- syslog-ng - lists.balabit.hu

syslog-ng daemon does not start up on HPUX ia64
by Rakesh Rajasekharan 19 Feb '13

19 Feb '13

I have successfully compiled the syslog-ng but upon starting .. syslog-ng daemon does not show up in the ps command. Running it in the debug mode.... i get the below error while i try to open a new putty terminal.. # /opt/soe/local/syslog-ng-3.3.7/sbin/syslog-ng -Fvde nanosleep() is not accurate enough to introduce minor stalls on the reader side, multi-threaded performance may be affected; Trying to open module; module='affile', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libaffile.so' Trying to open module; module='afprog', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libafprog.so' Trying to open module; module='afsocket', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libafsocket.so' Trying to open module; module='afuser', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libafuser.so' Trying to open module; module='basicfuncs', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libbasicfuncs.so' Trying to open module; module='csvparser', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libcsvparser.so' Trying to open module; module='dbparser', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libdbparser.so' Trying to open module; module='syslogformat', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libsyslogformat.so' Running application hooks; hook='1' Running application hooks; hook='3' syslog-ng starting up; version='3.3.7' Incoming log entry; line='<38>Feb 19 15:53:20 sshd[29953]: SSH: Server;Ltype: Kex;Remote: 20.201.140.200-62779;Enc: aes256-cbc;MAC: hmac-sha1;Comp: none' ** ** ERROR:(logsource.c:286):log_source_queue: assertion failed: (old_window_size > 0) Abort(coredump) Any suggestions on this please....

1 0

syslog 3.3.7 ivykis library error... HPUX 11.23 ia64
by Rakesh Rajasekharan 19 Feb '13

19 Feb '13

I have compiled the syslog-ng 3.3.7 on HPUX ia64 machine using dynamic linking option... but, while trying to run the binary i get the below error, # /opt/soe/local/syslog-ng-3.3.7/sbin/syslog-ng /usr/lib/hpux32/dld.so: Unable to find library 'libivykis.so.3'. Killed I have even tried --with-ivykis=system in the configure... but the error does not disappear. # ldd /opt/soe/local/syslog-ng-3.3.7/sbin/syslog-ng libpthread.so.1 => /usr/lib/hpux32/libpthread.so.1 libcl.so.1 => /usr/lib/hpux32/libcl.so.1 libc.so.1 => /usr/lib/hpux32/libc.so.1 libIO77.so.1 => /usr/lib/hpux32/libIO77.so.1 libunwind.so.1 => /usr/lib/hpux32/libunwind.so.1 libdl.so.1 => /usr/lib/hpux32/libdl.so.1 libuca.so.1 => /usr/lib/hpux32/libuca.so.1 Any suggestions on this please... Thanks, Rakesh.

2 4

[Bug 222] New: systemd unit file should set Restart
by bugzilla＠bugzilla.balabit.com 18 Feb '13

18 Feb '13

https://bugzilla.balabit.com/show_bug.cgi?id=222 Summary: systemd unit file should set Restart Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: pdgiddie+balabit(a)gmail.com Type of the Report: enhancement Estimated Hours: 0.0 To mitigate unforeseen crashes, the systemd unit file should set Restart. This will cause systemd to relaunch the service if it crashes. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 7

[PATCH 0/4]: Template type hinting, request for review
by Gergely Nagy 17 Feb '13

17 Feb '13

The patches that will come soon after this one implement template type hinting support for syslog-ng. These things allow us to tell the various destination drivers what type a particular template should be casted to. One can use this to store dates in MongoDB as datetime objects, or the PID as integer, and so on and so forth. The syntax is simple: template(type("template-string")) Where 'type' can be 'boolean', 'string', 'int32', 'int64', 'datetime' or 'literal' as of this writing. Not all drivers implement all of them, of course, but they implement the relevant ones. The infrastructure makes it possible to control what should happen when a type cast does not succeed: we can either drop the message (the default), drop that particular property, or fall back to string. We can do either of these silently, or by emitting a warning first. This is configurable with a global option only at the moment, but there are plans to make it possible to override the global setting on a per-template or per-driver level. A few examples on usage: template t_json { template("$(format-json PID=int32($PID) MESSAGE DATE)\n") }; destination d_mongodb { mongodb( value-pairs(pair("PID", int32("$PID")) pair("TIMESTAMP", datetime("$R_UNIXTIME"))) ); }; I'm reasonably happy with the code, at least for now. I plan to improve upon it within the scope of 3.5, but this is at a stage that I consider very close to merge ready.

