- syslog-ng - lists.balabit.hu

syslog-ng and oracle
by Andreas Sartori 12 Aug '09

12 Aug '09

hello, we are currently setting up a new syslog server and switching from a sun fire v880 with syslog-ng and plain files to a new linux based (centos 5.3) syslog server with oracle as logging backend. we do not want to use pipes to write to the database, so we compiled libdbi-dbd-oracle with the oracle instantclient 10.2.0.4-1. syslog-ng is starting up fine (not complaining about the oracle backend), but we do have some problem with the inserts to the database. our trial syslog-ng configuration: destination d_sql_fwint { sql(type(oracle) username("xxx") password("xxx") database("dashb") table("SYSLOG_FWINT") columns("MSG_RCV_TIME varchar2(16)", "HOSTNAME varchar2(256)", "MESSAGE varchar2(2048)") values("$R_DATE", "$HOST", "$MSGONLY") }; when running in debug mode we get the following output: Running SQL query; query='INSERT INTO SYSLOG_FWINT (MSG_RCV_TIME, HOSTNAME, MESSAGE) VALUES (\'Aug 11 21:24:14\', \'gw20\', \'Built outbound TCP connection 144547326429398234 for LAN230:10.20.30.17/43825 (10.20.30.17/43825) to outside:10.10.10.102/80 (10.10.10.102/80)\')' this cant work sind oracle is not accepting \ as escape char, and in this case we do not need an escape at all. the sql syntax is right without the \. since templates are not working when using the sql driver, does anyone has an idea how to fix that? are we missing something? oracle setup is right, tnsnames or works and we can connect to the database with sqlplus. the syslog-ng init script as the environment variables set (ORACLE_HOME, LD_LIBRARY_PATH) thanks for any help -andy

2 5

syslog-ng exits when system time set backwards
by Kirill Stepanchuk 12 Aug '09

12 Aug '09

Hello, I've googled the mailing list, but could find any related threads. On FreeBSD, syslog-ng 1.6.8 exits when the system time is set to a value earlier than the previous value. Has anyone else encountered this before? Is there a fix or a configuration issue? $ ps auxwww | grep syslog-ng root 1040 0.0 0.1 1516 1208 ?? Ss 10:15AM 0:00.08 /usr/local/sbin/syslog-ng kstepanchuk 6529 0.0 0.0 1568 980 p0 R+ 10:38AM 0:00.00 grep syslog-ng $ sudo date 200501010000 Sat Jan 1 00:00:00 EST 2005 $ ps auxwww | grep syslog-ng mfeeney 6533 0.0 0.0 1612 996 p0 S+ 12:00AM 0:00.00 grep syslog-ng Thanks,

2 1

3.0.3: Accessing unix-dgram source appears to break all logging
by Markus Stalder 06 Aug '09

06 Aug '09

Hello list, my first post to the list, so hello everybody! :-) I'm on Ubuntu 8.04.2 amd64 and trying to upgrade from syslog-ng 2.0.9-1ubuntu1 to syslog-ng 3.0.3. I've both tried the on balabit.com provided amd64 .deb package and also created an own amd64 .deb with the default settings in /debian using dpkg buildpackage. I have the following two sources in my config: source s_all { internal(); unix-stream("/dev/log"); file("/proc/kmsg" program_override("kernel: ")); }; source src { internal(); unix-dgram("/dev/log"); file("/proc/kmsg" program_override("kernel: ")); }; Logging works just fine with the s_all source. However, as soon as I access the src source, by, for example destination temp_logfile { fifo("/tmp/.tivoli/.logfile."); }; log { source(src); destination(temp_logfile); }; all logging will cease. Meaning, other than Aug 5 15:04:23 server syslog-ng[17505]: syslog-ng starting up; version='3.0.3' I'm not getting *anything* in my logs after restarting syslog-ng. If I then comment destination temp_logfile ... again and restart syslog-ng, logging works again. The exact same config has worked just fine with 2.0.9-1ubuntu1. Any idea what could be wrong here? Thanks a lot! Best regards Markus

