- syslog-ng - lists.balabit.hu

Configuring Syslog-ng client to start on a specific IP
by Pramod Pillai 09 May '11

09 May '11

Hi I am using Solaris box and it has multiple IP interfaces. I need to force the syslog-ng client to run on a specific interface card i.e on a specific IP. How can I do that. Each interface card is configured to run on different subnet and they can't talk to each other. ( for security reasons ) Hence when I run my syslog-ng client I end up running on the interface where I login. I want to change it. I want the syslog-client to create a socket on the interface ( IP ) which I specify ( in the config file ). Regards Pramod

2 1

Re: [syslog-ng] [PATCH RFC] Use cap_syslog when it is available (v3)
by Gergely Nagy 08 May '11

08 May '11

(forwarding the original mail, as it looks like it never made to the list) Serge Hallyn <serge.hallyn(a)canonical.com> writes: > (A-ha - great idea from Andrew - we *can* figure out whether the > kernel knows about CAP_SYSLOG, using the bounding set API) > > If cap_syslog exists, the kernel will complain (once) that we only > have cap_sys_admin. Additionally, using cap_syslog instead of > cap_sys_admin significantly lowers the unneeded privs we are > using. > > Changelog: > v2: At startup, detect whether libcap knows about CAP_SYSLOG. > (Thanks to Gergely Nagy for pointing out that case) > v3: Andrew Morgan pointed out a nice way to detect whether > the kernel has CAP_SYSLOG. Thanks, Andrew! > > Signed-off-by: Serge Hallyn <serge.hallyn(a)ubuntu.com> > --- > lib/gprocess.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++- > lib/gprocess.h | 2 +- > modules/affile/affile.c | 4 +++ > syslog-ng/main.c | 10 ++------ > 4 files changed, 55 insertions(+), 9 deletions(-) > > diff --git a/lib/gprocess.c b/lib/gprocess.c > index d9a2dfb..f9bda7b 100644 > --- a/lib/gprocess.c > +++ b/lib/gprocess.c > @@ -98,6 +98,7 @@ static gint startup_result_pipe[2] = { -1, -1 }; > static gint init_result_pipe[2] = { -1, -1 }; > static GProcessKind process_kind = G_PK_STARTUP; > static gboolean stderr_present = TRUE; > +static int have_capsyslog = FALSE; > > /* global variables */ > static struct > @@ -210,6 +211,14 @@ g_process_cap_modify(int capability, int onoff) > if (!process_opts.caps) > return TRUE; > > +#ifdef CAP_SYSLOG > + /* > + * if libcap or kernel doesn't support cap_syslog, then resort to > + * cap_sys_admin > + */ > + if (capability == CAP_SYSLOG && !have_capsyslog) > + capability = CAP_SYS_ADMIN; > +#endif > caps = cap_get_proc(); > if (!caps) > return FALSE; > @@ -416,7 +425,7 @@ g_process_set_working_dir(const gchar *cwd) > * capability set. The process will change its capabilities to this value > * during startup, provided it has enough permissions to do so. > **/ > -void > +static void > g_process_set_caps(const gchar *caps) > { > if (!process_opts.caps) > @@ -879,6 +888,43 @@ g_process_change_dir(void) > } > > /** > + * g_process_setup_caps(void) > + * > + * NOTE: polling /proc/kmsg requires cap_sys_admin, otherwise it'll always > + * indicate readability. Enabling/disabling cap_sys_admin on every poll > + * invocation seems to be too expensive. So I enable it for now. > + */ > +void > +g_process_setup_caps(void) > +{ > + int ret; > + gchar * capsstr = "cap_net_bind_service,cap_net_broadcast,cap_net_raw," > + "cap_dac_read_search,cap_dac_override,cap_chown,cap_fowner=p " > + "cap_sys_admin=ep"; > +#ifdef CAP_SYSLOG > + cap_t caps; > + > + /* Check whether cap_syslog exists. If not, get cap_sys_admin, else get > + * cap_syslog */ > + caps = cap_from_text("cap_syslog=p"); > + if (caps) { > + cap_free(caps); > + /* libcap knows it, does the kernel? */ > + ret = prctl(PR_CAPBSET_READ, CAP_SYSLOG); > + if (ret != -1) { > + /* kernel knows cap_syslog! Use it */ > + capsstr = "cap_net_bind_service,cap_net_broadcast,cap_net_raw," > + "cap_dac_read_search,cap_dac_override,cap_chown,cap_fowner=p " > + "cap_syslog=ep"; > + have_capsyslog = TRUE; > + } > + } > +#endif > + > + g_process_set_caps(capsstr); > +} > + > +/** > * g_process_send_result: > * @ret_num: exit code of the process > * > diff --git a/lib/gprocess.h b/lib/gprocess.h > index cda35b0..4ad0866 100644 > --- a/lib/gprocess.h > +++ b/lib/gprocess.h > @@ -66,7 +66,7 @@ void g_process_set_chroot(const gchar *chroot); > void g_process_set_pidfile(const gchar *pidfile); > void g_process_set_pidfile_dir(const gchar *pidfile_dir); > void g_process_set_working_dir(const gchar *cwd); > -void g_process_set_caps(const gchar *caps); > +void g_process_setup_caps(void); > void g_process_set_argv_space(gint argc, gchar **argv); > void g_process_set_use_fdlimit(gboolean use); > void g_process_set_check(gint check_period, gboolean (*check_fn)(void)); > diff --git a/modules/affile/affile.c b/modules/affile/affile.c > index a713bfc..358a083 100644 > --- a/modules/affile/affile.c > +++ b/modules/affile/affile.c > @@ -59,7 +59,11 @@ affile_open_file(gchar *name, gint flags, > if (privileged) > { > g_process_cap_modify(CAP_DAC_READ_SEARCH, TRUE); > +#ifdef CAP_SYSLOG > + g_process_cap_modify(CAP_SYSLOG, TRUE); > +#else > g_process_cap_modify(CAP_SYS_ADMIN, TRUE); > +#endif > } > else > { > diff --git a/syslog-ng/main.c b/syslog-ng/main.c > index 7e81f2f..5e62c1f 100644 > --- a/syslog-ng/main.c > +++ b/syslog-ng/main.c > @@ -167,13 +167,9 @@ main(int argc, char *argv[]) > > g_process_set_argv_space(argc, (gchar **) argv); > > - /* NOTE: polling /proc/kmsg requires cap_sys_admin, otherwise it'll always > - * indicate readability. Enabling/disabling cap_sys_admin on every poll > - * invocation seems to be too expensive. So I enable it for now. */ > - > - g_process_set_caps("cap_net_bind_service,cap_net_broadcast,cap_net_raw," > - "cap_dac_read_search,cap_dac_override,cap_chown,cap_fowner=p " > - "cap_sys_admin=ep"); > + /* Set up the minimal privilege we'll need */ > + g_process_setup_caps(); > + > ctx = g_option_context_new("syslog-ng"); > g_process_add_option_group(ctx); > msg_add_option_group(ctx); -- |8]

