- syslog-ng - lists.balabit.hu

down network during reload leads to blocking syslog() calls
by Nathan Parrish 18 Apr '17

18 Apr '17

Hi there, we are using syslog-ng 3.6.4 on Linux. we had an incident where the network port used for remote logging was inadvertently disabled for a couple hours, and during this time a critical process which logged via syslog() calls experienced threads hanging for seconds to minutes at a time. after some investigation and reproduction efforts, it looks like the problem is a combination of: - remote logging to server specified by hostname (vs. IP) - loss of management interface (e.g. that used for syslog traffic and DNS resolution) - log rotate triggering syslog-ng reload when I reproduce the problem (seems to take some considerable amount of logging load and a minute or so), I can see that writes to /dev/log hang: root@escort-ct0:/etc# strace -ttT logger test ^C 19:38:46.064830 execve("/usr/bin/logger", ["logger", "test"], [/* 26 vars */]) = 0 <0.000135> ... 19:38:46.069757 socket(PF_LOCAL, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 1 <0.000015> 19:38:46.069806 connect(1, {sa_family=AF_LOCAL, sun_path="/dev/log"}, 110) = 0 <0.000010> 19:38:46.069850 sendto(1, "<13>Mar 20 19:38:46 root: test", 30, MSG_NOSIGNAL, NULL, 0) = 30 <11.627190> 19:38:57.697110 close(1)= 0 <0.000490> meanwhile I see the main thread timing out name resolution: 19:48:18.214182 stat("/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=148, ...}) = 0 <0.000008> 19:48:18.214234 socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 31 <0.000012> 19:48:18.214279 connect(31, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("10.15.83.11")}, 16) = 0 <0.000024> 19:48:18.214332 poll([{fd=31, events=POLLOUT}], 1, 0) = 1 ([{fd=31, revents=POLLOUT}]) <0.000006> 19:48:18.214370 sendto(31, "\343\235\1\0\0\1\0\0\0\0\0\0\rescdev-syslog\3dev\vpurestorage\3com\0\0\1\0\1", 51, MSG_NOSIGNAL, NULL, 0) = 51 <0.000047> 19:48:18.214444 poll([{fd=31, events=POLLIN}], 1, 5000) = 0 (Timeout) <5.005040> this repeats with the other DNS servers configured. I cannot reproduce the issue if I configure an IP instead of hostname for the syslog server. we are using UDP and no flow-control configuration, with the expectation that syslog() will never block. and, indeed, until the reload, it works as expected. however, after reload I guess we re-establish the socket for the remote connection, requiring us to resolve the hostname; I don’t pretend to understand how this ultimately backs up processing of /dev/log (note that internal() and kernel messages are coming through just fine during this time). I guess my question is whether this is a known/expected issue, and/or if there’s a resolution other than specifying remote syslog servers by IP or hardcoding the name resolution in /etc/hosts and pointing to that with dns-cache-hosts(). basically, I’d like syslog-ng to simply give up if it can’t resolve remote syslog server hostnames, rather than allow this to interfere with servicing of /dev/log, with ramifications to callers. thanks in advance, nathan

2 1

Insider 2017-04: Docker; Splunk HEC; Suricata; videos; upcoming events;
by Czanik, Péter 13 Apr '17

13 Apr '17

Dear syslog-ng users, This is the 57th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Central log server in Docker ---------------------------- Containerization, and Docker in particular, changed the way we distribute and run applications. Your central log server can also run in a Docker container. If you wish to deploy your log server running syslog-ng in a Docker container, it is available as a ready-to-use image from the Docker Hub, already passing 500K pulls. Read how at https://www.balabit.com/blog/central-log-server-docker/ Feeding the Splunk HTTP event collector --------------------------------------- Using the HTTP destination of syslog-ng, you can feed the Splunk HTTP event collector (HEC) with log messages. This can simplify your logging architecture, because there is no need to store data in files and to use a Splunk forwarder. Read more about how to configure it on the Splunk website at https://www.splunk.com/blog/2017/03/30/syslog-ng-and-hec-scalable-aggregate… syslog-ng PE 7.0.2 available ---------------------------- The latest syslog-ng Premium Edition release adds two interesting new features: you can write message parsers and template functions in Python and the monitoring() source allows you to granularly select which statistics of syslog-ng PE you want to monitor. https://www.balabit.com/blog/monitor-your-syslog-ng-architecture-easier/ Collecting and parsing Suricata logs ------------------------------------ You can use syslog-ng to collect and parse the JSON-based log messages of Suricata. Learn how you can send these logs to Loggly or Elasticsearch for further analysis or configure simple alerting within syslog-ng: https://www.balabit.com/blog/collecting-and-parsing-suricata-logs-using-sys… Tutorial videos --------------- Patrick Bailey (https://twitter.com/whiteboardcoder) created a couple of tutorial videos about syslog-ng. These cover installation and initial configuration on Ubuntu, opening a network port for collecting log messages and sending JSON-based log messages: - https://www.youtube.com/watch?v=DrfBU9nBeoE - https://www.youtube.com/watch?v=YAYfBteY0kg - https://www.youtube.com/watch?v=Uejb0agO2NU UPCOMING EVENTS You can learn about syslog-ng at a growing number of events: HEPIX Spring Workshop: https://indico.cern.ch/event/595396/ Big Data Universe: https://bdu.hu/ openSUSE conference: https://events.opensuse.org/conference/oSC17 NEW RELEASES syslog-ng PE 7.0.2: https://www.balabit.com/documents/syslog-ng-pe-7.0-guides/en/syslog-ng-pe-g… Your feedback and news, or tips about the next issue are welcome at documentation(a)balabit.com. To read this newsletter online, visit: https://syslog-ng.org/ Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0

