- syslog-ng - lists.balabit.hu

syslog-ng 2.0 & 2.1 maintenance
by Balazs Scheidler 07 Feb '08

07 Feb '08

Hi, As there's a syslog-ng OSE 2.1 version available, the 2.0 branch is going to be put in strict maintenance mode, new bugfixes will first appear in the 2.1 version, 2.0 will receive only the less risky fixes and after sufficient testing in 2.1. Another question, I saw a couple of downloads for syslog-ng 2.1alpha1 release, but no feedback so far, I'd be interested in _any_ kind of success/failure reports, either syslog-ng or libdbi related. Thanks. -- Bazsi

1 0

Errorneous behaviour of syslog-ng v2.0.0 with logmessages in German
by Jewgenij.Belopilski＠alumni.TU-Berlin.DE 06 Feb '08

06 Feb '08

Hello, I use syslog-ng v2.0.0 and observe the following erroneous behaviour: If I specify a template for a target in syslog-ng.conf, a log-message, which contains letters specific to German language (Ä, ä, Ö, ö, Ü, ü), gets korrupted. Without specifying a template all works fine. The function in the source code, which corrupts log-messages is src/templates.c::log_template_format(...) Is this a bug? I appreciate each help.

1 0

Memory leaks...?
by Eiji Inatsu 05 Feb '08

05 Feb '08

Hi, My problem is that the memory usage of syslog-ngd increases continuously, and finally physical memory and swap spaces are exhausted. Is this a memory leak or not? My version # /usr/local/sbin/syslog-ng -V syslog-ng 2.0.2 My H/W and OS Solaris 10, sparc 64 This syslog-ng is running about 2 or 3 days until restarted. This host is central loghost and receives about 40GB data per day. Waiting for your reply. Thanks, -- // mailto: le.petit.planet(a)gmail.com

2 4

[Bug 18] New: random signal 6 in raise() from libc
by bugzilla＠bugzilla.balabit.com 05 Feb '08

05 Feb '08

https://bugzilla.balabit.com/show_bug.cgi?id=18 Summary: random signal 6 in raise() from libc Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: anders.henke(a)1und1.de Type of the Report: --- Estimated Hours: 0.0 On my central log server, syslog-ng 2.0.7 randomly aborts (signal 6); I haven't noticed this earlier (as syslog-ng is respawned from init), but according to 8 core dumps, it's always at the same function within libc; I wonder why only syslog-ng triggers this. # for I in core.syslog-ng.sig6.* ; do echo "# $I" ; echo quit | gdb /sbin/syslog-ng $I 2>&1 ; done > sig6 # grep raise sig6 #0 0x00007fea95e9a07b in raise () from /lib/libc.so.6 #0 0x00007f1cacf7807b in raise () from /lib/libc.so.6 #0 0x00007ffc4365d07b in raise () from /lib/libc.so.6 #0 0x00007f8f86a9407b in raise () from /lib/libc.so.6 #0 0x00007f45933aa07b in raise () from /lib/libc.so.6 #0 0x00007fcd9195007b in raise () from /lib/libc.so.6 #0 0x00007f01ea4bd07b in raise () from /lib/libc.so.6 #0 0x00007f83c135a07b in raise () from /lib/libc.so.6 Sample excerpt: # core.syslog-ng.sig6.16915 GNU gdb 6.4.90-debian Copyright (C) 2006 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "x86_64-linux-gnu"...Using host libthread_db library "/lib/libthread_db.so.1". Reading symbols from /lib/libnsl.so.1...done. Loaded symbols for /lib/libnsl.so.1 Reading symbols from /lib/librt.so.1...done. Loaded symbols for /lib/librt.so.1 Reading symbols from /lib/libc.so.6...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/libpthread.so.0...done. Loaded symbols for /lib/libpthread.so.0 Reading symbols from /lib/ld-linux-x86-64.so.2...done. Loaded symbols for /lib64/ld-linux-x86-64.so.2 Reading symbols from /lib/libnss_compat.so.2...done. Loaded symbols for /lib/libnss_compat.so.2 Reading symbols from /lib/libnss_nis.so.2...done. Loaded symbols for /lib/libnss_nis.so.2 Reading symbols from /lib/libnss_files.so.2...done. Loaded symbols for /lib/libnss_files.so.2 Failed to read a valid object file image from memory. Core was generated by `/sbin/syslog-ng -f /var/run/syslog-ng.conf.521 -F -p /var/run/syslog-ng.pid.521'. Program terminated with signal 6, Aborted. #0 0x00007fea95e9a07b in raise () from /lib/libc.so.6 (gdb) I'm running Debian Linux 4.0 (Etch) in 64-Bit-flavour. Syslog-NG 2.0.7 has been compiled using the supplied debian/rules file, except two changes: don't strip the symbol table from the binary and use --enable-debug. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

