- syslog-ng - lists.balabit.hu

Installation Error
by kibirango moses 28 Jul '12

28 Jul '12

Hullo users, I am installing syslog-ng ver.3.3.5 on slackware linux 13.1 and i am getting the errors below, when i do a make usr/lib64/gcc/x86_64-slackware-linux/4.4.4/../../../../x86_64-slackware-linux/bin/ld: /usr/local/lib64/libssl.a(s23_srvr.o): relocation R_X86_64_32 against `.rodata' can not be used when making a shared object; recompile with -fPIC /usr/local/lib64/libssl.a: could not read symbols: Bad value Could somebody helpme with a fix to the problem thanx in advnace

2 1

Logging To MongoDB and specifying data types
by Michael Dillon 27 Jul '12

27 Jul '12

I'm using the syslog-ng windows client to forward IIS logs to syslog-ng. I'm using the CSV parser to split it into pairs and pick and choose my pairs. I'm not able to figure out how to insert a field from these pairs (or any others) into MongoDB as a date time field. They are being stored as strings. Also I'd like to store quite a few of the other columns/elements as integers. Obviously I could run a job to do conversions after they are inserted into the database I'd just hate to setup a rube golberg machine if I don't have to. -- Michael Dillon

2 1

Able to connect but not logging
by kibirango moses 27 Jul '12

27 Jul '12

Hullo Users; I am using syslog-ng 3.3.4 and my client is able to connect but not logging to the central logging server. my syslog-ng.conf on server side is @version: 3.3 # Default syslog-ng configuration for Slackware # For info about the format of this file, see "man syslog-ng.conf" # Converted from sysklogd (syslog.conf) by mario(a)slackverse.org options { flush_lines (0); time_reopen (10); time_reap(360); # log_fifo_size (10240); # log_msg_size (8192); chain_hostnames (no); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); owner("root"); group("root"); dir_owner(root); # dir_group(logs); dir_perm(0750); perm(0640); stats_freq (3600); check_hostname (yes); dns_cache (yes); threaded(yes); mark_freq(600); }; source system { internal(); unix-stream("/dev/log"); udp(); tcp(max_connections(100)); }; filter f_messages { level(info,notice) and not facility(authpriv,cron,mail,news); }; filter f_syslog { level(warn..emerg) and not facility(authpriv,cron,mail,news); }; filter f_debug { level(debug); }; filter f_authpriv { facility(authpriv); }; filter f_cron { facility(cron); }; filter f_mail { facility(mail); }; filter f_emerg { level(emerg); }; filter f_uucp { facility(uucp); }; destination d_messages { file("/var/log/messages"); }; destination d_syslog { file("/var/log/syslog"); }; destination d_debug { file("/var/log/debug"); }; destination d_secure { file("/var/log/secure"); }; destination d_cron { file("/var/log/cron"); }; destination d_maillog { file("/var/log/maillog"); }; destination d_usertty { usertty("*"); }; destination d_spooler { file("/var/log/spooler"); }; # Log anything 'info' or higher, but lower than 'warn'. # Exclude authpriv, cron, mail, and news. These are logged elsewhere. log { source(system); filter(f_messages); destination(d_messages); }; # Log anything 'warn' or higher. # Exclude authpriv, cron, mail, and news. These are logged elsewhere. log { source(system); filter(f_syslog); destination(d_syslog); }; # Debugging information is logged here. log { source(system); filter(f_debug); destination(d_debug); }; # Private authentication message logging: log { source(system); filter(f_authpriv); destination(d_secure); }; # Cron related logs: log { source(system); filter(f_cron); destination(d_cron); }; # Mail related logs: log { source(system); filter(f_mail); destination(d_maillog); }; # Emergency level messages go to all users: log { source(system); filter(f_emerg); destination(d_usertty); }; # This log is for news and uucp errors: log { source(system); filter(f_uucp); destination(d_spooler); }; # Uncomment this to see kernel messages on the console. #filter f_kern { facility(kern); }; #destination d_console { file("/dev/console"); }; #log { source(system); filter(f_kern); destination(d_console); }; # Uncomment these if you'd like INN to keep logs on everything. # You won't need this if you don't run INN (the InterNetNews daemon). #filter f_news_crit { facility(news) and level(crit); }; #filter f_news_err { facility(news) and level(err); }; #filter f_news_notice { facility(news) and level(notice); }; #destination d_news_crit { file("/var/log/news/news.crit"); }; #destination d_news_err { file("/var/log/news/news.err"); }; #destination d_news_notice { file("/var/log/news/news.notice"); }; #log { source(system); filter(f_news_crit); destination(d_news_crit); }; #log { source(system); filter(f_news_err); destination(d_news_err); }; #log { source(system); filter(f_news_notice); destination(f_news_notice); }; # Remote logging source s_remote { tcp(ip(0.0.0.0) port(514)); udp(ip(0.0.0.0) port(514)); }; destination logpile { file("/var/log/$HOST/$YEAR/$MONTH/$FACILITY.$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) create_dirs(yes) dir_perm(0700)); }; log { source(system); destination(logpile); }; Cleint syslog-ng.conf I just added the lines belo to the server file above # Remote logging destination logpile { file("/var/log/$HOST/$YEAR/$MONTH/$FACILITY.$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) create_dirs(yes) dir_perm(0700)); }; destination remote { tcp("196.43.133.98" port(514)); }; log { source(system); destination(logpile); }; log { source(system); destination(remote); }; testing for connection root@client:/# lsof -i | grep syslog-ng syslog-ng 18339 root 9u IPv4 37485820 0t0 UDP *:syslog syslog-ng 18339 root 10u IPv4 37485822 0t0 TCP *:shell (LISTEN) syslog-ng 18339 root 11u IPv4 37485824 0t0 TCP client:48305-> syslog server:shell (ESTABLISHED) I am not seeing any logging being registered . How can i solve this and where have i gone wrong. Thanx i advance

