- syslog-ng - lists.balabit.hu

sql-driver and "ON duplicate KEY UPDATE"
by system＠ra-schaal.de 02 Jan '13

02 Jan '13

Hi all, is it possible to perform an "ON duplicate KEY UPDATE" with the sql-driver for a mysql-database? At the moment I use destination d_sql { program("/usr/bin/mysql -uUSER -pPASSWORD DATABASE" template("INSERT INTO TABLE VALUES (inet_aton('${.apache.client_ip}') ,${.apache.content_length},CURRENT_TIMESTAMP,1 ) ON duplicate KEY UPDATE bytes=bytes+${.apache.content_length}, hits=hits+1;\n") template-escape(yes)); }; without any problems. By using this destination, syslog-ng can´t use the sql-driver. I`m not sure if there is any difference between sql-driver and the destination above. regards Florian

2 1

Statistics summary
by Anton Koldaev 30 Dec '12

30 Dec '12

Is there a nice way to get total numbers of processed/stored/dropped messages in syslog-ng v3.3? >From docs: > The *center(received)* entry shows the total number of messages received from every configured sources. But in my stats center() shows zero almost for every host. I see zero in some other examples in docs too. -- Best regards, Koldaev Anton

3 7

SYSLOG-NG 3.4 exiting without any error print
by Deepak Gaur 28 Dec '12

28 Dec '12

Hello, I have cross-compiled syslog-ng for ARM target but it is exiting without showing any error code (on target). I am attaching strace output (syslog.txt). If anyone can help me out # syslog-ng -V syslog-ng 3.4.0alpha3 Installer-Version: 3.4.0alpha3 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.4#master#709ab1252920063e6d4d0d610ad5c1ee5ebdfb75 Compile-Date: Nov 27 2012 14:59:53 Available-Modules: syslogformat,afsocket-notls,afuser,basicfuncs,confgen,dbparser,tfuuid,afmongodb,afsocket-tls,afprog,afsocket,affile,csvparser Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-Linux-Caps: off Enable-Pcre: on ATTACHMENT syslog.txt

2 2

Re: [syslog-ng] syslog-ng 3.4.0beta1 has been released
by Evan Rempel 27 Dec '12

27 Dec '12

I thought that 3.4 was going to include - junctions so that results of multiple parsers could be combined - the ability to run a parser against a user defined macro rather than always parsing the complete MESSAGE marcro. Did these features fail to make it into 3.4 or is the documentation just missing these items? Thanks, -- Evan Rempel Senior Systems Administrator, Data Centre Services University of Victoria 250.721.7691

4 6

syslog-ng 3.3.6 make error on solaris 8
by Rakesh Rajasekharan 24 Dec '12

24 Dec '12

syslog-ng 3.3.6 on a Solaris 8 sparc machine gives the below error on the make stage.. I have used.. dynamic linking option... Undefined first referenced symbol in file __sync_lock_release ../../.libs/libivykis.a(iv_signal.o) __sync_lock_test_and_set ../../.libs/libivykis.a(iv_signal.o) Anyone faced a similar issue..? or if someone can help out please... Thanks, Rakesh..

