- syslog-ng - lists.balabit.hu

[Bug 138] New: Compilation failure in 3.3.1: CLOCK_MONOTONIC undeclared
by bugzilla＠bugzilla.balabit.com 15 Oct '11

15 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=138 Summary: Compilation failure in 3.3.1: CLOCK_MONOTONIC undeclared Product: syslog-ng Version: unspecified Platform: Macintosh OS/Version: Mac OS Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jacknagel(a)gmail.com Type of the Report: bug Estimated Hours: 0.0 Attempting to compile syslog-ng v3.3.1 from source on Mac OS X 10.6.8 fails with logsource.c: In function ‘log_source_msg_ack’: logsource.c:85: error: ‘CLOCK_MONOTONIC’ undeclared (first use in this function) logsource.c:85: error: (Each undeclared identifier is reported only once logsource.c:85: error: for each function it appears in.) I believe this is because OS X does not define CLOCK_MONOTONIC. Actually, afaik, OS X doesn't implement clock_gettime() either. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[PATCH] Fix compilation without OpenSSL.
by Gergely Nagy 15 Oct '11

15 Oct '11

While most places where OpenSSL was used were guarded by ENABLE_SSL ifs, some were not. This patch adds those guards to lib/crypto.c, modules/afsql/afsql.c and tests/loggen/loggen.c. It also makes sure that OPENSSL_LIBS gets emptied when enable_ssl is set to no. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- configure.in | 4 ++++ lib/crypto.c | 4 ++++ modules/afsql/afsql.c | 3 +++ tests/loggen/loggen.c | 3 +++ 4 files changed, 14 insertions(+), 0 deletions(-) diff --git a/configure.in b/configure.in index 13bc874..686911e 100644 --- a/configure.in +++ b/configure.in @@ -679,6 +679,10 @@ else enable_ssl="no" fi +if test "x$enable_ssl" = "xno"; then + OPENSSL_LIBS="" +fi + dnl dnl Right now, openssl is never linked statically as it is only used by the dnl TLS build of the afsocket plugin which is loaded dynamically anyway. diff --git a/lib/crypto.c b/lib/crypto.c index 702609c..ac4d070 100644 --- a/lib/crypto.c +++ b/lib/crypto.c @@ -29,6 +29,8 @@ #include "crypto.h" #include "apphook.h" +#if ENABLE_SSL + #include <openssl/rand.h> #include <openssl/ssl.h> #include <stdio.h> @@ -124,3 +126,5 @@ crypto_init(void) } /* the crypto options (seed) are handled in main.c */ + +#endif diff --git a/modules/afsql/afsql.c b/modules/afsql/afsql.c index eb59b57..02b9f83 100644 --- a/modules/afsql/afsql.c +++ b/modules/afsql/afsql.c @@ -35,7 +35,10 @@ #include <dbi/dbi.h> #include <string.h> + +#if ENABLE_SSL #include <openssl/md5.h> +#endif /* field flags */ enum diff --git a/tests/loggen/loggen.c b/tests/loggen/loggen.c index c5399a7..bf11a1e 100644 --- a/tests/loggen/loggen.c +++ b/tests/loggen/loggen.c @@ -14,11 +14,14 @@ #include <glib.h> #include <signal.h> +#if ENABLE_SSL #include <openssl/crypto.h> #include <openssl/x509.h> #include <openssl/pem.h> #include <openssl/ssl.h> #include <openssl/err.h> +#endif + #include <unistd.h> #define MAX_MESSAGE_LENGTH 8192 -- 1.7.0.4

2 1

Special characters in syslogng filters
by Jay 15 Oct '11

15 Oct '11

Hello If the filter specified in syslog-ng.conf contains the ( character or ) character, then is it correct to prefix them with \\. For example, if I need to filter a syslog containing the string (abcd) then in syslog-ng.conf, I would need to specify the filter as \$abcd\$ Could someone confirm, if this is the correct way of specifying the filter, please ? If not, please let me know the correct way of specifying the filter. Thanks in advance for your help.