2 4

[PATCH] afmongodb: Fix a possible crash during configuration.
by Gergely Nagy 08 May '11

08 May '11

During configuration, if the user specified value-pairs(), the driver would crash, because it tried to free a NULL structure. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/afmongodb/afmongodb.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/modules/afmongodb/afmongodb.c b/modules/afmongodb/afmongodb.c index 68594d7..422058e 100644 --- a/modules/afmongodb/afmongodb.c +++ b/modules/afmongodb/afmongodb.c @@ -148,7 +148,8 @@ afmongodb_dd_set_value_pairs(LogDriver *d, ValuePairs *vp) { MongoDBDestDriver *self = (MongoDBDestDriver *)d; - value_pairs_free (self->vp); + if (self->vp) + value_pairs_free (self->vp); self->vp = vp; } -- 1.7.2.5

1 0

3.3.0alpha2(git) escape \ with postgresql 9.0.4
by Hendrik Visage 05 May '11

05 May '11

Hi there (1) Thanks for the default value in the afsql ;) (2)warning seen: Running SQL query; query='INSERT INTO SystemEvents (ID, ReceivedAt, DeviceReportedTime, Facility, Priority, FromHost, Message, InfoUnitID, SysLogTag, CustomerID, NTSeverity, Importance, EventSource, EventUser, EventCategory, EventID, EventBinaryData, MaxAvailable, CurrUsage, MinUsage, MaxUsage, EventLogType, GenericFileName, SystemID) VALUES (DEFAULT, \'2011-05-05T16:45:58+02:00\', \'2011-05-05T16:45:58+02:00\', \'5\', \'3\', \'pint02\', \' 5 16:27:23 pint02 syslog-ng[1788]: I/O error occurred while writing; fd=\'\'23\'\', error=\'\'Can\\\'\'t assign requested address (227)\'\'\', \'1\', \'May \', NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL)' WARNING: nonstandard use of \\ in a string literal LINE 1: ... '2011-05-05T16:45:58+02:00', '5', '3', 'pint02', ' 5 16:27:... ^ HINT: Use the escape string syntax for backslashes, e.g., E'\\'.

2 1

[Bug 119] New: Compiling syslog-ng 3.2.3 with gcc 4.6: warnings
by bugzilla＠bugzilla.balabit.com 04 May '11

04 May '11

https://bugzilla.balabit.com/show_bug.cgi?id=119 Summary: Compiling syslog-ng 3.2.3 with gcc 4.6: warnings Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jpo(a)di.uminho.pt Type of the Report: --- Estimated Hours: 0.0 Hi, This is a small report about the 42 warnings produced by gcc 4.6 when compiling syslog-ng 3.2.3 without SSL and SQL support. The target linux distribution was Fedora 16 (currently very similar to the Fedora 15 Beta). The complete build logs can be browsed here: * http://kojipkgs.fedoraproject.org/packages/syslog-ng/3.2.3/1.fc16/data/logs… * http://kojipkgs.fedoraproject.org/packages/syslog-ng/3.2.3/1.fc16/data/logs… Warnings count by type: Num : gcc_warning_type ------------------------------------- 2 : -Wcpp 1 : -Wimplicit-function-declaration 2 : -Wstrict-aliasing 18 : -Wuninitialized 9 : -Wunused-but-set-variable 10 : -Wunused-result ------------------------------------- Output of wget -q -O - http://kojipkgs.fedoraproject.org/packages/syslog-ng/3.2.3/1.fc16/data/logs… | grep "\[-W": ---------- misc.c:382:9: warning: variable 'saved_caps' set but not used [-Wunused-but-set-variable] misc.c:420:18: warning: ignoring return value of 'chown', declared with attribute warn_unused_result [-Wunused-result] misc.c:422:18: warning: ignoring return value of 'chown', declared with attribute warn_unused_result [-Wunused-result] logrewrite.c:72:11: warning: variable 'regexp_error' set but not used [-Wunused-but-set-variable] gprocess.c:920:12: warning: ignoring return value of 'write', declared with attribute warn_unused_result [-Wunused-result] gprocess.c:873:14: warning: ignoring return value of 'chdir', declared with attribute warn_unused_result [-Wunused-result] gprocess.c:881:13: warning: ignoring return value of 'getcwd', declared with attribute warn_unused_result [-Wunused-result] filter-expr-grammar.c:3538:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] block-ref-grammar.c:2943:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] cfg-grammar.c:4073:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] pragma-grammar.c:3063:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] rewrite-expr-grammar.c:3117:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] parser-expr-grammar.c:2958:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] afsocket.c:95:13: warning: variable 'saved_caps' set but not used [-Wunused-but-set-variable] afunix.c:138:9: warning: variable 'saved_caps' set but not used [-Wunused-but-set-variable] afunix.c:149:14: warning: ignoring return value of 'chown', declared with attribute warn_unused_result [-Wunused-result] afunix.c:151:14: warning: ignoring return value of 'chown', declared with attribute warn_unused_result [-Wunused-result] afinet.c:349:17: warning: variable 'saved_caps' set but not used [-Wunused-but-set-variable] afinet.c:465:36: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] afinet.c:466:36: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] afsocket-grammar.c:5597:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] afsocket.c:1080:29: warning: 'source' may be used uninitialized in this function [-Wuninitialized] affile.c:47:9: warning: variable 'saved_caps' set but not used [-Wunused-but-set-variable] affile.c:109:15: warning: ignoring return value of 'fchown', declared with attribute warn_unused_result [-Wunused-result] affile.c:111:15: warning: ignoring return value of 'fchown', declared with attribute warn_unused_result [-Wunused-result] affile-grammar.c:3734:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] afprog-grammar.c:3455:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] afuser-grammar.c:2916:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] csvparser.c:348:3: warning: implicit declaration of function 'log_column_parser_free_method' [-Wimplicit-function-declaration] csvparser-grammar.c:3055:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] syslog-format.c:664:9: warning: variable 'sd_param_len' set but not used [-Wunused-but-set-variable] patternize.c:85:2: warning: #warning "openssl seems to be missing on your system, UUID generation will be disabled in pdbtool patternize" [-Wcpp] patternize.c:85:2: warning: #warning "openssl seems to be missing on your system, UUID generation will be disabled in pdbtool patternize" [-Wcpp] dbparser-grammar.c:2929:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] patterndb.c:421:12: warning: variable 'class_tag' set but not used [-Wunused-but-set-variable] patterndb.c:421:12: warning: variable 'class_tag' set but not used [-Wunused-but-set-variable] dummy-grammar.c:2950:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] loggen.c:183:12: warning: ignoring return value of 'fgets', declared with attribute warn_unused_result [-Wunused-result] loggen.c:350:17: warning: 'pos_seq' may be used uninitialized in this function [-Wuninitialized] loggen.c:329:21: warning: 'pos_timestamp2' may be used uninitialized in this function [-Wuninitialized] loggen.c:328:21: warning: 'pos_timestamp1' may be used uninitialized in this function [-c] loggen.c:215:1: warning: 'linelen' may be used uninitialized in this function [-Wuninitialized] ---------- Note: The warning "csvparser.c:348:3: warning: implicit declaration of function 'log_column_parser_free_method' [-Wimplicit-function-declaration]" appears to already be eliminated by a recent commit. Would it be possible to have some of these warnings eliminated? In particular the ones of the -Wuninitialized type? jpo -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

