- syslog-ng - lists.balabit.hu

syslog-ng-3.28.1
by Laszlo Budai 23 Jun '20

23 Jun '20

3.28.1 Highlights * http: add support for proxy option Example: log { source { system(); }; destination { http( url("SYSLOG_SERVER_IP:PORT") proxy("PROXY_IP:PORT") method("POST") ); }; }; (#3253<https://github.com/syslog-ng/syslog-ng/pull/3253>) Features * map: template function This template function applies a function to all elements of a list. For example: $(map $(+ 1 $_) 0,1,2) => 1,2,3. (#3301<https://github.com/syslog-ng/syslog-ng/pull/3301>) * use-syslogng-pid(): new option to all sources If set to yes, syslog-ng overwrites the message's ${PID} macro to its own PID. (#3323<https://github.com/syslog-ng/syslog-ng/pull/3323>) Bugfixes * affile: eliminate infinite loop in case of a spurious file path If the template evaluation of a log message will result to a spurious path in the file destination, syslog-ng refuses to create that file. However the problematic log message was left in the msg queue, so syslog-ng was trying to create that file again in time-reopen periods. >From now on syslog-ng will handle "permanent" file errors, and drop the relevant msg. (#3230<https://github.com/syslog-ng/syslog-ng/pull/3230>) * Fix minor memory leaks in error scenarios (#3265<https://github.com/syslog-ng/syslog-ng/pull/3265>) * crypto: fix hang on boot due to lack of entropy (#3271<https://github.com/syslog-ng/syslog-ng/pull/3271>) * Fix IPv4 UDP destinations on FreeBSD UDP-based destinations crashed when receiving the first message on FreeBSD due to a bug in destination IP extraction logic. (#3278<https://github.com/syslog-ng/syslog-ng/pull/3278>) * network sources: fix TLS connection closure RFC 5425 specifies that once the transport receiver gets close_notify from the transport sender, it MUST reply with a close_notify. The close_notify alert is now sent back correctly in case of TLS network sources. (#2811<https://github.com/syslog-ng/syslog-ng/pull/2811>) * disk-buffer: fixes possible crash, or fetching wrong value for logmsg nvpair (#3281<https://github.com/syslog-ng/syslog-ng/pull/3281>) * packaging/debian: fix mod-rdkafka Debian packaging (#3282<https://github.com/syslog-ng/syslog-ng/pull/3282>) * kafka destination: destination halts if consumer is down, and kafka's queue is filled (#3305<https://github.com/syslog-ng/syslog-ng/pull/3305>) * file-source: Throw error, when follow-freq() is set with a negative float number. (#3306<https://github.com/syslog-ng/syslog-ng/pull/3306>) * stats-freq: with high stats-freq syslog-ng emits stats immediately causing high memory and CPU usage (#3320<https://github.com/syslog-ng/syslog-ng/pull/3320>) * secure-logging: bug fixes (#3284<https://github.com/syslog-ng/syslog-ng/pull/3284>) * template arguments are now consistently checked * fixed errors when mac file not provided * fixed abort when derived key not provided * fixed crash with slogkey missing parameters * fixed secure-logging on 32-bit architectures * fixed CMake build Other changes * dbld: Fedora 32 support (#3315<https://github.com/syslog-ng/syslog-ng/pull/3315>) * dbld: Removed Ubuntu Eoan (#3313<https://github.com/syslog-ng/syslog-ng/pull/3313>) * secure-logging: improvements (#3284<https://github.com/syslog-ng/syslog-ng/pull/3284>) * removed 1500 message length limitation * slogimport has been renamed to slogencrypt * $(slog) will not start anymore when key is not found * internal messaging (warning, debug) improvements * improved memory handling and error information display * CMake build improvements * switched to GLib command line argument parsing * the output of slogkey -s is now parsable * manpage improvements Notes to developers * dbld: devshell is now upgraded to Ubuntu Focal (#3277<https://github.com/syslog-ng/syslog-ng/pull/3277>) * dbld/devshell: Multiple changes: * Added snmptrapd package. * Added support for both python2 and python3. (#3222<https://github.com/syslog-ng/syslog-ng/pull/3222>) * threaded-source: fully support default-priority() and default-facility() (#3304<https://github.com/syslog-ng/syslog-ng/pull/3304>) * CMake: fix libcap detection (#3294<https://github.com/syslog-ng/syslog-ng/pull/3294>) * Fix atomic_gssize_set() warning with new glib versions (#3286<https://github.com/syslog-ng/syslog-ng/pull/3286>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Airbus Commercial Aircraft, Andras Mitzki, Antal Nemes, Attila Szakacs, Balazs Scheidler, Gabor Nagy, Laszlo Budai, Laszlo Szemere, László Várady, Péter Kókai, Vatsal Sisodiya, Vivin Peris.

