- syslog-ng - lists.balabit.hu

Building a syslog server (syslog-ng) with GUI
by Yu Watanabe 14 Jun '12

14 Jun '12

Hi all! I am planning to build a syslog server using syslog-ng, however, not using the configuration drivers of syslog-ng. Instead, I want to use a third party GUI that has a filtering function and would be better if can set actions for each fitlering. The reason for using other GUI is that because configuration file is getting bit complex. So, the story is make syslog-ng gather the logs and send it to database ( such as mysql ). The the thrid party GUI do the filtering. Cacti - camm plugin is one of my candidates. It would be helpful if people in this mailing list can give us some recommendation for the GUI. Thanks, Yu

6 5

logstore and idx files
by Anup Shetty 13 Jun '12

13 Jun '12

Hello, When using logstore(), it writes to log files with extension .lgs. The .jor files act as buffers before the logs are written on to the disk in .lgs files. Another file that gets created are the .idx files. What are the .idx files for? Each day logs from the servers gets stored into different files as the $Date parameter is used to create the file name. When this happens, suppose on 23:59:59 hrs, the journal file does not fill up to the chunk size defined or the chuck time does not expire and the syslog writes to a new file at 00:00:00hrs then what happens to the logs? do they get written onto the .lgs files? -- Thanks and regards, Anup Shetty +91-9820784185

2 2

php as program()
by Peter Czanik 13 Jun '12

13 Jun '12

Hello, A user in the web based community forum ran into trouble running php from program(). As it on SLES running syslog-ng 2.0 which is out of support for ages, I could not find anybody around me with an answer for it. The forum thread is available at http://communities.balabit.com/balabit/topics/php_as_programm and please register / write your solution there, if you have an answer for the question! (so I don't need to become a forum/list gw :-) ) Bye, -- Peter Czanik (CzP)<czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

FW: syslog-ng-3.4.0alpha2 syslog-ng binary failure forserver instance.
by Balla, Hithendra (EXT-Other - IN/Bangalore) 13 Jun '12

13 Jun '12

Hi all, We found that the following rewrite caused the issue. We commented this part, and it was not giving any issue. But we need this rewrite option to be available. Can somebody let us know if this got changed in syslog-ng-3.4.0alpha2 ? Any suggestions ? #rewrite rw_msg{subst("\\[.*\\]", "", value("MESSAGE"));}; Thanks Hithendra From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ext anju.raveendrannair(a)wipro.com Sent: Friday, June 08, 2012 5:16 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng-3.4.0alpha2 syslog-ng binary failure forserver instance. Hi, We are using syslog-ng-3.4.0alpha2 binary and trying to run the syslog-ng server configuration file, but its not starting the syslog ng server. We are getting the following error incase of f__nonconsole_access filter when we ran the syslog-ng binary in debug mode. Filter rule evaluation result; result='match', rule='f_nonconsole_access', location='/ne_data/conf/syslogng/syslog-ng_server.conf:58:29' ** ERROR:logmsg.c:535:log_msg_set_value_indirect: assertion failed: (!log_msg_is_write_protected(self)) Abort (core dumped) PFA the debug.log The server conf is having the following line for the above mentioned filter, template ltemgr_msg_template { template("$S_ISODATE $HOST $FACILITY_NUM/$LEVEL_NUM $MSG\n"); }; #To strip of the msg_id introduced by syslogd rewrite rw_msg{subst("\\[.*\\] <file:///\\[.*\%5d> ", "", value("MESSAGE"));}; source s_LTEMGR_SYSLOG_CLIENTS{ tcp (ip (27.132.98.69) port(6515) max-connections(4) tls( key_file("/ne_data/conf/certificates/MOCM/MOCM_key.pem") cert_file("/ne_data/conf/certificates/MOCM/MOCM_SB_server.pem") ca_dir("/ne_data/conf/certificates/SYSLOGNG") cipher_suite("ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:!SS Lv2") peer_verify(optional-untrusted) ) ); }; ....... destination d_ltemgr_nonconsoleaccess_log {file("/ne_data/syslog/ems" perm(0644) template(ltemgr_msg_template)); }; ...... filter f_nonconsole_access { level(info..notice) and facility(auth) and ( match("Accepted password for" value("MESSAGE")) or match("Failed password for" value("MESSAGE")) ); }; ..... log { source(s_LTEMGR_SYSLOG_CLIENTS); filter(f_nonconsole_access); rewrite(rw_msg); destination(d_ltemgr_nonconsoleaccess_log); }; Without debug mode, we were able to run the server but central logging is not happening when tried with logger command. Thanks, Anju Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

[Bug 183] New: Threaded Syslog-ng chashes resolving locally
by bugzilla＠bugzilla.balabit.com 08 Jun '12

