- syslog-ng - lists.balabit.hu

[Bug 108] New: 2.6.38+ will require CAP_SYSLOG (CAP_SYS_ADMIN not enough)
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=108 Summary: 2.6.38+ will require CAP_SYSLOG (CAP_SYS_ADMIN not enough) Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: enhancement Estimated Hours: 0.0 2.6.38+ kernels (linus git) reports: [ 9.890305] WARNING: at kernel/printk.c:430 do_syslog+0x427/0x452() [ 9.890318] Hardware name: 2764CTO [ 9.890320] Attempt to access syslog with CAP_SYS_ADMIN but no CAP_SYSLOG (deprecated and denied). when syslog tries to do syslogging. Additionally I'm geting: [root@t400 ~]# /usr/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf Error opening file for reading; filename='/proc/kmsg', error='Operation not permitted (1)' Error initializing source driver; source='s_sys', id='s_sys#0' Error initializing message pipeline; which likely is due to the same problem. Commit: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h… -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 44

[Bug 107] New: when trying to log to postgres database if port is not specified it gets defaulted to 0
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=107 Summary: when trying to log to postgres database if port is not specified it gets defaulted to 0 Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jhnsmth64(a)gmail.com Type of the Report: bug Estimated Hours: 0.0 syslog-ng.conf ... destination d_pgsql { sql(type(pgsql) host("localhost") username("user") password("pass") ... }; ... If destination stays defined like above, without port specified explicitly, syslog sends log messages to port 0 instead defaulting port to the Postgres port (5432). Destination settings below works: ... destination d_pgsql { sql(type(pgsql) host("localhost") port(5432) username("user") password("pass") ... }; ... -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 4

[Bug 106] New: Syslog-ng memory strdup and g_malloc leaks
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=106 Summary: Syslog-ng memory strdup and g_malloc leaks Product: syslog-ng Version: 3.2.x Platform: Other OS/Version: Solaris Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: daniel_novak(a)kb.cz Type of the Report: refactorization Estimated Hours: 0.0 We tried to compile a few last git version of syslog-3.2.1(syslog-ng-3.2.git-5f25ce47ab57774f8fe8df17bc96a006e535cb53) as well as 3.2.1 stable release. Everything is running well, but there are several minor memory leaks.We run on Solaris 10/08 on sparc platform.With libumem.so in memory debug mode MDB output is following : > ::findleaks CACHE LEAKED BUFCTL CALLER 00052288 2 00110d98 libc.so.1`strdup+0xc 00052788 1 0007de00 libglib-2.0.so.0.2513.0`g_malloc0+0x64 ---------------------------------------------------------------------- Total 3 buffers, 64 bytes =========================================================================================== > ::findleaks -dvf findleaks: maximum buffers => 4121 findleaks: actual buffers => 3967 mdb: [fef80000, fef84000): couldn't read 16384 bytes at fef80000: no mapping for address findleaks: findleaks: potential pointers => 341574 findleaks: dismissals => 196071 (57.4%) findleaks: misses => 130325 (38.1%) findleaks: dups => 11214 ( 3.2%) findleaks: follows => 3964 ( 1.1%) findleaks: findleaks: elapsed wall time => 0 seconds findleaks: CACHE LEAKED BUFCTL CALLER 00052288 2 00110d98 libc.so.1`strdup+0xc 00052788 1 0007de00 libglib-2.0.so.0.2513.0`g_malloc0+0x64 ---------------------------------------------------------------------- Total 3 buffers, 64 bytes umem_alloc_16 leak: 2 buffers, 16 bytes each, 32 bytes total ADDR BUFADDR TIMESTAMP THREAD CACHE LASTLOG CONTENTS 110d98 1097e0 1b08cf3fb0c96c 1 52288 43af4 0 libumem.so.1`umem_cache_alloc+0x210 libumem.so.1`umem_alloc+0x60 libumem.so.1`malloc+0x28 libc.so.1`strdup+0xc libsyslog-ng.so.0.0.0`cfg_lexer_lookup_keyword+0xf0 libsyslog-ng.so.0.0.0`_cfg_lexer_lex+0x18a4 libsyslog-ng.so.0.0.0`cfg_lexer_lex+0x284 libsyslog-ng.so.0.0.0`main_lex+0x1c libsyslog-ng.so.0.0.0`main_parse+0x7a4 libsyslog-ng.so.0.0.0`cfg_parser_parse+0xcc libsyslog-ng.so.0.0.0`cfg_run_parser+0x1ac libsyslog-ng.so.0.0.0`cfg_read_config+0x98 initial_init+0x5c main+0x244 _start+0x5c umem_alloc_32 leak: 1 buffer, 32 bytes ADDR BUFADDR TIMESTAMP THREAD CACHE LASTLOG CONTENTS 7de00 77b98 1b08cf406e21b0 1 52788 373ec 0 libumem.so.1`umem_cache_alloc+0x210 libumem.so.1`umem_alloc+0x60 libumem.so.1`malloc+0x28 libumem.so.1`calloc+0x58 libglib-2.0.so.0.2513.0`g_malloc0+0x64 libsyslog-ng.so.0.0.0`serialize_file_archive_new+0x1c libsyslog-ng.so.0.0.0`persist_state_load+0x54 libsyslog-ng.so.0.0.0`persist_state_start+0x34 libsyslog-ng.so.0.0.0`cfg_initial_init+0x28 initial_init+0xbc main+0x244 _start+0x5c ========================================================================= findleaks: using cached results (-f will force a full run) CACHE LEAKED BUFCTL CALLER 00052288 2 00110d98 libc.so.1`strdup+0xc 00052788 1 0007de00 libglib-2.0.so.0.2513.0`g_malloc0+0x64 ---------------------------------------------------------------------- Total 3 buffers, 64 bytes > 00110d98::umem_verify mdb: cache 110d98 () does not have redzone checking enabled > 00052288::umem_verify Summary for cache 'umem_alloc_16' clean > 00052788::umem_verify Summary for cache 'umem_alloc_32' clean ============================================================================= -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