2 6

[Bug 221] New: syslog-ng 2.1.4 on rhel 5.8
by bugzilla＠bugzilla.balabit.com 15 Feb '13

15 Feb '13

https://bugzilla.balabit.com/show_bug.cgi?id=221 Summary: syslog-ng 2.1.4 on rhel 5.8 Product: syslog-ng Version: 2.1.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jk_kathi1(a)yahoo.com Type of the Report: --- Estimated Hours: 0.0 Red Hat Enterprise Linux Server release 5.8 (Tikanga) Syslog-ng version : syslog-ng-2.1.4-9.el5 Library installed : libnet-1.1.5-1.el5 /etc/syslog-ng/syslog-ng.conf file settings options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); # udp(ip(0.0.0.0) port(514)); }; source s_file { file("/opt/CA/siteminder/log/smps.log"); }; destination d_file { file("/var/log/messages"); }; destination d_remote_q1 { udp("x.x.x.x" port(514)); }; log { source(s_sys); destination(d_file); }; log { source(s_file); destination(d_file); destination(d_remote_q1); }; Syslog-ng executes fine , able to record all the OS logs . When i start syslog-ng the first time it polls the smps.log and forwards all the entries from that file to remote server , but after that any new events getting logged does not get processed even when syslog-ng is running in the background. The issue is syslog-ng is not able to monitor the App log smps.log in real time . This happens only for the app log , normal OS events gets processes immediately Tried logging a simple mesage using logger I did try running syslog-ng in debug mode , these are the results /sbin/syslog-ng -Fedv Syslog connection established; from='AF_INET(0.0.0.0:0)', to='AF_INET(x.x.x.x:514)' Running application hooks; hook='1' syslog-ng starting up; version='2.1.4' EOF occurred while reading; fd='3' Syslog connection accepted; from='AF_UNIX(anonymous)', to='AF_UNIX(/dev/log)' Syslog connection accepted; from='AF_UNIX(anonymous)', to='AF_UNIX(/dev/log)' Incoming log entry; line='<85>Feb 14 15:04:03 sshd[797]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.58.99.83 user=admin' Initializing destination file writer; template='/var/log/messages', filename='/var/log/messages' Incoming log entry; line='<86>Feb 14 15:04:06 sshd[797]: Failed password for admin from 10.58.99.83 port 64622 ssh2' EOF occurred while reading; fd='8' Closing log reader fd; fd='8' Syslog connection accepted; from='AF_UNIX(anonymous)', to='AF_UNIX(/dev/log)' Incoming log entry; line='<86>Feb 14 15:04:16 sshd[797]: Accepted password for admin from 10.58.99.83 port 64622 ssh2' EOF occurred while reading; fd='8' Closing log reader fd; fd='8' EOF occurred while reading; fd='7' Closing log reader fd; fd='7' Syslog connection accepted; from='AF_UNIX(anonymous)', to='AF_UNIX(/dev/log)' Incoming log entry; line='<86>Feb 14 15:04:16 sshd[797]: pam_unix(sshd:session): session opened for user admin by (uid=0)' Syslog connection accepted; from='AF_UNIX(anonymous)', to='AF_UNIX(/dev/log)' Incoming log entry; line='<13>Feb 14 15:04:22 admin: Test message' EOF occurred while reading; fd='8' Closing log reader fd; fd='8' Syslog connection accepted; from='AF_UNIX(anonymous)', to='AF_UNIX(/dev/log)' Incoming log entry; line='<86>Feb 14 15:04:48 su: pam_unix(su-l:session): session opened for user root by admin(uid=500)' Syslog connection accepted; from='AF_UNIX(anonymous)', to='AF_UNIX(/dev/log)' Incoming log entry; line='<86>Feb 14 15:05:00 su: pam_unix(su-l:session): session opened for user smuser by admin(uid=0)' But i do not see any debugs messages for smps.log getting processed ( even though the file is getting updated ) Any ideas Is this is a shortcoming in syslog-ng 2.1.4 . I cannot compile the latest version of syslog-ng since there is a limitation on my production system ( cannot compile anything due to security concerns ) so i am need of a syslog-ng rpm package other than 2.1.4 that works on RHEL 5 or if i can fix the issue in the existing version Appreciate any help Thanks Kathi -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 7

[Bug 218] New: To include local*.* facility. level in the source of syslog-ng
by bugzilla＠bugzilla.balabit.com 14 Feb '13

14 Feb '13

https://bugzilla.balabit.com/show_bug.cgi?id=218 Summary: To include local*.* facility.level in the source of syslog-ng Product: syslog-ng Version: 3.2.x Platform: Other OS/Version: Solaris Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jk_kathi1(a)yahoo.com Type of the Report: --- Estimated Hours: 0.0 We have oracle audits configured to send updates to local0.info facility.level and the existing syslog.conf ( solaris syslgod ) has a feature to include them in local6.info /var/log/syslog We are replacing syslogd with syslog-ng and need to replicate this property I have searched the syslog-ng documentation and there is not mention of including local6.info in the source section of syslog-ng.conf. I can use it in the filter section , but the source itself is not getting updated so filter option may be unused. I can source a file but the audit logs does not write to a file , they write to proprietary syslog's facility.level Is there a solution , i have hit a road block Any information , documentation of how i can include the facility.level into syslog-ng would be helpful source s_local { system(); sun-streams("/dev/log" door("/etc/.syslog_door")); }; # Filters #filter f_local6 { facility(local6); }; Do i include any other keywords apart from system in the source s_local line Thanks -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 14

need help with pattern, get .classifier.class=unknown
by Stefan Sabolowitsch 14 Feb '13

