- syslog-ng - lists.balabit.hu

Upgrade from 1.6.11 to 2.0.7: Gotchas?
by Ivey, Chris 13 Jan '08

13 Jan '08

Folks, I need to upgrade my syslog-ng from 1.6.11 to 2.0.7 since we now are using devices with high resolution timestamps. As I inherited these machines, and had not worked with syslog-ng prior to getting them, I was wondering if anyone could let me know if there were any gotchas for the upgrade. Can I upgrade in place? Do I need to make backups of any files? Things of this nature. Thanks, all! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage

2 1

Re: [syslog-ng] SEC and syslog
by infosec＠gmail.com 11 Jan '08

11 Jan '08

I use the program destination because I log to files by date and sometimes a host system with a bad date screws things up. With program I'll see every message once and only once, see it right away and not have to worry about the pipe. I could see going with a pipe if you wanted to be able to restart syslog regularly (like if you had a mem leak or something), but program() is quick, reliable and easy. -----Original Message----- From: "Solis, Alex $EMC$" <axsolis(a)cps-ems.com> Subj: [syslog-ng] SEC and syslog Date: Thu Jan 10, 2008 8:30 am Size: 873 bytes To: <syslog-ng(a)lists.balabit.hu> I have been using syslog-ng and logdog.pl (http://caspian.dotconf.net/menu/Software/LogDog/) for quite some time but now want to move to SEC because of its thresholding and suppression features. I noticed that SEC can monitor files and does not necessarily need a FIFO pipe. I also noticed that syslog-ng can send logs directly to a program using the program() feature. My question is which is the best way to implement the syslog-ng to SEC conduit? Should I create a pipe and ask SEC to monitor that because its efficient? Should I simply ask SEC to monitor syslog-ng's destination file even though files are rotated every night? Or should I use syslog-ng's program() feature to send messages to SEC. I guess all will work but which is the best option. Thanks for any insight. Alex --- attachment noname 1.html --- --- message truncated ---

3 2

SEC and syslog
by Solis, Alex (EMC) 10 Jan '08

10 Jan '08

I have been using syslog-ng and logdog.pl (http://caspian.dotconf.net/menu/Software/LogDog/) for quite some time but now want to move to SEC because of its thresholding and suppression features. I noticed that SEC can monitor files and does not necessarily need a FIFO pipe. I also noticed that syslog-ng can send logs directly to a program using the program() feature. My question is which is the best way to implement the syslog-ng to SEC conduit? Should I create a pipe and ask SEC to monitor that because its efficient? Should I simply ask SEC to monitor syslog-ng's destination file even though files are rotated every night? Or should I use syslog-ng's program() feature to send messages to SEC. I guess all will work but which is the best option. Thanks for any insight. Alex

1 0

make fails with syslog-ng 2.0.6 --enable-source-spoof
by David Rice 08 Jan '08

08 Jan '08

I'm having problems with the make when installing syslog-ng 2.0.6 on Solaris 10 x86 The error is the following *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /tmp/syslog- ng-2.0.6/src *** Error code 1 The following command caused the error: set fnord $MAKEFLAGS; amf=$2; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src tests doc contrib solbuild tgzbuild'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || case "$amf" in *=*) exit 1;; *k*) fail=yes;; *) exit 1;; esac; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /tmp/syslog-ng-2.0.6 *** Error code 1 make: Fatal error: Command failed for target `all' I'm using the following for the config script ./configure --enable-spoof-source --enable-dynamic-linking CC=gcc LDFLAGS=-L/usr/local/lib I need the -enable-spoof-source to pass to another syslog device upstream. Thanks in advance for the help

2 4

syslog-ng 2.0.7 has been released
by devel＠balabit.hu 08 Jan '08

08 Jan '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.0.7 SUMMARY : new stable release DATE : Jan 8, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.0.7) has been released. For latest fixes in the 2.0.x branch you are recommended to upgrade to this version. CHANGES: 2.0.7 Thu, 03 Jan 2008 07:01:59 +0100 Bugfixes: * Fixed UNIX domain socket destinations on Solaris. * Fixed flow-control behaviour for follow-mode source files. * Added the "mark" keyword to be an alias of "mark_freq" for compatibility with syslog-ng 1.6. * Fixed message loss in destination files during configuration reloads if syslog-ng is heavily loaded. * Fixed a possible segmentation fault in the dns-cache-host() file parsing code for improperly formatted host files. * Fixed possible "Insufficient buffer space" errors in the STREAMS driver. * Fixed the starvation of the timer used to reap unused destination files, which could cause some files never to be closed under heavy load. * Fixed ISO timestamp parsing for timestamps that have no timezone information or have a too long fraction of a second portion. * Added a workaround for possible deadlocks on /proc/kmsg and user terminals. * Fixed program name parsing that caused problems for TAG values that include the '/' character. This problem was introduced by 2.0.6. Other changes: * The fsync() option was implemented. * Added support for file sources that do not exist at startup. * Added support the "--persist-file" configuration option. * Added support for timestamps used by some LinkSys routers. * Added loggen tool to generate syslog messages at the specified rate. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.0 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.0 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.0 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.0 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.0 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/

