- syslog-ng - lists.balabit.hu

s_tail not working
by Nikunj Shah 18 Mar '09

18 Mar '09

Hi, I am using syslog-ng 2.0.9 on my opensuse 11.1 box. I was trying to configure my apache log to be logged in syslog-ng. I used below syntax: source s_tail { file("/var/log/apache2/access_log" follow_freq(1) flags(no-parse));}; destination logserver { tcp("192.168.1.184" port(1470)); }; log { source(s_tail); destination(logserver); }; It gave me below error: >Mar 18 04:08:09 sugar3 syslog-ng[22107]: Follow-mode file source not found, deferring open; filename='/var/log/apache2/access_log' Help would be appreciated. Regards, Nikunj

1 0

seeking for a help
by dhanesh m 18 Mar '09

18 Mar '09

freind, iam a redhat certified engineer , now iam concentrating on suse linux, and i wanna configure syslog-ng server in suse i gone through google search and got some idea i tried but its not coming juss tell me wat all entries i hav to give in server and client normal entries for remote logging hope some1 will help me...................................... Add more friends to your messenger and enjoy! Go to http://messenger.yahoo.com/invite/

2 1

[Bug 39] New: Memory exhaustion when using UDP destination to send to a remote server.
by bugzilla＠bugzilla.balabit.com 16 Mar '09

16 Mar '09

https://bugzilla.balabit.com/show_bug.cgi?id=39 Summary: Memory exhaustion when using UDP destination to send to a remote server. Product: syslog-ng Version: 2.1.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: gillespiem(a)pa.net Type of the Report: --- Estimated Hours: 0.0 I have noticed that if syslog-ng receives an ICMP Type 3 / Code 3 message from a syslog-ng server configured as a remote destination (using UDP as the transport), the syslog-ng process starts consuming more and more memory, finally exhausting all resources. I've found this issue can be consistently replicated. Centos 5.2 (Final) syslog-ng 2.1.3 syslog-ng.conf (snippet from sending server) destination d_syslog_rtr0 {udp("syslog-server.blah.com" port(514));}; Config on receiving server doesn't matter, you can send the packets to a blackhole when replicating the issue. Steps to replicate: Using tcpdump, determine the port the sending server is using to send messages. Then, using sing (or any packetcrafting tool), do the following (or similar): sing -du -S <receiving syslog server IP> -x port-unreach -prot udp -psrc <Sending server source port (determined above)> --pdst 514 <Sending syslog server> When viewing processes using "top", it's apparent that memory usage of the syslog-ng process starts increasing every ~2 seconds, until the server has exhausted all memory. (I can replicate this on 3 separate servers) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

syslog-ng OSE binary packages
by Balazs Scheidler 14 Mar '09

14 Mar '09

Hi, I'm happy to announce that BalaBit has decided to make the binary packages for syslog-ng OSE available for free. As you may know, BalaBit has various syslog-ng support packages and as a part of this service it prepared binary installation packages for different platforms. The access to these packages either required a support contract but could also be purchased separately for a yearly fee. With syslog-ng 3.0, the binary packages for syslog-ng OSE will become freely accessible. Since syslog-ng is an open source project, BalaBit planned to finish this task in the Open Source spirit: open and visible to all community members. This also means that the set of packages published with this e-mail is NOT yet release grade, rather it is more of a development snapshot of the current state of affairs. So please don't ruin your production systems with this package, it is more advisable to try them in a test environment (chroot or a dedicated test machine). With all these said, here is the link: https://www.balabit.com/network-security/syslog-ng/opensource-logging-syste… Please pick the release named "3.0HEAD". This contains a source snapshot (effectively git from two days ago), and a set of packages for SUSE 10, RHEL4/5, FreeBSD 6.x, Debian etch, and Linux generic. The binary packages contain all runtime dependencies needed to run syslog-ng, thus no further packages are required, it is an all-in-one package. The rpm/deb packages are prepared the same, they install syslog-ng in /opt/syslog-ng in order to avoid clashes with a system supplied syslog-ng daemon. There are two install kits for each platform: * one that includes database drivers (dubbed as "server") * one that does not include database drivers (dubbed as "client") Currently there are no other differences between the packages, but later on there might be. With the current infrastructure in place, I'm confident that with each syslog-ng OSE release, I can publish the source AND binary packages at the same time. I'd really appreciate success/failure reports and also any kind of comment you may have. I'd like to release 3.0.2 together with its binary packages, let's hope that I get enough feedback on these packages so that I can do that. Enjoy! -- Bazsi

2 1

question about message parsing behavior
by Joe Shaw 14 Mar '09

14 Mar '09

Hi, What happens if a parser fails to parse a message? Let's say I have a parser: csv_parser(columns("COL1", "COL2", "COL3") delimiters(",")); If I pass in "foo", does COL1 get set to "foo" and COL2 and COL3 are undefined? If I pass in "foo,bar" is just COL3 undefined? If I pass in "foo,bar,baz,quux" is COL3 "baz,quux" ? I am wondering if I can set up a filter for messages which don't meet the parsing rules, so that I can use the catch-all directive for logging rules and filter out messages that don't match the format (in lieu of the tagging that was discussed in a different thread). Thanks! Joe