2 2

syslog-ng 3.3.6 - AIX Issue
by Manimaran kk 23 Dec '12

23 Dec '12

I have compiled the syslog-ng version 3.3.6 on a AIX 5.3 . The compilation went through fine but when I try to run syslog-ng, i am getting following error. # ./syslog-ng Error opening plugin module; module='affile', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libaffile.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Error opening plugin module; module='afprog', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libafprog.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Plugin module not found in 'module-path'; module-path='/opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng', module='afsocket' Error opening plugin module; module='afuser', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libafuser.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Error opening plugin module; module='basicfuncs', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libbasicfuncs.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Error opening plugin module; module='csvparser', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libcsvparser.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Error opening plugin module; module='dbparser', error='rtld: 0712-001 Symbol __iv_now_location was referenced\x0a from module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libdbparser.so(), but a runtime definition\x0a of the symbol was not found.' Error opening plugin module; module='syslogformat', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libsyslogformat.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Error opening plugin module; module='syslogformat', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libsyslogformat.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Error opening plugin module; module='basicfuncs', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libbasicfuncs.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Plugin module not found in 'module-path'; module-path='/opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng', module='afsocket' Error opening plugin module; module='affile', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libaffile.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Error opening plugin module; module='afprog', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libafprog.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Error opening plugin module; module='afuser', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libafuser.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Error opening plugin module; module='dbparser', error='rtld: 0712-001 Symbol __iv_now_location was referenced\x0a from module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libdbparser.so(), but a runtime definition\x0a of the symbol was not found.' Error opening plugin module; module='csvparser', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libcsvparser.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Error opening plugin module; module='confgen', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libconfgen.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Error opening plugin module; module='confgen', error='\x090509-022 Cannot load module /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng/libconfgen.so.\x0a\x090509-026 System error: A file or directory in the path name does not exist.' Error parsing source, source plugin system not found in /opt/soe/local/syslog-ng-3.3.6/etc/syslog-ng.conf at line 10, column 2: system(); ^^^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng # Compiler Option ------------------------------------- syslog-ng Open Source Edition 3.3.6 configured Compiler options: compiler : gcc -std=gnu99 compiler options : -g -O2 -Wall -pthread -D_LARGE_FILES=1 -pthread -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/opt/soe/local/syslog-ng-3.3.6/eventlog/include/eventlog -I$(top_srcdir)/lib/ivykis/lib/include -I$(top_builddir)/lib/ivykis/lib/include -I$(top_srcdir)/lib/ivykis/modules/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -L/opt/soe/local/syslog-ng-3.3.6/lib -L/usr/local/lib -L/usr/ccs/lib -L/usr/lib -lpthread -Wl,-brtl prefix : /opt/soe/local/syslog-ng-3.3.6 linking mode : dynamic __thread keyword : yes Submodules: ivykis : internal libmongo-client : internal Features: Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : yes spoof-source support : no tcp-wrapper support : no Linux capability support : no PCRE support : no Env wrapper support : yes systemd support : no (unit dir: none) Modules: Module search path : /opt/soe/local/syslog-ng-3.3.6/lib/syslog-ng Default module list : affile,afprog,afsocket,afuser,basicfuncs,csvparser,dbparser,syslogformat Sun STREAMS support (module): no SSL support (module) : no SQL support (module) : no PACCT module (EXPERIMENTAL) : no MongoDB destination (module): yes JSON support (module) : no (using no) Could any one assist please.

2 2

[Bug 212] New: strange hostnames from /etc/hosts with threaded(yes);
by bugzilla＠bugzilla.balabit.com 21 Dec '12

21 Dec '12

https://bugzilla.balabit.com/show_bug.cgi?id=212 Summary: strange hostnames from /etc/hosts with threaded(yes); Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bpkroth(a)gmail.com Type of the Report: --- Estimated Hours: 0.0 Created an attachment (id=67) --> (https://bugzilla.balabit.com/attachment.cgi?id=67) syslog-ng.conf Hi, I've backported syslog-ng 3.3.5 for Debian squeeze in order to get the threaded feature for our main syslog server, but I've found that with threaded(yes) and sending logs to directories byhost ($FROM_FULLHOST) set, then I get a few directories that are actually weird mashups from entries in /etc/hosts (eg: fqdn{tab}shortname{newline}, where {tab} is an actual tab character, similarly for newlines). As an example: 13 lager.$domain lager loghost 2.208 ldap1.$domain ldap1 Here, 13 and 2.208 are the last part of the IP listing for that host, but the rest is missing. This seems similar to Bug #183, except that I'm not getting segfaults, just goofy log file names and directory names, which in turn causes some other problems on our end. For now, I've disabled threaded (and was happy to find that the CPU load on the machine is still quite reduced, so good work on whatever other scalability improvements you've done - epoll?), but I'd like to take advantage of the slew of cores the machine has. use_dns(yes) and dns_cache(yes) are set, but it doesn't use a persistent file, but rather the system resolver is set to 127.0.0.1 and there's a local bind named slave running (which has all of the necessary reverse lookup information). Attached is my full conf file. Please let me know if you need anymore info. Thanks, Brian -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 19

