- syslog-ng - lists.balabit.hu

[Bug 170] New: feature request: include only load *.conf files
by bugzilla＠bugzilla.balabit.com 07 May '12

07 May '12

https://bugzilla.balabit.com/show_bug.cgi?id=170 Summary: feature request: include only load *.conf files Product: syslog-ng Version: 3.3.x Platform: Other OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: enhancement Estimated Hours: 0.0 When an rpm package is used to place a configuration file in an include directory and the package is later updated, a file of the name *.conf.rpmnew or *.conf.rpmsave but the contents of this file will be a conflict with the *.conf file and syslog-ng will not start. Syslog-ng should only load the *.conf files so that it can work seamlessly with the rpm method. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

A question about filtering messages
by C. L. Martinez 06 May '12

06 May '12

Hi all, I need to filter different message types with some special words in it. Is this a correct filter to do this?? filter f_test { netmask("192.168.1.15") and ( message("FIRST_OPTION:") or message("SECOND_OPTION:") or message("THIRD_OPTION:")); }; Thanks.

2 1

(no subject)
by pedro castro 05 May '12

05 May '12

Learn How To Earn Money 0nline Now http://san-francisco-tips.com/perduol.php?gjgpageID=159 __________________ " De cow up n died on myhans." (c) annette albern Sat, 5 May 2012 8:55:20

1 0

[PATCH] Don't use deprecated glib symbols on newer glibs
by Gergely Nagy 04 May '12

04 May '12

A couple of symbols have been deprecated by glib in versions newer than the minimum version syslog-ng supports, and with 2.30 which deprecated g_atomic_int_exchange_and_add(), these warnings are way over the normal threshold, and turn build logs into not much more than noise. This patch solves this issue by checking the glib version at compile time, and deciding then which functions to use. This makes it possible to remain compatible with ancient glib, yet, still compile without deprecation warnings on systems with recent glibs. No functionality is lost or changed, just different interfaces used to accomplish the same thing. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- lib/atomic.h | 4 ++++ lib/timeutils.c | 8 ++++++++ syslog-ng/syslog-ng-ctl.c | 12 ++++++++---- 3 files changed, 20 insertions(+), 4 deletions(-) diff --git a/lib/atomic.h b/lib/atomic.h index 05cfb88..32d421e 100644 --- a/lib/atomic.h +++ b/lib/atomic.h @@ -52,7 +52,11 @@ g_atomic_counter_get(GAtomicCounter *c) static inline gint g_atomic_counter_exchange_and_add(GAtomicCounter *c, gint val) { +#if GLIB_CHECK_VERSION(2, 30, 0) + return g_atomic_int_add(&c->counter, val); +#else return g_atomic_int_exchange_and_add(&c->counter, val); +#endif } static inline gint diff --git a/lib/timeutils.c b/lib/timeutils.c index 9e7822b..313d61c 100644 --- a/lib/timeutils.c +++ b/lib/timeutils.c @@ -844,7 +844,11 @@ zone_info_read(const gchar *zonename, ZoneInfo **zone, ZoneInfo **zone64) if (byte_read == -1) { msg_error("Failed to read the time zone file", evt_tag_str("filename", filename), NULL); +#if GLIB_CHECK_VERSION(2, 22, 0) + g_mapped_file_unref(file_map); +#else g_mapped_file_free(file_map); +#endif g_free(filename); return FALSE; } @@ -857,7 +861,11 @@ zone_info_read(const gchar *zonename, ZoneInfo **zone, ZoneInfo **zone64) *zone64 = zone_info_parser(&buff, TRUE, &version); } +#if GLIB_CHECK_VERSION(2, 22, 0) + g_mapped_file_unref(file_map); +#else g_mapped_file_free(file_map); +#endif g_free(filename); return TRUE; } diff --git a/syslog-ng/syslog-ng-ctl.c b/syslog-ng/syslog-ng-ctl.c index 25948b0..16348f1 100644 --- a/syslog-ng/syslog-ng-ctl.c +++ b/syslog-ng/syslog-ng-ctl.c @@ -131,7 +131,7 @@ slng_verbose(int argc, char *argv[], const gchar *mode) { gint ret = 0; GString *rsp = NULL; - gchar buff[256]; + gchar buff[256], *ubuff; if (!verbose_set) snprintf(buff, 255, "LOG %s\n", mode); @@ -139,10 +139,14 @@ slng_verbose(int argc, char *argv[], const gchar *mode) snprintf(buff, 255, "LOG %s %s\n", mode, strncasecmp(verbose_set, "on", 2) == 0 || verbose_set[0] == '1' ? "ON" : "OFF"); - g_strup(buff); + ubuff = g_ascii_strup(buff, -1); - if (!(slng_send_cmd(buff) && ((rsp = slng_read_response()) != NULL))) - return 1; + if (!(slng_send_cmd(ubuff) && ((rsp = slng_read_response()) != NULL))) + { + g_free(ubuff); + return 1; + } + g_free(ubuff); if (!verbose_set) printf("%s\n", rsp->str); -- 1.7.10

