- syslog-ng - lists.balabit.hu

syslog problem
by Riyas Ahamed 09 Jul '14

09 Jul '14

Hi, I have configured syslog-ng but I cannot able to see logs of network devices in syslog-ng server. Please help me to sort-out the problem. Regards, N.B.Riaz Ahmed http://www.csscorp.com/common/email-disclaimer.php

4 4

Recommended version
by James Lay 08 Jul '14

08 Jul '14

All, As I'm working with it here, what's the recommended version folks are running? Currently I'm on 3.3.11, and I figure I might as well upgrade..thanks for any pointers/tips. James

2 3

[Bug 280] New: Memory leak in value-pairs.c
by bugzilla＠bugzilla.balabit.com 08 Jul '14

08 Jul '14

https://bugzilla.balabit.com/show_bug.cgi?id=280 Summary: Memory leak in value-pairs.c Product: syslog-ng Version: 3.5.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sgounaro(a)optonline.net Type of the Report: bug Estimated Hours: 0.0 Hi , it looks like vp_walker_name_value_split_add_name_token has a memory leak in g_strndup call. Running syslog-ng with a lot of messages coming in about ~800 per sec , starts with 139m of memory and ends up with 9gig of memory in a day being used. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

Properly forwarding syslog messages
by James Lay 07 Jul '14

07 Jul '14

Hey all, So I've looked around and I'm just not sure what the best method is for forwarding syslog messages. I have a current setup that is working well. I'd like to try and get all the messages forward to another machine using standard udp 514. I'd like the messages to appear as if they are coming from the originating machine, not the syslog server. I did see a couple sites that say I have to compile with spoofing. Can anyone point me to some resources to do this? Thank you. James

2 3

Optional Parser Type Match
by Michael Starks 07 Jul '14

07 Jul '14

Can a parser type be made to optionally match? For example, given the message of 'DROP IN=vlan2 OUT= MAC=48:5b:39:e8:44:c5:00:1d:5a:1c:37:b9:08:00:45:00:00:28 SRC=1.2.3.4 DST=172.16.0.1 LEN=40 TOS=0x00 PREC=0x00 TTL=45 ID=61318 PROTO=TCP SPT=443 DPT=45872 SEQ=1548679084 ACK=0 WINDOW=0 RES=0x00 RST URGP' OUT= may or may not be defined. I would like to match it if it exists with a parser and maybe just set it to nul if it doesn't exist. Similarly, in this message: 'DROP IN=vlan2 OUT= MAC=48:5b:39:e8:44:c5:00:1d:5a:1c:37:b9:08:00:45:00:00:28 SRC=1.2.3.4 DST=172.16.0.2 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=3265 DF PROTO=TCP SPT=443 DPT=44616 SEQ=880418731 ACK=0 WINDOW=0 RES=0x00 RST UR' the DF field sometimes exists and sometimes doesn't. Whenever I define something like 'DROP IN=@ESTRING:s1: @OUT=@ESTRING:s0: @' the OUT= string doesn't match if there is no value.

