- syslog-ng - lists.balabit.hu

[PATCH] afmongodb: Restore compatibility with syslog-ng 3.3
by Gergely Nagy 31 Mar '12

31 Mar '12

In syslog-ng 3.3, we had the host() and port() options for the mongodb driver, these were removed in 3.4 in favour of servers(). This patch re-adds this two. Using host() and port() will now prepend the specified combination to the server list. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/afmongodb/afmongodb-grammar.ym | 2 ++ modules/afmongodb/afmongodb-parser.c | 2 ++ modules/afmongodb/afmongodb.c | 25 +++++++++++++++++++++++++ modules/afmongodb/afmongodb.h | 2 ++ 4 files changed, 31 insertions(+), 0 deletions(-) diff --git a/modules/afmongodb/afmongodb-grammar.ym b/modules/afmongodb/afmongodb-grammar.ym index a21e23c..71dd46d 100644 --- a/modules/afmongodb/afmongodb-grammar.ym +++ b/modules/afmongodb/afmongodb-grammar.ym @@ -75,6 +75,8 @@ afmongodb_option | KW_USERNAME '(' string ')' { afmongodb_dd_set_user(last_driver, $3); free($3); } | KW_PASSWORD '(' string ')' { afmongodb_dd_set_password(last_driver, $3); free($3); } | KW_SAFE_MODE '(' yesno ')' { afmongodb_dd_set_safe_mode(last_driver, $3); } + | KW_HOST '(' string ')' { afmongodb_dd_set_host(last_driver, $3); free($3); } + | KW_PORT '(' LL_NUMBER ')' { afmongodb_dd_set_port(last_driver, $3); } | value_pair_option { afmongodb_dd_set_value_pairs(last_driver, $1); } | dest_driver_option ; diff --git a/modules/afmongodb/afmongodb-parser.c b/modules/afmongodb/afmongodb-parser.c index b8c9ead..9d72878 100644 --- a/modules/afmongodb/afmongodb-parser.c +++ b/modules/afmongodb/afmongodb-parser.c @@ -36,6 +36,8 @@ static CfgLexerKeyword afmongodb_keywords[] = { { "username", KW_USERNAME }, { "password", KW_PASSWORD }, { "safe_mode", KW_SAFE_MODE }, + { "host", KW_HOST }, + { "port", KW_PORT }, { NULL } }; diff --git a/modules/afmongodb/afmongodb.c b/modules/afmongodb/afmongodb.c index de78b23..9d75799 100644 --- a/modules/afmongodb/afmongodb.c +++ b/modules/afmongodb/afmongodb.c @@ -112,6 +112,23 @@ afmongodb_dd_set_password(LogDriver *d, const gchar *password) } void +afmongodb_dd_set_host(LogDriver *d, const gchar *host) +{ + MongoDBDestDriver *self = (MongoDBDestDriver *)d; + + g_free(self->host); + self->host = g_strdup(host); +} + +void +afmongodb_dd_set_port(LogDriver *d, gint port) +{ + MongoDBDestDriver *self = (MongoDBDestDriver *)d; + + self->port = port; +} + +void afmongodb_dd_set_servers(LogDriver *d, GList *servers) { MongoDBDestDriver *self = (MongoDBDestDriver *)d; @@ -450,6 +467,14 @@ afmongodb_dd_init(LogPipe *s) value_pairs_add_scope(self->vp, "nv-pairs"); } + if (self->host) + { + gchar *srv = g_strdup_printf ("%s:%d", self->host, + (self->port) ? self->port : 27017); + self->servers = g_list_prepend (self->servers, srv); + g_free (self->host); + } + self->host = NULL; self->port = 27017; if (!mongo_util_parse_addr(g_list_nth_data(self->servers, 0), &self->host, diff --git a/modules/afmongodb/afmongodb.h b/modules/afmongodb/afmongodb.h index 9950d26..e1f4b57 100644 --- a/modules/afmongodb/afmongodb.h +++ b/modules/afmongodb/afmongodb.h @@ -30,6 +30,8 @@ LogDriver *afmongodb_dd_new(void); void afmongodb_dd_set_servers(LogDriver *d, GList *servers); +void afmongodb_dd_set_host(LogDriver *d, const gchar *host); +void afmongodb_dd_set_port(LogDriver *d, gint port); void afmongodb_dd_set_database(LogDriver *d, const gchar *database); void afmongodb_dd_set_collection(LogDriver *d, const gchar *collection); void afmongodb_dd_set_user(LogDriver *d, const gchar *user); -- 1.7.9

