- syslog-ng - lists.balabit.hu

[Bug 139] New: syslog-ng crashes on SIGHUP when rewrite used in multiple log{} declarations
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=139 Summary: syslog-ng crashes on SIGHUP when rewrite used in multiple log{} declarations Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.syslogng(a)feystorm.net Type of the Report: --- Estimated Hours: 0.0 This is for version 3.3.1 which isnt an available version in the bug tracker. I've managed to create a situation where syslog-ng crashes when it receives a SIGHUP, and a certain rewrite has been used in at least 3 different log{} declarations. Below is the extremely stripped down configuration I've created which duplicates the issue. With the below configuration, when syslog-ng receives a HUP, it will get a segfault in malloc_consolidate(). Additionally, the process which monitors syslog-ng for crashing doesnt appear to have a signal handler for SIGHUP, so the monitor process will die when it gets a HUP. This is a problem, at least on redhat as the redhat init script sends a HUP to both the monitor process and the real worker process when the init script is called with `reload` @version: 3.3 @include "scl.conf" source s_local { system(); }; rewrite r_fext { #set("$LEVEL",value('FEXT')); subst('foo','bar', value('FEXT') type('string')); }; log { source(s_local); rewrite(r_fext); }; log { source(s_local); rewrite(r_fext); }; log { source(s_local); rewrite(r_fext); }; -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

syslog-ng 3.3.1 dying after SIGHUP
by Patrick H. 23 Oct '11

23 Oct '11

Is anyone else having issues with syslog-ng 3.3 dying when it gets a sighup? When the syslog-ng monitor process gets a HUP, it seems to die immediately, as if there were no signal handler. Strace shows absolutely nothing between getting the signal, and it exiting. When the actual syslog-ng worker process gets a HUP, it does a bunch of stuff, and then segfaults. It looks like it segfaults immediately after closing /var/log/syslog 4362 17:28:44.964645 stat("/var/log", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 4362 17:28:44.964729 stat("/var/log/syslog", {st_mode=S_IFREG|0644, st_size=3905, ...}) = 0 4362 17:28:44.964813 open("/var/log/syslog", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK, 0644) = 26 4362 17:28:44.964879 fcntl(26, F_GETFD) = 0 4362 17:28:44.964936 fcntl(26, F_SETFD, FD_CLOEXEC) = 0 4362 17:28:44.964993 capget(0x19980330, 0, {CAP_DAC_OVERRIDE|CAP_SYS_ADMIN, CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN, 0}) = 0 4362 17:28:44.965082 capset(0x19980330, 0, {CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_SYS_ADMIN, CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN, 0}) = 0 4362 17:28:44.965148 capget(0x19980330, 0, {CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_SYS_ADMIN, CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN, 0}) = 0 4362 17:28:44.965213 capset(0x19980330, 0, {CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_FOWNER|CAP_SYS_ADMIN, CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN, 0}) = 0 4362 17:28:44.965279 fchown(26, 0, 4294967295) = 0 4362 17:28:44.965344 fchown(26, 4294967295, 0) = 0 4362 17:28:44.965404 fchmod(26, 0644) = 0 4362 17:28:44.965464 capset(0x19980330, 0, {CAP_SYS_ADMIN, CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN, 0}) = 0 4362 17:28:44.965532 close(21) = 0 4362 17:28:44.966122 --- SIGSEGV (Segmentation fault) @ 0 (0) --- I'm going to try and track this down further, but was wondering if anyone else was seeing this behavior. Running this on RHEL5

2 3

[PATCH] afsocket: Fix compilation with libsystemd-daemon
by Gergely Nagy 22 Oct '11

