- syslog-ng - lists.balabit.hu

Appending values to Structured-Data
by Christian Haase 11 Mar '09

11 Mar '09

Hi, I want to send apache2 messages via tcp to my syslog server using syslog-ng3 with the IETF-Message format. I specified a source which uses file("/var/log/apache2/access.log" flags(no-parse) follow-freq(5)) to fetch the log data. So the orginating apache message keeps untouched and can be found in the MSG part. This message is packed into the IETF-Frame with the destination syslog("..." transport("tls") ... ) On server-side I want to "unpack" the message again to reconstruct the original format of the access.log. The main problem is to decide the source of the message to write it into the right file (multiple webservers will log this way). I wanted to solve this problem by setting the unused IETF-Message Headers to the values the identify them. For example I wanted to append a string like "www=my.web.site" to the Structured Data. These information then would be interpreted and the corresponding file will be used. Is there a way the set these fields and use them on the destination server in filters? Dear, Christian Haase -- ifu Hamburg - material flows and software ifu Institut fuer Umweltinformatik Hamburg GmbH Grosse Bergstrasse 219, 22767 Hamburg, Germany Managing Director: Jan Hedemann, Commercial Register: Hamburg, HRB 52629 www.ifu.com - www.umberto.de - www.sabento.com - www.e-sankey.com >>> e!Sankey - software for easy drawing of Sankey diagrams. >>> Visit http://www.e-sankey.com

2 1

[Bug 30] New: file() on fifo hangs syslog-ng
by bugzilla＠bugzilla.balabit.com 11 Mar '09

11 Mar '09

https://bugzilla.balabit.com/show_bug.cgi?id=30 Summary: file() on fifo hangs syslog-ng Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: enhancement Estimated Hours: 0.0 file() on fifo (made by mkfifo) causes syslog-ng to hang and eat memory. Could some checks be added to prevent such misconfiguration? -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

Error in syslog-ng Open Source Edition 3.0.1 configuration stage
by Ritesh Sood 10 Mar '09

10 Mar '09

Please take a look at the following snippet that ./configure outputs. In particular, the spurious text between "compiler options" and "linker flags" is due to libnet-config. Thing is, this bit of text is creeping into the Makefiles and compilation fails. My efforts at troubleshooting follow the snippet. ----------------start code--------------------------------- checking for TCP wrapper library... -lwrap checking for OPENSSL... yes checking for dlsym in -ldl... yes checking for inflate in -lz... yes checking for dlsym in -ldl... (cached) yes checking for LIBDBI... yes checking for LIBNET... Unknown option: - Unknown option: e Unknown option: f Unknown option: - Unknown option: l yes checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable SQL support... yes checking whether to enable Linux capability support... yes checking whether to enable PCRE support... yes checking for pkg-config... (cached) /usr/bin/pkg-config checking pkg-config is at least version 0.14... yes checking for GLIB - version >= 2.10.1... yes (version 2.12.3) checking for EVTLOG... yes checking for LIBNET... Unknown option: - Unknown option: e Unknown option: f Unknown option: - Unknown option: l yes checking for static GLib libraries... yes checking sanity checking Glib headers... yes configure: creating ./config.status config.status: creating dist.conf config.status: creating Makefile config.status: creating syslog-ng.spec.bb config.status: creating src/Makefile config.status: creating doc/Makefile config.status: creating doc/docvars.xml config.status: creating contrib/Makefile config.status: creating tests/Makefile config.status: creating debian/Makefile config.status: creating tgz2build/Makefile config.status: creating tests/unit/Makefile config.status: creating tests/functional/Makefile config.status: creating tests/loggen/Makefile config.status: creating config.h config.status: config.h is unchanged config.status: executing depfiles commands syslog-ng Open Source Edition 3.0.1 configured Compiler options: compiler : gcc compiler options : -O3 -I/opt/system/include -Wall - pthread -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/opt/ system/include/eventlog -I/usr/kerberos/include daytime_hosts ftp_ext_passive 1 ftp_firewall ftp_int_passive 0 ftp_testhost inet_domain dept.univ.edu nntp_hosts ph_hosts pop3_hosts smtp_hosts snpp_hosts test_exist 1 test_hosts 1 time_hosts This script will prompt you to enter hostnames that can be used as defaults for some of the modules in the libnet distribution. To ensure that you do not enter an invalid hostname, I can perform a lookup on each hostname you enter. If your internet connection is via a dialup line then you may not want me to perform these lookups, as it will require you to be on-line. Do you want me to perform hostname lookups (y|n) ? [yes] The following questions all require a list of host names, separated with spaces. If you do not have a host available for any of the services, then enter a single space, followed by <CR>. To accept the default, hit <CR> Enter a list of available NNTP hosts : [] Enter a list of available SMTP hosts : [] Enter a list of available POP3 hosts : [] Enter a list of available SNPP hosts : [] Enter a list of available PH Hosts : [] Enter a list of available TIME Hosts : [] Enter a list of available DAYTIME Hosts : [] Do you have a firewall/ftp proxy between your machine and the internet If you use a SOCKS firewall answer no (y|n) ? [no] Normally when FTP needs a data connection the client tells the server a port to connect to, and the server initiates a connection to the client. Some setups, in particular firewall setups, can/do not work using this protocol. In these situations the client must make the connection to the server, this is called a passive transfer. Should all FTP connections be passive (y|n) ? [no] What is your local internet domain name : [dept.univ.edu] If you specified some default hosts above, it is possible for me to do some basic tests when you run `make test' This will cause `make test' to be quite a bit slower and, if your internet connection is via dialup, will require you to be on-line unless the hosts are local. Do you want me to run these tests (y|n) ? [yes] To allow Net::FTP to be tested I will need a hostname. This host should allow anonymous access and have a /pub directory What host can I use : [] Writing libnet.cfg -I/usr/dbi -I/usr/dbi/dbi -D_GNU_SOURCE - D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -L/opt/system/lib prefix : /opt Features: Sun STREAMS support : no Sun Door support : no Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : yes spoof-source support : yes tcp-wrapper support : yes SSL support : yes SQL support : yes Linux capability support : yes PCRE support : yes Env wrapper support : no ----------------end code--------------------------------- The following line in configure are responsible: ----------------start code------------------------------- { echo "$as_me:$LINENO: checking for LIBNET" >&5 echo $ECHO_N "checking for LIBNET... $ECHO_C" >&6; } if test "x$with_libnet" = "x"; then LIBNET_CONFIG="`which libnet-config`" else LIBNET_CONFIG="$with_libnet/libnet-config" fi if test -n "$LIBNET_CONFIG" -a -x "$LIBNET_CONFIG"; then LIBNET_CFLAGS="`$LIBNET_CONFIG --defines`" LIBNET_LIBS="`$LIBNET_CONFIG --libs`" { echo "$as_me:$LINENO: result: yes" >&5 echo "${ECHO_T}yes" >&6; } else LIBNET_LIBS= { echo "$as_me:$LINENO: result: no" >&5 echo "${ECHO_T}no" >&6; } fi ----------------end code--------------------------------- libnet-config it seems does not expect the arguments `` --defines" or ``--libs" and is outputting all the text above. See the following lines above? Unknown option: - Unknown option: e Unknown option: f Unknown option: - Unknown option: l Searching on the web reveals that libnet-config is outdated and should not even be present on modern linux systems. Pointers towards how to proceed from here much appreciated. Ritesh Sood

