Re: [rsyslog] Forwarding to multiple syslog servers and HA

2016-03-03 Thread Avleen Vig
On Thu, Mar 3, 2016, 19:40 David Lang wrote: > On Fri, 4 Mar 2016, Avleen Vig wrote: > > > Subject: Re: [rsyslog] Forwarding to multiple syslog servers and HA > > > > On Thu, Mar 3, 2016 at 6:30 PM David Lang wrote: > > > >> On Thu, 3 Mar 2016, Avleen Vig wrote: > >> > >>> Hi folks! > >>> > >>>

Re: [rsyslog] Forwarding to multiple syslog servers and HA

2016-03-03 Thread David Lang
On Fri, 4 Mar 2016, Avleen Vig wrote: Subject: Re: [rsyslog] Forwarding to multiple syslog servers and HA On Thu, Mar 3, 2016 at 6:30 PM David Lang wrote: On Thu, 3 Mar 2016, Avleen Vig wrote: Hi folks! I'm looking at setting up some systems, where rsyslog is reading logs from disk and

Re: [rsyslog] Forwarding to multiple syslog servers and HA

2016-03-03 Thread Avleen Vig
On Thu, Mar 3, 2016 at 6:30 PM David Lang wrote: > On Thu, 3 Mar 2016, Avleen Vig wrote: > > > Hi folks! > > > > I'm looking at setting up some systems, where rsyslog is reading logs > from > > disk and forwarding them to two centralise servers at the same time. > > > > I have a question around a

Re: [rsyslog] Forwarding to multiple syslog servers and HA

2016-03-03 Thread David Lang
On Thu, 3 Mar 2016, Avleen Vig wrote: Hi folks! I'm looking at setting up some systems, where rsyslog is reading logs from disk and forwarding them to two centralise servers at the same time. I have a question around a specific failure scenario: If one of the two central servers goes down, ho

[rsyslog] Forwarding to multiple syslog servers and HA

2016-03-03 Thread Avleen Vig
Hi folks! I'm looking at setting up some systems, where rsyslog is reading logs from disk and forwarding them to two centralise servers at the same time. I have a question around a specific failure scenario: If one of the two central servers goes down, how does rsyslog behave? Does it keep se

Re: [rsyslog] imfile buffer overflow master-candidate

2016-03-03 Thread Brian Knox
Here we go - https://github.com/rsyslog/rsyslog/pull/840 On Thu, Mar 3, 2016 at 9:15 AM, Brian Knox wrote: > > https://github.com/rsyslog/rsyslog/blob/b5649a98107a8e6b7042e103f17bb16e907504f2/plugins/imfile/imfile.c#L686 > > Looks like getBasename should perhaps return a -1 if it doesn't find a

Re: [rsyslog] imfile buffer overflow master-candidate

2016-03-03 Thread Brian Knox
https://github.com/rsyslog/rsyslog/blob/b5649a98107a8e6b7042e103f17bb16e907504f2/plugins/imfile/imfile.c#L686 Looks like getBasename should perhaps return a -1 if it doesn't find a slash - and then we can "do the right thing" based on that. I'll see if I can sneak in time for a fix today or tomo

Re: [rsyslog] imfile buffer overflow master-candidate

2016-03-03 Thread Brian Knox
line 727 in imfile.c : memcpy(dirn, inst->pszFileName, i); /* do not copy slash */ On Thu, Mar 3, 2016 at 8:53 AM, Brian Knox wrote: > I've found a buffer overflow in imfile in the master-candidate branch. To > reproduce, make an imfile config that uses a relative path rather than > a

Re: [rsyslog] imfile buffer overflow master-candidate

2016-03-03 Thread Brian Knox
A little more info: Program received signal SIGABRT, Aborted. 0x769efcc9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 56../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) backtrace #0 0x769efcc9 in __GI_raise (sig=sig@ent

[rsyslog] imfile buffer overflow master-candidate

2016-03-03 Thread Brian Knox
I've found a buffer overflow in imfile in the master-candidate branch. To reproduce, make an imfile config that uses a relative path rather than absolute to a file: ``` module(load="imfile" PollingInterval="10") input( type="imfile" tag="crash" File="crashme" ) *.* /var/