- syslog-ng - lists.balabit.hu

.
by pedro castro 22 May '12

22 May '12

You can earn today money using your computer http://www.lekhajokha.in/hfdno.php?iriIDCid=855 Tue, 22 May 2012 13:59:18 ______________ That birds which fly with flapping wings derivetheir support from the air, is undoubtedly true,and that the lift produced is due, not to the form,or shape, or area of the wing, is also beyond question. jalyne aescleah

1 0

...
by pedro castro 21 May '12

21 May '12

Make aIot of money right from your PC http://kacchemicals.com/uuioino.php?ynenumberID=309 _______________ 126 86 36. emmett winefrith Sun, 20 May 2012 23:37:06

1 0

Rewriting CEF messages
by carlopmart 19 May '12

19 May '12

Hi all, I am trying to rewrite CEF messages that arrives to a syslog-ng instance. I am using the following rewrite rule: rewrite r_cef_logs { set("mydevice_logs", value("PROGRAM") condition(message("Device"))); }; Test message is: CEF:0|Device|Firewall|0|.... What am I doing wrong?? -- CL Martinez carlopmart {at} gmail {d0t} com

1 0

Introducing myself and GSoC syslog-ng MongoDB driver project
by Eun Kyung 18 May '12

18 May '12

Greetings, fellow developers. I recently joined the syslog-ng community because of Google Summer of Code, and I thought this would be a good time to briefly introduce myself. I am studying Information Technology in Dublin, Ireland, and I got accepted for GSoC 2012 to work on the MongoDB destination driver project. Syslog-ng, the leading logging platform for log collection and management, has been storing logs in MongoDB for over a year, but the technical documentation on the implementation is rudimentary, which impedes the improvement of the driver's functionality and speed. The goal of this project is to enhance the MongoDB destination driver for syslog-ng, to make it more robust, scalable and performant. Specific tasks and deliverables will include: - modifying syslog-ng's internal value pairs subsystem so that it will be able to emit a tree of values, instead of just a flat name:value list; - teaching the mongodb driver to walk the tree, and constructing BSON objects out of it, and using 'insert' instead of 'upsert'; - adding support for bulk inserts into a MongoDB, instead of inserting one by one My GSoC project proposal can be found at https://google-melange.appspot.com/gsoc/proposal/review/google/gsoc2012/eky… This is my first time working on an open source project, and I've liked a lot so far. My mentor has been tremendously friendly and helpful. I'm looking forward to a great summer of code with the syslog-ng community, and I would certainly like to keep you posted on the discussions and patches I will be making. Meanwhile, your comments and feedback would always be helpful. Best regards, Eun Kyung

1 0

receiving and forwarding snmp data
by Jason Kojro-Badziak 18 May '12

18 May '12

Hello all: I would like to use Syslog-NG to forward SNMP formatted data, in particular SNMP traps and some other SNMP data streams. I've been doing a lot of looking around today, and I've a few sites that have some recommended ways of doing things, but I'm wondering if anyone on this list has a tried and true way of doing it. Thank you! Jason Kojro-Badziak Monolith Software Staff Engineer 311 North 2nd Street, Suite #302 St. Charles, IL 60174 Office: 312-957-6470 x3010 Email: jbadziak(a)monolith-software.com<mailto:jbadziak@monolith-software.com/jb.022411>

2 1

[PATCH] jsonparser: Handle every kind of invalid input gracefully
by Gergely Nagy 18 May '12

18 May '12

Previously, we used json_tokener_parse_ex(), which always returned NULL in case of an error. A while ago, we switched to json_tokener_parse() instead, which never returns NULL, and instead, modifies the returned object to be an integer casted to pointer in case of an error. This resulted in the json-parser segfaulting whenever it encountered invalid input. The best course of action is to switch back to json_tokener_parse_ex(), because that way we can easily see when an error happened, and we even have easy access to the error message. In the long run, we should probably move back the tokener to the LogJSONParser object, and protect it with a mutex, for a bit better performance. Reported-by: Eun Kyung <ekyung01(a)googlemail.com> Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/jsonparser/jsonparser.c | 12 +++++++++++- 1 files changed, 11 insertions(+), 1 deletions(-) diff --git a/modules/jsonparser/jsonparser.c b/modules/jsonparser/jsonparser.c index 7331ad9..d95b0e2 100644 --- a/modules/jsonparser/jsonparser.c +++ b/modules/jsonparser/jsonparser.c @@ -166,6 +166,7 @@ log_json_parser_process (LogParser *s, LogMessage **pmsg, const LogPathOptions * { LogJSONParser *self = (LogJSONParser *) s; struct json_object *jso; + struct json_tokener *tok; if (self->marker) { @@ -177,7 +178,16 @@ log_json_parser_process (LogParser *s, LogMessage **pmsg, const LogPathOptions * input++; } - jso = json_tokener_parse (input); + tok = json_tokener_new (); + jso = json_tokener_parse_ex (tok, input, -1); + if (tok->err != json_tokener_success) + { + msg_error ("Unparsable JSON stream encountered", + evt_tag_str ("error", json_tokener_errors[tok->err]), NULL); + json_tokener_free (tok); + return FALSE; + } + json_tokener_free (tok); if (!jso) { -- 1.7.9