14 Feb '13

Hi all, i use the net screen pattern the ruleset: <ruleset name="NetScreen" id='1001'> <pattern>fw</pattern> <rules> <rule provider="ELSA" class='1001' id='1001'> <patterns> <pattern>NetScreen device_id=@ESTRING:s0: @@ESTRING:: @start_time="@ESTRING::"@ duration=@ESTRING:: @policy_id=@ESTRING:i0: @service=@ESTRING:s1: @proto=@ESTRING:: @src zone=@ESTRING:s2: @dst zone=@ESTRING:s3: @action=@ESTRING:s4: @sent=@ESTRING:: @rcvd=@ESTRING:: @src=@ESTRING:i1: @dst=@ESTRING:i2: @src_port=@ESTRING:i3: @dst_port=@ESTRING:i4: @session_id=@ESTRING:: @reason=Traffic Denied</pattern> </patterns> <examples> <example> <test_message program="NetScreen deny">NetScreen device_id=fw [Root]system-notification-00257(traffic): start_time="2012-10-02 09:46:20" duration=0 policy_id=10005 service=http proto=6 src zone=OUT dst zone=IN action=Deny sent=0 rcvd=40 src=192.168.0.1 dst=192.168.1.1 src_port=51271 dst_port=80 session_id=0 reason=Traffic Denied</test_message>  <test_value name="s0">fw</test_value>  <test_value name="i0">10005</test_value>  <test_value name="s1">http</test_value>  <test_value name="s2">OUT</test_value>  <test_value name="s3">IN</test_value>  <test_value name="s4">Deny</test_value>  <test_value name="i1">192.168.0.1</test_value>  <test_value name="i2">192.168.1.1</test_value>  <test_value name="i3">51271</test_value>  <test_value name="i4">80</test_value> </example> </examples> </rule> </rules> </ruleset> but i get this error : /usr/local/syslog-ng/bin/pdbtool match -c -D -v -p /usr/local/elsa/node/conf/patterndb.xml -P fw -M "NetScreen device_id=fw [Root]system-notification-00257(traffic): start_time="2012-10-02 09:46:20" duration=0 policy_id=10005 service=http proto=6 src zone=OUT dst zone=IN action=Deny sent=0 rcvd=40 src=192.168.0.1 dst=192.168.1.1 src_port=51271 dst_port=80 session_id=0 reason=Traffic Denied" Pattern matching part: NetScreen device_id=@ESTRING:s0=fw@@ESTRING:None=[Root]system-notification-00257(traffic):@start_time=2012-10-02 Matching part: NetScreen device_id=fw [Root]system-notification-00257(traffic): start_time= Values: MESSAGE=NetScreen device_id=fw [Root]system-notification-00257(traffic): start_time=2012-10-02 PROGRAM=fw .classifier.class=unknown Any help here thanks Stefan

2 2

[Bug 219] New: log_msg_is_write_protected when a source is used in multiple log statments
by bugzilla＠bugzilla.balabit.com 14 Feb '13

14 Feb '13

https://bugzilla.balabit.com/show_bug.cgi?id=219 Summary: log_msg_is_write_protected when a source is used in multiple log statments Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: critical Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 Created an attachment (id=71) --> (https://bugzilla.balabit.com/attachment.cgi?id=71) minimal syslog-ng.conf It appears that if a source is used in two different log statements, all branches use a write protected instance of the log message. Module loaded and initialized successfully; module='syslogformat' Running application hooks; hook='1' Running application hooks; hook='3' syslog-ng starting up; version='3.4.1' Syslog connection accepted; fd='12', client='AF_INET(142.104.141.3:40576)', local='AF_INET(0.0.0.0:514)' Incoming log entry; line='<134>2013-02-04T15:28:46-08:00 pangolin.comp.uvic.ca/pangolin.comp.uvic.ca action-handler[24020]: starting' Initializing destination file writer; template='/var/syslog/archive.log', filename='/var/syslog/archive.log' Filter node evaluation result; result='not-match' Filter node evaluation result; result='not-match', type='filter(f_short_host_at)' ** ERROR:logmsg.c:535:log_msg_set_value_indirect: assertion failed: (!log_msg_is_write_protected(self)) Attached is a very simple config file that reproduces this issue. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 7

IPv6 rewrite rule PVCE
by strife＠riseup.net 14 Feb '13

14 Feb '13

Hi, I want to anonymize certain logs, ie. remove IP addresses. Thanks to the advice/experiments by Micah from Riseup, I have the following. It works fine for IPv4: rewrite r_ip { subst('([[:digit:]]{1,3}\.){3}[[:digit:]]{1,3}', "\[REDACTED\]", value("MESSAGE"), type("pcre"), flags("global")); }; I tried to extend this to IPv6 using the IPV6 PCRE expression found at http://home.deds.nl/~aeron/regex/ : subst('/(((?=.*(::))(?!.*\3.+\3))\3?|([\dA-F]{1,4}(\3|:\b|$)|\2))(?4){5}((?4){2}|(((2[0-4]|1\d|[1-9])?\d|25[0-5])\.?\b){4})\z/i', "\[REDACTED\]", value("MESSAGE"), type("pcre"), flags("global")); When I test the expression using pcretest, it successfully matches IPv6 addresses in text. In syslog-ng, it does not. Any ideas? Thanks! -- strife

