- syslog-ng - lists.balabit.hu

Syslog-ng/Rsyslog "message" differences (?)
by Champ Clark III [Softwink] 14 Jan '11

14 Jan '11

Hello all! I've got a bit of a strange problem. I've been developing software (Shameless plug: http://sagan.softwink.com) that does log analysis. This software is mostly used with Syslog-ng and Rsyslog. We recently started testing some log normalization, and I'm seeing different results from syslog-ng's $MSG string and rsyslog %msg%. For example: template("$MSG\n") template-escape(no)); }; --------------- Syslog-ng: template("$MSG\n") template-escape(no)); }; Output: sshd[20657]: Invalid user champtest from 66.177.167.194 --------------- Rsyslog: $template sagan, "%msg%\n" Output: Invalid user champtest from 66.177.167.194 --------------- Whitespacing aside, with syslog-ng I get the program information within the message field. I should point out that most of the systems in the network are Syslog-ng and reporting to Rsyslog (which I can switch out with Syslog-ng for testing). I guess my questions are: 1. Does this sound like a Syslog-ng/Rsyslog interoperability issue? 2. Or do the two just see the "message" formats differently? 3. Maybe it's just my setup (syslog-ng/rsyslog versions)? I have a "work around" with Rsyslog, but was wondering if there where any thoughts on this issue? Thanks -- Champ Clark III | Softwink, Inc | 800-538-9357 x 101 http://www.softwink.com GPG Key ID: 58A2A58F Key fingerprint = 7734 2A1C 007D 581E BDF7 6AD5 0F1F 655F 58A2 A58F If it wasn't for C, we'd be using BASI, PASAL and OBOL.

3 5

Issues while using Syslog destination driver
by Amit Khare 13 Jan '11

13 Jan '11

Hi, I am getting a weird issues while using the syslog destination driver. I am sending an xml message to syslog (syslog-ng 3.1) and forwarding the message over to another destination. The relevant entries in my syslog.conf look as following: filter f_atna { facility(local7); }; destination d_loghost { syslog("19.16.2.9" transport("tcp") port(6514) template("$MESSAGE")); }; log { source(src); filter(f_atna); destination(d_loghost); }; The problem I am running into is that the xml message is not getting processed on the other side because I am getting some weird characters are getting added in the xml message: <?xml - - - version="1.0" encoding="UTF-8"?> The above xml tag is constant in my program and therefore I am not inserting it and I don't even see it in /var/log/localmessages Dec 28 11:01:07 10.15.1.1 <?xml version="1.0" encoding="UTF-8"?> but when I do see it in my tcpdump I do see it. I am not seeing these weird dashes when I use the tcp destination driver but the message is not in the required format so it blows up on the other side. Has anyone seen this issue before? Any help will be greatly appreciated. Thanks, Amit

2 1

Broken Debug Behavior in libdbi
by Matthew Hall 13 Jan '11

13 Jan '11

Hello, Sorry about the cross-post, this came up in the interaction of two different pieces of software used together. libdbi's configure.in and other files contain some broken code which is preventing me from debugging a segfault in dbi_initialize when this function is called by syslog-ng. 1) The code is stripping the libraries of debug symbols when 'make install' is called which violates the GNU coding standards. To fix this, I want to disable library stripping that it is doing which is not in line with the standards and would appreciate advice on how to do this. 2) I could work around it using the make debug target, but then the could would ignore my CFLAGS which are: -m32 -g -I /home/y/include Ignoring these causes it to try to generate a 64-bit library which won't be compatible with the syslog-ng binary I want to build. To fix this, I want to make sure that the DEBUG target is not ignoring or overriding the 'upstream' user flags, but merely adding to them, so that my '-m32' and my '-I' are not lost, which causes build breakage for me, and my '-g' gets duplicated. 3) To work around these problems for now I'm going to patch configure.in and rerun autoconf unless there is an alternative proposal. Thanks, Matthew Hall. Here is the problematic flag setup being done in configure.in: if test -z "$GCC"; then case $host in *-*-irix*) if test -z "$CC"; then CC=cc fi DEBUG="-g -signed" CFLAGS="-O2 -w -signed" PROFILE="-p -g3 -O2 -signed" ;; sparc-sun-solaris*) DEBUG="-v -g" CFLAGS="-xO4 -fast -w -fsimple -native -xcg92" PROFILE="-v -xpg -g -xO4 -fast -native -fsimple -xcg92 -Dsuncc" ;; *) DEBUG="-g" CFLAGS="-O" PROFILE="-g -p" ;; esac else case $host in *-*-linux*) DEBUG="-g -Wall -D_REENTRANT -D__NO_MATH_INLINES -fsigned-char -std=gnu99" CFLAGS="-O20 -ffast-math -D_REENTRANT -fsigned-char -std=gnu99" PROFILE="-pg -g -O20 -ffast-math -D_REENTRANT -fsigned-char -std=gnu99";; sparc-sun-*) DEBUG="-g -Wall -D__NO_MATH_INLINES -fsigned-char -mv8 -std=gnu99" CFLAGS="-O20 -ffast-math -D__NO_MATH_INLINES -fsigned-char -mv8 -std=gnu99" PROFILE="-pg -g -O20 -D__NO_MATH_INLINES -fsigned-char -mv8 -std=gnu99" ;; *) DEBUG="-g -Wall -D__NO_MATH_INLINES -fsigned-char -std=gnu99" CFLAGS="-O20 -D__NO_MATH_INLINES -fsigned-char -std=gnu99" PROFILE="-O20 -g -pg -D__NO_MATH_INLINES -fsigned-char -std=gnu99" ;; esac fi

