- syslog-ng - lists.balabit.hu

[Bug 28] New: syslog-ng 2.0.9 is cpu bound after bootup on FreeBSD 7. 1-RELEASE
by bugzilla＠bugzilla.balabit.com 30 Apr '09

30 Apr '09

https://bugzilla.balabit.com/show_bug.cgi?id=28 Summary: syslog-ng 2.0.9 is cpu bound after bootup on FreeBSD 7.1-RELEASE Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Other Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: syslog-ng(a)ee.lbl.gov Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=6) --> (https://bugzilla.balabit.com/attachment.cgi?id=6) syslogd lines from /etc.conf I'm using the FreeBSD syslog-ng2 package (2.0.9_2) under 7.1-RELEASE (see rc.conf.txt attachment). I find that syslog-ng is cpu bound following a reboot. This problem occurs on both i386 and amd64 installs. Either stopping and starting ("/etc/rc.d/syslogd restart") or reloading ("kill -HUP `cat /var/run/syslog.pid`") results in normal operation. I used ktrace and it poll() is called followed by four calls to gettimeofday() (see ktrace.txt attachment). gcore and gdb show the loop to be inside glib (see gdb.txt attachment). lsof shows the file descriptor that /dev/console should be on has been revoked (see lsof.txt attachment). I believe something happens early during the bootup process that causes /dev/console to be reconfigured. I think that devd is running when syslog-ng starts up. Forcing the syslogd started to happen after syscons doesn't help. Note: In order to get syslog-ng to work with /etc/rc.d/syslogd the startup script must be tweaked (see syslogd.patch.txt attachment). My syslog-ng.conf is attached (syslog-ng.conf.txt) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 7

[Bug 24] New: .pid file not set correctly (STOP not working)
by bugzilla＠bugzilla.balabit.com 30 Apr '09

30 Apr '09

https://bugzilla.balabit.com/show_bug.cgi?id=24 Summary: .pid file not set correctly (STOP not working) Product: syslog-ng Version: unspecified Platform: Other OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: man(a)inspektsecurity.com Type of the Report: --- Estimated Hours: 0.0 Hi. in installed syslog-ng 3.0.1 PE (syslog-ng-premium-edition-3.0.1-linux-i386.run). The installation is on a CentOS 5 system (RedHat spin-off). Although the program itself works fine, the RC scripts STOP command does not work. I traced the problem down to the .pid file not being set correctly. According to the RC script the .pid file shoud be in: PIDFILE=$SYSLOGNG_PREFIX/var/run/syslog-ng.pid resulting in the below when running STOP/RESTART ------------ [root@test-server:~] /etc/init.d/syslog-ng restart -n Restarting syslog-ng: -n Stopping syslog-ng: -n Starting syslog-ng: Error binding socket; addr='AF_INET(0.0.0.0:514)', error='Address already in use (98)' Error initializing source driver; source='tcp_input_syslog', id='tcp_input_syslog#0' Error initializing message pipeline; failed ------------- I found out that the pid file set is actually: /var/run/syslogd.pid So changing the RC script to: PIDFILE=/var/run/syslogd.pid seems to work. br /Marc -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

syslog-ng 3.0.1, open source edition, fails write to MySQL DB
by Arnold Wang 29 Apr '09

29 Apr '09

I have installed syslog-ng 3.0.1, open source edition, binary package in RHEL 5.3 system. I'm having trouble to have it writing to MySQL DB using native driver. The current configuration file looks like: # Write the logs to MySQL DB destination dd_mysql { sql(type(mysql) host("localhost") username("syslogadmin") password("syslogadmin") database("syslog") table("logs") columns("host", "facility", "priority", "level", "tag", "datetime", "program", "msg", "seq") values("$HOST", "$FACILITY", "$PRIORITY", "$LEVEL", "$TAG", "$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC", "$PROGRAM", "$MSG", "$SEQ") indexes("seq")); # program("/usr/bin/mysql -usyslogadmin -psyslogadmin syslog" # template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg, seq) # VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG', '$SEQ' );\n") # template-escape(yes)); }; It works if I use the program driver, as currently commented out. The table is configured as following, using the schema defined by php-syslog-ng 2.9.8m. +----------+---------------------+------+-----+---------+----------------+ | Field | Type | Null | Key | Default | Extra | +----------+---------------------+------+-----+---------+----------------+ | id | bigint(20) unsigned | NO | PRI | NULL | auto_increment | | host | varchar(128) | YES | MUL | NULL | | | facility | varchar(10) | YES | MUL | NULL | | | priority | varchar(10) | YES | MUL | NULL | | | level | varchar(10) | YES | | NULL | | | tag | varchar(10) | YES | | NULL | | | datetime | datetime | YES | MUL | NULL | | | program | varchar(15) | YES | MUL | NULL | | | msg | text | YES | | NULL | | | seq | bigint(20) unsigned | NO | MUL | 0 | | | counter | int(11) | NO | | 1 | | | fo | datetime | YES | | NULL | | | lo | datetime | YES | | NULL | | +----------+---------------------+------+-----+---------+---------------- What is the problem? Thanks in advance for the help.

