- syslog-ng - lists.balabit.hu

syslog-ng 3.3.11 has been released
by devel＠balabit.hu 14 Jun '13

14 Jun '13

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.3.11 SUMMARY : new stable release DATE : Jun 14, 2013 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.3.11) has been released. For latest fixes in the 3.3.x feature branch you are recommended to upgrade to this version. CHANGES: 3.3.11 Fri, 14 Jun 2013 16:00:00 +0100 Highlights ========== This release is a bug-fix release, correcting a handful of issues discovered since the previous one. Bugfixes ======== * Most of the changes in 3.3.10 have been reverted, as they resulted in instability and dead locks. * The configure files were updated to work with the newest automake, and not use long obsolete macros. * Zero-length templates (or template functions with zero-length output) do not result in an infinite loop anymore. * The $(if) and $(grep) template functions now respect the template_escape() setting. Credits ======= syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Balazs Scheidler <bazsi(a)balabit.hu> Evan Rempel <erempel(a)uvic.ca> Gergely Nagy <algernon(a)balabit.hu> Imre Lazar <imre(a)balabit.hu> Laszlo Meszaros <lmesz(a)balabit.hu> Michael Sterrett <mr_bones_(a)gentoo.org> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

[Bug 230] New: Passing args to blocks is broken in syslog-ng v.3.4
by bugzilla＠bugzilla.balabit.com 13 Jun '13

13 Jun '13

https://bugzilla.balabit.com/show_bug.cgi?id=230 Summary: Passing args to blocks is broken in syslog-ng v.3.4 Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: koldaevav(a)gmail.com Type of the Report: bug Estimated Hours: 0.0 After an upgrade from 3.3.7 to 3.4.1: ... block root mylogs(log()) { }; mylogs(log(123)) ... Gives: Unknown argument; context='root block mylogs', arg='log', value='123' Error parsing config, syntax error, unexpected LL_ERROR, expecting $end in /etc/syslog-ng/syslog-ng.conf at line 11, column 1: mylogs(log(123)) ^^^^^^ -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

[Bug 237] New: syslog-ng 3.4.2 (and 3.3.10): test failures in Fedora 18
by bugzilla＠bugzilla.balabit.com 13 Jun '13

13 Jun '13

https://bugzilla.balabit.com/show_bug.cgi?id=237 Summary: syslog-ng 3.4.2 (and 3.3.10): test failures in Fedora 18 Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Mac OS Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jpo(a)di.uminho.pt Type of the Report: --- Estimated Hours: 0.0 The syslog-ng 3.4.2 (and 3.3.10) test suite fails in Fedora 18: ---------- ... $DATE ${HOST:--} ${PROGRAM:--} ${PID:--} ${MSGID:--} ${SDATA:--} $MSG speed: 1056859.015 msg/sec *** glibc detected *** /home/fedora/rpms/BUILD/syslog-ng-3.4.2/tests/unit/.libs/lt-test_template_speed: free(): invalid pointer: 0x0000003a831b1c68 *** ======= Backtrace: ========= /lib64/libc.so.6[0x3a82e7ca8e] /lib64/libglib-2.0.so.0(g_mutex_free+0x9)[0x3a84a1c719] /lib64/libglib-2.0.so.0(g_static_mutex_free+0x16)[0x3a84a1ca66] /home/fedora/rpms/BUILDROOT/syslog-ng-3.4.2-0.1.fc18.x86_64//usr/lib64/libsyslog-ng-3.4.2.so(crypto_deinit+0x4e)[0x7f43c2fef0be] /lib64/ld-linux-x86-64.so.2[0x3a82a0f5f7] /lib64/libc.so.6[0x3a82e38df1] /lib64/libc.so.6[0x3a82e38e75] /lib64/libc.so.6(__libc_start_main+0xfc)[0x3a82e21a0c] /home/fedora/rpms/BUILD/syslog-ng-3.4.2/tests/unit/.libs/lt-test_template_speed[0x401681] ======= Memory map: ======== 00400000-00403000 r-xp 00000000 08:02 1863099 /home/fedora/rpms/BUILD/syslog-ng-3.4.2/tests/unit/.libs/lt-test_template_speed 00602000-00603000 r--p 00002000 08:02 1863099 /home/fedora/rpms/BUILD/syslog-ng-3.4.2/tests/unit/.libs/lt-test_template_speed 00603000-00604000 rw-p 00003000 08:02 1863099 /home/fedora/rpms/BUILD/syslog-ng-3.4.2/tests/unit/.libs/lt-test_template_speed 01f72000-01fb4000 rw-p 00000000 00:00 0 [heap] 3a82a00000-3a82a20000 r-xp 00000000 08:02 828574 /usr/lib64/ld-2.16.so ... 7f43c342c000-7f43c342d000 r--p 0000a000 08:02 1862848 /home/fedora/rpms/BUILDROOT/syslog-ng-3.4.2-0.1.fc18.x86_64/usr/lib64/syslog-ng/libsyslogformat.so 7f43c342d000-7f43c342e000 rw-p 0000b000 08:02 1862848 /home/fedora/rpms/BUILDROOT/syslog-ng-3.4.2-0.1.fc18.x86_64/usr/lib64/syslog-ng/libsyslogformat.so 7f43c342e000-7f43c342f000 rw-p 00000000 00:00 0 7fff57cb7000-7fff57cd8000 rw-p 00000000 00:00 0 [stack] 7fff57cef000-7fff57cf1000 r-xp 00000000 00:00 0 [vdso] ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall] /bin/sh: line 5: 6107 Aborted (core dumped) ${dir}$tst FAIL: test_template_speed ... ---------- -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

