- syslog-ng - lists.balabit.hu

rc2 segfaults under linux
by Harry Hoffman 14 Sep '06

14 Sep '06

Hi All, So I decided to upgrade to rc2 to deal with the fixes for reported memory leaks. Unfortunately, it now segfaults :-( Operating environment is Redhat AS3 update 8. eventlog and syslog-ng v2 rc2 are configured with default options. running under strace I see: poll([{fd=10, events=POLLOUT, revents=POLLOUT}, {fd=9, events=POLLOUT, revents=P OLLOUT}, {fd=11, events=POLLOUT, revents=POLLOUT}, {fd=12, events=POLLOUT, reven ts=POLLOUT}, {fd=13, events=POLLOUT, revents=POLLOUT}, {fd=4, events=POLLIN}, {f d=6, events=POLLIN}, {fd=8, events=POLLIN, revents=POLLIN}, {fd=3, events=POLLIN }, {fd=5, events=POLLIN}, {fd=7, events=POLLIN}], 11, 29882) = 6 write(10, "Sep 13 13:36:47 local_s(a)scribe.i"..., 105) = 105 write(10, "Sep 13 13:36:47 host.fq.dn"..., 139) = 139 write(10, "Sep 13 13:36:47 host.fq.dn"..., 195) = 195 write(10, "Sep 13 13:36:47 host.fq.dn"..., 204) = 204 write(10, "Sep 13 13:36:47 host.fq.dn"..., 97) = 97 write(10, "Sep 13 13:36:47 host.fq.dn"..., 115) = 115 --- SIGSEGV (Segmentation fault) @ 0 (0) --- getpid() = 11482 kill(11482, SIGSEGV) = 0 sigreturn() = ? (mask now []) --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ Process 11482 detached Any thoughts? I wanted to do more debugging but I need to get a test system together for that. Cheers, Harry

2 3

Re: syslog-ng-2.0rc1 doesn't log hostaddress using ipv6
by Bruce Penrod 13 Sep '06

13 Sep '06

> On Mon, 11 Sep 2006 12:00:09 +0200 (CEST), > syslog-ng-request(a)lists.balabit.hu > wrote: > > >On Thu, 2006-08-10 at 19:06 -0700, Bruce Penrod wrote: > >> I'm using the unpatched syslog-ng-2.0rc1. When logging messages sent > >> from another machine over udp6, the hostname of the sending machine is > >> not logged and the receiving host's name is logged instead, so that it > >> looks like the message was generated locally. When using udp, it > works > >> fine. > >> > > > >Can you check if the patch below works for you? It seems to work for me, > >however I don't have a live IPv6 environment. > > > >--- orig/src/misc.c > >+++ mod/src/misc.c > >@@ -127,37 +127,56 @@ gboolean > > resolve_hostname(GString *result, GSockAddr *saddr, gboolean usedns, > gboolean usefqdn) > > { > > static gchar local_hostname[256] = ""; > >- char *hname, *p; > >+ char *hname, *p, buf[256]; > > > >- if (saddr && saddr->sa.sa_family == AF_INET) > >+ if (saddr) > > { > >- struct sockaddr_in *inet_addr = (struct sockaddr_in *) &saddr->sa; > >- > >- /* FIXME: add nscache support here */ > >- > >- if (usedns) > >- { > >- struct hostent *hp; > >- > >- hp = gethostbyaddr((char *) &(inet_addr->sin_addr), > >- sizeof(struct in_addr), AF_INET); > >- hname = (hp && hp->h_name) ? hp->h_name : NULL; > >- } > >+ if (saddr->sa.sa_family == AF_INET || saddr->sa.sa_family == > AF_INET6) > >+ { > >+ void *addr; > >+ socklen_t addr_len; > >+ > >+ if (saddr->sa.sa_family == AF_INET) > >+ { > >+ addr = &((struct sockaddr_in *) &saddr->sa)->sin_addr; > >+ addr_len = sizeof(struct in_addr); > >+ } > >+ else > >+ { > >+ addr = &((struct sockaddr_in6 *) &saddr->sa)->sin6_addr; > >+ addr_len = sizeof(struct in6_addr); > >+ } > >+ > >+ /* FIXME: add nscache support here */ > >+ > >+ if (usedns) > >+ { > >+ struct hostent *hp; > >+ > >+ hp = gethostbyaddr(addr, addr_len, saddr->sa.sa_family); > >+ hname = (hp && hp->h_name) ? hp->h_name : NULL; > >+ } > >+ else > >+ hname = NULL; > >+ > >+ if (!hname) > >+ { > >+ inet_ntop(saddr->sa.sa_family, addr, buf, sizeof(buf)); > >+ hname = buf; > >+ } > >+ else > >+ { > >+ if (!usefqdn) > >+ { > >+ p = strchr(hname, '.'); > >+ if (p) *p = 0; > >+ } > >+ } > >+ } > > else > >- hname = NULL; > >- > >- if (!hname) > >- { > >- hname = inet_ntoa(inet_addr->sin_addr); > >- } > >- else > >- { > >- if (!usefqdn) > >- { > >- p = strchr(hname, '.'); > >- if (p) *p = 0; > >- } > >- } > >+ { > >+ g_assert_not_reached(); > >+ } > > } > > else > > { > > > > > > > > > > > >-- > >Bazsi > > > Yes, it works, but only for about a minute and terminates silently. > Prior to > that, it does indeed log an ipv6 address properly for the sending host. I > haven't scrutinized your patch yet to see if there is an obvious pointer > problem. > > Thanks for getting it this far. > > Bruce Apparently the patch to rc1 did not take well, because I am now running the rc2 code (which seems to have the same ipv6 patch included) and everything seems OK so far. -- Bruce Penrod

