- syslog-ng - lists.balabit.hu

syslog-ng 3.2.4 MySQL connection loss Server has gone away
by Erik Maciejewski 12 Nov '11

12 Nov '11

Hello, I have been researching an issue with syslog-ng 3.2.4 (both the Linux glibc2.3.6 and platform independent compiled from source versions) and MySQL on CentOS 5.6 in which syslog-ng tries to insert a log messages using a dead TCP or unix socket connection to a MySQL database. The issue results in the max attempt to insert a log message and then the message subsequently dropped. This seems to occur regularly in predominately low message volume environments, but has the potential to affect all environments using a MySQL (or other db) destination. The root cause of the issue seems to be directly related to the health of the connection between syslog-ng and MySQL and can be affected by the "wait_timeout" value used by MySQL to kill off inactive connections. I want to provide justification for implementing a fix to syslog-ng as I believe manipulating a, possibly tuned, environment variable for MySQL would seem like the wrong approach to take for remedial action. I feel that many MySQL instances are implemented in shared environments and are themselves shared by many applications. New connections to a MySQL instance are generally regarded as low cost and, it would seem, more often than not never used in a persisted fashion when supporting distributed applications. That being said, many times the "wait_timeout" value is set very low so that the MySQL instance can effectively control the number of simultaneous connections. By taking somewhat of a black-box approach to the issue (I'm just starting to explore syslog-ng), I noticed that there doesn't seem to be any health checking of the TCP or unix socket connection in the SQL destination implementation after the initial connection is made (most of the db actions being abstracted away by libdbi). Even if a syslog-ng database thread is suspended and reactivated due to error, there does not seem to be any attempt to check the health of the database connection. I have implemented a fix in my compiled version that will check a database connection's health and attempt to reconnect upon discovering a dead connection. I would like to know the policies/procedures/best practices for submitting such issues and/or fixes for discussion, review, and implementation. If this is a known issue or I am just wrong, all the better! Thank you guys for keeping this project going and I'm looking forward to implementing syslog-ng in a production environment in the very near future! Regards, Erik Maciejewksi

2 7

Variables in PatternDB - what am I doing wrong?
by Daniel Ankers 12 Nov '11

12 Nov '11

Hi, I've got the following as part of my ruleset:  <rule id='def42cfb-4364-4cfd-bbf1-cdf4f0bc3c88' class='lowpri' context-id="badauth-${badauth.errorsrc}" context-timeout='600' context-scope='host'> <patterns> <pattern>%TCP-6-BADAUTH: No MD5 digest from @IPvANY:badauth.errorsrc:@(@NUMBER::@) to @IPvANY:badauth.errordst:@(@NUMBER::@) (RST)</pattern> </patterns> <examples> <example> <test_message program='patternize'>%TCP-6-BADAUTH: No MD5 digest from 195.66.XXX.XX(179) to 195.66.YYYY.YY(56561) (RST)</test_message> </example> <example> <test_message program='patternize'>%TCP-6-BADAUTH: No MD5 digest from 2001:7F8:X::abcd:1(179) to 2001:7F8:X::1234:1(21296) (RST)</test_message> </example> </examples> <actions> <action trigger='match'> <message> <values> <value name='MESSAGE'>$(if ("${badauth.errorsrc}@1" eq "${badauth.errorsrc}@2") "Duplicate" "First") BGP Authentication Error to neighbour ${badauth.errorsrc}@1 - last one was ${badauth.errorsrc}@2</value> </values> </message> </action> </actions> </rule>  When I feed example messages in from a file, I expect to see something like the following: Nov 4 10:40:54 syslog First BGP Authentication Error to neighbour 2001:7F8:X::abcd:1 - last one was Nov 4 10:40:54 syslog Duplicate BGP Authentication Error to neighbour 2001:7F8:X::abcd:1 - last one was 2001:7F8:X::abcd:1 Nov 4 10:40:54 syslog First BGP Authentication Error to neighbour 195.66.Y.Z - last one was Nov 4 10:40:54 syslog Duplicate BGP Authentication Error to neighbour 195.66.Y.Z - last one was 195.66.Y.Z Nov 4 10:40:54 syslog Duplicate BGP Authentication Error to neighbour 195.66.Y.Z - last one was 195.66.Y.Z Nov 4 10:40:54 syslog Duplicate BGP Authentication Error to neighbour 195.66.Y.Z - last one was 195.66.Y.Z Instead I see: Nov 4 10:40:54 syslog Duplicate BGP Authentication Error to neighbour 2001:7F8:X::abcd:1 - last one was Nov 4 10:40:54 syslog Duplicate BGP Authentication Error to neighbour 2001:7F8:X::abcd:1 - last one was 2001:7F8:4::abcd:1 Nov 4 10:40:54 syslog Duplicate BGP Authentication Error to neighbour 195.66.Y.Z - last one was Nov 4 10:40:54 syslog Duplicate BGP Authentication Error to neighbour 195.66.Y.Z - last one was 195.66.Y.Z Nov 4 10:40:54 syslog Duplicate BGP Authentication Error to neighbour 195.66.Y.Z - last one was 195.66.Y.Z Nov 4 10:40:54 syslog Duplicate BGP Authentication Error to neighbour 195.66.Y.Z - last one was 195.66.Y.Z What am I getting wrong with the "if" function? The background to this is that the first of these messages from any host is useful information - however they are sent every 10 seconds and I'm trying to suppress all but the first message for each neighbour. I've tried several different ways of doing this including rate-limiting on the <action> but none of them have worked the way I expected. Thanks, Dan Daniel Ankers

