- syslog-ng - lists.balabit.hu

[PATCH (3.5) 0/3]: Catching template syntax errors at config time
by Gergely Nagy 10 Jun '13

10 Jun '13

Following up on the previous patch that added a check to the file() and pipe() destinations, allowing them to catch and report template syntax errors at config time, following this mail are three others, that do similar things to the set() and subst() rewrite functions, to the pair() statement of value-pairs() and to templatable settings in afamqp. These catch these issues: rewrite s_broken { set("$(+ 0", value(MESSAGE)); subst("original", "$(+ 0", value(MESSAGE)); }; destination d_broken { afamqp(body("$(+ 0") routing-key("$(+ 0") value-pairs(pair("INVALID", "$(+ 0"))); }; There are a couple of more cases in the codebase where the same issue is present, namely afsmtp() (the subject, body and header templates), afsql (fields and table name), and perhaps in patterndb too, I have not throughly inspected that one yet. -- |8]

1 3

Building 3.4.1 RPM
by Xuri Nagarin 07 Jun '13

07 Jun '13

I am trying to build a 3.4.1 RPM for CentOS 6. I already built the eventlog RPM and upgraded the one provided by EPEL repo. If I compile straight after untarring the source by running "./configure" (with options same as listed in the SPEC file below) and "make check", the tests runs ok and I get the syslog-ng binaries. But if I build a RPM from the SPEC file below, build fails with the following error. ------- error --------------- Input is not valid utf8, glob match requires utf8 input, thus it never matches in this case; value='\xe1rv\xedzt\xfbr\xf5t\xfck\xf6rf\xfar\xf3g\xe9p' PASS: test_matcher PASS: test_clone_logmsg PASS: test_serialize PASS: test_msgparse PASS: test_template /bin/sh: line 5: 31254 Segmentation fault (core dumped) ${dir}$tst FAIL: test_template_speed One "invalid regular expression" message is to be expected Error compiling regular expression; re='((', error='Unmatched ( or \(' One "invalid regular expressions" message is to be expected Error compiling regular expression; re='((', error='Unmatched ( or \(' WARNING: Your configuration file uses an obsoleted regexp option, please update your configuration; option='(?i)', change='use ignore-case flag instead of (?i)' One "invalid regular expression" message is to be expected Error compiling regular expression; re='((', error='Unmatched ( or \(' One "invalid regular expression" message is to be expected Error while compiling regular expression; regular_expression='((', error_at='', error_offset='2', error_message='missing )', error_code='14' One "invalid regular expressions" message is to be expected Error while compiling regular expression; regular_expression='((', error_at='', error_offset='2', error_message='missing )', error_code='14' One "invalid regular expressions" message is to be expected Invalid regexp flags; re='(?iana' One "invalid regular expressions" message is to be expected Error while compiling regular expression; regular_expression='(?iana', error_at='ana', error_offset='3', error_message='unrecognized character after (? or (?-', error_code='12' One "invalid regular expression" message is to be expected Error while compiling regular expression; regular_expression='((', error_at='', error_offset='2', error_message='missing )', error_code='14' PASS: test_filters DNS cache speed: 6578947.368 iters/sec inet_ntop speed: 1589572.405 iters/sec PASS: test_dnscache PASS: test_findeom PASS: test_findcrlf PASS: test_tags PASS: test_logwriter PASS: test_logproto PASS: test_serialize Failed to open the time zone file; filename='/usr/share/zoneinfo/Factory', message='Failed to open file \'/usr/share/zoneinfo/Factory\': open() failed: No such file or directory' Bogus timezone spec, must be in the format [+-]HH:MM, offset must be less than 24:00; value='Factory' SKIP: Factory PASS: test_zone PASS: test_persist_state PASS: test_value_pairs ==================== 1 of 21 tests failed ==================== make[3]: *** [check-TESTS] Error 1 make[3]: Leaving directory `/home/makerpm/rpmbuild/BUILD/syslog-ng-3.4.1/tests/unit' make[2]: *** [check-am] Error 2 make[2]: Leaving directory `/home/makerpm/rpmbuild/BUILD/syslog-ng-3.4.1/tests/unit' make[1]: *** [check-recursive] Error 1 make[1]: Leaving directory `/home/makerpm/rpmbuild/BUILD/syslog-ng-3.4.1/tests' make: *** [check-recursive] Error 1 error: Bad exit status