2 1

Re: [syslog-ng] Database field types
by Hahusseau, Thomas 09 Mar '09

09 Mar '09

Hi, I use different type of fields in my database and there is no issue with syslog-ng for writing logs inside. You just have to check that the data matches the types. Thomas -----Message d'origine----- De : syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] De la part de Liam Kirsher Envoyé : samedi 7 mars 2009 04:08 À : Syslog-ng users' and developers' mailing list Objet : [syslog-ng] Database field types Hi -- I notice that when the database tables get created all the fields are 'text' type. That is okay. However, it might in some cases be convenient for us to have different field types. Is there any problem with that? If we create the table with the desired field types, will that take care of it (assuming the data actually matches the type)? Liam -- Liam Kirsher PGP: http://liam.numenet.com/pgp/ ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

2 1

[Bug 36] New: tls crash when used as a syslog client
by bugzilla＠bugzilla.balabit.com 06 Mar '09

06 Mar '09

https://bugzilla.balabit.com/show_bug.cgi?id=36 Summary: tls crash when used as a syslog client Product: syslog-ng Version: 3.0.x Platform: All OS/Version: All Status: NEW Severity: critical Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bana(a)docisland.org Type of the Report: --- Estimated Hours: 0.0 There is a typo in the cfg-grammar.y file which prevents tls context initialization and then crash syslog-ng when used as a tls client. Here is the tiny patch: @@ -895,7 +895,7 @@ : dest_afinet_option | KW_TLS { -#if ENABLE_TLS +#if ENABLE_SSL last_tls_context = tls_context_new(TM_CLIENT); #endif } -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

Re: [syslog-ng] Syslog-ng 3.0.1 seg fault with TLS support
by Hahusseau, Thomas 05 Mar '09