3 6

syslog-ng Insider - February 2013
by Peter Czanik 14 Feb '13

14 Feb '13

Dear syslog-ng users, This is the 21th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com <mailto:documentation@balabit.com> FEATURED NEWS Video: Basic building blocks of syslog-ng.conf ---------------------------------------------- There is a video series in the work to introduce the basics of syslog-ng. The second video is online now, which explains the basic building blocks of syslog-ng.conf. You can watch it at http://www.youtube.com/watch?v=D3OjHQj42Jg New videos will be published on the same Youtube channel. You are very welcome to subscribe to receive notifications about further syslog-ng videos and other interesting content. Syslog-ng 3.4.1 is released --------------------------- Version 3.4.1was released at the end of January. Compared to the RC2release, it only has some minor bugfixes. This version brings many major new features to syslog-ng: junctions and channels to make syslog-ng configuration even more flexible, a community contributed AMQP destination, improved JSON support including a parser and many value pairs related improvements. For more details, check http://algernon.blogs.balabit.com/2013/01/syslog-ng-ose-3-4-1-released/ You cancheck the announcement athttps://lists.balabit.hu/pipermail/syslog-ng-announce/2013-January/000154.html For binary package availability check our 3^rd party binary page at http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… At the time of this writing there are v3.4.1 packages for openSUSE and SLES, not only as 3^rd party packages but also as part of the openSUSE 12.3 release. It's also available for FreeBSD in the sysutils/syslog-ng-devel port, and already in Fedora Rawhide. Packages for various Debian and Ubuntu releases are available in algernon's repo. syslog-ng at conferences: FOSDEM and Brno ----------------------------------------- The syslog-ng team is actively participating in the life of the open source community. Last weekend CzP gave a talk at FOSDEM and participated a two day long brainstorming session about logging and monitoring in Antwerp. He met many interesting people from the syslog-ng community. You can read about his experiences at http://czanik.blogs.balabit.com/2013/02/czp-fosdem-2013/ We will also participate http://devconf.cz/ and the systemd hackfest the day before the conference. If you are also there and want to talk about syslog-ng, we are more than happy to meet you! SHORT NEWS: * To use cacti with syslog-ng, check configuration examples at https://czanik.blogs.balabit.com/2013/01/trying-cacti-with-syslog-ng/ * What's new presentation in Hungarian for syslog-ng 3.4 with configuration examples: http://asylum.madhouse-project.org/downloads/presentations/syslog-ng-ose-3.… and http://asylum.madhouse-project.org/downloads/presentations/syslog-ng-ose-3.… NEW RELEASES: * syslog-ng OSE 3.4.1:https://lists.balabit.hu/pipermail/syslog-ng-announce/2013-January/000154.html ARCHIVE http://insider.blogs.balabit.com/ -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

[Bug 172] New: tcp() destination driver ignores ts_format() parameter
by bugzilla＠bugzilla.balabit.com 13 Feb '13

13 Feb '13

https://bugzilla.balabit.com/show_bug.cgi?id=172 Summary: tcp() destination driver ignores ts_format() parameter Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: chiestand(a)salk.edu Type of the Report: bug Estimated Hours: 0.0 The documentation (http://www.balabit.com/sites/default/files/syslog-ng-ose-v3.3-guide-admin-e…) states that you may use the ts_format() paramater to modify the timestamp format. However this parameter does not work, rfc3164 format seems to be used no matter what you specify in ts_format(). So either the documentation is wrong or there is a bug. I am running 3.3.4 on Debian Wheezy. I also had the problem running 3.1 in Debian Squeeze. my driver: destination My_Syslog { tcp("syslog.server.salk.edu" port(514) ts_format(iso) ); }; log { source(s_src); destination(My_Syslog); }; tcpdump: @.m..<hw<86>Apr 6 01:24:01 host CRON[1923]: pam_unix(cron:session): session closed for user root I emailed the mailing list on this issue, the thread can be viewed here: https://lists.balabit.hu/pipermail/syslog-ng/2012-April/018638.html -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

[Bug 215] New: syslog-ng v3 - tcp() does not support no-multi-line as docs reference.
by bugzilla＠bugzilla.balabit.com 13 Feb '13