1 0

Re: [syslog-ng] Tracking down a failure between NG and FIFO
by Rob Munsch 13 Sep '06

13 Sep '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Antonín Faltýnek wrote: > there is option log_fifo_size(); for syslog-ng that defines size of log queue > in number o messages, couldn't be you logserver overloaded? Yah possibly; in the absence of any other changes, some Event that spiked the volume would be what I expected to find. But i can't find anything in that time frame. > for mysql I'm not using fifo that's mentioned everywhere on inet by I call > mysql as program (I've different table layout): What version does that start appearing in? I've still got 1.6.9 - i was considering upgrading to the 2.0 branch, but not until I understand what happened here. Thanks for the info. It's working now; took down stunnel, syslog, and mysql, stared hard at all the configs for a bit, brought it all back up. Started working again. I'd feel better if i knew why it is working now, even more than finding out what broke before. > Tonda Faltynek > ------------------------------------------------------------ > You can do that without any technological mambo-jumbo... - -- Rob Munsch Solutions For Progress IT www.solutionsforprogress.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFCDbhBvBcJFK6xYURAtz2AJ90qQYUQn9sgPLfYawnjk2e97C1agCaApT1 Abv2dUK1DWHHcK2e+J8KD14= =EM0z -----END PGP SIGNATURE-----

1 0

Re: [syslog-ng] syslog-ng-2.0rc1 doesn't log hostaddress using ipv6
by Bruce M. Penrod 13 Sep '06

