- syslog-ng - lists.balabit.hu

[Bug 15] New: 2.0.6 is not compatible with previous version's config file
by bugzilla＠bugzilla.balabit.com 30 Dec '07

30 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=15 Summary: 2.0.6 is not compatible with previous version's config file Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: welz(a)fixe-post.de Type of the Report: bug Estimated Hours: 0.0 filter f_mail_count_incoming { program("postfix/smtp") and match("to=") and (match("@mydomain.de") or match("@MYDOMAIN.DE")) and not match("systemmeldung") and match("status=sent"); }; doesn't work since I upgraded from previos version (gentoo linux) However, when I change program("postfix/smtp") to program("postfix") it seems to work, but I have lots of rules and lots of computers, although you would say 12 is not much ;), and I wish to express that it would be absolutely helpful, if syntax changes could be mentioned in the changelog. Regards, Robert -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

Run 2 syslog-ng by defferent configurations
by Takenaka Kazuhiro 28 Dec '07

28 Dec '07

Hi all. I would like to run 2 syslog-ng instances in the same server and tried it, but encounterd a problem. I have some questions, please advise me something you know about this. Firstly, I run a syslog-ng 1.6.8 instance on Redhat EL4 update 5 by a install default configuration file. And then I run the other instance by the following configuration: ------------------------------------------------------------ source s_udp_9000 { udp(port(9000)); }; filter f_host_XXX { host ("[xX][xX][xX]11|172\.20\.100\.100"); }; destination d_udp_messages_XXX { file("/dbf/heartbeat/XXX.log" create_dirs(yes) perm(0640)); }; log { source(s_udp_9000); filter(f_host_XXX); destination(d_udp_messages_XXX); }; ------------------------------------------------------------ The operations proceeded as the following. # service syslog-ng start Starting system logger: [ OK ] # syslog-ng -p /var/run/syslog-ng-vip.pid -f syslog-ng-vip.conf Warning: No source refers to internal messages, they'll go to /dev/null My first question is : 1. Does syslog-ng 1.6.8 always handle internal messages ? I suspict it will cause odd behaviors on logging internal messages when multiple syslog-ng instances run on a server. Or are there some effective configurations to avoid this ? Next, I updated the version of syslog-ng to 2.0.4 and played same operations. No warnings were shown on the terminal. My second question is : 2. Can syslog-ng 2.0.4 ignore internal messages if the configurations specify that it shuld run so ? I think it means run multiple instances can run on a server safely. Or do some problems hide behind the silence ? =========================================================== I'd better to explain what makes me try such configurations I mentioned to help readers understand my demand. I plan to sent my servers' logs to a central syslog-ng server. To make my syslog-ng server a high avalable one, I decided to use Heartbeat as a HA manager to make a ACT/SBY syslog-ng cluster. I also decided to use shared disks so as to save external logs into them and make external log files be taken over on a failover by them. On the other hand, I intend to save central server's own logs into server's internal disks. I think it would be better to run 2 syslog-ng instances and assign one to handle internal logs and the other to handle external logs. The internal one shuld be managed by a rc script and the external should be managed by Heartbeat. The reason I think this way, or the reason I avoid handling all messages by one instance, is the following. Hearteat alway performs a stop operation on eash resources that Hearteat just attempt to failover. If Heartbeat manages the syslog-ng instance which handles all logs, and a failover is triggered by some reason except syslog-ng's own corruption, Heartbeat brings a stop to the syslog-ng instance. This means internal logging must stop in the very time some troubles occurs. It obviously is unpreferable. =========================================================== Sincerely. -- Takenaka Kazuhiro <takenaka.kazuhiro(a)oss.ntt.co.jp> NTT OSS Center

2 3

Solaris 9/SPARC patch for 2.0.6 (tests/unit/test_dnscache.c)
by Albert Chin 27 Dec '07

27 Dec '07

Solaris 9/SPARC needs sys/socket.h for AF_INET. Patch for tests/unit/test_dnscache.c attached. -- albert chin (china(a)thewrittenword.com)

2 1

[Bug 5] New: syslog-ng crashes when using fallback flag
by bugzilla＠bugzilla.balabit.com 27 Dec '07

27 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=5 Summary: syslog-ng crashes when using fallback flag Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: srainville(a)videotron.ca Type of the Report: --- Estimated Hours: 0.0 Tested on RHEL ES 4u5 32bit. Attached conf file. Used Nessus to scan system with all plugins enabled (even dangerous ones). Process quits but pid still exists. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