2 1

rfc3195 support
by Linus Grybäck 13 Oct '11

13 Oct '11

I was wondering if syslog-ng had support for sending messages according to the rfc3195 standard? I have not found any mention of it in the documentation. I noticed that syslog-ng can send BSD style messages with TCP. From what I understood from the rfc3195 ( http://www.ietf.org/rfc/rfc3195.txt) it specifies a way to do just that. So I was wondering if syslog-ng uses this form when it sends BSD style messages over TCP? If it have support for it at all, or not? With BSD style messages I mean messages following the rfc3164, also called legacy-syslog in the documentation. // Thanks for your help, Linus

2 1

syslog-ng Insider - October 2011
by Peter Czanik 13 Oct '11

13 Oct '11

Dear syslog-ng users, This is the 7th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com <mailto:documentation@balabit.com> FEATURED NEWS syslog-ng 3.3.1 is released! ---------------------------- A new version of syslog-ng is released! It took about a year to develop as a collaboration of over 50 individuals. Major new features include: * mongodb support * JSON support * Multi-threaded architecture For a complete list of changes, please check the NEWS file at https://www.balabit.com/files/syslog-ng/open-source-edition/3.3.1/changelog… Documentation is available at: http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.3-guid… Binary packages are available are already available for several Linux distributions: * openSUSE: http://download.opensuse.org/repositories/home:/czanik:/syslog-ng33/ and is already included in Factory. * Debian and Ubuntu: http://asylum.madhouse-project.org/projects/debian/ Many other distributions have already experimental ports, ebuilds, etc. including Arch, Fedora, FreeBSD, Gentoo. Regulatory compliance and system logging ---------------------------------------- We are happy to announce our latest technical white paper titled "Regulatory compliance and system logging". The document introduces the advantages of using syslog-ng Premium Edition to collect system log (syslog) and eventlog messages for policy compliance. The white paper includes a detailed list of policy requirements, including the requirements of the Payment Card Industry Data Security Standard (PCI-DSS), COBIT 4.1, ISO 27001, and the Health Insurance Portability and Accountability Act (HIPAA) that you can address with syslog-ng Premium Edition. The document is recommended for technical experts and decision makers working on implementing centralized logging solutions, and want to improve their compliance with industry standards. In addition, the white paper discusses further features of syslog-ng PE that can come handy for you when designing and implementing your system logging architecture. While the document focuses on syslog-ng PE, part of it also applies to syslog-ng OSE. It is available at http://www.balabit.com/support/documentation/syslog-ng-v3.0-whitepaper-comp… OTHER SHORT NEWS * BalaBit IT Security contributes to Common Event Expression Board’s log standardization work: http://andrea.blogs.balabit.com/2011/09/balabit-it-security-contributes-to-… <http://andrea.blogs.balabit.com/2011/09/balabit-it-security-contributes-to-…> * Some new books mentioning syslog-ng: http://czanik.blogs.balabit.com/2011/09/syslog-ng-in-books/ NEW RELEASES * syslog-ng OSE 3.3.1: https://lists.balabit.hu/pipermail/syslog-ng/2011-October/017420.html * syslog-ng PE 4 F1: http://andrea.blogs.balabit.com/2011/10/balabit-to-announce-the-high-speed-… WHITE PAPERS Download our latest white paper titled "Business benefits of logging". >From this White Paper you can learn: * How logging-based benefits can make *the work of managers more successful.* * How logging contributes to *lowering the operational costs*of organizations while making them more efficient. * How *syslog-ng logging technology*can contribute to organizations' business requirements. It is available at http://www.balabit.com/whitepaper?wp=46820069482870468259863 ARCHIVE http://insider.blogs.balabit.com/ -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

make error on AIX 6.1
by Frank Collette 09 Oct '11

09 Oct '11

# make make all-recursive Making all in lib "Makefile", line 679: make: 1254-055 Dependency line needs colon or double colon operator. make: 1254-058 Fatal errors encountered -- cannot continue. make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 2. Stop. ---- Line 679 in lib/Makefile is- ps: ps-am I've installed the RPM and syslog-ng core dumps, so I figured trying to build from source would be a better option. Any help in getting this compiled would be appreciated! Thanks, Frank