1 0

request for testing: logrotate scripts in Fedora/RHEL packages
by Peter Czanik (pczanik) 23 Jun '20

23 Jun '20

Hi, There were multiple tickets, bug reports about logrotate scripts in syslog-ng RPM packages for Fedora/RHEL. https://bugzilla.redhat.com/show_bug.cgi?id=1802165 https://github.com/syslog-ng/syslog-ng/issues/1384#issuecomment-644716350 I have now a possible solution available for testing in my git snapshot repo: https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng-githead/ * Installs the same logrotate script on RHEL/CentOS 7 as rsyslog * On RHEL/CentOS 8 and Fedora the logrotate script is called syslog-ng and uses systemctl to reload syslog-ng after rotation, just as the rsyslog variant. It is in a separate subpackage, and installed only when rsyslog is not on the system (for reasons check the RH bugzilla ticket: in short it would not be used anyway due to conflicts) I tested it on Fedora 32 and CentOS 7, both with and without rsyslog on the system. It worked fine for me, but any feedback is appreciated. If it is tested to work by someone else than me, I'll push the changes both to the official EPEL package and to the syslog-ng github repo. Bye, CzP Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

4 7

syslog-ng rpm java changes
by Secure-Logging, Generic 22 Jun '20

22 Jun '20

Hi Peter, apparently, I missed the poll. But I can assure you that we are not using Java in the syslog-ng version that are shipped to our customers. We are even building our own packages for syslog-ng on RHEL 7 to get rid of Java and Python. The systems we deliver have a minimal version of syslog-ng installed and the only extra module we currently use is the secure logging module. Regards, Stephan The information in this e-mail is confidential. The contents may not be disclosed or used by anyone other than the addressee. Access to this e-mail by anyone else is unauthorised. If you are not the intended recipient, please notify Airbus immediately and delete this e-mail. Airbus cannot accept any responsibility for the accuracy or completeness of this e-mail as it has been sent over public networks. If you have any concerns over the content of this message or its Accuracy or Integrity, please contact Airbus immediately. All outgoing e-mails from Airbus are checked using regularly updated virus scanning software but you should take whatever measures you deem to be appropriate to ensure that this message and any attachments are virus free.

1 0

syslog-ng rpm java changes
by Peter Czanik (pczanik) 22 Jun '20

22 Jun '20

Hi, Over a week ago I ran a Twitter poll and also asked around here on the mailing list about if/how you use Java in syslog-ng. No responses here and only a few "no" responses on Twitter. We know about some users, who use the Java bindings, but not our modules. Any previous users of Java modules I asked directly told me, that they already changed to kafka-c and elasticsearch-http. A few days later Fedora announced, that they are removing JDK 1.8 support from Rawhide. So, here is a list of changes and plans for the official distro syslog-ng packages and for my unofficial packages: * removed Java support completely from the official Fedora Rawhide package (no support for JDK 1.11 yet in syslog-ng), to avoid dropping syslog-ng from the distro * my unofficial packages will follow, once JDK 1.8 is really removed from the distro (end of July) * keep Java bindings everywhere else, as long as 1.8 is available * removed java modules (drivers) from all of my unofficial packages (Java-based Elasticsearch, Kafka, HDFS) My syslog-ng git snapshot packages (https://syslog-ng.com/blog/rpm-packages-from-syslog-ng-git-head/) already have these changes, and my 3.28 packages will be derived from these, once the release is available. Bye, Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Some logs written, some are not
by Jason Brown 16 Jun '20