2 2

installing syslog-ng on a CentOS 5.2
by Luigi Augello 14 Mar '09

14 Mar '09

Hi I have tried to install syslog-ng-3.0.1+20090312 with eventlog-0.2.9+20090312 on a CentOS 5.2 following this steps below 1) tar -xzvf eventlog-0.2.9+20090312.tar.gz 2) tar -xzvf syslog-ng-3.0.1+20090312.tar.gz 3) mkdir -p /opt/syslog-ng-3.0.1/eventlog 4) cd eventlog-0.2.9+20090312 5) ./configure --prefix=/opt/syslog-ng-3.0.1/eventlog/ 6) make&&make install 7) export PKG_CONFIG_PATH=/opt/syslog-ng-3.0.1/eventlog/lib/pkgconfig/ 8) cd syslog-ng-3.0.1+20090312 9) ./configure --prefix=/opt/syslog-ng-3.0.1/ and this is the output executing the last command checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for gawk... gawk checking whether make sets $(MAKE)... yes checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for style of include used by make... GNU checking dependency style of gcc... gcc3 checking for gcc... (cached) gcc checking whether we are using the GNU C compiler... (cached) yes checking whether gcc accepts -g... (cached) yes checking for gcc option to accept ISO C89... (cached) none needed checking dependency style of gcc... (cached) gcc3 checking for bison... no checking for byacc... no checking for flex... no checking for lex... no checking whether make sets $(MAKE)... (cached) yes checking for ranlib... ranlib checking for special C compiler options needed for large files... no checking for _FILE_OFFSET_BITS value needed for large files... 64 checking how to enable static linking for certain libraries... GNU or Solaris checking how to run the C preprocessor... gcc -E checking for grep that handles long lines and -e... /bin/grep checking for egrep... /bin/grep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dmalloc.h usability... no checking dmalloc.h presence... no checking for dmalloc.h... no checking for strings.h... (cached) yes checking getopt.h usability... yes checking getopt.h presence... yes checking for getopt.h... yes checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/strlog.h usability... no checking sys/strlog.h presence... no checking for sys/strlog.h... no checking door.h usability... no checking door.h presence... no checking for door.h... no checking sys/capability.h usability... no checking sys/capability.h presence... no checking for sys/capability.h... no checking sys/prctl.h usability... yes checking sys/prctl.h presence... yes checking for sys/prctl.h... yes checking tcpd.h usability... yes checking tcpd.h presence... yes checking for tcpd.h... yes checking whether struct tm is in sys/time.h or time.h... time.h checking for struct tm.tm_gmtoff... yes checking for I_CONSLOG... no checking for O_LARGEFILE... yes checking for struct sockaddr_storage... yes checking for struct sockaddr_in6... yes checking for PR_SET_KEEPCAPS... yes checking for door_create in -ldoor... no checking for socket in -lsocket... no checking for nanosleep in -lrt... yes checking for gethostbyname in -lnsl... yes checking for regexec in -lregex... no checking for res_init in -lresolv... no checking for cap_set_proc in -lcap... no checking for pcre_compile in -lpcre... no checking for strdup... yes checking for strtol... yes checking for strtoll... yes checking for strtoimax... yes checking for inet_aton... yes checking for inet_ntoa... yes checking for getopt_long... yes checking for getaddrinfo... yes checking for getutent... yes checking for strcasestr... yes checking for TCP wrapper library... -lwrap checking for OPENSSL... yes checking for dlsym in -ldl... yes checking for inflate in -lz... yes checking for dlsym in -ldl... (cached) yes checking for LIBDBI... no checking for dbi_initialize in -ldbi... no checking for LIBNET... no checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... yes checking whether to enable spoof source support... no checking whether to enable IPv6 support... yes checking whether to enable SQL support... no checking whether to enable Linux capability support... no checking whether to enable PCRE support... no checking for pkg-config... /usr/bin/pkg-config checking for GLIB - version >= 2.10.1... no *** Could not run GLIB test program, checking why... *** The test program failed to compile or link. See the file config.log for the *** exact error that occured. This usually means GLIB is incorrectly installed. configure: error: Cannot find GLIB version >= 2.10.1: is pkg-config in path? the latest 5 lines upon the GLIB library not updated, but mi CentOS is the latest. So, why this error? All hepls will be highly appreciated bye Luigi

