- syslog-ng - lists.balabit.hu

[PATCH (3.4)] jsonparser: Clone the marker() setting when cloning the parser
by Gergely Nagy 18 Aug '12

18 Aug '12

Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/jsonparser/jsonparser.c | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/jsonparser/jsonparser.c b/modules/jsonparser/jsonparser.c index 7331ad9..891b9f0 100644 --- a/modules/jsonparser/jsonparser.c +++ b/modules/jsonparser/jsonparser.c @@ -201,6 +201,7 @@ log_json_parser_clone (LogPipe *s) cloned = (LogJSONParser *) log_json_parser_new (); log_json_parser_set_prefix ((LogParser *)cloned, self->prefix); + log_json_parser_set_marker ((LogParser *)cloned, self->marker); return &cloned->super.super; } -- 1.7.10

2 2

[PATCH (3.4)] afsmtp: Fix the module linkage
by Gergely Nagy 18 Aug '12

18 Aug '12

Use $(MODULE_DEPS_LIBS) and $(MODULE_LDFLAGS) instead of trying to grab all the libs. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/afsmtp/Makefile.am | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/afsmtp/Makefile.am b/modules/afsmtp/Makefile.am index bb5b94d..34c0e98 100644 --- a/modules/afsmtp/Makefile.am +++ b/modules/afsmtp/Makefile.am @@ -6,10 +6,10 @@ export top_srcdir if ENABLE_SMTP module_LTLIBRARIES = libafsmtp.la -libafsmtp_la_CFLAGS = $(LIBESMTP_CFLAGS) $(IVYKIS_CFLAGS) $(EVENTLOG_CFLAGS) $(SYSLOG_NG_CFLAGS) +libafsmtp_la_CFLAGS = $(LIBESMTP_CFLAGS) libafsmtp_la_SOURCES = afsmtp-grammar.y afsmtp.c afsmtp.h afsmtp-parser.c afsmtp-parser.h -libafsmtp_la_LIBADD = $(LIBESMTP_LIBS) $(IVYKIS_LIBS) $(EVENTLOG_LIBS) $(SYSLOG_NG_LIBS) -libafsmtp_la_LDFLAGS = -avoid-version +libafsmtp_la_LIBADD = $(LIBESMTP_LIBS) $(MODULE_DEPS_LIBS) +libafsmtp_la_LDFLAGS = $(MODULE_LDFLAGS) endif -- 1.7.10.4

2 1

[Bug 62] PROGRAM macro problem
by bugzilla＠bugzilla.balabit.com 18 Aug '12

18 Aug '12

https://bugzilla.balabit.com/show_bug.cgi?id=62 Gergely Nagy <algernon(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |algernon(a)balabit.hu Resolution| |FIXED Status|NEW |RESOLVED --- Comment #4 from Gergely Nagy <algernon(a)balabit.hu> 2012-08-18 13:26:40 --- syslog-ng 3.4 has a $(sanitize) template function, which will replace "/" with "_", so this issue can be considered resolved, I believe. The same function can be configured to replace parens and pretty much anything else too, if so need be. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[PATCH 0/1] [RESEND] libmongo-client: Add support for Unix sockets
by Conrad Hoffmann 16 Aug '12

16 Aug '12

Hey once more. Here is a first revision of my earlier patch. Changes to last version: - Better error handling/input checking (thanks to Balazs for the feedback) - Free everything that was allocated before bailing out after errors - Some style fixes, hope it's ok now Further feedback welcome! Conrad Hoffmann (1): Add support for Unix sockets. examples/mongo-dump.c | 22 +++++++++++++++++----- src/mongo-client.c | 39 +++++++++++++++++++++++++++++++++++++++ src/mongo-client.h | 12 ++++++++++++ src/mongo-sync.c | 23 +++++++++++++++++++++++ src/mongo-sync.h | 15 +++++++++++++++ 5 files changed, 106 insertions(+), 5 deletions(-) -- 1.7.11.4

2 7

Compiling 3.4
by Conrad Hoffmann 14 Aug '12

14 Aug '12

Greetings! I am having some difficulties compiling current master (at the time of this writing) of syslog-ng 3.4. The first error is this: filter-expr-parser.c:30:5: error: conflicting types for 'filter_expr_parse' In file included from filter-expr-parser.c:27:0: filter-expr-grammar.h:404:5: note: previous declaration of 'filter_expr_parse' was here make[4]: *** [filter-expr-parser.lo] Error Now, at first I thought, since filter-expr-grammar.h is generated, it might have something to do with my bison version or the likes. But then I realized that the offending declaration in filter-expr-parser.c:30: int filter_expr_parse(CfgLexer *lexer, FilterExprNode **node); directly contradicts its use int the same file below (line 74): .parse = (gint (*)(CfgLexer *, gpointer *, gpointer)) filter_expr_parse, filter-expr-parser.c is not generated, so I don't quite get how this compiles at all for anyone? Am I missing something? The actual usage (line 74) matches the generated declaration, so I can just comment out the offending one in line 30. But I suspect this it not how it's supposed to work... Same thing happens for parser-expr-parser and rewrite-expr-parser... Thanks for any hints, Conrad