[Bug 104] New: Add libtool option -module
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=104 Summary: Add libtool option -module Product: syslog-ng Version: 3.2.x Platform: All OS/Version: All Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: vinschen(a)redhat.com Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=30) --> (https://bugzilla.balabit.com/attachment.cgi?id=30) Patch to add libtool option -module Libtool 2.2.6 and later provides an option -module which should be used when creating shared libraries which are supposed to be used as modules which get loaded via dlopen. See the "Building modules to dlopen" chapter in `info libtool'. For Cygwin the additional benefit is that the modules are not copied into a parallel "bin" directory at installation time, which is the default otherwise to accommodate the DLL search algorithm on Windows. The attached patch just adds the -module option to each of the Makefile.am files in the modules subdir. Corinna -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 4

[Bug 120] New: afsql. c afsql_dd_format_* routines should include table in persist_name string
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=120 Summary: afsql.c afsql_dd_format_* routines should include table in persist_name string Product: syslog-ng Version: 3.2.x Platform: Other URL: https://lists.balabit.hu/pipermail/syslog-ng/2011- February/015913.html OS/Version: Other Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jtk(a)cymru.com Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=36) --> (https://bugzilla.balabit.com/attachment.cgi?id=36) include table name in persist_name As originally discovered in the syslog-ng list post entitled "[syslog-ng] duplicate config elements in sql destinations" by John Kristoff on 2011-02-11, syslog-ng will complain, when multiple destinations all point to the same database, but different tables with the message: Internal error, duplicate configuration elements refer to the same persistent config; name='afsql_dd(pgsql,127.0.0.1,,bar)' Balazs responded describing the potential problems with counters being swapped and a fix that appears to work in testing. A Patch for syslog-ng 3.2.4 is attached, but similar patch should work for earlier versions as indicated by Balazs' posting. Thank you, John -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

[Bug 139] New: syslog-ng crashes on SIGHUP when rewrite used in multiple log{} declarations
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=139 Summary: syslog-ng crashes on SIGHUP when rewrite used in multiple log{} declarations Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.syslogng(a)feystorm.net Type of the Report: --- Estimated Hours: 0.0 This is for version 3.3.1 which isnt an available version in the bug tracker. I've managed to create a situation where syslog-ng crashes when it receives a SIGHUP, and a certain rewrite has been used in at least 3 different log{} declarations. Below is the extremely stripped down configuration I've created which duplicates the issue. With the below configuration, when syslog-ng receives a HUP, it will get a segfault in malloc_consolidate(). Additionally, the process which monitors syslog-ng for crashing doesnt appear to have a signal handler for SIGHUP, so the monitor process will die when it gets a HUP. This is a problem, at least on redhat as the redhat init script sends a HUP to both the monitor process and the real worker process when the init script is called with `reload` @version: 3.3 @include "scl.conf" source s_local { system(); }; rewrite r_fext { #set("$LEVEL",value('FEXT')); subst('foo','bar', value('FEXT') type('string')); }; log { source(s_local); rewrite(r_fext); }; log { source(s_local); rewrite(r_fext); }; log { source(s_local); rewrite(r_fext); }; -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