2 2

patches recently backported from PE
by Balazs Scheidler 14 Mar '09

14 Mar '09

Hi, As promised earlier, here comes a mail that describes what patches were ported from syslog-ng Premium Edition to OSE. I find this important because otherwise these patches would not be mentioned on this mailing list at all, so I hope to get more transparency in this field. Since there were some reports recently about bugs that I've previously fixed in Premium Edition, I went through the complete diff between OSE and PE (about 20k lines) and resynced the two in order to minimize the differences. Here's the list of patches (not necessarily in cronological order, I've removed references to patches that were already present on the mailing list), for more information you can always check the git repository at git.balabit.hu: Balazs Scheidler: [debian] fixed build-dependencies to work with packages in lenny [func_test] use SNDTIMEO on Linux platforms only as it does not work everywhere [tgz2build] fixed etc/install.dat generation [func_test] enhanced functional test program [unit tests] udapted to the changed log_msg_new() prototype [init script] balabit-initscripts fixes [afsocket] the member used to hold target hostname was moved to afsocket [afsocket] properly drop connections in case SSL handshake fails [afsocket] clarified log messages [afsql] recognize "mssql" as an alias to "freetds" [config parser] add an error message if the user requests to rewrite using "glob" [child manager] don't call destroy notify if one is not set [logmsg] fixed signed comparison problems [logmsg] rename log_msg_ack_func and remove static [db-parser] move the patterndb file checking into log_db_parser_reload_database() [logwriter] fixed write suspend in case the GSource instance is replaced [messages] added support for sending the internal messages to syslog() [radix] stylistic changes [loggen] readded sequence number & timestamp generation [loggen] don't allow message sizes that'd cause stack overflo [loggen] report the effective bandwidth used at the end of the run [templates] removed dead code [func_test] removed time.sleep() calls scattered around the code [tgz2build] accept 1 successful "make check" run out of 3 enough for success [compat.h] include config.h instead of syslog-ng.h updated copyright notices [configure] minor updates As it seems it was worth to review the set of differences as there were some important patches missing: [afsocket] properly drop connections in case SSL handshake fails Without this patch, you can DoS an SSL enabled listener with handshake failures. [logmsg] fixed signed comparison problems This could cause segfaults on platforms where it is common to have pointer values with the highest bit set (e.g. negative when interpreted as a signed number). I also find it important that the functional test program (ran when you issue "make check") was enhanced significantly. The other patches mostly move the two codebases in-line to make porting patches between the two easier. -- Bazsi

1 0

Syslog-ng not working with tcp_wrappers
by Liam Kirsher 13 Mar '09

13 Mar '09

Syslog-ng doesn't seem to be respecting tcp_wrappers security. I compiled syslog-ng (v. 3) with $ ./configure --sysconfdir=/etc/syslog-ng/ --enable-tcp-wrapper -- enable-sql --enable-dynamic-linking Although, I do notice this warning in config.log: configure:7282: gcc -o conftest -g -O2 -Wall conftest.c -lwrap >&5 conftest.c: In function 'main': conftest.c:43: warning: control reaches end of non-void function configure:7288: $? = 0 configure:7309: result: -lwrap However, the compile is successful. My hosts.allow file is: # # hosts.allow This file describes the names of the hosts which are # allowed to use the local INET services, as decided # by the '/usr/sbin/tcpd' server. # sshd: ALL #syslog-ng: localhost, p3.mydomain.com, p4.mydomain.com # # hosts.deny This file describes the names of the hosts which are # *not* allowed to use the local INET services, as decided # by the '/usr/sbin/tcpd' server. ALL: ALL Note that the syslog-ng process is commented out, but syslog-ng still works. Apparently, it's not checking the hosts.* files. Any idea ? Liam

3 3

syslog-ng not opening file specified in source
by Vinay Kalkoti 12 Mar '09

12 Mar '09

Hi, I am using syslog-ng 2.0.10 on suse 10 sp2. my syslog-ng.conf file looks like this - source tcp_src { file("/tmp/log"); }; destination tcp_dest { tcp("<ip>" port(514)); }; log { source(tcp_src); destination(tcp_dest); }; i have given rw permissions to my file /tmp/log. I did strace syslog-ng -f syslog-ng.conf. Here is where it is failing - open("/tmp/log", O_RDONLY|O_NONBLOCK|O_NOCTTY) = -1 EACCES (Permission denied) Any help is appreciated. Thanks, Vinay

3 2

loosing Messages via Modem (GPRS/UMTS) connection
by Jens-Peter C. Hillers 12 Mar '09

12 Mar '09

Hi, I try to log to a remote Syslog Server via: destination logserver { tcp("log.mydomain.xyz" port(514) flush_lines(1) flush_timeout(10) keep-alive(yes) ); }; if I have a long period between the messages (e.g. 10 Minutes) the messsage is still logged to the local machine ( I write a second log to a local file) but no message reaches the server. all new messages are lost. if I restart the syslog deamon ill get messages again (but only new ones) I use Suse Linux 10.1 with syslog-ng (2.x) (client) I also compiled and tried 3.0.1 but git the same effect. any idea ? regards Jens-Peter C. Hillers

2 2