- syslog-ng - lists.balabit.hu

Memory Exhaust
by blizzards＠libero.it 21 Dec '09

21 Dec '09

Hi all. I'm using syslog-ng 3.0.5. I have a very large configuration, more than 5000 lines, at my site. I write non only to a plain text file, but i redirect all traffic to another syslog-ng server with 10 templetas with udp socket. If i start the service, syslog-ng give me this error: Memory Exhaust at line 3666. If i cut off my configuration at line 3665, the service start correctly. Someone can help me with this issue? Maybe memory leak bug? Gix.

2 1

Sending TCP messages to Syslog-NG server
by James Pirman 18 Dec '09

18 Dec '09

I am having an issue sending TCP messages to a SysLog-NG server running version 3.0.4. For some reason when multiple messages are put into 1 tcp packet, the server queues part of the second packet and then spits it out when it receives the another new message. Has anyone seen this before? Any help would be appreciated. -Jim _________________________________________________________________ Hotmail: Powerful Free email with security by Microsoft. http://clk.atdmt.com/GBL/go/171222986/direct/01/

1 1

Pattern Database first snapshot available
by ILLES, Marton 18 Dec '09

18 Dec '09

Hi, Last week BalaBit made available some 8000 patterns (covering more than 200 applications) for syslog-ng patterndb (or db_parser as you like to call it). The patterns are available under the Creative Commons Attribution-Noncommercial-Share Alike 3.0 (CC by-NC-SA) license. The patterns in their current form are just snapshots of the ongoing effort of providing good quality patterns for various applications. You can download the snapshot of patterns from our website: http://www.balabit.com/downloads/files/patterndb-snapshot/patterndb-2009120… The patterns are partially hand-crafted and also automatically generated from logfiles and from logcheck regexp based database. Some of the patterns also contains example messages which we are using to automatically test the pattern and syslog-ng's db_parser. You can merge the xml files using "pdbtool merge". I would also like to setup a public git repository where anyone interested can follow the patterndb development and can submit patterns or fixes. A patterndb website containing all patterndb related information, links, forums, wikis and other useful documentations is under construction as well. Till than the syslog-ng mailing list a good place for questions, ideas and discussions. As always feedbacks are very welcomed! Happy parsing! Marton -- Key fingerprint = F78C 25CA 5F88 6FAF EA21 779D 3279 9F9E 1155 670D

3 5

syslog-ng OSE 3.1beta2 released
by Balazs Scheidler 18 Dec '09

18 Dec '09

Dear syslog-ng users, A new beta version of the current syslog-ng feature release has been uploaded to our website. https://www.balabit.com/network-security/syslog-ng/opensource-logging-syste… This is a bugfix only release containing blocker issues found in the past three weeks. Please see the NEWS entry below for more details. Any kind of feedback, be it positive or negative is appreciated. 3.1beta2 Fri, 18 Dec 2009 09:19:39 +0100 Bugfixes: * Fixed two major memory leaks, one on input messages, one in patterndb. * Fixed escaped structured data processing. * Fixed expanding SDATA references in templates which have multiple dots in its name (e.g. when an OID is present in the name of the SD param or SD-ID. * pdbtool now correctly zero pads month and day fields in publish date of the merged patterndb file. * pdbtool won't link to unnecessary libraries, which fixes a compilation problem on Solaris with flex installed. -- Bazsi

1 0

new blog about syslog-ng and software testing
by Zoltán Pallagi 17 Dec '09

17 Dec '09

Hi all, I would like you to know that I've created a new blog about syslog-ng, and software testing. http://pzolee.blogs.balabit.com I hope that you will find some useful and interesting informations here -- pzolee

1 0

Error in FreeBSD jail
by Peter Fraser 17 Dec '09

17 Dec '09

Hi All I installed syslog-ng3-3.0.3_3 in a jail, when I start the service, I get this error below Starting syslog_ng. Error binding socket; addr='AF_UNIX(/var/run/log)', error='Permission denied (13)' Error initializing source driver; source='src', id='src#0' Error initializing message pipeline; /usr/local/etc/rc.d/syslog-ng: WARNING: failed to start syslog_ng Does anyone have any ideas on what I could do to troubleshoot or resolve this problem? Thanks for any help.

