- syslog-ng - lists.balabit.hu

Cisco ASA logging to syslog-ng and a weird extra-characters in new-lines
by Finnur Orn Gudmundsson 16 Aug '13

16 Aug '13

Hi all, I have a syslog-ng server: rpm -qi syslog-ng Name : syslog-ng Relocations: (not relocatable) Version : 3.2.5 Vendor: Fedora Project Release : 3.el6 Build Date: Sun 15 Jan 2012 07:49:04 PM GMT Install Date: Wed 06 Mar 2013 03:56:17 PM GMT Build Host: x86-14.phx2.fedoraproject.org Group : System Environment/Daemons Source RPM: syslog-ng-3.2.5-3.el6.src.rpm Size : 1594638 License: GPLv2+ Signature : RSA/8, Sun 15 Jan 2012 08:55:15 PM GMT, Key ID 3b49df2a0608b895 The syslog-ng package installed is built and distributed by Fedora EPEL but I was hoping I could post here. I replaced a old syslog-ng 2.x server to this one and almost everything works as expected (there is always this one thing that does not work after a migration:). There is a Cisco ASA box logging to this server. For some records I get this extra space in a new-line like this: Aug 16 15:35:56 10.X.X.X %ASA-6-302021: Teardown ICMP connection for faddr 10.X.X.X/9483 gaddr 10.X.X.X/0 laddr 10.X.X.X/0 Aug 16 15:35:56 10.X.X.X %ASA-5-304001: 10.X.X.X Accessed URL 46.X.X.X:/ < Aug 16 15:35:56 10.X.X.X %ASA-5-304001: 10.X.X.X Accessed URL 92.X.X.X:http://sphotos-g.ak.fbcdn.net/hphotos-X/XxX/11X_221X18801_1X554_n.… Aug 16 15:35:56 10.X.X.X %ASA-6-305011: Built dynamic TCP translation from inside:10.X.X.X/38697 to outside:194.X.X.X/38697 (the < char is in a new-line) And another one: Aug 16 15:35:56 10.Z.Z.Z %ASA-6-302013: Built outbound TCP connection 1809896329 for outside:54.Z.Z.Z/80 (54.Z.Z.Z/80) to inside:10.Z.Z.Z/38684 (194.Z.Z.Z/38684) Aug 16 15:35:56 10.Z.Z.Z %ASA-5-304001: 10.Z.Z.Z Accessed URL 10.Z.Z.Z:/ 1 Aug 16 15:35:56 10.Z.Z.Z %ASA-6-302014: Teardown TCP connection 1809896328 for dmz-lb-int:10.Z.Z.Z/58759 to inside:10.Z.Z.Z/80 duration 0:00:00 bytes 162 TCP FINs (the single 1 char is in a new-line). Does someone know if this is a known bug ? I am aware that I am running a somewhat old version. Bgrds, Finnzi

1 1

insider 2013-08: New releases; GSoC updates; Dedicated OSE developer; Observe, Hack, Make 2013;
by Peter Czanik 15 Aug '13

15 Aug '13

Dear syslog-ng users, This is the 26th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. FEATURED NEWS syslog-ng 3.4.3 and 3.3.11 are released --------------------------------------- Both the current (3.4) and previous (3.3) stable syslog-ng releases received maintenance updates. Sources are available from git or as tgz from http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… For third-party binary packages for various Linux and UNIX platforms, visithttp://www.balabit.com/network-security/syslog-ng/opensource-logging-s… for 3^rd party binary packages for various distributions and UNIX variants. syslog-ng Agent for Windows 5.0 ------------------------------- There is a major new version of syslog-ng Agent available, version 5.0. Under the hood it builds now on the same code base as the UNIX version of syslog-ng. The new highlights include support for the Reliable Log Transfer Protocol (RLTP), flow control and support for the Windows Server 2012 and Windows 8 platforms. Long-time syslog-ng contributor Gergely Nagy now working full-time on syslog-ng Open Source Edition ----------------------------- If you've been following the mailing list, the community around syslog-ng or the commits in git you most certainly recognize the name of Gergely Nagy. He's been working at BalaBit for several years and we're happy to announce that from now on his dedicated role is to work on syslog-ng OSE full-time. You can read his thoughts about the change on his blog: https://algernon.blogs.balabit.com/2013/07/onto-greener-open-pastures/ syslog-ng GSoC: it's half-time! ------------------------------- The coding for Google Summer of Code is at half-time. Our students passed half-time evaluations and are working hard on a faster MySQL destination and on a brand new redis destination. You can follow their progress from their related blogs: http://petrovicsgyula.blogspot.com/ http://tichygsoc.blogspot.hu/ There is also a plan to provide test packages for those really adventurous in the coming weeks :-) syslog-ng JSON HowTo -------------------- JSON is gaining popularity, not just in Web 2.0 but in all fields of IT. As it's an easy way of storing and transmitting name value pairs, JSON emitting and parsing is now part of syslog-ng. The HowTo describing how it works in syslog-ng is available at http://asylum.madhouse-project.org/blog/2013/07/29/json-howto/ syslog-ng developers at Observe, Hack, Make 2013 ------------------------------------------------ Laser harp, Wikileaks, lockpicking, NSA, SIM card exploiting, LHC, counter-cryptanalysis, 24 pull requests, neutrino detectors, open source Bach, weird lights, quadrocopters, electric music cranked up to 11, workshops, lectures, discussions, and a lot more! We've been Observing, Hacking and Making! You can read more about it at https://athos.blogs.balabit.com/2013/08/observed-hacked-made/ SHORT NEWS: * CzP presenting log management and syslog-ng at Libre Software Meeting in Brussels: https://czanik.blogs.balabit.com/2013/08/czp-libre-software-meeting/ * What is Pseudonymous Data? An update on how upcoming EU regulations affect logging: https://jluby.blogs.balabit.com/2013/07/18/what-is-pseudonymous-data-in-the… NEW RELEASES * syslog-ng 3.3.11: https://lists.balabit.hu/pipermail/syslog-ng-announce/2013-June/000163.html * syslog-ng 3.4.3: https://lists.balabit.hu/pipermail/syslog-ng-announce/2013-August/000164.ht… * syslog-ng Agent 5.0.1: https://lists.balabit.hu/pipermail/syslog-ng-announce/2013-May/000158.html * syslog-ng PE 4.0.6: https://lists.balabit.hu/pipermail/syslog-ng-announce/2013-August/000165.ht… * syslog-ng PE 4.2.4: https://lists.balabit.hu/pipermail/syslog-ng-announce/2013-June/000160.html Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com <mailto:documentation@balabit.com> To read this newsletter on-line, visit: http://insider.blogs.balabit.com/ -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

syslog-ng 3.4.3 has been released
by devel＠balabit.hu 13 Aug '13

13 Aug '13

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.4.3 SUMMARY : new stable release DATE : Aug 13, 2013 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.4.3) has been released. For latest fixes in the 3.4.x feature branch you are recommended to upgrade to this version. CHANGES: 3.4.3 Tue, 13 Aug 2013 13:00:00 +0100 This is the second bug-fix release for the 3.4.x series, collecting significant fixes over the 3.4.2 release. Upgrading to this release is highly recommended. Bugfixes ======== * The pacct module has been fixed, and now compiles correctly. * Updated the configure.in script, and a few other places to fix issues with recent autotools. * Fixed an infinite loop when template expansion resulted in a zero-length string. * A considerable number of minor issues surrounding the build system have been eliminated. * The template_escape() setting is now respected by template functions that create templates themselves (such as the conditional functions) * Restore support for defaultless block{} arguments. [#230] * RFC5424 NILVALUE is now accepted in timestamps [#238] * The JSON parser will throw an error when the input is not an object (but, for example, a string) instead of crashing. * The program() source has been fixed, and now does not throw a syntax error at config parsing time, but works correctly again. * In case resolving a hostname fails, the IP address does not get truncated anymore. [#240 & #242] * A race condition in certain filter operations have been eliminated. Features ======== * The JSON parser now accepts generic parser related options, such as template(), so one can easily set the input for the parser. Credits: ======== syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Andras Tim <tia(a)balabit.hu> Anton Koldaev <koldaevav(a)gmail.com> Attila Szalay <sasa(a)balabit.hu> Balazs Scheidler <bazsi(a)balabit.hu> Gergely Nagy <algernon(a)balabit.hu> Martin <bmartin(a)lavabit.com> Michael Sterrett <mr_bones_(a)gentoo.org> Vincent Brillault <spam(a)lerya.net> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