16 Jun '20

I’m hoping someone can help here, because I’m at my wits end. System info: syslog-ng OSE 3.27 OS: CentOS 7.8 (though, I get similar results on Ubuntu 18.04) I have some kubernetes pods sending logs to a remote syslog-ng server. I have an issue where some logs are not being created. These are specifically received via TCP. I can see the message inbound by doing a packet capture, but nothing is written. One of the messages that stands out is: "Error processing message <-1>" Here is my scenario: Start a deployment with 3 pods: Pod1: log created on syslog-ng server: /data/2020/06/09/pod1/logs/app.log Pod2: nothing Pod3: nothing Delete and deploy again: Pod1: log created on syslog-ng server: /data/2020/06/09/pod1/logs/app.log Pod2: log created on syslog-ng server: /data/2020/06/09/pod2/logs/app.log Pod3: nothing Delete and deploy again: Pod1: nothing Pod2: nothing Pod3: nothing There seems to be no pattern. The pods that log, do so successfully. All pods should be logging the same exact date except for timestamps and the pod name. A packet capture shows healthy traffic inbound, with no errors, even from the pods that are not logging. The only indication of an issue is the trace log. Here’s an example from one of the non-writing pods, with a message id “0x7f2af8003800” : Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Initial message parsing follows; Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Setting value; name='PROGRAM', value='testlogger', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Setting value; name='LEGACY_MSGHDR', value='testlogger: ', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Setting value; name='HOST', value='testlogger-service-54956569bb-kqsjs', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Setting value; name='MESSAGE', value='2020-06-09 11:23:47,295 (main) INFO [c.b.s.r.s.TestLoggerServer] [trkId=] Server starting in Staging environment ', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Setting value; name='HOST_FROM', value='10.13.143.181', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Setting value; name='SOURCE', value='s_tcp_net_514', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Requesting flow control; location='/etc/syslog-ng/syslog-ng.conf:147:32' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: >>>>>> filter rule evaluation begin; rule='f_local7', location='/etc/syslog-ng/syslog-ng.conf:147:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: facility() evaluation started; fac='20', valid_fac='00800000', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: <<<<<< filter rule evaluation result; result='UNMATCHED - Dropping message from LogPipe', rule='f_local7', location='/etc/syslog-ng/syslog-ng.conf:147:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Requesting flow control; location='/etc/syslog-ng/syslog-ng.conf:146:32' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: >>>>>> filter rule evaluation begin; rule='f_local6', location='/etc/syslog-ng/syslog-ng.conf:146:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: facility() evaluation started; fac='20', valid_fac='00400000', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: <<<<<< filter rule evaluation result; result='UNMATCHED - Dropping message from LogPipe', rule='f_local6', location='/etc/syslog-ng/syslog-ng.conf:146:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Requesting flow control; location='/etc/syslog-ng/syslog-ng.conf:145:32' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: >>>>>> filter rule evaluation begin; rule='f_local5', location='/etc/syslog-ng/syslog-ng.conf:145:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: facility() evaluation started; fac='20', valid_fac='00200000', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: <<<<<< filter rule evaluation result; result='UNMATCHED - Dropping message from LogPipe', rule='f_local5', location='/etc/syslog-ng/syslog-ng.conf:145:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Requesting flow control; location='/etc/syslog-ng/syslog-ng.conf:142:32' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: >>>>>> filter rule evaluation begin; rule='f_local2', location='/etc/syslog-ng/syslog-ng.conf:142:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: facility() evaluation started; fac='20', valid_fac='00040000', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: <<<<<< filter rule evaluation result; result='UNMATCHED - Dropping message from LogPipe', rule='f_local2', location='/etc/syslog-ng/syslog-ng.conf:142:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Requesting flow control; location='/etc/syslog-ng/syslog-ng.conf:141:32' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: >>>>>> filter rule evaluation begin; rule='f_local1', location='/etc/syslog-ng/syslog-ng.conf:141:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: facility() evaluation started; fac='20', valid_fac='00020000', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: <<<<<< filter rule evaluation result; result='UNMATCHED - Dropping message from LogPipe', rule='f_local1', location='/etc/syslog-ng/syslog-ng.conf:141:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Requesting flow control; location='/etc/syslog-ng/syslog-ng.conf:144:32' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: >>>>>> filter rule evaluation begin; rule='f_local4', location='/etc/syslog-ng/syslog-ng.conf:144:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: facility() evaluation started; fac='20', valid_fac='00100000', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: severity() evaluation started; pri='6', valid_pri='000000ff', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: >>>>>> rewrite rule evaluation begin; rule='r_newlines', location='/etc/syslog-ng/syslog-ng.conf:186:5', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Message was cloned; original_msg='0x7f2af8003800', new_msg='0x7f2af8004830' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Performing subst() rewrite failed, pattern did not