- syslog-ng - lists.balabit.hu

[Bug 140] New: syslog-ng ignores filter boolean logic
by bugzilla＠bugzilla.balabit.com 24 Oct '11

24 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=140 Summary: syslog-ng ignores filter boolean logic Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: lisaev(a)umail.iu.edu Type of the Report: --- Estimated Hours: 0.0 Created an attachment (id=42) --> (https://bugzilla.balabit.com/attachment.cgi?id=42) syslog-ng 3.3.1 config file I am running syslog-ng 3.3.1 (arch linux), and noticed that my iptables logs go into every possible logfile, i.e. /var/log/{messages,kernel,iptables}.log. For example: cur_work$ tail -n1 /var/log/kernel.log Oct 23 12:43:18 linhost kernel: [ 5372.600518] firewall: IN=wlan0 OUT= MAC=00:26:c6:d7:27:6a:00:17:0f:70:b1:00:08:00 SRC=74.125.65.108 DST=96.125.23.251 LEN=40 TOS=0x00 PREC=0x00 TTL=43 ID=28546 PROTO=TCP SPT=993 DPT=52331 WINDOW=0 RES=0x00 RST URGP=0 This is despite the fact that syslog-ng.conf contains filter f_iptables { match("IN=" value("MESSAGE")) and match("OUT=" value("MESSAGE")); }; filter f_kernel { facility(kern) and not filter(f_iptables); }; I also tried modifying f_iptables as filter f_iptables { match("firewall" value("MESSAGE")); }; but still get firewall logs everywhere :( I add the full syslog-ng.conf as an attachment. Thanks. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

[Bug 129] New: Add ability to synchronously flush logs on demand
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=129 Summary: Add ability to synchronously flush logs on demand Product: syslog-ng Version: 1.6.x Platform: All OS/Version: FreeBSD Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: fermulator(a)sympatico.ca Type of the Report: enhancement Estimated Hours: 0.0 As per the below e-mail thread with Bazsi, I was trying to figure out why syslog-ng doesn't write logs immediately. As I discovered syslog-ng by default has the concept of “flush_timeout” and “flush_lines”, where flush_timeout is how frequently we'll write logs (default 10s), and flush_lines is the maximum number of lines we'll hold in the buffer before writing (default 10,000). Currently, there is no way to synchronously force syslog-ng to "write logs now". This ticket is an enhancement to syslog-ng to add the ability, in a synchronous way, ask syslog-ng to flush the buffer now, writing all logs in the queue/buffer immediately/ASAP, and block until the operation is completed. Version Information: * syslog-ng 1.6.8 * FreeBSD 6.1 ----------- From: bazsi(a)balabit.hu To: fermulator(a)sympatico.ca Subject: Re: Flush (write logs now) for syslog-ng? Date: Fri, 22 Jul 2011 06:31:36 +0200 hi, we do have a bugzilla at bugzilla.balabit.com, however it's primarily used for bug reports. you can file enhancement requests though. ----- Original message ----- > Thanks for the reply. > > I tried SIGHUP, and as you mentioned, it's not synchronous. syslog-ng > does write the logs, but only after a few seconds (presumably this is > less than the timeout though at least). > > Do you have any "ticket system", that has the "enhancement" to do this > synchronously that I could reference? > > ~Matt > > > -------- Original Message -------- > From: Balazs Scheidler <bazsi(a)balabit.hu> > Sent: Thu 21 Jul 2011 02:31:24 PM EST > To: Fermulator Fermulator <fermulator(a)sympatico.ca> > Cc: > Subject: Re: Flush (write logs now) for syslog-ng? > > > hi, > > > > sending a SIGHUP should flush all buffers. this is not synchronous > > though, so you have to sleep some time to let syslog-ng do the thing. > > > > we have plans to add both on-demand synchronous reloads and config > > file flushes. > > > > ----- Original message ----- > > > > > > > > > > > > Hi Bazsi, > > > > > > > > > > > > I hope you don’t mind, I was trying to search for this in > > > the syslog-ng mail archives, but couldn’t find my answer, and found > > > your e-mail in the process. > > > > > > > > > > > > > > > As I understand it, syslog-ng has “flush_timeout” and “flush_lines” > > > parameters which determine how often we write out the buffer/queue of > > > log messages, and what the maximum number of lines is that we’ll > > > buffer, respectively. > > > > > > > > > > > > > > > > > > I’m trying to figure out: How can I tell syslog-ng to “write > > > logs now” on demand? (i.e. I > > > have a script that upon failure, scrapes some log files … but > > > instead of waiting for the flush_timeout, I’d rather “poke” > > > syslog-ng to “write all logs now” (i.e. temporarily set the > > > flush_timeout to 0, or temporarily set the flush_lines to 0) > > > > > > > > > > > > Is it possible? > > > > > > > > > > > > Thanks so much > > > > > > > > > ~Fermulator > > > (Matt Callaghan) > > > > > -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 115] New: libsyslog-ng.so is not linked with glib/cap but uses glib/ cap symbols
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=115 Summary: libsyslog-ng.so is not linked with glib/cap but uses glib/cap symbols Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: --- Estimated Hours: 0.0 [arekm@carme-pld ~/rpm/BUILD/syslog-ng-3.2.2/lib]$ ldd .libs/libsyslog-ng.so linux-vdso.so.1 => (0x00007fff46f80000) libc.so.6 => /lib64/libc.so.6 (0x00007fb64c4b8000) /lib64/ld-linux-x86-64.so.2 (0x0000003fba800000) but libsyslog-ng.so uses many glib and cap symbols: libtool: link: x86_64-pld-linux-gcc -std=gnu99 -I../../../lib -I../../../lib -I../../../modules/dbparser -I.. -Wno-pointer-sign -O2 -fno-strict-aliasing -fwrapv -march=x86-64 -gdwarf-3 -g2 -Wall .libs/test_patterndbS.o -Wl,--as-needed -Wl,--no-copy-dt-needed-entries -Wl,-z -Wl,relro -Wl,-z -Wl,combreloc -o .libs/test_patterndb test_patterndb.o ../.libs/patternize.o -Wl,-Bstatic -Wl,--whole-archive -Wl,--export-dynamic -pthread -Wl,--no-whole-archive -Wl,-Bdynamic ../../syslogformat/.libs/libsyslogformat.so ../../../lib/.libs/libsyslog-ng.so ../.libs/libsyslog-ng-patterndb.so /home/users/arekm/rpm/BUILD/syslog-ng-3.2.2/lib/.libs/libsyslog-ng.so -lssl -lcrypto -lresolv /usr/lib64/libgmodule-2.0.so /usr/lib64/libgthread-2.0.so -lpthread /usr/lib64/libglib-2.0.so /usr/lib64/libevtlog.so /usr/lib64/libpcre.so -lcap -ldl -lrt -pthread -Wl,-rpath -Wl,/lib64/syslog-ng ../../../lib/.libs/libsyslog-ng.so: undefined reference to `cap_set_proc' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `cap_from_text' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `g_module_build_path' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `cap_free' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `g_module_make_resident' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `g_thread_init' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `g_module_symbol' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `g_module_open' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `g_module_error' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `cap_set_flag' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `cap_to_text' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `cap_get_proc' That's in mixed linking, CORE_DEPS_LIBS is then empty. CORE_DEPS_LIBS should contain static linking to glib and dynamic to cap then. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 5