3 2

[Bug 238] New: syslog-protocol: allow NILVALUE for TIMESTAMP as specified in rfc5424
by bugzilla＠bugzilla.balabit.com 13 Aug '13

13 Aug '13

https://bugzilla.balabit.com/show_bug.cgi?id=238 Summary: syslog-protocol: allow NILVALUE for TIMESTAMP as specified in rfc5424 Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: spam(a)lerya.net Type of the Report: --- Estimated Hours: 0.0 RFC5424 states: - section 6: """ TIMESTAMP = NILVALUE / FULL-DATE "T" FULL-TIME """ - section 6.2.3 "" A syslog application MUST use the NILVALUE as TIMESTAMP if the syslog application is incapable of obtaining system time. "" But the 3.4 version of syslog-ng does not allow such a NILVALUE: https://github.com/balabit/syslog-ng-3.4/blob/master/modules/syslogformat/s… For example, the following message does not work: <6>1 - - netlog - - - [ 775.895618] /bin/ping[2936] UDP 10.0.2.15:33285 -> 192.168.0.1:53 (uid=0) Whereas this one works: <6>1 2003-10-11T22:14:15.003Z - netlog - - - [ 775.895618] /bin/ping[2936] UDP 10.0.2.15:33285 -> 192.168.0.1:53 (uid=0) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 13

[Bug 240] New: host() in filters fail to match if using use_dns(yes)
by bugzilla＠bugzilla.balabit.com 13 Aug '13

13 Aug '13

https://bugzilla.balabit.com/show_bug.cgi?id=240 Summary: host() in filters fail to match if using use_dns(yes) Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bmartin(a)lavabit.com Type of the Report: bug Estimated Hours: 0.0 After upgrading from version 3.2.5 to 3.4.2 a filter using host() did not work anymore. The filter looks something like this: filter f_filter { host("172.12.0.1") or host("172.12.0.2"); }; Messages which would match this filter never reached their destination as they were used to with 3.2.5. I figured out that $HOST contained only the string '172'. My assumption is that host() matches against $HOST. In turn I set use_dns(no) and things started working again and now $HOST contains the whole IP address. used global options: options { threaded(yes); chain_hostnames(no); use_dns(no); stats_freq(43200); mark_freq(3600); }; -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

[Bug 242] New: IP address stripped to first number with use_fqdn off
by bugzilla＠bugzilla.balabit.com 13 Aug '13

13 Aug '13

https://bugzilla.balabit.com/show_bug.cgi?id=242 Summary: IP address stripped to first number with use_fqdn off Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: list0570(a)paradise.net.nz Type of the Report: bug Estimated Hours: 0.0 transport("udp") ip("0.0.0.0") port(514) ip-protocol(4) keep_timestamp(no) keep_hostname(no) # no = rewrite hostname use_dns(yes) # yes, no, persist_only use_fqdn(no) Regardless of what the use_dns setting is, if the host name is an IP address A.B.C.D, use_fqdn is no, and /etc/hosts has no name and the DNS lookup fails, then only "A" is logged as the host name. This is not useful at all - if a name lookup fails for an IP address, you have to keep the IP address and not truncate it to something useless. syslog-ng-3.4.2-1.5.1.i586 from openSUSE 12.3 -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[Bug 243] New: patterndb rule should allow action upon context timeout
by bugzilla＠bugzilla.balabit.com 09 Aug '13

09 Aug '13

https://bugzilla.balabit.com/show_bug.cgi?id=243 Summary: patterndb rule should allow action upon context timeout Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.balabit(a)faxm0dem.org Type of the Report: enhancement Estimated Hours: 0.0 Currently in an event correlation configuration, when a certain context times out, the whole rule is thrown away. It would be very useful to be able to trigger an action when a rule's context-timeout is reached. Of course the ability to add a timeout_action for every rule would further enhance the idea. Example: <ruleset name='dummy_ruleset' id='03eb0142-4b0c-4226-ac98-6bcb03e59e00'> <pattern>dummy_program</pattern> <rules> <rule provider="dummy_provider" id="0cc9a000-2a4e-41f2-b30b-09d67af68ddc" class='dummy_class' context-timeout="300" context-scope="program" context-id="dummy_context"> <patterns> <pattern>First message has @ANYSTRING:dummy_string@</pattern> </patterns> <timeout_actions> <action> <message> <values> <value name="MESSAGE">Timeout: Failed to correlate ${dummy_string}@1 with anything</value> </values> </message> </action> </timeout_actions> </rule> <rule provider="dummy_provider" id="6fbefe59-3448-4b29-8c4f-7d9c1ab65a4c" class='dummy_class' context-scope="program" context-id="dummy_context"> <patterns> <pattern>Second message has @ANYSTRING:dummy_string@</pattern> </patterns> <actions> <action> <message> <values> <value name="MESSAGE">Correlated ${dummy_string}@1 with ${dummy_string}@2</value> </values> </message> </action> </actions> </rule> </rules> </ruleset> -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

Time Conversion and String delimiter
by Kyaw Kyi 07 Aug '13

07 Aug '13

Hi, I have a non-standard (not rfc 5414) log message format coming into syslog-ng client. I am trying to use csv-parser to parse into custom macros and send it off to syslog-ng host in the correct format. With no-parse option, how do I make syslog-ng handle this incoming timestamp: [July 30, 2013 10:19:06 AM] ? It would be so much easier to simply use the timestamp for the time message received in syslog-ng (e.g $DATE marco) but I have to extract the timestamp from the message itself somehow. Example: [July 30, 2013 10:19:06 AM EDT] DisplayType=CLEAR ClassName=Host.... Secondly, the documentation of syslog-ng seems to hint that I can use string delimiter in parser. "Currently only the csv-parser is implemented, which can separate columns based on delimiter characters and strings." but it also says that "If you specify multiple characters, every character will be treated as a delimiter." . Is there a way for me to use a string, not single characters, as delimiters in csv-parser? Thanks. ------------------------------------------------------------------------------ Please consider the environment before printing this email. Visit our website at http://www.nyse.com <http://www.nyse.com> ***************************************************************************** Note: The information contained in this message and any attachment to it is privileged, confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately by replying to the message, and please delete it from your system. Thank you. NYSE Euronext.