2 1

[PATCH] dummy: Remove this module.
by Gergely Nagy 31 Mar '12

31 Mar '12

The dummy module does nothing, yet, is installed by default. It's not a terribly great example of a simple module, either. For these reasons and more, lets bid it a tearful farewell. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- configure.in | 1 - modules/Makefile.am | 2 +- modules/dummy/Makefile.am | 14 ------- modules/dummy/dummy-grammar.ym | 75 --------------------------------------- modules/dummy/dummy-parser.c | 48 ------------------------- modules/dummy/dummy-parser.h | 35 ------------------ modules/dummy/dummy.c | 76 ---------------------------------------- modules/dummy/dummy.h | 37 ------------------- 8 files changed, 1 insertions(+), 287 deletions(-) delete mode 100644 modules/dummy/Makefile.am delete mode 100644 modules/dummy/dummy-grammar.ym delete mode 100644 modules/dummy/dummy-parser.c delete mode 100644 modules/dummy/dummy-parser.h delete mode 100644 modules/dummy/dummy.c delete mode 100644 modules/dummy/dummy.h diff --git a/configure.in b/configure.in index 995c202..d9b50bc 100644 --- a/configure.in +++ b/configure.in @@ -1160,7 +1160,6 @@ AC_OUTPUT(dist.conf lib/Makefile syslog-ng/Makefile modules/Makefile - modules/dummy/Makefile modules/afsocket/Makefile modules/afsql/Makefile modules/afstreams/Makefile diff --git a/modules/Makefile.am b/modules/Makefile.am index bbb3b1a..983f67a 100644 --- a/modules/Makefile.am +++ b/modules/Makefile.am @@ -1 +1 @@ -SUBDIRS = afsocket afsql afstreams affile afprog afuser afmongodb afsmtp csvparser confgen syslogformat pacctformat basicfuncs dbparser tfjson tfuuid jsonparser dummy +SUBDIRS = afsocket afsql afstreams affile afprog afuser afmongodb afsmtp csvparser confgen syslogformat pacctformat basicfuncs dbparser tfjson tfuuid jsonparser diff --git a/modules/dummy/Makefile.am b/modules/dummy/Makefile.am deleted file mode 100644 index 5e90ff6..0000000 --- a/modules/dummy/Makefile.am +++ /dev/null @@ -1,14 +0,0 @@ -moduledir = @moduledir@ -AM_CPPFLAGS = -I$(top_srcdir)/lib -I../../lib -module_LTLIBRARIES = libdummy.la - -export top_srcdir - -libdummy_la_SOURCES = dummy-grammar.y dummy.c dummy.h dummy-parser.c dummy-parser.h -libdummy_la_LIBADD = $(MODULE_DEPS_LIBS) -libdummy_la_LDFLAGS = $(MODULE_LDFLAGS) - -BUILT_SOURCES = dummy-grammar.y dummy-grammar.c dummy-grammar.h -EXTRA_DIST = $(BUILT_SOURCES) dummy-grammar.ym - -include $(top_srcdir)/build/lex-rules.am diff --git a/modules/dummy/dummy-grammar.ym b/modules/dummy/dummy-grammar.ym deleted file mode 100644 index 3179e11..0000000 --- a/modules/dummy/dummy-grammar.ym +++ /dev/null @@ -1,75 +0,0 @@ -/* - * Copyright (c) 2002-2010 BalaBit IT Ltd, Budapest, Hungary - * Copyright (c) 1998-2010 Balázs Scheidler - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License version 2 as published - * by the Free Software Foundation, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA - * - * As an additional exemption you are allowed to compile & link against the - * OpenSSL libraries as published by the OpenSSL project. See the file - * COPYING for details. - * - */ - -%code requires { - -#include "dummy-parser.h" - -} - -%code { - -#include "cfg-parser.h" -#include "dummy-grammar.h" -#include "plugin.h" - -extern LogDriver *last_driver; - -} - -%name-prefix "dummy_" -%lex-param {CfgLexer *lexer} -%parse-param {CfgLexer *lexer} -%parse-param {LogDriver **instance} -%parse-param {gpointer arg} - - -/* INCLUDE_DECLS */ - -%token KW_DUMMY -%token KW_DUMMY_OPT - -%% - -start - : LL_CONTEXT_DESTINATION KW_DUMMY - { - last_driver = *instance = dummy_dd_new(); - } - '(' dummy_options ')' { YYACCEPT; } - ; - -dummy_options - : dummy_option dummy_options - | - ; - -dummy_option - : KW_DUMMY_OPT '(' yesno ')' { ((DummyDestDriver *)last_driver)->opt = $3; }; - | dest_driver_option - ; - - -/* INCLUDE_RULES */ - -%% diff --git a/modules/dummy/dummy-parser.c b/modules/dummy/dummy-parser.c deleted file mode 100644 index 2951563..0000000 --- a/modules/dummy/dummy-parser.c +++ /dev/null @@ -1,48 +0,0 @@ -/* - * Copyright (c) 2002-2010 BalaBit IT Ltd, Budapest, Hungary - * Copyright (c) 1998-2010 Balázs Scheidler - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License version 2 as published - * by the Free Software Foundation, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA - * - * As an additional exemption you are allowed to compile & link