1 0

[ANN]: balabit.logstore - Open Source LogStore reader API
by Gergely Nagy 04 May '12

04 May '12

--------------------------------------------------------------- PACKAGE : com.balabit/logstore VERSION : 0.0.1 SUMMARY : First alpha release DATE : 2012 April 24 HOMEPAGE : http://algernon.github.com/balabit.logstore --------------------------------------------------------------- DESCRIPTION: The balabit.logstore project is a library written in Clojure, that tries to provide a convenient API to read syslog-ng PE LogStore files. The reason behind the implementation is to have an independent, open source reader for the LogStore file format, so that one is not tied to syslog-ng to read one's logs stored in this format. An open implementation makes it possible to read these logs on systems where syslog-ng is not installed, or where the lgstool program is not available. LogStore itself is a storage format for log messages, supporting encryption, compression, secure timestamps, serialized messages (think name-value pairs as opposed to just a plain, formatted string) and a lot more. This format is being opened, and this library is meant to provide an implenetation for a LogStore reader, that will eventually support reading all kinds of LogStore files. EXAMPLE: (ns example (:require [balabit.logstore :as logstore])) (defn lgstool-cat ([] (lgstool-cat "resources/logstores/short.compressed.store")) ([filename] (logstore/with-file filename (let [indexed-records (zipmap (range (count (logstore/records))) (logstore/records)) chunk-records (keys (filter #(= :chunk (:type (val %))) indexed-records)) print-msgs (fn [index] (dorun (map println (:messages (logstore/nth-record index)))))] (dorun (map print-msgs chunk-records)))))) (lgstool-cat "/path/to/logstore/messages.store") More examples can be found bundled with the sources, and as part of the documentation: http://algernon.github.com/balabit.logstore/#balabit.logstore.examples FEATURES: The library - being in very early alpha stage - can already read some LogStore files, and transparently decompress them, collect meta-data about both the logstore, and the information stored within. It comes with an extensive test suite and a lot of examples. FUTURE DIRECTION: We are working on making the library able to deserialize name-value pairs, to make it support decrypting logstores, and paralell to that, we're working on a Java API, so that it can be used from a more familiar language, and still provide a convenient, easy to use API. In the future, we also plan to publish ready to use JAR files that one can easily use from any Java or Clojure project. DOWNLOADS: The source is available from the git repository at github: git://github.com/algernon/balabit.logstore.git Documentation and more information about the library is available on its homepage at http://algernon.github.com/balabit.logstore/. People interested in the development of the library can also look at the developer docs at: http://algernon.github.com/balabit.logstore/developer-api.html -- |8]

2 2

[PATCH] afsocket: Support a smooth upgrade path to recent systemd
by Gergely Nagy 04 May '12