4 4

syslog-ng 3.0.4 has been released
by devel＠balabit.hu 05 Aug '09

05 Aug '09

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.0.4 SUMMARY : new stable release DATE : Aug 5, 2009 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.0.4) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: 3.0.4 Wed, 05 Aug 2009 12:51:31 +0200 Bugfixes: * The use of the tcp6 destination caused aborts during startup, which has now been fixed. * The window size used for flow control could be decremented to a negative value in case multiple incoming connections overflowed the queue. This could cause an abort if a SIGHUP was received at this time. * Fixed a possible segmentation fault under Solaris if the syslog() driver was used without explicitly specifying a transport() option. * Fixed parse error handling when loading the patterndb. * Fixed the handling of door initialization failures on Solaris. Other changes: * Fixed performance degradation when using the host_override/program_override options. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system…

1 0

IPv6 destination host + port causes assertion failure in gsockaddr.h
by Alexei Aliaev 05 Aug '09

05 Aug '09

Hi, I am trying to solve an issue with syslog-ng 3.0.3 in IPv6 environment... I have a destination specified in my config file as such: destination collector { tcp6("fdab:228b:77af:6e7e:206:5bff:fef6:e2af" port(514)); }; When I run syslog-ng, I get this: file gsockaddr.h: line 86 (g_sockaddr_inet_get_sa): assertion failed: (g_sockaddr_inet_check(s)) Aborted I tracked down that this is caused by the destination definition above. The destination address is of the same box and port 514 is open and listening. If I remove the port, everything seems to start-up fine but it tries to connect to the specified IP to port 0 and I keep getting connection refused messages. Are there any known issues that could explain this? -- Alexey

2 7

Re: [syslog-ng] 3.0.3: Accessing unix-dgram source appears to break all logging
by Markus Stalder 05 Aug '09

05 Aug '09

> But who and what is reading the fifo /tmp/.tivoli/.logfile. in your > configuration? Opening a fifo for write will hang until someone else opens > it for read, that's how named pipes work... Thanks for your reply. As said before, the config worked just fine with 2.0.9. Also, the following config snippet will produce the exact same effect, ALL logging will stop, and there's no fifo involved at all: destination dings { udp("172.30.10.204" port(514) ); file("/var/monitoring/chk/logs/chk.log"); }; filter f_local5 { facility(local5); }; filter f_info { level(info); }; log { source(src); filter(f_local5); filter(f_info); destination(dings); }; So, it got to be about the source, since only this snippet and the previous one refer to the unix-dgram source "src". If I comment them, everything works fine, and I got a few dozen other log-entries in the config which refer to the unix-stream source "s_all". Again, *ALL* logging stops! Or, put differently: syslog-ng stops to log anything. It stops working. Thanks, Markus

1 0

log analyzer
by dreamywoman 04 Aug '09

04 Aug '09

hi everybody I would like to know that what web analyzer i can integrate with syslog-ng ? Best Roya

3 2

analyzer
by dreamywoman 02 Aug '09

02 Aug '09

Hi all Tanx for ur reply but I have installed php-syslog-ng but i need something more. I need one analyzer that realize attacks because I have different mailer. Best Roya

1 0

syslog-ng stops accepting new connections every 100-110 minutes
by Matt Pinkham 31 Jul '09

