo_size seem to be forced to zero if I try to specify alternate values for them as shown above. If I do not include them in the configuration file, syslog-ng uses their default values time_reopen=60 and log_fifo_size=10000. Does anybody know what may be causing this problem? The log_fifo_size default value is OK but I need a faster time_reopen window and I cannot find a way to specify it. If I do, syslog-ng forces it to time_reopen=0. I can tell because I get message like this when it is trying to reconnect: Syslog connection failed; fd='8', server='AF_INET(192.168.1.10:1901)', error='Connection refused (146)', time_reopen='0' If I remove the time_reopen(10) global option from the syslog-ng.conf file, then I get the following message when syslog-ng it is trying to reconnect: Syslog connection failed; fd='8', server='AF_INET(192.168.1.10:1901)', error='Connection refused (146)', time_reopen='60' Please let me know if you have any questions for me. Thank you for your help.

2 5

[Bug 272] New: When syslog-ng server is not available, all syslog-ng clients are frozen
by bugzilla＠bugzilla.balabit.com 07 Mar '14

07 Mar '14

https://bugzilla.balabit.com/show_bug.cgi?id=272 Summary: When syslog-ng server is not available, all syslog-ng clients are frozen Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: critical Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: carl.chenet-ext(a)cloudwatt.com Type of the Report: bug Estimated Hours: 0.0 Os: Ubuntu Precise Syslog-ng version: 3.4.7-1~mhp1.sysvinit Hi, When the syslog-ng server is not available, all syslog-ng clients are frozen. We have to restart syslog-ng by mco because no other access work (ssh, direct console...). I'm including your syslog-ng configuration files. Feel free to ask me whenever information you need. Regards, Carl Chenet -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

Problems creating syslog-ng.persit- file
by Tamayo, Andres 07 Mar '14

07 Mar '14

Hello, I am having problems starting up syslog-ng when I specify the location and name for its persist file. Here is the way I am trying to start it: syslog-ng --cfgfile=/etc/syslog-ng.conf --pidfile=/mnt/config/syslog-ng.pid --persist-file=/mnt/config/syslog-ng.persist When I use this command, syslog-ng starts and creates the /mnt/config/syslog-ng.persist file but it adds a '-' (dash) character to the end of the filename, like this: /mnt/config/syslog-ng.persist- Then it executes right to the point where it is about to parse the configuration file (I can see this in the debug logs) and stops. The command return value is 2. I have seen syslog-ng return 0 on success and 1 on failure but I do not know what is the meaning of 2 as the return value. I tried the same filename but a different location (/tmp) and it worked. The filename did not have the appended '-' and syslog-ng returned 0. The location I am trying to use is a flash memory mount that has JFFS2 file system. I wonder if this is part of the problem. I tried to change the name of the persist file to something different like: --persist-file=/mnt/config/something.else and the behavior is the same. The file is created like this: /mnt/config/something.else- and syslog-ng returns 2. Does anybody know why the '-' is appended to the filename or what is the meaning of a 2 return value? Thank you for your help.

3 4

$facility variable not working in filename - Solaris OS
by Feroz Basir 07 Mar '14

07 Mar '14

Hi all, Need some help regarding filename that use $facility variable. For some reason the facility variable was set to 'a' during file naming convention. I don't recall to have 'a' as a facility on remote server. What could be the issue here? This only happen on Solaris syslog-ng server. Others OS seem ok. Config sample: destination d_remoteall {file ("/syslog/$sourceip@$facility@$r_year:$r_month:$r_day:" create_dirs(yes) perm(0644));}; Sample output: 10.10.10.1@a@2014:03:05.gz I'm running syslog-ng version 3.0.2. Thanks. Regards, Feroz Basir