syslog-ng buffer and reload
by Fabien Wernli 13 Apr '17

13 Apr '17

Hi, I'm using the disk queue to buffer the writes to elasticsearch. I notices the following behaviour: When reloading the configuration (`syslog-ng-ctl reload`), syslog-ng stops processing incoming messages (they appear as `dropped` in stats) and starts emptying the queue. It only starts accepting new messages when the queue is completely empty. I understand this is probably an expected behaviour, but in the following scenario (I just experienced) it poses a problem: 1. some application goes bananas logging at zillions of events per second 2. syslog-ng queue starts filling up 3. crazy app identified: I modify syslog-ng.conf in order to filter out the app 4. syslog-ng-ctl reload 5. syslog-ng starts dropping all new messages and emptying the queue 6. I have to wait for the queue to be empty (which can take a long time) Wouldn't it be saner to continue accepting messages when intercepting the HUP?

4 6

is it exist some way to extract the filename listened by file() ?
by Jorge Pereira 08 Apr '17

08 Apr '17

Hi Team, Well, I am working on a POC using the syslog-ng 3.7.1, basically, I have many of log files that the filename is /path/<file> and I need to append the file name into the syslog payload. My current approach is. 1. I have the below destination() receiving the file name as a parameter. <snip> block destination d_collector_with_fn(__filename("")) { tcp("192.168.2.44" port(514) keep-alive(on) template("$DATE $HOST $MSGHDR $(format-json --scope selected_macros \ --exclude TAGS \ --exclude DATE \ --exclude PRIORITY \ --exclude FACILITY \ --exclude SOURCEIP \ --exclude PROGRAM \ --pair SYSLOG_WEBAPP_DOMAIN='`__filename`' \ --pair SOURCE=${SOURCE} )\n") template-escape(no) ); }; </snip> 2. My simple script called by confgen create some dynamic "log {}" statements listening to the files and appending the filename as a parameter to the d_collector_with_fn() <snip> log { source { file("/path/thisisafile001.net" program_override("mytag") follow_freq(1) flags(no-parse) ); }; destination { d_collector_with_fn(__filename("thisisafile001.net")); }; }; log { source { file("caipirinha4ever.net" program_override("mytag") follow_freq(1) flags(no-parse) ); }; destination { d_collector_with_fn(__filename("caipirinha4ever.net")); }; }; ......................... </snip> But, I have more than 5k files and my current approach creating multiples log { } statement resulting in one connection to the collector by each file!!! in this case, I have 5k connections... this is terrible, someone has some other suggestion? exist some way to catch the filename by some internal ${variable} and pass for a single destination()? -- Jorge Pereira

3 7

set mysql charset & collation
by Nik Ambrosch 04 Apr '17

04 Apr '17

I’m having a hard time getting the charset and collation of mysql tables set with syslog-ng: it needs to be utf8 (or utf8mb4) and from the documentation I’m under the impression that I can do something like this in order to set session variables: session-statements("set character_set_database=utf8mb4","set collation_database=utf8mb4_unicode_ci”) …however it’s not working - new tables are still being created as latin1. As far as I’m aware there’s also not a way to specify the charset/collation of a new table via syslog-ng either, right? Any ideas?

1 0

syslog-ng on FreeBSD
by Czanik, Péter 29 Mar '17

29 Mar '17

Hi, Last weekend syslog-ng 3.9.1 became available on FreeBSD in the sysutils/syslog-ng-devel port. The default syslog-ng port, sysutils/syslog-ng still points to syslog-ng 3.7. If you use syslog-ng on FreeBSD, please test 3.9.1 as I plan to promote 3.9.1 as the default syslog-ng version in ports. (I am only aware of a single problem when upgrading from earlier versions to 3.9.1, but that's Linux only: https://github.com/balabit/syslog-ng/issues/1395) Let me know, if you run into any troubles with 3.9.1, so it can be fixed before the change. Thanks, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik

1 0

patterndb Joining rulesets with mismatching program name sets
by Fabien Wernli 29 Mar '17

29 Mar '17

Hi, It seems somewhere between 3.7 and 3.8 my patterndb broke validation tests. When running `pdbtool test` I now get: Joining rulesets with mismatching program name sets This helpful message seems to be right if I understand it correctly: <ruleset name='pam_unix' id='72d75cb0-0107-4d12-b0bf-cea36ddf7f38'> <patterns> <pattern>sshd</pattern> <pattern>crond</pattern> <pattern>imap</pattern> <pattern>imapd</pattern> <pattern>login</pattern> <pattern>pam</pattern> <pattern>pure-ftpd</pattern> <pattern>proftpd</pattern> <pattern>su</pattern> <pattern>sudo</pattern> <ruleset name='cron' id='3a8efec5-6974-4b4a-b203-3247fe235812'> <patterns> <pattern>crond</pattern> <pattern>CROND</pattern> </patterns> Since when, and why is this illegal now? Thanks