08 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=183 Summary: Threaded Syslog-ng chashes resolving locally Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: egon(a)local.ee Type of the Report: bug Estimated Hours: 0.0 Syslog-ng crashes with segfault with following combination: threaded(yes); use_dns(persist_only); dns_cache_hosts(/etc/hosts); Jun 8 11:32:09 kernel: [5626308.537129] syslog-ng[15155]: segfault at 10 ip 00007fb09a512208 sp 00007fb0962b52a0 error 4 in libc-2.13.so[7fb09a49a000+17d000] Also tried to compile from source and on Debian squeeze distro, same issue occurred. System info: Debian GNU/Linux wheezy/sid \n \l Linux dev1 2.6.32-5-xen-amd64 #1 SMP Mon Jan 16 20:48:30 UTC 2012 x86_64 dpkg -l | grep -e syslog-ng -e libevtlog ii libevtlog0 0.2.12-5 Syslog event logger library ii libsyslog-ng-3.3.5:amd64 3.3.5-2 Next generation system logging daemon (private library) ii syslog-ng 3.3.5-2 Next generation system logging daemon (metapackage) ii syslog-ng-core 3.3.5-2 Next generation system logging daemon (core) ii syslog-ng-mod-json 3.3.5-2 Next generation system logging daemon (JSON plugin) ii syslog-ng-mod-mongodb 3.3.5-2 Next generation system logging daemon (MongoDB plugin) ii syslog-ng-mod-sql 3.3.5-2 Next generation system logging daemon (SQL plugin) # /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid -F --enable-core *** glibc detected *** /usr/sbin/syslog-ng: double free or corruption (fasttop): 0x00007f2ef25584c0 *** ======= Backtrace: ========= /lib/x86_64-linux-gnu/libc.so.6(+0x75b46)[0x7f2eeef75b46] /lib/x86_64-linux-gnu/libc.so.6(cfree+0x6c)[0x7f2eeef7a87c] /usr/lib/x86_64-linux-gnu/libsyslog-ng-3.3.5.so(main_loop_io_worker_thread_stop+0x65)[0x7f2ef0843755] /usr/lib/x86_64-linux-gnu/libsyslog-ng-3.3.5.so(+0x55b5b)[0x7f2ef085eb5b] /usr/lib/x86_64-linux-gnu/libsyslog-ng-3.3.5.so(+0x56226)[0x7f2ef085f226] /lib/x86_64-linux-gnu/libpthread.so.0(+0x6b50)[0x7f2eef28db50] /lib/x86_64-linux-gnu/libc.so.6(clone+0x6d)[0x7f2eeefd89dd] ======= Memory map: ======== 7f2ee4000000-7f2ee4022000 rw-p 00000000 00:00 0 7f2ee4022000-7f2ee8000000 ---p 00000000 00:00 0 7f2eea308000-7f2eea31d000 r-xp 00000000 ca:01 1180084 /lib/x86_64-linux-gnu/libgcc_s.so.1 7f2eea31d000-7f2eea51d000 ---p 00015000 ca:01 1180084 /lib/x86_64-linux-gnu/libgcc_s.so.1 7f2eea51d000-7f2eea51e000 rw-p 00015000 ca:01 1180084 /lib/x86_64-linux-gnu/libgcc_s.so.1 7f2eea51e000-7f2eea51f000 ---p 00000000 00:00 0 7f2eea51f000-7f2eead1f000 rw-p 00000000 00:00 0 7f2eead1f000-7f2eead20000 ---p 00000000 00:00 0 7f2eead20000-7f2eeb520000 rw-p 00000000 00:00 0 7f2eeb520000-7f2eeb527000 r-xp 00000000 ca:01 2886205 /usr/lib/x86_64-linux-gnu/libjson.so.0.0.1 7f2eeb527000-7f2eeb726000 ---p 00007000 ca:01 2886205 /usr/lib/x86_64-linux-gnu/libjson.so.0.0.1 7f2eeb726000-7f2eeb727000 r--p 00006000 ca:01 2886205 /usr/lib/x86_64-linux-gnu/libjson.so.0.0.1 7f2eeb727000-7f2eeb728000 rw-p 00007000 ca:01 2886205 /usr/lib/x86_64-linux-gnu/libjson.so.0.0.1 7f2eeb728000-7f2eeb729000 r-xp 00000000 ca:01 3020751 /usr/lib/syslog-ng/3.3.5/libtfjson.so 7f2eeb729000-7f2eeb929000 ---p 00001000 ca:01 3020751 /usr/lib/syslog-ng/3.3.5/libtfjson.so 7f2eeb929000-7f2eeb92a000 r--p 00001000 ca:01 3020751 /usr/lib/syslog-ng/3.3.5/libtfjson.so 7f2eeb92a000-7f2eeb92b000 rw-p 00002000 ca:01 3020751 /usr/lib/syslog-ng/3.3.5/libtfjson.so 7f2eeb92b000-7f2eeb93d000 r-xp 00000000 ca:01 2886210 /usr/lib/x86_64-linux-gnu/libmongo-client.so.0.3.1 7f2eeb93d000-7f2eebb3d000 ---p 00012000 ca:01 2886210 /usr/lib/x86_64-linux-gnu/libmongo-client.so.0.3.1 7f2eebb3d000-7f2eebb3e000 r--p 00012000 ca:01 2886210 /usr/lib/x86_64-linux-gnu/libmongo-client.so.0.3.1 7f2eebb3e000-7f2eebb3f000 rw-p 00013000 ca:01 2886210 /usr/lib/x86_64-linux-gnu/libmongo-client.so.0.3.1 7f2eebb3f000-7f2eebb49000 r-xp 00000000 ca:01 3020746 /usr/lib/syslog-ng/3.3.5/libafmongodb.so 7f2eebb49000-7f2eebd48000 ---p 0000a000 ca:01 3020746 /usr/lib/syslog-ng/3.3.5/libafmongodb.so 7f2eebd48000-7f2eebd49000 r--p 00009000 ca:01 3020746 /usr/lib/syslog-ng/3.3.5/libafmongodb.so 7f2eebd49000-7f2eebd4a000 rw-p 0000a000 ca:01 3020746 /usr/lib/syslog-ng/3.3.5/libafmongodb.so 7f2eebd4a000-7f2eebd55000 r-xp 00000000 ca:01 1180101 /lib/x86_64-linux-gnu/libnss_files-2.13.so 7f2eebd55000-7f2eebf54000 ---p 0000b000 ca:01 1180101 /lib/x86_64-linux-gnu/libnss_files-2.13.so 7f2eebf54000-7f2eebf55000 r--p 0000a000 ca:01 1180101 /lib/x86_64-linux-gnu/libnss_files-2.13.so 7f2eebf55000-7f2eebf56000 rw-p 0000b000 ca:01 1180101 /lib/x86_64-linux-gnu/libnss_files-2.13.so 7f2eebf56000-7f2eebf60000 r-xp 00000000 ca:01 1180097 /lib/x86_64-linux-gnu/libnss_nis-2.13.so 7f2eebf60000-7f2eec15f000 ---p 0000a000 ca:01 1180097 /lib/x86_64-linux-gnu/libnss_nis-2.13.so 7f2eec15f000-7f2eec160000 r--p 00009000 ca:01 1180097 /lib/x86_64-linux-gnu/libnss_nis-2.13.so 7f2eec160000-7f2eec161000 rw-p 0000a000 ca:01 1180097 /lib/x86_64-linux-gnu/libnss_nis-2.13.so 7f2eec161000-7f2eec168000 r-xp 00000000 ca:01 1180090 /lib/x86_64-linux-gnu/libnss_compat-2.13.so 7f2eec168000-7f2eec367000 ---p 00007000 ca:01 1180090 /lib/x86_64-linux-gnu/libnss_compat-2.13.so 7f2eec367000-7f2eec368000 r--p 00006000 ca:01 1180090 /lib/x86_64-linux-gnu/libnss_compat-2.13.so 7f2eec368000-7f2eec369000 rw-p 00007000 ca:01 1180090 /lib/x86_64-linux-gnu/libnss_compat-2.13.so 7f2eec369000-7f2eec36b000 r-xp 00000000 ca:01 3015504 /usr/lib/syslog-ng/3.3.5/libconfgen.so 7f2eec36b000-7f2eec56a000 ---p 00002000 ca:01 3015504 /usr/lib/syslog-ng/3.3.5/libconfgen.so 7f2eec56a000-7f2eec56b000 r--p 00001000 ca:01 3015504 /usr/lib/syslog-ng/3.3.5/libconfgen.so 7f2eec56b000-7f2eec56c000 rw-p 00002000 ca:01 3015504 /usr/lib/syslog-ng/3.3.5/libconfgen.so 7f2eec56c000-7f2eec570000 r-xp 00000000 ca:01 3015523 /usr/lib/syslog-ng/3.3.5/libsyslogformat.so 7f2eec570000-7f2eec76f000 ---p 00004000 ca:01 3015523 /usr/lib/syslog-ng/3.3.5/libsyslogformat.so 7f2eec76f000-7f2eec770000 r--p 00003000 ca:01 3015523 /usr/lib/syslog-ng/3.3.5/libsyslogformat.so 7f2eec770000-7f2eec771000 rw-p 00004000 ca:01 3015523 /usr/lib/syslog-ng/3.3.5/libsyslogformat.so 7f2eec771000-7f2eec787000 r-xp 00000000 ca:01 3015515 /usr/lib/syslog-ng/3.3.5/libdbparser.so 7f2eec787000-7f2eec987000 ---p 00016000 ca:01 3015515 /usr/lib/syslog-ng/3.3.5/libdbparser.so 7f2eec987000-7f2eec988000 r--p 00016000 ca:01 3015515 /usr/lib/syslog-ng/3.3.5/libdbparser.so 7f2eec988000-7f2eec989000 rw-p 00017000 ca:01 3015515 /usr/lib/syslog-ng/3.3.5/libdbparser.so 7f2eec989000-7f2eec991000 r-xp 00000000 ca:01 3015509 /usr/lib/syslog-ng/3.3.5/libcsvparser.so 7f2eec991000-7f2eecb91000 ---p 00008000 ca:01 3015509 /usr/lib/syslog-ng/3.3.5/libcsvparser.so 7f2eecb91000-7f2eecb92000 r--p 00008000 ca:01 3015509 /usr/lib/syslog-ng/3.3.5/libcsvparser.so 7f2eecb92000-7f2eecb93000 rw-p 00009000 ca:01 3015509 /usr/lib/syslog-ng/3.3.5/libcsvparser.so 7f2eecb93000-7f2eecb95000 r-xp 00000000 ca:01 3015503 /usr/lib/syslog-ng/3.3.5/libbasicfuncs.so 7f2eecb95000-7f2eecd95000 ---p 00002000 ca:01 3015503 /usr/lib/syslog-ng/3.3.5/libbasicfuncs.so 7f2eecd95000-7f2eecd96000 r--p 00002000 ca:01 3015503 /usr/lib/syslog-ng/3.3.5/libbasicfuncs.so 7f2eecd96000-7f2eecd97000 rw-p 00003000 ca:01 3015503 /usr/lib/syslog-ng/3.3.5/libbasicfuncs.so 7f2eecd97000-7f2eece18000 r-xp 00000000 ca:01 1180092 /lib/x86_64-linux-gnu/libm-2.13.so 7f2eece18000-7f2eed017000 ---p 00081000 ca:01 1180092 /lib/x86_64-linux-gnu/libm-2.13.so 7f2eed017000-7f2eed018000 r--p 00080000 ca:01 1180092 /lib/x86_64-linux-gnu/libm-2.13.so 7f2eed018000-7f2eed019000 rw-p 00081000 ca:01 1180092 /lib/x86_64-linux-gnu/libm-2.13.soAborted (core dumped) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