syslog-ng 3.4.0beta1 has been released
by devel＠balabit.hu 20 Dec '12

20 Dec '12

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.4.0beta1 SUMMARY : new stable release DATE : Dec 15, 2012 ------------------------------------------------------------------------------ DESCRIPTION: A new version of syslog-ng Open Source Edition (3.4.0beta1) has been released. For latest fixes in the 3.4.x feature branch you are recommended to upgrade to this version. CHANGES: 3.4.0beta1 Sat, 15 Dec 2012 02:21:14 +0100 Features: ========= * Added support for the amqp() destination driver, which sends messages to an AMQP queue. * Added support for a new parser named syslog-parser() that can invoke the RFC3164 and RFC5424 parser outside the source driver that received the message. Delaying the syslog parsing can be advantageous in case some preprocessing or filtering needs to take place before the actual syslog parsing. * Added support for dot notation in the $(format-json) template function. * Changed the MongoDB driver to use inserts instead of upserts. * Added support for UNIX domain sockets in the MongoDB driver by using the new path() option. * Added new template functions to perform various cryptographic hash functions on data, like: $(md5), $(md4), $(sha1), $(sha256), $(sha512) * Added a couple of new parsers to db-parser() pattern format: * @PCRE@: use this to parse using a regexp * @EMAIL@: to parse email addresses * @HOSTNAME@: to parse host names * @LLADDR@: to parse link-level addresses, like ethernet MAC addresses * Added the possibility to set TCP keepalive options for TCP based transports: tcp-keepalive-time(), tcp-keepalive-probes(), tcp-keepalive-intvl(). Also added the tcp-keepalive() option as an alias to the earlier so-keepalive() parameter. TCP keepalive became enabled by default. Bugfixes: ========= * Updated with the bugfixes from v3.3.7 * Fixed SQL statement formatting used to create indexes on Oracle. The original query contained an apostrophe when specifying the column name. * Fixed an incorrect validation in the file() source, which caused the entire file to be resent in case syslog-ng was restarted and an encoding() is specified. * Increased the performance when following files with the encoding() option set. Previously, the code to check if the source encoding is fixed size was incorrect, which in turn caused syslog-ng to excercise its slow path when processing these files, instead of a faster alternative. * Fixed a memory leak issue when encoding() is used for file sources and syslog-ng was reloaded. * Fixed a bug in processing the encoding() option for udp() sources. syslog-ng incorrectly propagated the character decoding state from one frame to the next, which might have originated from different senders. * Infinite feedback loops of internal messages triggering another set of internal messages are now detected and suppressed. Earlier it was not safe to enable debug/trace messages during runtime, now it is. * Fixed a race condition in resolving IP address to hostnames, which might have caused garbage in the hostname part of messages. This is most likely mitigated by the DNS cache. Other changes: ============== * Added unit test coverage for various log transport implementations. * Reorganized the LogProto code to support plugins, the transport() option for the syslog() and network() drivers can be used to specify a transport protocol plugin. Credits: ======== syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Attila Nagy <bra(a)fsn.hu> Balazs Scheidler <bazsi(a)balabit.hu> Balint Kovacs <blint(a)balabit.hu> Brian Kroth <bpkroth(a)gmail.com> Conrad Hoffmann <ch(a)bitfehler.net> Csaba Major <csaba.major(a)balabit.com> Cy Schubert <cy(a)FreeBSD.org> Eun Kyung <ekyung01(a)googlemail.com> Evan Rempel <erempel(a)uvic.ca> Gergely Nagy <algernon(a)balabit.hu> Jose Oliveira <jpo(a)di.uminho.pt> Juhasz Viktor <jviktor(a)balabit.hu> Marvin Nipper <marvin.nipper(a)stream.com> Michael Hocke <michael.hocke(a)nyu.edu> Peter Czanik <czanik(a)balabit.hu> Peter Gyongyosi <gyp(a)balabit.hu> Sandor Geller <wildy(a)muhelybt.hu> Sergey <cloun-rulez(a)yandex.ru> shih dane <daneshih1125(a)gmail.com> Tamas Pal <folti(a)balabit.hu> Viktor Juhasz <jviktor(a)balabit.hu> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