13 Feb '13

https://bugzilla.balabit.com/show_bug.cgi?id=215 Summary: syslog-ng v3 - tcp() does not support no-multi-line as docs reference. Product: syslog-ng Version: 3.3.x Platform: Other OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: balabit(a)32ths.com Type of the Report: --- Estimated Hours: 0.0 So after doing some test cases, I've noticed that on no-multi-line is not stripping newlines on v3.3.7. I've not tested previous versions yet. Here is my syslog-ng config: source s_net_tcp { tcp(ip(0.0.0.0) port(514) flags(no-multi-line)); }; destination all { file("/var/log/all"); }; log { source(s_net_tcp); destination(all); flags(final); }; I've also attempted to do this with no-parse flags passed in to no avail. When using the udp() source, it works just fine. My test case: # cat blah line1 line2 line3 # cat blah | nc -r -n myhost 514 And on "myhost" Jan 2 12:25:16 192.2.0.1 line1 Jan 2 12:25:16 192.2.0.1 line2 Jan 2 12:25:16 192.2.0.1 line3 So I assume this has something to do with it: https://bugzilla.balabit.com/show_bug.cgi?id=74 Particularly about newlines being message terminators over tcp(), however, why do the docs even say tcp() supports the no-multi-line flag? Maybe there is a way to adjust the terminator if this is the case? I must admit, I was curious what syslog-ng would do if the message size exceeded the mtu of the network. With UDP, I assume the end of the packet is the end of the message so any messages large enough to span two udp packets would actually be two log entries. I assumed it would also be the case with TCP, even if it is stream based. So the potential problems I see are: 1. tcp() doesn't really support no-multi-line (bug) or 2. the docs should be updated to not say it supports no-multi-line (bug) or 3. I've overlooked the doc references or 4. I'm missing some option (terminator?) in order to get tcp() to work with no-multi-line. (env) Thanks as always, - Mike -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

Support for OpenBSD
by C. L. Martinez 12 Feb '13

12 Feb '13

Hi all, Is syslog-ng supported under openbsd (releses 5.x)?? Can I expect problems installing under OpenBSD?? Thanks.

2 2

Systemd troubles: incompatibility with journald ?
by Guillaume Rousse 08 Feb '13

08 Feb '13

Hello list. I'm unable to run syslog-ng, whatever the version (I tried 3.3.6 and 3.4.1), on a recent system using systemd (mageia cauldron 64 bits, systemd 195). As soon as I'm launching syslog-ng, systemd and systemd-journal cpu usages reach 80/95%, and systemd fill dmesg log with this kind of message: [ 5962.484250] systemd[1]: syslog-ng.service start request repeated too quickly, refusing to start I tried to disable journald, but i didn't suceed. I also found indication of using the journald socket ( /run/systemd/journal/syslog) instead of /dev/log in syslog-ng configuration, but it doesn't change much. Also, the fedora package for syslog-ng doesn't contains anything special, either in default configuration, or in systemd service unit (excepted a patch to force pid file location). So, I'm a bit lost here... There is a user bug report on this issue: https://bugs.mageia.org/show_bug.cgi?id=8944 -- BOFH excuse #223: The lines are all busy (busied out, that is -- why let them in to begin with?).

3 5

[Bug 214] New: Build / Install Issues on AIX
by bugzilla＠bugzilla.balabit.com 08 Feb '13

08 Feb '13

https://bugzilla.balabit.com/show_bug.cgi?id=214 Summary: Build / Install Issues on AIX Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: AIX Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: blentz(a)cswg.com Type of the Report: --- Estimated Hours: 0.0 More fun for the AIX platform; Using version 3.3.7, GNU Make and GCC 4.2.0 However lib/syslog-ng/libafsocket.so is installed it is installed in such a way that the dependency for libsyslog-ng-crypto.a cannot be found. Seems like some kind of libtool problem. $ ldd /opt/local/syslogng/lib/syslog-ng/libafsocket.so /opt/local/syslogng/lib/syslog-ng/libafsocket.so needs: Cannot find libsyslog-ng-crypto.a(libsyslog-ng-crypto.so) /opt/local/syslogng/lib/libssl.so /opt/local/syslogng/lib/libcrypto.so /opt/local/syslogng/lib/libglib-2.0.a(libglib-2.0.so.0) /opt/local/syslogng/lib/libevtlog.a(libevtlog.so.0) /opt/local/syslogng/lib/libsyslog-ng.a(libsyslog-ng-3.3.7.so) /usr/lib/libc.a(shr.o) /usr/lib/librtl.a(shr.o) /opt/local/syslogng/lib/libgcc_s.a(shr.o) /usr/lib/libpthreads.a(shr_xpg5.o) /usr/lib/libiconv.a(shr4.o) /usr/lib/libpthread.a(shr_comm.o) /usr/lib/libpthread.a(shr_xpg5.o) /opt/local/syslogng/lib/libintl.a(libintl.so.8) /opt/local/syslogng/lib/libgmodule-2.0.a(libgmodule-2.0.so.0) /opt/local/syslogng/lib/libgthread-2.0.a(libgthread-2.0.so.0) /opt/local/syslogng/lib/libivykis.a(libivykis.so.0) /unix /usr/lib/libcrypt.a(shr.o) /usr/lib/libpthreads.a(shr_comm.o) /usr/lib/libthread.a(shr.o) Also, be aware that shared libraries on AIX use the .a suffix, not .so. Out of the box shared libraries are archived into .a files. $ ar tv /opt/local/syslogng/lib/syslog-ng/libafsocket.a rwxr-xr-x 0/0 572423 Dec 19 20:23 2012 libafsocket-tls.so The default "make install" process leaves nothing but *.a files in lib/syslog-ng and on startup the user is greeted with many errors about missing loadable modules. The RPM that Perzl makes gets around this by running ar -X32 -x'ing all of these .a files so the system is populated with both .a and .so versions of the files. ( cd ${RPM_BUILD_ROOT}%{_libdir} for f in *.a ; do /usr/bin/ar -X32 -x ${f} done cd ${RPM_BUILD_ROOT}%{_libdir}/%{name} for f in *.a ; do /usr/bin/ar -X32 -x ${f} done ) Can this be fixed? -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 18