against the - * OpenSSL libraries as published by the OpenSSL project. See the file - * COPYING for details. - * - */ - -#include "dummy.h" -#include "cfg-parser.h" -#include "dummy-grammar.h" - -extern int dummy_debug; -int dummy_parse(CfgLexer *lexer, DummyDestDriver **instance, gpointer arg); - -static CfgLexerKeyword dummy_keywords[] = { - { "dummy", KW_DUMMY }, - { "dummy_opt", KW_DUMMY_OPT }, - { NULL } -}; - -CfgParser dummy_parser = -{ -#if ENABLE_DEBUG - .debug_flag = &dummy_debug, -#endif - .name = "dummy", - .keywords = dummy_keywords, - .parse = (int (*)(CfgLexer *lexer, gpointer *instance, gpointer arg)) dummy_parse, - .cleanup = (void (*)(gpointer)) log_pipe_unref, -}; - -CFG_PARSER_IMPLEMENT_LEXER_BINDING(dummy_, LogDriver **) diff --git a/modules/dummy/dummy-parser.h b/modules/dummy/dummy-parser.h deleted file mode 100644 index 37a9e8f..0000000 --- a/modules/dummy/dummy-parser.h +++ /dev/null @@ -1,35 +0,0 @@ -/* - * Copyright (c) 2002-2010 BalaBit IT Ltd, Budapest, Hungary - * Copyright (c) 1998-2010 Balázs Scheidler - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License version 2 as published - * by the Free Software Foundation, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA - * - * As an additional exemption you are allowed to compile & link against the - * OpenSSL libraries as published by the OpenSSL project. See the file - * COPYING for details. - * - */ - -#ifndef DUMMY_PARSER_H_INCLUDED -#define DUMMY_PARSER_H_INCLUDED - -#include "cfg-parser.h" -#include "cfg-lexer.h" -#include "dummy.h" - -extern CfgParser dummy_parser; - -CFG_PARSER_DECLARE_LEXER_BINDING(dummy_, LogDriver **) - -#endif diff --git a/modules/dummy/dummy.c b/modules/dummy/dummy.c deleted file mode 100644 index f27667b..0000000 --- a/modules/dummy/dummy.c +++ /dev/null @@ -1,76 +0,0 @@ -/* - * Copyright (c) 2002-2010 BalaBit IT Ltd, Budapest, Hungary - * Copyright (c) 1998-2010 Balázs Scheidler - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License version 2 as published - * by the Free Software Foundation, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA - * - * As an additional exemption you are allowed to compile & link against the - * OpenSSL libraries as published by the OpenSSL project. See the file - * COPYING for details. - * - */ - -#include "dummy.h" -#include "dummy-parser.h" -#include "plugin.h" -#include "messages.h" - -static void -dummy_dd_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, gpointer user_data) -{ - DummyDestDriver *self = (DummyDestDriver *) s; - msg_notice("Dummy plugin received a message", - evt_tag_str("msg", log_msg_get_value(msg, LM_V_MESSAGE, NULL)), - evt_tag_int("opt", self->opt), - NULL); - - log_dest_driver_queue_method(s, msg, path_options, user_data); -} - -LogDriver * -dummy_dd_new(void) -{ - DummyDestDriver *self = g_new0(DummyDestDriver, 1); - - log_dest_driver_init_instance(&self->super); - self->super.super.super.queue = dummy_dd_queue; - - return &self->super.super; -} - -extern CfgParser dummy_dd_parser; - -static Plugin dummy_plugin = -{ - .type = LL_CONTEXT_DESTINATION, - .name = "dummy", - .parser = &dummy_parser, -}; - -gboolean -dummy_module_init(GlobalConfig *cfg, CfgArgs *args) -{ - plugin_register(cfg, &dummy_plugin, 1); - return TRUE; -} - -const ModuleInfo module_info = -{ - .canonical_name = "dummy", - .version = VERSION, - .description = "The dummy module is a sample destination driver not really doing any kind of useful work.", - .core_revision = SOURCE_REVISION, - .plugins = &dummy_plugin, - .plugins_len = 1, -}; diff --git a/modules/dummy/dummy.h b/modules/dummy/dummy.h deleted file mode 100644 index d99c7bf..0000000 --- a/modules/dummy/dummy.h +++ /dev/null @@ -1,37 +0,0 @@ -/* - * Copyright (c) 2002-2010 BalaBit IT Ltd, Budapest, Hungary - * Copyright (c) 1998-2010 Balázs Scheidler - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License version 2 as published - * by the Free Software Foundation, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA - * - * As an additional exemption you are allowed to compile & link against the - * OpenSSL libraries as published by the OpenSSL project. See the file - * COPYING for details. - * - */ - -#ifndef DUMMY_H_INCLUDED -#define DUMMY_H_INCLUDED - -#include "driver.h" - -typedef struct -{ - LogDestDriver super; - gint opt; -} DummyDestDriver; - -LogDriver *dummy_dd_new(void); - -#endif -- 1.7.9