[Bug 114] New: configure strips -ldl -lrt for static linking but doesn' t add back with dynamic linking
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=114 Summary: configure strips -ldl -lrt for static linking but doesn't add back with dynamic linking Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: --- Estimated Hours: 0.0 configure.in when detecting glib strips -ldl and -lrt to prevent static linking with these libraries. # strip out -ldl & -lrt as it cannot be linked statically GLIB_LIBS=`echo $GLIB_LIBS | tr ' ' '\n' | egrep -v "^(-ldld?)|(-lrt)$" | tr '\n' ' '` This is fine. Unfortunately it doesn't add -ldl and -lrt back with dynamic linking and that causes newer glib detection to fail: configure:14223: checking for g_hash_table_new configure:14223: x86_64-pld-linux-gcc -std=gnu99 -o conftest -O2 -fno-strict-aliasing -fwrapv -march=x86-64 -gdwarf-3 -g2 -Wall -D_FORTIFY_SOURCE=2 -Wl,--as-needed -Wl,--no-copy-dt-needed-entries -Wl,-z,relro -Wl,-z,combreloc conftest.c -Wl,-Bstatic -Wl,--export-dynamic -pthread -lgmodule-2.0 -lgthread-2.0 -lglib-2.0 -Wl,-Bdynamic >&5 /usr/lib64/gcc/x86_64-pld-linux/4.5.2/../../../../lib64/libglib-2.0.a(gmain.o): In function `g_get_monotonic_time': (.text+0x2e12): undefined reference to `clock_gettime' collect2: ld returned 1 exit status -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