[Bug 121] New: After service syslog-ng reload, the first log don' t transfer to remote servicer via TLS
by bugzilla＠bugzilla.balabit.com 08 Feb '13

08 Feb '13

https://bugzilla.balabit.com/show_bug.cgi?id=121 Summary: After service syslog-ng reload, the first log don't transfer to remote servicer via TLS Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: critical Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: yong.zheng(a)nsn.com Type of the Report: bug Estimated Hours: 0.0 The version:syslog-ng 3.0.5 options { flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); stats_freq (3600); }; I will upload the logs to remote syslog-ng server via TLS, I encounter a issue, On client: after reload the configure via below command: #service syslog-ng reload. I write a log: #logger -p local1.info "this is test" but I don't see the log to transfer to server immediately, I wait many minutes, still don't see. I must write the second log to triger that client send the 2 logs to server #logger -p local1.info "this is test 2" the 2 logs have transfered to server immediately successfully, I can see the 2 logs on server. It is 100% reproduced. Is this a known issue, or not ? Thanks. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

sysutils/syslog-ng-devel is now 3.4.1
by Peter Czanik 08 Feb '13

08 Feb '13

Hello, Just a heads up: the FreeBSD sysutils/syslog-ng-devel is now updated to 3.4.1. I plan to update the sysutils/syslog-ng port from 3.3 to 3.4 once 3.4.2 is available. Until that please use the -devel port to get known with 3.4 and let us know any problems you run into. Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

which eventlog version ?
by Guillaume Rousse 08 Feb '13

08 Feb '13

Hello. I'm sorry if that was explained in the release announcement, but I can't understand why syslog-ng 3.4.1 download pages include a link to an eventlog release with a mysterious 0.2.12+20120504+1700 version number, whereas 3.4.0rc1 had 0.2.13 release instead ? Has any kind of regression found, that couldn't be fixed with a regular 0.2.14 or 0.2.13.1 release instead ? -- BOFH excuse #144: Too few computrons available.

2 1

Compilation issue with syslog-ng 3.4.1
by Guillaume Rousse 07 Feb '13

07 Feb '13

Hello list. I'm facing some compilation issue with the pacct plugin: libtool: compile: gcc -std=gnu99 -DHAVE_CONFIG_H -I. -I../.. -I../../lib -I../../lib -pthread -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/usr/include/eventlog -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -I/usr/include -I../../lib/ivykis/src/include -I../../lib/ivykis/src/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -g -pipe -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fstack-protector --param=ssp-buffer-size=4 -fPIC -Wall -pthread -MT libpacctformat_la-pacct-format-plugin.lo -MD -MP -MF .deps/libpacctformat_la-pacct-format-plugin.Tpo -c pacct-format-plugin.c -fPIC -DPIC -o .libs/libpacctformat_la-pacct-format-plugin.o pacct-format-plugin.c:38:3: warning: initialization from incompatible pointer type [enabled by default] pacct-format-plugin.c:38:3: warning: (near initialization for 'pacct_format_plugin.construct') [enabled by default] mv -f .deps/libpacctformat_la-pacct-format-plugin.Tpo .deps/libpacctformat_la-pacct-format-plugin.Plo pacct-format.c:155:1: error: unknown type name 'LogProtoOptions' pacct-format.c:155:98: error: conflicting types for 'options' pacct-format.c:155:41: note: previous definition of 'options' was here pacct-format.c: In function 'pacct_construct_proto': pacct-format.c:157:3: warning: implicit declaration of function 'log_proto_binary_record_server_new' [-Wimplicit-function-declaration] pacct-format.c:157:3: warning: 'return' with a value, in function returning void [enabled by default] pacct-format.c: At top level: pacct-format.c:162:3: error: unknown field 'alter_proto_options' specified in initializer pacct-format.c:162:26: error: 'pacct_alter_proto_options' undeclared here (not in a function) pacct-format.c:164:1: warning: initialization from incompatible pointer type [enabled by default] pacct-format.c:164:1: warning: (near initialization for 'pacct_handler.parse') [enabled by default] make[3]: *** [libpacctformat_la-pacct-format.lo] Erreur 1 This is a mageia cauldron system, 64 bits, with gcc 4.7.2. -- BOFH excuse #368: Failure to adjust for daylight savings time.