2 1

[Bug 187] New: Syslog-ng truncates SDATA PARAM VALUE to 256 chars
by bugzilla＠bugzilla.balabit.com 27 Jul '12

27 Jul '12

https://bugzilla.balabit.com/show_bug.cgi?id=187 Summary: Syslog-ng truncates SDATA PARAM VALUE to 256 chars Product: syslog-ng Version: 3.2.x Platform: All OS/Version: All Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: cloun-rulez(a)yandex.ru QAContact: cloun-rulez(a)yandex.ru Type of the Report: enhancement Estimated Hours: 0.0 As you can see there are no limitations of SDATA PARAM VALUE length in rfc5424 http://tools.ietf.org/html/rfc5424 As I have saw in tests/unit/test_msgparse.c this is default behavior of syslog-ng. // too long sdata value gets truncated testcase("<132>1 2006-10-29T01:59:59.156+01:00 mymachine evntslog - - [a i=\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"] An application event log entry...", LP_SYSLOG_PROTOCOL, NULL, 132, // pri 1162083599, 156000, 3600, // timestamp (sec/usec/zone) "mymachine", // host "evntslog", //app "An application event log entry...", // msg "[a i=\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"]", //sd_str "",//processid "",//msgid expected_sd_pairs_test_5b ); I'm trying to increase limit of truncation but still haven't success. Need help. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