13 Sep '06

On Mon, 11 Sep 2006 12:00:09 +0200 (CEST), syslog-ng-request(a)lists.balabit.hu wrote: >On Thu, 2006-08-10 at 19:06 -0700, Bruce Penrod wrote: >> I'm using the unpatched syslog-ng-2.0rc1. When logging messages sent >> from another machine over udp6, the hostname of the sending machine is >> not logged and the receiving host's name is logged instead, so that it >> looks like the message was generated locally. When using udp, it works >> fine. >> > >Can you check if the patch below works for you? It seems to work for me, >however I don't have a live IPv6 environment. > >--- orig/src/misc.c >+++ mod/src/misc.c >@@ -127,37 +127,56 @@ gboolean > resolve_hostname(GString *result, GSockAddr *saddr, gboolean usedns, gboolean usefqdn) > { > static gchar local_hostname[256] = ""; >- char *hname, *p; >+ char *hname, *p, buf[256]; > >- if (saddr && saddr->sa.sa_family == AF_INET) >+ if (saddr) > { >- struct sockaddr_in *inet_addr = (struct sockaddr_in *) &saddr->sa; >- >- /* FIXME: add nscache support here */ >- >- if (usedns) >- { >- struct hostent *hp; >- >- hp = gethostbyaddr((char *) &(inet_addr->sin_addr), >- sizeof(struct in_addr), AF_INET); >- hname = (hp && hp->h_name) ? hp->h_name : NULL; >- } >+ if (saddr->sa.sa_family == AF_INET || saddr->sa.sa_family == AF_INET6) >+ { >+ void *addr; >+ socklen_t addr_len; >+ >+ if (saddr->sa.sa_family == AF_INET) >+ { >+ addr = &((struct sockaddr_in *) &saddr->sa)->sin_addr; >+ addr_len = sizeof(struct in_addr); >+ } >+ else >+ { >+ addr = &((struct sockaddr_in6 *) &saddr->sa)->sin6_addr; >+ addr_len = sizeof(struct in6_addr); >+ } >+ >+ /* FIXME: add nscache support here */ >+ >+ if (usedns) >+ { >+ struct hostent *hp; >+ >+ hp = gethostbyaddr(addr, addr_len, saddr->sa.sa_family); >+ hname = (hp && hp->h_name) ? hp->h_name : NULL; >+ } >+ else >+ hname = NULL; >+ >+ if (!hname) >+ { >+ inet_ntop(saddr->sa.sa_family, addr, buf, sizeof(buf)); >+ hname = buf; >+ } >+ else >+ { >+ if (!usefqdn) >+ { >+ p = strchr(hname, '.'); >+ if (p) *p = 0; >+ } >+ } >+ } > else >- hname = NULL; >- >- if (!hname) >- { >- hname = inet_ntoa(inet_addr->sin_addr); >- } >- else >- { >- if (!usefqdn) >- { >- p = strchr(hname, '.'); >- if (p) *p = 0; >- } >- } >+ { >+ g_assert_not_reached(); >+ } > } > else > { > > > > > >-- >Bazsi Yes, it works, but only for about a minute and terminates silently. Prior to that, it does indeed log an ipv6 address properly for the sending host. I haven't scrutinized your patch yet to see if there is an obvious pointer problem. Thanks for getting it this far. Bruce Bruce Penrod EndRun Technologies LLC "Smarter Timing Solutions" www.endruntechnologies.com 1360 N. Dutton Ave. Suite 200 Santa Rosa, CA 95401 707-573-8633 TEL 707-573-8619 FAX

1 0

Tracking down a failure between NG and FIFO
by Rob Munsch 12 Sep '06

12 Sep '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, i've had a running central loghost server for months on end without any problems. I've noticed however that something seems to have died and i can't pinpoint any changes made to any of the involved systems. After some testing, the central logserver is getting remote messages via stunnel; syslog-ng is logging locally; and if i tell it to put everything into a file, the remote as well as local log entries appear in the file. MySQL seems to be running and that end seems OK. The point of failure seems to be that syslog-ng is no longer putting anything into the named pipe. MySQL is patiently waiting for something to appear there to read; syslog-ng will log to any other destination; but the pipe destination does not seem to be working. How can i observe this process? I can't figure out how to "see" -ng's attempts to log to the pipe destination. The destination definition in question is - ----- # Local MySQL desination destination d_mysql { pipe("/var/run/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, timestamp, program, msg, seq) VALUES ( '$HOST','$FACILITY','$PRIORITY','$LEVEL','$TAG','$ISODATE','$PROGRAM','$MSG','$SEQ' );\n") template_escape(yes) ); }; - ----- exactly as it has been for months. The log directives are - ----- # Sending everything to the MySQL table... log { source(s_all); destination(d_mysql); }; # ... and send incoming logs there as well. log { source(stunnel); destination(d_mysql); ### destination(df_messages); was testing. }; - ----- As you can see by the commented line above, i had remote logs going to local messages dest: that worked fine. Instant results. Any help would be appreciated, as i'm kind of at a loss. - -- Rob Munsch Solutions For Progress IT www.solutionsforprogress.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFBwmVBvBcJFK6xYURAuJnAJ4lKg+94OhZpOvoLsaYcoSAsKoOcgCeLies XXlL1qf/mXl/262LLXBEelg= =ajlW -----END PGP SIGNATURE-----

