- syslog-ng - lists.balabit.hu

XML entities in PatternDB
by Martin Holste 08 Nov '12

08 Nov '12

I'm trying to find a way to use non-printable characters to delimit messages to avoid problems with escaping message delimiters. However, I'm having trouble representing any special characters in the patterndb.xml file. Specifically, I'd like to use characters like those found here: http://en.wikipedia.org/wiki/List_of_XML_and_HTML_character_entity_referenc… as U+200C. Trying to use the XML entity name, &zwnj; results in an error: "Entity name \'zwnj\' is not known." Is there a place that lists what entities are allowed in the XML? Thanks, Martin

2 1

Please help me on this error --- syslog-ng[4687]: Connection failed; error='Connection refused (111)', time_reopen='10' I don't see where is the problem
by Jian Zhu 05 Nov '12

05 Nov '12

Hi, Anyone know what does this mean? please help Oct 4 17:02:07 loghost syslog-ng[4687]: Connection failed; error='Connection refused (111)', time_reopen='10' I don't see where is the problem -- *Thanks & Best Regards* *James Zhu* *Mobile**:* *+86 18**6 8482 2818* *Email: *zhujian0805(a)gmail.com

2 2

syslog-ng 3.3.7 has been released
by devel＠balabit.hu 31 Oct '12

31 Oct '12

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.3.7 SUMMARY : new stable release DATE : Oct 30, 2012 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.3.7) has been released. For latest fixes in the 3.3.x feature branch you are recommended to upgrade to this version. CHANGES: 3.3.7 Wed, 31 Oct 2012 10:00:00 +0200 Highlights ========== This release is a bug-fix release, correcting a handful of issues discovered after the previous version was tagged. Bugfixes ======== * The bundled ivykis has been updated, fixing the following issues: * Fixed a Solaris-specific issue relating to TCP sources [#190] * Fixed a spinlock issue, triggered on at least FreeBSD [#193] * Workaround an issue with kqueue() on /dev/klog [#201] * The file source was corrected to properly handle character devices. This, and the ivykis update fixes a CPU spinning issue on FreeBSD. [#201] * The sun-streams module had a file descriptor leak, which has been corrected too. [#151] * The glob-based configuration file inclusion was fixed to behave similarly to including a whole directory, to include files alphabetically. [#191] The @include mechanism was also updated to not fail silently, but report an error in certain cases (such as permission errors, or missing files in case of an explicit, non-glob include). [#209] * Fixed a crash when trying to display the available modules in debug mode. [#189] * Fixed the building of afsocket-notls, so that it is correctly built without TLS support. [#188] * Fix compilation without spoof-source. [#192] * Avoid a feedback loop when emitting debug (and trace) messages. [#208] * Various minor fixes around the build system. Features ======== * The stats will now list the filename of unix domain sockets. [#195] Credits ======= syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Anton Koldaev <koldaevav(a)gmail.com> Attila Nagy <bra(a)fsn.hu> Balazs Scheidler <bazsi(a)balabit.hu> Cy Schubert <cy(a)FreeBSD.org> Dave Reisner <dreisner(a)archlinux.org> Evan Rempel <erempel(a)uvic.ca> Gergely Nagy <algernon(a)balabit.hu> Jose Pedro Oliveira <jpo(a)di.uminho.pt> Lennert Buytenhek <buytenh(a)wantstofly.org> Marvin Nipper <marvin.nipper(a)stream.com> Michael Hocke <michael.hocke(a)nyu.edu> Peter Czanik <czanik(a)balabit.hu> Tamas Pal <folti(a)balabit.hu> Yorick Peterse DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

3 2

[Bug 203] New: patterndb rule tag can not have a hyphen in the class attribute
by bugzilla＠bugzilla.balabit.com 28 Oct '12

28 Oct '12

https://bugzilla.balabit.com/show_bug.cgi?id=203 Summary: patterndb rule tag can not have a hyphen in the class attribute Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 Just seems odd that the rule tag can not have a hyphen in the class attribute. The error is element rule: Schemas validity error : Element 'rule', attribute 'class': [facet 'pattern'] The value 'sm-mta' is not accepted by the pattern '[a-zA-Z0-9_\.]+'. I would expect (and prefer) that the pattern should be '[a-zA-Z0-9_/\.+:-]' <ruleset name="sm-mta" id="RS-8e86ff39-2db4-48b6-bbe0-f980d9afebf0"> <pattern>sm-mta</pattern> <rules> <rule id="8e86ff39-2db4-48b6-bbe0-f980d9afebf0" class="sm-mta" provider="UVic"> <patterns> <pattern>whatever pattern</pattern> </patterns> </rule> </rules> </ruleset"> will reproduce this error. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

6 16

syslog-ng running help
by saeed salim 28 Oct '12

28 Oct '12

dear all, am new to the list and i want a help . i installed syslog-ng on ubuntu 11.10 when i run the application ,i got this error message ( Excess of number arguments ) any help? Thanks

3 7

[Bug 210] New: syslog-ng drops its capabilities before reading the config files
by bugzilla＠bugzilla.balabit.com 27 Oct '12