2 3

Authentication problem
by Fabien Bagard 13 Jan '11

13 Jan '11

Hi all, I am trying to set up a centralized syslog server, with encryption and authentication over TCP. Communication is ok, encryption too, but I can't get the authentication to work. Here is my actual configuration, reduced to what is needed : _Client :_ source s_src { unix-dgram("/dev/log"); internal(); file("/proc/kmsg" program_override("kernel")); }; ... destination d_net { tcp("192.168.0.42" port(4242) tls( ca_dir("/etc/rsyslog.d/certs/CA/") cert_file("/etc/rsyslog.d/certs/client.crt") key_file("/etc/rsyslog.d/certs/client.key") peer_verify(optional-untrusted) ) log_fifo_size(1000) ); }; ... log { source(s_src); destination(d_net); }; _Server :_ source s_src { # Local logging unix-dgram("/dev/log"); file("/proc/kmsg" program_override("kernel")); # Remote logging tcp( port(4242) tls( ca_dir("/etc/syslog-ng/certs/CA/") cert_file("/etc/syslog-ng/certs/server.crt") key_file("/etc/syslog-ng/certs/server.key") peer_verify(optional-untrusted) ) ); }; The CA which was used to sign these certificates is world readable and located in /etc/syslog-ng/certs/CA/ This setup works : server is getting client's logs, and cypherred on the wire. When I replace /peer_verify(optional-untrusted)/ by /peer_verify(required-trusted)/, in order to get mutual authentication, I get this error : ==> /var/log/error <== Jan 6 14:42:09 client syslog-ng[11086]: Certificate validation failed; subject='emailAddress=email(a)address.com, CN=server.fqdn, OU=Org Unit, O=Company, L=City, ST=Crountry, C=ID', issuer='emailAddress=email(a)address.com, CN=Root CA, OU=Org Unit, O=Company Root CA, L=City, ST=Country, C=ID', error='unable to get local issuer certificate', depth='0' Jan 6 14:42:09 client syslog-ng[11086]: SSL error while writing stream; tls_error='SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed' Jan 6 14:42:09 client syslog-ng[11086]: I/O error occurred while writing; fd='9', error='Broken pipe (32)' ==> /var/log/messages <== Jan 6 14:42:09 client syslog-ng[11086]: Syslog connection broken; fd='9', server='AF_INET(192.168.0.42:4242)', time_reopen='60' But my certificates are good : openssl verify -CAfile /etc/syslog-ng/certs/CA/ca.crt -purpose any /etc/syslog-ng/certs/client.crt /etc/syslog-ng/certs/client.crt: OK openssl verify -CAfile /etc/syslog-ng/certs/CA/ca.crt -purpose any /etc/syslog-ng/certs/server.crt /etc/syslog-ng/certs/server.crt: OK More informations : root@[client|server]:~ # syslog-ng -V syslog-ng 3.1.3 Installer-Version: 3.1.3 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.1#master#def34661b08109f8148904b860457d5747c425b3 Compile-Date: Nov 28 2010 12:29:35 Enable-Threads: on Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: on Enable-Linux-Caps: on Enable-Pcre: on Does someone has any clue on what's going wrong ? -- Fabien Bagard IT Department tel + 33 (0)1 48 03 60 40 -------------------------------------------------------------------------------- Parrot SA 174, Quai de Jemmapes | 75010 Paris - France tel + 33 (0)1 48 03 60 60 | fax + 33 (0)1 48 03 70 08 http://www.parrot.com -------------------------------------------------------------------------------- This e-mail message and any attached document(s) are for the sole use of the intended recipient(s)and may contain confidential and legally privileged information. Any unauthorized review, copy, use and/or disclosure is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original.