3 4

Removing Prefixes from Syslog-ng Messages
by adam.j.brendamour＠accenture.com 29 Apr '09

29 Apr '09

Hello all, I am having issues with syslog-ng adding prefixes to my messages. I currently have a syslog-ng agent sending messages from a log source to a syslog-ng central server. I am then sending the messages from the central server to a 3rd party event management program. Is there a way to forward an unchanged syslog-ng message from the relay server? For example: Message arriving from source: Apr 16 09:31:07 psrdev47 10.56.9.12 - - [16/Apr/2009:09:31:02 -0700] "GET / HTTP/1.1" 302 427 "-" "-" Message being forwarded from server: Apr 16 09:31:07 10.56.2.77 125 <0>1 2009-04-16T09:31:02-07:00 psrdev47 - - - - 10.56.9.12 - - [16/Apr/2009:09:31:02 -0700] "GET / HTTP/1.1" 302 427 "-" "-" How can I configure the syslog-ng server to relay this unchanged message to our destination? Apr 16 09:31:07 psrdev47 10.56.9.12 - - [16/Apr/2009:09:31:02 -0700] "GET / HTTP/1.1" 302 427 "-" "-" Thanks for your help! Regards, Adam This message is for the designated recipient only and may contain privileged, proprietary, or otherwise private information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the email by you is prohibited.

3 4

setting facility/level of source log messages ?
by bana＠docisland.org 29 Apr '09

29 Apr '09

Hi, I often meet the case where I need to centralize some purely applicative log messages (ie they don't even have a PRI header). So syslog-ng sets a default facility and severity for these messages, like kern facility and emergency severity for a source file with a "no-parse" option. Is there a clean way to change these default values by modifying the configuration file ? (and not using a source program() nor a tail | logger trick). I've already written a quick and dirty patch for my needs, but it would be great to have a native way of doing the same thing (I may have missed something in the documentation). Best Regards. -- Xavier

2 9

Parser-DB Memory Leak
by Martin Holste 27 Apr '09

27 Apr '09

I'm running tests with the db-parser() parser module and finding that the memory grows exponentially until the program finally dies with: ***MEMORY-ERROR***: syslog-ng[2769]: GSlice: failed to allocate 248 bytes (alignment: 256): Cannot allocate memory Here is my configuration: @version: 3.0 options { }; source s_tcp { tcp(ip(0.0.0.0) port(445)); }; parser p_db { db-parser(); }; filter f_security_class { match("security" value(".classifier.class")); }; filter f_class_unknown { match("unknown" value(".classifier.class")); }; filter f_not_class_unknown { not match("unknown" value(".classifier.class")); }; filter f_FIREWALL_ACCESS_DENY { match("2" value(".classifier.rule_id")); }; template t_FIREWALL_ACCESS_DENY { template("$R_UNIXTIME\t$SOURCEIP\t$FACILITY\t$PROGRAM\t${.classifier.class}\t${.classifier.rule_id}\t${FIREWALL.proto}\t${FIREWALL.o_int}\t${FIREWALL.srcip}\t${FIREWALL.srcport}\t${FIREWALL.i_int}\t${FIREWALL.dstip}\t${FIREWALL.dstport}\t${FIREWALL.access_group}\t${FWSM.PRIORITY}\t${FWSM.MSG_CODE}\t${MSGONLY}\n"); }; destination d_FIREWALL_ACCESS_DENY { fifo("/tmp/db_parsed_fifo", template(t_FIREWALL_ACCESS_DENY)); }; filter f_FIREWALL_CONNECTION_END { match("3" value(".classifier.rule_id")); }; template t_FIREWALL_CONNECTION_END { template("$R_UNIXTIME\t$SOURCEIP\t$FACILITY\t$PROGRAM\t${.classifier.class}\t${.classifier.rule_id}\t${FIREWALL.proto}\t${FIREWALL.o_int}\t${FIREWALL.srcip}\t${FIREWALL.srcport}\t${FIREWALL.i_int}\t${FIREWALL.dstip}\t${FIREWALL.dstport}\t${FIREWALL.conn_duration}\t${FIREWALL.conn_bytes}\t$MSGONLY\n"); }; destination d_FIREWALL_CONNECTION_END { fifo("/tmp/db_parsed_fifo", template(t_FIREWALL_CONNECTION_END)); }; template t_DEFAULT { template("$R_UNIXTIME\t$SOURCEIP\t\$FACILITY\t$PROGRAM\t1\t1\t$MSGONLY\n"); }; destination d_default_fifo { fifo("/tmp/db_parsed_fifo", template(t_DEFAULT)); }; log { source(s_tcp); log { parser(p_db); filter(f_not_class_unknown); log { filter(f_FIREWALL_ACCESS_DENY); destination(d_FIREWALL_ACCESS_DENY); }; log { filter(f_FIREWALL_CONNECTION_END); destination(d_FIREWALL_CONNECTION_END); }; flags(final); }; log { destination(d_default_fifo); }; }; var/patterndb.xml: <patterndb version='1' pub_date='2009-04-16'> <program name='FWSM'> <pattern>%FWSM</pattern> <rule id='2' class='2'> <pattern>Deny@QSTRING:FIREWALL.proto: @src@QSTRING:FIREWALL.o_int: :@@IPv4:FIREWALL.srcip:@/@NUMBER:FIREWALL.srcport:@ dst@QSTRING:FIREWALL.i_int: :@@IPv4:FIREWALL.dstip:@/@NUMBER:FIREWALL.dstport:@ by access-group @QSTRING:FIREWALL.access_group:"@</pattern> </rule> <rule id='3' class='3'> <pattern>Teardown@QSTRING:FIREWALL.proto: @connection @NUMBER::@ for@QSTRING:FIREWALL.o_int: :@@IPv4:FIREWALL.srcip:@ /@NUMBER:FIREWALL.srcport@ to@QSTRING:FIREWALL.i_int: :@@IPv4:FIREWALL.dstip:@/@NUMBER:FIREWALL.dstport@ duration@QSTRING:FIREWALL.conn_duration: @bytes @NUMBER:FIREWALL.conn_bytes:@</pattern> </rule> </program> </patterndb> syslog-ng -V syslog-ng 3.0.1+binpkg4 Revision: ssh+git://bazsi@git.balabit //var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.0#master#555574a984eaef9410a2869db0af1be0d52b269b Compile-Date: Apr 16 2009 14:42:21 Enable-Threads: on Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: on Enable-Linux-Caps: off Enable-Pcre: on Should I recompile with memtrace on? Thanks, Martin