match; rule='r_newlines', value='MESSAGE', input='2020-06-09 11:23:47,295 (main) INFO [c.b.s.r.s.TestLoggerServer] [trkId=] Server starting in Staging environment ', type='(null)', pattern='u2028', replacement='\x0a', location='/etc/syslog-ng/syslog-ng.conf:186:5’ Further down in the log, I see: Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Initial message parsing follows; Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Setting value; name='HOST', value='', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Setting value; name='MESSAGE', value='Error processing log message: <-1>Jun 9 11:23:47 testlogger-service-54956569bb-2c5wl testlogger: 2020-06-09 11:23:47,341 (main) INFO [c.b.s.r.s.TestLoggerServer] [trkId=] Server starting in Staging environment \x0a\x0a<-1>Jun 9 11:23:47 testlogger-service-54956569bb-2c5wl testlogger: 2020-06-09 11:23:47,346 (main) INFO [c.b.s.r.s.TestLoggerServer] [trkId=] Test log message \x0a\x0a>@<', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Setting value; name='PROGRAM', value='syslog-ng', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Setting value; name='PID', value='28873', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Setting value; name='HOST_FROM', value='10.13.98.167', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Setting value; name='HOST', value='10.13.98.167/10.13.98.167', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Setting value; name='SOURCE', value='s_tcp_net_514', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Requesting flow control; location='/etc/syslog-ng/syslog-ng.conf:147:32' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: >>>>>> filter rule evaluation begin; rule='f_local7', location='/etc/syslog-ng/syslog-ng.conf:147:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: facility() evaluation started; fac='5', valid_fac='00800000', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: <<<<<< filter rule evaluation result; result='UNMATCHED - Dropping message from LogPipe', rule='f_local7', location='/etc/syslog-ng/syslog-ng.conf:147:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Requesting flow control; location='/etc/syslog-ng/syslog-ng.conf:146:32' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: >>>>>> filter rule evaluation begin; rule='f_local6', location='/etc/syslog-ng/syslog-ng.conf:146:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: facility() evaluation started; fac='5', valid_fac='00400000', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: <<<<<< filter rule evaluation result; result='UNMATCHED - Dropping message from LogPipe', rule='f_local6', location='/etc/syslog-ng/syslog-ng.conf:146:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Requesting flow control; location='/etc/syslog-ng/syslog-ng.conf:145:32' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: >>>>>> filter rule evaluation begin; rule='f_local5', location='/etc/syslog-ng/syslog-ng.conf:145:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: facility() evaluation started; fac='5', valid_fac='00200000', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: <<<<<< filter rule evaluation result; result='UNMATCHED - Dropping message from LogPipe', rule='f_local5', location='/etc/syslog-ng/syslog-ng.conf:145:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Requesting flow control; location='/etc/syslog-ng/syslog-ng.conf:142:32' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: >>>>>> filter rule evaluation begin; rule='f_local2', location='/etc/syslog-ng/syslog-ng.conf:142:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: facility() evaluation started; fac='5', valid_fac='00040000', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: <<<<<< filter rule evaluation result; result='UNMATCHED - Dropping message from LogPipe', rule='f_local2', location='/etc/syslog-ng/syslog-ng.conf:142:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Requesting flow control; location='/etc/syslog-ng/syslog-ng.conf:141:32' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: >>>>>> filter rule evaluation begin; rule='f_local1', location='/etc/syslog-ng/syslog-ng.conf:141:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: facility() evaluation started; fac='5', valid_fac='00020000', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: <<<<<< filter rule evaluation result; result='UNMATCHED - Dropping message from LogPipe', rule='f_local1', location='/etc/syslog-ng/syslog-ng.conf:141:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Requesting flow control; location='/etc/syslog-ng/syslog-ng.conf:144:32' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: >>>>>> filter rule evaluation begin; rule='f_local4', location='/etc/syslog-ng/syslog-ng.conf:144:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: facility() evaluation started; fac='5', valid_fac='00100000', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: <<<<<< filter rule evaluation result; result='UNMATCHED - Dropping message from LogPipe', rule='f_local4', location='/etc/syslog-ng/syslog-ng.conf:144:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Requesting flow control; location='/etc/syslog-ng/syslog-ng.conf:143:32' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: >>>>>> filter rule evaluation begin; rule='f_local3', location='/etc/syslog-ng/syslog-ng.conf:143:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: facility() evaluation started; fac='5', valid_fac='00080000', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: <<<<<< filter rule evaluation result; result='UNMATCHED - Dropping message from LogPipe', rule='f_local3', location='/etc/syslog-ng/syslog-ng.conf:143:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: >>>>>> filter rule evaluation begin; rule='f_loggen', location='/etc/syslog-ng/syslog-ng.conf:97:22', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: match() evaluation started; input='syslog-ng', pattern='.