[Bug 108] New: 2.6.38+ will require CAP_SYSLOG (CAP_SYS_ADMIN not enough)
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=108 Summary: 2.6.38+ will require CAP_SYSLOG (CAP_SYS_ADMIN not enough) Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: enhancement Estimated Hours: 0.0 2.6.38+ kernels (linus git) reports: [ 9.890305] WARNING: at kernel/printk.c:430 do_syslog+0x427/0x452() [ 9.890318] Hardware name: 2764CTO [ 9.890320] Attempt to access syslog with CAP_SYS_ADMIN but no CAP_SYSLOG (deprecated and denied). when syslog tries to do syslogging. Additionally I'm geting: [root@t400 ~]# /usr/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf Error opening file for reading; filename='/proc/kmsg', error='Operation not permitted (1)' Error initializing source driver; source='s_sys', id='s_sys#0' Error initializing message pipeline; which likely is due to the same problem. Commit: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h… -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 44

[Bug 107] New: when trying to log to postgres database if port is not specified it gets defaulted to 0
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=107 Summary: when trying to log to postgres database if port is not specified it gets defaulted to 0 Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jhnsmth64(a)gmail.com Type of the Report: bug Estimated Hours: 0.0 syslog-ng.conf ... destination d_pgsql { sql(type(pgsql) host("localhost") username("user") password("pass") ... }; ... If destination stays defined like above, without port specified explicitly, syslog sends log messages to port 0 instead defaulting port to the Postgres port (5432). Destination settings below works: ... destination d_pgsql { sql(type(pgsql) host("localhost") port(5432) username("user") password("pass") ... }; ... -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 4

[Bug 106] New: Syslog-ng memory strdup and g_malloc leaks
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=106 Summary: Syslog-ng memory strdup and g_malloc leaks Product: syslog-ng Version: 3.2.x Platform: Other OS/Version: Solaris Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: daniel_novak(a)kb.cz Type of the Report: refactorization Estimated Hours: 0.0 We tried to compile a few last git version of syslog-3.2.1(syslog-ng-3.2.git-5f25ce47ab57774f8fe8df17bc96a006e535cb53) as well as 3.2.1 stable release. Everything is running well, but there are several minor memory leaks.We run on Solaris 10/08 on sparc platform.With libumem.so in memory debug mode MDB output is following : > ::findleaks CACHE LEAKED BUFCTL CALLER 00052288 2 00110d98 libc.so.1`strdup+0xc 00052788 1 0007de00 libglib-2.0.so.0.2513.0`g_malloc0+0x64 ---------------------------------------------------------------------- Total 3 buffers, 64 bytes =========================================================================================== > ::findleaks -dvf findleaks: maximum buffers => 4121 findleaks: actual buffers => 3967 mdb: [fef80000, fef84000): couldn't read 16384 bytes at fef80000: no mapping for address findleaks: findleaks: potential pointers => 341574 findleaks: dismissals => 196071 (57.4%) findleaks: misses => 130325 (38.1%) findleaks: dups => 11214 ( 3.2%) findleaks: follows => 3964 ( 1.1%) findleaks: findleaks: elapsed wall time => 0 seconds findleaks: CACHE LEAKED BUFCTL CALLER 00052288 2 00110d98 libc.so.1`strdup+0xc 00052788 1 0007de00 libglib-2.0.so.0.2513.0`g_malloc0+0x64 ---------------------------------------------------------------------- Total 3 buffers, 64 bytes umem_alloc_16 leak: 2 buffers, 16 bytes each, 32 bytes total ADDR BUFADDR TIMESTAMP THREAD CACHE LASTLOG CONTENTS 110d98 1097e0 1b08cf3fb0c96c 1 52288 43af4 0 libumem.so.1`umem_cache_alloc+0x210 libumem.so.1`umem_alloc+0x60 libumem.so.1`malloc+0x28 libc.so.1`strdup+0xc libsyslog-ng.so.0.0.0`cfg_lexer_lookup_keyword+0xf0 libsyslog-ng.so.0.0.0`_cfg_lexer_lex+0x18a4 libsyslog-ng.so.0.0.0`cfg_lexer_lex+0x284 libsyslog-ng.so.0.0.0`main_lex+0x1c libsyslog-ng.so.0.0.0`main_parse+0x7a4 libsyslog-ng.so.0.0.0`cfg_parser_parse+0xcc libsyslog-ng.so.0.0.0`cfg_run_parser+0x1ac libsyslog-ng.so.0.0.0`cfg_read_config+0x98 initial_init+0x5c main+0x244 _start+0x5c umem_alloc_32 leak: 1 buffer, 32 bytes ADDR BUFADDR TIMESTAMP THREAD CACHE LASTLOG CONTENTS 7de00 77b98 1b08cf406e21b0 1 52788 373ec 0 libumem.so.1`umem_cache_alloc+0x210 libumem.so.1`umem_alloc+0x60 libumem.so.1`malloc+0x28 libumem.so.1`calloc+0x58 libglib-2.0.so.0.2513.0`g_malloc0+0x64 libsyslog-ng.so.0.0.0`serialize_file_archive_new+0x1c libsyslog-ng.so.0.0.0`persist_state_load+0x54 libsyslog-ng.so.0.0.0`persist_state_start+0x34 libsyslog-ng.so.0.0.0`cfg_initial_init+0x28 initial_init+0xbc main+0x244 _start+0x5c ========================================================================= findleaks: using cached results (-f will force a full run) CACHE LEAKED BUFCTL CALLER 00052288 2 00110d98 libc.so.1`strdup+0xc 00052788 1 0007de00 libglib-2.0.so.0.2513.0`g_malloc0+0x64 ---------------------------------------------------------------------- Total 3 buffers, 64 bytes > 00110d98::umem_verify mdb: cache 110d98 () does not have redzone checking enabled > 00052288::umem_verify Summary for cache 'umem_alloc_16' clean > 00052788::umem_verify Summary for cache 'umem_alloc_32' clean ============================================================================= -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

