- syslog-ng - lists.balabit.hu

problem with windows agent and windows 2008
by Giovanni Mancuso 12 May '11

12 May '11

Hi, I have a problem with syslog-ng windows agent. I installed the client in a Windows 2003 machine and it works very well. I try to install the same client in a windows 2008 SP2 machine, but it send ONLY the startup/shutdown of the agent. It doesn't send other log (for ezample the windows event logs). I try to run the agent in debug mode (with /E) but i don't find useful information. Any ideas? Thank

2 1

syslog-ng Insider - May 2011
by Peter Czanik 12 May '11

12 May '11

Dear syslog-ng users, This is the 3rd issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com <mailto:documentation@balabit.com> FEATURED NEWS syslog-ng OSE 3.3 development ----------------------------- The previous month did not see a new syslog-ng 3.3 alpha or beta release, but development still went on. There were many important bugfixes and performance improvements. Also, most of the patches from the community were merged, including value-pairs(), mongo-db updates and JSON support. There is now a feature freeze in effect, so new features go now into the freshly opened syslog-ng 3.4 repository. The current version can be checked out out from git, which has regular updates at http://git.balabit.hu/?p=bazsi/syslog-ng-3.3.git;a=summary The mailing list archive with some more patches: http://lists.balabit.hu/pipermail/syslog-ng/ Blog about the feature freeze: http://bazsi.blogs.balabit.com/2011/05/syslog-ng-3-3-feature-freeze-3-4-bra… Blog series on web GUIs for syslog-ng ------------------------------------- Web based GUIs for syslog-ng is a hot topic recently, so a new blog series was started. This month I'll cover a new challenger: ELSA, which has patterndb at its heart.If you have any suggestions what else to cover, please let us know! ELSA: https://czanik.blogs.balabit.com/2011/05/elsa-web-interface-for-syslog-ng-a… Support the syslog-ng project with your testimonial! ---------------------------------------------------- We send syslog-ng T-Shirts for the best use-cases and testimonials. We are especially interested in how you use syslog-ng: your environment, performance metrics, the UNIX platforms that you use and anything that you deem interesting about your setup. This is your possibility to influence the syslog-ng development process and to help the syslog-ng project. http://www.balabit.com/testimonials/send OTHER SHORT NEWS * Maintenance policy update for syslog-ng OSE: http://bazsi.blogs.balabit.com/2011/05/maintenance-policy-update-for-syslog… * Algernon's syslog-ng status update: http://algernon.blogs.balabit.com/2011/05/veni-vidi-vici/ NEW RELEASES * new 3.2 OSE bugfix release: http://lists.balabit.hu/pipermail/syslog-ng/2011-May/016576.html RECENT WHITEPAPERS * How to establish a distributed syslog architecture in heterogeneous environment with syslog-ng Premium Edition? http://www.balabit.com/support/documentation/syslog-ng-v4.0-whitepaper-dist… * Get familiar with the advantages of using syslog-ng Premium Edition to collect system log (syslog) messages into an SQL database, such as Oracle or MySQL. http://www.balabit.com/support/documentation/syslog-ng-v4.0-whitepaper-sysl… ARCHIVE http://insider.blogs.balabit.com/ -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

[PATCH] afmongodb: Fix a possible crash during configuration.
by Gergely Nagy 12 May '11

12 May '11

During configuration, if the user specified value-pairs(), the driver would crash, because it tried to free a NULL structure. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/afmongodb/afmongodb.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/modules/afmongodb/afmongodb.c b/modules/afmongodb/afmongodb.c index 68594d7..422058e 100644 --- a/modules/afmongodb/afmongodb.c +++ b/modules/afmongodb/afmongodb.c @@ -148,7 +148,8 @@ afmongodb_dd_set_value_pairs(LogDriver *d, ValuePairs *vp) { MongoDBDestDriver *self = (MongoDBDestDriver *)d; - value_pairs_free (self->vp); + if (self->vp) + value_pairs_free (self->vp); self->vp = vp; } -- 1.7.2.5