2 2

Re: [syslog-ng] syslog-ng Digest, Vol 92, Issue 18
by Frank Scalzo 20 Dec '12

20 Dec '12

> Message: 12 > Subject: Re: [syslog-ng] having an issue with syslog and SElinux > > > On 2012-12-18 14:40, Frank Scalzo wrote: >> kernel: : type=1400 audit(1355841452.964:21866): avc: denied { fowner >> } for pid=861 comm="syslog-ng" capability=3 >> scontext=system_u:system_r:syslogd_t:s0 >> tcontext=system_u:system_r:syslogd_t:s0 tclass=capability >> >> >> How do i fix this without disabling SElinux > > Which Linux distribution are you using? And which versions of syslog-ng > and selinux? A copy of your syslog-ng configuration file would > also be helpful. Im running the following Red Hat Enterprise Linux Server release 6.3 (Santiago) selinux-3.7.19-187 syslog-ng 3.2.5 Installer-Version: 3.2.5 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#9d4bea28198bd731df1a61e980a2af5b88d81116 Compile-Date: Jan 15 2012 19:47:30 Enable-Threads: on Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-SSL: off Enable-SQL: on Enable-Linux-Caps: off Enable-Pcre: on Enable-Pacct: off conf below: @version:3.2 # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # options { flush_lines(100); log_fetch_limit(100); log_iw_size(100); log_fifo_size(1000); time_reopen (10); log_fifo_size (1000); use_dns (yes); use_fqdn (yes); create_dirs (yes); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" program_override("kernel: ")); unix-stream ("/dev/log"); internal(); # udp(ip(0.0.0.0) port(514)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" flush_lines(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_kern { file("/var/log/kern"); }; destination d_mlal { usertty("*"); }; filter f_kernel { facility(kern); }; filter f_default { level(info..emerg) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_auth { facility(authpriv); }; filter f_mail { facility(mail); }; filter f_emergency { level(emerg); }; filter f_news { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_boot { facility(local7); }; filter f_cron { facility(cron); }; #log { source(s_sys); filter(f_kernel); destination(d_cons); }; log { source(s_sys); filter(f_kernel); destination(d_kern); }; log { source(s_sys); filter(f_default); destination(d_mesg); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_mail); destination(d_mail); }; log { source(s_sys); filter(f_emergency); destination(d_mlal); }; log { source(s_sys); filter(f_news); destination(d_spol); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; log { source(s_sys); filter(f_cron); destination(d_cron); }; ## Additions for central syslog source s_udp { udp(); }; source s_tcp { tcp(ip(0.0.0.0) port(514)); }; destination d_hosts { file("/var/log/hosts/$HOST/$YEAR$MONTH$DAY" owner(syslog) group(syslog) perm(0644) dir_perm(0755) create_dirs(yes)); }; log { source(s_udp); destination(d_hosts); }; log { source(s_tcp); destination(d_hosts); }; # For testing: aka logger "my little pony" #log { source(s_sys); destination(d_hosts); }; ## End additions for central syslog # vim:ft=syslog-ng:ai:si:ts=4:sw=4:et: On Dec 20, 2012, at 8:59 AM, syslog-ng-request(a)lists.balabit.hu wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. syslog-ng Insider - December 2012 (Peter Czanik) > 2. [Bug 213] Build Failure on AIX with syslog-ng-3.3.6 and gcc > 4.2.0 (bugzilla(a)bugzilla.balabit.com) > 3. [Bug 213] Build Failure on AIX with syslog-ng-3.3.6 and gcc > 4.2.0 (bugzilla(a)bugzilla.balabit.com) > 4. [Bug 214] Build / Install Issues on AIX > (bugzilla(a)bugzilla.balabit.com) > 5. [Bug 214] Build / Install Issues on AIX > (bugzilla(a)bugzilla.balabit.com) > 6. [Bug 173] Compile issues with syslog-ng_3.3.4.tar.gz > (bugzilla(a)bugzilla.balabit.com) > 7. [Bug 61] udp6 source declaration causes syslog forwarding to > assume IPv6 (bugzilla(a)bugzilla.balabit.com) > 8. [Bug 42] capabilities, chown, chmod > (bugzilla(a)bugzilla.balabit.com) > 