3 4

destination based on custom field question
by Christopher Barry 13 Jan '11

13 Jan '11

Greetings, I'm new to syslog-ng, and I'm trying to key off of a custom field in a log entry, and put the message in a particular directory named for the field. a sample log entry would look like this: Dec 16 14:08:51 u910-05 testapp: \ 00000000000000a7:00007f62d170a910:DEBUG :part.cpp : 183: \ | PartitionInfo [0x275f720] '\' denotes line continuation. The field I want to key off in this line is: 00000000000000a7 I created a filter to only get stuff from 'testapp', but now I want to make the destination be tied to the field. The field is positional, but can have any value, and cannot be known a priori. Not sure how to go about it. Any links to examples or where to start would be very much appreciated. -- Thanks, -Christopher

5 8

Re: [syslog-ng] syslog-ng 3.2.1 compile error
by Eric Berggren 13 Jan '11

13 Jan '11

> I'm trying to compile syslog-ng 3.2.1 on CentOS 5.3 which is running glib > 2.12.3-4, and get this error: > > ./.libs/libdbparser.so: undefined reference to `g_timeout_add_seconds' > collect2: ld returned 1 exit status > Using the older API is Bazsi's decision, but I have doubts about it's > feasibility. My recommendation is building a GLIB 2.14 and installing > it to an alternative directory and link to it(see below). If it doesn't > work, I recommend trying the pre-compiled OSE installers built by > BalaBit, which bring all their dependencies with them. You can download > them from > http://www.balabit.com/downloads/files?path=/syslog-ng/sources/3.2.1/setups For EL5 builds, I added the following to syslog-ng-3.2.1/modules/dbparser/dbparser.h : #define g_timeout_add_seconds(i,c,u) g_timeout_add(i*1000,c,u) Admittedly, I'm not particularly familiar with this and related functions, nor am I using the dbparser component, so haven't verified the behavior. Otherwise using it successfully with 2200 hosts shooting UDP at it . Curious what the implications are for this ... -eric

2 1

[Bug 105] New: syslog-ng --no-caps option causes segmentation fault if compiled with caps support in hardened gentoo
by bugzilla＠bugzilla.balabit.com 11 Jan '11