2 3

[PATCH] value-pairs: Use MESSAGE instead of MSG.
by Gergely Nagy 12 May '11

12 May '11

MESSAGE is the canonical name of the key, not MSG. Using MSG in the rfc3164 scope will result in both MSG and MESSAGE being present if nv-pairs is being used aswell. Using the canonical name, only MESSAGE will end up in the set, which is exactly what we'd like. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- lib/value-pairs.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/lib/value-pairs.c b/lib/value-pairs.c index f88a486..7a09812 100644 --- a/lib/value-pairs.c +++ b/lib/value-pairs.c @@ -76,7 +76,7 @@ static ValuePairSpec rfc3164[] = { "HOST" }, { "PROGRAM" }, { "PID" }, - { "MSG" }, + { "MESSAGE" }, { "DATE", "R_DATE" }, { 0 }, }; -- 1.7.2.5

2 1

syslog-ng 3.2.4 has been released
by devel＠balabit.hu 11 May '11

11 May '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.2.4 SUMMARY : new stable release DATE : May 11, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.2.4) has been released. For latest fixes in the 3.2.x branch you are recommended to upgrade to this version. CHANGES: 3.2.4 Thu, 05 May 2011 23:10:52 +0200 Highlights: This maintenance release fixes some looser ends in the last published release, 3.2.3. There's one more important bugfix here, which is triggered by PCRE newer than 8.12. Bugfixes: * Fixed build problems on Solaris & AIX. * A bug was found in the pcre implementation for subst(). If the "global" flag is specified and pcre returns an error, an infinite loop is created, consuming memory in the process. It is triggered by PCRE 8.12, but could potentially affect older versions too. * Fixed a potential use of uninitialized memory in the configuration file parser, no bug was triggered but gcc 4.6 reported it via a warning. Other changes: * Fixed most (but not all) compilation warnings when compiling with gcc 4.6 Credits: syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Sandor Geller (Morgan Stanley) Balazs Scheidler (BalaBit) Micah Anderson Jose Oliveira (Fedora) Thanks for your efforts, it is appreciated. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

Configuring Syslog-ng client to start on a specific IP
by Pramod Pillai 09 May '11

09 May '11

Hi I am using Solaris box and it has multiple IP interfaces. I need to force the syslog-ng client to run on a specific interface card i.e on a specific IP. How can I do that. Each interface card is configured to run on different subnet and they can't talk to each other. ( for security reasons ) Hence when I run my syslog-ng client I end up running on the interface where I login. I want to change it. I want the syslog-client to create a socket on the interface ( IP ) which I specify ( in the config file ). Regards Pramod

2 1

Re: [syslog-ng] [PATCH RFC] Use cap_syslog when it is available (v3)
by Gergely Nagy 08 May '11

