- syslog-ng - lists.balabit.hu

Adding syslog-ng OSE 3.5.1 to buildroot
by Tamayo, Andres 16 Feb '14

16 Feb '14

Hello, I am working on adding syslog-ng OSE 3.5.1 to a cross-compiled image using buildroot. I was wondering if anybody knows if there is a repository where I can get the Config.in and syslog-ng.mk files needed to configure buildroot. Thank you for your help.

2 1

Multiple rewrite conditions under 3.4.x
by C. L. Martinez 14 Feb '14

14 Feb '14

Hi all, Is it possible to add multiple rewrite conditions in syslog-ng 3.4.x like this: rewrite r_rewrite_set{ set("myhost1", value("HOST") condition(program("myapplication1"))); set("myhost2", value("HOST") condition(program("myapplication2"))); set("myhost3", value("HOST") condition(program("myapplication3"))); set("myhost4", value("HOST") condition(program("myapplication4"))); }; ?? Is this a good option or maybe a performance penalty?? Thanks.

3 4

Re: [syslog-ng] [RFC] procfile Dezso Bagi
by Balazs Scheidler 14 Feb '14

14 Feb '14

Algernon is working on the debian subdir. Thanks for the feedback. Hope your experience is going to be bugfree :) On Feb 11, 2014 3:52 PM, "Valentijn Sessink" <valentyn(a)blub.net> wrote: > Hi, > > Finally found some time to test this. My setup is rather simple (I > think), the config-file now says: > destination d_syslogblock { pseudofile > ("/proc/net/xt_recent/syslogblock" template("+${usracct.device}\n")); > file("/var/log/syslogblock"); file("/tmp/blocker" > template("+${usracct.device}\n")); }; > > The "blocker" file is just for testing purposes. and "syslogblock" is to > log all evil to a regular log file as well. > > I got it to work rather easily and will report my findings. > > In the mean time, a question: is there anyone who guards the debian/ > directory inside the source tree? There seem to be some (mostly minor) > issues, and as I'm fixing them locally in order to get syslog-ng up and > running, I may as well send them upstream. If anyone cares ;-) that is. > > Best regards, > > Valentijn > > On 12/30/13 19:16, Balazs Scheidler wrote: > > I have now submitted a pull request to merge the "pseudofile" > > destination, I've now skipped the support for destination file > > templates, but that can be added later on when a more concrete usecase > > shows up. It already solves Valentijn's use-case, so it is useful as it > is. > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >

1 0

insider 2014-02: FIPS; GSoC; Incubator; Conferences;
by Peter Czanik 13 Feb '14

13 Feb '14

Dear syslog-ng users, This is the 31th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. FEATURED NEWS FIPS ---- Certain departments of the US government and those conducting business on certain regulated markets are required to use tools utilizing cryptography certified according to the FIPS 140-2 standard to handle sensitive data. As logs often contain sensitive information, this regulation can apply to the log management system, too. Starting with the 5.0.4 release, we are offering a version of syslog-ng Premium Edition to customers that is built and shipped with the OpenSSL FIPS Object Module and as thus usable in environments where such validation is required. (For more information about the OpenSSL FIPS Object Module, see _http://openssl.com/fips/_.) This is a separate version and the original version is available that uses the standard OpenSSL library. It is currently available on major Linux platforms and has the same functionality as the non-compliant version apart from a few limitations listed in the documentation. Please visit _http://www.balabit.com/lp/fips_if for more information. Google Summer of Code (GsoC) ---------------------------- Based on the success of last years syslog-ng Gsoc participation (in co-operation with the openSUSE project), this year we plan to participate in GsoC again with a number of syslog-ng related projects. The current list of ideas range from new sources and destination through under the hood improvements to integration with configuration management systems. The syslog-ng GsoC page is available at _https://github.com/balabit/syslog-ng/wiki/GSoC2014_ The ideas page is available at _https://github.com/balabit/syslog-ng/wiki/GSoC2014-Idea-&-Project-list_ We also created a central hub for syslog-ng OSE related material, as part of our preparations for Google Summer of Code and onwards: it is available at_http://syslog-ng.org/_ syslog-ng incubator updates --------------------------- The syslog-ng incubator is a collection of tools and modules which are not (yet) part of the official repository. Since last month there are many smaller changes and brand new features. The master branch goes now hand in hand with syslog-ng's master branch, which is currently 3.6 pre-alpha code. If you are working on syslog-ng 3.5, use the 3.5/master branch of syslog-ng-incubator. On the feature side the Lua destination was enhanced, a monitoring source was added, together with a Graphite output. Among the Lua examples one can also find a script to push logs into ElasticSearch. To try the new features, check out _https://github.com/balabit/syslog-ng-incubator_from git. You can read more about the Lua destination at _https://talien.blogs.balabit.com/2014/02/lua-the-undiscovered-country/_ syslog-ng at conferences ------------------------ In the past few weeks we visited three conferences. While there we talked about syslog-ng to many people, some during organized presentations, and many more between presentations and social events of the conferences. A look back at FOSDEM and Config Management Camp: _https://czanik.blogs.balabit.com/2014/02/fosdem-2014-and-config-management… The next confirmed event is: Open Source Data Center Conference, 8-10 April, Berlin, Germany: _http://www.netways.de/osdc/_, Giving a talk titled "Monitoring with syslog-ng, Riemann and Kibana" There will be two developers present, so if anyone attends, and has Incubator, Lua, Riemann, etc. related questions, we'll be happy to answer. SHORT NEWS: * Measuring log collection performance: _https://pzolee.blogs.balabit.com/2014/01/measuring-log-collection-performa… NEW RELEASES * syslog-ng 5.0.4: _https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-February/000180.html_ Your feedback and news tips about the next issue is welcome at _documentation(a)balabit.com <mailto:documentation@balabit.com>_To read this newsletter on-line, visit: _http://insider.blogs.balabit.com/_ -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