syslog-ng 2.0.8 has been released
by devel＠balabit.hu 04 Feb '08

04 Feb '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.0.8 SUMMARY : new stable release DATE : Jan 31, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.0.8) has been released. For latest fixes in the 2.0.x branch you are recommended to upgrade to this version. CHANGES: 2.0.8 Thu, 31 Jan 2008 12:38:21 +0100 Bugfixes: * Fixed a regression in 2.0.7 that caused destination files not to be reopened when syslog-ng was reloaded. This causes potential problems with log rotation. * Fixed DNS cache size checking, persistent DNS cache entries were also counted against dns_cache_size() which might decrease cache space significantly when a large /etc/hosts file is in use. * Fixed a bug that caused the persistent DNS cache (e.g. /etc/hosts) to be reloaded for all name resolution requests. Other changes: * Fixed sample configuration file for RedHat. * Some portability changes in loggen. * Added cygwin packaging files to contrib/cygwin-packaging. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.0 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.0 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.0 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.0 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.0 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/

3 2

[Bug 17] New: segfault in msg_send_internal_message
by bugzilla＠bugzilla.balabit.com 01 Feb '08

01 Feb '08

https://bugzilla.balabit.com/show_bug.cgi?id=17 Summary: segfault in msg_send_internal_message Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: anders.henke(a)1und1.de Type of the Report: bug Estimated Hours: 0.0 On my central log server, syslog-ng 2.0.7 randomly segfaults (signal 11); I haven't noticed this earlier (as syslog-ng is respawned from init), but according to 19 core dumps, it's always at the same position: # core.syslog-ng.sig11.16453 GNU gdb 6.4.90-debian Copyright (C) 2006 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "x86_64-linux-gnu"...Using host libthread_db library "/lib/libthread_db.so.1". Reading symbols from /lib/libnsl.so.1...done. Loaded symbols for /lib/libnsl.so.1 Reading symbols from /lib/librt.so.1...done. Loaded symbols for /lib/librt.so.1 Reading symbols from /lib/libc.so.6...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/libpthread.so.0...done. Loaded symbols for /lib/libpthread.so.0 Reading symbols from /lib/ld-linux-x86-64.so.2...done. Loaded symbols for /lib64/ld-linux-x86-64.so.2 Reading symbols from /lib/libnss_compat.so.2...done. Loaded symbols for /lib/libnss_compat.so.2 Reading symbols from /lib/libnss_nis.so.2...done. Loaded symbols for /lib/libnss_nis.so.2 Reading symbols from /lib/libnss_files.so.2...done. Loaded symbols for /lib/libnss_files.so.2 Failed to read a valid object file image from memory. Core was generated by `/sbin/syslog-ng -f /var/run/syslog-ng.conf.519 -F -p /var/run/syslog-ng.pid.519'. Program terminated with signal 11, Segmentation fault. #0 0x00000000004051d7 in msg_send_internal_message (prio=43, msg=0x0) at messages.c:59 59 m = log_msg_new(buf, strlen(buf), NULL, LP_INTERNAL | LP_LOCAL, NULL); (gdb) I'm running Debian Linux 4.0 (Etch) in 64-Bit-flavour. Syslog-NG 2.0.7 has been compiled using the supplied debian/rules file, except two changes: don't strip the symbol table from the binary and use --enable-debug. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

