- syslog-ng - lists.balabit.hu

[Bug 205] New: Docs for macro MSGHDR incorrect
by bugzilla＠bugzilla.balabit.com 10 Nov '12

10 Nov '12

https://bugzilla.balabit.com/show_bug.cgi?id=205 Summary: Docs for macro MSGHDR incorrect Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 The docs state; MSGHDR Description: The name and the pid of the program that sent the log message in PROGRAM: PID format. Includes a trailing whitespace. Note that the macro returns an empty value if both the program and pid fields of the message are empty. When this macro is used the format is PROGRAM[PID]: including a trailing space. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[Bug 204] New: dbparser docs not clear for @NUMBER@
by bugzilla＠bugzilla.balabit.com 10 Nov '12

10 Nov '12

https://bugzilla.balabit.com/show_bug.cgi?id=204 Summary: dbparser docs not clear for @NUMBER@ Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: packaging AssignedTo: folti(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 the @NUMBER@ parser should state that a leading minus sign is handled for non-hex numbers and that commas are not permitted. Alternatively, making @NUMBER@ accept commas would be nice, or allowing parameters for additional characters, although comma would be the only one I could think of. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

Debugging tools for syslog-ng
by Anton Koldaev 10 Nov '12

10 Nov '12

Hi, I wanted to know if syslog-ng developers has some tools like mysqltuner or just a shell scripts to check syslog-ng configuration and get some recommendations on tuning? There is a lot of information about all the buffers/window sizes, etc. and it's very complicated to set the proper values if I have a bunch of different sources/destinations. For example if I'm using flow-control+multiple destinations it can stop reading the source at any time and I have no idea when and why it's happening and which value should I tune. -- Best regards, Koldaev Anton

3 12

rsyslog client produces "Error processing log message"
by Andreas Heinlein 08 Nov '12

08 Nov '12

Hello, we have a centralised log server running syslog-ng 3.1 OSE on Debian 6.0. On the client side, we were using syslog-ng but now I'd like to use rsyslog instead (for several reasons). Transport should be TLS-encrypted TCP. I have set up a connection between the two, but apparently syslog-ng fails to parse the log messages sent by rsyslog. Every log line goes like this: Nov 6 11:15:31 admin2-desktop syslog-ng[1578]: Error processing log message: <13>Nov 6 11:15:31 admin2-desktop ah: Test4 Does anyone have an idea what to configure with either rsyslog or syslog-ng so the two understand each other? Relevant server side config: source s_all { syslog(ip(172.16.x.x) port(6514) max_connections(50) tls( key_file("/etc/ssl/private/xxx.pem") cert_file("/etc/ssl/private/xxx.pem") ca_dir("/etc/ssl/certs") peer_verify(optional-untrusted) ) ); }; Relevant client side config: $DefaultNetstreamDriverCAFile /etc/ssl/certs/xxx.pem $DefaultNetstreamDriver gtls # use gtls netstream driver $ActionSendStreamDriverMode 1 # require TLS for the connection $ActionSendStreamDriverAuthMode anon # server is NOT authenticated *.* @@(o)mail:6514;RSYSLOG_TraditionalForwardFormat # (o) seems to be neccessary or syslog-ng will not even accept the connection; RSYSLOG_TraditionalForwardFormat apparently doesn't matter Thanks, Andreas

3 7

syslog-ng Insider - November 2012
by Peter Czanik 08 Nov '12

08 Nov '12

Dear syslog-ng users, This is the 18th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com <mailto:documentation@balabit.com> FEATURED NEWS syslog-ng 3.3.7 is released --------------------------- Version 3.3.7 was released last week, right before the “All Saints Day” holidays. It has many fixes for FreeBSD, so it should compile with the bundled ivykis on FreeBSD 8 and 9. Patches to compile it on FreeBSD 7 will also be included in http://www.freshports.org/sysutils/syslog-ng/ Packages for all supported or development versions of openSUSE are also available: https://build.opensuse.org/project/show?project=home%3Aczanik%3Asyslog-ng33 Packages for Debian and Ubuntu are available at http://asylum.madhouse-project.org/projects/debian/ Announcement for 3.3.7: https://lists.balabit.hu/pipermail/syslog-ng/2012-October/019602.html syslog-ng @ conferences ----------------------- syslog-ng was presented at two conferences in October. Fedora users and developers gathered in Paris: https://czanik.blogs.balabit.com/2012/10/fudcon-fedora-and-syslog-ng/ while openSUSE, SLES and Gentoo developers had their conference in Prague at the technical university: https://czanik.blogs.balabit.com/2012/10/osc-opensuse-and-syslog-ng/ syslog-ng 3.4 news ------------------ Many new features were added during the previous month. AMQP destination, syslog parser, a couple of new parsers for patterndb contributed by Evan Rempel and a few more smaller features and fixes. For a complete list check https://github.com/balabit/syslog-ng-3.4/commits/master NEW RELEASES: * syslog-ng OSE 3.3.7: https://lists.balabit.hu/pipermail/syslog-ng/2012-October/019602.html ARCHIVE http://insider.blogs.balabit.com/ -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

