SysLog2ODBC is crashing when the SysLog message is longer than 1024 bytes.
The following was posted by a user in the discussion forum. I've created the bug entry to have this fixed or to alert potential users of this issue if it isn't fixed:
User exjobb wrote:
I wanted to stress test syslog2ODBC so i downloaded Kiwi SyslogGen, a freeware tool to generate syslog messages and it has an option to send UDP syslog messages larger than 1024 bytes, which causes syslg2odbc to hang, with the error:
SysLog2ODBC [Error] - recvfrom [WSAGetLastError(): 10040]
You can download kiwi sysloggGen from http://www.kiwisyslog.com/info_sysloggen.htm to try this out yourself.
This is a big problem, if an attacker were to crash our syslog deamon :(
Any help appreciated.
thanks.
----------
I enabled logging in syslog2odbc.ini and sent one of these messages...
[Logging]
LogToFile=1
LogFilePath=C:\SysLog2ODBC.log
MinSeverity=7
Here is the log:
<LOG>
2007-05-09 16:29:31 [Debug] - Using following configuration:
Verbosity level: 7 [Debug]
Bind to IP: 10.131.48.219
UDP Port: 514
Default values
facility: 0 [Kernel]
severity: 4 [Warning]
ODBC Conn. string: DSN=Syslog2ODBC;UID=edited;PWD=Edited
Wait on error: 30
Max retry count: 6
SQL Statement: INSERT INTO Data( Msg, SenderIP, Priority, Severity, Facility, ReceivedAt) VALUES ( ?, ?, ?, ?, ?, GETDATE())
2007-05-09 16:29:31 [Debug] - [01000] [Microsoft][ODBC SQL Server Driver][SQL Server]Changed database context to 'syslog'. (5701)
2007-05-09 16:29:31 [Debug] - [01000] [Microsoft][ODBC SQL Server Driver][SQL Server]Changed language setting to us_english. (5703)
2007-05-09 16:29:31 [Info] - Started!
2007-05-09 16:30:26 [Error] - recvfrom [WSAGetLastError(): 10040]
</LOG>