- syslog-ng - lists.balabit.hu

[Bug 73] sql driver does not: perform commits, doesnt support session start statements, mangles table names
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=73 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED --- Comment #2 from Balazs Scheidler <bazsi(a)balabit.hu> 2010-04-12 22:21:52 --- Hi, Just as stated on the mailing list, I've integrated your work into the 3.2 branch of syslog-ng, but I've some comments, please see inline: (In reply to comment #0) > Created an attachment (id=18) --> (https://bugzilla.balabit.com/attachment.cgi?id=18) [details] > fixes > > The main problem: When using the sql driver to output entries straight to a database, commits are not performed, so the data isnt visible outside the session > used by syslog-ng. > This was experienced when using the oracle driver of libdbi-drivers. You might be using an older version of libdbi, in my version, the Oracle driver automatically commits after every query using OCI_COMMIT_ON_SUCCESS parameter: status = OCIStmtExecute(Oconn->svc, stmt, Oconn->err, (ub4) (stmttype == OCI_STMT_SELECT ? 0 : 1), (ub4) 0, (CONST OCISnapshot *) NULL, (OCISnapshot *) NULL, stmttype == OCI_STMT_SELECT ? MY_OCI_STMT_SCROLLABLE_READONLY : OCI_COMMIT_ON_SUCCESS); But anyway, your patches are now integrated, but COMMITs need to be explicitly requested by the flags("explicit-commits") option to the SQL driver. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 79] internal statistics log can not be forwarded to syslog server.
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=79 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO --- Comment #1 from Balazs Scheidler <bazsi(a)balabit.hu> 2010-04-12 22:17:58 --- I can't see how that '!' could be added to a message and split, no such thing is performed using syslog-ng. Although while trying to verify this issue, I've found a problem: * syslog-ng 3.1 & 3.2 (the ones with the NVtable refactorization) cannot hold more than 64k in an NV pair Thus $MSG cannot be longer than 64k and the worst of it was, that it got truncated not at 64k, but at the lowest 16 bits of the length. I've fixed this in 3.2 now. However I couldn't find how syslog-ng could do what you describe. Can you elaborate? Thanks. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

syslog-ng 3.0.6 has been released
by devel＠balabit.hu 12 Apr '10

12 Apr '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.0.6 SUMMARY : new stable release DATE : Apr 11, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.0.6) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.6 Sun, 11 Apr 2010 10:35:46 +0200 Bugfixes: * Fixed a boundary checking error on the usertty() destination, which can cause a local buffer to be overflown if the wtmp file on the system contains more than 123 characters in its ut_line member. It is not believed to be exploitable on the following platforms: Linux (32 chars) Solaris (12 chars) AIX (64 chars) HP-UX (12 chars) FreeBSD (8 chars) OpenBSD (8 chars) * Fixed a possible loss of the last partial message in the TCP and TLS transports of the syslog() driver. * Fixed empty line handling in the syslog() driver. The parser now accepts empty lines (which it didn't, but should have) and empty lines have the required trailing space which it didn't previously. * Fixed SDATA value lookup in case the the SD-ID contains dots. * Added escaping support to the structured-data parser. * Fixed an off-by-one bug in the structured data parser. * Fixed a possible segmentation fault after initializing the configuration when using unix-stream() and unix-dgram() destinations. * Fixed the Solaris 10 SMF script to handle "refresh" calls. * Fixed the Solaris 10 SMF script to handle an existing PID file without syslog-ng running with that pid. * Fixed the Solaris init/SMF scripts to avoid ugly error messages if the dump device doesn't exist. This situation can easily happen in a chroot or a zone. * Fixed a 100% CPU usage if the pipe() driver is applied to a regular file, or a file() driver on a named pipe. * Fixed a daylight saving problem in the transition window when receiving a BSD timestamp. * syslog-ng CSV format statistics (reachable via the syslog-ng.ctl socket) is now properly escaped. Other changes: * Fixed a linking problem with the MacOSX linker. * Added automatic test coverage for RFC5424 protocol format. * The SQL driver will drop a message after 3 failed attempts to insert it into the database. * If a character set conversion problem occurs on a connection, syslog-ng will drop the connection instead of trying to read further. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system…

1 0

syslog-ng 3.1.1 has been released
by devel＠balabit.hu 12 Apr '10

12 Apr '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.1.1 SUMMARY : new stable release DATE : Apr 11, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.1.1) has been released. For latest fixes in the 3.1.x feature branch you are recommended to upgrade to this version. CHANGES: 3.1.1 Sun, 11 Apr 2010 10:26:57 +0200 Bugfixes: * Solaris 10 SMF script now checks if the pid file refers to an actual instance of syslog-ng to make sure that syslog-ng is started even after a system crash. * The System V init script used on Solaris 8/9 gave ugly error messages if the dump device doesn't exist (which happens in a chroot/zone environment), this was fixed. * Fixed a 100% CPU usage if the configuration file uses the pipe driver on a regular file or a file driver on a named pipe. * Fixed a daylight saving problem in the transition window when receiving a BSD timestamp. * syslog-ng CSV format statistics (reachable via syslog-ng-ctl) is now properly escaped. Other changes: * Added "TAGS" macro which expands to a list of comma separated message tags. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

match/program granularity
by Alex 12 Apr '10

12 Apr '10

Hi, I'm using an older version of syslog-ng for now, until I can upgrade to post-3.0, but for the time-being I'd like to be able to use the match() and program() qualifiers to redirect output from bind to a specific file, from the local host as well as from remote hosts using local3.info. Where can I find the documentation that describes the differences in usage for match() and program()? In the following line, what is considered "program" and what is considered "match"? How does this change if the line is from a remote host? Apr 10 17:16:15 smtp01 postfix/cleanup[23834]: 1F3BBE74004: message-id=<20103410231614.1F3BBE74004(a)smtp01.myhost.com> Can I match on hostname? Are there other parameters that might be helpful in classifying this information? Thanks, Alex

