Thursday, July 28, 2005

Finally ... new rsyslog site up!

Finally, I managed to get the new rsyslog site up and running. It turned out to be more work than initially expected. Special thanks go to Timm Herget, who did some of the initial preparation and of course to Andre Lorbach, who made the whole system appear. I just added the content and fumbled a little bit with the config settings ;)

The new site now allows user postings and easier updates. I hope it will be a valuable resource for the (hopefully growing) rsyslog community.

Besides rsyslog, the site also is intended to provide reference for add-ons like phpLogCon.

Tuesday, July 26, 2005

Port number for syslog/tcp...

I so often used ports 1514 and 10514 that I didn't really notice that they are IANA-reserved. I today posted my syslog stunnel article at aplawrence, and the first comment told me so. Wow! Looks like I need to rethink which ports I used. I am also a bit tempted to try to register a port for syslog/tcp, but this sounds not very easy (especially given the fact that the syslog-sec IETF WG does not at all like plain tcp syslog.

rsyslog 0.9.4 out

Yesterday, I finally released rsyslog 0.9.4, the first version with full TCP support. I got some encouraging feedback from I hope that word now spreads and we get some more momentum for rsyslog. After all, it isn't looking bad at all. We just need to keep in mind that the project is out since a few month (March this year I remember), so its not bad at all.

The next thing to do is writing a parser for syslog-protocol-14. I wanted to at least seriously begin this during the last call period, but I begin to feel I won't be able to manage that. Well, we'll see...

Friday, July 22, 2005

Syslog Encryption Tutorial...

Wow... I took me the afternoon to create a syslog encryption tutorial. The initial version is now posted for review and comments, but I think it will need some further brush-up. Also, doing the tutorial I noticed that I needed to tweak rsyslog a little to make it behave well with stunnel. It's done now, too. Looks like I am about releasing it early next week :)

Thursday, July 21, 2005

Syslog Demo Site...

I just got my syslog demo site online. It is available at The intention is that anybody can send his syslog data and see how it ends up. Now I need to prep some documentation and announce it. Honestly, I am very interested to see if it will be used at all ;)

BTW: I did also notice that phpLogCon needs some "minor" changes. I will see if I can at least initiate something, but given the current ressource restrictions, this does not look well... what a shame ;)

Rsyslog is becoming mature...

I've now made a number of changes to rsyslog, resulting in full TCP capabilities. Hopefully, I can make a release announcment today.

With that done, rsyslog is finally on its way to a secure syslog replacement. One of the next steps is to look into using stunnel, a thing that must be easy to do ... but also one that must be set up. The TCP support was a key to using things like stunnel, because UDP packets can not be secured in a way that makes sense (two tunnels would work - but who would like to have such a monster...).

Wednesday, July 20, 2005

sylog-protocol finally in last call

Finally, it happens :) Chris announced workgroup last call this morning. I am very interested to see which additional feedback we may get until August, 5th (the deadline). The last call period unfortunately is a bit sub-optimal, with the 63rd IETF right in the middle of it. Hopefully this poses no problem to the overall advance of the draft.

Nice Article on syslog

I've just read a nice article on syslog:

It's a good intro, though it again mentions syslog-ng as the only secure alternative. I guess we need to work a little on that (OK, rsyslog is not yet ready for prime time... but we are approaching;))

Tuesday, July 19, 2005

rsyslog 0.9.3 out

I've now released rsyslog 0.9.3, which fixes the nasty bug I described yesterday. Due to the bug, this release was urgent, but I am not 100% satisfied with it. I would have preferred to have a real functional tcp sender in it. Anyhow, maybe it is good that some folks might get their hands at the early implementation (if somebody cares...). The download can still be found at the monitorware-bound site, its time to get the new site up (who is eating up all the time...).

Monday, July 18, 2005

iLAMP: Setting up a reverse SSH tunnel

This sounds interesting and I probably should try to define a scenario for rsyslog, once it has complete TCP coverage.

iLAMP: Setting up a reverse SSH tunnel

A small C bug...