2 1

Need help upgrading from 2.0.4 to 3.2.5
by Edward Bailey 07 Feb '13

07 Feb '13

We have moved from OEL4 to OEL6 and I need help moving the 2.0.4 functionality to the new version of syslog-ng. I am having issues with our custom application logging which has very large messages and long stack traces. I am not seeing the same behavior in 3.2.5. In 3.2.5 I am seeing truncated messages and the first line of the stack trace is being logged to the correct facility local5 while the rest of the stack trace is being logged to /var/log/messages. Also the stack trace is not being preserved anymore. Instead every line is being treated as a new line and a new syslog entry. Our custom app logging is not the best and contains carriage returns which used to be stripped by 2.0.4 but that is not happening now. Can these behaviors from 2.0.4 be preserved in 3.2.5? Any suggestions are appreciated. Here is what I am trying to work with in 3.2.5 options { flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); stats_freq (50000); log_msg_size(8192); }; source s_sys { pipe("/proc/kmsg" log_prefix("kernel: ")); unix-dgram ("/dev/log" flags("no-multi-line")); internal(); udp(ip(127.0.0.1) port(514)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages" perm(0644)); }; destination d_mesgr { udp("remote syslog server" port(514)); }; destination d_auth { file("/var/log/secure"); }; destination d_authr { udp("remote syslog server" port(514)); }; destination d_mail { file("/var/log/maillog" flush_lines(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_cronr { udp("remote syslog server" port(514)); }; destination d_cust_app { file("/var/log/cust_app.log" owner("test") group("test") perm(0644)); }; destination d_kern { file("/var/log/kern"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info..emerg) and not (facility(mail) or facility(authpriv) or facility(cron) or facility(local5)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter9 { facility(local5); }; filter f_filter8 { facility(cron); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter1); destination(d_kern); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter2); destination(d_mesgr); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter3); destination(d_authr); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; log { source(s_sys); filter(f_filter8); destination(d_cronr); }; log { source(s_sys); filter(f_filter9); destination(d_cust_app); };

2 1

Host behind a NAT and multiple log files
by KERNEL - Mauricio Améndola 06 Feb '13

06 Feb '13

Hi everyone I've recently configured a syslog's server using syslog-ng and i have an issue to log from hosts that are outside my network in some place on internet. This is the thing, i have a few APs and a pfsense firewall/router. Each AP can log to a remote syslog server with a specific port. In my syslog server i add a new source, filter, destination and target and in pfsense box i create the rule to let pass trafic to the internal ap's IP. But the problem comes when i do the same for another AP, i configure another port but the syslog server doesn' t log. There is a way to log from remote multiple hosts that are behind just one public IP? Thanks in advance and sorry for my english. Regards, -- -- Mauricio Améndola Communications / Technical Department KERNEL Consultores Zabala 1327/402 , 11000, Montevideo, Uruguay T+(598-2) 915 6563 / (598-2) 915 9336

3 3

syslog-ng 3.4.1 has been released
by devel＠balabit.hu 02 Feb '13

02 Feb '13

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.4.1 SUMMARY : new stable release DATE : Jan 31, 2013 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.4.1) has been released. For latest fixes in the 3.4.x feature branch you are recommended to upgrade to this version. CHANGES: 3.4.1 Thu, 31 Jan 2013 11:00:00 +0100 This is the first stable release in the 3.4 series adding a number of features compared to 3.3, a culmination of more than a year's worth of development. Major features since 3.3 ======================== * New plugins: AMQP & SMTP destinations, JSON parser. See the following links for more details about them: http://git.io/mgF_sA (AMQP), http://git.io/Os9qpA (SMTP) and http://git.io/7MerYA (JSON parser) * New parsers for patterndb: HOSTNAME, EMAIL, PCRE and LLADDR. * It is now possible to control what db-parser() sees as its input via it's new template() option. (Defaults to $MESSAGE) See http://git.io/YZHPtg for more details. * value-pairs() gained support for programmatically rewriting key names in bulk, via the rekey() method. See http://git.io/VylQUg for more details. * The network() driver is introduced, unifying and extending tcp(), udp(), syslog(), unix-dgram() and unix-stream(). The old drivers are still available, but migrating over to network() is encouraged. See http://git.io/0Xjlhg for more details. * Support for junctions & channels were added, which improve the flexibility of the syslog-ng configuration language. This allows combining sources with their closely tied processing functionality (like parser, rewrite and filter statements). Read this blog post for more information: http://goo.gl/T8Txa In the final form of the functionality the "log" keyword as described in the blog post above was replaced with "channel". Changes since 3.4.0rc2: ======================= Bugfixes ======== * PatternDB allows a wider range of characters in a class value now. Newly allowed chars are: %, :, @, +, !, ^, / and \. * The fsync() and flush-lines() functionality was restored in the file() destination, both work as expected and correctly now. * The set() and subst() rewrite operations were fixed to work even when referenced from multiple places (and in a number of different corner-cases too). Credits: ======== syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Balazs Scheidler <bazsi(a)balabit.hu> Evan Rempel <erempel(a)uvic.ca> Gergely Nagy <algernon(a)balabit.hu> Johnson, Chris <chris.johnson3(a)hp.com> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

3 2

hi
by R. Wiegand 31 Jan '13

31 Jan '13

check it out http://bit.ly/VxCmvI R.

