- syslog-ng - lists.balabit.hu

Syslogs from Router
by Christopher Petsch 18 Jan '11

18 Jan '11

I am trying to get my router (Netgear FVS338) to send syslogs to my computer but I cant seem to get it configured correctly. Ive googled for the past three days and come up short with little to no help and what little i did find i kept getting syntax errors for. I know I'm doing something wrong but I don't know what. If I could get some help on this or be pointed in a better direction it would be most appricated. Thank you in advance. -- Sincerely, Chris KeyID: 0x348DC808 Keyserver: pool.sks-keyservers.net

5 9

Performance of syslog-ng for Database access (mysql)
by Yu Watanabe 18 Jan '11

18 Jan '11

Hello all. I would like to ask question for the performance of syslog-ng when it is accessing to mysql database. I am using syslog-ng 3.0.9 and thinking of using either one of the method below for the database connection. 1. Using the program driver and fork the "mysql command" to execute the sql. 2. Use the sql driver to access to the table I was wondering which is more efficient for syslog-ng and the server itself (i.e. CPU , memory ) Any advice would be helpful! Thanks, Yu Watanabe

3 6

MongoDB destination driver
by Gergely Nagy 16 Jan '11

16 Jan '11

Greetings! I was contemplating switching one of the websites I maintain from postgresql to one of these document store things, and while wondering about how to evaluate the options best, I stumbled into a short article on the MongoDB website: http://blog.mongodb.org/post/172254834/mongodb-is-fantastic-for-logging, which promptly led me to start pondering about how hard - or easy, as it turns out - would it be to write a MongoDB destination driver for syslog-ng? Only four hours later, I can present you the mongodb destination driver, available from my git repo (note the -b option, it is important): $ git clone -b algernon/dest/mongodb git://git.madhouse-project.org/syslog-ng/syslog-ng-3.2.git Of course, one can browse the sources on the web too: http://git.madhouse-project.org/syslog-ng/syslog-ng-3.2/tree/modules/afmong… It is using the MongoDB C client library (http://www.mongodb.org/display/DOCS/C+Language+Center) - I simply embedded the sources for now, lacking a better option. Once compiled, one can already begin using it with the default options: destination d_mongodb { mongodb(); }; This will try to connect to localhost:27017, and use the logs collection in the syslog-ng database, and will log all the standard fields. Of course, all of those are configurable! To demonstrate all the - currently - available options, the destination definition above is the same as the following: destination d_mongodb { mongodb( host("localhost") port(27017) database("syslog-ng") collection("logs") keys("date", "facility", "level", "host", "program", "pid", "message") values("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "$FACILITY", "$LEVEL", "$HOST", "$PROGRAM", "$PID", "$MSGONLY") ); }; A few things, like authentication and some template options are not configurable yet, partly because I didn't figure out what they're good for, or how they work. But I will get there at some point, especially if there's interest in said features. All in all, I'm very happy that I could cook up a fairly simple destination driver within a few hours, having no prior experience writing one. The syslog-ng code is amazing, by the way, it was a breeze to navigate through and find the stuff I needed to make this driver work. Mind you, this is very new code, and I haven't tested it extensively, but I do have some great plans involving syslog-ng and mongodb >;) Hope you like the code, and perhaps find it useful! -- |8]