3 5

Fwd: Memory Leak in syslog-ng 3.9.1
by Arnob Ghosh 28 Mar '17

28 Mar '17

Hi, We are observing memory leak with syslog-ng 3.9.1 while testing with Valgrind in x86 system. Please find attached valgrind report with below command. G_SLICE=always-malloc valgrind -v --log-file=valgrind.log --leak-check=full --show-leak-kinds=all syslog-ng -F --enable-core ==2104== Memcheck, a memory error detector ==2104== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al. ==2104== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info ==2104== Command: syslog-ng -F --enable-core ==2104== Parent PID: 2103 ==2104== --2104-- --2104-- Valgrind options: --2104-- -v --2104-- --log-file=valgrind.log --2104-- --leak-check=full --2104-- Contents of /proc/version: --2104-- Linux version 3.10.104.cge-rt117 (ferret@bamboo) (gcc version 4.7.0 (MontaVista Linux G++ 4.7-170301090024) ) #1 SMP PREEMPT Thu Mar 9 08:50:32 IST 2017 --2104-- Arch and hwcaps: AMD64, LittleEndian, amd64-cx16-lzcnt-rdtscp-sse3-avx-avx2-bmi --2104-- Page sizes: currently 4096, max supported 4096 --2104-- Valgrind library directory: /usr/lib64/valgrind --2104-- Reading syms from /usr/sbin/syslog-ng --2104-- Considering /usr/sbin/syslog-ng .. --2104-- .. CRC mismatch (computed 6ecb1f66 wanted 2175c4e1) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/valgrind/memcheck-amd64-linux --2104-- Considering /usr/lib64/valgrind/memcheck-amd64-linux .. --2104-- .. CRC mismatch (computed a66f1e19 wanted 8057359b) --2104-- object doesn't have a symbol table --2104-- object doesn't have a dynamic symbol table --2104-- Reading syms from /lib64/ld-2.16.so --2104-- Considering /lib64/ld-2.16.so .. --2104-- .. CRC mismatch (computed bcd9793b wanted d7ac4eab) --2104-- Considering /lib64/.debug/ld-2.16.so .. --2104-- .. CRC is valid --2104-- Scheduler: using generic scheduler lock implementation. --2104-- Reading suppressions file: /usr/lib64/valgrind/default.supp ==2104== embedded gdbserver: reading from /tmp/vgdb-pipe-from-vgdb-to-2104-by-root-on-??? ==2104== embedded gdbserver: writing to /tmp/vgdb-pipe-to-vgdb-from-2104-by-root-on-??? ==2104== embedded gdbserver: shared mem /tmp/vgdb-pipe-shared-mem-vgdb-2104-by-root-on-??? ==2104== ==2104== TO CONTROL THIS PROCESS USING vgdb (which you probably ==2104== don't want to do, unless you know exactly what you're doing, ==2104== or are doing some strange experiment): ==2104== /usr/lib64/valgrind/../../bin/vgdb --pid=2104 ...command... ==2104== ==2104== TO DEBUG THIS PROCESS USING GDB: start GDB like this ==2104== /path/to/gdb syslog-ng ==2104== and then give GDB the following command ==2104== target remote | /usr/lib64/valgrind/../../bin/vgdb --pid=2104 ==2104== --pid is optional if only one valgrind process is running ==2104== --2104-- REDIR: 0x3331417930 (ld-linux-x86-64.so.2:strlen) redirected to 0x380742d1 (???) --2104-- Reading syms from /usr/lib64/valgrind/vgpreload_core-amd64-linux.so --2104-- Considering /usr/lib64/valgrind/vgpreload_core-amd64-linux.so .. --2104-- .. CRC mismatch (computed 12fcda0f wanted d650c1e1) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so --2104-- Considering /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so .. --2104-- .. CRC mismatch (computed 112626bf wanted 5a5b2993) --2104-- object doesn't have a symbol table ==2104== WARNING: new redirection conflicts with existing -- ignoring it --2104-- old: 0x3331417930 (strlen ) R-> (0000.0) 0x380742d1 ??? --2104-- new: 0x3331417930 (strlen ) R-> (2007.0) 0x04a09500 strlen --2104-- REDIR: 0x3331417880 (ld-linux-x86-64.so.2:index) redirected to 0x4a090e0 (index) --2104-- REDIR: 0x3331417900 (ld-linux-x86-64.so.2:strcmp) redirected to 0x4a0a5b0 (strcmp) --2104-- REDIR: 0x3331418940 (ld-linux-x86-64.so.2:mempcpy) redirected to 0x4a0ce90 (mempcpy) --2104-- Reading syms from /usr/lib64/libsyslog-ng-3.9.so.0.0.0 --2104-- Considering /usr/lib64/libsyslog-ng-3.9.so.0.0.0 .. --2104-- .. CRC mismatch (computed 145c4fb7 wanted 143409f9) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/libssl.so.1.0.0 --2104-- Considering /usr/lib64/libssl.so.1.0.0 .. --2104-- .. CRC mismatch (computed bff95ff2 wanted e1f317f8) --2104-- object doesn't have a symbol table --2104-- Reading syms from /lib64/libcrypto.so.1.0.0 --2104-- Considering /lib64/libcrypto.so.1.0.0 .. --2104-- .. CRC mismatch (computed 0f7afdd4 wanted 67e91cbf) --2104-- object doesn't have a symbol table --2104-- Reading syms from /lib64/libuuid.so.1.3.0 --2104-- Considering /lib64/libuuid.so.1.3.0 .. --2104-- .. CRC mismatch (computed e44bde93 wanted bee5b57e) --2104-- object doesn't have a symbol table --2104-- Reading syms from /lib64/libnsl-2.16.so --2104-- Considering /lib64/libnsl-2.16.so .. --2104-- .. CRC mismatch (computed a4a8f693 wanted c21578ab) --2104-- Considering /lib64/.debug/libnsl-2.16.so .. --2104-- .. CRC is valid --2104-- Reading syms from /usr/lib64/libgmodule-2.0.so.0.3400.3 --2104-- Considering /usr/lib64/libgmodule-2.0.so.0.3400.3 .. --2104-- .. CRC mismatch (computed 56b50299 wanted 0faed9bb) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/libgthread-2.0.so.0.3400.3 --2104-- Considering /usr/lib64/libgthread-2.0.so.0.3400.3 .. --2104-- .. CRC mismatch (computed e16c9722 wanted 49f05f96) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/libglib-2.0.so.0.3400.3 --2104-- Considering /usr/lib64/libglib-2.0.so.0.3400.3 .. --2104-- .. CRC mismatch (computed 8b7f406d wanted d25a28ff) --2104-- object doesn't have a symbol table --2104-- Reading syms from /lib64/libpthread-2.16.so --2104-- Considering /lib64/libpthread-2.16.so .. --2104-- .. CRC mismatch (computed c0d22d21 wanted b4f3247d) --2104-- Considering /lib64/.debug/libpthread-2.16.so .. --2104-- .. CRC is valid --2104-- Reading syms from /lib64/librt-2.16.so --2104-- Considering /lib64/librt-2.16.so .. --2104-- .. CRC mismatch (computed 2d230dcc wanted efd16a99) --2104-- Considering /lib64/.debug/librt-2.16.so .. --2104-- .. CRC is valid --2104-- Reading syms from /usr/lib64/libevtlog.so.0.0.0 --2104-- Considering /usr/lib64/libevtlog.so.0.0.0 .. --2104-- .. CRC mismatch (computed 6a1cc924 wanted 5502f762) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/libpcre.so.1.2.7 --2104-- Considering /usr/lib64/libpcre.so.1.2.7 .. --2104-- .. CRC mismatch (computed 610e8772 wanted b6a438f6) --2104-- object doesn't have a symbol table --2104-- Reading syms from /lib64/libdl-2.16.so --2104-- Considering /lib64/libdl-2.16.so .. --2104-- .. CRC mismatch (computed 6231c842 wanted 8e630476) --2104-- Considering /lib64/.debug/libdl-2.16.so .. --2104-- .. CRC is valid --2104-- Reading syms from /lib64/libc-2.16.so --2104-- Considering /lib64/libc-2.16.so .. --2104-- .. CRC mismatch (computed 89e7ac0b wanted 542d8abb) --2104-- Considering /lib64/.debug/libc-2.16.so .. --2104-- .. CRC is valid --2104-- REDIR: 0x3331885e60 (libc.so.6:strcasecmp) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331882210 (libc.so.6:strnlen) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331888130 (libc.so.6:strncasecmp) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x33318822f0 (libc.so.6:strncmp) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331880600 (libc.so.6:strcmp) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331883c00 (libc.so.6:__GI_strrchr) redirected to 0x4a08df0 (__GI_strrchr) --2104-- REDIR: 0x3331882130 (libc.so.6:__GI_strlen) redirected to 0x4a09460 (__GI_strlen) --2104-- REDIR: 0x3331882330 (libc.so.6:__GI_strncmp) redirected to 0x4a09bf0 (__GI_strncmp) --2104-- REDIR: 0x333187c210 (libc.so.6:malloc) redirected to 0x4a088a0 (malloc) --2104-- REDIR: 0x33318820e0 (libc.so.6:strlen) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x333194ca10 (libc.so.6:__strlen_sse2_pminub) redirected to 0x4a09440 (strlen) --2104-- REDIR: 0x333188a810 (libc.so.6:memcpy@@GLIBC_2.14) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331931dd0 (libc.so.6:__memcpy_ssse3_back) redirected to 0x4a0a980 (memcpy@@GLIBC_2.14) --2104-- REDIR: 0x333187cbc0 (libc.so.6:calloc) redirected to 0x4a06730 (calloc) --2104-- REDIR: 0x33319244c0 (libc.so.6:__strcasecmp_avx) redirected to 0x4a09d40 (strcasecmp) --2104-- REDIR: 0x3331883ca0 (libc.so.6:strpbrk) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331924230 (libc.so.6:__strpbrk_sse42) redirected to 0x4a0d240 (strpbrk) --2104-- REDIR: 0xffffffffff600000 (???:???) redirected to 0x380742b3 (???) --2104-- REDIR: 0x3331899810 (libc.so.6:strstr) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x333191f060 (libc.so.6:__strstr_sse42) redirected to 0x4a0d1b0 (__strstr_sse42) --2104-- REDIR: 0x3331880540 (libc.so.6:index) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x333191d080 (libc.so.6:__strchr_sse42) redirected to 0x4a08fe0 (index) --2104-- REDIR: 0x3331883b80 (libc.so.6:strncpy) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x33318905e0 (libc.so.6:__strncpy_sse2_unaligned) redirected to 0x4a09a50 (__strncpy_sse2_unaligned) --2104-- REDIR: 0x333191d130 (libc.so.6:__strcmp_sse42) redirected to 0x4a0a560 (__strcmp_sse42) --2104-- REDIR: 0x333187c800 (libc.so.6:free) redirected to 0x4a07600 (free) --2104-- REDIR: 0x3331885cc0 (libc.so.6:stpcpy) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x33318915c0 (libc.so.6:__stpcpy_sse2_unaligned) redirected to 0x4a0c0a0 (__stpcpy_sse2_unaligned) --2104-- REDIR: 0x333187c890 (libc.so.6:realloc) redirected to 0x4a08aa0 (realloc) --2104-- REDIR: 0x3331884c40 (libc.so.6:memset) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331884c80 (libc.so.6:__GI_memset) redirected to 0x4a0c440 (memset) --2104-- REDIR: 0x333188bd10 (libc.so.6:strchrnul) redirected to 0x4a0cab0 (strchrnul) --2104-- REDIR: 0x333188a860 (libc.so.6:__GI_memcpy) redirected to 0x4a0aee0 (__GI_memcpy) --2104-- REDIR: 0x333191dee0 (libc.so.6:__strncmp_sse42) redirected to 0x4a09cd0 (__strncmp_sse42) --2104-- REDIR: 0x3331885d00 (libc.so.6:__GI_stpcpy) redirected to 0x4a0bf00 (__GI_stpcpy) --2104-- REDIR: 0x3331884630 (libc.so.6:bcmp) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331947340 (libc.so.6:__memcmp_sse4_1) redirected to 0x4a0bd40 (__memcmp_sse4_1) --2104-- REDIR: 0xffffffffff600400 (???:???) redirected to 0x380742bd (???) --2104-- REDIR: 0x33318994b0 (libc.so.6:__GI_strstr) redirected to 0x4a0d120 (__strstr_sse2) --2104-- REDIR: 0x33318842e0 (libc.so.6:memchr) redirected to 0x4a0a650 (memchr) --2104-- REDIR: 0x333188f970 (libc.so.6:__GI_strncpy) redirected to 0x4a097f0 (__GI_strncpy) --2104-- REDIR: 0x3331925b30 (libc.so.6:__strncasecmp_avx) redirected to 0x4a09e20 (strncasecmp) --2104-- REDIR: 0x3331880640 (libc.so.6:__GI_strcmp) redirected to 0x4a0a4c0 (__GI_strcmp) --2104-- Reading syms from /lib64/libnss_files-2.16.so --2104-- Considering /lib64/libnss_files-2.16.so .. --2104-- .. CRC mismatch (computed b7fe16f9 wanted c162f3cb) --2104-- Considering /lib64/.debug/libnss_files-2.16.so .. --2104-- .. CRC is valid --2104-- REDIR: 0x3331881ad0 (libc.so.6:__GI_strcpy) redirected to 0x4a095f0 (__GI_strcpy) --2104-- REDIR: 0x333188bac0 (libc.so.6:rawmemchr) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x333188bb00 (libc.so.6:__GI___rawmemchr) redirected to 0x4a0cb00 (__GI___rawmemchr) --2104-- Reading syms from /lib64/libnss_mdns4_minimal.so.2 --2104-- Considering /lib64/libnss_mdns4_minimal.so.2 .. --2104-- .. CRC mismatch (computed ede24083 wanted 0166de0d) --2104-- object doesn't have a symbol table --2104-- Reading syms from /lib64/libnss_dns-2.16.so --2104-- Considering /lib64/libnss_dns-2.16.so .. --2104-- .. CRC mismatch (computed 581b33f0 wanted efff06f8) --2104-- Considering /lib64/.debug/libnss_dns-2.16.so .. --2104-- .. CRC is valid --2104-- Reading syms from /lib64/libresolv-2.16.so --2104-- Considering /lib64/libresolv-2.16.so .. --2104-- .. CRC mismatch (computed 2b73909b wanted 4a30a1ca) --2104-- Considering /lib64/.debug/libresolv-2.16.so .. --2104-- .. CRC is valid --2104-- Reading syms from /lib64/libnss_mdns4.so.2 --2104-- Considering /lib64/libnss_mdns4.so.2 .. --2104-- .. CRC mismatch (computed 0cc691af wanted d88c289b) --2104-- object doesn't have a symbol table --2104-- REDIR: 0x3331884a70 (libc.so.6:__GI_memmove) redirected to 0x4a0c740 (__GI_memmove) --2104-- Reading syms from /usr/lib64/syslog-ng/libaffile.so --2104-- Considering /usr/lib64/syslog-ng/libaffile.so .. --2104-- .. CRC mismatch (computed 75ff58c4 wanted 6ceb6e1a) --2104-- object doesn't have a symbol table --2104-- REDIR: 0x3331418a90 (ld-linux-x86-64.so.2:stpcpy) redirected to 0x4a0c240 (stpcpy) --2104-- Discarding syms at 0x5a52eb0-0x5a580c8 in /usr/lib64/syslog-ng/libaffile.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libafprog.so --2104-- Considering /usr/lib64/syslog-ng/libafprog.so .. --2104-- .. CRC mismatch (computed 33d79891 wanted 38df833f) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a50c50-0x5a53ae8 in /usr/lib64/syslog-ng/libafprog.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libkvformat.so --2104-- Considering /usr/lib64/syslog-ng/libkvformat.so .. --2104-- .. CRC mismatch (computed a685392d wanted 0d0a3f36) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4fe80-0x5a520b8 in /usr/lib64/syslog-ng/libkvformat.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libadd-contextual-data.so --2104-- Considering /usr/lib64/syslog-ng/libadd-contextual-data.so .. --2104-- .. CRC mismatch (computed 3905c9b5 wanted 05577ff3) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a50cb0-0x5a53248 in /usr/lib64/syslog-ng/libadd-contextual-data.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libcef.so --2104-- Considering /usr/lib64/syslog-ng/libcef.so .. --2104-- .. CRC mismatch (computed 4be76a8f wanted c38742c5) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4dcb0-0x5a4e238 in /usr/lib64/syslog-ng/libcef.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libdate.so --2104-- Considering /usr/lib64/syslog-ng/libdate.so .. --2104-- .. CRC mismatch (computed 2879a739 wanted bf0a6250) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4f9f0-0x5a52168 in /usr/lib64/syslog-ng/libdate.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libcryptofuncs.so --2104-- Considering /usr/lib64/syslog-ng/libcryptofuncs.so .. --2104-- .. CRC mismatch (computed ca734dd6 wanted 6492f3d6) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4e070-0x5a4e508 in /usr/lib64/syslog-ng/libcryptofuncs.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libpseudofile.so --2104-- Considering /usr/lib64/syslog-ng/libpseudofile.so .. --2104-- .. CRC mismatch (computed 6a282fe2 wanted 2aaa9e3f) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4f6e0-0x5a51118 in /usr/lib64/syslog-ng/libpseudofile.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/liblinux-kmsg-format.so --2104-- Considering /usr/lib64/syslog-ng/liblinux-kmsg-format.so .. --2104-- .. CRC mismatch (computed cc160b54 wanted 2547ea5a) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4dbc0-0x5a4e7e8 in /usr/lib64/syslog-ng/liblinux-kmsg-format.