4 8

syslog-ng stats and performance
by Jesse Bowling 07 Mar '14

07 Mar '14

Hello, I'm running into an issue where we're fairly certain that we're dropping log messages somewhere along this path: device -> network -> VMware -> RHEL host -> syslog-ng What I'd like to understand better is what statistics I can gather from syslog-ng itself to help show or rule out drops in the software. I'm using the following general config: syslog-ng 3.2.5 Installer-Version: 3.2.5 Revision: ssh+git://bazsi@git.balabit //var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#9d4bea28198bd731df1a61e980a2af5b88d81116 Compile-Date: Jan 15 2012 19:47:30 Enable-Threads: on Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-SSL: off Enable-SQL: on Enable-Linux-Caps: off Enable-Pcre: on Enable-Pacct: off options { flush_lines (100); time_reopen (2); log_iw_size(100); log_fifo_size (65536); log_msg_size(8192); long_hostnames (off); use_dns(yes); use_fqdn(yes); keep_hostname (no); stats_freq(3600); stats_level(1); dns_cache(yes); keep_timestamp(no); }; When I looked at "syslog-ng-ctl stats" I see these "types" dropped processed stamp stored However I only see "dropped" counters for tcp destinations, and not for any of the sources or local destinations. Does "dropped" only make sense in the remote destination case? Is there anything I can turn on/examine to tune my syslog-ng performance and verify whether I have drops occurring within syslog-ng? For the RHEL host portion I've tried watching netstat -su and netstat -st but the error counters for those do not seem to indicate that the level of issue we're seeing lies there. The processor for syslog-ng is busy, but averages 75%... Is it foolish to expect VMware to keep up with the level of logs we're taking in? Might virtualization be hiding drops from me? Any help appreciated... Cheers, Jesse -- Jesse Bowling

3 3

TLS-Syslog not working
by stefan.zahnd＠id.unibe.ch 07 Mar '14

07 Mar '14

Hi I hope someone can help me! The syslog-ng in our environment sends syslog messages using tls to our SIEM (Qradar). The following is the configuration of the syslog-ng (ip changed): # First, set some global options. options { chain_hostnames(off); flush_lines(0); use_dns(yes); use_fqdn(no); owner("root"); group("adm"); perm(0640); stats_freq(0); bad_hostname("^gconfd$"); }; destination d_qradar_tls {tcp(„1.2.3.4" port(6514) tls( peer-verify(required-untrusted) ca_dir("/opt/syslog-ng/etc/syslog-ng/ca.d")) ); }; destination d_qradar_local { file("/tmp/qradar_local"); }; source s_testlog { file("/tmp/testlog" flags(no-parse)); }; log { source(s_testlog); destination(d_qradar_local); destination(d_qradar_tls); }; When I insert a message into the testlog it is parsed and written into the local destination „d_qradar_local“ but not sent to the remote destination. Syslog-NG in debugging mode (syslog-ng –Fevdt) shows the following: … Syslog connection established; fd='7', server=‚AF_INET(1.2.3.4:6514)', local='AF_INET(0.0.0.0:0)' Incoming log entry; line='test' Initializing destination file writer; template='/tmp/qradar_local', filename='/tmp/qradar_local' Destination timed out, reaping; template='/tmp/qradar_local', filename='/tmp/qradar_local' Closing log transport fd; fd=’15' Using tcpdump to check if some packets are sent to Qradar reveals that only the first insertion of a message into the testlog after a restart of syslog-ng leads to a packet sent to Qradar. Every other insertion has no effect on the remote destination but is always inserted into the local destination (file). Also during the start of syslog-ng two packets are sent to qradar. I’ve also opened a ticket at IBM and awating response. Thank you very much in advance for any help on this! Kind regards, Stefan -- University of Bern IT Services Department

2 1

need help debugging some network received logs that aren't writing to files
by Chris Moody 06 Mar '14

06 Mar '14

Hello. First off, thanks a __TON__ for syslog-ng. I've sworn by this awesome code for years now. I've built all sorts of logging infrastructure with it. I seem to have hit on something though that's got me scratching my head and lacking for explanation. Perhaps I've just been staring at it and debugging it too long and am missing something obvious. I've got an installation with a couple thousand network devices logging successfully to output spools on our log aggretor. This is rockin' and works beautifully. I've got things configured whereby each network source logs to it's own individual spool file with the source-ip as the spool name. I'm running into a case though where I have a Cisco switch sending logs to my log aggregator but the log-server isn't writing the output to the device's spool file. It is working however for many many more devices just like this switch. I've confirmed via tcpdump that this log traffic does actually hit the box, but it never gets recorded into the log spool for that network device. Since the host is -super- busy receiving logs from other gear enterprise-wide, I have to treat it very gingerly, so can't enable too much debugging...but I'm really confused why the logs wouldn't show up in the log spool.. Here's some bits of the config that are relevant: ===== options { keep_hostname(yes); use_dns(no); use_fqdn(no); stats_freq(600); stats_level(2); # Allow large messages log_msg_size(65536); }; # ===================== # UDP Packet Source source s_udp { udp(); }; # ===================== # TCP Packet Source source s_tcp { tcp(ip(aaa.bbb.ccc.ddd) port(514) max-connections(50000)); }; # ===================== destination net_perhost { file("/data/log/per-host/$HOST" owner(root) group(nwadmin) perm(0775) ); }; # ===================== log { source(s_tcp); source(s_udp); destination(net_perhost); }; ===== I've checked around for perhaps a different spool name, thinking perhaps the data was getting recognized as something other than it's source-ip, but haven't seen anything. Any thoughts? Cheers, -Chris