9. [Bug 213] Build Failure on AIX with syslog-ng-3.3.6 and gcc > 4.2.0 (bugzilla(a)bugzilla.balabit.com) > 10. [Bug 61] udp6 source declaration causes syslog forwarding to > assume IPv6 (bugzilla(a)bugzilla.balabit.com) > 11. [Bug 61] udp6 source declaration causes syslog forwarding to > assume IPv6 (bugzilla(a)bugzilla.balabit.com) > 12. Re: having an issue with syslog and SElinux (Jose Pedro Oliveira) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 20 Dec 2012 12:01:01 +0100 > From: Peter Czanik <czanik(a)balabit.hu> > Subject: [syslog-ng] syslog-ng Insider - December 2012 > To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> > Message-ID: <50D2EFED.9080108(a)balabit.hu> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > > Dear syslog-ng users, > > > This is the 19th issue of the syslog-ng Insider, a monthly newsletter > that brings you syslog-ng related news. > > Your feedback and news tips about the next issue is welcome at > documentation(a)balabit.com <mailto:documentation@balabit.com> > > > FEATURED NEWS > > > syslog-ng 3.4 beta1 is released > > ------------------------------- > > Version 3.4 beta1was released thisweek, right before the > Christmasholidays. It has many new features and bug fixes even since the > last alpha release, most notably a new AMQP destination a JSON parser > and a reworked syslog parser and network configuration, which makes > configuring syslog-ng even more simple and flexible. > > For a complete list of changes, check the announcement at > https://lists.balabit.hu/pipermail/syslog-ng-announce/2012-December/000150.… > > For binary package availability check our 3^rd party binary page at > http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… > > > balabit.logstore 0.1.0 is released > > ---------------------------------- > > The second version of the balabit.logstore project was announced last > week. It is a library written in Clojure, that tries to provide a > convenient API to read syslog-ng PE LogStore files. Development is still > in its early phases, but it can already read unencrypted logstore files, > search in them and print many useful information about them. Compared to > the previous version, this has a Java API. > > For more details, check the announcement at > https://lists.balabit.hu/pipermail/syslog-ng/2012-December/019788.html > > > > NEW RELEASES: > > * > > syslog-ng OSE 3.4 beta1: > https://lists.balabit.hu/pipermail/syslog-ng-announce/2012-December/000150.… > > * > > balabit.logstore 0.1.0: > https://lists.balabit.hu/pipermail/syslog-ng/2012-December/019788.html > > ARCHIVE > > > http://insider.blogs.balabit.com/ > > -- > Peter Czanik (CzP) <czanik(a)balabit.hu> > BalaBit IT Security / syslog-ng upstream > http://czanik.blogs.balabit.com/ > > > > > ------------------------------ > > Message: 2 > Date: Thu, 20 Dec 2012 13:02:58 +0100 (CET) > From: bugzilla(a)bugzilla.balabit.com > Subject: [syslog-ng] [Bug 213] Build Failure on AIX with > syslog-ng-3.3.6 and gcc 4.2.0 > To: syslog-ng(a)lists.balabit.hu > Message-ID: <20121220120258.155B339DC65(a)lists.balabit.hu> > Content-Type: text/plain; charset="UTF-8" > > https://bugzilla.balabit.com/show_bug.cgi?id=213 > > > Gergely Nagy <algernon(a)balabit.hu> changed: > > What |Removed |Added > ---------------------------------------------------------------------------- > Target Milestone|--- |3.3.8 > CC| |algernon(a)balabit.hu > AssignedTo|bazsi(a)balabit.hu |algernon(a)balabit.hu > > > > > --- Comment #3 from Gergely Nagy <algernon(a)balabit.hu> 2012-12-20 13:02:57 --- > Thanks for the report and the patch, I will apply this to 3.3's git head shortly, with some minor modifications: I don't want to replace GLOB_NOMAGIC with > GLOB_NOCHECK, as they're not the same. > > With GLOB_NOMAGIC, "/etc/syslog-ng/foo.conf" both would return foo.conf, but for "/etc/syslog-ng/conf.d/*.conf", NOCHECK