2 5

supervise/syslog-ng exits
by Kārlis Repsons 17 Dec '09

17 Dec '09

People, I wonder why is there some two messages like this in errors log each day: supervise/syslog-ng[28806]: Daemon exited gracefully, not restarting; exitcode='0' ? What are the possible reasons and what should be done?

6 12

3.03 filtering problem
by Tim Boyer 16 Dec '09

16 Dec '09

OK, I assume that this is something stupid I'm doing - but I've started at the config file for a week, and I'll be darned if I can see it. I've got a fairly vanilla setup, and I'm trying to send dhcpd, snort, etc to separate filters, while at the same time keeping one file with all of the error messages. Like so: # # log sources # source server { file("/proc/kmsg"); unix-stream("/dev/log"); internal(); }; destination dserver_all { file("/var/log/${HOST}.log" owner(root) group(hobbit) perm(0640)); }; destination dserver_cfengine { file("/var/log/cfengine.log"); }; destination dserver_snort { file("/var/log/snort.log"); }; destination dserver_dhcpd { file("/var/log/dhcpd.log"); }; ... filter fserver_snort { program("snort"); }; filter fserver_dhcpd { program("dhcpd"); }; filter fserver_cfengine { program("cfengine"); }; ... log { source(server); destination(dserver_all); }; log { source(server); filter(fserver_snort); destination(dserver_snort); flags(final); }; log { source(server); filter(fserver_cfengine); destination(dserver_cfengine); flags(final); }; log { source(server); filter(fserver_dhcpd); destination(dserver_dhcpd); flags(final); }; The 'log everything' is working fine. Some of the filtered logs are working fine, like the cfengine log: [root@saratoga log]# ls -la /var/log/cfengine.log -rw------- 1 root root 181006 Dec 14 11:15 /var/log/cfengine.log The dhcpd log is empty: [root@saratoga log]# ls -la /var/log/dhcpd.log -rw------- 1 root root 0 Dec 13 02:42 /var/log/dhcpd.log even though there are entries in the combined log that clearly should have hit the dhcpd log: [root@saratoga log]# tail /var/log/saratoga.log Dec 14 11:25:07 saratoga dhcpd: Copyright 2004-2006 Internet Systems Consortium. Dec 14 11:25:07 saratoga dhcpd: All rights reserved. Dec 14 11:25:07 saratoga dhcpd: For info, please visit http://www.isc.org/sw/dhcp/ Dec 14 11:25:07 saratoga dhcpd: Wrote 22 leases to leases file. Dec 14 11:25:07 saratoga dhcpd: Listening on LPF/eth3/00:0e:0c:6d:64:cf/192.168.3/24 What in the world am I missing? Thanks much, -- tim -- -- Tim Boyer Denman Tire Corporation

1 1

3.1 Beta 1 memory leak?
by Martin Holste 16 Dec '09

16 Dec '09

I'm trying the new 3.1 beta 1 build, and even with log_fifo_size(0), syslog-ng consumes all available memory until the kernel out-of-memory manager kills it. At first I thought this had something to do with UDP forwarding to a destination, but even with that disabled, the uncontrolled consumption occurs. I reconfigured with the most basic configuration to just dump everything to /dev/null, and though the leak is slower, the leak continues. Compiled with: Glibc-2.20.3 PCRE 7.9 syslog-ng 3.1beta1 Installer-Version: 3.1beta1 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.1#master#3412dce0235e8d65bc3bebedffe8ff6bed02f45b Compile-Date: Dec 11 2009 11:36:51 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: on Configuration: @version: 3.0 options { ts_format(iso); stats_level(1); stats_freq(30); keep_hostname(no); chain_hostnames(yes); create_dirs(yes); }; source s_tcp { tcp(ip(0.0.0.0) port(514)); }; source s_udp { udp(ip(0.0.0.0) port(514)); }; destination d_null { file("/dev/null"); }; log { source(s_udp); source(s_tcp); destination(d_null); };