1 1

syslog-ng 2.0rc2 core
by Martin, David M 12 Sep '06

12 Sep '06

2.0rc2 compiled fine on rhel4 host. same config file as in use w/ 2.0rc1. syntax-only check returns no errors. core dumps on execute. here's the gdb output. (gdb) quit # gdb ./syslog-ng core.1584 GNU gdb Red Hat Linux (6.3.0.0-1.96rh) Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux-gnu"...Using host libthread_db library "/lib/tls/libthread_db.so.1". Core was generated by `./syslog-ng -dvy'. Program terminated with signal 11, Segmentation fault. Reading symbols from /lib/libnsl.so.1...done. Loaded symbols for /lib/libnsl.so.1 Reading symbols from /lib/tls/librt.so.1...done. Loaded symbols for /lib/tls/librt.so.1 Reading symbols from /usr/lib/libglib-2.0.so.0...done. Loaded symbols for /usr/lib/libglib-2.0.so.0 Reading symbols from /opt/sfw/eventlog/0.2.5/lib/libevtlog.so.0...done. Loaded symbols for /opt/sfw/eventlog/0.2.5/lib/libevtlog.so.0 Reading symbols from /lib/tls/libc.so.6...done. Loaded symbols for /lib/tls/libc.so.6 Reading symbols from /lib/tls/libpthread.so.0...done. Loaded symbols for /lib/tls/libpthread.so.0 Reading symbols from /lib/ld-linux.so.2...done. Loaded symbols for /lib/ld-linux.so.2 Reading symbols from /lib/libnss_files.so.2...done. Loaded symbols for /lib/libnss_files.so.2 Reading symbols from /lib/libnss_dns.so.2...done. Loaded symbols for /lib/libnss_dns.so.2 Reading symbols from /lib/libresolv.so.2...done. Loaded symbols for /lib/libresolv.so.2 #0 0x08054b76 in log_template_format (self=0x8a58f10, lm=0x8a5dea0, macro_flags=2, ts_format=0, zone_offset=-1, frac_digits=0, result=0x8a57148) at templates.c:126 126 e = (LogTemplateElem *) p->data; (gdb) bt full #0 0x08054b76 in log_template_format (self=0x8a58f10, lm=0x8a5dea0, macro_flags=2, ts_format=0, zone_offset=-1, frac_digits=0, result=0x8a57148) at templates.c:126 p = (GList *) 0x5f646261 e = (LogTemplateElem *) 0x17b1a4 #1 0x080552df in log_writer_format_log (self=0x8a5d5a0, lm=0x8a5dea0, result=0x8a57148) at logwriter.c:228 template = (LogTemplate *) 0x8a58f10 #2 0x0805557e in log_writer_flush_log (self=0x8a5d5a0, fd=0x8a58f30) at logwriter.c:314 lm = (LogMessage *) 0x8a5dea0 path_flags = 0 line = (GString *) 0x8a57148 rc = 1305628 #3 0x08055078 in log_writer_fd_dispatch (source=0x8a5d5e0, callback=0, user_data=0x0) at logwriter.c:143 self = (LogWriterWatch *) 0x8a5d5e0 #4 0x0012474b in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0 No symbol table info available. #5 0x001261d2 in g_main_context_acquire () from /usr/lib/libglib-2.0.so.0 No symbol table info available. #6 0x001266b8 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0 No symbol table info available. #7 0x0804b3e4 in main_loop_run (cfg=0x8a50ec8) at main.c:162 main_loop = (GMainLoop *) 0x8a590c0 iters = 145034952 stats_timer_id = 5 #8 0x0804baac in main (argc=2, argv=0xbfed92c4) at main.c:420 cfg = (GlobalConfig *) 0x8a50ec8 syslog_ng_options = {{name = 0x805d23b "cfgfile", has_arg = 1, flag = 0x0, val = 102}, {name = 0x805d243 "pidfile", has_arg = 1, flag = 0x0, val = 112}, {name = 0x805d24b "debug", has_arg = 0, flag = 0x0, val = 100}, {name = 0x805d251 "syntax-only", has_arg = 0, flag = 0x0, val = 115}, {name = 0x805d25d "verbose", has_arg = 0, flag = 0x0, val = 118}, {name = 0x805d265 "foreground", has_arg = 0, flag = 0x0, val = 70}, {name = 0x805d270 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x805d17a "version", has_arg = 0, flag = 0x0, val = 86}, {name = 0x805d275 "chroot", has_arg = 1, flag = 0x0, val = 67}, {name = 0x805d27c "user", has_arg = 1, flag = 0x0, val = 117}, { ---Type <return> to continue, or q <return> to quit--- name = 0x805d281 "group", has_arg = 1, flag = 0x0, val = 103}, { name = 0x805d287 "stderr", has_arg = 0, flag = 0x0, val = 101}, { name = 0x805d28e "yydebug", has_arg = 0, flag = 0x0, val = 121}, { name = 0x0, has_arg = 0, flag = 0x0, val = 0}} syntax_only = 0 log_to_stderr = 0 opt = -1 rc = 134520085 The information transmitted (including attachments) is covered by the Electronic Communications Privacy Act, 18 U.S.C. 2510-2521, is intended only for the person(s) or entity/entities to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient(s) is prohibited. If you received this in error, please contact the sender and delete the material from any computer.