syslog-ng 3.3.1 dying after SIGHUP
by Patrick H. 23 Oct '11

23 Oct '11

Is anyone else having issues with syslog-ng 3.3 dying when it gets a sighup? When the syslog-ng monitor process gets a HUP, it seems to die immediately, as if there were no signal handler. Strace shows absolutely nothing between getting the signal, and it exiting. When the actual syslog-ng worker process gets a HUP, it does a bunch of stuff, and then segfaults. It looks like it segfaults immediately after closing /var/log/syslog 4362 17:28:44.964645 stat("/var/log", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 4362 17:28:44.964729 stat("/var/log/syslog", {st_mode=S_IFREG|0644, st_size=3905, ...}) = 0 4362 17:28:44.964813 open("/var/log/syslog", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK, 0644) = 26 4362 17:28:44.964879 fcntl(26, F_GETFD) = 0 4362 17:28:44.964936 fcntl(26, F_SETFD, FD_CLOEXEC) = 0 4362 17:28:44.964993 capget(0x19980330, 0, {CAP_DAC_OVERRIDE|CAP_SYS_ADMIN, CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN, 0}) = 0 4362 17:28:44.965082 capset(0x19980330, 0, {CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_SYS_ADMIN, CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN, 0}) = 0 4362 17:28:44.965148 capget(0x19980330, 0, {CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_SYS_ADMIN, CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN, 0}) = 0 4362 17:28:44.965213 capset(0x19980330, 0, {CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_FOWNER|CAP_SYS_ADMIN, CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN, 0}) = 0 4362 17:28:44.965279 fchown(26, 0, 4294967295) = 0 4362 17:28:44.965344 fchown(26, 4294967295, 0) = 0 4362 17:28:44.965404 fchmod(26, 0644) = 0 4362 17:28:44.965464 capset(0x19980330, 0, {CAP_SYS_ADMIN, CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN, 0}) = 0 4362 17:28:44.965532 close(21) = 0 4362 17:28:44.966122 --- SIGSEGV (Segmentation fault) @ 0 (0) --- I'm going to try and track this down further, but was wondering if anyone else was seeing this behavior. Running this on RHEL5

2 3

[PATCH] afsocket: Fix compilation with libsystemd-daemon
by Gergely Nagy 22 Oct '11

22 Oct '11

When the libsystemd-daemon library is used, we need to use the header provided by the library, otherwise linking will likely fail. To do that, configure sets WITH_LIBSYSTEMD as appropriate, and depending on that value, we either include <systemd/sd-daemon.h> or "sd-daemon.h". Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- configure.in | 1 + modules/afsocket/afunix.c | 5 +++++ 2 files changed, 6 insertions(+), 0 deletions(-) diff --git a/configure.in b/configure.in index 13bc874..1e3a09a 100644 --- a/configure.in +++ b/configure.in @@ -1059,6 +1059,7 @@ AC_DEFINE_UNQUOTED(ENABLE_LINUX_CAPS, `enable_value $enable_linux_caps`, [Enable AC_DEFINE_UNQUOTED(ENABLE_PCRE, `enable_value $enable_pcre`, [Enable PCRE support]) AC_DEFINE_UNQUOTED(ENABLE_ENV_WRAPPER, `enable_value $enable_env_wrapper`, [Enable environment wrapper support]) AC_DEFINE_UNQUOTED(ENABLE_SYSTEMD, `enable_value $enable_systemd`, [Enable systemd support]) +AC_DEFINE_UNQUOTED(WITH_LIBSYSTEMD, `enable_value $with_libsystemd`, [Compile with libsystemd-daemon]) AM_CONDITIONAL(ENABLE_ENV_WRAPPER, [test "$enable_env_wrapper" = "yes"]) AM_CONDITIONAL(ENABLE_SYSTEMD, [test "$enable_systemd" = "yes"]) diff --git a/modules/afsocket/afunix.c b/modules/afsocket/afunix.c index 57ae213..2d57078 100644 --- a/modules/afsocket/afunix.c +++ b/modules/afsocket/afunix.c @@ -25,7 +25,12 @@ #include "misc.h" #include "messages.h" #include "gprocess.h" + +#if WITH_LIBSYSTEMD +#include <systemd/sd-daemon.h> +#else #include "sd-daemon.h" +#endif #include <string.h> #include <sys/types.h> -- 1.7.7