11 Jan '11

https://bugzilla.balabit.com/show_bug.cgi?id=105 Summary: syslog-ng --no-caps option causes segmentation fault if compiled with caps support in hardened gentoo Product: syslog-ng Version: unspecified Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: dk(a)i-zet.ru Type of the Report: bug Estimated Hours: 0.0 syslog-ng --no-caps option causes segmentation fault if compiled with caps support on gentoo hardened system This is from the build log: syslog-ng Open Source Edition 3.1.2 configured Compiler options: compiler : x86_64-pc-linux-gnu-gcc -std=gnu99 compiler options : -O2 -pipe -fforce-addr -mtune=nocona -march=nocona -Wall -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/usr/include/eventlog -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -Wl,-O1 -Wl,--as-needed prefix : /usr linking mode : dynamic Features: Sun STREAMS support : no Sun Door support : no Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : no spoof-source support : no tcp-wrapper support : yes SSL support : yes SQL support : no Linux capability support : yes PCRE support : yes Env wrapper support : no >>> Source configured. System parameters: # syslog-ng --version syslog-ng 3.1.2 Installer-Version: 3.1.2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.1#master#8bf13c304b6ab5fc1a372b49d55c78370efe14ca Compile-Date: Dec 15 2010 21:10:17 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: off Enable-Spoof-Source: off Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: on Enable-Pcre: on # # # uname -a Linux xxxxxx 2.6.32-hardened-r29 #1 SMP Fri Dec 3 14:08:35 MSK 2010 x86_64 Intel(R) Xeon(R) CPU X5450 @ 3.00GHz GenuineIntel GNU/Linux # # gcc -v Using built-in specs. Target: x86_64-pc-linux-gnu Configured with: /var/tmp/portage/sys-devel/gcc-4.4.4-r2/work/gcc-4.4.4/configure --prefix=/usr --bindir=/usr/x86_64-pc-linux-gnu/gcc-bin/4.4.4 --includedir=/usr/lib/gcc/x86_64-pc-linux-gnu/4.4.4/include --datadir=/usr/share/gcc-data/x86_64-pc-linux-gnu/4.4.4 --mandir=/usr/share/gcc-data/x86_64-pc-linux-gnu/4.4.4/man --infodir=/usr/share/gcc-data/x86_64-pc-linux-gnu/4.4.4/info --with-gxx-include-dir=/usr/lib/gcc/x86_64-pc-linux-gnu/4.4.4/include/g++-v4 --host=x86_64-pc-linux-gnu --build=x86_64-pc-linux-gnu --disable-altivec --disable-fixed-point --without-ppl --without-cloog --disable-nls --with-system-zlib --disable-werror --enable-secureplt --enable-multilib --enable-libmudflap --disable-libssp --enable-esp --enable-libgomp --with-python-dir=/share/gcc-data/x86_64-pc-linux-gnu/4.4.4/python --enable-checking=release --disable-libgcj --enable-languages=c,c++ --enable-shared --enable-threads=posix --enable-__cxa_atexit --enable-clocale=gnu --with-bugurl=http://bugs.gentoo.org/ --with-pkgversion='Gentoo Hardened 4.4.4-r2 p1.2, pie-0.4.5' Thread model: posix gcc version 4.4.4 (Gentoo Hardened 4.4.4-r2 p1.2, pie-0.4.5) # glibc - 2.11.2-r3 Example: $ $ /usr/sbin/syslog-ng -F -v -d --no-caps Segmentation fault $ $ strace /usr/sbin/syslog-ng -F -v -d --no-caps execve("/usr/sbin/syslog-ng", ["/usr/sbin/syslog-ng", "-F", "-v", "-d", "--no-caps"], [/* 33 vars */]) = 0 brk(0) = 0x3cdf13cf10 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0cc000 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat(3, {st_mode=S_IFREG|0644, st_size=51584, ...}) = 0 mmap(NULL, 51584, PROT_READ, MAP_PRIVATE, 3, 0) = 0x3752a0bf000 close(3) = 0 open("/usr/lib/libglib-2.0.so.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320{\1\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=981792, ...}) = 0 mmap(NULL, 3079320, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x37529bc2000 mprotect(0x37529cb0000, 2097152, PROT_NONE) = 0 mmap(0x37529eb0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xee000) = 0x37529eb0000 close(3) = 0 open("/usr/lib/libevtlog.so.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\31\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=18184, ...}) = 0 mmap(NULL, 2113664, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x375299bd000 mprotect(0x375299c1000, 2093056, PROT_NONE) = 0 mmap(0x37529bc0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x37529bc0000 close(3) = 0 open("/usr/lib/libssl.so.1.0.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0Pa\1\0\0\0\0\0"..., 832) = 832 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0be000 fstat(3, {st_mode=S_IFREG|0555, st_size=386928, ...}) = 0 mmap(NULL, 2482512, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x3752975e000 mprotect(0x375297b5000, 2093056, PROT_NONE) = 0 mmap(0x375299b4000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x56000) = 0x375299b4000 close(3) = 0 open("/usr/lib/libcrypto.so.1.0.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@U\6\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0555, st_size=1845904, ...