- syslog-ng - lists.balabit.hu

Question about PE edition disk-based buffering
by Clayton Dukes 04 Oct '11

04 Oct '11

Hi Folks, We have a team doing testing on the PE edition and they are finding that the timeout for the failover trigger takes 60 seconds: It was observed that it takes anytime between 10 to 60 seconds to detect connection is broken. We found out it by running syslog-ng in debug mode. I guess it relies on connection timeout. This 60 second is large interval compared to the default interval that we have (15 sec). My question: Is there a way to tune this parameter down to 15 seconds in the config? ______________________________________________________________ Clayton Dukes ______________________________________________________________

2 2

RFC: An option to not warn when a module's not found.
by Gergely Nagy 04 Oct '11

04 Oct '11

Hi! Recently I stumbled upon an issue while packaging syslog-ng 3.3 modules for Debian: for convenience's sake, whenever a module package gets installed, it places a config file in /etc/syslog-ng/conf.d/, and all files from that directory are included into the main configuration. This makes it possible that one does not have to add explicit @module options to his config when he wants to use a module he installed: it's already there. This works well, and there's no problem here. Except that when one removes a module package, Debian leaves the config file on the system. They get removed only when the package is purged. This is understandable, and there's good reasons behind the distinction between remove and purge. However, this results in syslog-ng trying to load a removed module whenever it starts up or is reloaded, which emits a warning, which will result in a mail from cron after logrotates, among other things. So I'd like to introduce a command-line option that would result in these warnings NOT getting printed. So if a module is not found, even if it was explicitly loaded, with the command-line option set, syslog-ng wouldn't print a warning. This would mean I can use this flag in the init script and in the logrotate config aswell: if the module is loaded, but not used, there's no harm in ignoring its inexistence. If it would be used, syslog-ng will throw an error later anyway. I'll prepare a patch that adds this sometime this week, but I wanted to give a heads up, and ask for opinions too. If there's anyone who sees a problem with this approach, or has a better idea, please let me know! -- |8]

1 0

Syslog-ng under cygwin
by pedro castro 04 Oct '11

04 Oct '11

Does anyone know the step by step to compile syslog-ng under cygwin? I know that inside cygwin there is a syslog-ng package but it does not have spoof-source option enable so as documentation indicate I need to compile. any ideas? Thanks a lot

2 1

Error in documentation on syslog() source port
by Patrick H. 03 Oct '11

03 Oct '11

The syslog-ng admin guide for 3.2 says the default port for syslog() sources is 514. This isnt the observed behavior. When a syslog() source is configured without specifying the port, it listens on 601

3 4

syslog-ng Digest, Vol 73, Issue 37
by Kristen Eisenberg 02 Oct '11

02 Oct '11

Someone must have used a so-called "smart" editor to edit this file, since it seems to have used fancy quotes on the console line. #destination console_all { file("/dev/tty12"); }; destination console_all { file(“/dev/console”); }; #destination loghost { udp("loghost" port(999)); }; Notice how they are different from those on the line above? Word processors often replace quotes with matching pairs like that automatically; only plain text editors should be used to edit config files like this. Check for this kind of thing with a hex dumper or 'cat -vet': $ cat frank #destination console_all { file("/dev/tty12"); }; destination console_all { file("/dev/console"); }; #destination loghost { udp("loghost" port(999)); }; Kristen Eisenberg Billige Flüge Marketing GmbH Emanuelstr. 3, 10317 Berlin Deutschland Telefon: +49 (33) 5310967 Email: utebachmeier at gmail.com Site: http://flug.airego.de- Billige Flüge vergleichen

1 0

[PATCH] afmongodb: Support system-installed libmongo-client at configure time.
by Gergely Nagy 30 Sep '11

30 Sep '11

Modify configure.in to recognise a suitable version (>= 0.1.0) of the libmongo-client library, and use it instead of the internal version if requested so. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- configure.in | 10 ++++++---- 1 files changed, 6 insertions(+), 4 deletions(-) diff --git a/configure.in b/configure.in index e5bf174..e7038fb 100644 --- a/configure.in +++ b/configure.in @@ -28,6 +28,7 @@ IVYKIS_MIN_VERSION="0.18" JSON_C_MIN_VERSION="0.7" JSON_GLIB_MIN_VERSION="0.12" PCRE_MIN_VERSION="6.1" +LMC_MIN_VERSION="0.1.0" dnl *************************************************************************** dnl Initial setup @@ -743,12 +744,13 @@ if test "x$with_libmongo_client" = "xinternal"; then AC_MSG_WARN([Internal libmongo-client sources not found in modules/afmongodb/libmongo-client]) with_libmongo_client="no" fi -else - AC_MSG_WARN([Don't know how to locate system installed libmongo-client.]) - with_libmongo_client="no" +elif test "x$with_libmongo_client" = "xsystem"; then + PKG_CHECK_MODULES(LIBMONGO, libmongo-client >= $LMC_MIN_VERSION,,with_libmongo_client="no") fi - +if test "x$with_libmongo_client" = "xno"; then + enable_mongodb="no" +fi dnl *************************************************************************** dnl misc features to be enabled -- 1.7.2.5