6 38

syslog-ng 3.2.2 has been released
by devel＠balabit.hu 16 Jan '11

16 Jan '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.2.2 SUMMARY : new stable release DATE : Jan 16, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.2.2) has been released. For latest fixes in the 3.2.x feature branch you are recommended to upgrade to this version. CHANGES: 3.2.2 Sat, 15 Jan 2011 13:50:35 +0100 Bugfixes: * Fixed a possible segmentation fault when the port number is changed for a TCP source, the configuration is reloaded and there were open connections for the old port, which send messages after the SIGHUP. This behaviour has been broken since 3.0.1. * Fixed a possible security issue on FreeBSD and on platforms where mode_t is an unsigned 16 bit value. On these platforms syslog-ng may be using 0xFFFF as the permission bits causing log files to be world readable/writable/executable/setuid. * Fixed leaking the contents of internal() messages (such as MARK or the statistics message). * Fixed current time tracking when calculating the time in the correllation engine. * When the patterndb file got reloaded the correllation state was dropped. This behaviour was fixed. * Really ignore invalid persist-state files, which caused syslog-ng startup to fail previously. * Added the missing support for blocks inside log {} statements. * Fixed a configuration init error when the same db-parser() instance is referenced from multiple log paths. * Fixed handling the port() options for SQL destinations. Platform specific: * Added cygwin support to the system() source. Build related: * syslog-ng modules are now linked with "-module -no-undefined" parameters, pdbtool and unit tests are using -dlpreopen when explicitly linking against such modules. * The core patterndb functionality got split off to a separate library installed to $libdir to make it easier to be used by pdbtool. * Fixed support for an explicit --exec-prefix configure parameter. Earlier if exec_prefix was different from prefix, the installation layout produced unworkable binaries. * If no OpenSSL libraries are available, pdbtool patternize still can work, although in this case proper UUID generation is not possible. * If syslog-ng is compiled against an old glib (earlier than 2.13), it'll not use an API that is present in newer ones. Please note however that there might be other similar compatibility issues with old Glib versions. * Updated cygwin packaging files. * Don't use -wno-pointer-sign in dbparser if gcc doesn't support it. This will emit a lot of warnings, but still make the code possible to compile with older gcc versions. Credits: syslog-ng is developed as a community project. All changes and improvements requires effort, and this effort is really appreciated. Writing code, testing changes or simply providing use-cases and information on one's setup will make syslog-ng better. Here are the people, listed in no specific order who made this release possible. * Balázs Németh (BalaBit) * Sándor Gellér (Morgan Stanley) * Péter Czanik (BalaBit) * Owen Mann (Interactive Data) * Zhengxiang Pan (Alcatel Lucent) * Corinna Vinschen (RedHat) * Eric Berggren (Apple) * Gergely Nagy (BalaBit) * Matthew Hall * LEBRETON Philippe * Craig Bell * Steven Chamberlain * Balázs Scheidler (BalaBit) Thanks for their efforts, it is appreciated. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

[Bug 103] New: Refresh of files in contrib/cygwin-packaging
by bugzilla＠bugzilla.balabit.com 14 Jan '11

14 Jan '11

https://bugzilla.balabit.com/show_bug.cgi?id=103 Summary: Refresh of files in contrib/cygwin-packaging Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Other Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: vinschen(a)redhat.com Type of the Report: --- Estimated Hours: 0.0 Created an attachment (id=29) --> (https://bugzilla.balabit.com/attachment.cgi?id=29) changes to contrib/cygwin-packaging files Hi, the latest version of syslog-ng requires a couple of changes to the files in contrib/cygwin-packaging. I've attached a patch consisting of the changes to the existing files as well as a new file contrib/cygwin-packaging/syslog-ng.sh Please make sure the new file has execute permissions by default. Thanks, Corinna -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 6

syslog-ng 3.0.10 has been released
by devel＠balabit.hu 14 Jan '11

14 Jan '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.0.10 SUMMARY : new stable release DATE : Jan 14, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.0.10) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.10 Sun, 02 Jan 2011 12:43:46 +0100 Bugfixes: * Fixed handling the port() options for SQL destinations. * Fixed a possible segmentation fault when the port number is changed for a TCP source, the configuration is reloaded and there were open connections for the old port, which send messages after the SIGHUP. This behaviour has been broken since 3.0.1. * The configure script has been changed to properly honour the value of ${exec_prefix} in case the env wrapper is enabled (--enable-env-wrapper). Configurations not using the env wrapper or using the same value for exec_prefix & prefix should not be affected. * Fixed a possible security issue on Debian/kFreeBSD and on platforms where mode_t is an unsigned 16 bit value. On these platforms syslog-ng may be using 0xFFFF as the permission bits. Credits: Philippe LEBRETON, Zhengxiang Pan, Matthew Hall and Steven Chamberlain for reporting the bugs fixed in this release. Patches were authored by by Attila Nagy (BalaBit) and Balazs Scheidler (BalaBit). DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system…

1 0

syslog-ng 3.1.4 has been released
by devel＠balabit.hu 14 Jan '11

14 Jan '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.1.4 SUMMARY : new stable release DATE : Jan 14, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.1.4) has been released. For latest fixes in the 3.1.x feature branch you are recommended to upgrade to this version. CHANGES: 3.1.4 Sun, 02 Jan 2011 13:06:13 +0100 Bugfixes: * Fixed hostname resolution in case normalize_hostnames() is enabled. In this case syslog-ng didn't properly NUL terminate the string causing binary characters to be emitted in log messages. * Fixed a possible security issue on FreeBSD and on platforms where mode_t is an unsigned 16 bit value. On these platforms syslog-ng may be using 0xFFFF as the permission bits causing log files to be world readable/writable/executable/setuid. * Fixed handling the port() options for SQL destinations. * Fixed a possible segmentation fault when the port number is changed for a TCP source, the configuration is reloaded and there were open connections for the old port, which send messages after the SIGHUP. This behaviour has been broken since 3.0.1. * The configure script has been changed to properly honour the value of ${exec_prefix} in case the env wrapper is enabled (--enable-env-wrapper). Configurations not using the env wrapper or using the same value for exec_prefix & prefix should not be affected. Other Changes: * Added explicit patterndb version check, in order to inform the user that a patterndb file is meant to be used by a newer syslog-ng version. * Increase YYMAXDEPTH value to make it possible to process larger configuration files. * Clarified the message on the deprecated use of use_time_recvd() Credits: Paul Krizak, Mukarram Syed, Philippe LEBRETON, Zhengxiang Pan, Matthew Hall, Craig Bell, Gergely Nagy, Laszlo Boszormenyi, Peter Czanik and Steven Chamberlain for reporting the bugs fixed in this release. Patches were authored by by Attila Nagy (BalaBit) and Balazs Scheidler (BalaBit). DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