syslog-ng-3.4.0alpha2 syslog-ng binary failure for server instance.
by anju.raveendrannair＠wipro.com 08 Jun '12

08 Jun '12

Hi, We are using syslog-ng-3.4.0alpha2 binary and trying to run the syslog-ng server configuration file, but its not starting the syslog ng server. We are getting the following error incase of f__nonconsole_access filter when we ran the syslog-ng binary in debug mode. Filter rule evaluation result; result='match', rule='f_nonconsole_access', location='/ne_data/conf/syslogng/syslog-ng_server.conf:58:29' ** ERROR:logmsg.c:535:log_msg_set_value_indirect: assertion failed: (!log_msg_is_write_protected(self)) Abort (core dumped) PFA the debug.log The server conf is having the following line for the above mentioned filter, template ltemgr_msg_template { template("$S_ISODATE $HOST $FACILITY_NUM/$LEVEL_NUM $MSG\n"); }; #To strip of the msg_id introduced by syslogd rewrite rw_msg{subst("\\[.*\\]", "", value("MESSAGE"));}; source s_LTEMGR_SYSLOG_CLIENTS{ tcp (ip (27.132.98.69) port(6515) max-connections(4) tls( key_file("/ne_data/conf/certificates/MOCM/MOCM_key.pem") cert_file("/ne_data/conf/certificates/MOCM/MOCM_SB_server.pem") ca_dir("/ne_data/conf/certificates/SYSLOGNG") cipher_suite("ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:!SSLv2") peer_verify(optional-untrusted) ) ); }; ....... destination d_ltemgr_nonconsoleaccess_log {file("/ne_data/syslog/ems" perm(0644) template(ltemgr_msg_template)); }; ...... filter f_nonconsole_access { level(info..notice) and facility(auth) and ( match("Accepted password for" value("MESSAGE")) or match("Failed password for" value("MESSAGE")) ); }; ..... log { source(s_LTEMGR_SYSLOG_CLIENTS); filter(f_nonconsole_access); rewrite(rw_msg); destination(d_ltemgr_nonconsoleaccess_log); }; Without debug mode, we were able to run the server but central logging is not happening when tried with logger command. Thanks, Anju Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

[Bug 182] New: Support utmpx in afuser, along with the legacy utmp
by bugzilla＠bugzilla.balabit.com 08 Jun '12

08 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=182 Summary: Support utmpx in afuser, along with the legacy utmp Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: FreeBSD Status: ASSIGNED Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: algernon(a)balabit.hu ReportedBy: algernon(a)balabit.hu Type of the Report: --- Estimated Hours: 0.0 FreeBSD 9 had utmp support removed, so in the ports tree they were doing some sed magic to convert from utmp to utmpx. Instead of that, we should support both, and prefer utmpx if both are supported (like on Linux). A patch to implement this, based on the sed magic, and a patch by Alex Zimnitsky is available on the hotfix/3.3/fbsd9-utmpx branch of my git repo. Once tested, I will merge it to master. The commit in question is available at https://github.com/algernon/syslog-ng/commit/4b450a09da83bc8e27bd7c8adccea3… -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[PATCH] afuser: Use utmpx when available, instead of utmp
by Gergely Nagy 08 Jun '12