*[.]000', value='PROGRAM', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: <<<<<< filter rule evaluation result; result='UNMATCHED - Dropping message from LogPipe', rule='f_loggen', location='/etc/syslog-ng/syslog-ng.conf:97:22', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Initial message parsing follows; Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Setting value; name='HOST', value='', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Setting value; name='MESSAGE', value='Error processing log message: <-1>Jun 9 11:23:47 testlogger-service-54956569bb-2c5wl testlogger: 2020-06-09 11:23:47,346 (main) INFO [c.b.s.r.s.TestLoggerServer] [trkId=] Test log message \x0a\x0a>@<\x0a<-1>Jun 9 11:23:47 testlogger-service-54956569bb-2c5wl testlogger: 2020-06-09 11:23:47,346 (main) INFO [c.b.s.r.s.TestLoggerServer] [trkId=] Test log message ', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Setting value; name='PROGRAM', value='syslog-ng', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Setting value; name='PID', value='28873', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Setting value; name='HOST_FROM', value='10.13.98.167', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Setting value; name='HOST', value='10.13.98.167/10.13.98.167', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Setting value; name='SOURCE', value='s_tcp_net_514', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Requesting flow control; location='/etc/syslog-ng/syslog-ng.conf:147:32' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: >>>>>> filter rule evaluation begin; rule='f_local7', location='/etc/syslog-ng/syslog-ng.conf:147:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: facility() evaluation started; fac='5', valid_fac='00800000', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: <<<<<< filter rule evaluation result; result='UNMATCHED - Dropping message from LogPipe', rule='f_local7', location='/etc/syslog-ng/syslog-ng.conf:147:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Requesting flow control; location='/etc/syslog-ng/syslog-ng.conf:146:32' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: >>>>>> filter rule evaluation begin; rule='f_local6', location='/etc/syslog-ng/syslog-ng.conf:146:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: facility() evaluation started; fac='5', valid_fac='00400000', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: <<<<<< filter rule evaluation result; result='UNMATCHED - Dropping message from LogPipe', rule='f_local6', location='/etc/syslog-ng/syslog-ng.conf:146:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Requesting flow control; location='/etc/syslog-ng/syslog-ng.conf:145:32' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: >>>>>> filter rule evaluation begin; rule='f_local5', location='/etc/syslog-ng/syslog-ng.conf:145:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: facility() evaluation started; fac='5', valid_fac='00200000', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: <<<<<< filter rule evaluation result; result='UNMATCHED - Dropping message from LogPipe', rule='f_local5', location='/etc/syslog-ng/syslog-ng.conf:145:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Requesting flow control; location='/etc/syslog-ng/syslog-ng.conf:142:32' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: >>>>>> filter rule evaluation begin; rule='f_local2', location='/etc/syslog-ng/syslog-ng.conf:142:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: facility() evaluation started; fac='5', valid_fac='00040000', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: <<<<<< filter rule evaluation result; result='UNMATCHED - Dropping message from LogPipe', rule='f_local2', location='/etc/syslog-ng/syslog-ng.conf:142:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Requesting flow control; location='/etc/syslog-ng/syslog-ng.conf:141:32' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: >>>>>> filter rule evaluation begin; rule='f_local1', location='/etc/syslog-ng/syslog-ng.conf:141:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: facility() evaluation started; fac='5', valid_fac='00020000', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: <<<<<< filter rule evaluation result; result='UNMATCHED - Dropping message from LogPipe', rule='f_local1', location='/etc/syslog-ng/syslog-ng.conf:141:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Requesting flow control; location='/etc/syslog-ng/syslog-ng.conf:144:32' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: >>>>>> filter rule evaluation begin; rule='f_local4', location='/etc/syslog-ng/syslog-ng.conf:144:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: facility() evaluation started; fac='5', valid_fac='00100000', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: <<<<<< filter rule evaluation result; result='UNMATCHED - Dropping message from LogPipe', rule='f_local4', location='/etc/syslog-ng/syslog-ng.conf:144:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: Requesting flow control; location='/etc/syslog-ng/syslog-ng.conf:143:32' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: >>>>>> filter rule evaluation begin; rule='f_local3', location='/etc/syslog-ng/syslog-ng.conf:143:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: facility() evaluation started; fac='5', valid_fac='00080000', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: <<<<<< filter rule evaluation result; result='UNMATCHED - Dropping message from LogPipe', rule='f_local3', location='/etc/syslog-ng/syslog-ng.conf:143:32', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: >>>>>> filter rule evaluation begin; rule='f_loggen', location='/etc/syslog-ng/syslog-ng.conf:97:22', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: match() evaluation started; input='syslog-ng', pattern='.*[.]000', value='PROGRAM', msg='0x7f2af8003800' Jun 9 11:23:47 s_local@syslog syslog-ng[28873]: <<<<<< filter rule evaluation result; result='UNMATCHED - Dropping message from LogPipe', rule='f_loggen', location='/etc/syslog-ng/syslog-ng.conf:97:22', msg='0x7f2af8003800' Any help would be greatly appreciated. Thank you, Jason