}) = 0 mmap(NULL, 3956384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x37529398000 mprotect(0x37529538000, 2093056, PROT_NONE) = 0 mmap(0x37529737000, 147456, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x19f000) = 0x37529737000 mmap(0x3752975b000, 11936, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x3752975b000 close(3) = 0 open("/lib/libwrap.so.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@1\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=35552, ...}) = 0 mmap(NULL, 2132968, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x3752918f000 mprotect(0x37529197000, 2093056, PROT_NONE) = 0 mmap(0x37529396000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x7000) = 0x37529396000 close(3) = 0 open("/lib/libcap.so.2", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\26\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=18408, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0bd000 mmap(NULL, 2113856, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x37528f8a000 mprotect(0x37528f8e000, 2093056, PROT_NONE) = 0 mmap(0x3752918d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x3752918d000 close(3) = 0 open("/lib/libpcre.so.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\200\30\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=198368, ...}) = 0 mmap(NULL, 2293824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x37528d59000 mprotect(0x37528d89000, 2093056, PROT_NONE) = 0 mmap(0x37528f88000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2f000) = 0x37528f88000 close(3) = 0 open("/lib/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0~\354\1\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=1354792, ...}) = 0 mmap(NULL, 3463976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x37528a0b000 mprotect(0x37528b4f000, 2097152, PROT_NONE) = 0 mmap(0x37528d4f000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x144000) = 0x37528d4f000 mmap(0x37528d54000, 19240, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x37528d54000 close(3) = 0 open("/lib/libdl.so.2", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\r\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=14320, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0bc000 mmap(NULL, 2109600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x37528807000 mprotect(0x37528809000, 2097152, PROT_NONE) = 0 mmap(0x37528a09000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x37528a09000 close(3) = 0 open("/lib/libz.so.1", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p \0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=87936, ...}) = 0 mmap(NULL, 2183312, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x375285f1000 mprotect(0x37528606000, 2093056, PROT_NONE) = 0 mmap(0x37528805000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x14000) = 0x37528805000 close(3) = 0 open("/lib/libattr.so.1", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\25\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=22360, ...}) = 0 mmap(NULL, 2117664, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x375283eb000 mprotect(0x375283ef000, 2097152, PROT_NONE) = 0 mmap(0x375285ef000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4000) = 0x375285ef000 close(3) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0bb000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0ba000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3752a0b9000 arch_prctl(ARCH_SET_FS, 0x3752a0ba700) = 0 mprotect(0x375285ef000, 4096, PROT_READ) = 0 mprotect(0x37528805000, 4096, PROT_READ) = 0 mprotect(0x37528a09000, 4096, PROT_READ) = 0 mprotect(0x37528d4f000, 16384, PROT_READ) = 0 mprotect(0x37528f88000, 4096, PROT_READ) = 0 mprotect(0x3752918d000, 4096, PROT_READ) = 0 mprotect(0x37529396000, 4096, PROT_READ) = 0 mprotect(0x37529737000, 106496, PROT_READ) = 0 mprotect(0x375299b4000, 16384, PROT_READ) = 0 mprotect(0x37529bc0000, 4096, PROT_READ) = 0 mprotect(0x37529eb0000, 4096, PROT_READ) = 0 mprotect(0x3cdf136000, 8192, PROT_READ) = 0 mprotect(0x3752a0ce000, 4096, PROT_READ) = 0 munmap(0x3752a0bf000, 51584) = 0 brk(0) = 0x3cdf13cf10 brk(0x3cdf15df10) = 0x3cdf15df10 brk(0x3cdf15e000) = 0x3cdf15e000 setrlimit(RLIMIT_NOFILE, {rlim_cur=4*1024, rlim_max=4*1024}) = 0 setsid() = 13612 prctl(PR_SET_KEEPCAPS, 1) = 0 capget(0x20080522, 0, NULL) = -1 EFAULT (Bad address) --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ Segmentation fault $ It is quite possible, that it is hardened gentoo specific bug. I could not reproduce it on non-hardened system. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 92] New: Allow user to specify SSL/TLS cipher suite for connections
by bugzilla＠bugzilla.balabit.com 11 Jan '11