2 2

Problems writing to files with different templates/ownership in 3.x
by Brian De Wolf 12 Nov '11

12 Nov '11

Hello, I'm using syslog-ng as a remote syslog server for several of our internal groups. As such, when a syslog arrives, I use the source address to determine the ownership of the log file. Here is how I'm currently doing this: source net { udp(ip(0.0.0.0), port(514) flags(no-multi-line)); }; filter examplefilter { netmask("10.0.0.0/255.255.0.0"); }; filter example2filter { netmask("192.168.0.0/255.255.0.0"); }; destination examplelog { file("/var/log/remote/$HOST.log" group(examplegroup)); }; destination example2log { file("/var/log/remote/$HOST.log" group(example2group)); }; log { source(net); filter(examplefilter); destination(examplelog); flags(final); }; log { source(net); filter(example2filter); destination(example2log); flags(final); }; This worked fine in 1.6.x and appears to work fine in 3.2.x, but when logrotate pokes syslog-ng I get lines like this: syslog-ng: Internal error, duplicate configuration elements refer to the same persistent config; name='affile_dd_writers(/var/log/remote/$HOST.log)' Is there a better way to do this which only produces one reference to "/var/log/remote/$HOST.log"? Also, I'm using a similar set of filters and destinations to apply different templates to text that is being written to a single file. This also produces the error, but I am more concerned that the combined file might experience issues if the config isn't supposed to have multiple destinations be the same location. Is there a way to use filters to apply templates while still only having one destination defined? Could my current setup result in lost log lines? Thanks, Brian

2 1

[PATCH (3.3)] value-pairs: Fix a small memory leak in the commandline parser.
by Gergely Nagy 12 Nov '11

12 Nov '11

Whenever we parse a command-line, we construct a new argv array, to prepend a zeroth element for glibs option parser. We correctly free'd it on the error path, but never on the success path. This lead to a small memory leak every time value_pairs_new_from_cmdline() was called (that is, at the moment, each $(format-json) template function leaked a little bit). This patch fixes this issue by modifying the error handling a little: instead of freeing everything and returning NULL, we only free the value-pairs structure, and set it to NULL. The rest of the freeing is left up to the common parts afterwards, which now correctly frees the constructed argv array too. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- lib/value-pairs.c | 5 ++--- 1 files changed, 2 insertions(+), 3 deletions(-) diff --git a/lib/value-pairs.c b/lib/value-pairs.c index 803e14c..b5a95af 100644 --- a/lib/value-pairs.c +++ b/lib/value-pairs.c @@ -473,11 +473,10 @@ value_pairs_new_from_cmdline (GlobalConfig *cfg, if (!g_option_context_parse (ctx, &argc, &argv, error)) { value_pairs_free (vp); - g_option_context_free (ctx); - g_free (argv); - return NULL; + vp = NULL; } g_option_context_free (ctx); + g_free (argv); return vp; } -- 1.7.7.2