3 9

Disk buffer getting wiped out
by Raghunath Adhyapak 15 Jun '20

15 Jun '20

Hi, We have syslog-ng forwarding logs to a remote system, with reliability enabled and disk buffer size set to 50GB in the configuration. However, the actual size of the partition is 30GB. We had overlooked the partition size that resulted in this error. When there is connection loss to remote device and partition gets filled to 100% due to syslog-ng disk buffer. syslog-ng continues to run, but even after we free some space in partition and destination is available, it doesn't push out logs to the destination. We have to restart syslog-ng service. After restarting, we observe that all buffer files are freed up immediately. These files were consuming about 20-30GB. Syslog-ng version using :3.24 Below is disk buffer configuration: mem-buf-size(10000) disk-buf-size(53687091200) reliable(yes) dir(/syslog/buffer) Questions: 1. Does syslog-ng allocate buffers on disk as much as required and in small chunks? Or will it try to allocate all of the specified buffer at one (in this case 50GB)? 2. Why couldn't syslog-ng resume operations after partition was freed up and destination was available? 3. Why did all buffer files get deleted, after a restart Thanks Raghu

5 10

Insider 2020-06: edge; log management layer; WSL;
by Peter Czanik (pczanik) 11 Jun '20

11 Jun '20

Dear syslog-ng users, This is the 82nd issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Syslog-ng on the edge --------------------- After many years of pushing all computing from on-site to the cloud or huge data centers, there is a new trend: edge computing. There can be many reasons, legal or practical, why data should be processed locally instead of being sent to a central location as soon as it is created. Edge computing was a central theme of the recently held Red Hat Summit. Luckily syslog-ng is well prepared for this use case right from the beginning. While most people only know that syslog-ng can act as a client or a server, it can also collect, process and forward log messages. In syslog-ng terminology it is called a relay, but on the edge you might want to combine server and a relay functionality into one. https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-on-the-edge Creating a dedicated log management layer ----------------------------------------- Event logging is a central source of information both for IT security and operations, but different teams use different tools to collect and analyze log messages. The same log message is often collected by multiple applications. Having each team using different tools is complex, inefficient and makes systems less secure. Using a single application to create a dedicated log management layer independent of analytics instead, however, has multiple benefits. Using syslog-ng is a lot more flexible than most log aggregation tools provided by log analytics vendors. This is one of the reasons why my talks and blogs focused on how to make your life easier using its technical advantages. Of course, I am aware of the direct financial benefits as well. If you are interested in that part, talk to my colleagues on the business side. They can help you to calculate how much you can save on your SIEM licenses when syslog-ng collects log messages and ensures that only relevant messages reach your SIEM and only at a predicatively low message rate. You can learn more about this use case on our Optimizing SIEM page. In this blog, I will focus on a third aspect: simplifying complexity. This was the focus of many of my conference discussions before the COVID-19 pandemic. If we think a bit more about it, we can see that this is not really a third aspect, but a combination of the previous two instead. Using the flexibility of syslog-ng, we create a dedicated log management layer in front of different log analytics solutions. By reducing complexity, we can save in many ways: on computing and human resources, and on licensing when using commercial tools for log analysis as well. https://www.syslog-ng.com/community/b/blog/posts/creating-a-dedicated-log-m… I will cover this topic more in depth in my upcoming talk at the Pass the SALT conference: https://pass-the-salt.org/ Using syslog-ng in WSL ---------------------- Windows Subsystem for Linux (WSL) is an optional feature of Windows 10 for developers who want the power of Linux (especially the Linux shell) on their Windows desktops. Of course, it is more than just a shell: you can easily install and run any command line applications (but not GUI). As a Linux desktop user, I do not need WSL to access a Linux shell, but as I am often asked how syslog-ng runs in WSL, I finally gave it a try. The recurring questions are if syslog-ng runs at all in WSL and what the performance compared to syslog-ng installed on Linux is. As I run openSUSE Leap 15.1 as my main operating system on my laptop, I used that in WSL as well. I tested not just WSL 1, which has been generally available for years, but also the upcoming WSL 2, which brings tons of performance improvements. As WSL 2 involves virtualization, I also tested syslog-ng in Vmware Workstation running on Windows. In all cases, I used the latest syslog-ng 3.26 from my unofficial syslog-ng repository for openSUSE and a minimally modified syslog-ng.conf to enable the network source. Benchmarking was done both from localhost and from a small Xeon server on the local network, attached through Gigabit Ethernet. https://www.syslog-ng.com/community/b/blog/posts/using-syslog-ng-in-wsl CONFERENCES * ”Creating a dedicated log management layer” talk at the virtual Pass the SALT conference: https://pass-the-salt.org/ WEBINARS * Learn how to do custom HTTP REST API Authentication with syslog-ng: https://www.syslog-ng.com/event/customize-http-rest-apis-authentication-wit… * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Poll: Do you use any of the Java-based destination drivers of syslog-ng?
by Peter Czanik (pczanik) 10 Jun '20

10 Jun '20

Hi, Just posted a poll on Twitter, but answers are also very welcome here. Do you use any of the Java-based destination drivers of syslog-ng? HDFS, Kafka (not the C implementation) or Elasticsearch (not the elasticsearch-http() version). Or do you use the syslog-ng Java bindings with your own custom Java module? Let as know here or on Twitter at https://twitter.com/PCzanik/status/1270700394059104263 Also, please RT the above tweet to reach more syslog-ng users! Thanks, Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Fwd: Memleak in syslog-ng v3.19.1
by Vidya Balakrishnan 09 Jun '20