08 May '11

(forwarding the original mail, as it looks like it never made to the list) Serge Hallyn <serge.hallyn(a)canonical.com> writes: > (A-ha - great idea from Andrew - we *can* figure out whether the > kernel knows about CAP_SYSLOG, using the bounding set API) > > If cap_syslog exists, the kernel will complain (once) that we only > have cap_sys_admin. Additionally, using cap_syslog instead of > cap_sys_admin significantly lowers the unneeded privs we are > using. > > Changelog: > v2: At startup, detect whether libcap knows about CAP_SYSLOG. > (Thanks to Gergely Nagy for pointing out that case) > v3: Andrew Morgan pointed out a nice way to detect whether > the kernel has CAP_SYSLOG. Thanks, Andrew! > > Signed-off-by: Serge Hallyn <serge.hallyn(a)ubuntu.com> > --- > lib/gprocess.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++- > lib/gprocess.h | 2 +- > modules/affile/affile.c | 4 +++ > syslog-ng/main.c | 10 ++------ > 4 files changed, 55 insertions(+), 9 deletions(-) > > diff --git a/lib/gprocess.c b/lib/gprocess.c > index d9a2dfb..f9bda7b 100644 > --- a/lib/gprocess.c > +++ b/lib/gprocess.c > @@ -98,6 +98,7 @@ static gint startup_result_pipe[2] = { -1, -1 }; > static gint init_result_pipe[2] = { -1, -1 }; > static GProcessKind process_kind = G_PK_STARTUP; > static gboolean stderr_present = TRUE; > +static int have_capsyslog = FALSE; > > /* global variables */ > static struct > @@ -210,6 +211,14 @@ g_process_cap_modify(int capability, int onoff) > if (!process_opts.caps) > return TRUE; > > +#ifdef CAP_SYSLOG > + /* > + * if libcap or kernel doesn't support cap_syslog, then resort to > + * cap_sys_admin > + */ > + if (capability == CAP_SYSLOG && !have_capsyslog) > + capability = CAP_SYS_ADMIN; > +#endif > caps = cap_get_proc(); > if (!caps) > return FALSE; > @@ -416,7 +425,7 @@ g_process_set_working_dir(const gchar *cwd) > * capability set. The process will change its capabilities to this value > * during startup, provided it has enough permissions to do so. > **/ > -void > +static void > g_process_set_caps(const gchar *caps) > { > if (!process_opts.caps) > @@ -879,6 +888,43 @@ g_process_change_dir(void) > } > > /** > + * g_process_setup_caps(void) > + * > + * NOTE: polling /proc/kmsg requires cap_sys_admin, otherwise it'll always > + * indicate readability. Enabling/disabling cap_sys_admin on every poll > + * invocation seems to be too expensive. So I enable it for now. > + */ > +void > +g_process_setup_caps(void) > +{ > + int ret; > + gchar * capsstr = "cap_net_bind_service,cap_net_broadcast,cap_net_raw," > + "cap_dac_read_search,cap_dac_override,cap_chown,cap_fowner=p " > + "cap_sys_admin=ep"; > +#ifdef CAP_SYSLOG > + cap_t caps; > + > + /* Check whether cap_syslog exists. If not, get cap_sys_admin, else get > + * cap_syslog */ > + caps = cap_from_text("cap_syslog=p"); > + if (caps) { > + cap_free(caps); > + /* libcap knows it, does the kernel? */ > + ret = prctl(PR_CAPBSET_READ, CAP_SYSLOG); > + if (ret != -1) { > + /* kernel knows cap_syslog! Use it */ > + capsstr = "cap_net_bind_service,cap_net_broadcast,cap_net_raw," > + "cap_dac_read_search,cap_dac_override,cap_chown,cap_fowner=p " > + "cap_syslog=ep"; > + have_capsyslog = TRUE; > + } > + } > +#endif > + > + g_process_set_caps(capsstr); > +} > + > +/** > * g_process_send_result: > * @ret_num: exit code of the process > * > diff --git a/lib/gprocess.h b/lib/gprocess.h > index cda35b0..4ad0866 100644 > --- a/lib/gprocess.h > +++ b/lib/gprocess.h > @@ -66,7 +66,7 @@ void g_process_set_chroot(const gchar *chroot); > void g_process_set_pidfile(const gchar *pidfile); > void g_process_set_pidfile_dir(const gchar *pidfile_dir); > void g_process_set_working_dir(const gchar *cwd); > -void g_process_set_caps(const gchar *caps); > +void g_process_setup_caps(void); > void g_process_set_argv_space(gint argc, gchar **argv); > void g_process_set_use_fdlimit(gboolean use); > void g_process_set_check(gint check_period, gboolean (*check_fn)(void)); > diff --git a/modules/affile/affile.c b/modules/affile/affile.c > index a713bfc..358a083 100644 > --- a/modules/affile/affile.c > +++ b/modules/affile/affile.c > @@ -59,7 +59,11 @@ affile_open_file(gchar *name, gint flags, > if (privileged) > { > g_process_cap_modify(CAP_DAC_READ_SEARCH, TRUE); > +#ifdef CAP_SYSLOG > + g_process_cap_modify(CAP_SYSLOG, TRUE); > +#else > g_process_cap_modify(CAP_SYS_ADMIN, TRUE); > +#endif > } > else > { > diff --git a/syslog-ng/main.c b/syslog-ng/main.c > index 7e81f2f..5e62c1f 100644 > --- a/syslog-ng/main.c > +++ b/syslog-ng/main.c > @@ -167,13 +167,9 @@ main(int argc, char *argv[]) > > g_process_set_argv_space(argc, (gchar **) argv); > > - /* NOTE: polling /proc/kmsg requires cap_sys_admin, otherwise it'll always > - * indicate readability. Enabling/disabling cap_sys_admin on every poll > - * invocation seems to be too expensive. So I enable it for now. */ > - > - g_process_set_caps("cap_net_bind_service,cap_net_broadcast,cap_net_raw," > - "cap_dac_read_search,cap_dac_override,cap_chown,cap_fowner=p " > - "cap_sys_admin=ep"); > + /* Set up the minimal privilege we'll need */ > + g_process_setup_caps(); > + > ctx = g_option_context_new("syslog-ng"); > g_process_add_option_group(ctx); > msg_add_option_group(ctx); -- |8]