08 Jun '12

FreeBSD 9 removed support for utmp, and one must use the POSIX-specified utmpx instead. The same utmpx is available on Linux too (and it is the same as utmp there). The patch below converts afuser to use utmpx when available, utmp otherwise. It is based on the post-build sed magic applied to syslog-ng within the FreeBSD ports collection, with other bits based on a patch from Alex Zimnitsky. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- configure.in | 4 ++-- lib/utils.c | 4 +++- lib/utils.h | 7 ++++++- modules/afuser/afuser.c | 20 +++++++++++++++++++- 4 files changed, 30 insertions(+), 5 deletions(-) diff --git a/configure.in b/configure.in index aafb980..c76d7d9 100644 --- a/configure.in +++ b/configure.in @@ -383,7 +383,7 @@ dnl *************************************************************************** AC_HEADER_STDC AC_CHECK_HEADER(dmalloc.h) -AC_CHECK_HEADERS(strings.h getopt.h stropts.h sys/strlog.h door.h sys/capability.h sys/prctl.h) +AC_CHECK_HEADERS(strings.h getopt.h stropts.h sys/strlog.h door.h sys/capability.h sys/prctl.h utmpx.h) AC_CHECK_HEADERS(tcpd.h) @@ -479,7 +479,7 @@ if test "x$enable_linux_caps" = "xyes" -o "x$enable_linux_caps" = "xauto"; then AC_CHECK_LIB(cap, cap_set_proc, LIBCAP_LIBS="-lcap") fi -AC_CHECK_FUNCS(strdup strtol strtoll strtoimax inet_aton inet_ntoa getopt_long getaddrinfo getutent pread pwrite strcasestr memrchr localtime_r gmtime_r) +AC_CHECK_FUNCS(strdup strtol strtoll strtoimax inet_aton inet_ntoa getopt_long getaddrinfo getutent getutxent pread pwrite strcasestr memrchr localtime_r gmtime_r) old_LIBS=$LIBS LIBS=$BASE_LIBS AC_CHECK_FUNCS(clock_gettime) diff --git a/lib/utils.c b/lib/utils.c index 2b5c525..1f06e12 100644 --- a/lib/utils.c +++ b/lib/utils.c @@ -33,7 +33,9 @@ #include <netinet/in.h> #include <arpa/inet.h> #include <fcntl.h> +#if HAVE_UTMP_H #include <utmp.h> +#endif #include "utils.h" @@ -47,7 +49,7 @@ int inet_aton(const char *cp, struct in_addr *addr) } #endif -#ifndef HAVE_GETUTENT +#if !defined(HAVE_GETUTENT) && !defined(HAVE_GETUTXENT) && defined(HAVE_UTMP_H) static int utent_fd = -1; diff --git a/lib/utils.h b/lib/utils.h index 86e3a7f..a0f3dcc 100644 --- a/lib/utils.h +++ b/lib/utils.h @@ -28,13 +28,18 @@ #include <sys/types.h> #include <sys/socket.h> #include <netinet/in.h> + +#ifdef HAVE_UTMPX_H +#include <utmpx.h> +#else #include <utmp.h> +#endif #ifndef HAVE_INET_ATON int inet_aton(const char *cp, struct in_addr *addr); #endif -#ifndef HAVE_GETUTENT +#if !defined(HAVE_GETUTENT) && !defined(HAVE_GETUTXENT) struct utmp *getutent(void); void endutent(void); #endif diff --git a/modules/afuser/afuser.c b/modules/afuser/afuser.c index 8f170e5..7d082b2 100644 --- a/modules/afuser/afuser.c +++ b/modules/afuser/afuser.c @@ -25,7 +25,13 @@ #include "alarms.h" #include "messages.h" +#ifdef HAVE_UTMPX_H +#include <utmpx.h> +#define ut_name ut_user +#else #include <utmp.h> +#endif + #include <string.h> #include <fcntl.h> #include <unistd.h> @@ -46,7 +52,11 @@ afuser_dd_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, { AFUserDestDriver *self = (AFUserDestDriver *) s; gchar buf[8192]; +#ifdef HAVE_UTMPX_H + struct utmpx *ut; +#else struct utmp *ut; +#endif GString *timestamp; time_t now; @@ -63,7 +73,11 @@ afuser_dd_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, g_string_free(timestamp, TRUE); /* NOTE: there's a private implementations of getutent in utils.c on Systems which do not provide one. */ - while ((ut = getutent())) +#ifdef HAVE_GETUTXENT + while ((ut = getutxent())) +#else + while ((ut = getutent())) +#endif { #if HAVE_MODERN_UTMP if (ut->ut_type == USER_PROCESS && @@ -106,7 +120,11 @@ afuser_dd_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, } } } +#if HAVE_UTMPX_H + endutxent(); +#else endutent(); +#endif finish: log_msg_ack(msg, path_options); log_msg_unref(msg); -- 1.7.9

1 0

pattern tags in syslog
by system＠ra-schaal.de 08 Jun '12

08 Jun '12

Hi all, i´ve a problem with pdbtool / using tags with syslog 3.3.5: If I tag a message inside a pattern containing a "-", the tags are not used within syslog and "pbtool match": <ruleset id='c5a92074c59aca552764af9037cd895b' name='mirror'> <pattern>clam-clientsync</pattern> <rules> <rule class='mirror' id='c5a92074c59aca552764af9037cd895b' provider='fs'> <patterns> <pattern>safebrowsing</pattern> <pattern>deleting</pattern> <pattern>main</pattern> <pattern>daily</pattern> <pattern>bytecode</pattern> <pattern>local_blacklist_apache</pattern> <pattern>timestamp</pattern> <pattern>sent @NUMBER::@ bytes</pattern> <pattern>total size is @NUMBER::@</pattern> </patterns> <tags> <tag>clamav-mirror</tag> </tags> </rule> </rules> </ruleset> # pdbtool match -p mirror.pdb -P clam-clientsync -M "safebrowsing" -D Pattern matching part: safebrowsing Matching part: safebrowsing Values: MESSAGE=safebrowsing PROGRAM=clam-clientsync .classifier.class=mirror .classifier.rule_id=c5a92074c59aca552764af9037cd895b TAGS= BTW: if I skip "-D" everything is fine. But in my syslog-ng.conf i can´t use clamav-mirror in the filter. Instead I must use clamavmirror: filter f_rsync_clamav { tags("clamavmirror"); }; tags("clamav-mirror") won´t work.

1 0

Writes garbled kernel messages to logs
by shih dane 08 Jun '12

08 Jun '12

Hi All Lately I've setup syslog server on Fedora 12 l want to get iscsi connection log but get some garbled kernel messages syslog-ng version : syslog-ng 3.3.1 syslog-ng.conf @version: 3.3 @include "scl.conf" options { stats_freq(0); create_dirs(yes); dir_perm(0777); perm(0644); }; source src { system(); internal(); udp(); }; destination information { file("/raid/syslog/information"); }; destination error { file("/raid/syslog/error"); }; destination warning { file("/raid/syslog/warning"); }; filter f_info { level(info); }; filter f_error { level(error); }; filter f_warning { level(warning); }; log { source(src); filter(f_info); destination(information); }; log { source(src); filter(f_error); destination(error); }; log { source(src); filter(f_warning); destination(warning); }; Thanks for any advice Best Regard Dane

1 0

Snare TAB characters converted to \011 are missing?
by Clayton Dukes 07 Jun '12

07 Jun '12

Hi All, I have a user receiving messages from Snare but, for some reason, syslog-ng doesn't appear to be converting the TAB characters properly. Snare sends messages as: HostName<TAB>MSWinEventLog<TAB>Criticality<TAB>EventLogSource<TAB>SnareCounter<TAB>SubmitTime<TAB>EventID<TAB>SourceName<TAB>UserName<TAB>SIDType<TAB>EventLogType<TAB>ComputerName<TAB>CategoryString<TAB>DataString<TAB>ExpandedString<TAB>MD5 checksum (optional) I have verified using a sniffer on the syslog-ng server that the message format is coming in correctly with the TABs, but somehow the messages are leaving syslog-ng as: ...snip (full message clipped for brevity) Tue Jun 05 11:09:27 2012592SecuritySYSTEMUserSuccess Audit ...snip In the example above, it should be: Tue Jun 05 11:09:27 2012\011592\011Security\011SYSTEM\011User\011Success Audit I've checked his syslog-ng.conf file and it is the normal one that comes with Ubuntu 12.4 LTS. Any idea what might be causing this? ______________________________________________________________ Clayton Dukes ______________________________________________________________