3.2.4 to be released in the coming days
by Balazs Scheidler 04 May '11

04 May '11

Hi, Since the release of 3.2.3 spurred some activity around the 3.2.x branch again, I accumulated some changes that either fix build related issues and fixes for a bug or two. I'm going to prepare a release later today, or latest tomorrow, so if you have an 3.2.x related issue, it's best to speak up now, so that I can perhaps fix it before doing a release. Thanks, -- Bazsi

1 0

Integrating syslog-ng on Solaris 10
by Pramod Pillai 04 May '11

04 May '11

Hi On Solaris machine the legacy logging is done by SMF system-log. And there are many Solaris SMF which depends on system-log SMF. If I want to integrate syslog-ng to Solaris box , should I disable system-log SMF ? But disabling "system-log" will cause few legacy SMF to go down. I can't have system-log SMF and syslog-ng enabled at the same time since it would result in logging twice. Can any one suggest alternative approach for integrating syslog-ng to Solaris box. Regards Pramod

5 4

[list admin] discussion of patches
by Balazs Scheidler 04 May '11

04 May '11

Hi, I intend to make the development of syslog-ng even more transparent and this means that more and more patches and development related questions needs to be discussed. See for instance the last e-mail about linking options. The big question is whether these discussions should be moved to a separate list, or rather it should stay here. I don't have a definitive view, as I read both development and non-development discussions, but I guess there are others on this list, who couldn't care less about linking options, patches and whatnot. But even for a user, seeing what kind of features are development, might be useful information, even if the code itself is less interesting. For me, it is more convinient as it is now. The question is how you, the other list members think about it? Please share your thoughts. Thanks. -- Bazsi

