- syslog-ng - lists.balabit.hu

syslog 3.3.7 ivykis library error... HPUX 11.23 ia64
by Rakesh Rajasekharan 19 Feb '13

19 Feb '13

I have compiled the syslog-ng 3.3.7 on HPUX ia64 machine using dynamic linking option... but, while trying to run the binary i get the below error, # /opt/soe/local/syslog-ng-3.3.7/sbin/syslog-ng /usr/lib/hpux32/dld.so: Unable to find library 'libivykis.so.3'. Killed I have even tried --with-ivykis=system in the configure... but the error does not disappear. # ldd /opt/soe/local/syslog-ng-3.3.7/sbin/syslog-ng libpthread.so.1 => /usr/lib/hpux32/libpthread.so.1 libcl.so.1 => /usr/lib/hpux32/libcl.so.1 libc.so.1 => /usr/lib/hpux32/libc.so.1 libIO77.so.1 => /usr/lib/hpux32/libIO77.so.1 libunwind.so.1 => /usr/lib/hpux32/libunwind.so.1 libdl.so.1 => /usr/lib/hpux32/libdl.so.1 libuca.so.1 => /usr/lib/hpux32/libuca.so.1 Any suggestions on this please... Thanks, Rakesh.

2 4

[Bug 222] New: systemd unit file should set Restart
by bugzilla＠bugzilla.balabit.com 18 Feb '13

18 Feb '13

https://bugzilla.balabit.com/show_bug.cgi?id=222 Summary: systemd unit file should set Restart Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: pdgiddie+balabit(a)gmail.com Type of the Report: enhancement Estimated Hours: 0.0 To mitigate unforeseen crashes, the systemd unit file should set Restart. This will cause systemd to relaunch the service if it crashes. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 7

[PATCH 0/4]: Template type hinting, request for review
by Gergely Nagy 17 Feb '13

17 Feb '13

The patches that will come soon after this one implement template type hinting support for syslog-ng. These things allow us to tell the various destination drivers what type a particular template should be casted to. One can use this to store dates in MongoDB as datetime objects, or the PID as integer, and so on and so forth. The syntax is simple: template(type("template-string")) Where 'type' can be 'boolean', 'string', 'int32', 'int64', 'datetime' or 'literal' as of this writing. Not all drivers implement all of them, of course, but they implement the relevant ones. The infrastructure makes it possible to control what should happen when a type cast does not succeed: we can either drop the message (the default), drop that particular property, or fall back to string. We can do either of these silently, or by emitting a warning first. This is configurable with a global option only at the moment, but there are plans to make it possible to override the global setting on a per-template or per-driver level. A few examples on usage: template t_json { template("$(format-json PID=int32($PID) MESSAGE DATE)\n") }; destination d_mongodb { mongodb( value-pairs(pair("PID", int32("$PID")) pair("TIMESTAMP", datetime("$R_UNIXTIME"))) ); }; I'm reasonably happy with the code, at least for now. I plan to improve upon it within the scope of 3.5, but this is at a stage that I consider very close to merge ready.

2 6

[Bug 221] New: syslog-ng 2.1.4 on rhel 5.8
by bugzilla＠bugzilla.balabit.com 15 Feb '13