2 1

system() source problem.
by Nemeth Gyorgy 07 Aug '13

07 Aug '13

I compiled a syslog-ng 3.4 and when starting I get teh following error message: Error parsing source, source plugin system not found in /etc/syslog-ng/syslog-ng.conf at line 31, column 2: system(); The part of syslog-ng.conf is the following: source s_src { # message generated by Syslog-NG internal(); # standard Linux log source (this is the default place for the syslog() # function to send logs to) unix-stream("/dev/log"); # messages from the kernel file("/proc/kmsg" program_override("kernel")); # use the following line if you want to receive remote UDP logging messages # (this is equivalent to the "-r" syslogd flag) # udp(); system(); }; According to the documentation the system() source is correct.. What is wrong here? When I comment the system() source out, the syslog-ng daemon starts without errors. # syslog-ng -V syslog-ng 3.4.2 Installer-Version: 3.4.2 Revision: Compile-Date: Aug 5 2013 11:00:20 Available-Modules: syslogformat,afsocket-notls,afsocket-tls,afsql,affile,afprog,afuser,afamqp,afmongodb,csvparser,confgen,system-source,basicfuncs,cryptofuncs,dbparser,afsocket Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-Linux-Caps: off Enable-Pcre: on -- Friczy

3 3

problem tagging with patterndb (syslog-ng 3.4.1)
by mailing lists 06 Aug '13

06 Aug '13

Hello all, I am having a problem understanding patterndb and tags, for the following rule the log line is matched but tags are not settled in pdbtool output. What am i missing here? <rule id="dad57bd5-6f9e-47b8-9e9f-401e3eb34334" provider="user" class="system"> <patterns> <pattern>@ESTRING:postfix.qid::@ to=@QSTRING:postfix.to:<>@, orig_to=@QSTRING:postfix.orig_to:<>@, relay=@ESTRING:postfix.relay.hostname:[@@ESTRING:postfix.relay.path:]@, delay=@ESTRING:postfix.delay:,@ delays=@ESTRING:postfix.delays.1:/@@ESTRING:postfix.delays.2:/@@ESTRING:postfix.delays.3:/@@ESTRING:postfix.delays.4:,@ dsn=@ESTRING:postfix.dsn:,@ status=@ESTRING:postfix.status: @@QSTRING:postfix.statusmsg:()@</pattern> <pattern>@ESTRING:postfix.qid::@ to=@QSTRING:postfix.to:<>@, orig_to=@QSTRING:postfix.orig_to:<>@, relay=@ESTRING:postfix.relay.hostname:[@@ESTRING:postfix.relay.path:]@:24, delay=@ESTRING:postfix.delay:,@ delays=@ESTRING:postfix.delays.1:/@@ESTRING:postfix.delays.2:/@@ESTRING:postfix.delays.3:/@@ESTRING:postfix.delays.4:,@ dsn=@ESTRING:postfix.dsn:,@ status=@ESTRING:postfix.status: @@QSTRING:postfix.statusmsg:()@</pattern> <pattern>@ESTRING:postfix.qid::@ to=@QSTRING:postfix.to:<>@, orig_to=@QSTRING:postfix.orig_to:<>@, relay=@ESTRING:postfix.relay.hostname:[@@ESTRING:postfix.relay.path:]@:24, delay=@ESTRING:postfix.delay:,@ delays=@ESTRING:postfix.delays.1:/@@ESTRING:postfix.delays.2:/@@ESTRING:postfix.delays.3:/@@ESTRING:postfix.delays.4:,@ dsn=@ESTRING:postfix.dsn:,@ status=@ESTRING:postfix.status: @(@ESTRING:postfix.status.code1: @@ESTRING:postfix.status.code2: @@EMAIL:postfix.status.recipient:<> @@ESTRING:postfix.status.qid: @Saved)</pattern> </patterns> <tags> <tag>postfix</tag> <tag>lmtp</tag> </tags> </rule> $ pdbtool match -P 'postfix' -p postfix.pdb -D -c -f mail.log Pattern matching part: @ESTRING:postfix.qid=B5BBAADB@ to=@QSTRING:postfix.to=user002@example.com@, orig_to=@QSTRING:postfix.orig_to=noreply@example.com@, relay=@ESTRING:postfix.relay.hostname=lmtp.example.com@@ESTRING:postfix.relay.path=10.180.242.142@:24, delay=@ESTRING:postfix.delay=0.07@ delays=@ESTRING:postfix.delays.1=0.04@@ESTRING:postfix.delays.2=0@@ESTRING:postfix.delays.3=0@@ESTRING:postfix.delays.4=0.03@ dsn=@ESTRING:postfix.dsn=2.0.0@ status=@ESTRING:postfix.status=sent@(@ESTRING:postfix.status.code1=250@@ESTRING:postfix.status.code2=2.0.0@@EMAIL:postfix.status.recipient=noreply@example.com@@ESTRING:postfix.status.qid=XP52K7Bp+1G/FAAAtCZERg@Saved) Matching part: B5BBAADB: to=<user002(a)example.com>, orig_to=<noreply(a)example.com>, relay=lmtp.example.com[10.180.242.142]:24, delay=0.07, delays=0.04/0/0/0.03, dsn=2.0.0, status=sent (250 2.0.0 <noreply(a)example.com> XP52K7Bp+1G/FAAAtCZERg Saved) Values: HOST=mailserver MESSAGE=B5BBAADB: to=<user002(a)example.com>, orig_to=<noreply(a)example.com>, relay=lmtp.example.com[10.180.242.142]:24, delay=0.07, delays=0.04/0/0/0.03, dsn=2.0.0, status=sent (250 2.0.0 <noreply(a)example.com> XP52K7Bp+1G/FAAAtCZERg Saved) PROGRAM=postfix/lmtp PID=29484 LEGACY_MSGHDR=postfix/lmtp[29484]: .classifier.class=system .classifier.rule_id=dad57bd5-6f9e-47b8-9e9f-401e3eb34334 postfix.qid=B5BBAADB postfix.to=user002(a)example.com postfix.orig_to=noreply(a)example.com postfix.relay.hostname=lmtp.example.com postfix.relay.path=10.180.242.142 postfix.delay=0.07 postfix.delays.1=0.04 postfix.delays.2=0 postfix.delays.3=0 postfix.delays.4=0.03 postfix.dsn=2.0.0 postfix.status=sent postfix.status.code1=250 postfix.status.code2=2.0.0 postfix.status.recipient=noreply(a)example.com postfix.status.qid=XP52K7Bp+1G/FAAAtCZERg TAGS=

2 1

Multi-line support issue
by Satish Patel 03 Aug '13

03 Aug '13

We have tomcat shop and at everyone know tomcat has a java call trace in logs with tab space but syslog-ng doesn't know about it and printing lines as a new line. I have read here syslog-ng 3.x does support multi-line logs http://www.balabit.com/sites/default/files/documents/syslog-ng-pe-4.0-guide… But does this feature available in Open Source syslog-ng? If yes then why its not working for me?

