- syslog-ng - lists.balabit.hu

feature request: owner/group/mode parameters for pipe sources
by Patrick Hemmer 30 Jan '12

30 Jan '12

Can we get the owner, group, and mode paramters for pipe sources? Docs say that syslog-ng will create the pipe starting from 3.0, but we cant cant control the permissions on it. Thanks -Patrick

2 2

ANN: syslog-ng 3.3 & 3.4 debian package news
by Gergely Nagy 30 Jan '12

30 Jan '12

Hi! I'd like to give a quick heads up regarding the syslog-ng deb packages I provide[1]: I recently pushed out a new version, 3.3.4.dfsg-1~mhp1, which is based on the 3.3.4 release, with one patch applied. It's available for all the usual Debian and Ubuntu platforms, except kfreebsd-*, see below. Based on my download logs, I'm the only user of the kfreebsd-* packages, and I only use them on one system: the buildd. So I'm going to drop those arches, and provide i386, amd64 and powerpc only. If I missed anyone, who'd like to have the kfreebsd debs around, please let me know, and I'll keep them around! For now, the older 3.3.3 packages are still available, but the newest 3.3.4 release has not been compiled for these two platforms, and unless there's at least one more user, I plan to remove kfreebsd-* from my repo during the next two weeks. Also, since syslog-ng 3.4 is starting to have interesting features that 3.3 does not, I plan to start offering debian packages for this version too, as soon as alpha1 is released (or perhaps earlier, if I grow too impatient). They will be available separately, and those of you who use my syslog-ng 3.3 packages won't get automatic upgrades to 3.4. Those who will want to try the 3.4 debs, the planned sources.list lines will follow this template: deb http://packages.madhouse-project.org/$VENDOR $RELEASE syslog-ng/experimental For example: deb http://packages.madhouse-project.org/debian squeeze syslog-ng/experimental Upgrades from 3.3 should be smooth and painless, at least I'll try my best. Also, if one would like to see any other architecture, release or perhaps even another derivative distribution supported, speak up, and I'll see what I can do! -- |8]

1 0

syslog-ng over Windows 2008 abort running
by pedro castro 30 Jan '12

30 Jan '12

Hi, I have syslog-ng running on Windows 2008 and it is working fine until it crash. The process stopped and it is not able to run againg This is the message i got. (process:2304): GLib-ERROR (recursed) **: /usr/src/ports-git/trunk/gnome/glib2.0/glib2.0-2.24.1-1/src/glib-2.24.1/glib/gmem.c:137: failed to allocate 352 bytes aborting... Any ideas?

2 3

Init scripts
by Chris Johnson 30 Jan '12

30 Jan '12

My apologies, I know this is probably a trivial question. I trying to install syslog-ng for the first time from source. It appears to install okay, but the config file and init scripts are not installed during install. I am running Ubuntu 11.10 and tried to copy the init files from the debian folder, but this does not launch when I run /etc/init.d/syslog-ng start. Is there something else I need to configure? Copying the wrong files? Any help is greatly appreciated. Chris

4 4

"Unable to initialize database access" error
by Justin Ryburn 29 Jan '12

29 Jan '12

For some reason I cannot seem to get my log messages to go to the mysql database. I get the following error when I attempt to start the syslog-ng service… jryburn@ryburn-server:/etc/syslog-ng$ sudo service syslog-ng restart * Stopping system logging syslog-ng ...done. * Starting system logging syslog-ng Unable to initialize database access (DBI); rc='-1', error='No such file or directory (2)' Error initializing dest driver; dest='d_mysql', id='d_mysql#0' Error initializing message pipeline; ...fail! The relevant pieces of syslog-ng.conf… source s_net { udp(); }; source s_tcp { tcp(ip(0.0.0.0) port(1999)); }; # Desitations for remote devices destination d_routers { file("/var/log/routers.log"); }; # Send logs to the mysql database destination d_mysql { sql( type(mysql) host("localhost") username("syslogadmin") password("syslogadmin") database("syslog") table("logs") columns("host", "facility", "priority", "level", "tag", "datetime", "program", "msg") values("$HOST_FROM", "$FACILITY", "$PRIORITY", "$LEVEL", "$TAG", "$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC", "$PROGRAM", "$MSG") indexes("host", "facility", "priority", "datetime", "program") ); }; log { source(s_net); source(s_tcp); destination(d_routers); destination(d_mysql); }; I have verified the username and password are correct and have access to the syslog database. If I remove the "d_mysql" destination, my log statement works correctly and the log files get dumped in to the /var/log/routers.log file just fine. I have gone through the documentation on the website, FAQs, etc. and come up empty. It has me stumped. Any help would be greatly appreciated. Thanks, -Justin