3 5

phpsyslogng-2.8.
by Jose Aguero M. 14 Aug '12

14 Aug '12

Hi all: I have installed ubuntu server with syslog-ng 2.8, but I need to know how to install a client on linux centos. I need help thanks

2 1

[PATCH] [0/1] libmongo-client: add support for Unix sockets
by Conrad Hoffmann 14 Aug '12

14 Aug '12

Greetings! This is patch agains the master branch of syslog-ng-3.4. It's more of a proof-of-concept thing, but in a quick session I put support for Unix sockets into libmongo-client. It may not be stunningly beautiful, but I actually used it (along with a second patch, which I will send shortly) to have syslog-ng write to mongodb via a Unix socket. I realize libmongo-client is also on GitHub, but the submodule pointed to a different repo, so I decided to just dump this here. :) If you have any interest at all, I could also clean this up some more. Maybe split across two commits, too. Let me know. Conrad Hoffmann (1): Add support for Unix sockets. examples/mongo-dump.c | 22 +++++++++++++++++----- src/mongo-client.c | 40 ++++++++++++++++++++++++++++++++++++++++ src/mongo-client.h | 12 ++++++++++++ src/mongo-sync.c | 23 +++++++++++++++++++++++ src/mongo-sync.h | 15 +++++++++++++++ 5 files changed, 107 insertions(+), 5 deletions(-) -- 1.7.11.4

3 3

3.4 alpha: Deadlock in MongoDB plugin?
by Conrad Hoffmann 14 Aug '12

14 Aug '12

Hi, it's me bugging again :) (btw, I'm on the list, no need to CC me) In my quest to test my patches with the actual 3.4 version syslog, I noticed today that the mongodb plugin doesn't seem to work very at all on todays master branch (vanilla, without any patches). No log messages are ever written to the DB, and after a few messages syslog locks up. The mongodb threads seems to idle in its normal event loop while the main thread seems to be stuck in some afmongodb-related lock. Once again, I need to go to bed before I can take a closer look, but I just thought I'd let you know. Find here a backtrace of the main thread in the state it is stuck in: http://pastebin.com/QZSam3CH At the bottom is also the backtrace for the mongodb thread, as far as I can tell it looks as always. Good night for now, Conrad

2 4

[PATCH] [0/1] Allow mongodb destination to use Unix sockets
by Conrad Hoffmann 12 Aug '12

12 Aug '12

As promised this is actually the second part of the previous patch, but since the other one was for a different repo I decided to keep them seperate. Yet, this one depends on the former. This patch is also for syslog-ng-3.4, master branch. Like I mentioned, I already used Unix sockets successfully, though I must add that this was with a modified version of the path for syslog-ng-3.3, because I had trouble getting 3.4 to work at all. I will take another look at this tomorrow, but maybe you can give some feedback already? Conrad Hoffmann (1): Allow Unix sockets for MongoDB connection. modules/afmongodb/afmongodb-grammar.ym | 2 ++ modules/afmongodb/afmongodb-parser.c | 1 + modules/afmongodb/afmongodb.c | 25 +++++++++++++++++++++---- modules/afmongodb/afmongodb.h | 1 + 4 files changed, 25 insertions(+), 4 deletions(-) -- 1.7.11.4

3 4

[PATCH] tfhash: New template function to calculate the SHA1 of its input
by Peter Gyongyosi 12 Aug '12

12 Aug '12

tfhash: New template function to calculate the SHA1 of its input This patch adds a new template function called $(hash) which can be used to calculate the SHA1 hash of its inputs. As it uses the SHA1() function from OpenSSL, it is only available if syslog-ng is compiled using --enable-ssl. One use case for it can be when you'd like to anonymize sensitive parts of the log message (eg. the user name) you parsed out using patterndb before storing or forwarding it for further analysis but would like to retain the ability to correlate messages along this value. Beware though that such simple anonymization can be broken if there's enough data available, see http://arxiv.org/pdf/cs/0610105v2.pdf for references and examples. Thanks for the original idea to Martin Grauel. Signed-off-by: Peter Gyongyosi <gyp(a)balabit.hu> --- [see the patch itself at https://github.com/gyp/syslog-ng-3.4/commit/5c6e97d94694eef2aa76fa61a1c8928… ] <https://github.com/gyp/syslog-ng-3.4/commit/5c6e97d94694eef2aa76fa61a1c8928…>

5 12