- syslog-ng - lists.balabit.hu

Google Summer of Code proposals
by Tusa Viktor 14 Mar '14

14 Mar '14

Dear Google Summer of Code Applicants! Please note that you have only one week left for submitting your proposals. Please register in www.google-melange.com as a student, upload the necessary document, and you can start writing your proposal. Some of you already knows, that we will give you a small task which will test your eligibility for the project. We will give these tasks after your proposal submission, but not before March 17 (Monday). If you need a few tips about how to write a good proposal, here is a blog post about it: http://www.di.ens.fr/~baghdadi/TXT_blog/5_advices_to_get_your_proposal_acce… Happy Coding! Best Regards, Viktor Tusa

1 0

AUTO: James B Horwath is out of the office (returning 03/18/2014)
by James B Horwath 14 Mar '14

14 Mar '14

I am out of the office until 03/18/2014. I will be out of the office until 03/18/2013 with limited access to e-mail. If you have an urgent issue please contact Sunil Gupta at (610)-807-6710 or Dylan Yoder at (610)-807-7230. Regards Jim Horwath IT Security Services & Governance, Corporate BTS and IT Security/Risk Tel 610-807-8795 Mobile 610-533-6972 3900 Burgess Place, Bethlehem, Pa. 18017 Jim_Horwath(a)glic.com Note: This is an automated response to your message "syslog-ng Digest, Vol 107, Issue 29" sent on 3/14/2014 6:40:24. This is the only notification you will receive while this person is away. ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

1 0

syslog-ng news: GSoC, incubator, conferences
by Peter Czanik 14 Mar '14

14 Mar '14

Hi, Yesterday the syslog-ng newsletter went out with broken links and for some users it ended up in the spam folder for gmail users (and possibly others). I'm still debugging the cause of these problems. Until a good solution is found, here is a link to the on-line version: https://insider.blogs.balabit.com/2014/03/gsoc-incubator-conferences/ Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

Config visualization - concrete task
by Sandeep K Chaudhary 14 Mar '14

14 Mar '14

Hi guys, I have installed syslog-ng on my system, and have been looking at this[1] repository a little. I think I can start doing something concrete now. Can someone please give me the task so that I can start working on it? I hope that [1] is the correct repo to look at. [1] https://github.com/balabit/syslog-ng-3.5 Thanks, Sandeep.