4 14

syslog-ng 3.2.4 : How to handle syslogs with multiple lines
by Jay 30 Sep '11

30 Sep '11

Hello I am using syslog-ng on RHEL 5 Some syslogs from devices are wrapped. i.e. some syslogs contain multiple lines. In such cases, syslog-ng is treating each line as a separate syslog. I need all lines beloging to that syslog to be considered as single line. The \n\r (s) should be ignored. Adding flags (no-multi-line) option didn't help. Could someone help to address this issue, please ? Thanks

1 0

[Bug 136] New: duplicated logpaths gives no error
by bugzilla＠bugzilla.balabit.com 29 Sep '11

29 Sep '11

https://bugzilla.balabit.com/show_bug.cgi?id=136 Summary: duplicated logpaths gives no error Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: balazs.nemeth(a)balabit.com Type of the Report: --- Estimated Hours: 0.0 During my daily work I started to experience to receive every log message twice. It turned out that I made a silly copy&paste mistake but syslog-ng showed no warning or something like that at all. Steps to reproduce: 1) create a config like this # snippet start parser pattern_db { db_parser( file("/var/lib/misc/patterndb.xml") ); }; source s_netcat { tcp(ip(127.0.0.1) port(5514)); }; destination d_patterndb { file("/var/log/hosts/$HOST/$R_YEAR.$R_MONTH.$R_DAY/messages-${.classifier.class}"); }; log{ source(s_netcat); parser(pattern_db); destination(d_netcat); }; log{ source(s_netcat); parser(pattern_db); destination(d_netcat); }; # snippet end 2) send logs with netcat 3) check that every log message arrives twice to the given destination syslog-ng 3.2.4 Installer-Version: 3.2.4 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#ef7b91e4a1b1f9628c66138b4ae83de7e4c697c6 Compile-Date: Aug 16 2011 09:13:16 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: on Enable-Pacct: off -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

current 3.3 git
by Peter Czanik 29 Sep '11

29 Sep '11

Hello, There were many updates to 3.3 git this afternoon. I did a quick compile, packaging and functional test on my platforms (FreeBSD and openSUSE). I did not do many tests, but what I tried seems to work fine. >From the previous git version I found only one change: README was removed, so package lists had to be changed. You can find my current openSUSE syslog-ng package together with syslog-ng sources at https://build.opensuse.org/package/show?package=syslog-ng&project=home%3Acz… The file name says beta2, but it's actually a git snapshot from this afternoon. Have a nice weekend! Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

2 3

"Errors" in /var/log/messages
by Aldrich, Jamie S 28 Sep '11

28 Sep '11

I have setup syslog-ng to report application logs to a LogLogic device over UDP. Below is a excerpt of the syslog.conf file: source s_file_fs3 { file("/tmp/APPSRV_fs3_current.LOG" flags(no-parse) follow-freq(1)); }; destination d_messages{ udp("10.13.33.11" port(514)); }; log { source(s_file_fs3); destination(d_messages); }; I am seeing the following messages from our OSSEC server and /var/log/messages: OSSEC HIDS Notification. 2011 Sep 28 09:50:11 Received From: lxfwossecp3->/var/log/messages Rule: 1003 fired (level 13) -> "Non standard syslog message (size too large)." Portion of the log(s): Sep 28 09:50:10 lxfwossecp3 syslog-ng[3992]: Log statistics; processed='destination(d_mail)=2', processed='destination(d_spol)=0', processed='source(s_file_fs3)=1690', processed='global(payload_reallocs)=218', processed='source(s_sys)=325', processed='destination(d_mesg)=114', processed='global(msg_clones)=0', processed='src.internal(s_sys#2)=114', stamp='src.internal(s_sys#2)=1317220810', processed='destination(d_kern)=0', processed='destination(d_mlal)=0', processed='destination(d_cron)=200', dropped='dst.udp(d_messages#0,10.13.33.11:514)=0', processed='dst.udp(d_messages#0,10.13.33.11:514)=20670', stored='dst.udp(d_messages#0,10.13.33.11:514)=0', processed='global(sdata_updates)=0', processed='destination(d_auth)=9', processed='destination(d_boot)=0', processed='source(s_file_hr1)=2025', processed='center(received)=0', processed='source(s_file_fs1)=3896', processed='destination(d_messages)=20670', processed='source(s_file_hr2)=2743', processed='center(queued)=0', processed='source(s_file_fs2)=2662', processed='source(s_file_hr3)=7654' Do we have an issue? It looks like the log size is too large to process correctly, and it is kicking it out. What would we need to do to remedy the situation? Jamie

2 1