syslog-ng OSE 2.1alpha1
by Balazs Scheidler 31 Jan '08

31 Jan '08

Hi, As posted on my blog, I've released syslog-ng OSE 2.1alpha1, the first GPLd release that features native syslog-to-SQL capability. You can download the source code for OSE 2.1 from: http://www.balabit.com/downloads/files/syslog-ng/sources/2.1/src/ You'll need a patched libdbi/libdbi-drivers package also available at the download location and you have accessibility for all SQL servers that have an driver in libdbi. We've successfully tested MySQL, PostgreSQL, SQLite and Oracle, others will probably work, but are untested. The code in this "alpha" release has already been tested in the context of the commercial syslog-ng product, so I don't expect too much problems once it builds and starts. The configure script and the Makefiles might still have some surprises though. To configure the SQL destination, please read the current Administrator's Guide for syslog-ng, the chapter on SQL is here: http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/ch08s02.html#r… -- Bazsi

1 0

Win syslog-agent PRI
by Tiago Gomes da Silva Mendo 31 Jan '08

31 Jan '08

>On Mon, 2008-01-28 at 11:05 +0000, Tiago Gomes da Silva Mendo wrote: >> Hi, >> >> >> >> I have syslog-ng-premium-edition (2.1.8) on an Debian etch and >> multiple linuxs sending syslog messages to this server, using >> diferents PRIs. >> >> The problem is with the windows agent (2.1.4). In the windows agent I >> have an message format like this: "<182>$DATE $HOST $EVENT_SOURCE: >> $MSG", but at the server the received PRI is not 182. >> >> At the server I get messages with the correct PRI when the syslog-ng >> agent is restarted: >> >> >> >> "Jan 28 10:57:41 10.176.25.108 LogRelay: Application started", with >> local6 and info, but every message I send through syslog-ng agent >> arrives at the server with user/notice (PRI 13). > >Are you reading messages from files or you are sending out the EventLog >records? > >If my assumption is true, then the difference between the LogRelay entry >and the other messages is that the LogRelay entry is coming from the >EventLog, and the others come from files, right? > >I ask my collegue to look into this. > >-- >Bazsi You are rigth. The messages from the eventlog containers are getting to the server with the right PRI, but the ones from the files don't. Thanks

5 11

[Bug 6] New: syslog-ng dies after cron.daily
by bugzilla＠bugzilla.balabit.com 31 Jan '08

31 Jan '08

https://bugzilla.balabit.com/show_bug.cgi?id=6 Summary: syslog-ng dies after cron.daily Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=427791 OS/Version: Linux Status: NEW Severity: critical Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: bug Estimated Hours: 0.0 >From bugs.debian.org: Syslog-ng is dying repeatedly after logrotate runs. I believe that in most cases it continues to log to the original file, despite it having been rotated, though I am not 100% sure of this. Where it does continue running, it dies when the 2nd rotate occurs, where the logfile is gzipped. When trying to reproduce it manually, sending kill -HUP causes syslog-ng to die shortly after it gets a new PID. I am able to consistently reproduce this. No data is written to the new logfile until I manually restart syslog-ng For now, as a workaround, I have altered the post-rotate command to restart syslog-ng rather than reload. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

syslog-ng dnscache.c patch
by Steven McDougall 30 Jan '08

30 Jan '08

We enabled dns caching with a configuration like dns_cache_hosts(/etc/hosts), and found that syslog-ng was re-reading the hosts file every time it needed to resolve a host name. This patch fixed it. diff -ru syslog-ng-2.0.6/src/dnscache.c syslog-ng-2.0.6-patch/src/dnscache.c --- syslog-ng-2.0.6/src/dnscache.c 2007-04-19 15:37:16.000000000 -0400 +++ syslog-ng-2.0.6-patch/src/dnscache.c 2008-01-26 19:45:31.000000000 -0500 @@ -168,7 +168,9 @@ if (hosts) { gchar buf[4096]; - + + dns_cache_hosts_mtime = st.st_mtime; + while (fgets(buf, sizeof(buf), hosts)) { gchar *p, *ip;

2 1