- syslog-ng - lists.balabit.hu

[PATCH RFC] Use cap_syslog when it is available
by Serge Hallyn 18 Apr '11

18 Apr '11

If cap_syslog exists, the kernel will complain (once per boot) that we only have cap_sys_admin. Ideally, we would detect whether the kernel knows about cap_syslog, and not use cap_sys_admin if it does. However, there is no good way to deduce that. We can only detect whether userspace knows about it, and kernel may not match userspace. I will work to get such polling into the kernel and, when successful, will provide a syslog-ng patch to use that, so that when CAP_SYSLOG is supported by the kernel, we can reduce the amount of privilege we needlessly take. Signed-off-by: Serge Hallyn <serge.hallyn(a)ubuntu.com> --- lib/gprocess.c | 35 ++++++++++++++++++++++++++++++++++- lib/gprocess.h | 2 +- modules/affile/affile.c | 3 +++ syslog-ng/main.c | 10 +++------- 4 files changed, 41 insertions(+), 9 deletions(-) diff --git a/lib/gprocess.c b/lib/gprocess.c index d9a2dfb..0884237 100644 --- a/lib/gprocess.c +++ b/lib/gprocess.c @@ -416,7 +416,7 @@ g_process_set_working_dir(const gchar *cwd) * capability set. The process will change its capabilities to this value * during startup, provided it has enough permissions to do so. **/ -void +static void g_process_set_caps(const gchar *caps) { if (!process_opts.caps) @@ -879,6 +879,39 @@ g_process_change_dir(void) } /** + * g_process_setup_caps(void) + * + * NOTE: polling /proc/kmsg requires cap_sys_admin, otherwise it'll always + * indicate readability. Enabling/disabling cap_sys_admin on every poll + * invocation seems to be too expensive. So I enable it for now. + * + * If CAP_SYSLOG exists, add that to our list of capabilities alongside + * CAP_SYS_ADMIN. Ideally we would *replace* it. However, we currently + * have no reliable way to check whether the kernel - which may not + * match userspace - supports it. If it doesn't, there is no harm in + * adding CAP_SYSLOG, but we of course still need CAP_SYS_ADMIN for + * /proc/kmsg. + * + * Once the kernel supports polling for the number of capabilities, we + * can drop CAP_SYSLOG after detecting whether CAP_SYSLOG exists. + */ +void +g_process_setup_caps(void) +{ +#ifdef CAP_SYSLOG + gchar * capsstr = "cap_net_bind_service,cap_net_broadcast,cap_net_raw," + "cap_dac_read_search,cap_dac_override,cap_chown,cap_fowner=p " + "cap_syslog,cap_sys_admin=ep"; +#else + gchar * capsstr = "cap_net_bind_service,cap_net_broadcast,cap_net_raw," + "cap_dac_read_search,cap_dac_override,cap_chown,cap_fowner=p " + "cap_sys_admin=ep"; +#endif + + g_process_set_caps(capsstr); +} + +/** * g_process_send_result: * @ret_num: exit code of the process * diff --git a/lib/gprocess.h b/lib/gprocess.h index cda35b0..4ad0866 100644 --- a/lib/gprocess.h +++ b/lib/gprocess.h @@ -66,7 +66,7 @@ void g_process_set_chroot(const gchar *chroot); void g_process_set_pidfile(const gchar *pidfile); void g_process_set_pidfile_dir(const gchar *pidfile_dir); void g_process_set_working_dir(const gchar *cwd); -void g_process_set_caps(const gchar *caps); +void g_process_setup_caps(void); void g_process_set_argv_space(gint argc, gchar **argv); void g_process_set_use_fdlimit(gboolean use); void g_process_set_check(gint check_period, gboolean (*check_fn)(void)); diff --git a/modules/affile/affile.c b/modules/affile/affile.c index a713bfc..b11b7ac 100644 --- a/modules/affile/affile.c +++ b/modules/affile/affile.c @@ -59,6 +59,9 @@ affile_open_file(gchar *name, gint flags, if (privileged) { g_process_cap_modify(CAP_DAC_READ_SEARCH, TRUE); +#ifdef CAP_SYSLOG + g_process_cap_modify(CAP_SYSLOG, TRUE); +#endif g_process_cap_modify(CAP_SYS_ADMIN, TRUE); } else diff --git a/syslog-ng/main.c b/syslog-ng/main.c index 7e81f2f..5e62c1f 100644 --- a/syslog-ng/main.c +++ b/syslog-ng/main.c @@ -167,13 +167,9 @@ main(int argc, char *argv[]) g_process_set_argv_space(argc, (gchar **) argv); - /* NOTE: polling /proc/kmsg requires cap_sys_admin, otherwise it'll always - * indicate readability. Enabling/disabling cap_sys_admin on every poll - * invocation seems to be too expensive. So I enable it for now. */ - - g_process_set_caps("cap_net_bind_service,cap_net_broadcast,cap_net_raw," - "cap_dac_read_search,cap_dac_override,cap_chown,cap_fowner=p " - "cap_sys_admin=ep"); + /* Set up the minimal privilege we'll need */ + g_process_setup_caps(); + ctx = g_option_context_new("syslog-ng"); g_process_add_option_group(ctx); msg_add_option_group(ctx); -- 1.7.4.1