04 May '12

When the journal was introduced in systemd, it started to pass /run/systemd/journal/syslog to syslogds (it was passing down /dev/log before). Since we verify that the FD to open matches the expected filename, we didn't pick up the fd due to the filename mismatch. This can be fixed on the system() source level, where it can decide which to generate into the config. However, for setups that do not use system() for one reason or the other, this does not work. For these systems that do not use the system() source, the best solution is to try and replace /dev/log with /run/systemd/journal/syslog at run-time. This patch does just that, and ties it to config versions 3.4 or earlier. This means that post-3.4, the automatic replacement will stop working, and users will get the generic failed to acquire socket error message instead. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/afsocket/afunix.c | 56 ++++++++++++++++++++++++++++++++++----------- 1 file changed, 43 insertions(+), 13 deletions(-) diff --git a/modules/afsocket/afunix.c b/modules/afsocket/afunix.c index 8145f1a..a5644ac 100644 --- a/modules/afsocket/afunix.c +++ b/modules/afsocket/afunix.c @@ -72,7 +72,8 @@ afunix_sd_set_perm(LogDriver *s, gint perm) #if ENABLE_SYSTEMD static gboolean -afunix_sd_acquire_socket(AFSocketSourceDriver *s, gint *result_fd) +afunix_sd_acquire_named_socket(AFSocketSourceDriver *s, gint *result_fd, + const gchar *filename) { AFUnixSourceDriver *self = (AFUnixSourceDriver *) s; gint fd, fds; @@ -101,12 +102,12 @@ afunix_sd_acquire_socket(AFSocketSourceDriver *s, gint *result_fd) for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + fds; fd++) { /* check if any type is available */ - if (sd_is_socket_unix(fd, 0, -1, self->filename, 0)) + if (sd_is_socket_unix(fd, 0, -1, filename, 0)) { int type = (self->super.flags & AFSOCKET_STREAM) ? SOCK_STREAM : SOCK_DGRAM; /* check if it matches our idea of the socket type */ - if (sd_is_socket_unix(fd, type, -1, self->filename, 0)) + if (sd_is_socket_unix(fd, type, -1, filename, 0)) { *result_fd = fd; break; @@ -114,7 +115,7 @@ afunix_sd_acquire_socket(AFSocketSourceDriver *s, gint *result_fd) else { msg_error("The systemd supplied UNIX domain socket is of a different type, check the configured driver and the matching systemd unit file", - evt_tag_str("filename", self->filename), + evt_tag_str("filename", filename), evt_tag_int("systemd-sock-fd", fd), evt_tag_str("expecting", type == SOCK_STREAM ? "unix-stream()" : "unix-dgram()"), NULL); @@ -130,31 +131,60 @@ afunix_sd_acquire_socket(AFSocketSourceDriver *s, gint *result_fd) */ msg_debug("Ignoring systemd supplied fd as it is not a UNIX domain socket", - evt_tag_str("filename", self->filename), + evt_tag_str("filename", filename), evt_tag_int("systemd-sock-fd", fd), NULL); } } } - else - return TRUE; if (*result_fd != -1) { g_fd_set_nonblock(*result_fd, TRUE); g_fd_set_cloexec(*result_fd, TRUE); msg_verbose("Acquired systemd socket", - evt_tag_str("filename", self->filename), + evt_tag_str("filename", filename), evt_tag_int("systemd-sock-fd", *result_fd), NULL); + return TRUE; } - else + return TRUE; +} + +static gboolean +afunix_sd_acquire_socket(AFSocketSourceDriver *s, gint *result_fd) +{ + AFUnixSourceDriver *self = (AFUnixSourceDriver *) s; + gboolean fd_ok; + GlobalConfig *cfg = log_pipe_get_config(&s->super.super.super); + + fd_ok = afunix_sd_acquire_named_socket(s, result_fd, self->filename); + + if (fd_ok && (*result_fd == -1) && (strcmp(self->filename, "/dev/log") == 0)) { - msg_debug("Failed to acquire systemd socket, trying to open ourselves", - evt_tag_str("filename", self->filename), - NULL); + fd_ok = afunix_sd_acquire_named_socket(s, result_fd, "/run/systemd/journal/syslog"); + + if (fd_ok && *result_fd > -1) + { + if (cfg->version <= 0x0304) + { + msg_warning("WARNING: systemd detected while using /dev/log; migrating automatically to /run/systemd/journal/syslog. Please update your configuration to use the system() source.", + evt_tag_str("id", self->super.super.super.id), + NULL); + + g_free(self->filename); + self->filename = g_strdup("/run/systemd/journal/syslog"); + return TRUE; + } + } } - return TRUE; + + if (!fd_ok) + msg_debug("Failed to acquire systemd socket, trying to open ourselves", + evt_tag_str("filename", self->filename), + NULL); + + return fd_ok; } #else -- 1.7.10