4 6

insider 2013-06: syslog-ng 3.4.2 released; PatternDB update; GSoC; RSS destination
by Peter Czanik 13 Jun '13

13 Jun '13

Dear syslog-ng users, This is the 25th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. FEATURED NEWS syslog-ng 3.4.2 is released --------------------------- Last week syslog-ng 3.4.2 was released, the first bugfix release in the 3.4 series. The most important fix is for a hang when suppress() was used. A full list of changes is available in git at: https://github.com/balabit/syslog-ng-3.4/commits/master Sources are available from git or as tgz from http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… For third-party binary packages for various Linux and UNIX platforms, visithttp://www.balabit.com/network-security/syslog-ng/opensource-logging-s… for 3^rd party binary packages for various distributions and UNIX variants. PatternDB git moved and updated ------------------------------- The BalaBit patterndb git moved recently to github. It’s available now at https://github.com/balabit/syslog-ng-patterndb instead of our server. That way the patterns are available next to the syslog-ng sources, and are also faster to download. We have also updated, reorganized and extended the available patterns. For details, read https://czanik.blogs.balabit.com/2013/05/patterndb-git-moved-and-updated/ syslog-ng is participating GSoC again ------------------------------------- Just as last year, syslog-ng is participating in the Google Summer of Code under the umbrella of the openSUSE project. Two of our candidates have the opportunity to code all summer long as GsoC students. Gyula Petrovicswill work on a faster MySQL destination, which works without libdbi. The other student, Tihamér Petrovics, will add a redis destination, which can not only store logs but also provide counters and help with statistics. Related blogs: http://petrovicsgyula.blogspot.com/ http://tichygsoc.blogspot.hu/ RSS destination --------------- RSS destination is a neat little feature of syslog-ng. It can store up to 100 pieces log lines, and can serve them as an Atom feed. This destination works as a FIFO, so if it is full, the last incoming log line kicks out the first one. Now you are able to read the alerts from your machines in your favorite RSS reader (well, unfortunately not in Google Reader). Available at https://github.com/talien/syslog-ng in the feature/rss-destination branch. SHORT NEWS: * Using a low power gadget as syslog-ng server: https://czanik.blogs.balabit.com/2013/05/using-a-low-power- <https://czanik.blogs.balabit.com/2013/05/using-a-low-power-gadget-as-syslog…>gadget-as-syslog-ng-server/ <https://czanik.blogs.balabit.com/2013/05/using-a-low-power-gadget-as-syslog…> Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com <mailto:documentation@balabit.com> To read this newsletter on-line, visit: http://insider.blogs.balabit.com/ -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

How to log message without a timestamp?
by Anton Koldaev 12 Jun '13

12 Jun '13

Is there any way to send a message from syslog-ng via destination(tcp) with no timestamp at all? -- Best regards, Koldaev Anton