3 18

Re: [syslog-ng] question on parsed syslog-ng config files and command line options
by Jim Hendrick 27 Jul '13

27 Jul '13

Thanks! Sent from my Verizon Wireless 4G LTE Smartphone -------- Original message -------- From: Balazs Scheidler <bazsi77(a)gmail.com> Date: 07/26/2013 5:35 PM (GMT-05:00) To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] question on parsed syslog-ng config files and command line options --preprocess-into Not a perfect name, and should probably exit after having done its work. On Jul 26, 2013 9:46 PM, <jrhendri(a)roadrunner.com> wrote: Hi, I remember seeing (somewhere...) a command line option for syslog-ng that created an output file that was essentially the "resulting configuration" after all #include files were processed. I am trying to debug a problem with message parsing, and my filters are maintained in separate files. I was hoping I could remember this option so I could see what syslog-ng "thought" the resultant config was but (neither myself nor google) can remember it. essentially it expands all the include files "inline" and produces one output file. Help? Thanks, Jim ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

question on parsed syslog-ng config files and command line options
by jrhendri＠roadrunner.com 26 Jul '13

26 Jul '13

Hi, I remember seeing (somewhere...) a command line option for syslog-ng that created an output file that was essentially the "resulting configuration" after all #include files were processed. I am trying to debug a problem with message parsing, and my filters are maintained in separate files. I was hoping I could remember this option so I could see what syslog-ng "thought" the resultant config was but (neither myself nor google) can remember it. essentially it expands all the include files "inline" and produces one output file. Help? Thanks, Jim

2 1

Time zone problem in Mongodb driver
by Kyaw Kyi 25 Jul '13

25 Jul '13

Hi, I tried to use time_zone() option in mongodb destination driver but it is throwing an error. Error parsing afmongodb, syntax error, unexpected KW_TIME_ZONE, expecting ')' in /usr/local/etc/syslog-ng.conf at line 60, column 2: time_zone("America/New_York") It doesn't seem to a syntax error. It seems more like syslog-ng doesn't understand the time_zone() option in mongodb driver. This is my configuration: @version: 3.4 @include "scl.conf" options { ts_format(iso) ; keep_hostname(yes); keep_timestamp(yes); time_reopen(10); }; destination d_mongodb1 { mongodb( time_zone("America/New_York") ); }; I tried using ("-04:00") instead but no avail. Mongodb destination driver is working well without the time_zone() option. Thanks, Joe ------------------------------------------------------------------------------ Please consider the environment before printing this email. Visit our website at http://www.nyse.com <http://www.nyse.com> ***************************************************************************** Note: The information contained in this message and any attachment to it is privileged, confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately by replying to the message, and please delete it from your system. Thank you. NYSE Euronext.

4 5

XMPP destination for syslog-ng
by IKAC 23 Jul '13

23 Jul '13

Hi, My name is Ilija, and I'm a undergraduate student of computer science. I'm interested if this project is open for contribution apart from GSOC, since as I saw that there is no activity on it's github repository? Best regards, Ilija

5 5

AUTO: James B Horwath is out of the office (returning 07/29/2013)
by James B Horwath 20 Jul '13

20 Jul '13

I am out of the office until 07/29/2013. I will be out of the office until 07/29/2013 with limited access to e-mail. If you have an urgent issue please contact Sunil Gupta at (610)-807-6710 or Dylan Yoder at (610)-807-7230. Regards Jim Horwath IT Security Services & Governance, Corporate BTS and IT Security/Risk Tel 610-807-8795 Mobile 610-533-6972 3900 Burgess Place, Bethlehem, Pa. 18017 Jim_Horwath(a)glic.com Note: This is an automated response to your message "syslog-ng Digest, Vol 99, Issue 20" sent on 7/20/2013 6:00:02. This is the only notification you will receive while this person is away. ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

1 0

Help getting my rewrite to work
by Dave Vernon 19 Jul '13

19 Jul '13

Good morning all, I'm having difficulties getting my rewrite statement to work properly. I've been spending more hours than I care to admit pouring through docs, examples, etc and just can't get it. (I really thought I was on the right track from a post in the May archives) In short, I am using syslog-ng 3.4.2 to receive my Windows event logs. There are several common Windows events that includes a detailed description of the event EVERY TIME that I am trying to drop before writing to my syslog server, leaving just the meat. I originally wanted to start my testing by replacing a single word (i.e. the word "interactive" so that I could make sure the re-write rule was working before I tweaked my regex.) However, whenever I add my rule it's not logging any event that matches at all, and I'm not sure why. I'm doing a tail on the log file and it just doesn't write (literally) anything at all. My examples... source s_syslog { udp(ip(0.0.0.0) port(514)); }; destination d_allwindows { file("/syslog/log/windows/hosts/$HOST/$R_YEAR/$R_MONTH/$R_DAY/$HOST$YEAR$MONTH$DAY" create_dirs(yes)); }; rewrite r_rewrite_4624_2 { subst("interactive", "QuackApple", value("MSGONLY"));}; ("interactive" is contained in the message, so it was an easy one to pickout for testing, and I used the string "QuackApple" as the replacement as I know it won't naturally appear, so I can search on it easily) log { source(s_syslog); filter(f_allwindows); rewrite(r_rewrite_4624_2); destination(d_allwindows); }; With these rules in place, the log is actually dropped, not re-written. If I change my rewrite rule to be something not found (i.e. replace "interactive" with "ZZowkr" then the events start showing up in the tail again) Thanks! Dave Vernon

2 2

[Bug 239] New: syslog-ng refuses to allow 'Common Name' CN wildcards
by bugzilla＠bugzilla.balabit.com 11 Jul '13

11 Jul '13

https://bugzilla.balabit.com/show_bug.cgi?id=239 Summary: syslog-ng refuses to allow 'Common Name' CN wildcards Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Windows Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: shawn.starr(a)statpro.com Type of the Report: bug Estimated Hours: 0.0 Distribution package version: 3.3.4.dfsg-2ubuntu1 (3.3.4) When attempting to use the following configuration: source system_stuff { system(); }; destination dest_kern { tcp("192.168.70.4" port(514) tls( #peer-verify(optional-untrusted) peer-verify(required-trusted) cipher_suite("AES256-SHA") trusted_dn("*, O=MyCompany Name, L=Toronto, ST=Ontario, C=CA") cert_file("/etc/syslog-ng/certs/genericServer.crt") ca_dir("/etc/syslog-ng/ca")) ); }; log { source(system_stuff); destination(dest_kern); }; Jul 9 12:20:01 testad syslog-ng[12607]: Certificate subject does not match configured hostname; hostname='192.168.70.4', certificate='*.dev.company.com' When trying to use trusted_tn("CN=*.dev.company.com, O=MyCompany Name, L=Toronto, ST=Ontario, C=CA) it then shows: Jul 9 11:21:20 testad syslog-ng[12473]: Certificate valid, but DN constraints were not met, rejecting; If I read this right, CN is provided (as per default CA policy) but we should be able to match hosts to the wildcard. Similar to what rsyslog has: http://www.rsyslog.com/doc/tls_cert_server.html I don't know if this also happens in 3.5.x but I can test this on my Fedora systems at home -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