2 2

No PatternDB Matches
by Michael Starks 02 Jul '14

02 Jul '14

x-posted from ELSA mailing list; no replies there so please excuse the noise. I am trying to add an additional ASA log message that is unclassified in ELSA. To make a long story short, *nothing" seems to be matching with pdbtool. Here is the line I am trying to work with: Jun 23 00:00:05 192.168.1.4 %ASA-3-106100: access-list INOUT denied tcp inside/1.2.3.4(64576) -> outside/5.6.7.8(80) hit-cnt 1 first hit [0x59bca63e, 0x620e5b55] Putting that aside for the moment since I can't get it to work, I went straight to the syslog-ng docs (https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.4-gui…) and used the example. I created /etc/elsa/patterns.d/test.xml with this content: <patterndb version='4' pub_date='2010-10-17'> <ruleset name='ssh' id='123456678'> <pattern>ssh</pattern> <rules> <rule provider='me' id='182437592347598' class='system'> <patterns> <pattern>Accepted @QSTRING:SSH.AUTH_METHOD: @ for@QSTRING:SSH_USERNAME: @from\ @QSTRING:SSH_CLIENT_ADDRESS: @port @NUMBER:SSH_PORT_NUMBER:@ ssh2</pattern> </patterns> </rule> </rules> </ruleset> </patterndb> I then tested with this line: /usr/local/syslog-ng/bin/pdbtool match -p /etc/elsa/patterns.d/test.xml -M "Accepted password for sampleuser from 10.50.0.247 port 42156 ssh2" The result is this: MESSAGE=Accepted password for sampleuser from 10.50.0.247 port 42156 ssh2 .classifier.class=unknown Details are: [root@hostname elsa]# /usr/local/syslog-ng-3.2.4/sbin/syslog-ng -V syslog-ng 3.2.4 Installer-Version: 3.2.4 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#ef7b91e4a1b1f9628c66138b4ae83de7e4c697c6 Compile-Date: May 23 2012 09:58:14 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: on Enable-Pcre: on Enable-Pacct: off [root@hostname elsa]# cat /etc/redhat-release Oracle Linux Server release 6.5 Thank you in advance.

2 3

[ANN] syslog-ng 3.5 and 3.6 release plans
by Gergely Nagy 24 Jun '14

24 Jun '14

Hi! I described my plans for syslog-ng maintainance last October[1], and promised that I will give ample warning when 3.6 is about to hit beta. Here's the warning: I plan to release either an alpha, or a beta of 3.6 in early September (I will aim for beta, with an alpha in August), at which point, the 3.3 branch will no longer be maintained, and will be removed from my Debian repository[2] too. At that point, 3.4 will become a maintainance release, 3.5 will be stable, and 3.6 will be the feature branch. [1]: https://lists.balabit.hu/pipermail/syslog-ng/2013-October/020831.html [2]: http://asylum.madhouse-project.org/projects/debian/ However, I'd like to cut down on my tasks, and trying to maintain three versions of syslog-ng is quite a big burden, and I feel I'm not really doing a good job of taking care of the oldest version. Therefore, I'll try to deprecate 3.4 much quicker, and came up with the following plan: * When 3.5.5 is released (mid-July, if all goes well), I will switch the "syslog-ng" component of my Debian repo to 3.5. "syslog-ng-devel" will point to the same place. The 3.4 branch will remain available under the "syslog-ng-3.4" component, of course. One reason I feel this is safe to do, is because most distros migrated to 3.5 already, so 3.4 is not really in use. Also, with 3.5, you get the Incubator as a bonus, and increasing Incubator use would be great, too. * When 3.6 hits, I'd like to declare 3.4 "deprecated", and stop supporting it in a few months. This means that in 2015, I'd like to maintain only 3.5 and 3.6. This could all change, mind you, if there's enough demand for the maintainance of three versions. If you have good reasons for using 3.4, or wishing there were three maintained branches, do let me know! -- |8]

1 0

New release: puppet module for patterndb
by Fabien Wernli 23 Jun '14

23 Jun '14

Hi, I'm proud to announce the availability of version 2.0.0 of the patterndb puppet module. This new release adds the possibility to manage multiple pattern parsers, and fixes a number of bugs. cheers https://forge.puppetlabs.com/ccin2p3/patterndb

1 0

[Bug 279] New: Syslog-ng central loging server seg fault gentoo
by bugzilla＠bugzilla.balabit.com 23 Jun '14