22 Oct '11

When the libsystemd-daemon library is used, we need to use the header provided by the library, otherwise linking will likely fail. To do that, configure sets WITH_LIBSYSTEMD as appropriate, and depending on that value, we either include <systemd/sd-daemon.h> or "sd-daemon.h". Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- configure.in | 1 + modules/afsocket/afunix.c | 5 +++++ 2 files changed, 6 insertions(+), 0 deletions(-) diff --git a/configure.in b/configure.in index 13bc874..1e3a09a 100644 --- a/configure.in +++ b/configure.in @@ -1059,6 +1059,7 @@ AC_DEFINE_UNQUOTED(ENABLE_LINUX_CAPS, `enable_value $enable_linux_caps`, [Enable AC_DEFINE_UNQUOTED(ENABLE_PCRE, `enable_value $enable_pcre`, [Enable PCRE support]) AC_DEFINE_UNQUOTED(ENABLE_ENV_WRAPPER, `enable_value $enable_env_wrapper`, [Enable environment wrapper support]) AC_DEFINE_UNQUOTED(ENABLE_SYSTEMD, `enable_value $enable_systemd`, [Enable systemd support]) +AC_DEFINE_UNQUOTED(WITH_LIBSYSTEMD, `enable_value $with_libsystemd`, [Compile with libsystemd-daemon]) AM_CONDITIONAL(ENABLE_ENV_WRAPPER, [test "$enable_env_wrapper" = "yes"]) AM_CONDITIONAL(ENABLE_SYSTEMD, [test "$enable_systemd" = "yes"]) diff --git a/modules/afsocket/afunix.c b/modules/afsocket/afunix.c index 57ae213..2d57078 100644 --- a/modules/afsocket/afunix.c +++ b/modules/afsocket/afunix.c @@ -25,7 +25,12 @@ #include "misc.h" #include "messages.h" #include "gprocess.h" + +#if WITH_LIBSYSTEMD +#include <systemd/sd-daemon.h> +#else #include "sd-daemon.h" +#endif #include <string.h> #include <sys/types.h> -- 1.7.7

2 1

feature request: clear stats counters after diplayed
by syslogng＠feystorm.net 18 Oct '11

18 Oct '11

I was wondering if it would be possible to clear the stats generated by syslog-ng after theyre logged from the stats_freq setting. Basically so every set of stats that gets displayed will be the numbers since the last time stats were displayed, not for the whole lifetime of the process. Largely, this is just so that one can easily tell if processing has changed in a certain time period without having to do the math. Additionally it also would help a great deal with system health monitoring software. For example, something could look to see if syslog-ng has dropped any messages, but as it currently is it would have to compare the most recent stats with the previous set of stats just to see if the dropped counter went up.

2 1

[PATCH] syslog-ng: Add a -q/--silent-module-load option
by Gergely Nagy 15 Oct '11

15 Oct '11

With the -q/--silent-module-load option set (defaults to off), no warnings will be printed when a module cannot be found. If it's found, but cannot be loaded, a message is still printed. If it is used later in the config, that's still handled correctly. The flag only suppresses the warning, and nothing else. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- lib/globals.c | 1 + lib/plugin.c | 9 +++++---- lib/syslog-ng.h | 1 + syslog-ng/main.c | 1 + 4 files changed, 8 insertions(+), 4 deletions(-) diff --git a/lib/globals.c b/lib/globals.c index b2afec7..b3b2121 100644 --- a/lib/globals.c +++ b/lib/globals.c @@ -28,3 +28,4 @@ GlobalConfig *configuration; int cfg_parser_debug; gchar *module_path = MODULE_PATH; gchar *default_modules = DEFAULT_MODULES; +gboolean silent_module_load = FALSE; diff --git a/lib/plugin.c b/lib/plugin.c index 5239974..cce549a 100644 --- a/lib/plugin.c +++ b/lib/plugin.c @@ -179,10 +179,11 @@ plugin_dlopen_module(const gchar *module_name, const gchar *module_path) g_strfreev(module_path_dirs); if (!plugin_module_name) { - msg_error("Plugin module not found in 'module-path'", - evt_tag_str("module-path", module_path), - evt_tag_str("module", module_name), - NULL); + if (!silent_module_load) + msg_error("Plugin module not found in 'module-path'", + evt_tag_str("module-path", module_path), + evt_tag_str("module", module_name), + NULL); return NULL; } msg_debug("Trying to open module", diff --git a/lib/syslog-ng.h b/lib/syslog-ng.h index 4bd79c2..edb8a4d 100644 --- a/lib/syslog-ng.h +++ b/lib/syslog-ng.h @@ -66,5 +66,6 @@ typedef struct _GlobalConfig GlobalConfig; extern GlobalConfig *configuration; extern gchar *module_path; extern gchar *default_modules; +extern gboolean silent_module_load; #endif diff --git a/syslog-ng/main.c b/syslog-ng/main.c index c682e44..e414321 100644 --- a/syslog-ng/main.c +++ b/syslog-ng/main.c @@ -75,6 +75,7 @@ static GOptionEntry syslogng_options[] = { "module-registry", 0, 0, G_OPTION_ARG_NONE, &display_module_registry, "Display module information", NULL }, { "default-modules", 0, 0, G_OPTION_ARG_STRING, &default_modules, "Set the set of auto-loaded modules, default=" DEFAULT_MODULES, "<module-list>" }, { "seed", 'S', 0, G_OPTION_ARG_NONE, &dummy, "Does nothing, the need to seed the random generator is autodetected", NULL}, + { "silent-module-load", 'q', 0, G_OPTION_ARG_NONE, &silent_module_load, "Load modules silently, not printing a warning when one's not found", NULL}, #ifdef YYDEBUG { "yydebug", 'y', 0, G_OPTION_ARG_NONE, &cfg_parser_debug, "Enable configuration parser debugging", NULL }, #endif -- 1.7.7