C is know to "bite". Today, it bit me ;) rsyslog, as I thought initially, did duplicate the TIMESTAMP and the fields after it when relaying data. Looking closer, I found that actually the timestamp was not correctly parsed. As such, all fields were invalid, not only when forwarding but also when storing data. What a shame... The cause, however, is even somewhat more shamefull - should I really tell? ;) Of course I do. One of my beloved ultry-optimal parsers had a small bug. I incremented a character pointer at the wrong place, makeing it point to the wrong location. It did not cause a buffer overflow or something like that, but it resulted in each message to be treated like one without a proper TIMESTAMP - leading to all the mess. Obviously, this is something that needs to be fixed and I already did this. I just need to package everything, so hopefully tomorrow we will see a new release. Oh, btw, did you wonder why I didn't catch this bug earlier? Well, it appeared the first time in July... If you wonder why, you need to look at the code. I won't tell all dirty little secrets here (but it's well-documented in syslogd.c).

Tuesday, July 12, 2005

syslog-protocol-14 is out!

Finally, the 14th revision of syslog-protocol is out. It now addresses all issues I am aware of, so this hopefully brings us very close to completion of this task. Chris already has announced he will call for WG last call, so let's hope for the best. Of course, I expect some really bright and probably major-things-changing comments during last call. Let's see how much must be redone then. On the other hand, we've had some real hard dicussions on the whole spec, especially in the last few month. So chances should be good the draft gets accepted without major revision need. But you never know...

The draft editor currently is very busy, as the cutoff date for draft submissions is next monday. Probably, it will take some days until the draft shows up. It's available in my draft repository, so for those interested in it. This is draft-ietf-syslog-protocol-14.

New syslog client - AliveMon

Finally, we are finished with our new network monitoring tool. AliveMon monitors routers and server (well, everything with an IP stack ;)) and lets you know when they are in trouble. It can do ping based-checks but also the more reliable application specific checks. For example, it talks http to a web server. I was insistent on these app-specific probes because I've often seen situations where a simple ping probe told you "all well" where the web server was already died. As an extra bonus, it also supports UDP monitoring for game servers, which, as my frieds have told me, is a great feature (did I mention I am too old-fashioned to see the greatness in it... ;)).

OK, so it is a nice tool - but why the heck I am talking in my syslog blog about it? Well, as one of its alerting actions, it supports sending syslog messages. This is cool, as it allows you to integrate server availability monitoring into your central syslog backend.

AliveMon is part of the Windows product line, but it is free for monitoring a single server. This is thanks to my "game server friend" who insisted this might be a nice incident for his folks ;) Those with more than a single server are expected to pay a reasonable fee. As my fried said: "those with money for many servers my also want to fund development a little". I guess this was said rightly ;)

Monday, July 11, 2005

syslog-protocol getting even closer to RFC...

Chris send a nice encouraging note and I have changed some of the IANA considerations to be more precise. Also, I have added text to allow for experimental (x-) PARAM-NAMEs in any SD-ID. I think this is a good idea and it will probably be helpful. And: if we don't allow it, the community will do it anyhow. So why forcing them to become non-standard. Let's see what the WG tells us.

I am just a bit concerend that Didier will not be able to provide his feedback right in time. But anyhow, as Chris told, there is a 2 week "Last Call" period in the WG, so that is probably another chance to get it in.

Let's see how things progres...


Thursday, July 07, 2005

On to the next round...

Did I say syslog-protocol is close to being finished? Well, yesterday evening, I started to integrate some intelligent comments into my draft (then at revision #14). Initially, I thought it was a quick job. Now (again arrived close to evening), I now know I underestimated things a little bit. If you need to double-check the documents, this is quite time-intensive. For example, I changed some field values, which lead to all examples become invalid and needed to be redone. Also, when at it, I noticed some other minor quirks (interesting, they are still there...). Nothing big, but it simply takes time. Anyhow, now it's finished and I've send a really huge posting to the IETF discussion list. I hope people will actually look at it.