1 1

syslog-ng Insider - June 2012
by Peter Czanik 07 Jun '12

07 Jun '12

Dear syslog-ng users, This is the 14th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com <mailto:documentation@balabit.com> FEATURED NEWS New features in syslog-ng 3.4 ----------------------------- The CEE/Lumberjack project might be very silent recently, but is still a good excuse to demonstrate some of the new features of syslog-ng 3.4. These make implementing structured logging (and this way CEE) possible by adding a JSON parser, marker detection, channels and junctions and a flexible use of blocks, so complex configurations can be combined in a block and easily reused in many configs. For details and examples check: http://bazsi.blogs.balabit.com/2012/05/cee-prototype-and-a-show-case-for-th… Version 3.4 also merges many features from syslog-ng PE, which can be followed in git commit messages. These include the SYSUPTIME macro, AM/PM related macros, test cases, support for Cisco sequence numbers, etc. Git commits: https://github.com/bazsi/syslog-ng-3.4/commits/master Message rate alerting in SSB ---------------------------- Even though syslog-ng Store Box neither is nor aims to be a full-blown SIEM solution, it can be and is indeed often used to detect anomalies, identify possible threats, and find problems within an organization's IT infrastructure. One important thing to note is that it is not only the contents of log messages that carry information about what happens in the network but their volume too. Read how message rate alerting works in SSB at http://gyp.blogs.balabit.com/2012/06/new-features-in-ssb-3-lts-message-rate… syslog-ng 3.3 has a new maintainer ---------------------------------- As Bazsi, lead developer of syslog-ng announced on the syslog-ng mailing list, the stable version has now a new maintainer. He is Gergely Nagy, or better known as Algernon, who coded some interesting new features for syslog-ng, including a MongoDB destination, and a JSON output and parser (for 3.4). This change will leave Bazsi more time for 3.4 developments and also speed up merging bugfixes to the 3.3 line. Announcement: https://lists.balabit.hu/pipermail/syslog-ng/2012-May/018885.html Algernon's plans: http://algernon.blogs.balabit.com/2012/05/hats-and-sticks/ syslog-ng community forum ------------------------- For those, who prefer to use web based forums instead of mailing lists, BalaBit provides now a community forum. Right now there are over forty users and their number is growing every day. If you want to read about interesting topics, or could help fellow users using a forum instead of the mailing list, please visit the forum at http://communities.balabit.com/balabit OTHER SHORT NEWS * Follow syslog-ng development on twitter: http://twitter.com/bazsi771 * FreeBSD users love syslog-ng: http://czanik.blogs.balabit.com/2012/06/freebsd-pfsense-and-syslog-ng/ NEW RELEASES: * SSB (syslog-ng store box) 3LTS: http://andrea.blogs.balabit.com/2012/05/balabit-announces-new-release-of-it… ARCHIVE http://insider.blogs.balabit.com/ -- Peter Czanik (CzP)<czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

[Bug 176] New: iv_event_raw module doesn't work on mips64el n32, missing include
by bugzilla＠bugzilla.balabit.com 05 Jun '12

05 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=176 Summary: iv_event_raw module doesn't work on mips64el n32, missing include Product: syslog-ng Version: 3.3.x Platform: Other OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: mads(a)ab3.no Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=57) --> (https://bugzilla.balabit.com/attachment.cgi?id=57) iv_event_raw.c patch, missing include I have a Lemote Fuloong 2F mips64el (n32) machine running Gentoo, the uname looks like this: Linux Lemote 3.3.0 #5 PREEMPT Wed Apr 18 13:25:19 CEST 2012 mips64 ICT Loongson-2 V0.3 FPU V0.1 lemote-fuloong-2f-box GNU/Linux This machine doesn't get updated that often, so I didn't discover that syslog-ng didn't work before I updated syslog-ng to version 3.3.4 and then later 3.3.5 recently. Tested with glibc 2.14 and 2.15. Running syslog-ng -d: eventfd2: Invalid argument Trying to open module; module='affile', filename='/usr/lib32/syslog-ng/libaffile.so' Trying to open module; module='afprog', filename='/usr/lib32/syslog-ng/libafprog.so' Trying to open module; module='afsocket', filename='/usr/lib32/syslog-ng/libafsocket.so' Trying to open module; module='afuser', filename='/usr/lib32/syslog-ng/libafuser.so' Trying to open module; module='basicfuncs', filename='/usr/lib32/syslog-ng/libbasicfuncs.so' Trying to open module; module='csvparser', filename='/usr/lib32/syslog-ng/libcsvparser.so' Trying to open module; module='dbparser', filename='/usr/lib32/syslog-ng/libdbparser.so' Trying to open module; module='syslogformat', filename='/usr/lib32/syslog-ng/libsyslogformat.so' Running application hooks; hook='1' Running application hooks; hook='3' syslog-ng starting up; version='3.3.5' eventfd2: Invalid argument eventfd2: Invalid argument eventfd2: Invalid argument eventfd2: Invalid argument eventfd2: Invalid argument Segmentation fault I checked the file lib/ivykis/modules/iv_event_raw.c as it was the only file calling the eventfd2 syscall, and I noticed that it defines EFD_NONBLOCK and EFD_CLOEXEC if it's not already defined by the includes. I then noticed the values existed in <sys/eventfd.h>, and that the values in that file were other values that the ones defined in iv_event_raw.c. So I just included <sys/eventfd.h>, and that fixed the problem. Attaching a patch fixing the problem for me. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 8

tcp/udp driver not binding correctly
by N. Max Pierson 04 Jun '12

04 Jun '12

Hi List, I've searched the mailing lists for over a year back and couldn't find an answer to my question. I'm working with an older version of syslog-ng and most of the questions were about 3.x or newer, so here goes. I've setup a LVS cluster which is working perfectly. The problem I am having is when I have a logical interface ip (or no ip at all, interface is eth0:1) when using the tcp/udp driver, it does not seem to bind correctly and accept messages on the port specified. When using udp, I try a port scan with nmap and it shows the port on the logical interface a "closed". When I try tcp, it shows "filtered". The primary ip on interface eth0 accepts logs with no issues. Can syslog-ng bind to logical interfaces as described above and receive logs on multiple addresses?? A netstat -a shows *:syslog or when I outright specify the logical ip, it shows the logical ip, but as stated above ... it's either closed or filtered. I've searched all over, but it seems my google foo is not matching anything. Specifics .. RHEL v5.8 Syslog-ng v2.1.4 Regards, max

2 2

Problems for configure syslog structured as a source
by C. L. Martinez 04 Jun '12

04 Jun '12

Hi all, I am trying to configure syslog-ng to receive syslog messages as syslog structured (IETF). To accomplish I have configured: source s_ietfsyslog { syslog (port(20514) transport(tcp)); }; but not messages are processed by syslog-ng (but messages arrives from third devices). Any idea??