from /var/tmp/rpm-tmp.izm78V (%check) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.izm78V (%check) ----------------------------xxxxxxxxxxxxx------------------------------------------------------------------------- ---------------syslog-ng.SPEC------------------------------------ %global evtlog_ver 0.2.12 %global _sbindir /sbin %global _libdir /%{_lib} Name: syslog-ng Version: 3.4.1 Release: 1%{?dist} Summary: Next-generation syslog server Group: System Environment/Daemons License: GPLv2+ Url: http://www.balabit.com/network-security/syslog-ng Source0: http://www.balabit.com/downloads/files?path=/syslog-ng/sources/%{version}/s… Source1: syslog-ng.conf Source2: syslog-ng.init.d Source3: syslog-ng.sysconfig Source4: syslog-ng.logrotate #Patch0: syslog-ng-3.2.4-disable-ssl-tests.patch #Patch1: syslog-ng-3.2.5-tests-functional-control.py.patch #Patch2: syslog-ng-3.2.5-tests-functional-sql-test.patch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) BuildRequires: pkgconfig BuildRequires: libtool BuildRequires: eventlog-devel >= %{evtlog_ver} BuildRequires: glib2-devel >= 2.10.1 BuildRequires: libdbi-devel BuildRequires: libnet-devel >= 1.1.4-3 BuildRequires: openssl-devel BuildRequires: pcre-devel >= 6.1 BuildRequires: tcp_wrappers-devel # For the test suite BuildRequires: python # For the SQL tests BuildRequires: libdbi-dbd-sqlite Requires: logrotate Requires(post): /sbin/chkconfig Requires(preun): /sbin/chkconfig Requires(preun): /sbin/service Requires(postun): /sbin/service Provides: syslog # merge separate syslog-vim package into one Provides: syslog-ng-vim = %{version}-%{release} Obsoletes: syslog-ng-vim < 2.0.8-1 %description syslog-ng, as the name shows, is a syslogd replacement, but with new functionality for the new generation. The original syslogd allows messages only to be sorted based on priority/facility pairs; syslog-ng adds the possibility to filter based on message contents using regular expressions. The new configuration scheme is intuitive and powerful. Forwarding logs over TCP and remembering all forwarding hops makes it ideal for firewalled environments. %package libdbi Summary: libdbi support for %{name} Group: Development/Libraries Requires: %{name} = %{version}-%{release} %description libdbi This module supports a large number of database systems via libdbi. %package devel Summary: Development files for %{name} Group: Development/Libraries Requires: %{name} = %{version}-%{release} %description devel The %{name}-devel package contains libraries and header files for developing applications that use %{name}. %prep %setup -q #%patch0 -p1 #%patch1 -p1 #%patch2 -p1 # fix perl path %{__sed} -i 's|^#!/usr/local/bin/perl|#!%{__perl}|' contrib/relogger.pl # fix executable perms on contrib files %{__chmod} -c a-x contrib/syslog2ng # fix authors file /usr/bin/iconv -f iso8859-1 -t utf-8 AUTHORS > AUTHORS.conv && \ %{__mv} -f AUTHORS.conv AUTHORS %build %configure \ --prefix=/ \ --libdir=/%{_lib} \ --includedir=%{_includedir} \ --sysconfdir=%{_sysconfdir}/%{name} \ --localstatedir=%{_sharedstatedir}/%{name} \ --datadir=%{_datadir}/%{name} \ --with-module-dir=/%{_lib}/%{name} \ --enable-ipv6 \ --enable-tcp-wrapper \ --enable-pcre \ --enable-ssl \ --enable-shared \ --disable-static \ --enable-dynamic-linking \ --enable-threads=posix \ --enable-linux-caps # remove rpath sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool make %{_smp_mflags} %install %{__rm} -rf %{buildroot} make DESTDIR=%{buildroot} install #%{__install} -d -m 755 %{buildroot}%{_sysconfdir}/%{name} %{__install} -p -m 644 %{SOURCE1} %{buildroot}%{_sysconfdir}/%{name}/syslog-ng.conf %{__install} -d -m 755 %{buildroot}%{_sysconfdir}/init.d %{__install} -p -m 755 %{SOURCE2} %{buildroot}%{_sysconfdir}/init.d/%{name} %{__install} -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig %{__install} -p -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/sysconfig/%{name} %{__install} -d -m 755 %{buildroot}%{_sysconfdir}/logrotate.d %{__install} -p -m 644 %{SOURCE4} %{buildroot}%{_sysconfdir}/logrotate.d/syslog # create the local state dir %{__install} -d -m 755 %{buildroot}/%{_sharedstatedir}/%{name} # install the main library header files %{__install} -d -m 755 %{buildroot}%{_includedir}/%{name} %{__install} -p -m 644 config.h %{buildroot}%{_includedir}/%{name} %{__install} -p -m 644 lib/*.h %{buildroot}%{_includedir}/%{name} # install vim files %{__install} -d -m 755 %{buildroot}%{_datadir}/%{name} %{__install} -p -m 644 contrib/syslog-ng.vim %{buildroot}%{_datadir}/%{name} for vimver in 70 71 72 73 ; do %{__install} -d -m 755 %{buildroot}%{_datadir}/vim/vim$vimver/syntax cd %{buildroot}%{_datadir}/vim/vim$vimver/syntax ln -s ../../../%{name}/syslog-ng.vim . cd - done find %{buildroot} -name "*.la" -exec rm -f {} \; %check LD_LIBRARY_PATH=%{buildroot}/%{_lib}:%{buildroot}/%{_lib}/%{name} make check %clean rm -rf %{buildroot} %post /sbin/ldconfig /sbin/chkconfig --add %{name} %preun if [ $1 -eq 0 ] ; then # Package removal, not upgrade /sbin/service %{name} stop > /dev/null 2>&1 /sbin/chkconfig --del %{name} fi %postun /sbin/ldconfig if [ $1 -ge 1 ] ; then # Package upgrade, not uninstall /sbin/service %{name} condrestart >/dev/null 2>&1 fi %triggerin -- vim-common VIMVERNEW=`rpm -q --qf='%%{epoch}:%%{version}\n' vim-common | sort | tail -n 1 | sed -e 's/[0-9]*://' | sed -e 's/\.[0-9]*$//' | sed -e 's/\.//'` [ -d %{_datadir}/vim/vim${VIMVERNEW}/syntax ] && \ cd %{_datadir}/vim/vim${VIMVERNEW}/syntax && \ ln -sf ../../../%{name}/syslog-ng.vim . || : %triggerun -- vim-common VIMVEROLD=`rpm -q --qf='%%{epoch}:%%{version}\n' vim-common | sort | head -n 1 | sed -e 's/[0-9]*://' | sed -e 's/\.[0-9]*$//' | sed -e 's/\.//'` [ $2 = 0 ] && rm -f %{_datadir}/vim/vim${VIMVEROLD}/syntax/syslog-ng.vim || : %triggerpostun -- vim-common VIMVEROLD=`rpm -q --qf='%%{epoch}:%%{version}\n' vim-common | sort | head -n 1 | sed -e 's/[0-9]*://' | sed -e 's/\.[0-9]*$//' | sed -e 's/\.//'` VIMVERNEW=`rpm -q --qf='%%{epoch}:%%{version}\n' vim-common | sort | tail -n 1 | sed -e 's/[0-9]*://' | sed -e 's/\.[0-9]*$//' | sed -e 's/\.//'` if [ $1 = 1 ]; then rm -f %{_datadir}/vim/vim${VIMVEROLD}/syntax/syslog-ng.vim || : [ -d %{_datadir}/vim/vim${VIMVERNEW}/syntax ] && \ cd %{_datadir}/vim/vim${VIMVERNEW}/syntax && \ ln -sf ../../../%{name}/syslog-ng.vim . || : fi %files %defattr(-,root,root,-) %doc AUTHORS COPYING README ChangeLog NEWS %doc doc/security/*.txt %doc contrib/{relogger.pl,syslog2ng,syslog-ng.conf.doc} %dir %{_sysconfdir}/%{name} %dir %{_sysconfdir}/%{name}/patterndb.d %config(noreplace) %{_sysconfdir}/%{name}/%{name}.conf %config(noreplace) %{_sysconfdir}/%{name}/modules.conf %config(noreplace) %{_sysconfdir}/%{name}/scl.conf %config(noreplace) %{_sysconfdir}/sysconfig/%{name} %config(noreplace) %{_sysconfdir}/logrotate.d/syslog %{_sysconfdir}/init.d/%{name} %dir %{_sharedstatedir}/%{name} %{_sbindir}/%{name} %{_sbindir}/syslog-ng-ctl %{_bindir}/loggen %{_bindir}/pdbtool %{_bindir}/update-patterndb %{_libdir}/lib%{name}.so.* %{_libdir}/%{name}/*.so %exclude %{_libdir}/%{name}/libafsql.so %dir %{_datadir}/%{name} %{_datadir}/%{name}/syslog-ng.vim %ghost %{_datadir}/vim/ # scl files %{_datadir}/%{name}/include/ # uhm, some better places for those? %{_datadir}/%{name}/xsd/ %{_mandir}/man1/loggen.1* %{_mandir}/man1/pdbtool.1* %{_mandir}/man1/syslog-ng-ctl.1* %{_mandir}/man5/syslog-ng.conf.5* %{_mandir}/man8/syslog-ng.8* %files libdbi %defattr(-,root,root,-) %{_libdir}/%{name}/libafsql.so %files devel %defattr(-,root,root,-) %{_libdir}/libsyslog-ng.so %{_includedir}/%{name}/ %changelog ------------------------------------------------------------------------------------------------------------------------ ----------/var/tmp/rpm-tmp.izm78V-------------------- #!/bin/sh RPM_SOURCE_DIR="/home/makerpm/rpmbuild/SOURCES" RPM_BUILD_DIR="/home/makerpm/rpmbuild/BUILD" RPM_OPT_FLAGS="-O2 -g" RPM_ARCH="x86_64" RPM_OS="linux" export RPM_SOURCE_DIR RPM_BUILD_DIR RPM_OPT_FLAGS RPM_ARCH RPM_OS RPM_DOC_DIR="/usr/share/doc" export RPM_DOC_DIR RPM_PACKAGE_NAME="syslog-ng" RPM_PACKAGE_VERSION="3.4.1" RPM_PACKAGE_RELEASE="1.el6" export RPM_PACKAGE_NAME RPM_PACKAGE_VERSION RPM_PACKAGE_RELEASE LANG=C export LANG unset CDPATH DISPLAY ||: RPM_BUILD_ROOT="/home/makerpm/rpmbuild/BUILDROOT/syslog-ng-3.4.1-1.el6.x86_64" export RPM_BUILD_ROOT PKG_CONFIG_PATH="/lib64/pkgconfig:/usr/share/pkgconfig" export PKG_CONFIG_PATH set -x umask 022 cd "/home/makerpm/rpmbuild/BUILD" cd 'syslog-ng-3.4.1' LD_LIBRARY_PATH=/home/makerpm/rpmbuild/BUILDROOT/syslog-ng-3.4.1-3.el6.x86_64/lib64:/makerpm/rpmbuild/BUILDROOT/syslog-ng-3.4.1-3.el6.x86_64/lib64/syslog-ng make check exit 0 -------------------------------------------------------------------------------------

