[syslog-ng][PATCH] please test: syslog-ng message mangling fix

[Balazs Scheidler]

On Thu, Aug 08, 2002 at 01:53:29PM -0500, Caylan Van Larson wrote:
> Mr. Bazsi,
> 
> I will try to clarify this for you.  If I miss something just shoot me an 
> email and I will answer it immeidately.
> 
> When I say "mangled" the logs are cut off prematurely or squished in some 
> spots, almost as if they are being folded.  This "mangled" effect has 
> happened when I use pipe or file to gather the kernel logs.  Using the 
> command "demsg" I am confronted with a console full of nice looking 
> iptable logs.  When these are compared to the logged versions you can 
> see the apparent squishing.  When syslog-ng is stopped and syslogd is 
> started /var/log/messages is populated with perfect iptable logs.  The 
> syslog.conf file is at default configuration, while syslog-ng.conf is 
> customized and attached below.  The logs that I have been presenting to 
> this list are from the local filesystem, although this machine is 
> configured to send these out to a log host.
> 
> I read that syslog-ng could replace klogd and I did this.  However, the 
> effects still showed that w/ only syslog-ng running the logs are still 
> bad.
> 
> Here are some examples of good iptable logs (from dmesg, line wrapped of course):
> IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=138.12.5.2 DST=134.129.212.30
> 		LEN=127 TOS=0x00 PREC=0x00 TTL=243 ID=6173 DF PROTO=UDP SPT=53 DPT=33014 LEN=107
> IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.214.194 DST=134.129.212.30
> 		LEN=252 TOS=0x00 PREC=0x00 TTL=127 ID=56906 PROTO=UDP SPT=138 DPT=138 LEN=232
> IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.223.141 DST=134.129.212.30
> 		LEN=232 TOS=0x00 PREC=0x00 TTL=127 ID=16276 PROTO=UDP SPT=138 DPT=138 LEN=212
> IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.201.29 DST=134.129.212.30
> 		LEN=60 TOS=0x00 PREC=0x00 TTL=61 ID=10830 DF PROTO=TCP SPT=2715 DPT=53 WINDOW=32120 RES=0x00 SYN URGP=0
> IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.111.111 DST=134.129.212.30
> 		LEN=60 TOS=0x00 PREC=0x00 TTL=57 ID=49241 DF PROTO=TCP SPT=3475 DPT=53 WINDOW=32120 RES=0x00 SYN URGP=0
> IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.223.237 DST=134.129.212.30
> 		LEN=229 TOS=0x00 PREC=0x00 TTL=127 ID=14673 PROTO=UDP SPT=138 DPT=138 LEN=209
> 
> Here is an example of what would show up in the logs (/var/log/kern):
> Aug  8 12:34:04 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.214.231 DST=134.129.212.30
> 		LEN=78 S=0PREC=0x00 TL=127 ID=5 0426 PROTO=UDSPT=137T=137 LEN=58
> Aug  8 12:34:05 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.214.231 DST=134.129.212.30
> 		LEN=78 TOS=0x00 PRE
> Aug  8 12:34:08 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.215.54 DS
> 		0x00 TTL=127 ID=36747 OTDP SPT=138PT= LEN=222
> Aug  8 12:34:08 smack IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.214.139 DST=134.129.212.30
> 		LEN=60 TO=0 PREC=0x00 TTL=63 ID=29205 DF PROTO=TCP 347 DPT=53 WINDOW=5840 RES=0x00  URGP=0
> Aug  8 12:34:08 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.214.231 DST=134.129.212.30
> 		LEN=78 T0x00 PREC=0x00 TTL=127 ID=50430 PROTO=UDP SPT=137 DPT=137 LEN=58
> 

I've installed syslog-ng on a host with kernel 2.4 and iptables installed. I
added a rule

iptables -A INPUT -j LOG

to log all traffic. I generated network traffic using ping, and ssh, all
messages were logged fine to local logs.

can you strace syslog-ng while running?

for example try a simple configuration:


source src { file("/proc/kmsg"); internal(); };

destination dst { file("/var/log/kern.log"); };

log { source(src); destination(dst); };

this syslog-ng doesn't handle local messages only reads kernel messages.

stop any daemons that use /proc/kmsg (klogd, the other syslog-ng)

run this syslog-ng (syslog-ng -f <pathtonewsyslog-ngconf>)

and start strace:

strace -o syslog-ng.strace -s 256 -p <syslogngpid>

generate some iptables lines that are mangled. please send me the logfile,
the strace output, and a dmesg output in private.

Today is the only chance to find the problem, as I'm leaving for holidays
tomorrow.



-- 
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1