3 6

Re: [syslog-ng] Error in running syslogng client - source plugin sun-streams not found
by Balla, Hithendra (EXT-Other - IN/Bangalore) 04 Jun '12

04 Jun '12

Hi all, In the below conf file, I can see @include "scl.conf". If I remove that line or if I change it to --> include "scl.conf"; [i.e remove @ and add ; at the end], it did not complain any error. Is that expected behavior? Thanks Hithendra _____________________________________________ From: Balla, Hithendra (EXT-Other - IN/Bangalore) Sent: Monday, June 04, 2012 4:01 PM To: 'Syslog-ng users' and developers' mailing list' Subject: Error in running syslogng client - source plugin sun-streams not found Hi all, Can somebody help here in identifying the issue here. It says source plug-in sun-streams not sound. I have configured syslog-ng with --enable-ssl --enable-sun-streams A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -V syslog-ng 3.4.0alpha2 Installer-Version: 3.4.0alpha2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainli ne--3.4--master#ab25c4c2a32988d86a5e024d784db7ad48f17cd2 Compile-Date: Jun 4 2012 18:38:40 Available-Modules: afsocket,afsocket-notls,afstreams,affile,afprog,afuser,afmongodb,csvpars er,confgen,syslogformat,basicfuncs,dbparser,tfuuid,afsocket-tls Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-Linux-Caps: off Enable-Pcre: on A02-LEM-CSLPN01A# This is the client config file ######################################################################## ##### #Syslog-ng Client configuration File. # @version: 3.3 @include "scl.conf" options { keep_hostname (yes); log_fifo_size (1000); }; source s_local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)); }; A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -fFvde ~/syslog_conf/mod/syslog-ng_client.conf nanosleep() is not accurate enough to introduce minor stalls on the reader side, multi-threaded performance may be affected; WARNING: Configuration file format is too old, please update it to use the 3.4 format as some constructs might operate inefficiently; Starting to read include file; filename='/usr/local/etc/scl.conf', depth='1' Global value changed; define='scl-root', value='/usr/local/share/include/scl' Global value changed; define='include-path', value='/usr/local/etc:/usr/local/share/include' Starting to read include file; filename='/usr/local/etc/modules.conf', depth='2' Global value changed; define='autoload-compiled-modules', value='0' Module loaded and initialized successfully; module='syslogformat' Module loaded and initialized successfully; module='basicfuncs' Module loaded and initialized successfully; module='afsocket' Module loaded and initialized successfully; module='affile' Module loaded and initialized successfully; module='afprog' Module loaded and initialized successfully; module='afuser' Module loaded and initialized successfully; module='dbparser' Module loaded and initialized successfully; module='csvparser' Finishing include; filename='/usr/local/etc/modules.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/system/plugin.conf', depth='2' Module loaded and initialized successfully; module='confgen' Finishing include; filename='/usr/local/share/include/scl/system/plugin.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/pacct/plugin.conf', depth='2' Finishing include; filename='/usr/local/share/include/scl/pacct/plugin.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/syslogconf/plugin.conf', depth='2' Module loaded and initialized successfully; module='confgen' Finishing include; filename='/usr/local/share/include/scl/syslogconf/plugin.conf', depth='2' Finishing include; filename='/usr/local/etc/scl.conf', depth='1' Error parsing source, source plugin sun-streams not found in /export/home/root/syslog_conf/mod/syslog-ng_client.conf at line 14, column 18: source s_local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)) ;}; ^^^^^^^^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng A02-LEM-CSLPN01A

1 0

Re: [syslog-ng] Need help in running syslog-ng
by Balla, Hithendra (EXT-Other - IN/Bangalore) 04 Jun '12

04 Jun '12

Hi, This is the output with Fvde. It is showing relocation error for libafsocket.so. Any idea why it is coming ? A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -fFvde ~/syslog_conf/mod/syslog-ng_client.conf nanosleep() is not accurate enough to introduce minor stalls on the reader side, multi-threaded performance may be affected; WARNING: Configuration file format is too old, please update it to use the 3.4 format as some constructs might operate inefficiently; Starting to read include file; filename='/usr/local/etc/scl.conf', depth='1' Global value changed; define='scl-root', value='/usr/local/share/include/scl' Global value changed; define='include-path', value='/usr/local/etc:/usr/local/share/include' Starting to read include file; filename='/usr/local/etc/modules.conf', depth='2' Global value changed; define='autoload-compiled-modules', value='0' Module loaded and initialized successfully; module='syslogformat' Module loaded and initialized successfully; module='basicfuncs' Error opening plugin module; module='afsocket', error='ld.so.1: syslog-ng: fatal: relocation error: file /usr/local/lib/syslog-ng/libafsocket.so: symbol request_init: referenced symbol not found' Module loaded and initialized successfully; module='affile' Module loaded and initialized successfully; module='afprog' Module loaded and initialized successfully; module='afuser' Module loaded and initialized successfully; module='dbparser' Module loaded and initialized successfully; module='csvparser' Finishing include; filename='/usr/local/etc/modules.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/system/plugin.conf', depth='2' Module loaded and initialized successfully; module='confgen' Finishing include; filename='/usr/local/share/include/scl/system/plugin.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/pacct/plugin.conf', depth='2' Finishing include; filename='/usr/local/share/include/scl/pacct/plugin.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/syslogconf/plugin.conf', depth='2' Module loaded and initialized successfully; module='confgen' Finishing include; filename='/usr/local/share/include/scl/syslogconf/plugin.conf', depth='2' Finishing include; filename='/usr/local/etc/scl.conf', depth='1' Error parsing source, source plugin sun-streams not found in /export/home/root/syslog_conf/mod/syslog-ng_client.conf at line 14, column 18: source s_local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)) ;}; ^^^^^^^^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng A02-LEM-CSLPN01A# Thanks Hithendra -----Original Message----- From: Balla, Hithendra (EXT-Other - IN/Bangalore) Sent: Friday, June 01, 2012 5:49 PM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Need help in running syslog-ng Hi, Please find the attached output of configure. I tried running the command with -Fvde along with -f, but it says "excess number of args". Can you tell me if I missed anything here.? A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -f -Fvde /export/home/root/syslog_conf/mod/syslog-ng_client.conf Excess number of arguments Thanks Hithendra -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ext Gergely Nagy Sent: Friday, June 01, 2012 5:29 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] Need help in running syslog-ng "Balla, Hithendra (EXT-Other - IN/Bangalore)" <hithendra.balla.ext(a)nsn.com> writes: > A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -f > /export/home/root/syslog_conf/mod/syslog-ng_client.conf > > WARNING: Configuration file format is too old, please update it to use > the 3.4 format as some constructs might operate inefficiently; > Error parsing source, source plugin sun-streams not found in > /export/home/root/syslog_conf/mod/syslog-ng_client.conf at line 14, > column 18: > > source s_local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)); }; Could you post the output of configure, or config.log, perhaps? Also, you can try running syslog-ng with the -Fvde parameters (in addition to -f), which will output quite a lot of debug info to stderr, which might help us determine what's going wrong. >From both errors you showed, it seems syslog-ng is unable to find a module or two. Why that is so, I can't tell. config.log and the output of running syslog-ng with -Fvde could help us figure out the reason. -- |8] ________________________________________________________________________ ______ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