4 9

mismatching size/inode information
by Gbe gbe 07 Oct '11

07 Oct '11

Hi everyone ! I have this message in my logs repeated several times and for different files : « syslog-ng[964]: The current log file has a mismatching size/inode information, restarting from the beginning; filename='/var/log/squid3/access.log' » This message comes from this part of the code in src/logreader.c : 644 if (cur_inode && 645 cur_inode == log_reader_get_inode(self) && 646 cur_size <= log_reader_get_size(self)) 647 { 648 /* ok, the stored state matches the current file */ 649 log_reader_update_pos(self, cur_pos); 650 return; 651 } 652 else 653 { 654 /* the stored state does not match the current file */ 655 msg_notice("The current log file has a mismatching size/inode information, restarting from the beginning", 656 evt_tag_str("filename", self->follow_filename), 657 NULL); 658 goto error; 659 } Does this mean I may have a hardware problem? Hard drive not working properly, file system damaged, … Google hasn't been really helpful so far. Greg.

2 4

syslog-ng 3.3.1 released
by Balazs Scheidler 06 Oct '11

06 Oct '11

Hi, I'm proud to announce that syslog-ng 3.3.1 has been released. It is an important release in a number of ways: - syslog-ng architecture was completely revamped to scale properly in today's multi-core environments. I've seen it process 800000 messages / second in some scenarios. - following the licensing change in 3.2, it incorporates contributions (code, testing & feedback) from 54 individuals. In total, the development of 3.3 took about a year, producing 580 patches and the following diffstat: 294 files changed, 20314 insertions(+), 7624 deletions(-) That compared to the total number of lines in the git repository (81804 lines) is a significant change over 3.2 See the syslog-ng ohloh page for more statistics: https://www.ohloh.net/p/syslog-ng For the list of features and changes, please see the NEWS entry at the end of this email. You can download the source code from: https://www.balabit.com/network-security/syslog-ng/opensource-logging-syste… A number of distributions already carry 3.3.1 packages thanks for our faithful package maintainers. You can also get the source code from git, at http://git.balabit.hu/ I'd like to thank all contributors who have helped to make syslog-ng to be what it is today (collected from the git commit summaries): Andras Mitzki <micek(a)balabit.hu> Andy Ruch <adruch2002(a)yahoo.com> Arkadiusz Miśkiewicz <arekm(a)maven.pl> Attila Nagy <naat(a)balabit.hu> Balazs Nemeth Balazs Scheidler <bazsi(a)balabit.hu> Balint Kovacs <balint.kovacs(a)balabit.hu> Brett Edgar <brett.edgar(a)truedigitalsecurity.com> Corinna Vinschen <vinschen(a)redhat.com> Costa Farber <costaf(a)wix.com> Craig Bell Dalibor Toman <dtoman(a)fortech.cz> Dave Reisner <dreisner(a)archlinux.org> Eric Berggren Eric Duda <ericduda(a)yahoo.com> Fischhof Gyorgy <george(a)balabit.hu> Gergely Nagy <algernon(a)balabit.hu> Jakub Jankowski <shasta(a)toxcorp.com> Jose Oliveira <jpo(a)di.uminho.pt> Juhasz Viktor <jviktor(a)balabit.hu> Kevin Guthrie <Kevin.Guthrie(a)itron.com> Laszlo Boszormenyi <gcs(a)lsc.hu> LEBRETON Philippe Lennart Poettering <lennart(a)poettering.net> Marius Tomaschewski <mt(a)suse.de> Martin Holste <mcholste(a)gmail.com> Marton Illes <marci(a)balabit.hu> Matthew Hall Matthew Hall <mhall(a)mhcomputing.net> Micah Anderson <micah(a)riseup.net> Michael <codejodler(a)gmx.ch> Mishou Michael <Michael.Mishou(a)csirc.irs.gov> Nat Baldwin Nix <nix(a)esperi.org.uk> Owen Mann Pallagi Zoltan <pzolee(a)balabit.hu> Paul Krizak <paul.krizak(a)amd.com> Peter "CzP" Czanik <czanik(a)balabit.hu> Peter Eisenlohr Peter Gyongyosi <gyp(a)balabit.hu> Peter Gyorko <gyorkop(a)balabit.hu> Remy Zandwijk <remy(a)luckyhands.nl> Roger <gaudet(a)verizon.net> Sandor Geller <Sandor.Geller(a)morganstanley.com> Serge Hallyn <serge.hallyn(a)ubuntu.com> Steven Chamberlain <steven(a)pyro.eu.org> SZALAY Attila <sasa(a)balabit.hu> Tamas Pal <folti(a)balabit.hu> Tevesz Andras <ghost(a)balabit.hu> Tom Gundersen <teg(a)jklm.no> Valentijn Sessink <valentyn(a)blub.net> Viktor Juhasz <jviktor(a)balabit.hu> Zhengxiang Pan Zoltan Pallagi <pzolee(a)balabit.hu> The list of changes are below (copied verbatim from the NEWS file in the source code): 3.3.1 Sat, 01 Oct 2011 13:17:56 +0200 This is the first stable release in the 3.3 series adding a number of features compared to 3.2: - multi-core/CPU scaling: the new multi-threaded architecture allows syslog-ng to scale into the 800k msg/sec region. - MongoDB support: using MongoDB instead of SQL is faster and allows better representation of log data. - JSON support: using the $(format-json) template function it is now possible to construct JSON (JavaScript Object Notation) output for log messages. JSON is a commonly used format for exchanging information between information systems, providing a rich and extensible format for structured information. - A number of enhancements all over the place: SQL, patterndb. The most important changes in this release: - The default ports have changed. syslog-ng is using the standard RFC allocated ports in the syslog() driver. - The meaning for log-iw-size() was changed for tcp() and unix-stream() drivers. That value is _evenly_ allocated to all possible connections starting with this release, whereas previously that window was shared between actual connections. Changes since 3.3.0beta2: system() source: ================ * Added support for Debian/kFreeBSD internal() source: ================== * Added support for the tags() option pdbtool test: ============= * Added support for testing a specific rule, instead of the complete patterndb file. * Added support for match debugging with the --debug and --color-out command line options. pdbtool dictionary: =================== * New pdbtool command that displays the name-value pairs that are set by any of the rules in a patterndb XML file. $(indent-multi-line): ===================== * This template function was added to make it possible to write multi-line log messages into a file. The first line is written like a regular message, subsequent lines are