2 1

[PATCH 0/1]: afmongodb: queue & wakeup race condition
by Gergely Nagy 31 Mar '12

31 Mar '12

There is a way to deadlock the mongodb destination, and I don't entirely understand the scenario, and thus, I can't properly explain it, either. Perhaps I'd need more coffee... but anyway! Following this mail, I'll send a patch that fixes the issue for me (I separately sent the same patch to the original reporter of the problem, too), but I'm not entirely happy with it. Nevertheless, I still find it better to send it to the list, where it can - perhaps - receive more testing than I was able to give it.

2 2

[PATCH (3.4) 1/2] configure: Fix --with-json=json-c/json-glib handling.
by Gergely Nagy 31 Mar '12

31 Mar '12

The tests that decide whether the user wanted to select json-c or json-glib were a little bit off, which resulted in anything other than --with-json=auto failing. This has now been corrected. Reported-by: Peter Czanik <czanik(a)balabit.hu> Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- configure.in | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) diff --git a/configure.in b/configure.in index 995c202..f766888 100644 --- a/configure.in +++ b/configure.in @@ -606,11 +606,11 @@ fi dnl *************************************************************************** dnl json headers/libraries dnl *************************************************************************** -if test "x$with_json" = "xauto" || test "x$with_json" = "json-c"; then - PKG_CHECK_MODULES(JSON_C, json >= $JSON_C_MIN_VERSION,, JSON_C_LIBS="") +if test "x$with_json" = "xauto" || test "x$with_json" = "xjson-c"; then + PKG_CHECK_MODULES(JSON_C, json >= $JSON_C_MIN_VERSION) fi -if test "x$with_json" = "xauto" || test "x$with_json" = "json-glib"; then - PKG_CHECK_MODULES(JSON_GLIB, json-glib-1.0 >= $JSON_GLIB_MIN_VERSION,, JSON_GLIB_LIBS="") +if test "x$with_json" = "xauto" || test "x$with_json" = "xjson-glib"; then + PKG_CHECK_MODULES(JSON_GLIB, json-glib-1.0 >= $JSON_GLIB_MIN_VERSION) fi dnl *************************************************************************** -- 1.7.9