09 Jun '20

Greetings, This mail is regarding Memory leak in Syslog-ng v3.19.1. The process gets launched at 26MB and then grows to 37MB or even upto 45MB. Pasting the configurations used below: @version: 3.19 @include "scl.conf" source s_local { #system(); #internal(); syslog(port(514) transport("udp")); }; rewrite tag_SN { set("ABC-XXXXXXX", value("HOST")); }; destination d_Log_Server { network("abcd.com" port(514) transport(tls) tls( ca-dir("/etc/ssl") peer-verify("required-trusted") ) time-zone("+00:00") template("${R_YEAR}-${R_MONTH}-${R_DAY}T${R_HOUR}:${R_MIN}:${R_SEC}.${R_MSEC}${TZOFFSET} ${HOST} ${MSGHDR}${MESSAGE}\n") ); }; log { source(s_local); rewrite(tag_SN); destination(d_Log_Server); }; Also, tried debugging using valgrind but did not resolve the issue. ==19671== Memcheck, a memory error detector ==19671== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al. ==19671== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info ==19671== Command: /sbin/syslog-ng --cfgfile=/var/syslog-ng.conf ==19671== Parent PID: 2190 ==19671== ==19671== Conditional jump or move depends on uninitialised value(s) ==19671== at 0x401A8D4: index (in /lib/ld-linux.so.3) ==19671== by 0x4007F33: expand_dynamic_string_token (in /lib/ld-linux.so.3) ==19671== ==19671== Conditional jump or move depends on uninitialised value(s) ==19671== at 0x401A8D8: index (in /lib/ld-linux.so.3) ==19671== by 0x4007F33: expand_dynamic_string_token (in /lib/ld-linux.so.3) ==19671== ==19671== Conditional jump or move depends on uninitialised value(s) ==19671== at 0x4007F38: expand_dynamic_string_token (in /lib/ld-linux.so.3) ==19671== disInstr(arm): unhandled instruction: 0xEC510F1E cond=14(0xE) 27:20=197(0xC5) 4:4=1 3:0=14(0xE) ==19671== valgrind: Unrecognised instruction at address 0x4cd6e68. ==19671== at 0x4CD6E68: _armv7_tick (in /lib/libcrypto.so.1.1) ==19671== Your program just tried to execute an instruction that Valgrind ==19671== did not recognise. There are two possible reasons for this. ==19671== 1. Your program has a bug and erroneously jumped to a non-code ==19671== location. If you are running Memcheck and you just saw a ==19671== warning about a bad jump, it's probably your program's fault. ==19671== 2. The instruction is legitimate but Valgrind doesn't handle it, ==19671== i.e. it's Valgrind's fault. If you think this is the case or ==19671== you are not sure, please let us know and we'll try to fix it. ==19671== Either way, Valgrind will now raise a SIGILL signal which will ==19671== probably kill your program. ==19700== Invalid read of size 4 ==19700== at 0x401A8D4: index (in /lib/ld-linux.so.3) ==19700== by 0x40145BB: dl_open_worker (in /lib/ld-linux.so.3) ==19700== Address 0x4f86bb4 is 3 bytes after a block of size 41 alloc'd ==19700== at 0x4847654: malloc (vg_replace_malloc.c:299) ==19700== by 0x49B3BC3: g_malloc (gmem.c:94) ==19700== by 0x49CEA17: g_strdup (gstrfuncs.c:363) ==19700== by 0x49417BF: g_module_open (gmodule.c:543) ==19700== by 0x489AFDB: plugin_dlopen_module_as_filename (plugin.c:252) ==19700== by 0x489B8B3: plugin_dlopen_module_as_dir_and_filename (plugin.c:271) ==19700== by 0x489B8B3: plugin_load_candidate_modules (plugin.c:457) ==19700== by 0x4887017: cfg_lexer_preprocess (cfg-lexer.c:1068) ==19700== by 0x4887017: cfg_lexer_lex (cfg-lexer.c:1110) ==19700== by 0x48A876F: main_parse (cfg-grammar.c:3143) ==19700== by 0x4887D8F: cfg_parser_parse (cfg-parser.c:369) ==19700== by 0x48845BF: cfg_run_parser (cfg.c:504) ==19700== by 0x48846B3: cfg_read_config (cfg.c:556) ==19700== by 0x489766B: main_loop_read_and_init_config (mainloop.c:552) ==19700== ==19700== Conditional jump or move depends on uninitialised value(s) ==19700== at 0x401A8D4: index (in /lib/ld-linux.so.3) ==19700== by 0x40145BB: dl_open_worker (in /lib/ld-linux.so.3) ==19700== ==19700== Conditional jump or move depends on uninitialised value(s) ==19700== at 0x401A8D8: index (in /lib/ld-linux.so.3) ==19700== by 0x40145BB: dl_open_worker (in /lib/ld-linux.so.3) ==19700== ==19700== Conditional jump or move depends on uninitialised value(s) ==19700== at 0x40145C0: dl_open_worker (in /lib/ld-linux.so.3) ==19700== ==19700== Conditional jump or move depends on uninitialised value(s) ==19700== at 0x401AD9C: strcpy (in /lib/ld-linux.so.3) ==19700== by 0x400A8D3: _dl_lookup_symbol_x (in /lib/ld-linux.so.3) ==19700== ==19700== Invalid read of size 4 ==19700== at 0x401AC60: strcpy (in /lib/ld-linux.so.3) ==19700== by 0x400A8D3: _dl_lookup_symbol_x (in /lib/ld-linux.so.3) ==19700== Address 0x5185254 is 0 bytes after a block of size 20 alloc'd ==19700== at 0x4849EB4: realloc (vg_replace_malloc.c:785) ==19700== by 0x49B3C9B: g_realloc (gmem.c:159) ==19700== by 0x49FCAF3: _g_gnulib_vasnprintf (vasnprintf.c:5533) ==19700== by 0x49FD263: _g_gnulib_vasprintf (printf.c:142) ==19700== by 0x49F6B0B: g_vasprintf (gprintf.c:310) ==19700== by 0x49CEB7F: g_strdup_vprintf (gstrfuncs.c:514) ==19700== by 0x49CEBAB: g_strdup_printf (gstrfuncs.c:540) ==19700== by 0x489AF7F: plugin_get_module_init_name (plugin.c:234) ==19700== by 0x489B363: plugin_load_module (plugin.c:364) ==19700== by 0x48ABCAB: pragma_parse (pragma-grammar.y:443) ==19700== by 0x4887D8F: cfg_parser_parse (cfg-parser.c:369) ==19700== by 0x4886E9B: cfg_lexer_parse_pragma (cfg-lexer.c:996) ==19700== by 0x4886E9B: cfg_lexer_preprocess (cfg-lexer.c:1040) ==19700== by 0x4886E9B: cfg_lexer_lex (cfg-lexer.c:1110) ==19700== ==19700== Conditional jump or move depends on uninitialised value(s) ==19700== at 0x401AD80: strcpy (in /lib/ld-linux.so.3) ==19700== by 0x400A8D3: _dl_lookup_symbol_x (in /lib/ld-linux.so.3) ==19700== ==19700== Use of uninitialised value of size 4 ==19700== at 0x401ACB8: strcpy (in /lib/ld-linux.so.3) ==19700== by 0x400A8D3: _dl_lookup_symbol_x (in /lib/ld-linux.so.3) ==19700== ==19700== Invalid read of size 4 ==19700== at 0x401ADAC: strcpy (in /lib/ld-linux.so.3) ==19700== by 0x400A8D3: _dl_lookup_symbol_x (in /lib/ld-linux.so.3) ==19700== Address 0x533bdac is 3 bytes after a block of size 25 alloc'd ==19700== at 0x4849EB4: realloc (vg_replace_malloc.c:785) ==19700== by 0x49B3C9B: g_realloc (gmem.c:159) ==19700== by 0x49FCAF3: _g_gnulib_vasnprintf (vasnprintf.c:5533) ==19700== by 0x49FD263: _g_gnulib_vasprintf (printf.c:142) ==19700== by 0x49F6B0B: g_vasprintf (gprintf.c:310) ==19700== by 0x49CEB7F: g_strdup_vprintf (gstrfuncs.c:514) ==19700== by 0x49CEBAB: g_strdup_printf (gstrfuncs.c:540) ==19700== by 0x489AF7F: plugin_get_module_init_name (plugin.c:234) ==19700== by 0x489B363: plugin_load_module (plugin.c:364) ==19700== by 0x489B6BB: plugin_find (plugin.c:199) ==19700== by 0x489921B: msg_format_options_init (msg-format.c:81) ==19700== by 0x4891A9B: log_reader_options_init (logreader.c:728) ==19700== ==19700== Conditional jump or move depends on uninitialised value(s) ==19700== at 0x401ADC4: strcpy (in /lib/ld-linux.so.3) ==19700== by 0x400A8D3: _dl_lookup_symbol_x (in /lib/ld-linux.so.3) ==19700== ==19700== Conditional jump or move depends on uninitialised value(s) ==19700== at 0x401A8D4: index (in /lib/ld-linux.so.3) ==19700== by 0x4008BFB: _dl_map_object (in /lib/ld-linux.so.3) ==19700== ==19700== Conditional jump or move depends on uninitialised value(s) ==19700== at 0x401A8D8: index (in /lib/ld-linux.so.3) ==19700== by 0x4008BFB: _dl_map_object (in /lib/ld-linux.so.3) ==19700== ==19700== Conditional jump or move depends on uninitialised value(s) ==19700== at 0x4008C00: _dl_map_object (in /lib/ld-linux.so.3) ==19700== ==19700== Syscall param epoll_pwait(sigmask) points to unaddressable byte(s) ==19700== at 0x4BCC73C: epoll_pwait (in /lib/libc.so.6) ==19700== Address 0x0 is not stack'd, malloc'd or (recently) free'd ==19700== ==19671== ==19671== HEAP SUMMARY: ==19671== in use at exit: 11,980 bytes in 55 blocks ==19671== total heap usage: 179 allocs, 124 frees, 49,157 bytes allocated ==19671== ==19671== 419 (44 direct, 375 indirect) bytes in 1 blocks are definitely lost in loss record 44 of 46 ==19671== at 0x4847654: malloc (vg_replace_malloc.c:299) ==19671== by 0x49B3BC3: g_malloc (gmem.c:94) ==19671== by 0x488BD07: g_process_set_argv_space (gprocess.c:569) ==19671== by 0x1127B: main (main.c:216) ==19671== ==19671== LEAK SUMMARY: ==19671== definitely lost: 44 bytes in 1 blocks ==19671== indirectly lost: 375 bytes in 10 blocks ==19671== possibly lost: 0 bytes in 0 blocks ==19671== still reachable: 11,561 bytes in 44 blocks ==19671== suppressed: 0 bytes in 0 blocks ==19671== Reachable blocks (those to which a pointer was found) are not shown. ==19671== To see them, rerun with: --leak-check=full --show-leak-kinds=all The memory usage keeps increasing. There are no local disks used to store the logs messages. It is directly sent to the Graylog server. Could you please take a look at this issue and help resolving the same. Regards, Vidya Balakrishnan

2 4

my syslog-ng-stable repos updated to 3.27
by Peter Czanik (pczanik) 08 Jun '20

08 Jun '20

Hi, My unofficial syslog-ng-stable repos for openSUSE/SLES and Fedora/RHEL/CentOS are now updated to syslog-ng 3.27. As you might recall, version 3.26 was skipped, as it arrived at a time when nobody was touching systems (beginning of WFH). 3.27 was relesaed a while ago. It seems to run fine everywhere, so I found it as a safe choice for the stable repo. (side note: thanks to those who reminded me to update the repos. The one drawback that I don't update immediately after release, that sometimes I forget it completely... 🙂 ). As usual: let me know, if you run into any problems with the packages. Peter Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0