indented with a tab, just like RFC822. Other features & changes: ========================= * At stats-level(3) syslog-ng keeps track how much messages get tagged with individual tags. * Added support for pad_size() option for destinations, effectively padding the output string to a fixed size. This can be used on HP-UX to send messages to the local syslogd daemon, as that expects messages to be padded to 2048 bytes. * The command-line parser of the value-pairs functionality (used by $(format-json) for instance, was changed to use an empty scope by default. Bugfixes: ========= * Fixed spoof-source support as it didn't have proper thread synchronization in the previous beta versions, causing memory leaks and crashes if spoof-source was enabled on a destination and threading is used. * Fixed a MongoDB and SQL race conditions causing stalls and failed assertions. * Fixed a possible stall of syslog-ng caused by pipe() destinations without readers (e.g. /dev/xconsole). The root cause was a flipped flow-control state: pipes have become flow-controlled even if the user didn't request it. On the other hand files have become non-flow-controlled, even though they always should be. * Fixed possible crashes during reload or shutdown. * Fixes for several, significant memory leaks: - Fixed a major memory leak, effectively causing all messages to be leaked when message contents are changed on some of the log statements (with a rewrite rule or a parser). - Fixed a memory leak in file destinations caused by the leakage of the associated queue when the given file is closed (by time-reap or otherwise). - Fixed a memory leak in the server protocol handling code, leaking a small amount of memory every time a connection is closed. - Fixed a memory leak in the log source code causing some memory to be leaked for each connection when processing a reload. - PCRE matcher has leaked its state, causing a small leak on reloads. - The configuration parser contained leaks also causing leaks when parsing the configuration file (e.g. on reloads). - The persist state handling code has leaked some memory each time the persist state file was processed (startup + reloads). * Fixed thread synchronization when registering/deregistering stats counters. Previously these were performed without caring about threads, effectively the root cause for various ill effects from invalid counters to crashes. * Fixed a timestamp parsing problems affecting timestamps with month values between and including September .. December. * Fixed a timezone representation issue for zones that have half an hour offsets from GMT in the negative direction. * Fixed pdbtool patternize to generate proper UUIDs if openssl was detected. Previously it worked as if openssl was never detected. * Fixed a possible race on MARK message timing, which could cause MARK messages to appear somewhat inconsistently. * Fixed the generation of [meta sequenceId] SDATA field. * Fixed handling of zero-sized messages which have caused a crash due to NULL deref. * The processing of included directories was changed not to include hidden files. * Reloading syslog-ng didn't reinitialize the name resolver causing etc/resolv.conf changes not to be recognized even if syslog-ng was reloaded. A res_init() call was added to match earlier behaviour and UNIX best practice. * Fixed program-override() clash with the 'store-legacy-msghdr' reader flag, which has become default in syslog-ng 3.1. If storing the legacy msghdr is enabled, overwriting the value for $PROGRAM was not reflected in the output, since instead of reconstructing it from the parsed values, syslog-ng always used what was originally in the input. If the value for $PROGRAM changes, that automatically disables the use of the 'store-legacy-msghdr' flag. * Fixed CAP_SYSLOG detection to also detect if either the kernel, or libcap is lacking some required functionality. * Fixed the handling of messages generated by AIX, which include a "message forwarded for" header that syslog-ng failed to parse properly. * Fixed proper size limitation for the data structure used to hold name-value pairs of a log message. Previously, if this structure would go over 262140 bytes syslog-ng crashed because of an unhandled integer overflow. Build changes: ============== * It is possible to request the use of the system-installed libmongo-client instead of the bundled one. At least 0.1.3 is required. * The bundled libmongo-client was updated to 0.1.4, plus some minor patches (tagged in the git.balabit.hu git repo with syslog-ng-3.3-ref2) * autogen.sh: automatically check the availability of git before trying to pull the bundled libraries from git.balabit.hu * systemd unit file redirects syslog-ng startup messages to /dev/null without a better place. * Introduced a pkg-config file for syslog-ng.pc to make it easier to build 3rd party modules for syslog-ng. * The syslog-ng version number is added to libsyslog-ng.so, which goes to $prefix/lib to indicate that binary compatibility is not guaranteed between syslog-ng versions. * Added --without-compile-date option to remove the compilation date from the binary, as SUSE Linux checks if recompilation changes the binary to detect if dependent packages need to be rebuilt or not. * It is now possible to build against libsystemd-daemon instead of using the bundled sources. Other changes: ============== * The --seed command line option has become a no-op, syslog-ng tries to detect the availability of the random seed automatically. The command line option of the syslog-ng binary is present without doing anything, but it was removed from other utilities. Credits: ======== syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: * Attila Nagy (BalaBit) * Balazs Scheidler (BalaBit) * Balint Kovacs (BalaBit) * Costa Farber (wix.com) * Eric Duda * Gergely Nagy (BalaBit) * Jakub Jankowski (SuperHost.pl) * Kevin Guthrie (itron) * Lennart Poettering (RedHat) * Martin Holste * Marton Illes (BalaBit) * Peter Czanik (BalaBit) * Peter Eisenlohr * Peter Gyorko (BalaBit) * Sandor Geller (Morgan Stanley) * Tamas Pal (BalaBit) * Viktor Juhasz (BalaBit) -- Bazsi