2 4

[PATCH] afmongodb: Fix a possible crash during configuration.
by Gergely Nagy 08 May '11

08 May '11

During configuration, if the user specified value-pairs(), the driver would crash, because it tried to free a NULL structure. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/afmongodb/afmongodb.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/modules/afmongodb/afmongodb.c b/modules/afmongodb/afmongodb.c index 68594d7..422058e 100644 --- a/modules/afmongodb/afmongodb.c +++ b/modules/afmongodb/afmongodb.c @@ -148,7 +148,8 @@ afmongodb_dd_set_value_pairs(LogDriver *d, ValuePairs *vp) { MongoDBDestDriver *self = (MongoDBDestDriver *)d; - value_pairs_free (self->vp); + if (self->vp) + value_pairs_free (self->vp); self->vp = vp; } -- 1.7.2.5

1 0

3.3.0alpha2(git) escape \ with postgresql 9.0.4
by Hendrik Visage 05 May '11

05 May '11

Hi there (1) Thanks for the default value in the afsql ;) (2)warning seen: Running SQL query; query='INSERT INTO SystemEvents (ID, ReceivedAt, DeviceReportedTime, Facility, Priority, FromHost, Message, InfoUnitID, SysLogTag, CustomerID, NTSeverity, Importance, EventSource, EventUser, EventCategory, EventID, EventBinaryData, MaxAvailable, CurrUsage, MinUsage, MaxUsage, EventLogType, GenericFileName, SystemID) VALUES (DEFAULT, \'2011-05-05T16:45:58+02:00\', \'2011-05-05T16:45:58+02:00\', \'5\', \'3\', \'pint02\', \' 5 16:27:23 pint02 syslog-ng[1788]: I/O error occurred while writing; fd=\'\'23\'\', error=\'\'Can\\\'\'t assign requested address (227)\'\'\', \'1\', \'May \', NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL)' WARNING: nonstandard use of \\ in a string literal LINE 1: ... '2011-05-05T16:45:58+02:00', '5', '3', 'pint02', ' 5 16:27:... ^ HINT: Use the escape string syntax for backslashes, e.g., E'\\'.

2 1

[Bug 119] New: Compiling syslog-ng 3.2.3 with gcc 4.6: warnings
by bugzilla＠bugzilla.balabit.com 04 May '11