3 3

insider 2014-03: GSoC; Incubator; Conferences;
by Peter Czanik 13 Mar '14

13 Mar '14

Dear syslog-ng users, This is the 32th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. FEATURED NEWS Google Summer of Code (GsoC) ---------------------------- This year the syslog-ng project was accepted to GSoC as a mentoring organization. We vould like to thank to the Debian and openSUSE projects for vouching for us and openSUSE to let us participate previous years under the openSUSE umbrella. We don't know yet the number of students we can mentor, but we already have a nice number of project ideas and students who expressed interest. It's not yet too late to browse the ideas page _https://github.com/balabit/syslog-ng/wiki/GSoC2014-Idea-&-Project-list_ and write a project proposal to the syslog-ng mailing list. Contact information is available at _https://github.com/balabit/syslog-ng/wiki/GSoC2014_ syslog-ng incubator updates --------------------------- The syslog-ng incubator is a collection of tools and modules which are not (yet) part of the official repository. Version 0.2.1 was released recently with many bugfixes, advanced LUA related features, support for FreeBSD and a python script based ElasticSearch destination. The syslog-ng incubator is available in many ways. First of all, the source is available in git at _https://github.com/balabit/syslog-ng-incubator_and as a release tgz at _http://packages.madhouse-project.org/syslog-ng/incubator/syslog-ng-incubat… There are also packages for openSUSE and Fedora with riemann support available in a subpackage. To use it, visit one of the below web pages and add the necessary repositories, which also have syslog-ng 3.5 and the riemann C client available. Fedora: _http://copr.fedoraproject.org/coprs/czanik/syslog-ng35/_ openSUSE: _https://build.opensuse.org/project/show/home:czanik:syslog-ng35_ A FreeBSD port is also work in progress, once ready, it will be committed to sysutils/syslog-ng-incubator. Riemann support is not included. syslog-ng at conferences ------------------------ The next confirmed events are: * Open Source Data Center Conference, 8-10 April, Berlin, Germany: _http://www.netways.de/osdc/_, Giving a talk titled "Monitoring with syslog-ng, Riemann and Kibana" There will be two developers present, so if anyone attends, and has Incubator, Lua, Riemann, etc. related questions, we'll be happy to answer. * Linux Open Admin Days, 5-6 April, Antwerp, Belgium: _http://loadays.org/_, Giving a talk titled “Babel Fish for DevOps: syslog-ng”. Those, who visited FOSDEM will be familiar with the basis of the presentation, but this time with a lot more details and configuration examples thanks to the more available time. * Infosecurity Europe, 29 April - 1 May, London, United Kingdom: _http://www.infosec.co.uk/_, Giving a talk titled "Finding method in the madness: the challenges of the automatic classification of log messages". The talk will be given by Balazs Scheidler (Bazsi) who you will also be able to find at the BalaBit booth at the event. * LinuxTag, 8-10 May, Berlin, Germany: _http://linuxtag.org <http://linuxtag.org/>_, Giving a talk titled "Finding method in the madness: the challenges of the automatic classification of log messages". BalaBit will also be sponsoring the event so you'll be able to find us and get T-shirts and talk with our engineers. The talk will be a revised version of the talk given a week before at Infosecurity Europe. NEW RELEASES * syslog-ng incubator 0.2.1: _https://github.com/balabit/syslog-ng-incubator/blob/master/NEWS_ * syslog-ng OSE 3.5.4: _https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-March/000182.html_ * syslog-ng OSE 3.5.4.1: _https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-March/000183.html_ * syslog-ng PE 4.0.7: _https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-March/000181.html_ Your feedback and news tips about the next issue is welcome at _documentation(a)balabit.com <mailto:documentation@balabit.com>_To read this newsletter on-line, visit: _http://insider.blogs.balabit.com/_ -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

syslog-ng 3.5.4.1 has been released
by devel＠balabit.hu 13 Mar '14

13 Mar '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.5.4.1 SUMMARY : new stable release DATE : Mar 13, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.5.4.1) has been released. For latest fixes in the 3.5.x feature branch you are recommended to upgrade to this version if you are running on a 32-bit platform. CHANGES: 3.5.4.1 Thu, 13 Mar 2014 10:46:07 +0100 This is the fourth bug-fix release for the 3.5.x series, with a single fix for 32-bit platforms. Upgrading to this version is highly recommended for people using 32-bit platforms, others are not affected. Bugfixes ======== * The basic template functions (substr, +, -, etc) were fixed to work correctly on 32-bit platforms, following up on a previous change that changed how numbers are parsed. Credits ======= syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Gergely Nagy <algernon(a)balabit.hu> Peter Czanik <czanik(a)balabit.hu> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

Installing multiple instances of Syslog-NG
by Shashank Rohatgi 13 Mar '14

13 Mar '14

Hi Can someone help me figure out how to install multiple instances of syslog-ng on a single server. Copying the binary and starting it with a different configuration file did spawn another instances but it wasnt independent as i saw it behaving different than what is configured in its syslog-ng file. I need a parallel instance for development alongside production. Thanks in advance regards SK