would return the pattern, NOMAGIC > would return GLOB_NOMATCH. So on platforms that do have NOMAGIC, syslog-ng should use it, on others, it should fall back to NOCHECK as the next best option. > > I plan to do this with something along these lines: > > #ifndef GLOB_NOMAGIC > #define GLOB_NOMAGIC GLOB_NOCHECK > #endif > > Or better yet, implement NOMAGIC if the platform does not support it. I'll see which option is more feasible in our case. > > > -- > Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email > ------- You are receiving this mail because: ------- > You are watching all bug changes. > > > ------------------------------ > > Message: 3 > Date: Thu, 20 Dec 2012 13:03:08 +0100 (CET) > From: bugzilla(a)bugzilla.balabit.com > Subject: [syslog-ng] [Bug 213] Build Failure on AIX with > syslog-ng-3.3.6 and gcc 4.2.0 > To: syslog-ng(a)lists.balabit.hu > Message-ID: <20121220120308.8D50439DC58(a)lists.balabit.hu> > Content-Type: text/plain; charset="UTF-8" > > https://bugzilla.balabit.com/show_bug.cgi?id=213 > > > Gergely Nagy <algernon(a)balabit.hu> changed: > > What |Removed |Added > ---------------------------------------------------------------------------- > Status|NEW |ASSIGNED > > > > > -- > Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email > ------- You are receiving this mail because: ------- > You are watching all bug changes. > > > ------------------------------ > > Message: 4 > Date: Thu, 20 Dec 2012 13:06:40 +0100 (CET) > From: bugzilla(a)bugzilla.balabit.com > Subject: [syslog-ng] [Bug 214] Build / Install Issues on AIX > To: syslog-ng(a)lists.balabit.hu > Message-ID: <20121220120640.1E33C39DC6B(a)lists.balabit.hu> > Content-Type: text/plain; charset="UTF-8" > > https://bugzilla.balabit.com/show_bug.cgi?id=214 > > > Gergely Nagy <algernon(a)balabit.hu> changed: > > What |Removed |Added > ---------------------------------------------------------------------------- > CC| |algernon(a)balabit.hu > AssignedTo|bazsi(a)balabit.hu |algernon(a)balabit.hu > > > > > --- Comment #2 from Gergely Nagy <algernon(a)balabit.hu> 2012-12-20 13:06:40 --- > (In reply to comment #1) >> Also to note, version 3.2.5 does not have any issues with lib/syslog-ng/libafsocket.so dependencies... the ldd output doesn't seem to indicate a requirement >> for libsyslog-ng-crypto. >> > > libsyslog-ng-crypto was split out of libsyslog-ng in 3.3. > > My guess is that libsyslog-ng-crypto gets installed into /opt/local/syslogng/lib/syslog-ng/, which is not on the dynamic loader's path, and the AIX linker > thingies do not support RPATH. > > The best course of action here would be to link libsyslog-ng-crypto directly into libsyslog-ng, I believe. Or, move it out of lib/syslog-ng, into lib/ itself. > > > -- > Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email > ------- You are receiving this mail because: ------- > You are watching all bug changes. > > > ------------------------------ > > Message: 5 > Date: Thu, 20 Dec 2012 13:06:52 +0100 (CET) > From: bugzilla(a)bugzilla.balabit.com > Subject: [syslog-ng] [Bug 214] Build / Install Issues on AIX > To: syslog-ng(a)lists.balabit.hu > Message-ID: <20121220120652.23B0039DC75(a)lists.balabit.hu> > Content-Type: text/plain; charset="UTF-8" > > https://bugzilla.balabit.com/show_bug.cgi?id=214 > > > Gergely Nagy <algernon(a)balabit.hu> changed: > > What |Removed |Added > ---------------------------------------------------------------------------- > Target Milestone|--- |3.3.8 > Status|NEW |ASSIGNED > > > > > -- > Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email > ------- You are receiving this mail because: ------- > You are watching all bug changes. > > > ------------------------------ > > Message: 6 > Date: Thu, 20 Dec 2012 13:09:21 +0100 (CET) > From: bugzilla(a)bugzilla.balabit.com > Subject: [syslog-ng] [Bug 173] Compile issues with > syslog-ng_3.3.4.tar.gz > To: syslog-ng(a)lists.balabit.hu > Message-ID: <20121220120921.688A011E004(a)lists.balabit.hu> > Content-Type: text/plain; charset="UTF-8" > > https://bugzilla.balabit.com/show_bug.cgi?id=173 > > > Gergely Nagy <algernon(a)balabit.hu> changed: > > What |Removed |Added > ---------------------------------------------------------------------------- > Status|REOPENED |NEEDINFO > > > > > --- Comment #4 from Gergely Nagy <algernon(a)balabit.hu> 2012-12-20 13:09:21 --- > (In reply to comment #3) >> (In reply to comment #2) >>> Is this still and issue, or can I close it? I don't think this is a bug in syslog-ng... >>> >> >> I am facing the same issue while compiling syslog-ng-3.4.0-alpha3 on CentoOS 6.3 . > [...] >> when i set the env varilable export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig , eventlog went through fine but glib gave errors >> checking for GLIB... no >> configure: error: Package requirements (glib-2.0 >= 2.10.1 gmodule-2.0 gthread-2.0) were not met: > [...] > > Can you attach the config.log files from all three configure runs? That would help me figure out what goes wrong. > > Thanks! > > > -- > Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email > ------- You are receiving this mail because: ------- > You are watching all bug changes. > > > ------------------------------ > > Message: 7 > Date: Thu, 20 Dec 2012 13:12:03 +0100 (CET) > From: bugzilla(a)bugzilla.balabit.com > Subject: [syslog-ng] [Bug 61] udp6 source declaration causes syslog > forwarding to assume IPv6 > To: syslog-ng(a)lists.balabit.hu > Message-ID: <20121220121203.AA09339DC23(a)lists.balabit.hu> > Content-Type: text/plain; charset="UTF-8" > > https://bugzilla.balabit.com/show_bug.cgi?id=61 > > > Gergely Nagy <algernon(a)balabit.hu> changed: > > What |Removed |Added > ---------------------------------------------------------------------------- > Target Milestone|3.0.6 |3.4.1 > > > > > --- Comment #5 from Gergely Nagy <algernon(a)balabit.hu> 2012-12-20 13:12:03 --- > This is partially fixed in 3.4 already with the network() statement, we only need to force syslog() to set last_addr_family to IPv4. > > > -- > Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email > ------- You are receiving this mail because: ------- > You are watching all bug changes. > > > ------------------------------ > > Message: 8 > Date: Thu, 20 Dec 2012 13:15:24 +0100 (CET) > From: bugzilla(a)bugzilla.balabit.com > Subject: [syslog-ng] [Bug 42] capabilities, chown, chmod > To: syslog-ng(a)lists.balabit.hu > Message-ID: <20121220121524.A692E39DCAA(a)lists.balabit.hu> > Content-Type: text/plain; charset="UTF-8" > > https://bugzilla.balabit.com/show_bug.cgi?id=42 > > > Gergely Nagy <algernon(a)balabit.hu> changed: > > What |Removed |Added > ---------------------------------------------------------------------------- > CC| |algernon(a)balabit.hu > Resolution| |FIXED > Status|REOPENED |RESOLVED > > > > > --- Comment #10 from Gergely Nagy <algernon(a)balabit.hu> 2012-12-20 13:15:23 --- > I'm closing this issue, as I believe it is not relevant for recent syslog-ng anymore. > > > -- > Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email > ------- You are receiving this mail because: ------- > You are watching all bug changes. > > > ------------------------------ > > Message: 9 > Date: Thu, 20 Dec 2012 14:12:50 +0100 (CET) > From: bugzilla(a)bugzilla.balabit.com > Subject: [syslog-ng] [Bug 213] Build Failure on AIX with > syslog-ng-3.3.6 and gcc 4.2.0 > To: syslog-ng(a)lists.balabit.hu > Message-ID: <20121220131250.317AC39DC2A(a)lists.balabit.hu> > Content-Type: text/plain; charset="UTF-8" > > https://bugzilla.balabit.com/show_bug.cgi?id=213 > > > Gergely Nagy <algernon(a)balabit.hu> changed: > > What |Removed |Added > ---------------------------------------------------------------------------- > Resolution| |FIXED > Status|ASSIGNED |RESOLVED > > > > > --- Comment #4 from Gergely Nagy <algernon(a)balabit.hu> 2012-12-20 14:12:49 --- > (In reply to comment #3) >> Or better yet, implement NOMAGIC if the platform does not support it. I'll see which option is more feasible in our case. > > This is what I ended up doing, as the code required was pretty simple. I pushed the fix for both the iv_event.h include and the GLOB_NOMAGIC implementation to > 3.3's master, both will be part of syslog-ng 3.3.8. > > Thanks for the report! > > > -- > Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email > ------- You are receiving this mail because: ------- > You are watching all bug changes. > > > ------------------------------ > > Message: 10 > Date: Thu, 20 Dec 2012 14:19:41 +0100 (CET) > From: bugzilla(a)bugzilla.balabit.com > Subject: [syslog-ng] [Bug 61] udp6 source declaration causes syslog > forwarding to assume IPv6 > To: syslog-ng(a)lists.balabit.hu > Message-ID: <20121220131941.CE0DC39DC95(a)lists.balabit.hu> > Content-Type: text/plain; charset="UTF-8" > > https://bugzilla.balabit.com/show_bug.cgi?id=61 > > > Gergely Nagy <algernon(a)balabit.hu> changed: > > What |Removed |Added > ---------------------------------------------------------------------------- > Target Milestone|3.4.1 |3.3.8 > > > > > -- > Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email > ------- You are receiving this mail because: ------- > You are watching all bug changes. > > > ------------------------------ > > Message: 11 > Date: Thu, 20 Dec 2012 14:23:47 +0100 (CET) > From: bugzilla(a)bugzilla.balabit.com > Subject: [syslog-ng] [Bug 61] udp6 source declaration causes syslog > forwarding to assume IPv6 > To: syslog-ng(a)lists.balabit.hu > Message-ID: <20121220132347.5C94639DCAC(a)lists.balabit.hu> > Content-Type: text/plain; charset="UTF-8" > > https://bugzilla.balabit.com/show_bug.cgi?id=61 > > > Gergely Nagy <algernon(a)balabit.hu> changed: > > What |Removed |Added > ---------------------------------------------------------------------------- > Resolution| |FIXED > Status|ASSIGNED |RESOLVED > > > > > --- Comment #6 from Gergely Nagy <algernon(a)balabit.hu> 2012-12-20 14:23:47 --- > I ended up fixing this in 3.3, by forcing the syslog() destination to use IPv4, similar to how the source does it. In 3.4, network() can be used if one wants > syslog over IPv6. > > > -- > Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email > ------- You are receiving this mail because: ------- > You are watching all bug changes. > > > ------------------------------ > > Message: 12 > Date: Thu, 20 Dec 2012 13:58:55 +0000 > From: Jose Pedro Oliveira <jpo(a)di.uminho.pt> > Subject: Re: [syslog-ng] having an issue with syslog and SElinux > To: syslog-ng(a)lists.balabit.hu > Message-ID: <50D3199F.8020004(a)di.uminho.pt> > Content-Type: text/plain; charset=ISO-8859-1 > > On 2012-12-18 14:40, Frank Scalzo wrote: >> kernel: : type=1400 audit(1355841452.964:21866): avc: denied { fowner >> } for pid=861 comm="syslog-ng" capability=3 >> scontext=system_u:system_r:syslogd_t:s0 >> tcontext=system_u:system_r:syslogd_t:s0 tclass=capability >> >> >> How do i fix this without disabling SElinux > > Which Linux distribution are you using? And which versions of syslog-ng > and selinux? A copy of your syslog-ng configuration file would > also be helpful. > > jpo > -- > Jos? Pedro Oliveira > * mailto:jpo@di.uminho.pt * > > > ------------------------------ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > End of syslog-ng Digest, Vol 92, Issue 18 > *****************************************

2 1

having an issue with syslog and SElinux
by Frank Scalzo 20 Dec '12

20 Dec '12

kernel: : type=1400 audit(1355841452.964:21866): avc: denied { fowner } for pid=861 comm="syslog-ng" capability=3 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=capability How do i fix this without disabling SElinux

3 2