11 Jan '11

https://bugzilla.balabit.com/show_bug.cgi?id=92 Summary: Allow user to specify SSL/TLS cipher suite for connections Product: syslog-ng Version: 3.1.x Platform: PC OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: brett.edgar(a)truedigitalsecurity.com Type of the Report: enhancement Estimated Hours: 0.0 Created an attachment (id=22) --> (https://bugzilla.balabit.com/attachment.cgi?id=22) Patch to allow user to specify acceptable TLS cipher suites. Some compliance regimens (e.g., the PCI DSS) require SSL/TLS connections to disable weak (<128 bit key length) ciphers and old protocols like SSLv2. Syslog-ng already disables SSLv2 by default, but there is no way to disable the weak ciphers without modifying the source with every new release. I have developed a very small patch that adds a configuration file line with the tls { } stanza to specify which TLS ciphers can be used. Example: source tlssrc { tcp(ip(1.2.3.4) port(514) max-connections(32) tls( key_file("/etc/syslog-ng/server.key") cert_file("/etc/syslog-ng/server.crt") cipher_suite("ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:!SSLv2") peer_verify(optional-untrusted)) ); }; -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

syslog-ng 3.2.1 compile error
by Lutz Mutz 11 Jan '11

11 Jan '11

Hey everyone, I'm trying to compile syslog-ng 3.2.1 on CentOS 5.3 which is running glib 2.12.3-4, and get this error: ./.libs/libdbparser.so: undefined reference to `g_timeout_add_seconds' collect2: ld returned 1 exit status make[5]: *** [pdbtool] Error 1 make[5]: Leaving directory `/usr/local/src/syslog-ng-3.2.1/modules/dbparser' make[4]: *** [all-recursive] Error 1 make[4]: Leaving directory `/usr/local/src/syslog-ng-3.2.1/modules/dbparser' make[3]: *** [all] Error 2 make[3]: Leaving directory `/usr/local/src/syslog-ng-3.2.1/modules/dbparser' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng-3.2.1/modules' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/local/src/syslog-ng-3.2.1' make: *** [all] Error 2 As I understand g_timeout_add_seconds was added to glib 2.14, which CentOS doesn't support yet. Now my question is, there was a big filed a while ago about this, does balabit plan on implementing the old api for glib to support 3.2.1 for glib < 2.14 ? Knowing the fact that CentOS is such a popular and wide distribution, why not make it easy for us and patch it? Is my other choice to just compile it statically on a system running glib >= 2.14 and then install the binary on the CentOS system? Thanks, Lutz

2 1

Signed-off-by usage
by Balazs Scheidler 10 Jan '11

10 Jan '11

Hi, You probably know that starting with 3.2 the license for syslog-ng has changed and BalaBit has given up copyright assignment paperwork when accepting patches into the source tree. However I feel it very important to track who contributed what, and using the git "Author" field is just painful. So I'd like to start using a "standard" procedure what all the kernel folks use, more specifically the "signed-off-by" line added to each submitted patch. All it takes is to add a Signed-off-by: Random Developer <random(a)developer.org> after understanding the implications. The implications are documented in the kernel source tree (Documentation/SubmittingPatches), copied below for simplicity's sake. I hope this will make it easier for me to give credits where credits are due. :) I also updated the webpage on https://www.balabit.com/network-security/syslog-ng/opensource-logging-syste… For accumulated stuff, I may ask you to add a signed-off-by line for an already submitted patch, in this case, all I need is a reply, posted on the public mailing list, quoting the patch and adding a Signed-off-by line, that I can copy-paste into the commit message. Thanks. PS: I still need to read my backlog of syslog-ng messages that got accumulated during the winter holidays, but I haven't forgotten them, I just got distracted. ---- quoted SubmittingPatches file ---- 11) Sign your work To improve tracking of who did what, especially with patches that can percolate to their final resting place in the kernel through several layers of maintainers, we've introduced a "sign-off" procedure on patches that are being emailed around. The sign-off is a simple line at the end of the explanation for the patch, which certifies that you wrote it or otherwise have the right to pass it on as a open-source patch. The rules are pretty simple: if you can certify the below: Developer's Certificate of Origin 1.1 By making a contribution to this project, I certify that: (a) The contribution was created in whole or in part by me and I have the right to submit it under the open source license indicated in the file; or (b) The contribution is based upon previous work that, to the best of my knowledge, is covered under an appropriate open source license and I have the right under that license to submit that work with modifications, whether created in whole or in part by me, under the same open source license (unless I am permitted to submit under a different license), as indicated in the file; or (c) The contribution was provided directly to me by some other person who certified (a), (b) or (c) and I have not modified it. (d) I understand and agree that this project and the contribution are public and that a record of the contribution (including all personal information I submit with it, including my sign-off) is maintained indefinitely and may be redistributed consistent with this project or the open source license(s) involved. then you just add a line saying Signed-off-by: Random J Developer <random(a)developer.org> Some people also put extra tags at the end. They'll just be ignored for now, but you can do this to mark internal company procedures or just point out some special detail about the sign-off. -- Bazsi

1 0