[Bug 104] New: Add libtool option -module
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=104 Summary: Add libtool option -module Product: syslog-ng Version: 3.2.x Platform: All OS/Version: All Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: vinschen(a)redhat.com Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=30) --> (https://bugzilla.balabit.com/attachment.cgi?id=30) Patch to add libtool option -module Libtool 2.2.6 and later provides an option -module which should be used when creating shared libraries which are supposed to be used as modules which get loaded via dlopen. See the "Building modules to dlopen" chapter in `info libtool'. For Cygwin the additional benefit is that the modules are not copied into a parallel "bin" directory at installation time, which is the default otherwise to accommodate the DLL search algorithm on Windows. The attached patch just adds the -module option to each of the Makefile.am files in the modules subdir. Corinna -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 4

[Bug 120] New: afsql. c afsql_dd_format_* routines should include table in persist_name string
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=120 Summary: afsql.c afsql_dd_format_* routines should include table in persist_name string Product: syslog-ng Version: 3.2.x Platform: Other URL: https://lists.balabit.hu/pipermail/syslog-ng/2011- February/015913.html OS/Version: Other Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jtk(a)cymru.com Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=36) --> (https://bugzilla.balabit.com/attachment.cgi?id=36) include table name in persist_name As originally discovered in the syslog-ng list post entitled "[syslog-ng] duplicate config elements in sql destinations" by John Kristoff on 2011-02-11, syslog-ng will complain, when multiple destinations all point to the same database, but different tables with the message: Internal error, duplicate configuration elements refer to the same persistent config; name='afsql_dd(pgsql,127.0.0.1,,bar)' Balazs responded describing the potential problems with counters being swapped and a fix that appears to work in testing. A Patch for syslog-ng 3.2.4 is attached, but similar patch should work for earlier versions as indicated by Balazs' posting. Thank you, John -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

[Bug 139] New: syslog-ng crashes on SIGHUP when rewrite used in multiple log{} declarations
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=139 Summary: syslog-ng crashes on SIGHUP when rewrite used in multiple log{} declarations Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.syslogng(a)feystorm.net Type of the Report: --- Estimated Hours: 0.0 This is for version 3.3.1 which isnt an available version in the bug tracker. I've managed to create a situation where syslog-ng crashes when it receives a SIGHUP, and a certain rewrite has been used in at least 3 different log{} declarations. Below is the extremely stripped down configuration I've created which duplicates the issue. With the below configuration, when syslog-ng receives a HUP, it will get a segfault in malloc_consolidate(). Additionally, the process which monitors syslog-ng for crashing doesnt appear to have a signal handler for SIGHUP, so the monitor process will die when it gets a HUP. This is a problem, at least on redhat as the redhat init script sends a HUP to both the monitor process and the real worker process when the init script is called with `reload` @version: 3.3 @include "scl.conf" source s_local { system(); }; rewrite r_fext { #set("$LEVEL",value('FEXT')); subst('foo','bar', value('FEXT') type('string')); }; log { source(s_local); rewrite(r_fext); }; log { source(s_local); rewrite(r_fext); }; log { source(s_local); rewrite(r_fext); }; -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4