Re: [syslog-ng] syslog-ng Digest, Vol 99, Issue 9
by Yarick Tsagoyko 11 Jul '13

11 Jul '13

Dear Satish, multiline is supported in open source version of syslog-ng, as bazsi wrote. To glue the lines together, into one line you can do one of two things. First, configure syslog-ng not to break messages into separate lines, by disabling native multiline support. Second, define a pattern that identifies the beginning of a new line. I encourage you to read the manual prior to engaging entire list to solve your issue, which is clearly not an issue with the way code is written. Thanks. Y. This is my source declaration and i have put flags which you have mentioned. source s_tomcat { syslog( transport("udp") flags(indent-multi-line)); }; I got following error when i am trying to put flags Error parsing afsocket, Unknown flag indent-multi-line in /usr/local/syslog-ng-3.4.2/etc/syslog-ng.conf at line 54, column 33: syslog( transport("udp") flags(indent-multi-line) ); On Thu, Jul 11, 2013 at 10:22 AM, <syslog-ng-request(a)lists.balabit.hu>wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Re: Multi-line support issue (Balazs Scheidler) > 2. Re: Multi-line support issue (Satish Patel) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 11 Jul 2013 13:53:56 +0200 > From: Balazs Scheidler <bazsi(a)balabit.hu> > Subject: Re: [syslog-ng] Multi-line support issue > To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> > Message-ID: <1373543636.3171.17.camel@bzorp> > Content-Type: text/plain; charset="UTF-8" > > > I can't see the source declaration, it must be something along the lines > of: > > source s_tomcat { > file("/var/log/tomcat/xxx.log" flags(indent-multi-line)); > }; > > On Wed, 2013-07-10 at 12:54 -0400, Satish Patel wrote: > > Hi Balazs, > > > > > > what is your thought about my config? did you see? > > > > > > > > On Mon, Jul 8, 2013 at 12:30 PM, Satish Patel <satish.txt(a)gmail.com> > > wrote: > > This is what i have configured and no luck with it.. can you > > suggest what i am missing? > > > > destination d02_tc74_log > > { file("/logs/server1/tomcat7.4/catalina_$YEAR$MONTH$DAY.log" > > template("$(indent-multi-line ${MESSAGE})\n") > > template(t_tomcatlog) owner("root") group("root") perm(0644) > > dir_perm(0755) create_dirs(yes)); }; > > filter server1 { host("server1.example.com") }; > > log { > > source (s_tomcat); > > filter (server1); > > filter (tomcat7_4); > > destination (d02_tc74_log); > > }; > > > > > > > > > > On Mon, Jul 8, 2013 at 12:08 PM, Satish Patel > > <satish.txt(a)gmail.com> wrote: > > How do i use indented-multi-line ? I meant where do i > > configure it? I tried but my syslog-ng doesn't > > recognizing this option i have syslog-ng 3.3.7 could > > you give me example where and how do i check whether > > it is supported or not > > > > > > > > On Sat, Jul 6, 2013 at 2:12 AM, Balazs Scheidler > > <bazsi77(a)gmail.com> wrote: > > This looks.like the format that should be > > supported by indented-multi-line > > > > On Jul 5, 2013 9:33 PM, "Satish Patel" > > <satish.txt(a)gmail.com> wrote: > > Here is my tomcat catalina.out log > > file sample. See there is a tab space > > in logs > > > > 2013-06-27 05:30:00,065 > > [EDISN-Scheduler_Worker-2] ERROR > > com.example.edisn.sftp.SftpSession - > > Exception attempting to work with an > > SFTP Session: connection is closed by > > foreign host > > 2013-06-27 05:30:00,066 > > [EDISN-Scheduler_Worker-2] ERROR > > org.quartz.core.JobRunShell - Job > > EDISN.CTMS_Upload threw an unhandled > > Exception: > > com.example.edisn.EdisnRuntimeException: > Exception attempting to work with an SFTP Session: connection is closed by > foreign host > > at > > > com.example.edisn.sftp.SftpSession.doSession(SftpSession.java:64) > > at > > > com.example.edisn.EdisnSession.exec(EdisnSession.java:13) > > at > > > com.example.ctms.CtmsScheduledJob.executeInternal(CtmsScheduledJob.java:27) > > at > > > org.springframework.scheduling.quartz.QuartzJobBean.execute(QuartzJobBean.java:86) > > at > > > org.quartz.core.JobRunShell.run(JobRunShell.java:202) > > at > > org.quartz.simpl.SimpleThreadPool > > > $WorkerThread.run(SimpleThreadPool.java:525) > > Caused by: > > com.jcraft.jsch.JSchException: > > connection is closed by foreign host > > at > > com.jcraft.jsch.Session.connect(Unknown > Source) > > at > > com.jcraft.jsch.Session.connect(Unknown > Source) > > at > > > com.example.edisn.sftp.SftpSession.doSession(SftpSession.java:45) > > ... 5 more > > > > > > > > > > On Fri, Jul 5, 2013 at 3:27 PM, Balazs > > Scheidler <bazsi77(a)gmail.com> wrote: > > No, I implemented a different > > multiline style support first > > (that is not in pe), where > > continuation lines are > > indicated by indentation, like > > mime. > > > > Iirc tomcat has this kind of > > log file. Can you show a > > sample log entry? > > > > The infrastructure for > > multiline-prefix is also there > > but not added yet. > > > > Let me see the sample, I'll > > tell if the current solution > > works or not. > > > > On Jul 5, 2013 8:24 PM, > > "Satish Patel" > > <satish.txt(a)gmail.com> wrote: > > Thanks for reply > > Balazs, > > > > > > You mean say this > > feature is available > > in Open Source Edition > > (OSE) 3.4? Once after > > specifying flag > > "indented-multi-line" > > i can use > > multi-line-prefix? > > > > > > > > On Fri, Jul 5, 2013 at > > 1:26 PM, Balazs > > Scheidler > > <bazsi77(a)gmail.com> > > wrote: > > You have found > > the PE > > documentation > > but I have > > already ported > > this to the > > OSE tree and > > has been > > released as > > part of 3.4. > > > > You have to > > specify > > > indented-multi-line as a flag to the file source. > > > > On Jul 5, 2013 > > 6:28 PM, > > "Satish Patel" > > < > satish.txt(a)gmail.com> wrote: > > > > We > > have > > tomcat > > shop > > and at > > everyone > know tomcat has a java call trace in logs with tab space but syslog-ng > doesn't know about it and printing lines as a new line. I have read here > syslog-ng 3.x does support multi-line logs > http://www.balabit.com/sites/default/files/documents/syslog-ng-pe-4.0-guide… > > > > > > But > > does > > this > > feature > available in Open Source syslog-ng? If yes then why its not working for me? > > > > > > > > > ______________________________________________________________________________ > > Member > > info: > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: > > > http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > ______________________________________________________________________________ > > Member info: > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: > > > http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > > > > > ______________________________________________________________________________ > > Member info: > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: > > > http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > ______________________________________________________________________________ > > Member info: > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: > > > http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > > > > > ______________________________________________________________________________ > > Member info: > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: > > > http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > ______________________________________________________________________________ > > Member info: > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > > > > > > > > > > > ______________________________________________________________________________ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > ------------------------------ > > Message: 2 > Date: Thu, 11 Jul 2013 10:22:45 -0400 > From: Satish Patel <satish.txt(a)gmail.com> > Subject: Re: [syslog-ng] Multi-line support issue > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <CAPgF-fpPdRswwj2HNUXAxfgRekHVhwwF6O= > 7N39q9mfggN-nUQ(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > This is my source declaration and i have