[Bug 9] New: syslog-ng crashes when /etc/eventlog.conf exists
by bugzilla＠bugzilla.balabit.com 27 Dec '07

27 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=9 Summary: syslog-ng crashes when /etc/eventlog.conf exists Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=447105 OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: bug Estimated Hours: 0.0 >From bugs.debian.org: When /etc/eventlog.conf exists and contains "[hello]" (for example), syslog-ng segfaults at start. Here is the end of strace output: uname({sys="Linux", node="naruto", ...}) = 0 brk(0) = 0x8088000 brk(0x80a9000) = 0x80a9000 open("/etc/localtime", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 fstat64(3, {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f7c000 read(3, "TZif\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\0\0\0\f\0"..., 4096) = 1082 close(3) = 0 munmap(0xb7f7c000, 4096) = 0 rt_sigaction(SIGPIPE, {SIG_IGN}, NULL, 8) = 0 rt_sigaction(SIGHUP, {0x804aae0, [], 0}, NULL, 8) = 0 rt_sigaction(SIGTERM, {0x804aaf0, [], 0}, NULL, 8) = 0 rt_sigaction(SIGINT, {0x804aaf0, [], 0}, NULL, 8) = 0 rt_sigaction(SIGCHLD, {0x804ab00, [], 0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {0x804ab10, [], SA_ONESHOT}, NULL, 8) = 0 gettimeofday({1192688001, 803861}, NULL) = 0 open("/etc/eventlog.conf", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=8, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f7c000 read(3, "[hello]\n", 4096) = 8 --- SIGSEGV (Segmentation fault) @ 0 (0) --- kill(12421, SIGSEGV) = 0 sigreturn() = ? (mask now []) --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ Process 12421 detached I did not find any documentation about /etc/eventlog.conf file. I have found this bug because such file was created by an unrelated application. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

[Bug 1] New: syslog-ng crashes when /etc/eventlog.conf exists
by bugzilla＠bugzilla.balabit.com 27 Dec '07

27 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=1 Summary: syslog-ng crashes when /etc/eventlog.conf exists Product: syslog-ng Version: 2.1.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bazsi(a)balabit.hu Estimated Hours: 0.0 Hi ! When /etc/eventlog.conf exists and contains "[hello]" (for example), syslog-ng segfaults at start. Here is the end of strace output: uname({sys="Linux", node="naruto", ...}) = 0 brk(0) = 0x8088000 brk(0x80a9000) = 0x80a9000 open("/etc/localtime", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 fstat64(3, {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f7c000 read(3, "TZif\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\0\0\0\f\0"..., 4096) = 1082 close(3) = 0 munmap(0xb7f7c000, 4096) = 0 rt_sigaction(SIGPIPE, {SIG_IGN}, NULL, 8) = 0 rt_sigaction(SIGHUP, {0x804aae0, [], 0}, NULL, 8) = 0 rt_sigaction(SIGTERM, {0x804aaf0, [], 0}, NULL, 8) = 0 rt_sigaction(SIGINT, {0x804aaf0, [], 0}, NULL, 8) = 0 rt_sigaction(SIGCHLD, {0x804ab00, [], 0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {0x804ab10, [], SA_ONESHOT}, NULL, 8) = 0 gettimeofday({1192688001, 803861}, NULL) = 0 open("/etc/eventlog.conf", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=8, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f7c000 read(3, "[hello]\n", 4096) = 8 --- SIGSEGV (Segmentation fault) @ 0 (0) --- kill(12421, SIGSEGV) = 0 sigreturn() = ? (mask now []) --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ Process 12421 detached I did not find any documentation about /etc/eventlog.conf file. I have found this bug because such file was created by an unrelated application. -- System Information: Debian Release: lenny/sid APT prefers unstable APT policy: (500, 'unstable'), (500, 'stable'), (1, 'experimental') Architecture: i386 (i686) Kernel: Linux 2.6.22-2-686-bigmem (SMP w/2 CPU cores) Locale: LANG=fr_FR@euro, LC_CTYPE=fr_FR@euro (charmap=ISO-8859-15) Shell: /bin/sh linked to /bin/bash Versions of packages syslog-ng depends on: ii libc6 2.6.1-5 GNU C Library: Shared libraries Versions of packages syslog-ng recommends: ii logrotate 3.7.1-3 Log rotation utility -- no debconf information -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 10] New: Option mark() not working
by bugzilla＠bugzilla.balabit.com 27 Dec '07