Errors building syslog-ng-3.3.7 under FreeBSD 8.3
by C. L. Martinez 08 Nov '12

08 Nov '12

Hi all, I am trying to build syslog-ng 3.3.7 in a FreeBSD 8.3 i386 host, but make returns me these errors: syslog-ng Open Source Edition 3.3.7 configured Compiler options: compiler : gcc -std=gnu99 compiler options : -g -O2 -Wall -pthread -D_REENTRANT -I/usr/local/include/glib-2.0 -I/usr/local/include/eventlog -I/usr/local/include -I/usr/local/include -I$(top_srcdir)/lib/ivykis/lib/include -I$(top_builddir)/lib/ivykis/lib/include -I$(top_srcdir)/lib/ivykis/modules/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : prefix : /data/soft/syslog-ng linking mode : dynamic __thread keyword : yes Submodules: ivykis : internal libmongo-client : internal Features: Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : yes spoof-source support : yes tcp-wrapper support : yes Linux capability support : no PCRE support : yes Env wrapper support : no systemd support : no (unit dir: none) Modules: Module search path : /data/soft/syslog-ng/lib/syslog-ng Default module list : affile,afprog,afsocket,afuser,basicfuncs,csvparser,dbparser,syslogformat Sun STREAMS support (module): no SSL support (module) : yes SQL support (module) : no PACCT module (EXPERIMENTAL) : no MongoDB destination (module): yes JSON support (module) : no (using no) root@fbsd02:/tmp/u/syslog-ng-3.3.7# make make all-recursive Making all in lib "Makefile", line 1101: Need an operator make: fatal errors encountered -- cannot continue *** Error code 1 Stop in /tmp/u/syslog-ng-3.3.7. *** Error code 1 Stop in /tmp/u/syslog-ng-3.3.7 My package list: bison-2.5.1,1 A parser generator from FSF, (mostly) compatible with Yacc compat6x-i386-6.4.604000.200810_3 A convenience package to install the compat6x libraries eventlog-0.2.12 Replacement of the simple syslog() API providing structure flex-2.5.37 Fast lexical analyzer generator gamin-0.1.10_4 A file and directory monitoring system gettext-0.18.1.1 GNU gettext package gio-fam-backend-2.28.8_1 FAM backend for GLib\'s GIO library glib-2.28.8_4 Some useful routines of C programming (current stable versi gmake-3.82_1 GNU version of 'make' utility libee-0.3.2 An event expression library inspired by CEE libestr-0.1.2 A library for some string essentials libiconv-1.14 A character set conversion library libnet11-1.1.2.1_4,1 A C library for creating IP packets libsysinfo-0.0.2 GNU libc's sysinfo port for FreeBSD libtool-2.4.2 Generic shared library support script m4-1.4.16_1,1 GNU m4 openssl-1.0.1_4 SSL and crypto library pcre-8.31 Perl Compatible Regular Expressions library perl-5.14.2_2 Practical Extraction and Report Language pkgconf-0.8.8 pkg-config compatible utility which does not depend on glib python27-2.7.3_3 An interpreted object-oriented programming language

2 3

XML entities in PatternDB
by Martin Holste 08 Nov '12

08 Nov '12

I'm trying to find a way to use non-printable characters to delimit messages to avoid problems with escaping message delimiters. However, I'm having trouble representing any special characters in the patterndb.xml file. Specifically, I'd like to use characters like those found here: http://en.wikipedia.org/wiki/List_of_XML_and_HTML_character_entity_referenc… as U+200C. Trying to use the XML entity name, &zwnj; results in an error: "Entity name \'zwnj\' is not known." Is there a place that lists what entities are allowed in the XML? Thanks, Martin