15 Feb '13

https://bugzilla.balabit.com/show_bug.cgi?id=221 Summary: syslog-ng 2.1.4 on rhel 5.8 Product: syslog-ng Version: 2.1.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jk_kathi1(a)yahoo.com Type of the Report: --- Estimated Hours: 0.0 Red Hat Enterprise Linux Server release 5.8 (Tikanga) Syslog-ng version : syslog-ng-2.1.4-9.el5 Library installed : libnet-1.1.5-1.el5 /etc/syslog-ng/syslog-ng.conf file settings options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); # udp(ip(0.0.0.0) port(514)); }; source s_file { file("/opt/CA/siteminder/log/smps.log"); }; destination d_file { file("/var/log/messages"); }; destination d_remote_q1 { udp("x.x.x.x" port(514)); }; log { source(s_sys); destination(d_file); }; log { source(s_file); destination(d_file); destination(d_remote_q1); }; Syslog-ng executes fine , able to record all the OS logs . When i start syslog-ng the first time it polls the smps.log and forwards all the entries from that file to remote server , but after that any new events getting logged does not get processed even when syslog-ng is running in the background. The issue is syslog-ng is not able to monitor the App log smps.log in real time . This happens only for the app log , normal OS events gets processes immediately Tried logging a simple mesage using logger I did try running syslog-ng in debug mode , these are the results /sbin/syslog-ng -Fedv Syslog connection established; from='AF_INET(0.0.0.0:0)', to='AF_INET(x.x.x.x:514)' Running application hooks; hook='1' syslog-ng starting up; version='2.1.4' EOF occurred while reading; fd='3' Syslog connection accepted; from='AF_UNIX(anonymous)', to='AF_UNIX(/dev/log)' Syslog connection accepted; from='AF_UNIX(anonymous)', to='AF_UNIX(/dev/log)' Incoming log entry; line='<85>Feb 14 15:04:03 sshd[797]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.58.99.83 user=admin' Initializing destination file writer; template='/var/log/messages', filename='/var/log/messages' Incoming log entry; line='<86>Feb 14 15:04:06 sshd[797]: Failed password for admin from 10.58.99.83 port 64622 ssh2' EOF occurred while reading; fd='8' Closing log reader fd; fd='8' Syslog connection accepted; from='AF_UNIX(anonymous)', to='AF_UNIX(/dev/log)' Incoming log entry; line='<86>Feb 14 15:04:16 sshd[797]: Accepted password for admin from 10.58.99.83 port 64622 ssh2' EOF occurred while reading; fd='8' Closing log reader fd; fd='8' EOF occurred while reading; fd='7' Closing log reader fd; fd='7' Syslog connection accepted; from='AF_UNIX(anonymous)', to='AF_UNIX(/dev/log)' Incoming log entry; line='<86>Feb 14 15:04:16 sshd[797]: pam_unix(sshd:session): session opened for user admin by (uid=0)' Syslog connection accepted; from='AF_UNIX(anonymous)', to='AF_UNIX(/dev/log)' Incoming log entry; line='<13>Feb 14 15:04:22 admin: Test message' EOF occurred while reading; fd='8' Closing log reader fd; fd='8' Syslog connection accepted; from='AF_UNIX(anonymous)', to='AF_UNIX(/dev/log)' Incoming log entry; line='<86>Feb 14 15:04:48 su: pam_unix(su-l:session): session opened for user root by admin(uid=500)' Syslog connection accepted; from='AF_UNIX(anonymous)', to='AF_UNIX(/dev/log)' Incoming log entry; line='<86>Feb 14 15:05:00 su: pam_unix(su-l:session): session opened for user smuser by admin(uid=0)' But i do not see any debugs messages for smps.log getting processed ( even though the file is getting updated ) Any ideas Is this is a shortcoming in syslog-ng 2.1.4 . I cannot compile the latest version of syslog-ng since there is a limitation on my production system ( cannot compile anything due to security concerns ) so i am need of a syslog-ng rpm package other than 2.1.4 that works on RHEL 5 or if i can fix the issue in the existing version Appreciate any help Thanks Kathi -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 7

[Bug 218] New: To include local*.* facility. level in the source of syslog-ng
by bugzilla＠bugzilla.balabit.com 14 Feb '13

14 Feb '13

https://bugzilla.balabit.com/show_bug.cgi?id=218 Summary: To include local*.* facility.level in the source of syslog-ng Product: syslog-ng Version: 3.2.x Platform: Other OS/Version: Solaris Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jk_kathi1(a)yahoo.com Type of the Report: --- Estimated Hours: 0.0 We have oracle audits configured to send updates to local0.info facility.level and the existing syslog.conf ( solaris syslgod ) has a feature to include them in local6.info /var/log/syslog We are replacing syslogd with syslog-ng and need to replicate this property I have searched the syslog-ng documentation and there is not mention of including local6.info in the source section of syslog-ng.conf. I can use it in the filter section , but the source itself is not getting updated so filter option may be unused. I can source a file but the audit logs does not write to a file , they write to proprietary syslog's facility.level Is there a solution , i have hit a road block Any information , documentation of how i can include the facility.level into syslog-ng would be helpful source s_local { system(); sun-streams("/dev/log" door("/etc/.syslog_door")); }; # Filters #filter f_local6 { facility(local6); }; Do i include any other keywords apart from system in the source s_local line Thanks -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 14

need help with pattern, get .classifier.class=unknown
by Stefan Sabolowitsch 14 Feb '13