2 1

Reaping unused destination files
by Jordi Prats 06 Jun '13

06 Jun '13

Hi, After updating to syslog-ng 3.2, I'm no longer getting any logs. It reports some destinations as unused: May 23 17:09:16 borg syslog-ng[27957]: Reaping unused destination files; template='/var/log/firewalls/$YEAR/$MONTH/$DAY/$HOST.log' May 23 17:09:16 borg syslog-ng[27957]: Reaping unused destination files; template='/var/log/troncal/$YEAR/$MONTH/$DAY/$SOURCEIP.log' May 23 17:09:16 borg syslog-ng[27957]: Reaping unused destination files; template='/var/log/remote/$HOST/$YEAR/$MONTH/$DAY/$PROGRAM/$FACILITY' But I have no clue why, as this configuration was working on another system (I'm pretty sure it was an older version, but I can't tell which exactly) My config is as follows: options { time_reopen (10); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); sync (5000); time_reap(5); log_fifo_size (536870912); stats_freq(60); flush_lines(500); flush_timeout(10000); }; source remote_tcp { tcp(port(514) keep-alive(no)); }; source remote_default { udp(ip(192.168.1.1) port(514)); }; source remote_servers { udp(ip(192.168.1.2) port(514)); }; source firewalls { udp(port(1515)); }; source troncal { udp(ip(192.168.1.3) port(514)); }; destination hosts { file("/var/log/remote/$HOST/$YEAR/$MONTH/$DAY/$PROGRAM/$FACILITY" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); }; destination firewalls { file("/var/log/firewalls/$YEAR/$MONTH/$DAY/$HOST.log" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); }; destination troncal { file("/var/log/troncal/$YEAR/$MONTH/$DAY/$SOURCEIP.log" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); }; log { source(remote_default); source(remote_servers); destination(hosts); }; log { source(firewalls); destination(firewalls); }; log { source(troncal); destination(troncal); }; Anyone can help me out? Thank you! -- Jordi