debian init files gone wrong? (Due to git reorg?)
by Valentijn Sessink 12 Feb '14

12 Feb '14

Hi, Building syslog-ng from source posed a few problems, one of them being debian/syslog-ng.init that missed a crucial option: It's function syslogng_start() in Git currently says: start-stop-daemon --start --quiet --exec "$SYSLOGNG" --pidfile "$PIDFILE" -- $SYSLOGNG_OPTS \ ... while the Debian source I viewed says: start-stop-daemon --start --quiet --exec "$SYSLOGNG" --pidfile "$PIDFILE" -- -p "$PIDFILE" $SYSLOGNG_OPTS \ As the Git repository tells the file is from 2007, I suspect the git reorganisation from november to have caused this - but I'm not sure. Also, the Debian init files seem to be much more up to date than this file - the file in Git still starts with the "skeleton" stuff. Best regards, Valentijn

2 3

[RFC] procfile destination
by Balazs Scheidler 11 Feb '14

11 Feb '14

Hi, Based on a request I have now created a new destination driver, called "procfile". A working PoC is available on this branch: https://github.com/balabit/syslog-ng/tree/3.6/f/procfile It can be used to change kernel settings dynamically, based on a trigger within syslog-ng. The difference between procfile() and file(): - no template in the name of the file - processing is performed immediately as read by the source, no queueing is performed (e.g. no loss is possible, but takes CPU time from the source) - opens and closes the destination file after each and every write, writes to offset zero e.g. it doesn't append further data. I'd be grateful if you could provide feedback around these questions or the feature in general: - name of the driver, right now it is called procfile as it was the original use-case, however it works with stuff in /dev too, and might work with simple named pipes. - right now the file must exist and is not created (e.g. it really requires an existing file); do we need that? - do we need append mode in some cases - whether we need append mode (if we think of general files, this would probably be needed) Thanks in advance, Bazsi

5 6

[Bug 269] New: some code doesn't follow glib recomendations
by bugzilla＠bugzilla.balabit.com 04 Feb '14

04 Feb '14

https://bugzilla.balabit.com/show_bug.cgi?id=269 Summary: some code doesn't follow glib recomendations Product: syslog-ng Version: 3.5.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: iippolitov(a)gmail.com Type of the Report: bug Estimated Hours: 0.0 I'm using rhel 5.9 and syslog-ng 3.5.3. tests/unit/test_nvtable fails on line 69. It is a know bug: https://bugzilla.redhat.com/show_bug.cgi?id=714409#c4 . As per https://bugzilla.redhat.com/show_bug.cgi?id=716447 : >From the glib2 documentation: ... Note that neither keys nor values are copied when inserted into the GHashTable, so they must exist for the lifetime of the GHashTable. This means that the use of static strings is OK, but temporary strings (i.e. those created in buffers and those returned by GTK+ widgets) should be copied with g_strdup() before being inserted. If keys or values are dynamically allocated, you must be careful to ensure that they are freed when they are removed from the GHashTable, and also when they are overwritten by new insertions into the GHashTable. It is also not advisable to mix static strings and dynamically-allocated strings in a GHashTable, because it then becomes difficult to determine whether the string should be freed. ... The code in lib/nv_table.c uses a pointer to a string that is changed during a program execution to insert values into GHashTable. This causes some unit tests to fail at least in rhel5. nv_registry_alloc_handle was obviously fixed to g_strdup() string from function parameters, while nv_registry_add_alias still uses a pointer the function gets as a parameter: Here is a workaround: void nv_registry_add_alias(NVRegistry *self, NVHandle handle, const gchar *alias) { g_static_mutex_lock(&nv_registry_lock); - g_hash_table_insert(self->name_map, (gchar*)alias, GUINT_TO_POINTER((glong) handle)); + gchar * st_alias = g_strdup(alias); + g_hash_table_insert(self->name_map, st_alias, GUINT_TO_POINTER((glong) handle)); g_static_mutex_unlock(&nv_registry_lock); } AFAIK, g_hash_table_insert is used widely around syslog-ng code. Could someone please look it through and ensure that any value added into gHashTable is not changed during hashtable lifetime? Feel free to contact me via email or gtalk to find out any details I might miss. Thanks in advance. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 7

Help with long log messages
by Edward Gleeck 03 Feb '14

03 Feb '14

Syslog-ng seems to only allow up to 8192 bytes of log_msg_size and after which it splits up the log message into multiple log messages. Setting this up in the global options or on the source option to use more than 8192 does not seem to work. I was wondering if there are other options that I need to put in order that very long logs aren't split up. I realize this might be a very rare case on the need for long log messages, but the application logging was designed poorly and we need this functionality currently while the logging is being fixed. In looking at the source code, it seems that the log_msg_size is stored as a gint type, which in my recollection allows me to store up to +32787 right? If the max I could put is 8192, then I guess I'll have to come up with something else to process the split logs, otherwise any help would be appreciated.