2 1

[PATCH (3.5) 0/3]: Catching template syntax errors at config time
by Gergely Nagy 10 Jun '13

10 Jun '13

Following up on the previous patch that added a check to the file() and pipe() destinations, allowing them to catch and report template syntax errors at config time, following this mail are three others, that do similar things to the set() and subst() rewrite functions, to the pair() statement of value-pairs() and to templatable settings in afamqp. These catch these issues: rewrite s_broken { set("$(+ 0", value(MESSAGE)); subst("original", "$(+ 0", value(MESSAGE)); }; destination d_broken { afamqp(body("$(+ 0") routing-key("$(+ 0") value-pairs(pair("INVALID", "$(+ 0"))); }; There are a couple of more cases in the codebase where the same issue is present, namely afsmtp() (the subject, body and header templates), afsql (fields and table name), and perhaps in patterndb too, I have not throughly inspected that one yet. -- |8]

1 3

Building 3.4.1 RPM
by Xuri Nagarin 07 Jun '13

07 Jun '13

I am trying to build a 3.4.1 RPM for CentOS 6. I already built the eventlog RPM and upgraded the one provided by EPEL repo. If I compile straight after untarring the source by running "./configure" (with options same as listed in the SPEC file below) and "make check", the tests runs ok and I get the syslog-ng binaries. But if I build a RPM from the SPEC file below, build fails with the following error. ------- error --------------- Input is not valid utf8, glob match requires utf8 input, thus it never matches in this case; value='\xe1rv\xedzt\xfbr\xf5t\xfck\xf6rf\xfar\xf3g\xe9p' PASS: test_matcher PASS: test_clone_logmsg PASS: test_serialize PASS: test_msgparse PASS: test_template /bin/sh: line 5: 31254 Segmentation fault (core dumped) ${dir}$tst FAIL: test_template_speed One "invalid regular expression" message is to be expected Error compiling regular expression; re='((', error='Unmatched ( or \(' One "invalid regular expressions" message is to be expected Error compiling regular expression; re='((', error='Unmatched ( or \(' WARNING: Your configuration file uses an obsoleted regexp option, please update your configuration; option='(?i)', change='use ignore-case flag instead of (?i)' One "invalid regular expression" message is to be expected Error compiling regular expression; re='((', error='Unmatched ( or \(' One "invalid regular expression" message is to be expected Error while compiling regular expression; regular_expression='((', error_at='', error_offset='2', error_message='missing )', error_code='14' One "invalid regular expressions" message is to be expected Error while compiling regular expression; regular_expression='((', error_at='', error_offset='2', error_message='missing )', error_code='14' One "invalid regular expressions" message is to be expected Invalid regexp flags; re='(?iana' One "invalid regular expressions" message is to be expected Error while compiling regular expression; regular_expression='(?iana', error_at='ana', error_offset='3', error_message='unrecognized character after (? or (?