2 1

Problem with Squid logs
by Matias Banchoff 15 Apr '11

15 Apr '11

Hello, I have a problem with remote logging for Squid logs. Our setup is the following: - syslog-ng server: syslog-ng 3.1.3. It is a dedicated server for logging. From now on, the server. - syslog-ng in Squid: syslog-ng 2.0.9. From now on, the client. The Squid process writes three log files: access.log, store.log and cache.log. I have configured the client syslog-ng to send those files to the log server. The problem is that the content of those files are sent only when syslog-ng starts on the client side. So: 1) The syslog-ng client writes all the information to the local files (access, cache and store). So, locally, it works. 2) The information is sent, but only when the client syslog-ng process restarts. So it is not a networking problem. 3) And, I've left the default config for all the other log stuff (like messages, syslog, etc.). That information is also sent to the log server. And, in this case, the information is sent constantly. I mean, I don't have to restart the syslog-ng client to make the Squid machine send the "messages", "syslog", "mail" and other logs. I've googled a while, but the only thing I found was some article about delayed logs, but it was due a bad timestamp. The thing here is Squid writes its logs with a strange timestamp: "1302699202.239", for example. Is there any way to translate that Squid timestamp into a more readable one, so I can probe if that is the problem? In addition, I've started syslog-ng client y debug mode (with -d -F), but nothing appears in the screen, although the logs are being written. Thank you for any answer or comment you might have :-) ----- CeSPI Centro Superior para el Procesamiento de la Información Universidad Nacional de La Plata ------------------------------------------------------------------------------- Proteja el Medioambiente. No imprima este mail si no es absolutamente necesario

4 4

Current stable version of syslog-ng
by Yu Watanabe 15 Apr '11

15 Apr '11

Hello all. I would like to ask a question regarding to the version of syslog-ng. Which version would be the most stable version for now? v 3.0.10 v 3.1.4 v 3.2.2 I asked the same question before but I didn't recieve a reply so I would like to ask again. Thanks, Yu Watanabe