27 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=10 Summary: Option mark() not working Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=425018 OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: bug Estimated Hours: 0.0 >From bugs.debian.org: syslog-ng.conf(5) states that mark(n) is not implemented yet but mark-lines are printed to syslog. mark(0) should disable that but gives an error during syntax-check. If one writes mark_freq() to config it works. So, at least the manpage should be updated. Second quirk: mark_freq(0) does not disable printing of mark-lines, instead it really floods the syslog with mark-lines. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 8] New: syslog-ng hangs writing to /dev/ttyN
by bugzilla＠bugzilla.balabit.com 27 Dec '07

27 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=8 Summary: syslog-ng hangs writing to /dev/ttyN Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=397650 OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=4) --> (https://bugzilla.balabit.com/attachment.cgi?id=4) Patch to prevent hanging >From bugs.debian.org: (This is the same problem reported against syslog-ng in Gentoo at https://bugs.gentoo.org/show_bug.cgi?id=154465 -- this contains a patch which fixes the problem with a similar approach to that taken in sysklogd.) When syslog-ng writes to a tty under Linux, for example as a result of a usertty directive, the write syscall to /dev/ttyN can ocassionally block indefinitely. One situation when this occurs is when the user has set XOFF (perhaps with Ctrl-S or Scroll Lock). Aside from the fact that this obvious prevents any further log messages from being written, /dev/log's buffer eventually fills up causing other programs to block writing to /dev/log. In extremis, this can render a machine inaccesible when ssh, etc., all block preventing access. Reproducible: Always Steps to Reproduce: 1. Check that there is a usertty("*") directive for (say) kern.emerg logs 2. Ensure syslog-ng is running 3. On console, press Scroll Lock 4. Log something, e.g. logger -p kern.emerg 'Foo'. 5. Repeat #4 many times; eventually it will hang trying to log -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 7] New: Syslog-ng doesn' t send to *any* remote host when one of them isn't reachable
by bugzilla＠bugzilla.balabit.com 27 Dec '07

27 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=7 Summary: Syslog-ng doesn't send to *any* remote host when one of them isn't reachable Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=452249 OS/Version: Linux Status: NEW Severity: critical Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: bug Estimated Hours: 0.0 >From bugs.debian.org: Hi, I'm using syslog-ng to have a bunch of webservers log to remote syslog-servers. I have defined them on the webservers like this; destination remote_logging { tcp("10.10.10.1" port(1999)); }; destination remote_logging { tcp("10.10.10.2" port(1999)); }; Which works fine as long as both the remote servers are reachable. The moment one of them is unreachable, syslog-ng starts complaining about it in the logging: Nov 21 11:46:34 web01 syslog-ng[9892]: Connection broken to AF_INET(10.10.10.2:1999), reopening in 10 seconds But at this moment it doesn't log to the other remote syslog-ng server either, which makes the setup useless. I could not find a configuration-feature to prevent this from happening, am I overlooking something? thanks a lot, Roel. -- System Information: Debian Release: 3.1 Architecture: i386 (i686) Kernel: Linux 2.6.17-mp20070417 Locale: LANG=en_US, LC_CTYPE=en_US (charmap=ISO-8859-1) Versions of packages syslog-ng depends on: ii libc6 2.3.2.ds1-22sarge5 GNU C Library: Shared libraries an ii util-linux 2.12p-4sarge1 Miscellaneous system utilities -- no debconf information -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

unable to compile on AIX
by Anant Athavale 27 Dec '07

27 Dec '07

Dear List: I am unable to compile syslog-ng on AIX 5.3. I am using the following command to configure. configure EVTLOG_LIBS=-L/usr/local/lib EVTLOG_CFLAGS=-I/usr/local/include/eventlog --enable-static-linking --prefix=/usr/local/syslog-ng When I run make, I get the following error: Sorry for another post. I am giving the complete error here. ----------------------------------------------------------------------- Making all in src gcc -g -O2 -Wall -L/usr/local/lib -o syslog-ng main.o libsyslog-ng.a -static -lnsl -lrt -lfl -L/opt/freeware/lib -lglib-2.0 -lintl -liconv -L/usr/local/lib ld: 0711-340 SEVERE ERROR Symbol yyout in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yyin in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yyin in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yyout in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yyout in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yyout in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. collect2: ld returned 12 exit status make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 2. Stop. ---------------------------------------------------------------------------- Please let me know, how to proceed. TIA. Regards, Anant Athavale.

2 1