Anyhow, as Chris has announced on the list, we seem to be close to final call.

Wednesday, July 06, 2005

A new syslog/tcp receiver

I have just released rsyslog 0.9.2, the first release of it supporting plain TCP syslog. This is really good news, as TCP syslog allows much more secure log transmittal. Not only that the sender has an indication of the message arrived or not. TCP enables also to use cryptography, for example with the help of stunnel or IPSec (IPSec, to the best of my knowledge, doesn't play well with UDP).

So here we are with a syslogd capable of this. So have we arrived? Not really. The current TCP implementation support receiving messages, only. Not yet supported is sending them via TCP, so relaying is also not possible with rsyslog alone. Guess what's the next major thing to be added. Anyhow, even the receiver-only implementation offers many goodies, for example we can now accept messages from Cisco PIX, syslog-ng or our Windows syslog product line. Especially with the later stunnel integration works well, so this buys us many things.

All in all, I am quite happy with today's release. As said, the sending part will follow, but there are also some other things I need to look at, so it might take a few days longer...

Tags: ,

Tuesday, July 05, 2005

A GUI syslog...

Benedikt's idea strikes me: a graphical subsystem for syslog notifications under Linux: Xfce Diary: Desktop notification

Sounds so straigthforward - why didn't it ever come up my mind (after all, we are doing it on Windows anyhow...). Of course, it's nothing I can do immediately, but at least I will keep it on my "to look at list" ;)

Monday, July 04, 2005

More on syslog message size...

Coincidently, I ran into a thread on (see 6th post). As it looks, there are also some other folks who are not overly happy with the 1k restriction of syslog. BTW: did I mention that I, too, need more than 1k as soon as I need to deal with Windows Event Logs? Actually, I am doing a number of eventlog-to-syslog products and the event log is always very verbose. So it is often hard to get the message into 1k. This is the main reason why our Windows software products initally supported large size messages. As we now see, there are other good reasons, too :-)

syslog, IHE and message sizes...

back to our regular programming... ;) The IHE initiative uses syslog for auditing. Unfortunately, though, their framework specifies audit records way in access of syslogs's normal 1024 byte message size. Some IHE messages can grow as large as 32K, few stay within the 1024 byte limit. The bad thing is that most Unix syslogds will truncate the message at 1024 bytes, effectively loosing audit data. Under Windows, it's less of a problem, as most Windows syslog servers accept "oversize" messages.

So I thought I'll cure this under Linux and include the capability for larger size messages in rsyslog. I fired up the development machine to get a first glimpse of what to do. Well, it figured out that all I need to do is change the MAXLINE #define - and that's it. Isn't that funny? I am now fiddling with the source for some month, have even applied some considerate changes ... but never noticed this simple thing. Dumb me ;) Anyhow, I'll change the default to 32K with the next version I will release, so the IHE folks will hopefully be happy...

Tags: ,

Temple 1 and NASA TV

The main NASA TV Internet media servers are overrun by visitors. The secondary NASA TV sites listed on are still available and have complete coverage. Their quality has been reduced, but it is still a very interesting view if you do not have access to other NASA TV sources (if you have, it's probably better to head for the TV set...).

Temple-1, not syslog...

I am mirroring the first Temple-1 foto NASA released. I've tried to browse the main NASA site for early picutures, but it took me around half an hour to actually be able to download one of it. So I thought I share it with all of you. Photo credit, of course, is NASA.

But you may ask - how does this relate to syslog? Well - not at all ;-). I just couldn't stand it. I am right now watching NASA TV and as it looks the Deep Impact mission was a huge success. The impactor seems to have it exactly where it should.

This is the Temple-1 main nucleus as the impactor saw it during its approach:

Tags: ,

simplifying rsyslog JSON generation

With RESTful APIs, like for example ElasticSearch, you need to generate JSON strings. Rsyslog will soon do this in a very easy to use way. ...