14 Feb '13

Hi all, i use the net screen pattern the ruleset: <ruleset name="NetScreen" id='1001'> <pattern>fw</pattern> <rules> <rule provider="ELSA" class='1001' id='1001'> <patterns> <pattern>NetScreen device_id=@ESTRING:s0: @@ESTRING:: @start_time="@ESTRING::"@ duration=@ESTRING:: @policy_id=@ESTRING:i0: @service=@ESTRING:s1: @proto=@ESTRING:: @src zone=@ESTRING:s2: @dst zone=@ESTRING:s3: @action=@ESTRING:s4: @sent=@ESTRING:: @rcvd=@ESTRING:: @src=@ESTRING:i1: @dst=@ESTRING:i2: @src_port=@ESTRING:i3: @dst_port=@ESTRING:i4: @session_id=@ESTRING:: @reason=Traffic Denied</pattern> </patterns> <examples> <example> <test_message program="NetScreen deny">NetScreen device_id=fw [Root]system-notification-00257(traffic): start_time="2012-10-02 09:46:20" duration=0 policy_id=10005 service=http proto=6 src zone=OUT dst zone=IN action=Deny sent=0 rcvd=40 src=192.168.0.1 dst=192.168.1.1 src_port=51271 dst_port=80 session_id=0 reason=Traffic Denied</test_message>  <test_value name="s0">fw</test_value>  <test_value name="i0">10005</test_value>  <test_value name="s1">http</test_value>  <test_value name="s2">OUT</test_value>  <test_value name="s3">IN</test_value>  <test_value name="s4">Deny</test_value>  <test_value name="i1">192.168.0.1</test_value>  <test_value name="i2">192.168.1.1</test_value>  <test_value name="i3">51271</test_value>  <test_value name="i4">80</test_value> </example> </examples> </rule> </rules> </ruleset> but i get this error : /usr/local/syslog-ng/bin/pdbtool match -c -D -v -p /usr/local/elsa/node/conf/patterndb.xml -P fw -M "NetScreen device_id=fw [Root]system-notification-00257(traffic): start_time="2012-10-02 09:46:20" duration=0 policy_id=10005 service=http proto=6 src zone=OUT dst zone=IN action=Deny sent=0 rcvd=40 src=192.168.0.1 dst=192.168.1.1 src_port=51271 dst_port=80 session_id=0 reason=Traffic Denied" Pattern matching part: NetScreen device_id=@ESTRING:s0=fw@@ESTRING:None=[Root]system-notification-00257(traffic):@start_time=2012-10-02 Matching part: NetScreen device_id=fw [Root]system-notification-00257(traffic): start_time= Values: MESSAGE=NetScreen device_id=fw [Root]system-notification-00257(traffic): start_time=2012-10-02 PROGRAM=fw .classifier.class=unknown Any help here thanks Stefan

2 2

[Bug 219] New: log_msg_is_write_protected when a source is used in multiple log statments
by bugzilla＠bugzilla.balabit.com 14 Feb '13

14 Feb '13

https://bugzilla.balabit.com/show_bug.cgi?id=219 Summary: log_msg_is_write_protected when a source is used in multiple log statments Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: critical Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 Created an attachment (id=71) --> (https://bugzilla.balabit.com/attachment.cgi?id=71) minimal syslog-ng.conf It appears that if a source is used in two different log statements, all branches use a write protected instance of the log message. Module loaded and initialized successfully; module='syslogformat' Running application hooks; hook='1' Running application hooks; hook='3' syslog-ng starting up; version='3.4.1' Syslog connection accepted; fd='12', client='AF_INET(142.104.141.3:40576)', local='AF_INET(0.0.0.0:514)' Incoming log entry; line='<134>2013-02-04T15:28:46-08:00 pangolin.comp.uvic.ca/pangolin.comp.uvic.ca action-handler[24020]: starting' Initializing destination file writer; template='/var/syslog/archive.log', filename='/var/syslog/archive.log' Filter node evaluation result; result='not-match' Filter node evaluation result; result='not-match', type='filter(f_short_host_at)' ** ERROR:logmsg.c:535:log_msg_set_value_indirect: assertion failed: (!log_msg_is_write_protected(self)) Attached is a very simple config file that reproduces this issue. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 7

IPv6 rewrite rule PVCE
by strife＠riseup.net 14 Feb '13

14 Feb '13

Hi, I want to anonymize certain logs, ie. remove IP addresses. Thanks to the advice/experiments by Micah from Riseup, I have the following. It works fine for IPv4: rewrite r_ip { subst('([[:digit:]]{1,3}\.){3}[[:digit:]]{1,3}', "\[REDACTED\]", value("MESSAGE"), type("pcre"), flags("global")); }; I tried to extend this to IPv6 using the IPV6 PCRE expression found at http://home.deds.nl/~aeron/regex/ : subst('/(((?=.*(::))(?!.*\3.+\3))\3?|([\dA-F]{1,4}(\3|:\b|$)|\2))(?4){5}((?4){2}|(((2[0-4]|1\d|[1-9])?\d|25[0-5])\.?\b){4})\z/i', "\[REDACTED\]", value("MESSAGE"), type("pcre"), flags("global")); When I test the expression using pcretest, it successfully matches IPv6 addresses in text. In syslog-ng, it does not. Any ideas? Thanks! -- strife