1 0

[PATCH] afmongodb: Fix a queue notify<->wakeup deadlock
by Gergely Nagy 18 May '12

18 May '12

As it turns out, there's a race condition between afmongodb_dd_queue_notify() and the worker thread: one is trying to lock queue_mutex to send a wakeup signal and clear the notification callback, and the other is using g_cond_wait() with the same queue_mutex locked around it. There appears to be a race between the two threads, and it can happen that both are trying to g_mutex_lock() the same mutex at the same time. To work around this problem, the patch below removes the queue_mutex locking from dd_queue_notify(): it's not required anyway. But it also moves the log_queue_reset_parallel_push() from the queue notify function to the other thread, where we're already holding the mutex after the g_cond_wait() anyway. (And do something similar in the suspend wakeup case too, where locking queue_mutex is also safe). This gets rid of the deadlock, and the code becomes easier to follow aswell. Reported-by: Eun Kyung <ekyung01(a)googlemail.com> Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/afmongodb/afmongodb.c | 7 ++++--- 1 files changed, 4 insertions(+), 3 deletions(-) diff --git a/modules/afmongodb/afmongodb.c b/modules/afmongodb/afmongodb.c index 5af34c9..7a1b6e2 100644 --- a/modules/afmongodb/afmongodb.c +++ b/modules/afmongodb/afmongodb.c @@ -388,6 +388,9 @@ afmongodb_worker_thread (gpointer arg) self->suspend_mutex, &self->writer_thread_suspend_target); self->writer_thread_suspended = FALSE; + g_mutex_lock(self->queue_mutex); + log_queue_reset_parallel_push(self->queue); + g_mutex_unlock(self->queue_mutex); g_mutex_unlock(self->suspend_mutex); } else @@ -398,6 +401,7 @@ afmongodb_worker_thread (gpointer arg) if (log_queue_get_length(self->queue) == 0) { g_cond_wait(self->writer_thread_wakeup_cond, self->queue_mutex); + log_queue_reset_parallel_push(self->queue); } g_mutex_unlock(self->queue_mutex); } @@ -560,10 +564,7 @@ afmongodb_dd_queue_notify(gpointer user_data) { MongoDBDestDriver *self = (MongoDBDestDriver *)user_data; - g_mutex_lock(self->queue_mutex); g_cond_signal(self->writer_thread_wakeup_cond); - log_queue_reset_parallel_push(self->queue); - g_mutex_unlock(self->queue_mutex); } static void -- 1.7.9

1 0

LogZilla v4.0
by Clayton Dukes 17 May '12

17 May '12

Hi Everyone, Just wanted to let you all know that I have released v4.0. This new version includes some features that many of the users on the syslog-ng list asked for, so I wanted to share the good news :-) Here's more info on this release: http://www.logzilla.pro/news/releases/4.0 ______________________________________________________________ Clayton Dukes ______________________________________________________________

1 0

Re: [syslog-ng] issue during start up
by Lay, James 16 May '12

16 May '12

Hello all: I am afraid I am having another issue which I would like some help with. When I try to start syslog-ng, I am getting this error: Starting syslog-ng: Error initializing raw socket, spoof-source support disabled; Syslog-ng then starts, but it doesn't appear to be forwarding messages. This is extremely strange as I have syslog-ng installed and running with the exact same config file on another system without any issues. I am sure the problem is that I'm an idiot, but I would greatly appreciate any help with the error I am having. Thank you! Try doing a: ldd `which syslog-ng` on both boxes....see if they are different. James

3 4

Problem with Syslog-NG 3.2.5 on Aix 7.1 ... It coredumps..
by Jonathan Kaufman 16 May '12