2 1

syslog-ng 3.4.2 has been released
by devel＠balabit.hu 06 Jun '13

06 Jun '13

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.4.2 SUMMARY : new stable release DATE : Jun 3, 2013 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.4.2) has been released. For latest fixes in the 3.4.x feature branch you are recommended to upgrade to this version. CHANGES: 3.4.2 Mon, 3 Jun 2013 16:00:00 +0100 This is the first bug-fix release for the 3.4.x series, collecting significant fixes over the 3.4.1 release. Upgrading to this release is highly recommended. Bugfixes ======== * loggen will bail out earily if using Unix sockets without a path specified. * Using the same filter for multiple destinations does not trigger a crash anymore. [#219] * An issue with log branch propagation has been fixed, restoring compatibility with the 3.3 branch (this mostly affected flags(final) use cases). [#220] * The systemd unit file now specified Restart=on-failure. [#222] * Support for empty blocks in the configuration were restored, syslog-ng does not crash anymore when encountering one. * An assertion was fixed in patterndb, that prevented one from overriding built-in values, such as HOST. [#225] * The persist state file (syslog-ng.persist) is now marked close-on-exec, so it does not leak through to forked subprocesses. * The system() source now treats /proc/kmsg as optional: if it is not readable to the user running syslog-ng, it will not be included. * Proper escape handling in backtick insertion has been implemented, so string arguments to block parameters are - again - treated correctly. [#235] * A rare race condition in the SQL, MongoDB, SMTP and AMQP destinations have been fixed. * A possible deadlock was fixed within the suppress() handling code. Credits ======= Attila M. Magyar <athos(a)balabit.hu> Balazs Scheidler <bazsi(a)balabit.hu> Evan Rempel <erempel(a)uvic.ca> Gergely Nagy <algernon(a)balabit.hu> Paul Dann <pdgiddie+balabit(a)gmail.com> Peter Czanik <czanik(a)balabit.hu> Tamas Pal <folti(a)balabit.hu> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

5 6

syslog-ng consumes a lot of cpu
by C. L. Martinez 04 Jun '13

04 Jun '13

HI all, I have installed syslog-ng 3.3.8 under an OpenBSD with a simple configuration: @version: 3.3 options { log_fifo_size(30000); use_dns (no); use_fqdn (no); keep_hostname (yes); }; # Define what files to be monitored source s_network { tcp(port(10514) flags(no-multi-line)); }; # Define filters # Define default destinations destination d_ossec_fifo { pipe("/var/log/syslog.fifo"); }; # # Default log actions # log { source(s_network); log { destination(d_ossec_fifo); flags(flow-control,final); }; }; but it is consuming a lot of CPU: load averages: 1.13, 1.09, 1.08 obsdhost 11:17:49 25 processes: 1 running, 23 idle, 1 on processor CPU states: 0.8% user, 0.0% nice, 3.5% system, 0.0% interrupt, 95.7% idle Memory: Real: 29M/356M act/tot Free: 2655M Cache: 297M Swap: 0K/3067M PID USERNAME PRI NICE SIZE RES STATE WAIT TIME CPU COMMAND 30813 root 64 0 1260K 4204K run - 60:49 99.02% syslog-ng Any idea why??

2 3

TCP packet collapse errors
by Xuri Nagarin 04 Jun '13

04 Jun '13

I have a pair of Syslog-NG servers running 3.2.5-3. The hardware specs are - Quad Xeon E5-2680 (32 cores), 32GB RAM, and two 1TB SAS 7200 RPM disks in RAID-1. OS is RHEL6.2 - Kernel 2.6.32-279.5.2. Filesystem is ext3. Global options are set as: options { flush_lines (1000); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); keep_timestamp(yes); dir_group("syslog"); perm(0640); dir_perm(0750); group("syslog"); }; I have already set TCP kernel buffers to 128MB max and set disk scheduler to "deadline". But even under light disk IO load, from ~8-25MB, I see "1320811067 packets collapsed in receive queue due to low socket buffer". I had some other processes on the host writing to disk. Stopping them reduced the packet errors but this number still keeps incrementing. To rule out other issues, I temporarily pointed my disk-based destinations to /dev/null and then packet losses/errors stopped. So either Syslog-NG isn't able to write to disk fast enough or there is an underlying OS/hardware issue. Both hosts have the same issue. Any pointers in troubleshooting it will be appreciated. TIA.