3 6

syslog-ng Insider - February 2013
by Peter Czanik 14 Feb '13

14 Feb '13

Dear syslog-ng users, This is the 21th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com <mailto:documentation@balabit.com> FEATURED NEWS Video: Basic building blocks of syslog-ng.conf ---------------------------------------------- There is a video series in the work to introduce the basics of syslog-ng. The second video is online now, which explains the basic building blocks of syslog-ng.conf. You can watch it at http://www.youtube.com/watch?v=D3OjHQj42Jg New videos will be published on the same Youtube channel. You are very welcome to subscribe to receive notifications about further syslog-ng videos and other interesting content. Syslog-ng 3.4.1 is released --------------------------- Version 3.4.1was released at the end of January. Compared to the RC2release, it only has some minor bugfixes. This version brings many major new features to syslog-ng: junctions and channels to make syslog-ng configuration even more flexible, a community contributed AMQP destination, improved JSON support including a parser and many value pairs related improvements. For more details, check http://algernon.blogs.balabit.com/2013/01/syslog-ng-ose-3-4-1-released/ You cancheck the announcement athttps://lists.balabit.hu/pipermail/syslog-ng-announce/2013-January/000154.html For binary package availability check our 3^rd party binary page at http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… At the time of this writing there are v3.4.1 packages for openSUSE and SLES, not only as 3^rd party packages but also as part of the openSUSE 12.3 release. It's also available for FreeBSD in the sysutils/syslog-ng-devel port, and already in Fedora Rawhide. Packages for various Debian and Ubuntu releases are available in algernon's repo. syslog-ng at conferences: FOSDEM and Brno ----------------------------------------- The syslog-ng team is actively participating in the life of the open source community. Last weekend CzP gave a talk at FOSDEM and participated a two day long brainstorming session about logging and monitoring in Antwerp. He met many interesting people from the syslog-ng community. You can read about his experiences at http://czanik.blogs.balabit.com/2013/02/czp-fosdem-2013/ We will also participate http://devconf.cz/ and the systemd hackfest the day before the conference. If you are also there and want to talk about syslog-ng, we are more than happy to meet you! SHORT NEWS: * To use cacti with syslog-ng, check configuration examples at https://czanik.blogs.balabit.com/2013/01/trying-cacti-with-syslog-ng/ * What's new presentation in Hungarian for syslog-ng 3.4 with configuration examples: http://asylum.madhouse-project.org/downloads/presentations/syslog-ng-ose-3.… and http://asylum.madhouse-project.org/downloads/presentations/syslog-ng-ose-3.… NEW RELEASES: * syslog-ng OSE 3.4.1:https://lists.balabit.hu/pipermail/syslog-ng-announce/2013-January/000154.html ARCHIVE http://insider.blogs.balabit.com/ -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

[Bug 172] New: tcp() destination driver ignores ts_format() parameter
by bugzilla＠bugzilla.balabit.com 13 Feb '13

13 Feb '13

https://bugzilla.balabit.com/show_bug.cgi?id=172 Summary: tcp() destination driver ignores ts_format() parameter Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: chiestand(a)salk.edu Type of the Report: bug Estimated Hours: 0.0 The documentation (http://www.balabit.com/sites/default/files/syslog-ng-ose-v3.3-guide-admin-e…) states that you may use the ts_format() paramater to modify the timestamp format. However this parameter does not work, rfc3164 format seems to be used no matter what you specify in ts_format(). So either the documentation is wrong or there is a bug. I am running 3.3.4 on Debian Wheezy. I also had the problem running 3.1 in Debian Squeeze. my driver: destination My_Syslog { tcp("syslog.server.salk.edu" port(514) ts_format(iso) ); }; log { source(s_src); destination(My_Syslog); }; tcpdump: @.m..<hw<86>Apr 6 01:24:01 host CRON[1923]: pam_unix(cron:session): session closed for user root I emailed the mailing list on this issue, the thread can be viewed here: https://lists.balabit.hu/pipermail/syslog-ng/2012-April/018638.html -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6