1 0

SYSLOG-NG 3.4.1 on ARM target
by Deepak Gaur 31 Jan '13

31 Jan '13

Hi, Got following error while launching syslog-ng 3.4.1 on ARM target. Earlier version 3.4.0alpha3 working . Development environment is same. lib/message.c compilation seems to be missing in Makefile Starting system-ng log daemon: syslog-ngError opening plugin module; module='system-source', error='/lib/syslog-ng/libsystem-source.so: undefined symbol: ms' Error opening plugin module; module='syslogformat', error='/lib/syslog-ng/libsyslogformat.so: undefined symbol: last_msg_format_options' Error opening plugin module; module='afsocket-notls', error='/lib/syslog-ng/libafsocket-notls.so: undefined symbol: last_msg_format_options' Error opening plugin module; module='afuser', error='/lib/syslog-ng/libafuser.so: undefined symbol: msg_event_suppress_recursions_and_send' Error opening plugin module; module='basicfuncs', error='/lib/syslog-ng/libbasicfuncs.so: undefined symbol: msg_event_suppress_recursions_and_send' Error opening plugin module; module='confgen', error='/lib/syslog-ng/libconfgen.so: undefined symbol: msg_event_suppress_recursions_and_send' Error opening plugin module; module='dbparser', error='/lib/syslog-ng/libsyslog-ng-crypto.so: undefined symbol: msg_event_suppress_recursions_and_send' Error opening plugin module; module='syslog-ng-crypto', error='/lib/syslog-ng/libsyslog-ng-crypto.so: undefined symbol: msg_event_suppress_recursions_and_se' Error opening plugin module; module='tfuuid', error='/lib/syslog-ng/libsyslog-ng-crypto.so: undefined symbol: msg_event_suppress_recursions_and_send' Error opening plugin module; module='afamqp', error='/lib/syslog-ng/libafamqp.so: undefined symbol: msg_event_suppress_recursions_and_send' Error opening plugin module; module='cryptofuncs', error='/lib/syslog-ng/libsyslog-ng-crypto.so: undefined symbol: msg_event_suppress_recursions_and_send' Error opening plugin module; module='afmongodb', error='/lib/syslog-ng/libafmongodb.so: undefined symbol: value_pairs_walk' Error opening plugin module; module='afsocket-tls', error='/lib/syslog-ng/libsyslog-ng-crypto.so: undefined symbol: msg_event_suppress_recursions_and_send' Error opening plugin module; module='afprog', error='/lib/syslog-ng/libafprog.so: undefined symbol: msg_event_suppress_recursions_and_send' Error opening plugin module; module='afsocket', error='/lib/syslog-ng/libsyslog-ng-crypto.so: undefined symbol: msg_event_suppress_recursions_and_send' Error opening plugin module; module='system-source', error='/lib/syslog-ng/libsystem-source.so: undefined symbol: msg_event_suppress_recursions_and_send' Error opening plugin module; module='affile', error='/lib/syslog-ng/libaffile.so: undefined symbol: last_msg_format_options' Error opening plugin module; module='csvparser', error='/lib/syslog-ng/libcsvparser.so: undefined symbol: msg_event_suppress_recursions_and_send' Error opening plugin module; module='confgen', error='/lib/syslog-ng/libconfgen.so: undefined symbol: msg_event_suppress_recursions_and_send' Error parsing source, source plugin system not found in /etc/syslog-ng/syslog-ng.conf at line 10, column 2: system(); ^^^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng with regards, Deepak Gaur -------------------------------------------------------------------------------- ::Disclaimer:: -------------------------------------------------------------------------------- The contents of this email and any attachment(s) are confidential and intended for the named recipient(s) only. It shall not attach any liability on C-DOT. Any views or opinions presented in this email are solely those of the author and may not necessarily reflect the opinions of C-DOT. Any form of reproduction, dissemination, copying, disclosure, modification, distribution and / or publication of this message without the prior written consent of the author of this e-mail is strictly prohibited. If you have received this email in error please delete it and notify the sender immediately. --------------------------------------------------------------------------------

2 1

mongodb and TTL collections
by Lucas, Sascha 28 Jan '13

28 Jan '13

Hi, Mongodb 2.2 has a new feature called TTL collections (expire data by setting a TTL). An analogy to the classic logrotate. One constraint is, that you index a field of date BSON type[1]. As far as I know, atm syslog-ng can only store strings? Or how can it be done to store one field as date? [1] http://docs.mongodb.org/manual/tutorial/expire-data/ TIA, Sascha. Vorsitzender des Aufsichtsrates: Ralf Hiltenkamp Geschäftsführung: Michael Krüger (Sprecher), Stephan Drescher Sitz der Gesellschaft: Halle/Saale Registergericht: Amtsgericht Stendal | Handelsregister-Nr. HRB 208414 UST-ID-Nr. DE 158253683 Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Empfänger sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail oder des Inhalts dieser Mail sind nicht gestattet. Diese Kommunikation per E-Mail ist nicht gegen den Zugriff durch Dritte geschützt. Die GISA GmbH haftet ausdrücklich nicht für den Inhalt und die Vollständigkeit von E-Mails und den gegebenenfalls daraus entstehenden Schaden. Sollte trotz der bestehenden Viren-Schutzprogramme durch diese E-Mail ein Virus in Ihr System gelangen, so haftet die GISA GmbH - soweit gesetzlich zulässig - nicht für die hieraus entstehenden Schäden.

2 6