-', error_code='12' One "invalid regular expression" message is to be expected Error while compiling regular expression; regular_expression='((', error_at='', error_offset='2', error_message='missing )', error_code='14' PASS: test_filters DNS cache speed: 6578947.368 iters/sec inet_ntop speed: 1589572.405 iters/sec PASS: test_dnscache PASS: test_findeom PASS: test_findcrlf PASS: test_tags PASS: test_logwriter PASS: test_logproto PASS: test_serialize Failed to open the time zone file; filename='/usr/share/zoneinfo/Factory', message='Failed to open file \'/usr/share/zoneinfo/Factory\': open() failed: No such file or directory' Bogus timezone spec, must be in the format [+-]HH:MM, offset must be less than 24:00; value='Factory' SKIP: Factory PASS: test_zone PASS: test_persist_state PASS: test_value_pairs ==================== 1 of 21 tests failed ==================== make[3]: *** [check-TESTS] Error 1 make[3]: Leaving directory `/home/makerpm/rpmbuild/BUILD/syslog-ng-3.4.1/tests/unit' make[2]: *** [check-am] Error 2 make[2]: Leaving directory `/home/makerpm/rpmbuild/BUILD/syslog-ng-3.4.1/tests/unit' make[1]: *** [check-recursive] Error 1 make[1]: Leaving directory `/home/makerpm/rpmbuild/BUILD/syslog-ng-3.4.1/tests' make: *** [check-recursive] Error 1 error: Bad exit status from /var/tmp/rpm-tmp.izm78V (%check) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.izm78V (%check) ----------------------------xxxxxxxxxxxxx------------------------------------------------------------------------- ---------------syslog-ng.SPEC------------------------------------ %global evtlog_ver 0.2.12 %global _sbindir /sbin %global _libdir /%{_lib} Name: syslog-ng Version: 3.4.1 Release: 1%{?dist} Summary: Next-generation syslog server Group: System Environment/Daemons License: GPLv2+ Url: http://www.balabit.com/network-security/syslog-ng Source0: http://www.balabit.com/downloads/files?path=/syslog-ng/sources/%{version}/s… Source1: syslog-ng.conf Source2: syslog-ng.init.d Source3: syslog-ng.sysconfig Source4: syslog-ng.logrotate #Patch0: syslog-ng-3.2.4-disable-ssl-tests.patch #Patch1: syslog-ng-3.2.5-tests-functional-control.py.patch #Patch2: syslog-ng-3.2.5-tests-functional-sql-test.patch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) BuildRequires: pkgconfig BuildRequires: libtool BuildRequires: eventlog-devel >= %{evtlog_ver} BuildRequires: glib2-devel >= 2.10.1 BuildRequires: libdbi-devel BuildRequires: libnet-devel >= 1.1.4-3 BuildRequires: openssl-devel BuildRequires: pcre-devel >= 6.1 BuildRequires: tcp_wrappers-devel # For the test suite BuildRequires: python # For the SQL tests BuildRequires: libdbi-dbd-sqlite Requires: logrotate Requires(post): /sbin/chkconfig Requires(preun): /sbin/chkconfig Requires(preun): /sbin/service Requires(postun): /sbin/service Provides: syslog # merge separate syslog-vim package into one Provides: syslog-ng-vim = %{version}-%{release} Obsoletes: syslog-ng-vim < 2.0.8-1 %description syslog-ng, as the name shows, is a syslogd replacement, but with new functionality for the new generation. The original syslogd allows messages only to be sorted based on priority/facility pairs; syslog-ng adds the possibility to filter based on message contents using regular expressions. The new configuration scheme is intuitive and powerful. Forwarding logs over TCP and remembering all forwarding hops makes it ideal for firewalled environments. %package libdbi Summary: libdbi support for %{name} Group: Development/Libraries Requires: %{name} = %{version}-%{release} %description libdbi This module supports a large number of database systems via libdbi. %package devel Summary: Development files for %{name} Group: Development/Libraries Requires: %{name} = %{version}-%{release} %description devel The %{name}-devel package contains libraries and header files for developing applications that use %{name}. %prep %setup -q #%patch0 -p1 #%patch1 -p1 #%patch2 -p1 # fix perl path %{__sed} -i 's|^#!