2 1

Cannot start syslog-ng-3.3.1
by Hery Fanomezantsoa 29 Jan '12

29 Jan '12

Hello I installed syslog-ng-3.3.1 from source on debian lenny. And when I start it, it says "error while loading shared librairies: libsyslog-ng-3.3.1.so: cannot open shared object file: No such file or directory" though this file is in /usr/local/syslog-ng/lib/ libsyslog-ng-3.3.1.so Anyone can help?

3 3

[PATCH] [logproto.c] "Invalid Frame Header" in syslog protocol
by Gergely Nagy 29 Jan '12

29 Jan '12

When using the syslog protocol, in case when we received an EAGAIN during an attempt to send the framing, the frame was not resent, resulting in protocol errors and invalid frame header messages on the other end. This patch corrects the problem by not using log_proto_text_client_post to send framed messages, but a wrapper that can resume sending the frame too. Signed-off-by: Fried Zoltan <deirf(a)balabit.hu> Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- lib/logproto.c | 64 ++++++++++++++++++++++++++++++++++++------------------- 1 files changed, 42 insertions(+), 22 deletions(-) diff --git a/lib/logproto.c b/lib/logproto.c index 16ca0d7..e2cf944 100644 --- a/lib/logproto.c +++ b/lib/logproto.c @@ -35,6 +35,26 @@ #include <sys/uio.h> #include <limits.h> + +typedef struct _LogProtoTextClient +{ + LogProto super; + guchar *partial; + gsize partial_len, partial_pos; +} LogProtoTextClient; + +#define LPFCS_FRAME_INIT 0 +#define LPFCS_FRAME_SEND 1 +#define LPFCS_MESSAGE_SEND 2 + +typedef struct _LogProtoFramedClient +{ + LogProtoTextClient super; + gint state; + gchar frame_hdr_buf[9]; + gint frame_hdr_len, frame_hdr_pos; +} LogProtoFramedClient; + gboolean log_proto_set_encoding(LogProto *self, const gchar *encoding) { @@ -70,14 +90,6 @@ log_proto_free(LogProto *s) g_free(s); } - -typedef struct _LogProtoTextClient -{ - LogProto super; - guchar *partial; - gsize partial_len, partial_pos; -} LogProtoTextClient; - static gboolean log_proto_text_client_prepare(LogProto *s, gint *fd, GIOCondition *cond) { @@ -144,7 +156,7 @@ log_proto_text_client_flush(LogProto *s) * successfully sent this message, or if it should be resent by the caller. **/ static LogProtoStatus -log_proto_text_client_post(LogProto *s, guchar *msg, gsize msg_len, gboolean *consumed) +log_proto_client_post_writer(LogProto *s, guchar *msg, gsize msg_len, gboolean *consumed, gboolean syslog_proto) { LogProtoTextClient *self = (LogProtoTextClient *) s; gint rc; @@ -173,6 +185,14 @@ log_proto_text_client_post(LogProto *s, guchar *msg, gsize msg_len, gboolean *co */ return rc; } + else if (self->partial_len != 0 && !self->partial && syslog_proto) + { + LogProtoFramedClient *framed_self = (LogProtoFramedClient *) s; + self->partial_pos =0; + self->partial_len =0; + framed_self->state = LPFCS_FRAME_INIT; + return rc; + } /* OK, partial buffer empty, now flush msg that we just got */ @@ -219,6 +239,18 @@ log_proto_text_client_post(LogProto *s, guchar *msg, gsize msg_len, gboolean *co return LPS_SUCCESS; } +static LogProtoStatus +log_proto_text_client_post(LogProto *s, guchar *msg, gsize msg_len, gboolean *consumed) +{ + return log_proto_client_post_writer(s, msg, msg_len, consumed, FALSE); +} + +static LogProtoStatus +log_proto_framed_client_post_writer(LogProto *s, guchar *msg, gsize msg_len, gboolean *consumed) +{ + return log_proto_client_post_writer(s, msg, msg_len, consumed, TRUE); +} + LogProto * log_proto_text_client_new(LogTransport *transport) { @@ -1741,18 +1773,6 @@ log_proto_dgram_server_new(LogTransport *transport, gint max_msg_size, guint fla return &self->super.super; } -#define LPFCS_FRAME_INIT 0 -#define LPFCS_FRAME_SEND 1 -#define LPFCS_MESSAGE_SEND 2 - -typedef struct _LogProtoFramedClient -{ - LogProtoTextClient super; - gint state; - gchar frame_hdr_buf[9]; - gint frame_hdr_len, frame_hdr_pos; -} LogProtoFramedClient; - static LogProtoStatus log_proto_framed_client_post(LogProto *s, guchar *msg, gsize msg_len, gboolean *consumed) { @@ -1800,7 +1820,7 @@ log_proto_framed_client_post(LogProto *s, guchar *msg, gsize msg_len, gboolean * self->state = LPFCS_MESSAGE_SEND; } case LPFCS_MESSAGE_SEND: - rc = log_proto_text_client_post(s, msg, msg_len, consumed); + rc = log_proto_framed_client_post_writer(s, msg, msg_len, consumed); /* NOTE: we don't check *consumed here, as we might have a pending * message in self->partial before we begin, in which case *consumed -- 1.7.8.3