16 May '12

Hello All, I am hoping someone out there has a working installation of 3.2.5 on Aix 7.1 and can help me get mine working. I am currently trying to use a self-compiled version of 3.2.5 on an Power7 CPU Aix 7.1 TL1 SP3 box. I was able to get Syslog-NG to compile on Aix 7.1 after I mangled a new libtool release into the source so it would compile shared objects. Unfortunately, when I start syslog-ng it core dumps repeatedly. Core dumps start filling up /sftw/syslog-ng/var and a ps -ef shows only the "supervising syslog-ng process". a dbx syslog-ng gives this output... [root@mlwitt71]:[/sftw/syslog-ng/sbin] > dbx syslog-ng Type 'help' for help. [using memory image in core.10092546.01150742] reading symbolic information ... Segmentation fault in alloca at 0xd2970930 ($t1) 0xd2970930 (alloca+0x8) 800c0000 lwz r0,0x0(r12) (dbx) where alloca() at 0xd2970930 evt_str_append_escape_bs() at 0xd2970520 evtrec_format_plain() at 0xd296feb4 evt_format() at 0xd2970104 msg_event_send(e = 0x00000005), line 166 in "messages.c" main_loop_run(cfg = (nil)), line 148 in "main.c" main(argc = 1, argv = 0x2ff227f4), line 470 in "main.c" (dbx) I have also tried using the Syslog-ng rpm's from perzl & Bull. Both of them core dump as well, so I went back to trying to get a self-compiled release to work as I have some control over that. I used IBM VisualAge C/C++ v11.1.0.9 as the C compiler. [root@mlwitt71]:[/sftw/syslog-ng/sbin] > lslpp -L | grep vac vac.Bnd 11.1.0.1 C F XL C for AIX Media Defined vac.C 11.1.0.9 C F IBM XL C Compiler vac.aix53.lib 11.1.0.9 C F XL C for AIX Libraries for AIX vac.include 11.1.0.9 C F IBM XL C Compiler Include vac.lib 11.1.0.9 C F XL C for AIX Libraries vacpp.Bnd 11.1.0.1 C F IBM XL C/C++ Media Defined vacpp.cmp.aix53.lib 11.1.0.9 C F IBM XL C/C++ Libraries for AIX vacpp.cmp.core 11.1.0.9 C F IBM XL C/C++ Compiler vacpp.cmp.include 11.1.0.9 C F IBM XL C/C++ Compiler Include vacpp.cmp.lib 11.1.0.9 C F IBM XL C/C++ Libraries vacpp.cmp.rte 11.1.0.9 C F IBM XL C/C++ Compiler vacpp.cmp.tools 11.1.0.9 C F IBM XL C/C++ Tools vacpp.tnb 11.1.0.1 C F IBM XL C/C++ Evaluation I mangled libtool 2.4.2 into the source directories so it would detect/compile shared libraries (it wouldn't otherwise). I compiled and installed eventlog 0.2.12 in /sftw/syslog-ng, I also compiled OpenSSL 1.0.0g into it staticly. I am initially trying to start it using the default configuration files. There were no errors during the compile, and a syslog-ng -s did NOT coredump. I believe syslog-ng is using the following libraries and their locations (dynamically linked). [root@mlwitt71]:[/sftw/syslog-ng/sbin] > ldd syslog-ng syslog-ng needs: /sftw/syslog-ng/lib/libsyslog-ng.a(libsyslog-ng.so.0) /usr/lib/libnsl.a(shr.o) /opt/freeware/lib/libgmodule-2.0.so /opt/freeware/lib/libglib-2.0.so /usr/lib/libpthread.a(shr_xpg5.o) /usr/lib/libc.a(shr.o) /sftw/syslog-ng/lib/libevtlog.a(libevtlog.so.0) /usr/lib/librtl.a(shr.o) /opt/freeware/lib/libpcre.a(libpcre.so.0) /usr/lib/libthread.a(shr.o) /usr/lib/libpthreads_compat.a(shr.o) /usr/lib/libpthreads.a(shr_xpg5.o) /usr/lib/libtli.a(shr.o) /opt/freeware/lib/libglib-2.0.a(libglib-2.0.so.0) /opt/freeware/lib/libintl.a(libintl.so.1) /usr/lib/libiconv.a(shr4.o) /usr/lib/libpthreads.a(shr_comm.o) /unix /usr/lib/libcrypt.a(shr.o) /usr/lib/libpthreads.a(shr.o) /usr/lib/libc.a(pse.o) and the configure command when compiling from source was: ./configure --prefix=/sftw/syslog-ng \ --disable-spoof-source \ --enable-dynamic-linking \ --enable-debug \ --enable-ssl and I added -g to the CFLAGS I am using glib2-2.28.6-1 from perzl as well.. I plan on removing the --enable-debug if I can get it working Any ideas? Jonathan Kaufman

8 10