/usr/local/bin/perl|#!%{__perl}|' contrib/relogger.pl # fix executable perms on contrib files %{__chmod} -c a-x contrib/syslog2ng # fix authors file /usr/bin/iconv -f iso8859-1 -t utf-8 AUTHORS > AUTHORS.conv && \ %{__mv} -f AUTHORS.conv AUTHORS %build %configure \ --prefix=/ \ --libdir=/%{_lib} \ --includedir=%{_includedir} \ --sysconfdir=%{_sysconfdir}/%{name} \ --localstatedir=%{_sharedstatedir}/%{name} \ --datadir=%{_datadir}/%{name} \ --with-module-dir=/%{_lib}/%{name} \ --enable-ipv6 \ --enable-tcp-wrapper \ --enable-pcre \ --enable-ssl \ --enable-shared \ --disable-static \ --enable-dynamic-linking \ --enable-threads=posix \ --enable-linux-caps # remove rpath sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool make %{_smp_mflags} %install %{__rm} -rf %{buildroot} make DESTDIR=%{buildroot} install #%{__install} -d -m 755 %{buildroot}%{_sysconfdir}/%{name} %{__install} -p -m 644 %{SOURCE1} %{buildroot}%{_sysconfdir}/%{name}/syslog-ng.conf %{__install} -d -m 755 %{buildroot}%{_sysconfdir}/init.d %{__install} -p -m 755 %{SOURCE2} %{buildroot}%{_sysconfdir}/init.d/%{name} %{__install} -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig %{__install} -p -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/sysconfig/%{name} %{__install} -d -m 755 %{buildroot}%{_sysconfdir}/logrotate.d %{__install} -p -m 644 %{SOURCE4} %{buildroot}%{_sysconfdir}/logrotate.d/syslog # create the local state dir %{__install} -d -m 755 %{buildroot}/%{_sharedstatedir}/%{name} # install the main library header files %{__install} -d -m 755 %{buildroot}%{_includedir}/%{name} %{__install} -p -m 644 config.h %{buildroot}%{_includedir}/%{name} %{__install} -p -m 644 lib/*.h %{buildroot}%{_includedir}/%{name} # install vim files %{__install} -d -m 755 %{buildroot}%{_datadir}/%{name} %{__install} -p -m 644 contrib/syslog-ng.vim %{buildroot}%{_datadir}/%{name} for vimver in 70 71 72 73 ; do %{__install} -d -m 755 %{buildroot}%{_datadir}/vim/vim$vimver/syntax cd %{buildroot}%{_datadir}/vim/vim$vimver/syntax ln -s ../../../%{name}/syslog-ng.vim . cd - done find %{buildroot} -name "*.la" -exec rm -f {} \; %check LD_LIBRARY_PATH=%{buildroot}/%{_lib}:%{buildroot}/%{_lib}/%{name} make check %clean rm -rf %{buildroot} %post /sbin/ldconfig /sbin/chkconfig --add %{name} %preun if [ $1 -eq 0 ] ; then # Package removal, not upgrade /sbin/service %{name} stop > /dev/null 2>&1 /sbin/chkconfig --del %{name} fi %postun /sbin/ldconfig if [ $1 -ge 1 ] ; then # Package upgrade, not uninstall /sbin/service %{name} condrestart >/dev/null 2>&1 fi %triggerin -- vim-common VIMVERNEW=`rpm -q --qf='%%{epoch}:%%{version}\n' vim-common | sort | tail -n 1 | sed -e 's/[0-9]*://' | sed -e 's/\.[0-9]*$//' | sed -e 's/\.