2 1

[Bug 267] New: $YEAR on event in RFC 3164 format
by bugzilla＠bugzilla.balabit.com 31 Jan '14

31 Jan '14

https://bugzilla.balabit.com/show_bug.cgi?id=267 Summary: $YEAR on event in RFC 3164 format Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: dtgarry(a)hotmail.com Type of the Report: --- Estimated Hours: 0.0 I am using syslog-ng 3.3.4 Revision: /3.3.4.dfsg-2ubuntu1 Revision: /3.3.4.dfsg-2ubuntu1 I have a problem on the macro $YEAR when the event is in RFC 3164 format sometime the $YEAR extract the correct value of year, but not always. I test this problem on a computer with the current date, 9 january 2014, sending some event with these dates: - Dec 31 23:59:59, syslog-ng return the 2013 year; - Jan 1 00:00:01, syslog-ng return the 2014 year; - Feb 1 00:00:01, syslog-ng return the 2014 year; - Mar 1 00:00:01, syslog-ng return the 2013 year; how syslog-ng extract the year from an event when there is no year? Is it possible to configure correctly the syslog-ng? for testing I have configured syslog-ng to call my program "mytest" like this: destination d_tst { program("/etc/syslog-ng/sbin/mytest" template("<$PRI>$DATE $HOST $PROGRAM $MSGONLY $HOST $FACILITY $PRIORITY $LEVEL $TAG $YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC $PROGRAM\n") template-escape(yes) ); }; on mytest program I log what syslog-ng has parsed; today, that is the 9th january 2014, I have sent to syslog-ng this string: <131>Dec 31 23:59:59 hostTest processTest some test on mytest I will receive: <131>Dec 31 23:59:59 hostTest processTest some test hostTest local0 err err 83 2013-12-31 23:59:59 processTest note the year is 2013 If I send this: <131>Jan 1 00:00:01 hostTest processTest some test I will receive: <131>Jan 1 00:00:01 hostTest processTest some test hostTest local0 err err 83 2014-01-01 00:00:01 processTest now the year is 2014 But I send this event that is in the future: <131>Feb 1 00:00:01 hostTest processTest some test I will receive: <131>Feb 1 00:00:01 hostTest processTest some test hostTest local0 err err 83 2014-02-01 00:00:01 processTest the year is 2014 If I send an event of march: <131>Mar 1 00:00:01 hostTest processTest some test I will receive: <131>Mar 1 00:00:01 hostTest processTest some test hostTest local0 err err 83 2013-03-01 00:00:01 processTest where the year is 2013 thank you. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

Re: [syslog-ng] Issue with pdbtool patterndb and percent symbols
by Mark Shetka 29 Jan '14

29 Jan '14

My Zsh shell was somehow interfering with pdbtool and the % symbols. I reran with Bash and the patterns match just fine, so I'm all good. Thanks! -- Mark Shetka Information Technology Systems & Services University of Minnesota - Duluth (218) 726-7682 On Wed, Jan 29, 2014 at 8:40 AM, Mark Shetka <mshetka(a)d.umn.edu> wrote: > I am setting up some patterns to parse Cisco syslog messages. I noticed > that pdbtool will not complete if I have a "%F" anywhere in the string. > > Example log message: > %FWSM-1-109006: Authentication failed for user 'test' from > 131.212.1.1/43250 to 10.1.1.1/22 on interface management > > This does not complete: > pdbtool match -p cisco.xml -M "%FWSM-1-109006: Authentication failed for > user 'test' from 131.212.1.1/43250 to 10.1.1.1/22 on interface management" > > Nor does simply %F: > pdbtool match -p cisco.xml -M "%F" > > It is fine without the %: > pdbtool match -p cisco.xml -M "FWSM-1-109006: Authentication failed for > user 'test' from 131.212.1.1/43250 to 10.1.1.1/22 on interface management" > > MESSAGE=FWSM-1-109006: Authentication failed for user 'test' from > 131.212.1.1/43250 to 10.1.1.1/22 on interface management > .classifier.class=login > .classifier.rule_id=5cfbcb23-cfe4-4120-85c1-918df65c0edc > usracct.username=test > usracct.device=131.212.1.1 > usracct.service=22 > usracct.type=login > usracct.sessionid= > usracct.application= > secevt.verdict=REJECT > TAGS=.classifier.login,usracct,secevt > > It also seems to have issues with "%S", although not quite in the same > way. Any ideas what could be causing this? > > Mark > > > -- > Mark Shetka > Information Technology Systems & Services > University of Minnesota - Duluth > (218) 726-7682 >

1 0