2 1

Error in running syslogng client - source plugin sun-streams not found
by Balla, Hithendra (EXT-Other - IN/Bangalore) 04 Jun '12

04 Jun '12

Hi all, Can somebody help here in identifying the issue here. It says source plug-in sun-streams not sound. I have configured syslog-ng with --enable-ssl --enable-sun-streams A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -V syslog-ng 3.4.0alpha2 Installer-Version: 3.4.0alpha2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainli ne--3.4--master#ab25c4c2a32988d86a5e024d784db7ad48f17cd2 Compile-Date: Jun 4 2012 18:38:40 Available-Modules: afsocket,afsocket-notls,afstreams,affile,afprog,afuser,afmongodb,csvpars er,confgen,syslogformat,basicfuncs,dbparser,tfuuid,afsocket-tls Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-Linux-Caps: off Enable-Pcre: on A02-LEM-CSLPN01A# This is the client config file ######################################################################## ##### #Syslog-ng Client configuration File. # @version: 3.3 @include "scl.conf" options { keep_hostname (yes); log_fifo_size (1000); }; source s_local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)); }; A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -fFvde ~/syslog_conf/mod/syslog-ng_client.conf nanosleep() is not accurate enough to introduce minor stalls on the reader side, multi-threaded performance may be affected; WARNING: Configuration file format is too old, please update it to use the 3.4 format as some constructs might operate inefficiently; Starting to read include file; filename='/usr/local/etc/scl.conf', depth='1' Global value changed; define='scl-root', value='/usr/local/share/include/scl' Global value changed; define='include-path', value='/usr/local/etc:/usr/local/share/include' Starting to read include file; filename='/usr/local/etc/modules.conf', depth='2' Global value changed; define='autoload-compiled-modules', value='0' Module loaded and initialized successfully; module='syslogformat' Module loaded and initialized successfully; module='basicfuncs' Module loaded and initialized successfully; module='afsocket' Module loaded and initialized successfully; module='affile' Module loaded and initialized successfully; module='afprog' Module loaded and initialized successfully; module='afuser' Module loaded and initialized successfully; module='dbparser' Module loaded and initialized successfully; module='csvparser' Finishing include; filename='/usr/local/etc/modules.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/system/plugin.conf', depth='2' Module loaded and initialized successfully; module='confgen' Finishing include; filename='/usr/local/share/include/scl/system/plugin.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/pacct/plugin.conf', depth='2' Finishing include; filename='/usr/local/share/include/scl/pacct/plugin.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/syslogconf/plugin.conf', depth='2' Module loaded and initialized successfully; module='confgen' Finishing include; filename='/usr/local/share/include/scl/syslogconf/plugin.conf', depth='2' Finishing include; filename='/usr/local/etc/scl.conf', depth='1' Error parsing source, source plugin sun-streams not found in /export/home/root/syslog_conf/mod/syslog-ng_client.conf at line 14, column 18: source s_local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)) ;}; ^^^^^^^^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng A02-LEM-CSLPN01A

1 0

(no subject)
by pedro castro 03 Jun '12

03 Jun '12

Gain Your Freedom, Manage Your Own Business http://www.fastauditores.com/httppxdvxdz-2.php?rytnumberID=353 Sun, 3 Jun 2012 12:57:56 _______________ Fiber board may also be used, but this is moredifficult to handle. journey wynwode

1 0

Need help in running syslog-ng
by Balla, Hithendra (EXT-Other - IN/Bangalore) 01 Jun '12

01 Jun '12

<<mod_client.conf>> <<mod_server.conf>> Hi all, This is Hithendra. I have succefully compiled and installed syslog-ng-3.4 version on Solaris Sparc10. I have used the following options while configuring syslog-ng. ./configure --with-ssl=/usr/local/ssl/ --enable-ssl --enable-sun-streams When I try to run the client /usr/local/sbin/syslog-ng -f /export/home/root/syslog_conf/mod/syslog-ng_client.conf --> I am getting the following error. A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -f /export/home/root/syslog_conf/mod/syslog-ng_client.conf WARNING: Configuration file format is too old, please update it to use the 3.4 format as some constructs might operate inefficiently; Error parsing source, source plugin sun-streams not found in /export/home/root/syslog_conf/mod/syslog-ng_client.conf at line 14, column 18: source s_local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)) ;}; ------------------------------------------------------------------------ --------------------------------------------------- When I try to run the server A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -f /export/home/root/syslog_conf/mod/syslog-ng_server.conf --> I am getting the following error WARNING: Configuration file format is too old, please update it to use the 3.4 format as some constructs might operate inefficiently; Using a global log-iw-size() option was removed, please use a per-source log-iw-size(); Error parsing afsocket, syntax error, unexpected LL_IDENTIFIER in /export/home/root/syslog_conf/mod/syslog-ng_server.conf at line 21, column 13: tls( ^^^ Can somebody help here in identifying issue and provide some input on how to get rid of it. Please find the attached conf files. Thanks Hithendra