6 5

Setting facility/priority in 2.1.4?
by Ray Van Dolson 03 May '11

03 May '11

[ Wasn't subscribed to the list -- apologies if this ends up getting posted twice. ] I have a source (a FIFO/pipe) which I am re-emitting to another syslog-ng server via TCP. How do I define what facility and priority the data from this source is transmitted with? What is the default (daemon.info?)? This is syslog-ng 2.1.4 (old I know). Thanks, Ray

2 2

Solaris 10 UDP overflows, message drops
by Mishou Michael 03 May '11

03 May '11

All, I've done a lot of reading, and I can't figure out what I can do to this config in order to fix the UDP drops due to udpInOverflows on netstat -s. Here are some statistics relating to the amount of traffic we receive via syslog-ng, it's pretty busy but in reading I'm finding that some folks are doing much more. These stats are based on a ~30 second window of traffic during peak times, but variance due to time is not so much in our environment. I used tcpdump with a bpf to capture only inbound udp/514, so this is what the interface is seeing in the way of syslog. Elapsed: 00:00:34 Packets: 200000 Avg. packets/sec: 5836.546 Avg. packet size: 303.182 bytes Bytes: 60636477 Avg. bytes/sec: 1769537.884 Avg. MBit/sec: 14.156 So, about 6k messages per second. Here are the drop numbers over a time sample (done right after a process restart, you can see the buffer takes a moment to fill up [64 MB so_rcvbuf]): # while true; do echo -en "$(date) :: "; netstat -s | grep udpInOverflows | head -n 1 | sed 's|.*=||'; sleep 10; done Fri Apr 15 14:12:46 GMT 2011 :: 472517477 Fri Apr 15 14:12:56 GMT 2011 :: 472517477 Fri Apr 15 14:13:06 GMT 2011 :: 472517477 Fri Apr 15 14:13:16 GMT 2011 :: 472517477 Fri Apr 15 14:13:26 GMT 2011 :: 472543152 Fri Apr 15 14:13:36 GMT 2011 :: 472592800 Fri Apr 15 14:13:46 GMT 2011 :: 472638848 Fri Apr 15 14:13:56 GMT 2011 :: 472684407 So that's about 5k overflows a second, which jives with our calculations, suggesting we're getting only ~10% of our messages logged to disk. I inherited a config with _very_ many filter statements, but have decided to cut all that out to see if my performance problems in the way of udp drops continue (they do). I've attached a sanitized config to this message, all the stuff here concerns this config running (even though I thought eliminating the filters would really help, it didn't). We're running Solaris 10 SPARC. The syslog-ng version is: # /usr/local/sbin/syslog-ng -V syslog-ng 3.1.2 Installer-Version: 3.1.2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainli ne--3.1#master#8bf13c304b6ab5fc1a372b49d55c78370efe14ca Compile-Date: Oct 25 2010 23:56:18 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: on Enable-Sun-Door: on Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: on The following options are set for the OS: # ndd /dev/udp udp_max_buf 1073741824 # ndd /dev/udp udp_recv_hiwat 65536 Some options lines from the config based on what I've seen: * note the TCP stuff can be safely ignored, it's legacy from some testing but isn't currently seeing traffic * all 3 udp sources set with so_rcvbuf(67108864) (64 MB) options { # things I've changed/tweaked flush_lines(1000); flush_timeout(20); log_fifo_size (67108864); log_msg_size(8192); chain_hostnames(yes); # end my changes <snip> }; So I'm totally stumped. I can set the buffers with so_rcvbuf() to 1 GB, it still doesn't matter, they eventually fill up and I start losing packets. I'm hoping that someone can point me to some tweaks I can do to get the numbers of drops down or eliminated. Is it unreasonable to expect to be able to process this many messages per second via UDP? Maybe that's the problem. I might experiment some with default syslog to see if it can write this many messages without drops...this doesn't seem like an insane amount of traffic. But perhaps my expectations are unrealistic, that's what I'm hoping someone can tell me. Regards, --Mike

11 37