3 8

syslog-ng 3.5.4 has been released
by devel＠balabit.hu 12 Mar '14

12 Mar '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.5.4 SUMMARY : new stable release DATE : Mar 12, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.5.4) has been released. For latest fixes in the 3.5.x feature branch you are recommended to upgrade to this version. CHANGES: 3.5.4 Wed, 12 Mar 2014 13:18:36 +0100 This is the third bug-fix release for the 3.5.x series, with a number of important improvements over the previous release. Upgrading to this version is highly recommended. Bugfixes ======== * The value-pairs code had a serious bug, where under some circumstances (depending on compiler, platform and optimisation flags), it could end up in a live-lock, where the only way out was to forcibly kill the syslog-ng process. * SDATA enterprise IDs are handled better when using value-pairs (MongoDB, $(format-json), etc): the enterprise id is kept together, the possibly dotted numeric ID is not split into sub-structures anymore. * json-parser() can now be used from multiple log paths without crashing the syslog-ng process. * Options that can take a unit-suffixed number now work correctly on 32-bit big-endian platforms. * Using some time-related macros (like R_SEC) in filters do not crash syslog-ng anymore. * The internal copy of libmongo-client was updated to version 0.1.7.1, which fixes an important bug in the safe mode handling code. * The system() source learned to recognise FreeBSD jails, and will not use /dev/klog when running inside one. * The host() and port() options of the MongoDB destination have been marked obsolete (which were documented as such, but the code didn't follow). * The username() and password() options are now mandatory for the AMQP destination, and syslog-ng raises an error if either of them is unset. This is because the destination does not work without them anyway. * The timezone file parser now supports Tzif3 formatted files too. * The $(geoip) template function handles failed look-ups gracefully: it expands to an empty string then, and does not print a warning anymore. * The source code was updated to work with bison 3 and later (only affects people compiling from git, or rebuilding grammar files). * The syslog-ng pkg-config file now has an scldir and a datarootdir variable too, to help third-party packages. Credits ======= syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Andras Mitzki <micek(a)balabit.hu> Andres Tamayo <Andres.Tamayo(a)viasat.com> Balazs Scheidler <bazsi(a)balabit.hu> Daniel Gados <gdani(a)balabit.hu> Evan Rempel <erempel(a)uvic.ca> Fabien Wernli <bugzilla.balabit(a)faxm0dem.org> Gergely Nagy <algernon(a)balabit.hu> Igor Ippolitov <iippolitov(a)gmail.com> Peter Czanik <czanik(a)balabit.hu> Steve Berryman <steve(a)berryman.org.uk> Tibor Benke <btibi(a)balabit.hu> Viktor Tusa <tusa(a)balabit.hu> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

[Bug 273] New: 3.5.3 segfault on match against some macros
by bugzilla＠bugzilla.balabit.com 12 Mar '14

12 Mar '14

https://bugzilla.balabit.com/show_bug.cgi?id=273 Summary: 3.5.3 segfault on match against some macros Product: syslog-ng Version: 3.5.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 If I include any match against the time related macros, syslog-ng seg faults. Seems that *SEC and UNIXTIME are affected at the very least Very simple conf and all blows up. @version: 3.5 source s_test { internal(); } ; destination d_var_syslog { file("/var/log/syslog.log" owner("root") group("syslogs") perm(0640) ); }; filter f_one { match("1" value("R_SEC") ); }; log { source(s_test); log { filter(f_one); destination(d_var_syslog); }; }; -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[Bug 270] New: deadlock with patterndb and format-json ( debug NOT enabled in compilation)
by bugzilla＠bugzilla.balabit.com 12 Mar '14

12 Mar '14

https://bugzilla.balabit.com/show_bug.cgi?id=270 Summary: deadlock with patterndb and format-json (debug NOT enabled in compilation) Product: syslog-ng Version: 3.5.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.balabit(a)faxm0dem.org Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=90) --> (https://bugzilla.balabit.com/attachment.cgi?id=90) syslog-ng configuration and patterndb file This one was hard to isolate. Using the minimal attached configuration, it's very easy to lock the system down by running the following command (bourne shell): $ i=0; while echo 'sshd: Received disconnect from 1.2.3.4: 11: disconnected by user' > /var/tmp/syslo g-ng.src.fifo; do printf .$i.; i=$(($i+1)); done .0..1..2..3..4..5..6..7..8..9..10..11..12..13..14..15..16..17..18..19..20..21..22..23..24..25..26..27..28 [...] 124..125 [DEADLOCK] After that, syslog-ng is completely locked. command used to run syslog-ng: /sbin/syslog-ng -f /home/faxm0dem/syslog-ng-bug/syslog-ng.conf -R /tmp/syslog-ng.persist -p /tmp/syslog-ng.pid Most importantly, this does *only* happen when --enable-debug is *not* switched during compilation. Moreover, an example pattern in the provided patterndb shows how this can be avoided by renaming the variables. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 7