05 Mar '09

Hi, Ok sorry I forgot to modify the .c source file. I don't have segmentation fault anymore. Just an issue with "unknown ca" in server logs, when client and server negotiate the tls transaction. I'll investigate it tomorrow. Thanks for your help; I suppose that you'll correct the typo in later builds of syslog-ng? Regards Thomas -----Message d'origine----- De : Hahusseau, Thomas Envoyé : jeudi 5 mars 2009 13:42 À : 'Syslog-ng users' and developers' mailing list' Objet : RE: [syslog-ng] Syslog-ng 3.0.1 seg fault with TLS support I changed it in the source and now the compilation crashed for cfg-grammar.y :( :( -----Message d'origine----- De : syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] De la part de Xavier Lapie Envoyé : jeudi 5 mars 2009 12:12 À : Syslog-ng users' and developers' mailing list Objet : Re: [syslog-ng] Syslog-ng 3.0.1 seg fault with TLS support On Thu, Mar 05, 2009 at 10:50:29AM +0100, Xavier Lapie wrote: > On Thu, Mar 05, 2009 at 10:44:03AM +0100, Hahusseau, Thomas wrote: > > Yeah I enable the debug mode and open the core file with gdb. I can see a > > huge backtrace with a lot of "index out of range" error inside. If you I can > > attach the backtrace on this mailing list. I found something which could solve your problem. The tls context is not initialized when used in client mode, there is a typo in the cfg-grammar.y file. Just go to the line 899 and replace ENABLE_TLS by ENABLE_SSL. -- Xavier ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

1 0

Re: [syslog-ng] Syslog-ng 3.0.1 seg fault with TLS support
by Hahusseau, Thomas 05 Mar '09

05 Mar '09

I changed it in the source and now the compilation crashed for cfg-grammar.y :( :( -----Message d'origine----- De : syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] De la part de Xavier Lapie Envoyé : jeudi 5 mars 2009 12:12 À : Syslog-ng users' and developers' mailing list Objet : Re: [syslog-ng] Syslog-ng 3.0.1 seg fault with TLS support On Thu, Mar 05, 2009 at 10:50:29AM +0100, Xavier Lapie wrote: > On Thu, Mar 05, 2009 at 10:44:03AM +0100, Hahusseau, Thomas wrote: > > Yeah I enable the debug mode and open the core file with gdb. I can see a > > huge backtrace with a lot of "index out of range" error inside. If you I can > > attach the backtrace on this mailing list. I found something which could solve your problem. The tls context is not initialized when used in client mode, there is a typo in the cfg-grammar.y file. Just go to the line 899 and replace ENABLE_TLS by ENABLE_SSL. -- Xavier ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng] Syslog-ng 3.0.1 seg fault with TLS support
by Hahusseau, Thomas 05 Mar '09

05 Mar '09

Yeah I enable the debug mode and open the core file with gdb. I can see a huge backtrace with a lot of "index out of range" error inside. If you I can attach the backtrace on this mailing list. -----Message d'origine----- De : Xavier Lapie [mailto:bana@docisland.org] Envoyé : jeudi 5 mars 2009 10:30 À : Hahusseau, Thomas Objet : Re: [syslog-ng] Syslog-ng 3.0.1 seg fault with TLS support On Thu, Mar 05, 2009 at 09:39:46AM +0100, Hahusseau, Thomas wrote: > > The seg fault is on the client side and occurred only when I enable the TLS > encryption (it works well with clean transmission). Anyone could help me to > fix that problem? If you need some additional information just let me know. Hi, Did you enable debugging code and what does gdb tell you about the crash ? -- Xavier

2 2

Syslog-ng 3.0.1 seg fault with TLS support
by Hahusseau, Thomas 05 Mar '09

05 Mar '09

Hi, I have a bad segmentation fault when I'm trying to launch syslog-ng version 3.0.1 on Mandriva 2009 used a as a syslog-ng client. I wan't that the messages are forwarded to another syslog-ng host in an encrypted way with TLS. I use a PEM formatted CA certificate on my client. And a self signed certificate (from the same CA) on the "server". The seg fault is on the client side and occurred only when I enable the TLS encryption (it works well with clean transmission). Anyone could help me to fix that problem? If you need some additional information just let me know. Thomas Hahusseau

1 0

permission denied ater adding a file as source-driver
by gatfi sami 04 Mar '09

04 Mar '09

Hi it is me again no one had answered my previous questions until now but i 'll never loose hope so here is another one I am killing my self to add a file as a source driver in syslog-ng repeat i installed 1.6.12-76.2 in open suse 11.0 i used > source my_src { > > #internal(); > > #file("/var/log/apache2/error_log"); > #perm(0666); > > #unix-dgram("/dev/log"); *see i tried alot of thing before i asked you* > file("/var/lib/mysql/mysqld.log"); > > > > > }; and here is the error Shutting down syslog services done Re-Starting syslog servicesError opening file /var/lib/mysql/mysqld.log for r*eading (Permission denied)* Error initializing configuration, exiting. I also tried to change the file's permission by the way is this the best way to log mysql arror log to a syslog client thks

2 1