31 Jul '09

For the last 24 hours on versions 2.0.4, 2.1.4, & 3.0.3 syslog-ng will stop taking new connections via a listening port every 100-110 minutes (aka it will hang up immediately). It will never recover on its own and has to be restarted. I haven't figured out the exact interval but hopefully that will be close enough to work with (note that the traffic is fairly low -- 10 mesgs/sec -- 500K-600K data/min). I had a program logging data locally via /dev/log into a named directory and then moved this program to a remote server. That remote server does not seem to be having an issue. I have observed this issue on two separate servers (RHEL4.[image: Cool] that were taking this data feed. I have tried with flush_lines/sync & time_reopen commented out with no difference as well as log_fifo_size, log_mesg_size,so_recvbuf commented out. There are no obvious messages about why syslog-ng stops working (even with debug and verbose enabled). Note that these two servers (that stop working) are behind an Alteon 2424 switch (although I have other feeds to other servers working fine behind this switch). Ideas? Need more data? ==syslog will stop accepting connections== [root@server]# telnet localhost 514 Trying 127.0.0.1... Connected to localhost.localdomain (127.0.0.1). Escape character is '^]'. Connection closed by foreign host. ==top section of 3.0 syslog-ng.conf== options { flush_lines (0); time_reopen (10); log_fifo_size (10000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); dir_perm (0755); perm (0644); chain_hostnames(no); keep_hostname (yes); stats_freq (3600); log_msg_size(65536); }; source remote { udp(ip(0.0.0.0) port(514) so_rcvbuf(1048576)); tcp(ip(0.0.0.0) port(514) max-connections(50) so_rcvbuf(1048576)); }; ==logging data like this=== filter f_data { match("Data:"); }; destination d_data { file("/var/log/data/data-$R_MONTH$R_DAY$R_HOUR$R_MIN"); }; log { source(remote); filter(f_data); destination(d_data); };

3 6

Problem with static linking glib on Solaris
by kdajka 30 Jul '09

30 Jul '09

Hi, I'm trying to compile latest stable syslog-ng (3.0.3) release on Solaris 10. I have compiled glib (2.10.3) with ./configure --enable-static --with-libiconv --prefix=/usr/local/inp/glib. Eventlog was installed by Sun administrator in my company: $pkginfo |grep -i event application SMCevtlog eventlog Which is installed to /usr/local/lib Everything is fine if I run configure like this: LD_LIBRARY_PATH=/usr/local/inp/glib/lib:$LD_LIBRARY_PATH PKG_CONFIG_PATH=/usr/local/inp/glib/lib/pkgconfig/:/usr/local/lib/pkgconfig ./configure but if I try compile it with static: LD_LIBRARY_PATH=/usr/local/inp/glib/lib:$LD_LIBRARY_PATH PKG_CONFIG_PATH=/usr/local/inp/glib/lib/pkgconfig/:/usr/local/lib/pkgconfig ./configure --enable-static-linking I'm getting this error: checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for a BSD-compatible install... ./install-sh -c checking whether build environment is sane... ^Z ... ... checking for pkg-config... (cached) /usr/bin/pkg-config checking pkg-config is at least version 0.14... yes checking for GLIB - version >= 2.10.1... yes (version 2.10.3) checking for EVTLOG... yes checking for static GLib libraries... no checking sanity checking Glib headers... yes configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib It says that it couldn't find libglib-2.0.a, even though it is located on my system: $ ls -l /usr/local/inp/glib/lib/libglib-2.0.* -rw-r--r-- 1 webadm webadm 1103212 Jul 29 09:58 /usr/local/inp/glib/lib/libglib-2.0.a -rwxr-xr-x 1 webadm webadm 1236 Jul 29 09:58 /usr/local/inp/glib/lib/libglib-2.0.la lrwxrwxrwx 1 webadm webadm 23 Jul 29 09:58 /usr/local/inp/glib/lib/libglib-2.0.so -> libglib-2.0.so.0.1000.3 lrwxrwxrwx 1 webadm webadm 23 Jul 29 09:58 /usr/local/inp/glib/lib/libglib-2.0.so.0 -> libglib-2.0.so.0.1000.3 -rwxr-xr-x 1 webadm webadm 940008 Jul 29 09:58 /usr/local/inp/glib/lib/libglib-2.0.so.0.1000.3 Is there another variable in which I can specify non-standard place of libglib-2.0.a? My config.log http://pastebin.com/d29c03773

2 2