27 Oct '12

https://bugzilla.balabit.com/show_bug.cgi?id=210 Summary: syslog-ng drops its capabilities before reading the config files Product: syslog-ng Version: 3.3.x Platform: All OS/Version: All Status: ASSIGNED Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: algernon(a)balabit.hu ReportedBy: algernon(a)balabit.hu Type of the Report: --- Estimated Hours: 0.0 When reading config files, syslog-ng should be running with full capabilities (or at least enough to read root owned 0600 files), whether that happens during initial startup or on reload. (Via Yorick Peterse) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[Bug 209] New: @include can silently fail
by bugzilla＠bugzilla.balabit.com 27 Oct '12

27 Oct '12

https://bugzilla.balabit.com/show_bug.cgi?id=209 Summary: @include can silently fail Product: syslog-ng Version: 3.3.x Platform: All OS/Version: All Status: ASSIGNED Severity: major Priority: unspecified Component: syslog-ng AssignedTo: algernon(a)balabit.hu ReportedBy: algernon(a)balabit.hu Type of the Report: --- Estimated Hours: 0.0 With the glob-based @includes, we can silently ignore files that could not be opened, which can very well hide problems. Case in point: /etc/syslog-ng/conf.d/ with 0750 mode and a single file within it, syslog-ng.conf has @include "/etc/syslog-ng/conf.d/some-file.conf" In this case, we never see some-file.conf being tried, even though it is explicitly included (it still goes through the glob code), and glob() returns GLOB_NOMATCH, with errno set to EPERM. In this case, we should abort. An @include should only succeed if there was nothing to include (in case of a globby include), or if everything went well. That we can't read a file, is an error, and should be treated as such. (Via Yorick Peterse on twitter) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[Bug 206] New: program_override() and host_override() do not work in 3.4
by bugzilla＠bugzilla.balabit.com 27 Oct '12

27 Oct '12

https://bugzilla.balabit.com/show_bug.cgi?id=206 Summary: program_override() and host_override() do not work in 3.4 Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: ASSIGNED Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: algernon(a)balabit.hu ReportedBy: algernon(a)balabit.hu Type of the Report: --- Estimated Hours: 0.0 The *Options simplification change (d93d35857e3acac5eb59a9735d8947dedf43a511) broke host_override () & program_override (), because they host_override_len and program_override_len properties are no longer initialized to -1, but to 0, so when setting an override, a value with 0 length will be set, emptying the variable instead of setting it to a new value. This should be fairly easy to fix, this bug is a reminder for myself to not forget it. But if anyone happens to get around to submit a patch before I get there, so much the better! -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[PATCH 0/2]: afamqp: AMQP destination driver
by Gergely Nagy 27 Oct '12

27 Oct '12

The two patches that will follow implement an AMQP destination driver for syslog-ng, contributed by Attila Nagy <bra(a)fsn.hu>, with a few minor enhancements and porting to syslog-ng 3.4 by myself. The patch is also available on the feature/3.4/amqp[1] and feature/3.3/amqp[2] branches of my git repository, for syslog-ng 3.4 and 3.3 respectively. Functionally, they're exactly the same, but all further improvements and fixes will go to the 3.4 branch only, the 3.3 branch is there for testing and historical purposes only, and will be removed sometime after the driver gets merged to 3.4. Now, I won't explain in detail what AMQP is, let it suffice that it is a messaging protocol, of which RabbitMQ[3] is an implementation of. Interested people can read the available documentation, there's plenty! For now, lets concentrate on how to take the driver for a test drive! Once rabbitmq is installed (on debian and derivatives of recent versions it is as simple as apt-get install rabbitmq-server), all one needs to do, is configure syslog-ng to send messages, and grab a client that can look at the queue. For testing purposes, there's a simple one at https://gist.github.com/3859756 - you'll need a couple of python modules for that. What it does, is it sets up a queue named 'test', and binds it to the 'syslog' exchange (the default used by the AMQP driver), and starts consuming messages. It prints both headers and the payload (if any, by default, there is no payload). What one needs to know about the driver, is that it does not declare any queues: it's the responsibility of the admin to set queues up, and route messages as they see fit. This can be done on the RabbitMQ web admin interface (again, see the docs about that!), among other things, or programmatically, like the script above does. Hopefully, this is enough to get one started! If not, I plan to write a more detailed blog post about the topic in the not too distant future. There are plans to write an accompanying source driver too, but work has not started on that front yet. Rest assured though, it will come. I'd like to thank Attila again for contributing the driver, and answering my silly questions during review - both are much appreciated! [1]: https://github.com/algernon/syslog-ng/tree/feature/3.4/amqp [2]: https://github.com/algernon/syslog-ng/tree/feature/3.3/amqp [3]: http://www.rabbitmq.com/

2 3

[PATCH] logreader: When following a file, treat non-regular files specially
by Gergely Nagy 27 Oct '12

27 Oct '12

When following a file with follow-freq(), and it is not a regular file, but something for which stat(2) always returns 0 size (such as the /dev/klog character device on FreeBSD), log_reader_io_follow_file() never went into the process input branch, because the current position (0) was always at EOF (also 0). To break out of this unfortunate situation, if the file to read from is not a regular file, go into the process input loop anyway: at worst, it will do an expensive noop. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- lib/logreader.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/logreader.c b/lib/logreader.c index eb52330..1e2ea5e 100644 --- a/lib/logreader.c +++ b/lib/logreader.c @@ -276,7 +276,7 @@ log_reader_io_follow_file(gpointer s) evt_tag_int("size", st.st_size), NULL); - if (pos < st.st_size) + if (pos < st.st_size || !S_ISREG(st.st_mode)) { /* we have data to read */ log_reader_io_process_input(s); -- 1.7.10.4

2 1