2 3

commit with the oracle sql driver
by Patrick H. 10 Apr '10

10 Apr '10

So, extensive googling has failed me on this. I'm using the sql driver to output to an oracle database, with debugging mode, I can see that the insert queries are indeed being executed, however my tables remain empty. I've been through the source code, and it doesnt look like a commit is being performed anywhere. Though my google efforts, I did find one reference where someone patched the libdbi-drivers oracle driver to do a commit on success after every query, but that is insanely expensive (and ugly). I have started modifying the code to add the flush_lines and flush_timeout option to the sql driver. But before I got too carried away, I was wondering why this is the way it is the way it is, or if I'm missing something.

3 5

URL for open source and premium version comparison
by Clayton Dukes 06 Apr '10

06 Apr '10

Hey folks, Someone from work asked me why they should pay for the Premium edition as opposed to using the OSE. I thought I would just point him to a URL the compares the two, but can't seem to locate it. Is it out there? -- ______________________________________________________________ Clayton Dukes ______________________________________________________________

2 2

syslog-ng 3.0.4 not adjusting for daylight savings time
by Chris Fabri 05 Apr '10

05 Apr '10

I have a red hat 3 system running 3.0.4 It did not successfully adjust for daylight savings time. Everything else on the system is fine - syslog is showing the correct time stamps, the system reports the correct time. Restart of syslog-ng, and shutting down both syslog and syslog-ng did not help. I didn't see anything in the lists addressing this, here are details of my syslog-ng: [fabric@netlog dhcp]$ sudo /usr/local/sbin/syslog-ng -V syslog-ng 3.0.4 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.0#master#1b5d618e301ad94aa20e692ffba16469dece8d10 Compile-Date: Aug 24 2009 16:54:31 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: on Enable-SSL: off Enable-SQL: off Enable-Linux-Caps: on Enable-Pcre: off I didn't see anything in the man page for adjusting for time. I have keep_timestamp(no) configured in my conf file. The systems sending the syslog files time is correctly adjusted for daylight savings. Is this a bug in this particular version, or am I just missing the right flag or something? chris

3 13

try tcp destination but fail quickly if unavailable
by Jan Schaumann 05 Apr '10

05 Apr '10

Hello, I have a tcp destination that, unfortunately, may occasionally become unavailable. When that happens, I believe that the system will try to retransmit the messages and/or re-establish the connection (time_reopen), but either way, messages will accumulate. Is there a way to tell syslog-ng "try this destination, but if it can't be delivered within <time>, drop the message / skip the destination" ? -Jan

2 1

Change the facility or the priority of a syslog message ?
by Ilas, Yann 05 Apr '10

05 Apr '10

Hello, I'm using the syslog-ng application version 3.1.0. I would like to change the severity and/or the facility of an event. Here is the configuration for this test : template t_format { template ("$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC;$HOST;$FACILITY;$PRIORITY;$PROGRAM;$MSG\n"); }; source s_local_test { unix-stream("/dev/log"); }; destination d_test { file ( "/tmp/test" template (t_format) ); }; rewrite r_rewrite_set { set ( "my_program" value("PROGRAM") ); }; log { source (s_local_test); rewrite (r_rewrite_set); destination (d_test); }; I generated a message by using "logger" : # logger -i -p local0.info "Test Message : ABCDEFGHIJKLMNOPQRST ## $(date) ##" => /tmp/test: 2010-04-01 15:12:14;pc-dev.dom;local0;info;MY_PROGRAM;Test Message : ABCDEFGHIJKLMNOPQRST ## jeu avr 1 15:12:14 CEST 2010 ## Ok, I can change the PROGRAM name... :-) ...So I changed the rule "r_rewrite_set" to modify the value to "facility" : rewrite r_rewrite_set { set ( "local4" value("FACILITY") ); }; And when I restarted the syslog-ng, I had the following errors : # /etc/init.d/syslog-ng restart Macros are read-only, they cannot be changed in rewrite rules, falling back to MESSAGE instead; macro='FACILITY' Restarting syslog-ng: Stopping syslog-ng: [ OK ] Starting syslog-ng: Macros are read-only, they cannot be changed in rewrite rules, falling back to MESSAGE instead; macro='FACILITY' [ OK ] I have the same error when I changed the "PRIORITY" of the rule "r_rewrite_set" : > Macros are read-only, they cannot be changed in rewrite rules, falling back to MESSAGE instead; macro='PRIORITY' I tried to send a message by using "logger" but as it written in the above error, the MESSAGE was changed... :-( My questions are : 1. Which macros are read-only ? PRIORITY, FACILITY, another ? 2. Is there a way to change the facility or the priority of an event ? 3. If not, why can't I change the facility or the priority ? Regards, Yann

2 1