2 1

[Bug 137] New: [debian #642479]: should print a warning at startup if not configured to log anything
by bugzilla＠bugzilla.balabit.com 06 Oct '11

06 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=137 Summary: [debian #642479]: should print a warning at startup if not configured to log anything Product: syslog-ng Version: unspecified Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642479 OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: algernon(a)balabit.hu Type of the Report: --- Estimated Hours: 0.0 The following report was filed in the Debian BTS against the syslog-ng package: So I was frustrated for a while by why "/var/log/messages", etc., all had a timestamp of a few months ago (which is when I last installed or reconfigured Syslog-NG on this host). The attached file does work; I'm pretty sure the problem was that I had a whole page of "log(...)" statements with no "source(...)" option and no "catchall" flag. If the start-script can prove by static analysis that it's impossible for any messages to match and be written to any destination, it should print a warning, not just start silently. In fact, a "log(...)" statement with no "source(...)" option and no "catchall" flag should probably trigger a warning. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

SQL support under cygwin?
by Fekete Robert 05 Oct '11

05 Oct '11

Hi, I assume that the SQL destination is not enabled in the cygwin package of syslog-ng. Is that correct? Someone is trying to use syslog-ng on Windows to log into a database, and I suspect that is why he fails (http://www.syslog.org/forum/index.php?topic=1224.0) Can anyone confirm that? Thank you in advance. Regards, Robert

2 2