2 2

syslog_ng 3.3.4 make error on HPUX HPPA 11.11
by Rakesh Rajasekharan 01 Jun '12

01 Jun '12

Hi, I am trying to compile syslog-ng 3.3.4 version on an HPUX HPPA 11.11 machine. The configure options I used were. ./configure --enable-dynamic-linking --prefix=/opt/soe/local/syslog-ng-3.3.4 Compiler options: compiler : gcc -std=gnu99 compiler options : -g -O2 -Wall -pthread -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -D_REENTRANT -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/opt/soe/local/syslog-ng-3.3.4/eventlog/include/eventlog -I/usr/local/include -I$(top_srcdir)/lib/ivykis/lib/include -I$(top_builddir)/lib/ivykis/lib/include -I$(top_srcdir)/lib/ivykis/modules/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -lcl prefix : /opt/soe/local/syslog-ng-3.3.4 linking mode : dynamic __thread keyword : no Submodules: ivykis : internal libmongo-client : internal Features: Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : yes spoof-source support : no tcp-wrapper support : no Linux capability support : no PCRE support : yes Env wrapper support : no systemd support : no (unit dir: none) Modules: Module search path : /opt/soe/local/syslog-ng-3.3.4/lib/syslog-ng Default module list : affile,afprog,afsocket,afuser,basicfuncs,csvparser,dbparser,syslogformat Sun STREAMS support (module): no SSL support (module) : no SQL support (module) : no PACCT module (EXPERIMENTAL) : no MongoDB destination (module): yes JSON support (module) : no (using no) The make though fails with the below error. /bin/sh ../../libtool --tag=CC --mode=link gcc -Wall -g -O2 -o client client.o ../libivykis.la -lpthread libtool: link: gcc -Wall -g -O2 -o client client.o ../.libs/libivykis.a -lpthread /usr/ccs/bin/ld: Unsatisfied symbols: pthread_sigmask (first referenced in ../.libs/libivykis.a(iv_main.o)) (data) pthread_mutex_init (first referenced in ../.libs/libivykis.a(iv_main.o)) (data) pthread_mutex_destroy (first referenced in ../.libs/libivykis.a(iv_main.o)) (data) pthread_mutex_unlock (first referenced in ../.libs/libivykis.a(iv_main.o)) (data) pthread_mutex_lock (first referenced in ../.libs/libivykis.a(iv_main.o)) (data) /usr/ccs/bin/ld: (Warning) Linker features were used that may not be supported in future releases. The +vallcompatwarnings option can be used to display more details, and the ld(1) man page contains additional information. This warning can be suppressed with the +vnocompatwarnings option. collect2: ld returned 1 exit status make[7]: *** [client] Error 1 make[7]: Leaving directory `/compile/syslog/syslog-ng-3.3.4/lib/ivykis/lib/test' make[6]: *** [all-recursive] Error 1 make[6]: Leaving directory `/compile/syslog/syslog-ng-3.3.4/lib/ivykis/lib' make[5]: *** [all-recursive] Error 1 make[5]: Leaving directory `/compile/syslog/syslog-ng-3.3.4/lib/ivykis' make[4]: *** [all] Error 2 make[4]: Leaving directory `/compile/syslog/syslog-ng-3.3.4/lib/ivykis' make[3]: *** [all-recursive] Error 1 make[3]: Leaving directory `/compile/syslog/syslog-ng-3.3.4/lib' make[2]: *** [all] Error 2. I have compiled glib-2.16.5 statically and eventlog_0.2.12. make[2]: Leaving directory `/compile/syslog/syslog-ng-3.3.4/lib' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/compile/syslog/syslog-ng-3.3.4' make: *** [all] Error 2. Please help me fix this. I have tried tweaking with the comfigure options but could no tget anywhere. Regards, Rakesh

3 6

[Bug 157] New: syslog-ng 3.2.x/3.3.x: test_sql.py and 64-bit systems
by bugzilla＠bugzilla.balabit.com 01 Jun '12

01 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=157 Summary: syslog-ng 3.2.x/3.3.x: test_sql.py and 64-bit systems Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Mac OS Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jpo(a)di.uminho.pt Type of the Report: --- Estimated Hours: 0.0 Created an attachment (id=45) --> (https://bugzilla.balabit.com/attachment.cgi?id=45) Add '/usr/lib64/dbd/' to the search paths Hi, In 64-bits systems we need to add lib64 directories to the libdbi/libdbdsqlite3 module search path in order to successfully run the test_sql functional test. Location of libdbdsqlite3.so in 64-bit Fedora/RHEL: ---------- $ rpm -ql libdbi-dbd-sqlite /usr/lib64/dbd/libdbdsqlite3.so ---------- Affected syslog-ng versions: At least the 3.2 and 3.3 branches (I haven't check the 3.4 development branch). Fix: The attached patch adds the '/usr/lib64/dbd/' directory to the search path. Adding '/usr/local/lib64/dbd' should also make sense (but it is not done by the attached patch). /jpo -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

[Bug 180] New: README file in spec files but not in tar.gz
by bugzilla＠bugzilla.balabit.com 31 May '12

31 May '12

https://bugzilla.balabit.com/show_bug.cgi?id=180 Summary: README file in spec files but not in tar.gz Product: syslog-ng Version: 3.3.x Platform: Other OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: mark.ulmer(a)apollogrp.edu Type of the Report: bug Estimated Hours: 0.0 During rpmbuild process, I've noticed that the syslog-ng.spec and syslog-ng.spec.in files expect a README file that does not exist in the source tar.gz. Unknown if the README was intended to be removed? ./install-sh -o root -g root -m 0644 README \ ${RPM_BUILD_ROOT}/%{_prefix}/share/doc/syslog-ng-3.3.5/README I of course commented out these lines to get past the issue. Mark Ulmer -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[Bug 143] New: syslog-ng supervisor dies on SIGHUP
by bugzilla＠bugzilla.balabit.com 31 May '12

31 May '12

https://bugzilla.balabit.com/show_bug.cgi?id=143 Summary: syslog-ng supervisor dies on SIGHUP Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.syslogng(a)feystorm.net Type of the Report: --- Estimated Hours: 0.0 The process which supervises syslog-ng and restarts it in the event of a crash dies when it receives a SIGHUP. This is a problem as when sending a HUP to syslog-ng to have it reload its config, the HUP will get sent to both the supervisor process and the worker process if doing something like `pkill -HUP syslog-ng`. I attached a gdb to the supervisor and its not a segfault or anything, it just quits. I'm guessing the supervisor doesnt have a signal handler for HUP, so it uses the default action which is to quit. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

[Bug 175] New: syslog-ng doesnt perform fsync() with fsync option enabled on file destinations
by bugzilla＠bugzilla.balabit.com 31 May '12

31 May '12

https://bugzilla.balabit.com/show_bug.cgi?id=175 Summary: syslog-ng doesnt perform fsync() with fsync option enabled on file destinations Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.syslogng(a)feystorm.net Type of the Report: --- Estimated Hours: 0.0 While trying to track down an issue on our production system where our box would experience hanging issues every 30 seconds, I discovered this was because syslog-ng wasnt flushing its data, and so when the linux pdflush woke up, it would flush out a ton of data to NFS causing syslog and other applications to hang until the flush completed. Ultimately this was causing messages to be dropped as input buffers were filling up while syslog-ng was hung. This shouldnt have been happening as I have syslog-ng configured with the flush option enabled on the file destination which writes to NFS. I have a workaround in place by forcing pdflush to run more frequently, and have also increased several of the input buffers so they dont fill up so fast. I confirmed this issue by building syslog-ng-3.3.5 and putting a gdb break point on lib/logtransport.c:170, and the break point never triggers. I do have a question about the fsync option as well. Does this option tell syslog-ng to flush() after every write, or after all lines have been written (like from the flush_lines or flush_timeout() options)? If it flushes after every write, would it be possible to get an option to flush only once all the messages in the batch have been written? This is the stripped down configuration I have duplicated the issue with: @version: 3.3 options { keep_hostname(yes); chain_hostnames(no); normalize_hostnames(yes); use_dns(no); use_fqdn(yes); stats_freq(0); mark_freq(0); create_dirs(yes); dir_perm(0755); perm(0644); }; source s_sys { unix-dgram("/dev/log" max-connections(256)); internal(); file("/proc/kmsg"); }; destination d_default { file("/var/log/$FACILITY" flush_lines(1) fsync(yes)); }; log { source(s_sys); destination(d_default); flags(fallback); }; -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 7