4 10

syslog-ng 3.0.1 dies on reload with program() destination
by Jan Rekorajski 24 Apr '09

24 Apr '09

Sorry for possible double post, I sent the first from wrong email. Hi, Syslog-ng 3.0.1 dies on reload (kill -HUP pid) when config file contains log { destination { program() } } directive set. 100% repeatable. Here are the relevant config lines: destination d_sshguard { program("/usr/sbin/sshguard -a 6"); }; # A desperate experiment #destination d_sshguard { program("read"); }; log { source(s_sys); filter(f_authpriv); destination(d_sshguard); }; >From what I managed to find with strace/ltrace, syslog-ng kills the program, does not clear some data structures and then falls face down with sigsegv/term/ill trying to restart/reattach(?) to the program. The exact same configuration works perfectly with version 2.0.10. -- Jan Rekorajski | ALL SUSPECTS ARE GUILTY. PERIOD! baggins<at>mimuw.edu.pl | OTHERWISE THEY WOULDN'T BE SUSPECTS, WOULD THEY? BOFH, MANIAC | -- TROOPS by Kevin Rubio

5 8

sunfreeware syslog-ng v 3.0.1
by Ngim, Hyrum CTR ADCF/Arrowpoint 23 Apr '09

23 Apr '09

I get this error when I introduce the owner when defining a destination: destination firewall { file("/data/firewall/fwlog" owner(sysadmin) group(sysadmin) perm(0644)); }; When I run a syntax check I get this: # syslog-ng -s Error resolving user; user='sysadmin' # pkginfo -l SMCsyslng PKGINST: SMCsyslng NAME: syslogng CATEGORY: application ARCH: sparc VERSION: 3.0.1 BASEDIR: /usr/local VENDOR: BalaBit IT Ltd PSTAMP: Steve Christensen INSTDATE: Apr 15 2009 11:56 EMAIL: steve(a)smc.vnet.net STATUS: completely installed FILES: 91 installed pathnames 4 shared pathnames 25 directories 7 executables 1610 blocks used (approx) I also checked the misc.c file in the sunfreeware source and it didn't seem like it had the same errors that were identified in posts like this one: https://lists.balabit.hu/pipermail/syslog-ng/2009-April/012761.html

2 2

sunfreeware syslog-ng v 3.0.1
by Ngim, Hyrum CTR ADCF/Arrowpoint 23 Apr '09

23 Apr '09

I have installed and am configuring the sunfreeware package for syslog-ng. I ran into this issue that I saw on some other emails: Error resolving user; user='sysadmin' Is there a way around this to get it working? TIA

2 1

IPv6 addresses logged as 127.0.0.1
by Michael Granzow 22 Apr '09

22 Apr '09

When using the template parameter $SOURCEIP, connections originating from IPv6 addresses are logged as "127.0.0.1". The following patch fixes that issue. Listening on :: on dual-stack hosts will lead to IPv4 connections being logged in IPv6-mapped format, e.g. ::ffff:10.11.12.13. This is not what people usually expect, but it's not wrong. If desired, the place to fix that would be g_sockaddr_inet6_format().

2 2