1 0

[PATCH 0/2] systemd enhancements
by Gergely Nagy 04 May '12

04 May '12

The two patches that follow improve syslog-ng's support for systemd-enabled platforms. The first patch simply teaches the system() source to prefer /run/systemd/journal/syslog over /dev/log if running under systemd. That alone makes configs that use system() work under both sysvinit and systemd without any change at all to the config. However, for configs that use /dev/log hard-coded, the upgrade path isn't that smooth. In that case, we still check whether running under systemd, and if so, but we couldn't accept any of the offered fds, we check again with /run/systemd/journal/syslog as the filename, and replace the hard-coded one if the other filename worked. The second patch implements the above - I'm not entirely sold on the idea, and haven't explored the possible side-effects yet, but I believe it's reasonably safe for the vast majority of cases. For now, the second patch is mostly meant as a proposal, and will need a review before it can be considered for a merge.

2 5

[PATCH] afsocket: Fix unix-dgram initialisation
by Gergely Nagy 04 May '12

04 May '12

When initializing an unix-dgram socket, set self->fd to the acquired socket FD, so that fds inherited from systemd actually get used and polled on. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/afsocket/afsocket.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/modules/afsocket/afsocket.c b/modules/afsocket/afsocket.c index 5b192f4..c1bee5c 100644 --- a/modules/afsocket/afsocket.c +++ b/modules/afsocket/afsocket.c @@ -679,7 +679,7 @@ afsocket_sd_init(LogPipe *s) if (sock == -1 && !afsocket_open_socket(self->bind_addr, !!(self->flags & AFSOCKET_STREAM), &sock)) return self->super.super.optional; } - self->fd = -1; + self->fd = sock; if (!self->setup_socket(self, sock)) { -- 1.7.9.1

2 3

[PATCH] afsmtp: Fix afsmtp linking when configured with --with-libesmtp
by Gergely Nagy 04 May '12

04 May '12

In case configure received a --with-libesmtp=/path option, we forgot to add -lesmtp to LIBESMTP_LIBS, which resulted in afsmtp getting compiled, but not linked to libesmtp, which is obviously not desirable. This patch fixes that, and adds the -lesmtp. Reported-by: Peter Czanik <czanik(a)balabit.hu> Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- configure.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure.in b/configure.in index 2d56bbd..03cc76c 100644 --- a/configure.in +++ b/configure.in @@ -815,7 +815,7 @@ if test "x$enable_smtp" != "xno" && test "x$with_libesmtp" != "no"; then CPPFLAGS="$CPPFLAGS -I$with_libesmtp/include" LDFLAGS="$LDFLAGS -L$with_libesmtp/lib" AC_CHECK_HEADER(libesmtp.h, [LIBESMTP_CFLAGS="-I$with_libesmtp/include" - LIBESMTP_LIBS="-L$with_libesmtp/lib"], [libesmtp=no]) + LIBESMTP_LIBS="-L$with_libesmtp/lib -lesmtp"], [libesmtp=no]) CPPFLAGS="$CPPFLAGS_SAVE" LDFLAGS="$LDFLAGS_SAVE" else -- 1.7.10

1 0

[PATCH] lib/gprocess.c: Ignore SIGHUP inside the supervisor.
by Gergely Nagy 04 May '12

04 May '12

Reloading syslog-ng's config is often done via a killall -HUP syslog-ng command, which also sends a signal to the supervisor. However, the supervisor did not handle said signal, thus it exited as is the default for it. To work around this issue, lets ignore SIGHUP inside the supervisor. Reported-by: Patrick Hemmer Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- lib/gprocess.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/lib/gprocess.c b/lib/gprocess.c index aaefbab..d68521d 100644 --- a/lib/gprocess.c +++ b/lib/gprocess.c @@ -1055,10 +1055,15 @@ g_process_perform_supervise(void) pid_t pid; gboolean first = TRUE, exited = FALSE; gchar proc_title[PROC_TITLE_SPACE]; + struct sigaction sa; g_snprintf(proc_title, PROC_TITLE_SPACE, "supervising %s", process_opts.name); g_process_setproctitle(proc_title); + memset(&sa, 0, sizeof(sa)); + sa.sa_handler = SIG_IGN; + sigaction(SIGHUP, &sa, NULL); + while (1) { if (pipe(init_result_pipe) != 0) -- 1.7.10

1 0