//'` [ -d %{_datadir}/vim/vim${VIMVERNEW}/syntax ] && \ cd %{_datadir}/vim/vim${VIMVERNEW}/syntax && \ ln -sf ../../../%{name}/syslog-ng.vim . || : %triggerun -- vim-common VIMVEROLD=`rpm -q --qf='%%{epoch}:%%{version}\n' vim-common | sort | head -n 1 | sed -e 's/[0-9]*://' | sed -e 's/\.[0-9]*$//' | sed -e 's/\.//'` [ $2 = 0 ] && rm -f %{_datadir}/vim/vim${VIMVEROLD}/syntax/syslog-ng.vim || : %triggerpostun -- vim-common VIMVEROLD=`rpm -q --qf='%%{epoch}:%%{version}\n' vim-common | sort | head -n 1 | sed -e 's/[0-9]*://' | sed -e 's/\.[0-9]*$//' | sed -e 's/\.//'` VIMVERNEW=`rpm -q --qf='%%{epoch}:%%{version}\n' vim-common | sort | tail -n 1 | sed -e 's/[0-9]*://' | sed -e 's/\.[0-9]*$//' | sed -e 's/\.//'` if [ $1 = 1 ]; then rm -f %{_datadir}/vim/vim${VIMVEROLD}/syntax/syslog-ng.vim || : [ -d %{_datadir}/vim/vim${VIMVERNEW}/syntax ] && \ cd %{_datadir}/vim/vim${VIMVERNEW}/syntax && \ ln -sf ../../../%{name}/syslog-ng.vim . || : fi %files %defattr(-,root,root,-) %doc AUTHORS COPYING README ChangeLog NEWS %doc doc/security/*.txt %doc contrib/{relogger.pl,syslog2ng,syslog-ng.conf.doc} %dir %{_sysconfdir}/%{name} %dir %{_sysconfdir}/%{name}/patterndb.d %config(noreplace) %{_sysconfdir}/%{name}/%{name}.conf %config(noreplace) %{_sysconfdir}/%{name}/modules.conf %config(noreplace) %{_sysconfdir}/%{name}/scl.conf %config(noreplace) %{_sysconfdir}/sysconfig/%{name} %config(noreplace) %{_sysconfdir}/logrotate.d/syslog %{_sysconfdir}/init.d/%{name} %dir %{_sharedstatedir}/%{name} %{_sbindir}/%{name} %{_sbindir}/syslog-ng-ctl %{_bindir}/loggen %{_bindir}/pdbtool %{_bindir}/update-patterndb %{_libdir}/lib%{name}.so.* %{_libdir}/%{name}/*.so %exclude %{_libdir}/%{name}/libafsql.so %dir %{_datadir}/%{name} %{_datadir}/%{name}/syslog-ng.vim %ghost %{_datadir}/vim/ # scl files %{_datadir}/%{name}/include/ # uhm, some better places for those? %{_datadir}/%{name}/xsd/ %{_mandir}/man1/loggen.1* %{_mandir}/man1/pdbtool.1* %{_mandir}/man1/syslog-ng-ctl.1* %{_mandir}/man5/syslog-ng.conf.5* %{_mandir}/man8/syslog-ng.8* %files libdbi %defattr(-,root,root,-) %{_libdir}/%{name}/libafsql.so %files devel %defattr(-,root,root,-) %{_libdir}/libsyslog-ng.so %{_includedir}/%{name}/ %changelog ------------------------------------------------------------------------------------------------------------------------ ----------/var/tmp/rpm-tmp.izm78V-------------------- #!/bin/sh RPM_SOURCE_DIR="/home/makerpm/rpmbuild/SOURCES" RPM_BUILD_DIR="/home/makerpm/rpmbuild/BUILD" RPM_OPT_FLAGS="-O2 -g" RPM_ARCH="x86_64" RPM_OS="linux" export RPM_SOURCE_DIR RPM_BUILD_DIR RPM_OPT_FLAGS RPM_ARCH RPM_OS RPM_DOC_DIR="/usr/share/doc" export RPM_DOC_DIR RPM_PACKAGE_NAME="syslog-ng" RPM_PACKAGE_VERSION="3.4.1" RPM_PACKAGE_RELEASE="1.el6" export RPM_PACKAGE_NAME RPM_PACKAGE_VERSION RPM_PACKAGE_RELEASE LANG=C export LANG unset CDPATH DISPLAY ||: RPM_BUILD_ROOT="/home/makerpm/rpmbuild/BUILDROOT/syslog-ng-3.4.1-1.el6.x86_64" export RPM_BUILD_ROOT PKG_CONFIG_PATH="/lib64/pkgconfig:/usr/share/pkgconfig" export PKG_CONFIG_PATH set -x umask 022 cd "/home/makerpm/rpmbuild/BUILD" cd 'syslog-ng-3.4.1' LD_LIBRARY_PATH=/home/makerpm/rpmbuild/BUILDROOT/syslog-ng-3.4.1-3.el6.x86_64/lib64:/makerpm/rpmbuild/BUILDROOT/syslog-ng-3.4.1-3.el6.x86_64/lib64/syslog-ng make check exit 0 -------------------------------------------------------------------------------------