3 2

syslog-ng Insider - April 2011
by Peter Czanik 14 Apr '11

14 Apr '11

Dear syslog-ng users, This is the second issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com <mailto:documentation@balabit.com> FEATURED NEWS syslog-ng OSE 3.3 development ----------------------------- The next syslog-ng release is developed at rocket speed. The second alpha release brought in support for MongoDB as destination, and threading for increased performance and scalability. Community involvement in the development process is increasing, with many patches and detailed bug reports, which helped to fix correlation problems. Direct SMTP support is also available as a not yet merged patch. There were also long discussions about JSON and name value pairs with value-pairs() and tfjson() available as patches. One can download the alpha2 release, or if impatient also check it out from git, which has regular updates at http://git.balabit.hu/?p=bazsi/syslog-ng-3.3.git;a=summary Alpha2 release: https://bazsi.blogs.balabit.com/2011/03/the-2nd-alpha-for-syslog-ng-3-3-is-… Mailing list archive with many patches: https://lists.balabit.hu/pipermail/syslog-ng/ A blog, how to get started with coding: http://algernon.blogs.balabit.com/2011/01/howto-write-a-simple-template-fun… syslog-ng called open source project of the year ------------------------------------------------ IDG hold its first Open Source conference on the 24th of February in Hungary. A new award was established for open source projects, and it was first given to syslog-ng OSE. Blog series on web GUIs for syslog-ng ------------------------------------- Web based GUIs for syslog-ng is a hot topic recently, so a new blog series was started. Loganalyzer, Loggly and Logzilla are already covered and a few more reviews (ELSA, Octopussy) are already under way. If you have any suggestions what else to cover, please let us know! Logzilla (formerly php-syslog-ng): http://czanik.blogs.balabit.com/2011/04/logzilla-brings-syslog-ng-and-cisco… Loganalyzer: https://czanik.blogs.balabit.com/2011/02/loganalyzer/ Loggly: https://czanik.blogs.balabit.com/2011/03/logging-to-the-cloud/ Support the syslog-ng project with your testimonial! ---------------------------------------------------- We send syslog-ng T-Shirts for the best use-cases and testimonials. We are especially interested in how you use syslog-ng: your environment, performance metrics, the UNIX platforms that you use and anything that you deem interesting about your setup. This is your possibility to influence the syslog-ng development process and to help the syslog-ng project. http://www.balabit.com/testimonials/send OTHER SHORT NEWS * openSUSE 11.4 comes with syslog-ng 3.2: https://czanik.blogs.balabit.com/2011/03/opensuse-11-4-with-syslog-ng-and-s… * FreeBSD 8.2 comes with syslog-ng 3.2: https://czanik.blogs.balabit.com/2011/02/freebsd-8-2-released/ * Intrusion prevention based on syslog-ng and patterndb: https://bazsi.blogs.balabit.com/2011/02/another-nice-hack-with-syslog-ng/ * ELSA (Enterprise Log Search and Archive Project) had its first public release: http://code.google.com/p/enterprise-log-search-and-archive RECENT WHITEPAPERS * http://www.balabit.com/whitepaper?wp=8988187171444164966624785 This document aims at briefly demonstrating the technological and business processes that led to the revaluation of log information to such an extent that its collection and procession has become one of the most essential tasks of contemporary corporate IT. Furthermore, we attempt to identify those critical points of a central logging management project that determine its success the most. We hope that taking our six pieces of advice relating to these six points will substantially contribute to the successful professional activities of our readers. ARCHIVE http://insider.blogs.balabit.com/ -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

Openssl SSL3_WRITE_PENDING error correction
by Juhasz Viktor 12 Apr '11

12 Apr '11

Hi All! We've found a bug in the log_proto_framed_client. The bug is the following: - using ssl communication between the server and client. - using syslog protocol - If client send messages faster than the server can process messages, then the client go into the SSL3_WRITE_PENDING openssl error and close the connection. partial message handling correction: the flush is called only if proto have partially sent message after flush is called log_proto_text_client_post have to return because the post send one message per call it is important in case of framed messages diff --git a/lib/logproto.c b/lib/logproto.c index d821275..7f2f897 100644 --- a/lib/logproto.c +++ b/lib/logproto.c @@ -145,9 +145,13 @@ log_proto_text_client_post(LogProto *s, guchar *msg, gsize msg_len, gboolean *co g_assert(self->super.convert == (GIConv) -1); *consumed = FALSE; - rc = log_proto_flush(s); - if (rc == LPS_ERROR) - goto write_error; + if(self->partial) + { + rc = log_proto_flush(s); + if (rc == LPS_ERROR) + goto write_error; + return rc; + } /* OK, partial buffer empty, now flush msg that we just got */ @@ -1774,6 +1778,7 @@ log_proto_framed_client_new(LogTransport *transport) self->super.super.prepare = log_proto_text_client_prepare; self->super.super.post = log_proto_framed_client_post; + self->super.super.flush = log_proto_text_client_flush; self->super.super.transport = transport; self->super.super.convert = (GIConv) -1; return &self->super.super; Best Regards, Viktor

3 4

Current stable version
by Yu Watanabe 12 Apr '11

12 Apr '11

Hi all I would like to ask question about open source edition. Which version will be the current stable version? Thanks, Yu Watanabe