2 2

syslog-ng OSE 3.0.4 coredumps when use "internal()" in s_local
by nova club 15 Dec '09

15 Dec '09

Hi there, I am a new user of syslog-ng. Thanks for your time and attention in advance. The problem is syslog-ng coredumps when use "internal()" in "source", however it will work fine without "internal()". The conf file is like: ===>BEGIN @version:3.0 options { dir_perm(0755); perm(0644); chain_hostnames(no); keep_hostname(yes); }; # Default local source. source local { unix-dgram("/var/run/log"); unix-dgram("/var/run/logpriv" perm(0600)); internal(); file("/dev/klog"); }; ... filter f_hecxd { program("hecxd"); }; ... log { source(local); filter(f_hecxd); destination(d_hecxd); }; ==>END The options used for building syslog-ng is: CFLAGS='-Wl,-Bdynamic -liconv -Wl,-Bstatic' --enable-static-linking \ --enable-debug \ --enable-ssl --enable-ipv6=no --enable-tcp-wrapper=no \ --with-pidfile-dir="/var/run/" The platform is: FREEBSD 6.4-RELEASE-p6 i386 I got a very big core dump file (>500M), by backtracing that file, I can see the problem is "g_malloc0" for some reason failed to allocate memory, while syslog-ng did not check the return value and tried to use the "0x0" pointer in a "strlen()" call later. Here is a part of trace information: #0 0x080a2d8d in strlen () No symbol table info available. #1 0x0804e7fe in log_msg_new_internal (prio=43, msg=0x0, flags=6) at logmsg.c:1971 buf = (gchar *) 0x0 self = (LogMessage *) 0x8159000 #2 0x080492b1 in msg_send_internal_message (prio=43, msg=0x0) at messages.c:128 context = (MsgContext *) 0x81893a0 m = (LogMessage *) 0x7 #3 0x0804954c in msg_log_func (log_domain=0x81186ea "GLib", log_flags=6, msg=0x0, user_data=0x0) at messages.c:187 pri = 43 #4 0x08084906 in IA__g_logv (log_domain=0x81186ea "GLib", log_level=G_LOG_LEVEL_ERROR, format=0x811cbac "%s: failed to allocate %u bytes", args1=0xbfbfe6cc "3�\021\bl") at gmessages.c:519 msg = (gchar *) 0x0 was_fatal = 0 was_recursion = 0 i = 2 #5 0x08084ae4 in IA__g_log (log_domain=0x81186ea "GLib", log_level=G_LOG_LEVEL_ERROR, format=0x811cbac "%s: failed to allocate %u bytes") at gmessages.c:569 No locals. #6 0x08084239 in IA__g_malloc0 (n_bytes=108) at gmem.c:155 mem = 0x0 #7 0x0804e5ef in log_msg_new ( msg=0x8a82180 "<47> syslog-ng[3277]: Filter node evaluation result; filter_result='not-match', filter_type='level'\n", length=100, saddr=0x0, flags=6, bad_hostname=0x0, assume_timezone=-1, default_pri=47) at logmsg.c:1873 self = (LogMessage *) 0x810ba1b #8 0x0804e80a in log_msg_new_internal (prio=47, msg=0x817f500 "Filter node evaluation result; filter_result='not-match', filter_type='level'", flags=6) at logmsg.c:1971 buf = (gchar *) 0x8a82180 "<47> syslog-ng[3277]: Filter node evaluation result; filter_result='not-match', filter_type='level'\n" self = (LogMessage *) 0x8159000 #9 0x080492b1 in msg_send_internal_message (prio=47, msg=0x817f500 "Filter node evaluation result; filter_result='not-match', filter_type='level'") at messages.c:128 context = (MsgContext *) 0x81893a0 m = (LogMessage *) 0x8182030 If you need the completed coredump file, just let me know and tell me where to put it :) Any help is much appreciated. Thanks a lot. Shen _________________________________________________________________ Windows Live: Make it easier for your friends to see what you’re up to on Facebook. http://go.microsoft.com/?linkid=9691816

2 4