2 1

Reaping unused destination files
by Jordi Prats 06 Jun '13

06 Jun '13

Hi, After updating to syslog-ng 3.2, I'm no longer getting any logs. It reports some destinations as unused: May 23 17:09:16 borg syslog-ng[27957]: Reaping unused destination files; template='/var/log/firewalls/$YEAR/$MONTH/$DAY/$HOST.log' May 23 17:09:16 borg syslog-ng[27957]: Reaping unused destination files; template='/var/log/troncal/$YEAR/$MONTH/$DAY/$SOURCEIP.log' May 23 17:09:16 borg syslog-ng[27957]: Reaping unused destination files; template='/var/log/remote/$HOST/$YEAR/$MONTH/$DAY/$PROGRAM/$FACILITY' But I have no clue why, as this configuration was working on another system (I'm pretty sure it was an older version, but I can't tell which exactly) My config is as follows: options { time_reopen (10); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); sync (5000); time_reap(5); log_fifo_size (536870912); stats_freq(60); flush_lines(500); flush_timeout(10000); }; source remote_tcp { tcp(port(514) keep-alive(no)); }; source remote_default { udp(ip(192.168.1.1) port(514)); }; source remote_servers { udp(ip(192.168.1.2) port(514)); }; source firewalls { udp(port(1515)); }; source troncal { udp(ip(192.168.1.3) port(514)); }; destination hosts { file("/var/log/remote/$HOST/$YEAR/$MONTH/$DAY/$PROGRAM/$FACILITY" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); }; destination firewalls { file("/var/log/firewalls/$YEAR/$MONTH/$DAY/$HOST.log" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); }; destination troncal { file("/var/log/troncal/$YEAR/$MONTH/$DAY/$SOURCEIP.log" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); }; log { source(remote_default); source(remote_servers); destination(hosts); }; log { source(firewalls); destination(firewalls); }; log { source(troncal); destination(troncal); }; Anyone can help me out? Thank you! -- Jordi

2 1

syslog-ng 3.4.2 has been released
by devel＠balabit.hu 06 Jun '13

06 Jun '13

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.4.2 SUMMARY : new stable release DATE : Jun 3, 2013 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.4.2) has been released. For latest fixes in the 3.4.x feature branch you are recommended to upgrade to this version. CHANGES: 3.4.2 Mon, 3 Jun 2013 16:00:00 +0100 This is the first bug-fix release for the 3.4.x series, collecting significant fixes over the 3.4.1 release. Upgrading to this release is highly recommended. Bugfixes ======== * loggen will bail out earily if using Unix sockets without a path specified. * Using the same filter for multiple destinations does not trigger a crash anymore. [#219] * An issue with log branch propagation has been fixed, restoring compatibility with the 3.3 branch (this mostly affected flags(final) use cases). [#220] * The systemd unit file now specified Restart=on-failure. [#222] * Support for empty blocks in the configuration were restored, syslog-ng does not crash anymore when encountering one. * An assertion was fixed in patterndb, that prevented one from overriding built-in values, such as HOST. [#225] * The persist state file (syslog-ng.persist) is now marked close-on-exec, so it does not leak through to forked subprocesses. * The system() source now treats /proc/kmsg as optional: if it is not readable to the user running syslog-ng, it will not be included. * Proper escape handling in backtick insertion has been implemented, so string arguments to block parameters are - again - treated correctly. [#235] * A rare race condition in the SQL, MongoDB, SMTP and AMQP destinations have been fixed. * A possible deadlock was fixed within the suppress() handling code. Credits ======= Attila M. Magyar <athos(a)balabit.hu> Balazs Scheidler <bazsi(a)balabit.hu> Evan Rempel <erempel(a)uvic.ca> Gergely Nagy <algernon(a)balabit.hu> Paul Dann <pdgiddie+balabit(a)gmail.com> Peter Czanik <czanik(a)balabit.hu> Tamas Pal <folti(a)balabit.hu> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

5 6

syslog-ng consumes a lot of cpu
by C. L. Martinez 04 Jun '13

04 Jun '13

HI all, I have installed syslog-ng 3.3.8 under an OpenBSD with a simple configuration: @version: 3.3 options { log_fifo_size(30000); use_dns (no); use_fqdn (no); keep_hostname (yes); }; # Define what files to be monitored source s_network { tcp(port(10514) flags(no-multi-line)); }; # Define filters # Define default destinations destination d_ossec_fifo { pipe("/var/log/syslog.fifo"); }; # # Default log actions # log { source(s_network); log { destination(d_ossec_fifo); flags(flow-control,final); }; }; but it is consuming a lot of CPU: load averages: 1.13, 1.09, 1.08 obsdhost 11:17:49 25 processes: 1 running, 23 idle, 1 on processor CPU states: 0.8% user, 0.0% nice, 3.5% system, 0.0% interrupt, 95.7% idle Memory: Real: 29M/356M act/tot Free: 2655M Cache: 297M Swap: 0K/3067M PID USERNAME PRI NICE SIZE RES STATE WAIT TIME CPU COMMAND 30813 root 64 0 1260K 4204K run - 60:49 99.02% syslog-ng Any idea why??

2 3