2 8

syslog-ng 3.3.10 has been released
by devel＠balabit.hu 03 Jun '13

03 Jun '13

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.3.10 SUMMARY : new stable release DATE : Jun 3, 2013 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.3.10) has been released. For latest fixes in the 3.3.x feature branch you are recommended to upgrade to this version. CHANGES: 3.3.10 Mon, 3 Jun 2013 16:00:00 +0100 Highlights ========== This release is a bug-fix release, correcting a handful of issues discovered since the previous one. Bugfixes ======== * The persist state file (syslog-ng.persist) is now marked close-on-exec, so it does not leak through to forked subprocesses. * A rare race condition in the SQL and MongoDB destinations have been fixed. Credits ======= syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Attila M. Magyar <athos(a)balabit.hu> Balazs Scheidler <bazsi(a)balabit.hu> Evan Rempel <erempel(a)uvic.ca> Gergely Nagy <algernon(a)balabit.hu> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

[Bug 236] New: syslog-ng loses part of kernel log and replaces it with \0 characters
by bugzilla＠bugzilla.balabit.com 03 Jun '13

03 Jun '13

https://bugzilla.balabit.com/show_bug.cgi?id=236 Summary: syslog-ng loses part of kernel log and replaces it with \0 characters Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: kroz.nn(a)gmail.com Type of the Report: bug Estimated Hours: 0.0 1. syslog-ng with default configuration inserts characters with code 0 into /var/log/messages (2nd line, beginning of kernel log / dmesg). Comparison with output of dmesg has shown, that no log records lost, just characters inserted. 2. syslog-ng with more complicated configuration inserts two batches of \0 characters (2nd line and 12th line). Second batch of characters replaces 118 lines of kernel log (comparing with log of default configuration and dmesg) OS: Gentoo Linux Attachments: - For each of scenario 1 and scenario 2: configuration file, relevant parts of /var/log/messages - Gentoo compilation environment (output of `emerge --info` ) - Beginning of syslog-ng compilation log (configure stage) Syslog-ng version: syslog-ng 3.4.1 Installer-Version: 3.4.1 Revision: ssh+git://algernon@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.4#master-3.4#dea0b2a11bffe1877ec10d29279fbb0f635d70e7 Compile-Date: Jun 2 2013 12:23:49 Available-Modules: syslogformat,dbparser,afsocket-notls,afuser,afamqp,basicfuncs,cryptofuncs,afsocket-tls,afprog,afsocket,system-source,confgen,affile,csvparser Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: on Enable-Linux-Caps: on Enable-Pcre: on -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 9

problems compiling OSE 3.4.1 on redhat enterprise 6.4
by Russell Fulton 01 Jun '13

01 Jun '13

make[4]: Entering directory `/home/rful011/syslog-ng-3.4.1/modules/afsocket' /bin/sh ../../libtool --tag=CC --mode=compile gcc -std=gnu99 -DHAVE_CONFIG_H -I. -I../.. -I../../lib -I../../lib -pthread -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/usr/local/include/eventlog -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -I../../lib/ivykis/src/include -I../../lib/ivykis/src/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -pthread -MT libafsocket_notls_la-afinet-dest.lo -MD -MP -MF .deps/libafsocket_notls_la-afinet-dest.Tpo -c -o libafsocket_notls_la-afinet-dest.lo `test -f 'afinet-dest.c' || echo './'`afinet-dest.c libtool: compile: gcc -std=gnu99 -DHAVE_CONFIG_H -I. -I../.. -I../../lib -I../../lib -pthread -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/usr/local/include/eventlog -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -I../../lib/ivykis/src/include -I../../lib/ivykis/src/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -pthread -MT libafsocket_notls_la-afinet-dest.lo -MD -MP -MF .deps/libafsocket_notls_la-afinet-dest.Tpo -c afinet-dest.c -fPIC -DPIC -o .libs/libafsocket_notls_la-afinet-dest.o In file included from /usr/include/net/ethernet.h:27, from /usr/include/libnet.h:98, from afinet-dest.c:43: when I first encountered this error I went and did some googling and followed some vague leads to install a bunch of -devel packages (most of which were already installed ) but it did not make any difference. Googling the message brings up a bunch of hits for both redhat and debian families and a range of packages. There did not seem to be any common cause. Russell

4 7

PatternDB git moved and updated
by Peter Czanik 31 May '13

31 May '13

Hello, The BalaBit patterndb git moved recently to github. It’s available now at https://github.com/balabit/syslog-ng-patterndb instead of our server. The main advantage of this is the access speed and that patterns are now available next to the syslog-ng sources. Patterns were not only moved, but also updated, reorganized and extended. You can read more about what is changed at https://czanik.blogs.balabit.com/2013/05/patterndb-git-moved-and-updated/ Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0