2 2

[Bug 138] New: Compilation failure in 3.3.1: CLOCK_MONOTONIC undeclared
by bugzilla＠bugzilla.balabit.com 15 Oct '11

15 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=138 Summary: Compilation failure in 3.3.1: CLOCK_MONOTONIC undeclared Product: syslog-ng Version: unspecified Platform: Macintosh OS/Version: Mac OS Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jacknagel(a)gmail.com Type of the Report: bug Estimated Hours: 0.0 Attempting to compile syslog-ng v3.3.1 from source on Mac OS X 10.6.8 fails with logsource.c: In function ‘log_source_msg_ack’: logsource.c:85: error: ‘CLOCK_MONOTONIC’ undeclared (first use in this function) logsource.c:85: error: (Each undeclared identifier is reported only once logsource.c:85: error: for each function it appears in.) I believe this is because OS X does not define CLOCK_MONOTONIC. Actually, afaik, OS X doesn't implement clock_gettime() either. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[PATCH] Fix compilation without OpenSSL.
by Gergely Nagy 15 Oct '11

15 Oct '11

While most places where OpenSSL was used were guarded by ENABLE_SSL ifs, some were not. This patch adds those guards to lib/crypto.c, modules/afsql/afsql.c and tests/loggen/loggen.c. It also makes sure that OPENSSL_LIBS gets emptied when enable_ssl is set to no. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- configure.in | 4 ++++ lib/crypto.c | 4 ++++ modules/afsql/afsql.c | 3 +++ tests/loggen/loggen.c | 3 +++ 4 files changed, 14 insertions(+), 0 deletions(-) diff --git a/configure.in b/configure.in index 13bc874..686911e 100644 --- a/configure.in +++ b/configure.in @@ -679,6 +679,10 @@ else enable_ssl="no" fi +if test "x$enable_ssl" = "xno"; then + OPENSSL_LIBS="" +fi + dnl dnl Right now, openssl is never linked statically as it is only used by the dnl TLS build of the afsocket plugin which is loaded dynamically anyway. diff --git a/lib/crypto.c b/lib/crypto.c index 702609c..ac4d070 100644 --- a/lib/crypto.c +++ b/lib/crypto.c @@ -29,6 +29,8 @@ #include "crypto.h" #include "apphook.h" +#if ENABLE_SSL + #include <openssl/rand.h> #include <openssl/ssl.h> #include <stdio.h> @@ -124,3 +126,5 @@ crypto_init(void) } /* the crypto options (seed) are handled in main.c */ + +#endif diff --git a/modules/afsql/afsql.c b/modules/afsql/afsql.c index eb59b57..02b9f83 100644 --- a/modules/afsql/afsql.c +++ b/modules/afsql/afsql.c @@ -35,7 +35,10 @@ #include <dbi/dbi.h> #include <string.h> + +#if ENABLE_SSL #include <openssl/md5.h> +#endif /* field flags */ enum diff --git a/tests/loggen/loggen.c b/tests/loggen/loggen.c index c5399a7..bf11a1e 100644 --- a/tests/loggen/loggen.c +++ b/tests/loggen/loggen.c @@ -14,11 +14,14 @@ #include <glib.h> #include <signal.h> +#if ENABLE_SSL #include <openssl/crypto.h> #include <openssl/x509.h> #include <openssl/pem.h> #include <openssl/ssl.h> #include <openssl/err.h> +#endif + #include <unistd.h> #define MAX_MESSAGE_LENGTH 8192 -- 1.7.0.4

2 1

Special characters in syslogng filters
by Jay 15 Oct '11

15 Oct '11

Hello If the filter specified in syslog-ng.conf contains the ( character or ) character, then is it correct to prefix them with \\. For example, if I need to filter a syslog containing the string (abcd) then in syslog-ng.conf, I would need to specify the filter as \$abcd\$ Could someone confirm, if this is the correct way of specifying the filter, please ? If not, please let me know the correct way of specifying the filter. Thanks in advance for your help.