non-UTF-8 data in mongodb
by Lucas, Sascha 25 Jul '12

25 Jul '12

Hi, I was looking for a way to have some log-rotate functionality (move logs older then x into another collection). I heard of TTL collections, which is fine for deletion. To keep collections small, I tried following mongo-shell code: for( var c = db.messages.find({DATE: {$lt: "1342688698"}}); c.hasNext(); ) { db.messages.old.save(c.next()); } Being totally new to mongodb, I don’t know if this is the right solution, however I got the following error: Mon Jul 23 12:30:34 decode failed. probably invalid utf-8 string [opx2 opx2-dispatch.exe(8100) 2 OPX-20001 Attempt to do an array operation on #26\META-SUPER-HYPER-� which is not an array.] Mon Jul 23 12:30:34 why: TypeError: malformed UTF-8 character sequence at offset 98 Mon Jul 23 12:30:34 Error: invalid utf8 shell/collection.js:128 Asking on mongodb-user Tad Marshall explained that running mongodb with --objcheck prevents this problem. The mogodb config file has following comment: # Inspect all client data for validity on receipt (useful for # developing drivers) #objcheck = true Is the syslog-ng shipped driver the root cause? Should syslog-ng utf8-encode the strings? Is this a bug, or do I miss something? TIA, Sascha. Vorsitzender des Aufsichtsrates: Ralf Hiltenkamp Geschäftsführung: Michael Krüger (Sprecher), Stephan Drescher Sitz der Gesellschaft: Halle/Saale Registergericht: Amtsgericht Stendal | Handelsregister-Nr. HRB 208414 UST-ID-Nr. DE 158253683 Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Empfänger sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail oder des Inhalts dieser Mail sind nicht gestattet. Diese Kommunikation per E-Mail ist nicht gegen den Zugriff durch Dritte geschützt. Die GISA GmbH haftet ausdrücklich nicht für den Inhalt und die Vollständigkeit von E-Mails und den gegebenenfalls daraus entstehenden Schaden. Sollte trotz der bestehenden Viren-Schutzprogramme durch diese E-Mail ein Virus in Ihr System gelangen, so haftet die GISA GmbH - soweit gesetzlich zulässig - nicht für die hieraus entstehenden Schäden.

2 2

Glob character ranges
by T. A. Smooth 24 Jul '12

24 Jul '12

Any one have an example of a glob character range for matching a value? match("*[0-9]" value ("MSG") type ("glob") ) The above should match Dog 1 Dog 2 Dog 3

5 7

Syslog-ng MongoDB inserting date data type
by Michael Dillon 24 Jul '12

24 Jul '12

I'm using Epilog (Snare) to push syslog messages from my IIS logs to syslog-ng. I'm using the CSV parser to parse the message body and create nv pairs. I can't seem to figure out how to get the messages inserted with a datetime data type. Any insights? -- Michael Dillon

2 1

prevent duplicate messages in logs
by Sergey Naumov 23 Jul '12

23 Jul '12

Hello. I would like to ask what mechanism syslog-ng provides to prevent duplicate messages in a log. In most common scenarios I can use "final" flag, for example, when I want only logging on a local machine (so when I have a single destination). But imagine, that user can specify any combination of facilities/priorities and destinations, for example, user want to log auth/>=info and all/>=notice to local machine and auth/>=debug to remote. Then I have a problem: I can't use "final" flag for these entries, because some messages (say auth/>=info) will not be logged to remote host, but only auth/debug, and if I don't use final flag, there will be duplicates of all auth/>=notice messages in the local log. Is there a way to solve this problem in general? One way is to make a separate log entry for each facility/priority combination and group all destinations there, but it won't work if user specify some additional custom filters. Thanks in advance, Sergey Naumov.

2 2

Question regarding lib/nvtable.c (FAIL: test_nvtable)
by John Skopis 20 Jul '12

20 Jul '12

Hello, I just tried to rebuild the EPEL6 SRPM for syslog-ng. The build fails on make check because the test_nvtable test fails. Forgive me if the solution has already been posted. I was able to find a post, but it linked to a few RH bugs suggesting improper use of g_hash_table_insert in nv_registry_alloc_handle(nvtable.c). I looked at nvtable.c and noticed the hash is created: g_hash_table_new_full(g_str_hash, g_str_equal, NULL, NULL) Then, in nv_registry_free: for (i = 0; i < self->names->len; i++) g_free(g_array_index(self->names, NVHandleDesc, i).name); g_array_free(self->names, TRUE); I am wondering if there is a good reason not to pass in g_free as the "key_destroy_func" to g_hash_table_new_full (http://developer.gnome.org/glib/2.29/glib-Hash-Tables.html#g-hash-table-new…) ? Thanks, John

1 0

what's next for syslog-ng?
by Peter Czanik 20 Jul '12

20 Jul '12

Hello, It was in last weeks syslog-ng newsletter, but as I'd like to see more input, I post it again: Sources for some previously Premium Edition-only features have been available for a while now, but have not been merged into the Open Source Edition yet. As we want to release OSE 3.4 soon, we are unlikely to have the necessary resources to merge all of these. We would like to ask Your opinion on which of these features would you like to see in the upcoming release. Please vote and share your reasoning in the BalaBit community forum at http://communities.balabit.com/balabit/topics/poll_which_of_these_features_… Thanks for your feedback in these hot summer days! :) Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

2 2