2 4

[PATCH (3.4)] modules: Do not build or install disabled modules
by Gergely Nagy 31 Mar '12

31 Mar '12

The afmongodb and afsmtp modules had a subtle bug in their Makefile.ams: even if they were disabled, the Makefile still built and installed an empty module. This patch corrects that, by moving the module_LTLIBRARIES inside the if block. Reported-by: Peter Czanik <czanik(a)balabit.hu> Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/afmongodb/Makefile.am | 5 ++--- modules/afsmtp/Makefile.am | 2 +- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/modules/afmongodb/Makefile.am b/modules/afmongodb/Makefile.am index c0eec33..d022912 100644 --- a/modules/afmongodb/Makefile.am +++ b/modules/afmongodb/Makefile.am @@ -1,14 +1,13 @@ - SUBDIRS = @LIBMONGO_SUBDIRS@ DIST_SUBDIRS = libmongo-client moduledir = @moduledir@ AM_CPPFLAGS = -I$(top_srcdir)/lib -I../../lib -module_LTLIBRARIES = libafmongodb.la export top_srcdir if ENABLE_MONGODB +module_LTLIBRARIES = libafmongodb.la libafmongodb_la_CFLAGS = $(LIBMONGO_CFLAGS) libafmongodb_la_SOURCES = afmongodb-grammar.y afmongodb.c afmongodb.h afmongodb-parser.c afmongodb-parser.h @@ -32,4 +31,4 @@ uninstall: $(MAKE) $(AM_MAKEFLAGS) uninstall-am check: - echo "Make check disabled, since it requires a newer glib" \ No newline at end of file + echo "Make check disabled, since it requires a newer glib" diff --git a/modules/afsmtp/Makefile.am b/modules/afsmtp/Makefile.am index 790aad7..bb5b94d 100644 --- a/modules/afsmtp/Makefile.am +++ b/modules/afsmtp/Makefile.am @@ -1,10 +1,10 @@ moduledir = @moduledir@ AM_CPPFLAGS = -I$(top_srcdir)/lib -I../../lib -module_LTLIBRARIES = libafsmtp.la export top_srcdir if ENABLE_SMTP +module_LTLIBRARIES = libafsmtp.la libafsmtp_la_CFLAGS = $(LIBESMTP_CFLAGS) $(IVYKIS_CFLAGS) $(EVENTLOG_CFLAGS) $(SYSLOG_NG_CFLAGS) libafsmtp_la_SOURCES = afsmtp-grammar.y afsmtp.c afsmtp.h afsmtp-parser.c afsmtp-parser.h -- 1.7.9

2 1

Reprocess disk buffer files
by Aaron Daniel 31 Mar '12

31 Mar '12

In the LTS version of PE, we have some servers that have old disk-buffer files (var/*qf) still on disk, with the contents not sent to a central server. Is there a way to force syslog-ng to re-process those, or do we have to manually process them ourselves? The files contain very old log entries that still need to be processed, and syslog-ng appears to be using a newer *.qf file for it's disk buffer. When it does this, it's completely ignoring the old log entries so we have some gaps in our central processing system. (Sorry if this has been asked before, google's not been my friend on this search...) -- Aaron Daniel