2 1

rfc3195 support
by Linus Grybäck 13 Oct '11

13 Oct '11

I was wondering if syslog-ng had support for sending messages according to the rfc3195 standard? I have not found any mention of it in the documentation. I noticed that syslog-ng can send BSD style messages with TCP. From what I understood from the rfc3195 ( http://www.ietf.org/rfc/rfc3195.txt) it specifies a way to do just that. So I was wondering if syslog-ng uses this form when it sends BSD style messages over TCP? If it have support for it at all, or not? With BSD style messages I mean messages following the rfc3164, also called legacy-syslog in the documentation. // Thanks for your help, Linus

2 1

syslog-ng Insider - October 2011
by Peter Czanik 13 Oct '11

13 Oct '11

Dear syslog-ng users, This is the 7th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com <mailto:documentation@balabit.com> FEATURED NEWS syslog-ng 3.3.1 is released! ---------------------------- A new version of syslog-ng is released! It took about a year to develop as a collaboration of over 50 individuals. Major new features include: * mongodb support * JSON support * Multi-threaded architecture For a complete list of changes, please check the NEWS file at https://www.balabit.com/files/syslog-ng/open-source-edition/3.3.1/changelog… Documentation is available at: http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.3-guid… Binary packages are available are already available for several Linux distributions: * openSUSE: http://download.opensuse.org/repositories/home:/czanik:/syslog-ng33/ and is already included in Factory. * Debian and Ubuntu: http://asylum.madhouse-project.org/projects/debian/ Many other distributions have already experimental ports, ebuilds, etc. including Arch, Fedora, FreeBSD, Gentoo. Regulatory compliance and system logging ---------------------------------------- We are happy to announce our latest technical white paper titled "Regulatory compliance and system logging". The document introduces the advantages of using syslog-ng Premium Edition to collect system log (syslog) and eventlog messages for policy compliance. The white paper includes a detailed list of policy requirements, including the requirements of the Payment Card Industry Data Security Standard (PCI-DSS), COBIT 4.1, ISO 27001, and the Health Insurance Portability and Accountability Act (HIPAA) that you can address with syslog-ng Premium Edition. The document is recommended for technical experts and decision makers working on implementing centralized logging solutions, and want to improve their compliance with industry standards. In addition, the white paper discusses further features of syslog-ng PE that can come handy for you when designing and implementing your system logging architecture. While the document focuses on syslog-ng PE, part of it also applies to syslog-ng OSE. It is available at http://www.balabit.com/support/documentation/syslog-ng-v3.0-whitepaper-comp… OTHER SHORT NEWS * BalaBit IT Security contributes to Common Event Expression Board’s log standardization work: http://andrea.blogs.balabit.com/2011/09/balabit-it-security-contributes-to-… <http://andrea.blogs.balabit.com/2011/09/balabit-it-security-contributes-to-…> * Some new books mentioning syslog-ng: http://czanik.blogs.balabit.com/2011/09/syslog-ng-in-books/ NEW RELEASES * syslog-ng OSE 3.3.1: https://lists.balabit.hu/pipermail/syslog-ng/2011-October/017420.html * syslog-ng PE 4 F1: http://andrea.blogs.balabit.com/2011/10/balabit-to-announce-the-high-speed-… WHITE PAPERS Download our latest white paper titled "Business benefits of logging". >From this White Paper you can learn: * How logging-based benefits can make *the work of managers more successful.* * How logging contributes to *lowering the operational costs*of organizations while making them more efficient. * How *syslog-ng logging technology*can contribute to organizations' business requirements. It is available at http://www.balabit.com/whitepaper?wp=46820069482870468259863 ARCHIVE http://insider.blogs.balabit.com/ -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0