8 15

[Bug 260] New: exit with code 134
by bugzilla＠bugzilla.balabit.com 06 Mar '14

06 Mar '14

https://bugzilla.balabit.com/show_bug.cgi?id=260 Summary: exit with code 134 Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 I just did a reload on version 3.4.4 (with latest patches) and triggered 2013-11-05T21:24:33-08:00 host daemon.crit supervise/syslog-ng[25895]: Daemon exited due to a deadlock/signal/failure, restarting; exitcode='134' Is it possible that the return code of syslog-ng is somehow linked to the return code of a child program destination? core file sent to Balazs in private e-mail -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 11

syslog-ng incubator packaged for openSUSE and Fedora
by Peter Czanik 06 Mar '14

06 Mar '14

Hi, syslog-ng incubator had a new release this week. Highlights are: ** Feature: LuaJIT support ** Feature: monitor source ** Feature: Templating support for the Lua destination ** Feature: Lua destinations have easy access to the timestamps ** Feature: The Lua modules now have a deinit hook ** Feature: The Lua modules has access to logging functions ** Feature: The Lua destination can have global variables set ** Feature: graphite output template function ** Feature: An ElasticSearch SCL ** Bugfix: RSS destination does not require newer glib For details check the NEWS file at https://github.com/balabit/syslog-ng-incubator/blob/master/NEWS I did some syslog-ng incubator packaging for openSUSE and Fedora. Functionality is not tested, as I don't have ElasticSearch, graphite, Riemann or lua scripts at hand (yet). As it's untested, there is no guarantee, that it does not eat your server :-) On the other hand testing and feedback is very welcome! openSUSE: https://build.opensuse.org/project/show/home:czanik:syslog-ng35 Fedora: http://copr.fedoraproject.org/coprs/czanik/syslog-ng35/ You should add the repository to your package manager, so all necessary dependencies are automagically resolved. Have a nice weekend! Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

3 3

patterndb
by Fabien Wernli 03 Mar '14

03 Mar '14

Hi, I'm currently organizing my patterndb files into something easily maintainable, and I ran into the following problem, best explained using an example: sshd and pam_unix. Some of sshd specific patterns reside in a specific ruleset, e.g. <ruleset name='sshd' id='A'> <patterns> <pattern>sshd</pattern </patterns> <rules> <rule> ... </rule> </rules> </ruleset> Some of sshd's messages come from pam_unix, e.g. modules/pam_unix/support.c, and are shared among other daemons: <ruleset name='pam_unix' id='B'> <patterns> <pattern>crond</pattern> <pattern>imap</pattern> <pattern>login</pattern> <pattern>pam</pattern> <pattern>pure-ftpd</pattern> <pattern>proftpd</pattern> <pattern>sshd</pattern> <pattern>su</pattern> <pattern>sudo</pattern> ... <patterns> <rules> <rule> ... </rule> </rules> </ruleset> The problem is, when a sshd message is parsed, even if it doesn't match any rules in ruleset 'A', ruleset 'B' isn't even considered for matching. So how do I properly organize my pdb tree, without duplicating rules in multiple source files? Thanks in advance