2 1

High volume of syslog message getting dropped
by Samuel Petreski 31 Mar '12

31 Mar '12

I'm running syslog-ng 3.3.4 on FreeBSD 8.2, but am getting choppy logging from syslog-ng. I'm continually (every minute or so) getting the following messages from syslog-ng, Mar 19 17:09:24 system syslog-ng[47183]: Syslog connection accepted; fd='51', client='AF_INET(10.33.11.249:24813)', local='AF_INET(0.0.0.0:1470)' Mar 19 17:09:25 system syslog-ng[47183]: Syslog connection closed; fd='51', client='AF_INET(10.33.11.249:24813)', local='AF_INET(0.0.0.0:1470)' Mar 19 17:09:46 system syslog-ng[47183]: Syslog connection accepted; fd='25', client='AF_INET(10.166.166.234:50240)', local='AF_INET(0.0.0.0:1470)' Mar 19 17:09:47 system syslog-ng[47183]: Syslog connection closed; fd='25', client='AF_INET(10.166.166.234:50240)', local='AF_INET(0.0.0.0:1470)' Most of my hosts sending their logs to syslog-ng are Cisco ASAs and they are configured to send their logs securely. Also these devices send syslog messages at a very high rate (few of the devices generate logs in excess of 10GB/day). My relevant syslog-ng paramenters are as follows, **************** #global options options { chain_hostnames(off); keep_hostname(yes); use_fqdn(off); flush_lines(0); stats_freq(360); threaded(yes); dns_cache(2000); dns_cache_expire(87600); flush_lines(10000000); flush_timeout(6000); }; #destination, source and logging destination d_cisco_devices { file("/data/log/$HOST-$YEAR$MONTH$DAY.log" perm(0400)); }; source tls_clients { tcp(ip(0.0.0.0) port(1470) max-connections(300) log_iw_size(300000000) log_fetch_limit(2000000) tls( key_file("/etc/syslog-ng.key") cert_file("/etc/syslog-ng.crt") peer_verify(optional-untrusted)) ); }; log { source(tls_clients); destination(d_cisco_devices); flags(flow-control); }; **************** I've read through the manual and have tried to increase the flush_line, log_fetch_limit, log_iw_size parameters but have not been able to fine tune its operation. Most of the my recorded syslog messages are for about few seconds, and then they start again the next minute. Any help or pointers anyone can provide would be greatly appreciated. Thanks. --Samuel

2 1

allow setting up unix named sockets for listening
by Patrick Hemmer 30 Mar '12

30 Mar '12

When troubleshooting issues with our production syslog servers, its often not possible to deliberately duplicate discovered issues as it then affects production. Something which would be extremely useful in this case is if we could configure syslog-ng to set up a unix socket as a listener. Then whenever clients connect logs can be sent to the client. Syslog-ng currently has unix-stream and unix-dgram destinations, but they act as clients, only sending to already created sockets. There could be other uses for this, basically allowing clients to connect whenever they want and receive the logs. Kind of like a pipe destination, but it works a bit cleaner since if no client is connected, syslog-ng wouldnt have to buffer and drop messages (and it would allow multiple clients). Fairly low priority, but just something that I thought would be useful. -Patrick