2 1

Syslog-ng and tomcat6 & apache2 servers
by Ralf W. 27 Jan '12

27 Jan '12

Hello group - Using syslog-ng as central syslog server. I was ask to syslog all tomcat6, as well as apache2 servers using syslog-ng. I followed some instructions on using sockets, but it doesn't work. Can somebody please point me in the right direction or has any ideas on how to do this. Thank YOU, Ralf The problem with troubleshooting is that trouble shoots back. - Ralf Wiegand 1999

2 1

AUTO: James B Horwath/TheGuardian is out of the office. (returning 01/30/2012)
by James B Horwath 27 Jan '12

27 Jan '12

I am out of the office until 01/30/2012. I am out of the office until Monday, January 30, 2012 with limited access to e-mail. If there are Nitro issues please contact Dante Rodino at 212-919-2819 or Sunil Gupta at 610-807-6710. Any other issues please contact Christopher Clarke manager of Security Operations Thanks, Jim Note: This is an automated response to your message "syslog-ng Digest, Vol 81, Issue 38" sent on 1/27/2012 6:00:15. This is the only notification you will receive while this person is away. ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

1 0

[Bug 142] New: --worker-threads=0 support
by bugzilla＠bugzilla.balabit.com 25 Jan '12

25 Jan '12

https://bugzilla.balabit.com/show_bug.cgi?id=142 Summary: --worker-threads=0 support Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: enhancement Estimated Hours: 0.0 Hello, I was hoping that threading support would solve my problem described in https://bugzilla.balabit.com/show_bug.cgi?id=113. Unfortunately it looks like it is impossible to create configuration for which each target will use one thread by default (as only such configuration is safe in case of some targets blocking on I/O). This feature request is about adding some option like: --worker-threads=0 that would limit number of threads to numer of sources + number of destinations, so each possible blocking I/O would be happening in separate thread. Yes, it would be more than cpu cores but this configuration is about reliability and not performance. (right now I have only one, network logging target that needs to always work, so probably disabling threading globally and enabling threading only for this network target would get me "always working" logging via net, even if some infinite I/O blocking happens. What would be best is to have ability to have such config on by default for all targets) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 12