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libsyslogformat.so --2104-- Considering /usr/lib64/syslog-ng/libsyslogformat.so .. --2104-- .. CRC mismatch (computed 8799a4da wanted 3a04cfa7) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4fd40-0x5a53138 in /usr/lib64/syslog-ng/libsyslogformat.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libcsvparser.so --2104-- Considering /usr/lib64/syslog-ng/libcsvparser.so .. --2104-- .. CRC mismatch (computed 991af95b wanted f7306355) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4fc00-0x5a517d8 in /usr/lib64/syslog-ng/libcsvparser.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libdbparser.so --2104-- Considering /usr/lib64/syslog-ng/libdbparser.so .. --2104-- .. CRC mismatch (computed c7d22793 wanted 2dc4d4e8) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a56860-0x5a62a98 in /usr/lib64/syslog-ng/libdbparser.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libdisk-buffer.so --2104-- Considering /usr/lib64/syslog-ng/libdisk-buffer.so .. --2104-- .. CRC mismatch (computed 6b87b880 wanted 75803ff5) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a510d0-0x5a56588 in /usr/lib64/syslog-ng/libdisk-buffer.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libafuser.so --2104-- Considering /usr/lib64/syslog-ng/libafuser.so .. --2104-- .. CRC mismatch (computed be65199f wanted f4d26998) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4f340-0x5a50918 in /usr/lib64/syslog-ng/libafuser.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libconfgen.so --2104-- Considering /usr/lib64/syslog-ng/libconfgen.so .. --2104-- .. CRC mismatch (computed 0236a91a wanted 8d6d9a19) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4dd50-0x5a4e208 in /usr/lib64/syslog-ng/libconfgen.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libafstomp.so --2104-- Considering /usr/lib64/syslog-ng/libafstomp.so .. --2104-- .. CRC mismatch (computed ab8d437d wanted f040ecae) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a51000-0x5a54108 in /usr/lib64/syslog-ng/libafstomp.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libgraphite.so --2104-- Considering /usr/lib64/syslog-ng/libgraphite.so .. --2104-- .. CRC mismatch (computed 5f29ba28 wanted d29a0f96) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4df90-0x5a4e5a8 in /usr/lib64/syslog-ng/libgraphite.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libafsocket.so --2104-- Considering /usr/lib64/syslog-ng/libafsocket.so .. --2104-- .. CRC mismatch (computed 9ce8515e wanted cbb9d1f4) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a557a0-0x5a5cac8 in /usr/lib64/syslog-ng/libafsocket.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libbasicfuncs.so --2104-- Considering /usr/lib64/syslog-ng/libbasicfuncs.so .. --2104-- .. CRC mismatch (computed cd95d630 wanted 6620ef09) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4ff40-0x5a52058 in /usr/lib64/syslog-ng/libbasicfuncs.so due to munmap() --2104-- Reading syms from /usr/lib64/syslog-ng/libsystem-source.so --2104-- Considering /usr/lib64/syslog-ng/libsystem-source.so .. --2104-- .. CRC mismatch (computed e87f0e6c wanted dd3a8c65) --2104-- object doesn't have a symbol table --2104-- Discarding syms at 0x5a4df10-0x5a4e9d8 in /usr/lib64/syslog-ng/libsystem-source.so due to munmap() --2104-- Reading syms from /lib64/libnss_compat-2.16.so --2104-- Considering /lib64/libnss_compat-2.16.so .. --2104-- .. CRC mismatch (computed 66a1b543 wanted eea82e2f) --2104-- Considering /lib64/.debug/libnss_compat-2.16.so .. --2104-- .. CRC is valid --2104-- REDIR: 0x3331880580 (libc.so.6:__GI_strchr) redirected to 0x4a08f20 (__GI_strchr) --2104-- Reading syms from /usr/lib64/syslog-ng/libafsocket.so --2104-- Considering /usr/lib64/syslog-ng/libafsocket.so .. --2104-- .. CRC mismatch (computed 9ce8515e wanted cbb9d1f4) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/syslog-ng/libaffile.so --2104-- Considering /usr/lib64/syslog-ng/libaffile.so .. --2104-- .. CRC mismatch (computed 75ff58c4 wanted 6ceb6e1a) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/syslog-ng/libafuser.so --2104-- Considering /usr/lib64/syslog-ng/libafuser.so .. --2104-- .. CRC mismatch (computed be65199f wanted f4d26998) --2104-- object doesn't have a symbol table --2104-- Reading syms from /usr/lib64/syslog-ng/libsyslogformat.so --2104-- Considering /usr/lib64/syslog-ng/libsyslogformat.so .. --2104-- .. CRC mismatch (computed 8799a4da wanted 3a04cfa7) --2104-- object doesn't have a symbol table --2104-- REDIR: 0x3331884bf0 (libc.so.6:memcpy@GLIBC_2.2.5) redirected to 0x48016a0 (_vgnU_ifunc_wrapper) --2104-- REDIR: 0x3331937370 (libc.so.6:__memmove_ssse3_back) redirected to 0x4a0a720 (memcpy(a)GLIBC_2.2.5) ==2104== Thread 3: ==2104== Invalid read of size 8 ==2104== at 0x3334043DFA: g_list_prepend (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x33348334D8: dns_caching_thread_deinit (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482CCC8: app_thread_stop (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x33348423F8: main_loop_worker_thread_stop (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871C70: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871EDF: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871122: iv_run_tasks (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873403: iv_main (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871C12: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873B56: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3332007DFE: start_thread (pthread_create.c:308) ==2104== by 0x33318E639C: clone (clone.S:114) ==2104== Address 0x4db9e40 is 16 bytes inside a block of size 24 free'd ==2104== at 0x4A0766C: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==2104== by 0x333406306F: g_slice_free_chain_with_offset (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x3334833564: dns_caching_global_deinit (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482CC89: app_shutdown (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x40171F: main (in /usr/sbin/syslog-ng) ==2104== ==2104== Invalid write of size 8 ==2104== at 0x3334043E0B: g_list_prepend (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x33348334D8: dns_caching_thread_deinit (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482CCC8: app_thread_stop (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x33348423F8: main_loop_worker_thread_stop (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871C70: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871EDF: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871122: iv_run_tasks (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873403: iv_main (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871C12: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873B56: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3332007DFE: start_thread (pthread_create.c:308) ==2104== by 0x33318E639C: clone (clone.S:114) ==2104== Address 0x4db9e40 is 16 bytes inside a block of size 24 free'd ==2104== at 0x4A0766C: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==2104== by 0x333406306F: g_slice_free_chain_with_offset (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x3334833564: dns_caching_global_deinit (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482CC89: app_shutdown (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x40171F: main (in /usr/sbin/syslog-ng) ==2104== --2104-- Discarding syms at 0x50211e0-0x50281d8 in /lib64/libnss_files-2.16.so due to munmap() --2104-- Discarding syms at 0x522caf0-0x522d768 in /lib64/libnss_mdns4_minimal.so.2 due to munmap() --2104-- Discarding syms at 0x542f0b0-0x5432198 in /lib64/libnss_dns-2.16.so due to munmap() --2104-- Discarding syms at 0x5637a30-0x5643ed8 in /lib64/libresolv-2.16.so due to munmap() --2104-- Discarding syms at 0x584bbb0-0x584c938 in /lib64/libnss_mdns4.so.2 due to munmap() --2104-- Discarding syms at 0x5a52370-0x5a56d28 in /lib64/libnss_compat-2.16.so due to munmap() ==2104== ==2104== HEAP SUMMARY: ==2104== in use at exit: 121,871 bytes in 3,300 blocks ==2104== total heap usage: 11,707 allocs, 8,407 frees, 829,833 bytes allocated ==2104== ==2104== Searching for pointers to 3,300 not-freed blocks ==2104== Checked 17,360,560 bytes ==2104== ==2104== Thread 1: ==2104== 502 (128 direct, 374 indirect) bytes in 1 blocks are definitely lost in loss record 678 of 725 ==2104== at 0x4A08910: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==2104== by 0x333404D290: g_malloc (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x3334834D53: g_process_set_argv_space (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x4015AC: main (in /usr/sbin/syslog-ng) ==2104== ==2104== 608 bytes in 2 blocks are possibly lost in loss record 683 of 725 ==2104== at 0x4A067B0: calloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==2104== by 0x3331410EF9: allocate_dtv (dl-tls.c:296) ==2104== by 0x333141163D: _dl_allocate_tls (dl-tls.c:460) ==2104== by 0x33320085F4: allocate_stack (allocatestack.c:570) ==2104== by 0x33320085F4: pthread_create@@GLIBC_2.2.5 (pthread_create.c:460) ==2104== by 0x3334873C8B: iv_thread_create (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871B0E: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334872290: iv_work_pool_submit_work (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871122: iv_run_tasks (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873403: iv_main (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334841E53: main_loop_run (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x401713: main (in /usr/sbin/syslog-ng) ==2104== ==2104== 765 (360 direct, 405 indirect) bytes in 3 blocks are definitely lost in loss record 690 of 725 ==2104== at 0x4A067B0: calloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==2104== by 0x333404D2E8: g_malloc0 (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x333485B952: log_filter_pipe_new (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x33348320D1: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334831EB6: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333483210E: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334831EB6: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334832451: cfg_tree_compile_rule (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x33348325CA: cfg_tree_compile (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334832668: cfg_tree_start (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482D3DD: cfg_init (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334841AFF: main_loop_initialize_state (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== ==2104== LEAK SUMMARY: ==2104== definitely lost: 488 bytes in 4 blocks ==2104== indirectly lost: 779 bytes in 27 blocks ==2104== possibly lost: 608 bytes in 2 blocks ==2104== still reachable: 119,996 bytes in 3,267 blocks ==2104== suppressed: 0 bytes in 0 blocks ==2104== Reachable blocks (those to which a pointer was found) are not shown. ==2104== To see them, rerun with: --leak-check=full --show-leak-kinds=all ==2104== ==2104== ERROR SUMMARY: 5 errors from 5 contexts (suppressed: 1 from 1) ==2104== ==2104== 1 errors in context 1 of 5: ==2104== Thread 3: ==2104== Invalid write of size 8 ==2104== at 0x3334043E0B: g_list_prepend (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x33348334D8: dns_caching_thread_deinit (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482CCC8: app_thread_stop (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x33348423F8: main_loop_worker_thread_stop (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871C70: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871EDF: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871122: iv_run_tasks (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873403: iv_main (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871C12: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873B56: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3332007DFE: start_thread (pthread_create.c:308) ==2104== by 0x33318E639C: clone (clone.S:114) ==2104== Address 0x4db9e40 is 16 bytes inside a block of size 24 free'd ==2104== at 0x4A0766C: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==2104== by 0x333406306F: g_slice_free_chain_with_offset (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x3334833564: dns_caching_global_deinit (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482CC89: app_shutdown (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x40171F: main (in /usr/sbin/syslog-ng) ==2104== ==2104== ==2104== 1 errors in context 2 of 5: ==2104== Invalid read of size 8 ==2104== at 0x3334043DFA: g_list_prepend (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x33348334D8: dns_caching_thread_deinit (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482CCC8: app_thread_stop (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x33348423F8: main_loop_worker_thread_stop (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871C70: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871EDF: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871122: iv_run_tasks (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873403: iv_main (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334871C12: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3334873B56: ??? (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x3332007DFE: start_thread (pthread_create.c:308) ==2104== by 0x33318E639C: clone (clone.S:114) ==2104== Address 0x4db9e40 is 16 bytes inside a block of size 24 free'd ==2104== at 0x4A0766C: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==2104== by 0x333406306F: g_slice_free_chain_with_offset (in /usr/lib64/libglib-2.0.so.0.3400.3) ==2104== by 0x3334833564: dns_caching_global_deinit (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x333482CC89: app_shutdown (in /usr/lib64/libsyslog-ng-3.9.so.0.0.0) ==2104== by 0x40171F: main (in /usr/sbin/syslog-ng) ==2104== --2104-- --2104-- used_suppression: 1 dl-hack3-cond-1 /usr/lib64/valgrind/default.supp:1206 ==2104== ==2104== ERROR SUMMARY: 5 errors from 5 contexts (suppressed: 1 from 1) When we are running logger application with emergency priority for long time we find RSS memory is getting increased very fast from 13K to 24K and syslog-ng is getting killed with OOM Killer. Thanks, Arnob

1 0

throttle parser
by Fabien Wernli 27 Mar '17

27 Mar '17

Hi, How would you suggest to throttle matching messages in a log path? I know there's the `throttle` option in many destinations, but I'd like to be able to do this upstream, e.g. in patterndb or better in the path directly. It would be awesome to be able to do: log { source(…); junction { channel { filter(…); throttle(100); }; channel { flags(fallback); }; }; destination(…); }; wouldn't it?

1 0

Does Syslog-NG Support Multiline Messages
by Traiano Welcome 26 Mar '17

26 Mar '17

Hi Does syslog-ng support multiline log messages? Thanks, Traiano

4 5