Tailing a file
by maillists0＠gmail.com 14 Jan '11

14 Jan '11

I need to tail a bunch of application logs that aren't in syslog format and send them to a remote server. I've configured this: source s_tail { file(/var/log/chaotic_debug_log follow_freq(1) flags(no-parse)); }; destination remote { tcp("my_syslogserver.com" port(514)); }; log { source(s_tail); destination(remote); }; syslog-ng starts successfully and doesn't complain, but nothing happens... no logs appear remotely. I did a tcpdump on the syslog server and nothing is showing up from this box, so I did an strace on syslog-ng and didn't see the log files being opened. Running lsof on those files didn't show anything but the writing program. syslog-ng just isn't reading the files. Is something wrong with my config? How might I troubleshoot this? The syslog-ng version is 2.1.4 on CentOS 5.4. Also, to have syslog tail multiple files, do I just add multiple entries, like this? source s_tail { file(/var/log/chaotic_debug_log1 follow_freq(1) flags(no-parse)); }; source s_tail { file(/var/log/chaotic_debug_log2 follow_freq(1) flags(no-parse)); }; source s_tail { file(/var/log/chaotic_debug_log3 follow_freq(1) flags(no-parse)); }; Any help is appreciated. Thanks!

2 2

ld.so.1 problem during upgrade to 3.1.2
by Zeek Anow 14 Jan '11

14 Jan '11

I just upgraded to syslog-ng Solaris 10 on a Sun server. When I went to test my syslog-ng.conf file I am getting the following error: ld.so.1: syslog-ng: fatal: relocation error: file /.alt.Solaris10/usr/local/sbin/syslog-ng: symbol g_malloc_n: referenced symbol not found It looks as though something is missing from a library or maybe a path is not set correctly. Here are the packages I installed: libiconv-1.13.1-sol10-sparc-local glib-2.25.13-sol10-sparc-local libintl-3.4.0-sol10-sparc-local libgcc-3.4.6-sol10-sparc-local pcre-8.10-sol10-sparc-local eventlog-0.2.12-sol10-sparc-local libpcap-1.1.1-sol10-sparc-local tcpdump-4.1.1-sol10-sparc-local syslogng-3.1.2-sol10-sparc-local I had originally installed gcc-3.4.6-sol10-sparc-local too, but then uninstalled all packages and then reinstalled everything except gcc-3.4.6-sol10-sparc-local. The instructions says one or the other. Anyone have any ideas on how to fix this? Thanks

4 7

Syslog-ng/Rsyslog "message" differences (?)
by Champ Clark III [Softwink] 14 Jan '11

14 Jan '11

Hello all! I've got a bit of a strange problem. I've been developing software (Shameless plug: http://sagan.softwink.com) that does log analysis. This software is mostly used with Syslog-ng and Rsyslog. We recently started testing some log normalization, and I'm seeing different results from syslog-ng's $MSG string and rsyslog %msg%. For example: template("$MSG\n") template-escape(no)); }; --------------- Syslog-ng: template("$MSG\n") template-escape(no)); }; Output: sshd[20657]: Invalid user champtest from 66.177.167.194 --------------- Rsyslog: $template sagan, "%msg%\n" Output: Invalid user champtest from 66.177.167.194 --------------- Whitespacing aside, with syslog-ng I get the program information within the message field. I should point out that most of the systems in the network are Syslog-ng and reporting to Rsyslog (which I can switch out with Syslog-ng for testing). I guess my questions are: 1. Does this sound like a Syslog-ng/Rsyslog interoperability issue? 2. Or do the two just see the "message" formats differently? 3. Maybe it's just my setup (syslog-ng/rsyslog versions)? I have a "work around" with Rsyslog, but was wondering if there where any thoughts on this issue? Thanks -- Champ Clark III | Softwink, Inc | 800-538-9357 x 101 http://www.softwink.com GPG Key ID: 58A2A58F Key fingerprint = 7734 2A1C 007D 581E BDF7 6AD5 0F1F 655F 58A2 A58F If it wasn't for C, we'd be using BASI, PASAL and OBOL.

3 5