2 1

Re: question regarding program name logs
by G.W. Haywood 12 Sep '06

12 Sep '06

Hi there, On Tue, 12 Sep 2006 Justin Randall wrote: > I am currently using Syslog-NG version 2.0rc1. > > I've noticed that sometimes when Syslog-NG is logging messages, it > prefixes something onto the program name which disrupts filters > while matching against a program name. For example, in some logs > for a program named "foo" I'll see logs in the form of "<15>foo" > which fail to be matched against a filter of 'program("foo") '. > This seems to only be noticed on logs which originate from remote > hosts. > > Could anyone provide an explanation for what is going on with this? I reported this problem a couple of weeks ago, and Balazs kindly provided a patch which fixed it. I imagine the patch is in .rc2, try upgrading. -- 73, Ged.

1 0

question regarding program name logs
by Justin Randall 12 Sep '06

12 Sep '06

Hello, I am currently using Syslog-NG version 2.0rc1. I've noticed that sometimes when Syslog-NG is logging messages, it prefixes something onto the program name which disrupts filters while matching against a program name. For example, in some logs for a program named "foo" I'll see logs in the form of "<15>foo" which fail to be matched against a filter of 'program("foo") '. This seems to only be noticed on logs which originate from remote hosts. Could anyone provide an explanation for what is going on with this? Regards, Justin Randall

2 1

syslog-ng 2.0rc2 released
by Balazs Scheidler 11 Sep '06

11 Sep '06

Hi, I'm proud to announce that syslog-ng 2.0rc2 has been released. Hopefully this is the last rc before 2.0.0 final. Here's the list of changes: 2.0rc2 Mon, 11 Sep 2006 12:06:30 +0200 Bugfixes: * Fixed a filter evaluation bug on platforms that have unsigned characters by default. * Fixed a denial of service problem when a zero sized UDP packet is received (was taken as an EOF and the input channel was closed). * Fixed NL handling for datagram transports. * Fixed IPv6 name resolution. * Fixed "Duplicate stats counter" message upon reload for program() destinations. * Fixed various memory leaks. -- Bazsi

2 1

Need Information on installing syslog-ng on Solaris 10
by Swenson, Jim 11 Sep '06

11 Sep '06

Hello. I am trying to find information on how to install syslog-ng on Solaris 10. I have been able to build syslog-ng 2.0rc1 from scratch and am now in the process of attempting to replace the Solaris syslog system with the syslog-ng I have built. The instructions for installing syslog-ng on Solaris 8 and Solaris 9 do not suffice since some of the files mentioned in these documents do not exist on Solaris 10 (specifically the start-up script for syslog). I have seen some mention in the archives of some people who have solved this Problem, but since the archives do not seem to have a search function, I cannot find the beginning of the threads so I can piece together what I ned to do. Also I am not a Solaris SysAdmin, although I have access to one. I have to build and deploy syslog-ng from source since if syslog-ng generates RFC3164 syslog message that cam be forwarded to a centralized syslog server, I will have to deploy it on machines running various flavors of Solaris (8 and 9), Linux, and FreeBSD. I thank you in advance for the help. -------------------------------------------------- James R. Swenson Information Technology Services The Pennsylvania State University jrs40(a)psu.edu, 814.863.1348

2 1