put flags which you have > mentioned. > > source s_tomcat { > syslog( transport("udp") flags(indent-multi-line)); > }; > > I got following error when i am trying to put flags > > Error parsing afsocket, Unknown flag indent-multi-line in > /usr/local/syslog-ng-3.4.2/etc/syslog-ng.conf at line 54, column 33: > > syslog( transport("udp") flags(indent-multi-line) ); > ^^^^^^^^^^^^^^^^^ > > > > > On Thu, Jul 11, 2013 at 7:53 AM, Balazs Scheidler <bazsi(a)balabit.hu> > wrote: > > > > > I can't see the source declaration, it must be something along the lines > > of: > > > > source s_tomcat { > > file("/var/log/tomcat/xxx.log" flags(indent-multi-line)); > > }; > > > > On Wed, 2013-07-10 at 12:54 -0400, Satish Patel wrote: > > > Hi Balazs, > > > > > > > > > what is your thought about my config? did you see? > > > > > > > > > > > > On Mon, Jul 8, 2013 at 12:30 PM, Satish Patel <satish.txt(a)gmail.com> > > > wrote: > > > This is what i have configured and no luck with it.. can you > > > suggest what i am missing? > > > > > > destination d02_tc74_log > > > { file("/logs/server1/tomcat7.4/catalina_$YEAR$MONTH$DAY.log" > > > template("$(indent-multi-line ${MESSAGE})\n") > > > template(t_tomcatlog) owner("root") group("root") perm(0644) > > > dir_perm(0755) create_dirs(yes)); }; > > > filter server1 { host("server1.example.com") }; > > > log { > > > source (s_tomcat); > > > filter (server1); > > > filter (tomcat7_4); > > > destination (d02_tc74_log); > > > }; > > > > > > > > > > > > > > > On Mon, Jul 8, 2013 at 12:08 PM, Satish Patel > > > <satish.txt(a)gmail.com> wrote: > > > How do i use indented-multi-line ? I meant where do i > > > configure it? I tried but my syslog-ng doesn't > > > recognizing this option i have syslog-ng 3.3.7 could > > > you give me example where and how do i check whether > > > it is supported or not > > > > > > > > > > > > On Sat, Jul 6, 2013 at 2:12 AM, Balazs Scheidler > > > <bazsi77(a)gmail.com> wrote: > > > This looks.like the format that should be > > > supported by indented-multi-line > > > > > > On Jul 5, 2013 9:33 PM, "Satish Patel" > > > <satish.txt(a)gmail.com> wrote: > > > Here is my tomcat catalina.out log > > > file sample. See there is a tab space > > > in logs > > > > > > 2013-06-27 05:30:00,065 > > > [EDISN-Scheduler_Worker-2] ERROR > > > com.example.edisn.sftp.SftpSession - > > > Exception attempting to work with an > > > SFTP Session: connection is closed by > > > foreign host > > > 2013-06-27 05:30:00,066 > > > [EDISN-Scheduler_Worker-2] ERROR > > > org.quartz.core.JobRunShell - Job > > > EDISN.CTMS_Upload threw an unhandled > > > Exception: > > > > com.example.edisn.EdisnRuntimeException: > > Exception attempting to work with an SFTP Session: connection is closed > by > > foreign host > > > at > > > > > com.example.edisn.sftp.SftpSession.doSession(SftpSession.java:64) > > > at > > > > > com.example.edisn.EdisnSession.exec(EdisnSession.java:13) > > > at > > > > > > com.example.ctms.CtmsScheduledJob.executeInternal(CtmsScheduledJob.java:27) > > > at > > > > > > org.springframework.scheduling.quartz.QuartzJobBean.execute(QuartzJobBean.java:86) > > > at > > > > > org.quartz.core.JobRunShell.run(JobRunShell.java:202) > > > at > > > org.quartz.simpl.SimpleThreadPool > > > > > $WorkerThread.run(SimpleThreadPool.java:525) > > > Caused by: > > > com.jcraft.jsch.JSchException: > > > connection is closed by foreign host > > > at > > > com.jcraft.jsch.Session.connect(Unknown > > Source) > > > at > > > com.jcraft.jsch.Session.connect(Unknown > > Source) > > > at > > > > > com.example.edisn.sftp.SftpSession.doSession(SftpSession.java:45) > > > ... 5 more > > > > > > > > > > > > > > > On Fri, Jul 5, 2013 at 3:27 PM, Balazs > > > Scheidler <bazsi77(a)gmail.com> wrote: > > > No, I implemented a different > > > multiline style support first > > > (that is not in pe), where > > > continuation lines are > > > indicated by indentation, like > > > mime. > > > > > > Iirc tomcat has this kind of > > > log file. Can you show a > > > sample log entry? > > > > > > The infrastructure for > > > multiline-prefix is also there > > > but not added yet. > > > > > > Let me see the sample, I'll > > > tell if the current solution > > > works or not. > > > > > > On Jul 5, 2013 8:24 PM, > > > "Satish Patel" > > > <satish.txt(a)gmail.com> wrote: > > > Thanks for reply > > > Balazs, > > > > > > > > > You mean say this > > > feature is available > > > in Open Source Edition > > > (OSE) 3.4? Once after > > > specifying flag > > > "indented-multi-line" > > > i can use > > > multi-line-prefix? > > > > > > > > > > > > On Fri, Jul 5, 2013 at > > > 1:26 PM, Balazs > > > Scheidler > > > <bazsi77(a)gmail.com> > > > wrote: > > > You have found > > > the PE > > > documentation > > > but I have > > > already ported > > > this to the > > > OSE tree and > > > has been > > > released as > > > part of 3.4. > > > > > > You have to > > > specify > > > > > indented-multi-line as a flag to the file source. > > > > > > On Jul 5, 2013 > > > 6:28 PM, > > > "Satish Patel" > > > < > > satish.txt(a)gmail.com> wrote: > > > > > > We > > > have > > > tomcat > > > shop > > > and at > > > > everyone > > know tomcat has a java call trace in logs with tab space but syslog-ng > > doesn't know about it and printing lines as a new line. I have read here > > syslog-ng 3.x does support multi-line logs > > > http://www.balabit.com/sites/default/files/documents/syslog-ng-pe-4.0-guide… > > > > > > > > > But > > > does > > > this > > > feature > > available in Open Source syslog-ng? If yes then why its not working for > me? > > > > > > > > > > > > > > > ______________________________________________________________________________ > > > Member > > > info: > > > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > > Documentation: > > http://www.balabit.com/support/documentation/?product=syslog-ng > > > FAQ: > > > > > http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > > > > > > > ______________________________________________________________________________ > > > Member info: > > > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Documentation: > > > > > http://www.balabit.com/support/documentation/?product=syslog-ng > > > FAQ: > > > > > http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > > > > > > > > > > > > > ______________________________________________________________________________ > > > Member info: > > > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Documentation: > > > > > http://www.balabit.com/support/documentation/?product=syslog-ng > > > FAQ: > > > > > http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > > > > > > > ______________________________________________________________________________ > > > Member info: > > > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Documentation: > > > > > http://www.balabit.com/support/documentation/?product=syslog-ng > > > FAQ: > > > > > http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > > > > > > > > > > > > > ______________________________________________________________________________ > > > Member info: > > > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Documentation: > > > > > http://www.balabit.com/support/documentation/?product=syslog-ng > > > FAQ: > > > > > http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > > > > > > > ______________________________________________________________________________ > > > Member info: > > > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Documentation: > > > > > http://www.balabit.com/support/documentation/?product=syslog-ng > > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > ______________________________________________________________________________ > > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Documentation: > > http://www.balabit.com/support/documentation/?product=syslog-ng > > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > > > > > > > > ______________________________________________________________________________ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > >

1 0

iv_port_poll socket operation on non-socket -- syslog-ng 3.3.7 Solaris 10 opterron
by Rakesh Rajasekharan 09 Jul '13

09 Jul '13

Hello everyone, I am using syslog-ng 3.3.7 compiled on solaris 10 opteron. When I try to run the daemon I get this error.. "iv_port_poll socket operation on non-socket". But this same binary works fine on Soalris 11 opteron. Any ideas on this please, why the error comes...? Thanks, Rakesh.

1 0

IPv6 TLS source question
by Jeff Lange 05 Jul '13

05 Jul '13

I'm attempting to setup a TCP IPv6 source declaration that uses TLS but syslog-ng is not happy with the configuration file. The following is what I use for IPv4 and it works fine: source s_tls { syslog( ip(0.0.0.0) port(6514) transport( "tls" ) tls ( key_file("/srv/syslog-ng/certs/priv-key.pem") cert_file("/srv/syslog-ng/certs/id-cert.pem") ca_dir("/srv/syslog-ng/certs") cipher_suite("SHA256:!aNULL:!eNULL:!ECDH:!DSS") ) ); }; However the following is not valid: source s_tls6 { syslog( ip("::") port(6515) transport( "tls" ) tls ( key_file("/srv/syslog-ng/certs/priv-key.pem") cert_file("/srv/syslog-ng/certs/id-cert.pem") ca_dir("/srv/syslog-ng/certs") cipher_suite("SHA256:!aNULL:!eNULL:!ECDH:!DSS") ) ); }; I've tried the ip with and without quotes with no luck. What am I doing wrong? Thanks -Jeff

3 4

[GSoC2013][syslog-ng:MySQL destination] Status update
by Gyula Petrovics 04 Jul '13

04 Jul '13

Hello, I published a new status update on my blog http://petrovicsgyula.blogspot.hu/ , and some source code on github https://github.com/gyula/mysqlclient/. Best regards, Gyula

1 0

Upcoming changes regarding my Debian/Ubuntu packages
by Gergely Nagy 04 Jul '13

04 Jul '13

Hi! For a good while now, I've been providing Debian and Ubuntu packages[1] for syslog-ng, and rest assured, I will continue to do so. However, the way they are prepared and how the repository is structured, will change. At the moment, there are two different components one can choose from: syslog-ng and syslog-ng-devel, which have packages for 3.3 and 3.4, respectively. However, -devel is not appropriate for 3.4 anymore, but I don't want to move it to syslog-ng either, partly because up to this point, there were no Ubuntu Lucid packages of 3.4. So, I will be making the following changes: * I'll create syslog-ng-3.3, syslog-ng-3.4 and syslog-ng-3.5 components * syslog-ng will point to the latest stable branch (3.4) * syslog-ng will point to the current development branch (3.5) * I'll be preparing Ubuntu Lucid packages for 3.4 too, so all branches will be available for every debian or ubuntu system that are still supported by their respective vendors. To be able to provide Ubuntu Lucid (10.04) packages sanely, I have to do the packaging a little bit differently: the source package will not be shared between debian and ubuntu anymore, and systemd support will be explicitly disabled on Ubuntu. But since Ubuntu uses upstart by default, ubuntu systems with systemd are fairly unlikely anyway. I plan to make these changes once 3.4.2 comes out. Until then, I'll introduce the syslog-ng-3.3 and -3.4 components, but syslog-ng will point to -3.3 still, and -devel to -3.4. Once 3.4.2 is out, though, I'll change the symlinks. [1]: http://asylum.madhouse-project.org/projects/debian/ -- |8]

1 2

[PATCH (3.5)] affile: Error out when there's a syntax error in the filename template
by Gergely Nagy 04 Jul '13

04 Jul '13

When there is a syntax error in the filename template (eg, "/var/log/foo-$(+ 0"), error out at config load time. This is done by adding an error output variable to affile_dd_new_instance() and both affile_dd_new() and afpipe_dd_new(), then using that to store the result of log_template_compile(). If that function fails, we bail out early, and use CHECK_ERROR() in the grammar to notify the user of the issue. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/affile/affile-dest.c | 23 +++++++++++++++-------- modules/affile/affile-dest.h | 6 +++--- modules/affile/affile-grammar.ym | 12 +++++++++--- 3 files changed, 27 insertions(+), 14 deletions(-) diff --git a/modules/affile/affile-dest.c b/modules/affile/affile-dest.c index c8fa9c1..c9447ce 100644 --- a/modules/affile/affile-dest.c +++ b/modules/affile/affile-dest.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2002-2012 BalaBit IT Ltd, Budapest, Hungary + * Copyright (c) 2002-2013 BalaBit IT Ltd, Budapest, Hungary * Copyright (c) 1998-2012 Balázs Scheidler * * This program is free software; you can redistribute it and/or modify it @@ -703,17 +703,24 @@ affile_dd_free(LogPipe *s) } static AFFileDestDriver * -affile_dd_new_instance(gchar *filename) +affile_dd_new_instance(gchar *filename, GError **error) { AFFileDestDriver *self = g_new0(AFFileDestDriver, 1); + LogTemplate *filename_template; + + filename_template = log_template_new(configuration, NULL); + if (!log_template_compile(filename_template, filename, error)) + { + log_template_unref(filename_template); + return NULL; + } log_dest_driver_init_instance(&self->super); self->super.super.super.init = affile_dd_init; self->super.super.super.deinit = affile_dd_deinit; self->super.super.super.queue = affile_dd_queue; self->super.super.super.free_fn = affile_dd_free; - self->filename_template = log_template_new(configuration, NULL); - log_template_compile(self->filename_template, filename, NULL); + self->filename_template = filename_template; log_writer_options_defaults(&self->writer_options); file_perm_options_defaults(&self->file_perm_options); self->writer_options.mark_mode = MM_NONE; @@ -728,15 +735,15 @@ affile_dd_new_instance(gchar *filename) } LogDriver * -affile_dd_new(gchar *filename) +affile_dd_new(gchar *filename, GError **error) { - return &affile_dd_new_instance(filename)->super.super; + return &affile_dd_new_instance(filename, error)->super.super; } LogDriver * -afpipe_dd_new(gchar *filename) +afpipe_dd_new(gchar *filename, GError **error) { - AFFileDestDriver *self = affile_dd_new_instance(filename); + AFFileDestDriver *self = affile_dd_new_instance(filename, error); self->is_pipe = TRUE; return &self->super.super; } diff --git a/modules/affile/affile-dest.h b/modules/affile/affile-dest.h index 3f4f21b..dcee654 100644 --- a/modules/affile/affile-dest.h +++ b/modules/affile/affile-dest.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2002-2012 BalaBit IT Ltd, Budapest, Hungary + * Copyright (c) 2002-2013 BalaBit IT Ltd, Budapest, Hungary * Copyright (c) 1998-2012 Balázs Scheidler * * This program is free software; you can redistribute it and/or modify it @@ -53,8 +53,8 @@ typedef struct _AFFileDestDriver gint time_reap; } AFFileDestDriver; -LogDriver *affile_dd_new(gchar *filename); -LogDriver *afpipe_dd_new(gchar *filename); +LogDriver *affile_dd_new(gchar *filename, GError **error); +LogDriver *afpipe_dd_new(gchar *filename, GError **error); void affile_dd_set_create_dirs(LogDriver *s, gboolean create_dirs); void affile_dd_set_fsync(LogDriver *s, gboolean enable); diff --git a/modules/affile/affile-grammar.ym b/modules/affile/affile-grammar.ym index abecee4..0d2f099 100644 --- a/modules/affile/affile-grammar.ym +++ b/modules/affile/affile-grammar.ym @@ -1,5 +1,5 @@ /* - * Copyright (c) 2002-2012 BalaBit IT Ltd, Budapest, Hungary + * Copyright (c) 2002-2013 BalaBit IT Ltd, Budapest, Hungary * Copyright (c) 1998-2012 Balázs Scheidler * * This program is free software; you can redistribute it and/or modify it @@ -144,7 +144,10 @@ dest_affile dest_affile_params : string { - last_driver = *instance = affile_dd_new($1); + GError *error; + + last_driver = *instance = affile_dd_new($1, &error); + CHECK_ERROR(last_driver, @1, "Error compiling template; %s", error->message); free($1); last_writer_options = &((AFFileDestDriver *) last_driver)->writer_options; last_file_perm_options = &((AFFileDestDriver *) last_driver)->file_perm_options; @@ -171,7 +174,10 @@ dest_affile_option dest_afpipe_params : string { - last_driver = *instance = afpipe_dd_new($1); + GError *error; + + last_driver = *instance = afpipe_dd_new($1, &error); + CHECK_ERROR(last_driver, @1, "Error compiling template; %s", error->message); free($1); last_writer_options = &((AFFileDestDriver *) last_driver)->writer_options; last_file_perm_options = &((AFFileDestDriver *) last_driver)->file_perm_options; -- 1.7.10.4