3 4

Error parsing source
by Jesus M Diaz 28 Feb '14

28 Feb '14

Hello, I have just came to 'syslog-ng' and I am having some troubles to setting it up. I am using the "syslog-ng.conf" provided by "slackbuilds.org", and I have add just few lines. Well, those lines make the daemon not to run. the error: ++++++++++++ Starting syslog-ng daemon: /usr/sbin/syslog-ng Error parsing source, source plugin s_router not found in /etc/syslog-ng/syslog-ng.conf at line 59, column 14: log { source{s_router}; destination{d_router}; }; ^^^^^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng ******************* the release: ++++++++++++ root@liet:/etc/syslog-ng# syslog-ng -V syslog-ng 3.5.2 Installer-Version: 3.5.2 Revision: ssh+git://algernon@git.balabit/var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.5#master#a31bdb7a7f57382a90305bd033753b2762469854 Compile-Date: Feb 28 2014 19:53:40 Available-Modules: afsocket-notls,afamqp,linux-kmsg-format,basicfuncs,affile,dbparser,afsocket-tls,csvparser,afsocket,afstomp,system-source,afmongodb,cryptofuncs,afprog,syslogformat,afuser,confgen Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-Linux-Caps: on Enable-Pcre: on ******************* And the config file (my lines remarked with <<<<<<): +++++++++++++++++ @version: 3.5 # Drop-in replacement for a stock Slackware syslog.conf # For info about the format of this file, see "man syslog-ng.conf" # Written by Mario Preksavec <mario(a)slackware.hr> options { flush_lines(0); time_reopen(60); log_fifo_size(10240); log_msg_size(8192); chain_hostnames(no); use_dns(no); use_fqdn(no); create_dirs(yes); keep_hostname(yes); owner("root"); group("root"); perm(0640); dir_perm(0755); stats_freq(0); check_hostname(yes); dns_cache(no); }; source s_router { udp(ip(192.168.1.1) port(514)); }; <<<<<<<<<<<<< source s_system { internal(); unix-dgram("/dev/log"); file("/proc/kmsg" program_override("kernel")); }; filter f_messages { level(info,notice) and not facility(authpriv,cron,mail,news); }; filter f_syslog { level(warn..emerg) and not facility(authpriv,cron,mail,news); }; filter f_debug { level(debug); }; filter f_authpriv { facility(authpriv); }; filter f_cron { facility(cron); }; filter f_mail { facility(mail); }; filter f_emerg { level(emerg); }; filter f_uucp { facility(uucp); }; destination d_messages { file("/var/log/messages"); }; destination d_syslog { file("/var/log/syslog"); }; destination d_debug { file("/var/log/debug"); }; destination d_secure { file("/var/log/secure"); }; destination d_cron { file("/var/log/cron"); }; destination d_maillog { file("/var/log/maillog"); }; destination d_usertty { usertty("*"); }; destination d_spooler { file("/var/log/spooler"); }; destination d_router { file("/var/log/router"); }; <<<<<<<<<<<<< ############ ## Router ########################### log { source{s_router}; destination{d_router}; }; <<<<<<<<<<<<< # Log anything 'info' or higher, but lower than 'warn'. # Exclude authpriv, cron, mail, and news. These are logged elsewhere. log { source(s_system); filter(f_messages); destination(d_messages); }; # Log anything 'warn' or higher. # Exclude authpriv, cron, mail, and news. These are logged elsewhere. log { source(s_system); filter(f_syslog); destination(d_syslog); }; # Debugging information is logged here. log { source(s_system); filter(f_debug); destination(d_debug); }; # Private authentication message logging: log { source(s_system); filter(f_authpriv); destination(d_secure); }; # Cron related logs: log { source(s_system); filter(f_cron); destination(d_cron); }; # Mail related logs: log { source(s_system); filter(f_mail); destination(d_maillog); }; # Emergency level messages go to all users: log { source(s_system); filter(f_emerg); destination(d_usertty); }; # This log is for news and uucp errors: log { source(s_system); filter(f_uucp); destination(d_spooler); }; # Uncomment this to see kernel messages on the console. #filter f_kern { facility(kern); }; #destination d_console { file("/dev/console"); }; #log { source(s_system); filter(f_kern); destination(d_console); }; # Uncomment these if you'd like INN to keep logs on everything. # You won't need this if you don't run INN (the InterNetNews daemon). #filter f_news_crit { facility(news) and level(crit); }; #filter f_news_err { facility(news) and level(err); }; #filter f_news_notice { facility(news) and level(notice); }; #destination d_news_crit { file("/var/log/news/news.crit"); }; #destination d_news_err { file("/var/log/news/news.err"); }; #destination d_news_notice { file("/var/log/news/news.notice"); }; #log { source(s_system); filter(f_news_crit); destination(d_news_crit); }; #log { source(s_system); filter(f_news_err); destination(d_news_err); }; #log { source(s_system); filter(f_news_notice); destination(f_news_notice); }; *************************** If I comment my "log" line, it works fine, but if I use it, it complains about the "source" entry. Surely it is a silly mistake, but I can't see it, so if any of you could help me I really would be very gratefull thanks a lot! JM Diaz

2 2

GSoC 2014 - Configuration visualisation project
by Sandeep K Chaudhary 28 Feb '14

28 Feb '14

Hi guys, I am interested in working on the project 'Configuration visualisation'. The mentor for this project is Viktor Tusa but I don't know how to reach Viktor directly so I am emailing to this list. Would reaching out to the IRC channel be better? Please let me know. Thanks, Sandeep.