1 0

Loganalyzer
by Peter Czanik 11 Nov '11

11 Nov '11

Hello, Recently I found many e-mail and forum posts looking for a web GUI for syslog-ng. One of them, Loganalyzer is getting more popular, as a completely free web application. There is just one catch, it was not designed for syslog-ng originally. So I did some research and tests, and using my instructions quite easy to get started with it. Of course Loganalyzer has some rough edges, but it works for me on a number of different systems. For a step by step tutorial to get started, read my blog at http://czanik.blogs.balabit.com/2011/02/loganalyzer/ Have a nice weekend! Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

2 3

Syslog_ng 3.0.7 issues running in Central server mode on AIX 7.1
by Rakesh Rajasekharan 11 Nov '11

11 Nov '11

Hi, I am facing some challenges configuring the syslog_ng( 3.0.7) for central logging on AIX. The subsystem becomes in-operative while trying to set it up for central logging. But otherwise while tryng to log the messages on the same machine it runs fine... Below are the logs 1. Logging on the same host. # /opt/soe/local/syslog_ng/etc/init.d/syslog-ng.d restart 0513-044 The syslog_ng Subsystem was requested to stop. 0513-059 The syslog_ng Subsystem has been started. Subsystem PID is 9043968. # ^C # lssrc -a |grep -i syslog syslog_ng local 9043968 active syslogd ras inoperative Now ,after I change the conf file to the central server one... # cp syslog-ng.conf.server-sample syslog-ng.conf # /opt/soe/local/syslog_ng/etc/init.d/syslog-ng.d restart 0513-044 The syslog_ng Subsystem was requested to stop. 0513-059 The syslog_ng Subsystem has been started. Subsystem PID is 3342368. # lssrc -a |grep -i syslog syslogd ras inoperative syslog_ng local inoperative Below is are the contents for myu conf file whiel trying to set up for central logging. # cat syslog-ng.conf.server-sample @version: 3.0 source s_remote { tcp(); }; destination d_clients { file("/var/adm/messages-ng.$HOST.log"); }; log { source(s_remote); destination(d_clients); }; source s_local { internal();unix-dgram("/dev/log"); }; destination d_local { file("/var/log/syslog-ng.log" owner("root") group("adm") perm(0640)); }; log { source(s_local); destination(d_local); }; destination d_messages { file("/var/log/messages-ng" owner("root") group("adm") perm(0640)); }; log { source(s_local); destination(d_messages); }; Please let me know if somehting in he conf file does not look fine and might be causing the susbsytem to turn inoperative. Because If i revert back to my old config file the subsystem again becomes active. Regards, Rakesh