1 0

UDP Works, TCP Does Not
by Baxter, Scott 07 Jan '08

07 Jan '08

All, I am new to syslog-ng and want to use it for tcp remote logging, (without ssh at this time). I am testing from a Solaris 10 box, sending logging files to another Solaris 10 box. It sends them via udp just fine. But when I change that to TCP, no logging. Not finding much on the internet around this subject. If anybody has any info regarding this, please send my way. Thanks, Scott

2 2

rewrite log messages
by M. Braun syslog-ng 06 Jan '08

06 Jan '08

Hi, is there a way to make syslog-ng rewrite a log message before it is written to disk, e.g. to remove all sender and recipient fields the mail server did log? MB

3 2

datetime stamp of syslog-ng...
by Anant Athavale 02 Jan '08

02 Jan '08

Dear List, I am redirecting a system log of one server to a centralized log server running syslog-ng. When we redirect, syslog-ng adds its own datetime stamp before the actual log entry for each line. Due to this, one of the log processing software does not recognize the format and does not generate any reports. If I remove those 4 fields (Month Name, Date, Year and IP address) for ex: Jan 2 2008 10.10.10.10 (here 10.10.10.10 is the IP address of the system whose logs are getting stored in central log server) that log processing software works as expected and generates report. Is it possible that, I can block those fields getting recorded. If yes, how? and if not, what is the alternative? Regards, Anant Athavale.

2 4

[BUG] non-existing program destinations
by Ortwin Glück 31 Dec '07

31 Dec '07

Hi, I discovered a problem in syslog-ng-2.0.6. In my Gentoo installation there were some default program destinations configured: destination mail-alert { program("/usr/local/bin/syslog-mail"); }; destination mail-alert-perl { program("/usr/local/bin/syslog-mail-perl"); }; But these programs do not exist in my installation. strace shows that syslog-ng is looping while trying to start these processes: --- SIGCHLD (Child exited) @ 0 (0) --- sigreturn() = ? (mask now []) close(6) = 0 fcntl64(13, F_GETFL) = 0x1 (flags O_WRONLY) fcntl64(13, F_SETFL, O_WRONLY|O_NONBLOCK) = 0 waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 127}], WNOHANG) = 19922 close(7) = 0 pipe([6, 7]) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7ca2708) = 19927 --- SIGCHLD (Child exited) @ 0 (0) --- sigreturn() = ? (mask now []) close(6) = 0 fcntl64(7, F_GETFL) = 0x1 (flags O_WRONLY) fcntl64(7, F_SETFL, O_WRONLY|O_NONBLOCK) = 0 waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 127}], WNOHANG) = 19924 close(8) = 0 pipe([6, 8]) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7ca2708) = 19928 --- SIGCHLD (Child exited) @ 0 (0) --- sigreturn() = ? (mask now []) close(6) = 0 fcntl64(8, F_GETFL) = 0x1 (flags O_WRONLY) fcntl64(8, F_SETFL, O_WRONLY|O_NONBLOCK) = 0 waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 127}], WNOHANG) = 19926 close(13) = 0 pipe([6, 13]) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7ca2708) = 19929 Sending it a HUP makes the situation even worse (I think it just starts another loop) and syslog-ng consumes considerable CPU time after that. syslog-ng ought to check if the file exists before trying clone(). Maybe also a warning would help to spot the config problem (there is none, even with the -d flag). But like this it is really hard to find the problem. Cheers Ortwin Glück

2 1

Can TAG field be terminated by space?
by Tsurusawa Takeshi 31 Dec '07

31 Dec '07

Hi, I'm using syslog-ng-2.0.5 and trying to store syslog messages into a DB table with a TAG field column. But when TAG fileld is terminated with space character(' ') in syslog message, syslog-ng parser returns as TAG field not only TAG field but also some extra strings end with a colon(':') in CONTENT field. For example, if MSG part is "program abc: message...", syslog-ng returns "program abc" as a TAG field. According to the section 4.1.3 of RFC3164, a space character can also terminate a TAG field. The TAG is a string of ABNF alphanumeric characters that MUST NOT exceed 32 characters. Any non-alphanumeric character will terminate the TAG field and will be assumed to be the starting character of the CONTENT field. Most commonly, the first character of the CONTENT field that signifies the conclusion of the TAG field has been seen to be the left square bracket character ("["), a colon character (":"), or a space character. Is it possible to change this behavior of syslog-ng? Thanks in advance. -- Tsurusawa Takeshi <tsuru(a)grid.nii.ac.jp>

3 6