2 1

Please help me on this error --- syslog-ng[4687]: Connection failed; error='Connection refused (111)', time_reopen='10' I don't see where is the problem
by Jian Zhu 05 Nov '12

05 Nov '12

Hi, Anyone know what does this mean? please help Oct 4 17:02:07 loghost syslog-ng[4687]: Connection failed; error='Connection refused (111)', time_reopen='10' I don't see where is the problem -- *Thanks & Best Regards* *James Zhu* *Mobile**:* *+86 18**6 8482 2818* *Email: *zhujian0805(a)gmail.com

2 2

syslog-ng 3.3.7 has been released
by devel＠balabit.hu 31 Oct '12

31 Oct '12

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.3.7 SUMMARY : new stable release DATE : Oct 30, 2012 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.3.7) has been released. For latest fixes in the 3.3.x feature branch you are recommended to upgrade to this version. CHANGES: 3.3.7 Wed, 31 Oct 2012 10:00:00 +0200 Highlights ========== This release is a bug-fix release, correcting a handful of issues discovered after the previous version was tagged. Bugfixes ======== * The bundled ivykis has been updated, fixing the following issues: * Fixed a Solaris-specific issue relating to TCP sources [#190] * Fixed a spinlock issue, triggered on at least FreeBSD [#193] * Workaround an issue with kqueue() on /dev/klog [#201] * The file source was corrected to properly handle character devices. This, and the ivykis update fixes a CPU spinning issue on FreeBSD. [#201] * The sun-streams module had a file descriptor leak, which has been corrected too. [#151] * The glob-based configuration file inclusion was fixed to behave similarly to including a whole directory, to include files alphabetically. [#191] The @include mechanism was also updated to not fail silently, but report an error in certain cases (such as permission errors, or missing files in case of an explicit, non-glob include). [#209] * Fixed a crash when trying to display the available modules in debug mode. [#189] * Fixed the building of afsocket-notls, so that it is correctly built without TLS support. [#188] * Fix compilation without spoof-source. [#192] * Avoid a feedback loop when emitting debug (and trace) messages. [#208] * Various minor fixes around the build system. Features ======== * The stats will now list the filename of unix domain sockets. [#195] Credits ======= syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Anton Koldaev <koldaevav(a)gmail.com> Attila Nagy <bra(a)fsn.hu> Balazs Scheidler <bazsi(a)balabit.hu> Cy Schubert <cy(a)FreeBSD.org> Dave Reisner <dreisner(a)archlinux.org> Evan Rempel <erempel(a)uvic.ca> Gergely Nagy <algernon(a)balabit.hu> Jose Pedro Oliveira <jpo(a)di.uminho.pt> Lennert Buytenhek <buytenh(a)wantstofly.org> Marvin Nipper <marvin.nipper(a)stream.com> Michael Hocke <michael.hocke(a)nyu.edu> Peter Czanik <czanik(a)balabit.hu> Tamas Pal <folti(a)balabit.hu> Yorick Peterse DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

3 2

[Bug 203] New: patterndb rule tag can not have a hyphen in the class attribute
by bugzilla＠bugzilla.balabit.com 28 Oct '12

28 Oct '12

https://bugzilla.balabit.com/show_bug.cgi?id=203 Summary: patterndb rule tag can not have a hyphen in the class attribute Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 Just seems odd that the rule tag can not have a hyphen in the class attribute. The error is element rule: Schemas validity error : Element 'rule', attribute 'class': [facet 'pattern'] The value 'sm-mta' is not accepted by the pattern '[a-zA-Z0-9_\.]+'. I would expect (and prefer) that the pattern should be '[a-zA-Z0-9_/\.+:-]' <ruleset name="sm-mta" id="RS-8e86ff39-2db4-48b6-bbe0-f980d9afebf0"> <pattern>sm-mta</pattern> <rules> <rule id="8e86ff39-2db4-48b6-bbe0-f980d9afebf0" class="sm-mta" provider="UVic"> <patterns> <pattern>whatever pattern</pattern> </patterns> </rule> </rules> </ruleset"> will reproduce this error. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

6 16