1 1

syslog-ng Insider - November 2011
by Peter Czanik 11 Nov '11

11 Nov '11

Dear syslog-ng users, This is the 8th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com <mailto:documentation@balabit.com> FEATURED NEWS syslog-ng 3.3.2 is about to be released! ---------------------------------------- A new version of syslog-ng is about to be released! There are no new features to announce, but all problems reported since 3.3.1 should be fixed by now! To make it the best syslog-ng ever, please test it to make sure, that all your problems are fixed. Sources are available in git or as a snapshot: * git://git.balabit.hu/bazsi/syslog-ng-3.3 * http://packages.madhouse-project.org/syslog-ng/3.3/3.3.2/syslog-ng-3.3.2-HE… Binary packages are available are available for several Linux distributions: * openSUSE: http://download.opensuse.org/repositories/home:/czanik:/syslog-ng33/ * Debian and Ubuntu: http://asylum.madhouse-project.org/projects/debian/ syslog-ng and CEE ----------------- The latest syslog-ng release, version 3.3 can be used to implement part of the “CEE over syslog” standard. BalaBit’s patterndb <http://www.balabit.com/network-security/syslog-ng/opensource-logging-system…> technology was able to extract information from syslog messages already for a long time. With this release JSON output was added, meaning the extracted information can be output as JSON data. What it means in practice, that syslog-ng is able to parse log messages, and output the extracted fields in the form required by CEE. To see, how it works, check http://czanik.blogs.balabit.com/2011/10/cee-and-syslog-ng/ Development of syslog-ng 3.4 started ------------------------------------ While 3.3 was just released, development of 3.4 is already started. The first version of a JSON parser is already merged ( https://github.com/bazsi/syslog-ng-3.4/commit/e5569687bba2551c89a78faee55bc… ). There are some pending fixes and enhancements, which add boolean, array and nested JSON parsing ( https://github.com/algernon/syslog-ng/commits/feature/3.4/json/parser ). Value-pairs key rewrite is work in progress ( https://github.com/algernon/syslog-ng/commits/feature/3.4/value-pairs/rekey ) and nested JSON output is also planned. The above features among others help us to better support CEE. With key rewriting we could use a “.cee.” prefix in CEE related patterns and rewrite it later. It also makes parsing of messages possible. All the current code is available for testing in Algernon's 3.4 sandbox project: https://github.com/algernon/syslog-ng/tree/sandbox/3.4 To download it, use git: $ git clone -b sandbox/3.4 git@github.com:algernon/syslog-ng <mailto:git@github.com:algernon/syslog-ng> OTHER SHORT NEWS * An interesting article about centralized syslog server in Linux Journal: http://www.linuxjournal.com/content/creating-centralized-syslog-server NEW RELEASES * syslog-ng OSE 3.2.5: http://www.balabit.com/downloads/files/syslog-ng/sources/3.2.5 WHITE PAPERS A longer paper about the “Future of logging tools”, which also provides some background information about HSRL, as used in syslog-ng: http://andrea.blogs.balabit.com/files/2011/10/HSRL_backgrounder_english_fin… ARCHIVE http://insider.blogs.balabit.com/ -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

3.3.x conditional rewrite bug
by Martin Holste 11 Nov '11

11 Nov '11

The following will not work in the 3.3.x branch: filter f_rewrite_cisco_program { match('^(%(?:ASA|PIX|FWSM)\-\d\-\d{6}): ([^\n]+)' value("MESSAGE") type("pcre") flags("store-matches" "nobackref")); }; rewrite r_cisco_program { set("$1", value("PROGRAM") condition(filter(f_rewrite_cisco_program))); set("$2", value("MESSAGE") condition(filter(f_rewrite_cisco_program))); }; It will process a few lines and then hang indefinitely. It will process ok if the condition is taken off of the filter, so I am assuming this is a PCRE issue, though I found it made no difference to remove the PCRE requirement and use a simpler matching expression. All works perfectly in 3.2.4.

3 4

Quick filter question
by Lay, James 10 Nov '11

10 Nov '11

Hey all! Real quick...trying to filter OUT firewall hits that have say...169.254. Will this do the trick? filter f_firewall { not program (firewall flags(ignore-case)); and not message("169\.254\.[0-9]+\.[0-9]+"); }; Thanks all. James

4 10

Syslog-ng under cygwin.
by andrea.meconi＠libero.it 10 Nov '11

10 Nov '11

Hello. Does anyone know the step by step to compile syslog-ng under Cygwin? I'm running Cygwin on Windows 2008 R2 64 bit and I need option spoof-source enabled. I'm trying this guide, http://mathieu.carbou.free.fr/wiki/index.php?title=How_to_compile_Libnet_un… without success. Thanks. Regards. Andrea

1 0