2 1

syslog-ng Insider - March 2012
by Peter Czanik 29 Mar '12

29 Mar '12

Dear syslog-ng users, This is the 12th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com <mailto:documentation@balabit.com> FEATURED NEWS GSoC wants you to code syslog-ng in the summer ---------------------------------------------- GSoC ( http://code.google.com/soc/ ) is a nice opportunity for higher education students to spend their summers productively by coding in open source software projects. This time BalaBit participates in GSoC with the help of the openSUSE project. If you are interested in enhancing syslog-ng or Zorp, please see our project ideas on the openSUSE ideas page: http://en.opensuse.org/openSUSE:GSOC_ideas#syslog-ng and http://en.opensuse.org/openSUSE:GSOC_ideas#Zorp Alpha1 of syslog-ng 3.4 is released ----------------------------------- The first alpha version of syslog-ng 3.4 is released. Major new features are junctions & channels which add even more flexibility to the syslog-ng configuration. There is now also a json parser, smtp destination and modules are now loaded automatically. For more details on what is new, please check Bazsi's blog: http://bazsi.blogs.balabit.com/2012/03/first-alpha-release-of-syslog-ng-3-4… Instead of using the release, it is recommended to use sources from git, which have some major stability fixes: https://github.com/bazsi/syslog-ng-3.4 If you intend to package syslog-ng 3.4, it's recommended to check the mailing list for patches from Algernon, which make packaging easier. A snapshot of his work is available at: http://packages.madhouse-project.org/syslog-ng/algernon/3.4/syslog-ng-alger… There are already packages for openSUSE and an updated syslog-ng-devel port for FreeBSD. See http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The (r)evolution of name value pairs ------------------------------------ Name value pairs were at the heart of syslog-ng even before PatternDB made it obvious. And now the CEE board and the Lumberjack project also push into this direction: instead of free form text messages, use name value pairs for logging. Recent developments in syslog-ng also serve this purpose: v3.3 can output name value pairs in JSON and v3.4 will be able to parse these logs and turn them into name value pairs again. How project Lumberjack can improve logging: http://bazsi.blogs.balabit.com/2012/02/project-lumberjack-to-improve-linux-… How syslog-ng can be used for CEE (JSON) logs: http://algernon.blogs.balabit.com/2012/02/cee-handling-with-syslog-ng/ How using name value pairs can improve logging: http://czanik.blogs.balabit.com/2012/03/state-of-the-art-logging-syslog-ng-… which is also the basis for our syslog-ng presentation at the LOADays conference: http://loadays.org/ syslog-ng community forum ------------------------- BalaBit has had a very positive experience with the syslog-ng community and we believe that your feedback has played a key role in the success of syslog-ng. We have decided to adopt this community model to our other products so that we can have our customers involved in product design. It could be interesting for you to visit this brand new community site at http://communities.balabit.com <http://communities.balabit.com/>. You are one of the first of our friends to be invited. OTHER SHORT NEWS * An introduction to RLTP, a protocol to make syslog-ng PE even more reliable: http://pzolee.blogs.balabit.com/2012/03/zero-message-loss-with-syslog-ng-pr… * The libumberlog library is a thin, LD_PRELOAD-able layer on top of the legacy syslog() function, that turns those calls into something that emits its message part as a JSON formatted structured log message:http://algernon.github.com/libumberlog/ * ELSA, the high performance web GUI for syslog-ng, received a few interesting updates to make resolving security incidents even more quick and efficient. For the latest examples check: http://ossectools.blogspot.com/ NEW RELEASES: * syslog-ng OSE 3.4 alpha1: http://bazsi.blogs.balabit.com/2012/03/first-alpha-release-of-syslog-ng-3-4… * syslog-ng PE 4F2: http://andrea.blogs.balabit.com/2012/02/balabits-new-syslog-ng-premium-edit… * lumberlog 0.1.0: http://algernon.github.com/libumberlog/ ARCHIVE http://insider.blogs.balabit.com/ -- Peter Czanik (CzP)<czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

IP Address folder
by Julien Groselle 28 Mar '12

28 Mar '12

Hello everybody, I work for a lange society, and we use syslog-ng for 5 years now. We have a centralized server with storage tank to keep logs securly. Concretely, we have 2 centralized servers syslog-ng in chrooted environement, and 50 clients servers. Since we use TLS transport in place of stunnel workaround, we have many issues : - First of all, many logs aren't writen in $HOST folder but in IPADDRESS folder. So, to be clear, this is an exemple : # ls drwxr-x--- 8 root adm 4,0K 1 mars 00:07 10.0.0.1 drwxr-x--- 53 root adm 4,0K 19 mars 00:35 host1 I assume that host1 have 10.0.0.1 IP address and # tree 192.168.100.79/2012-03/ 10.0.0.1/2012-03/ ├── 02-user-10.0.0.1.log.bz2 ├── 06-user-10.0.0.1.log.bz2 ├── 07-user-10.0.0.1.log.bz2 ├── 08-user-10.0.0.1.log.bz2 ├── 09-user-10.0.0.1.log.bz2 ├── 12-user-10.0.0.1.log.bz2 ├── 13-user-10.0.0.1.log.bz2 ├── 14-user-10.0.0.1.log.bz2 ├── 15-user-10.0.0.1.log.bz2 ├── 16-user-10.0.0.1.log.bz2 └── 19-user-10.0.0.1.log # tree host1/2012-03/ |grep 19- ├── 19-apache.access-host1.log ├── 19-apache.error-host1.log ├── 19-authpriv-host1.log ├── 19-auth-host1.log ├── 19-cron-host1.log ├── 19-daemon-host1.log ├── 19-kern-host1.log ├── 19-mail-host1.log ├── 19-nagios-host1.log ├── 19-puppetd-host1.log ├── 19-syslog-host1.log └── 19-user-host1.log (we have this problem with many servers) In facility "user" for host 10.0.0.1 in fact i have log for snmptrapd... But why ?? We have config for snmpd but not for snmptrapd... So i have tried to define a default facility => failed After i have tried many dns and hostnames options => failed As anyone here have a way to search for me ? If you need more details, i'm your's. Kind regards. -- JG

1 1