2 2

Escaping open bracket and close bracket.
by C. L. Martinez 27 Feb '14

27 Feb '14

2 2

Porposal (Rough Draft): Type Hinting from the start
by Rajul Srivastava 26 Feb '14

26 Feb '14

Hi all, I have come up with a very rough draft of a proposal for the project idea "Type Hinting from the start" which I have upload here: https://drive.google.com/file/d/0B2mFOuJDrIXmT1AzbngtUXp3eVk/edit?usp=shari… This is the preliminary draft, where I have tried to just list the background and a brief write-up about what I can understand about the project idea. I request you all to kindly take a look at it and I shall be very grateful to anyone who can give me suggestions about how may I go about the design and implementation details about this project. I have not included the timeline for the project, which I plan to do after I have finalized the design and implementation details in the proposal. I shall really be grateful for any suggestions and feedback. Thanking You, Kind regards, Rajul

2 1

[Bug 271] New: using json parser twice in two unnested log statements causes segfault
by bugzilla＠bugzilla.balabit.com 25 Feb '14

25 Feb '14

https://bugzilla.balabit.com/show_bug.cgi?id=271 Summary: using json parser twice in two unnested log statements causes segfault Product: syslog-ng Version: 3.5.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.balabit(a)faxm0dem.org Type of the Report: --- Estimated Hours: 0.0 Created an attachment (id=91) --> (https://bugzilla.balabit.com/attachment.cgi?id=91) minimal configuration to trigger segfault The attached configuration causes a segfault on startup (before any messages make it to source). Here's a stack trace: -- (gdb) bt full #0 0x00007fd54fe6e86f in __strlen_sse42 () from /lib64/libc.so.6 No symbol table info available. #1 0x00007fd54d2c9766 in log_json_parser_set_marker () from /lib64/syslog-ng/libjson-plugin.so No symbol table info available. #2 0x00007fd54d2c9e1b in log_json_parser_clone () from /lib64/syslog-ng/libjson-plugin.so No symbol table info available. #3 0x00007fd551884a1e in log_pipe_clone () from /lib64/libsyslog-ng-3.5.3.so No symbol table info available. #4 0x00007fd55188560c in cfg_tree_compile_single () from /lib64/libsyslog-ng-3.5.3.so No symbol table info available. #5 0x00007fd551886224 in cfg_tree_compile_node () from /lib64/libsyslog-ng-3.5.3.so No symbol table info available. #6 0x00007fd551885c02 in cfg_tree_compile_sequence () from /lib64/libsyslog-ng-3.5.3.so No symbol table info available. #7 0x00007fd551886267 in cfg_tree_compile_node () from /lib64/libsyslog-ng-3.5.3.so No symbol table info available. #8 0x00007fd551885a98 in cfg_tree_compile_reference () from /lib64/libsyslog-ng-3.5.3.so No symbol table info available. #9 0x00007fd551886247 in cfg_tree_compile_node () from /lib64/libsyslog-ng-3.5.3.so No symbol table info available. #10 0x00007fd551885c02 in cfg_tree_compile_sequence () from /lib64/libsyslog-ng-3.5.3.so No symbol table info available. #11 0x00007fd551886267 in cfg_tree_compile_node () from /lib64/libsyslog-ng-3.5.3.so No symbol table info available. #12 0x00007fd551886306 in cfg_tree_compile_rule () from /lib64/libsyslog-ng-3.5.3.so No symbol table info available. #13 0x00007fd551886639 in cfg_tree_compile () from /lib64/libsyslog-ng-3.5.3.so No symbol table info available. #14 0x00007fd55188667d in cfg_tree_start () from /lib64/libsyslog-ng-3.5.3.so No symbol table info available. #15 0x00007fd55188045d in cfg_init () from /lib64/libsyslog-ng-3.5.3.so No symbol table info available. #16 0x00007fd55189cc8a in main_loop_initialize_state () from /lib64/libsyslog-ng-3.5.3.so No symbol table info available. #17 0x00007fd55189d253 in main_loop_init () from /lib64/libsyslog-ng-3.5.3.so No symbol table info available. #18 0x0000000000401805 in main () No symbol table info available. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3