04 May '11

https://bugzilla.balabit.com/show_bug.cgi?id=119 Summary: Compiling syslog-ng 3.2.3 with gcc 4.6: warnings Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jpo(a)di.uminho.pt Type of the Report: --- Estimated Hours: 0.0 Hi, This is a small report about the 42 warnings produced by gcc 4.6 when compiling syslog-ng 3.2.3 without SSL and SQL support. The target linux distribution was Fedora 16 (currently very similar to the Fedora 15 Beta). The complete build logs can be browsed here: * http://kojipkgs.fedoraproject.org/packages/syslog-ng/3.2.3/1.fc16/data/logs… * http://kojipkgs.fedoraproject.org/packages/syslog-ng/3.2.3/1.fc16/data/logs… Warnings count by type: Num : gcc_warning_type ------------------------------------- 2 : -Wcpp 1 : -Wimplicit-function-declaration 2 : -Wstrict-aliasing 18 : -Wuninitialized 9 : -Wunused-but-set-variable 10 : -Wunused-result ------------------------------------- Output of wget -q -O - http://kojipkgs.fedoraproject.org/packages/syslog-ng/3.2.3/1.fc16/data/logs… | grep "\[-W": ---------- misc.c:382:9: warning: variable 'saved_caps' set but not used [-Wunused-but-set-variable] misc.c:420:18: warning: ignoring return value of 'chown', declared with attribute warn_unused_result [-Wunused-result] misc.c:422:18: warning: ignoring return value of 'chown', declared with attribute warn_unused_result [-Wunused-result] logrewrite.c:72:11: warning: variable 'regexp_error' set but not used [-Wunused-but-set-variable] gprocess.c:920:12: warning: ignoring return value of 'write', declared with attribute warn_unused_result [-Wunused-result] gprocess.c:873:14: warning: ignoring return value of 'chdir', declared with attribute warn_unused_result [-Wunused-result] gprocess.c:881:13: warning: ignoring return value of 'getcwd', declared with attribute warn_unused_result [-Wunused-result] filter-expr-grammar.c:3538:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] block-ref-grammar.c:2943:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] cfg-grammar.c:4073:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] pragma-grammar.c:3063:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] rewrite-expr-grammar.c:3117:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] parser-expr-grammar.c:2958:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] afsocket.c:95:13: warning: variable 'saved_caps' set but not used [-Wunused-but-set-variable] afunix.c:138:9: warning: variable 'saved_caps' set but not used [-Wunused-but-set-variable] afunix.c:149:14: warning: ignoring return value of 'chown', declared with attribute warn_unused_result [-Wunused-result] afunix.c:151:14: warning: ignoring return value of 'chown', declared with attribute warn_unused_result [-Wunused-result] afinet.c:349:17: warning: variable 'saved_caps' set but not used [-Wunused-but-set-variable] afinet.c:465:36: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] afinet.c:466:36: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] afsocket-grammar.c:5597:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] afsocket.c:1080:29: warning: 'source' may be used uninitialized in this function [-Wuninitialized] affile.c:47:9: warning: variable 'saved_caps' set but not used [-Wunused-but-set-variable] affile.c:109:15: warning: ignoring return value of 'fchown', declared with attribute warn_unused_result [-Wunused-result] affile.c:111:15: warning: ignoring return value of 'fchown', declared with attribute warn_unused_result [-Wunused-result] affile-grammar.c:3734:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] afprog-grammar.c:3455:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] afuser-grammar.c:2916:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] csvparser.c:348:3: warning: implicit declaration of function 'log_column_parser_free_method' [-Wimplicit-function-declaration] csvparser-grammar.c:3055:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] syslog-format.c:664:9: warning: variable 'sd_param_len' set but not used [-Wunused-but-set-variable] patternize.c:85:2: warning: #warning "openssl seems to be missing on your system, UUID generation will be disabled in pdbtool patternize" [-Wcpp] patternize.c:85:2: warning: #warning "openssl seems to be missing on your system, UUID generation will be disabled in pdbtool patternize" [-Wcpp] dbparser-grammar.c:2929:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] patterndb.c:421:12: warning: variable 'class_tag' set but not used [-Wunused-but-set-variable] patterndb.c:421:12: warning: variable 'class_tag' set but not used [-Wunused-but-set-variable] dummy-grammar.c:2950:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] loggen.c:183:12: warning: ignoring return value of 'fgets', declared with attribute warn_unused_result [-Wunused-result] loggen.c:350:17: warning: 'pos_seq' may be used uninitialized in this function [-Wuninitialized] loggen.c:329:21: warning: 'pos_timestamp2' may be used uninitialized in this function [-Wuninitialized] loggen.c:328:21: warning: 'pos_timestamp1' may be used uninitialized in this function [-c] loggen.c:215:1: warning: 'linelen' may be used uninitialized in this function [-Wuninitialized] ---------- Note: The warning "csvparser.c:348:3: warning: implicit declaration of function 'log_column_parser_free_method' [-Wimplicit-function-declaration]" appears to already be eliminated by a recent commit. Would it be possible to have some of these warnings eliminated? In particular the ones of the -Wuninitialized type? jpo -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6