1 0

syslog-ng IPv6 problem ver 3.01
by Arya, Manish Kumar 10 Apr '11

10 Apr '11

I am getting syntax error on line udp6 or tcp6 in destination same works well as source in version 3.2.1 deb:/var/log# netstat -na | grep 514 tcp6 0 0 fd00:abcd:4321:2:20:514 :::* LISTEN udp6 0 0 fd00:abcd:4321:2:20:514 :::* here is my config for syslog client using syslog-ng 3.01 source s_local { internal(); unix-stream("/dev/log"); file("/proc/kmsg" log_prefix("kernel: ")); udp(); }; destination ipv6_host { # udp6(ip(fd00:abcd:4321:2:20c:29ff:fea8:9671) port(514)); tcp6(ip(fd00:abcd:4321:2:20c:29ff:fea8:9671) port(514)); }; destination d_local { file("/var/log/messages"); }; log { source(s_local); destination(ipv6_host); destination(d_local); };

4 7

syslog-ng -s errors with catchall flag (1.6 to 3.1)
by Mishou Michael 09 Apr '11

09 Apr '11

Folks, I've done a lot of reading of the list archives through Google, but this is the first question that's really stumped me and also stumped the archives as well. I'm currently converting a 1.6 config to version 3.1, eliminating the warnings generated by -s and whatnot. One of the warnings I get is the following: Unknown log statement flag; flag='catchall' The configuration line this warning/error is referencing looks like this: log { source(network); destination(finalcatchall); destination(catchall_relay); flags(final,catchall); }; For some reason, the syslog-ng version I'm using doesn't like that flag option, but according to the 3.1 documentation, it is valid, as far as I can see. http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.1- guide-admin-en.html/index.html-single.html#logpath I tried removing the final flag (thinking perhaps it was redundant) and just leaving the catchall in, but the error persists. Here is the version information for the syslog-ng I'm using, perhaps it is a bug? I'm not quite sure how to search the bug database, if anyone could point me in the right direction it would be appreciated. # /usr/local/sbin/syslog-ng -V syslog-ng 3.1.2 Installer-Version: 3.1.2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainli ne--3.1#master#8bf13c304b6ab5fc1a372b49d55c78370efe14ca Compile-Date: Oct 25 2010 23:56:18 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: on Enable-Sun-Door: on Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: on The version of syslog-ng I'm using is on Solaris 10 SPARC, pre-compiled packages I got from here: http://www.sunfreeware.com/programlistsparc10.html#syslogng If anyone has any ideas, please let me know. Thank you very much, --Mike

4 6

client -> server logging.. filters?
by Matt Wise 08 Apr '11

08 Apr '11

I'm doing some logging from clients -> servers via syslog-ng over a TCP session with stunnel. On my client, I'm seeing some log messages come in that are not making it to the server.. reliably. I don't have any filtering setup I don't think — is there some default setting somewhere that I don't know about that only passes certain types of messages to the remote dest? Do I need to specify somewhere 'send all'? Whats quite strange is that I have the hosts logging to 2 systems right now.. old syslog-ng server, and new one. The old one is getting all of the messages, but the new one is ignoring messages like these: Apr 8 18:21:43 xxx stunnel: LOG5[5459:1079724352]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket It seems to get all other messages.. but messages that have that LOG5 or LOG3 or LOG7 appended to them seem to get lost in translation... any ideas? —Matt

2 2

Using macro substring as another macro
by Jakub Jankowski 08 Apr '11

08 Apr '11

Hi, I'd like to implement simple hashing in file() destination, mainly to avoid ext3 32k directories limit, but also for convenience. Is it possible to do something simliar what this shell snippet does: $ NAME=value $ echo ${NAME[*]:0:1} v $ but for macros (especially those coming from parsers)? What I want is logs written to /var/log/h/ho/hos/hostname/service.log (with configurable level of subdirs) using a single destination(). Regards, -- Jakub Jankowski|shasta@toxcorp.com|http://toxcorp.com/ GPG: FCBF F03D 9ADB B768 8B92 BB52 0341 9037 A875 942D

3 6