2 1

feature request: clear stats counters after diplayed
by syslogng＠feystorm.net 18 Oct '11

18 Oct '11

I was wondering if it would be possible to clear the stats generated by syslog-ng after theyre logged from the stats_freq setting. Basically so every set of stats that gets displayed will be the numbers since the last time stats were displayed, not for the whole lifetime of the process. Largely, this is just so that one can easily tell if processing has changed in a certain time period without having to do the math. Additionally it also would help a great deal with system health monitoring software. For example, something could look to see if syslog-ng has dropped any messages, but as it currently is it would have to compare the most recent stats with the previous set of stats just to see if the dropped counter went up.

2 1

[PATCH] syslog-ng: Add a -q/--silent-module-load option
by Gergely Nagy 15 Oct '11

15 Oct '11

With the -q/--silent-module-load option set (defaults to off), no warnings will be printed when a module cannot be found. If it's found, but cannot be loaded, a message is still printed. If it is used later in the config, that's still handled correctly. The flag only suppresses the warning, and nothing else. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- lib/globals.c | 1 + lib/plugin.c | 9 +++++---- lib/syslog-ng.h | 1 + syslog-ng/main.c | 1 + 4 files changed, 8 insertions(+), 4 deletions(-) diff --git a/lib/globals.c b/lib/globals.c index b2afec7..b3b2121 100644 --- a/lib/globals.c +++ b/lib/globals.c @@ -28,3 +28,4 @@ GlobalConfig *configuration; int cfg_parser_debug; gchar *module_path = MODULE_PATH; gchar *default_modules = DEFAULT_MODULES; +gboolean silent_module_load = FALSE; diff --git a/lib/plugin.c b/lib/plugin.c index 5239974..cce549a 100644 --- a/lib/plugin.c +++ b/lib/plugin.c @@ -179,10 +179,11 @@ plugin_dlopen_module(const gchar *module_name, const gchar *module_path) g_strfreev(module_path_dirs); if (!plugin_module_name) { - msg_error("Plugin module not found in 'module-path'", - evt_tag_str("module-path", module_path), - evt_tag_str("module", module_name), - NULL); + if (!silent_module_load) + msg_error("Plugin module not found in 'module-path'", + evt_tag_str("module-path", module_path), + evt_tag_str("module", module_name), + NULL); return NULL; } msg_debug("Trying to open module", diff --git a/lib/syslog-ng.h b/lib/syslog-ng.h index 4bd79c2..edb8a4d 100644 --- a/lib/syslog-ng.h +++ b/lib/syslog-ng.h @@ -66,5 +66,6 @@ typedef struct _GlobalConfig GlobalConfig; extern GlobalConfig *configuration; extern gchar *module_path; extern gchar *default_modules; +extern gboolean silent_module_load; #endif diff --git a/syslog-ng/main.c b/syslog-ng/main.c index c682e44..e414321 100644 --- a/syslog-ng/main.c +++ b/syslog-ng/main.c @@ -75,6 +75,7 @@ static GOptionEntry syslogng_options[] = { "module-registry", 0, 0, G_OPTION_ARG_NONE, &display_module_registry, "Display module information", NULL }, { "default-modules", 0, 0, G_OPTION_ARG_STRING, &default_modules, "Set the set of auto-loaded modules, default=" DEFAULT_MODULES, "<module-list>" }, { "seed", 'S', 0, G_OPTION_ARG_NONE, &dummy, "Does nothing, the need to seed the random generator is autodetected", NULL}, + { "silent-module-load", 'q', 0, G_OPTION_ARG_NONE, &silent_module_load, "Load modules silently, not printing a warning when one's not found", NULL}, #ifdef YYDEBUG { "yydebug", 'y', 0, G_OPTION_ARG_NONE, &cfg_parser_debug, "Enable configuration parser debugging", NULL }, #endif -- 1.7.7

2 2