2 2

Problems with recovering from 'disk full' I/O error
by Johnson, Chris (HP TippingPoint Roseville) 26 Jun '13

26 Jun '13

Hi all, I've come across a situation where syslog-ng (3.3.3 and 3.3.9) aborts after trying to write to a disk that has no space and then is cleaned up. I've been able to reproduce the 'error' condition with the following Set up: In the config file: ########################################################### # test log destination # filter f_test{program("LOGID_99-*" type("glob"));}; destination d_test { file("/var/testpartition/test.log" perm(0644) flags(no-multi-line)); }; log { source(s_local); filter(f_test); destination(d_test); flags(final); }; 1) Fill up the '/var/testpartition' disk: root@device:/var/testpartition# dd if=/dev/zero of=/var/testpartition/foo bs=1M dd: writing '/var/testpartition/foo': No space left on device 3531+0 records in 3529+1 records out 2) Send messages ('TEST: pre I/O error')to 'test.log' until syslog-ng complains: 2013-06-14 22:41:09.623 [device] [syslog-ng-ERROR:] "I/O error occurred while writing; fd='22', error='No space left on device (28)'" 2013-06-14 22:41:09.623 [device] [syslog-ng-NOTICE:] "Suspending write operation because of an I/O error; fd='22', time_reopen='60'" 3) Restart syslog-ng with a SIGHUP root@device:/var/testpartition# kill -s HUP $(cat /var/run/syslog-ng.pid) Program received signal SIGHUP, Hangup. 0x00007f38ee8dad63 in __epoll_wait_nocancel () from /xxx/xxx/xxx/xxx/xxx/xxx/lib/libc.so.6 (gdb) continue Continuing. 4) Send another message ('TEST: post I/O error; post SIGHUP')to syslog-ng (it complains): 2013-06-14 22:41:37.147 [device] [syslog-ng-NOTICE:] "Configuration reload request received, reloading configuration;" 2013-06-14 22:41:59.610 [device] [syslog-ng-ERROR:] "I/O error occurred while writing; fd='23', error='No space left on device (28)'" 2013-06-14 22:41:59.610 [device] [syslog-ng-NOTICE:] "Suspending write operation because of an I/O error; fd='23', time_reopen='60'" 5) Clean up '/var/testpartition' disk: root@device:/var/testpartition# rm foo 6) Send another message ('TEST: post I/O error; post SIGHUP 2'); syslog-ng aborts: Program received signal SIGABRT, Aborted. 0x00007f38ee83eda5 in raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64 64 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory. in ../nptl/sysdeps/unix/sysv/linux/raise.c (gdb) bt #0 0x00007f38ee83eda5 in raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64 #1 0x00007f38ee8402c3 in abort () at abort.c:88 #2 0x00007f38ee87af18 in __libc_message (do_abort=2, fmt=0x7f38ee927cc8 "*** glibc detected *** %s: %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:170 #3 0x00007f38ee8804b8 in malloc_printerr (action=2, str=0x7f38ee927dd0 "double free or corruption (!prev)", ptr=<value optimized out>) at malloc.c:5891 #4 0x00007f38ee8825c6 in __libc_free (mem=0x7f38ee91e820) at malloc.c:3626 #5 0x00007f38ef7d989a in ?? () #6 0x0000000000401800 in ?? () at elf-init.c:99 #7 0x00007f38efcf0257 in log_proto_file_writer_flush (s=0x674de0) at logproto.c:306 #8 0x00007f38efcf04a8 in log_proto_file_writer_post (s=0x674de0, msg=0x6558a0 "2013-06-14T22:42:30.476+00:00 device LOGID_99-INFO: TEST: post I/O error; post SIGHUP 2\n", msg_len=89, consumed=0x7fffa53e570c) at logproto.c:380 #9 0x00007f38efcfc274 in log_proto_post (s=0x674de0, msg=0x6558a0 "2013-06-14T22:42:30.476+00:00 device LOGID_99-INFO: TEST: post I/O error; post SIGHUP 2\n", msg_len=89, consumed=0x7fffa53e570c) at logproto.h:95 #10 0x00007f38efcfc095 in log_writer_flush (self=0x655a30, flush_mode=LW_FLUSH_NORMAL) at logwriter.c:983 #11 0x00007f38efcf9be3 in log_writer_work_perform (s=0x655a30) at logwriter.c:129 #12 0x00007f38efcf9efe in log_writer_io_flush_output (s=0x655a30) at logwriter.c:198 #13 0x00007f38efd238b5 in iv_run_tasks (st=0x6036a0) at iv_task.c:46 #14 0x00007f38efd22a86 in iv_main () at iv_main.c:266 #15 0x00007f38efcfedf9 in main_loop_run () at mainloop.c:736 #16 0x00000000004017c9 in main (argc=1, argv=0x7fffa53e5968) at main.c:263 (gdb) The last two test messages are being written (run together with the last partial message that generated the 'disk full' I/O error): root@device:/var/testpartition# tail test.log 2013-06-14T22:40:58.140+00:00 device LOGID_99-INFO: TEST: pre I/O error 2013-06-14T22:40:59.150+00:00 device LOGID_99-INFO: TEST: pre I/O error 2013-06-14T22:41:00.180+00:00 device LOGID_99-INFO: TEST: pre I/O error 2013-06-14T22:41:01.176+00:00 device LOGID_99-INFO: TEST: pre I/O error 2013-06-14T22:41:02.170+00:00 device LOGID_99-INFO: TEST: pre I/O error 2013-06-14T22:41:03.010+00:00 device LOGID_99-INFO: TEST: pre I/O error 2013-06-14T22:41:03.930+00:00 device LOGID_99-INFO: TEST: pre I/O error 2013-06-14T22:41:05.040+00:00 device LOGID_99-INFO: TEST: pre I/O error 2013-06-14T22:41:06.180+00:00 device LOGID_99-INFO: TEST: pre I/O error 2013-06-14T22:41:07.140+00:00 device LOGID_99-INFO: T2013-06-14T22:42:30.476+00:00 device LOGID_99-INFO: TEST: post I/O error; post SIGHUP 2013-06-14T22:42:30.476+00:00 device LOGID_99-INFO: TEST: post I/O error; post SIGHUP 2 root@device:/var/testpartition# Thanks, Chris ---------------------------------------- Christopher Johnson chris.johnson3(a)hp.com<mailto:chris.johnson3@hp.com> HP Software - Security Product Group (916) 785-2817 ----------------------------------------

3 3