23 Jun '14

https://bugzilla.balabit.com/show_bug.cgi?id=279 Summary: Syslog-ng central loging server seg fault gentoo Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: critical Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: hlavacek(a)gmx.com Type of the Report: bug Estimated Hours: 0.0 Hello, we have set up the following topology: OS gentoo: Linux syslog1 3.8.12-hardened #1 SMP Wed Sep 18 16:30:57 CEST 2013 x86_64 Intel(R) Xeon(TM) CPU 3.00GHz GenuineIntel GNU/Linux syslog: syslog server v3.4.7 and 40 syslog clients v3.x.x. problem: After a few days (5 or 10) server experienced segfault: [309942.605750] syslog-ng[17117]: segfault at 8 ip 00007fdb01e66609 sp 00007fdafe1ccac0 error 6 in libsyslog-ng-3.4.7.so[7fdb01e2b000+8f000] and then after two days with any error syslog-ng freezed in loop (cpu 100%), strace: futex(0x7fdc64009ca0, FUTEX_WAIT_PRIVATE, 2, NULL This scenario is being periodicaly repeated. We have faced this problem also with version 3.3 of syslog. BACKTRACE after segfault: syslog1 run # gdb syslog-ng -c core.syslog.201422041822 GNU gdb (Gentoo 7.6.2 p1) 7.6.2 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-pc-linux-gnu". For bug reporting instructions, please see: <http://bugs.gentoo.org/>... Reading symbols from /usr/sbin/syslog-ng...(no debugging symbols found)...done. [New LWP 26604] [New LWP 24631] [New LWP 1932] [New LWP 1933] [New LWP 1710] [New LWP 1456] [New LWP 1931] [New LWP 1713] [New LWP 1749] warning: Could not load shared library symbols for linux-vdso.so.1. Do you need "set solib-search-path" or "set sysroot"? [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". Core was generated by `syslog-ng --enable-core -c /var/run/syslog-ng-remote.ctl --persist-file /var/li'. Program terminated with signal 11, Segmentation fault. #0 0x00007f03fdb44a59 in ?? () from /usr/lib64/libsyslog-ng-3.4.7.so (gdb) bt full #0 0x00007f03fdb44a59 in ?? () from /usr/lib64/libsyslog-ng-3.4.7.so No symbol table info available. #1 0x00007f03fdb44b6a in ?? () from /usr/lib64/libsyslog-ng-3.4.7.so No symbol table info available. #2 0x00007f03fdb4cf35 in ?? () from /usr/lib64/libsyslog-ng-3.4.7.so No symbol table info available. #3 0x00007f03fdb6d42b in ?? () from /usr/lib64/libsyslog-ng-3.4.7.so No symbol table info available. #4 0x00007f03fdb6c3c2 in iv_run_tasks () from /usr/lib64/libsyslog-ng-3.4.7.so No symbol table info available. #5 0x00007f03fdb6ee1b in iv_main () from /usr/lib64/libsyslog-ng-3.4.7.so No symbol table info available. #6 0x00007f03fdb6d21a in ?? () from /usr/lib64/libsyslog-ng-3.4.7.so No symbol table info available. #7 0x00007f03fdb6f736 in ?? () from /usr/lib64/libsyslog-ng-3.4.7.so No symbol table info available. #8 0x00007f03fd5bcbd8 in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #9 0x00007f03fd2f7bbd in clone () from /lib64/libc.so.6 No symbol table info available. (gdb) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 9

Internal error, duplicate configuration elements...
by David Hauck 15 Jun '14

15 Jun '14

Hi, I've been playing around with configuring UDP destinations. My syntax checks ('syslog-ng -s') and high-level operation appear to be sound. However, I've noticed the following "internal error" that's issued whenever I start the service: 20140604 09:54:47.780 err syslog(syslog-ng):Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_dd_connection(dgram,205.159.216.207:514)' The UDP configuration references from 'syslog-ng.conf' are as follows: destination d_NAaudit_Prio { file("/var/log/netacquire/audit_log" template(t_NAFormat_Prio)); udp("205.159.216.207" port(514) template(t_NAFormat_Prio)); }; destination d_NAmessage_Prio { udp("205.159.216.207" port(514) template(t_NAFormat_Prio)); }; Does anyone know what this message is referring too? Things seem to work fine (e.g., log statements with these destinations do, ultimately, send the filtered messages to the target system), so I'm wondering if I need to be concerned at all. Thanks, -David

4 9