kernel logging is broken if syslogd.cache survives a system boot

                  .--.  .--.              .--.
.-----.--.--.-----|  |--|  :-----.-----.--|  |
|__ --|  |  |__ --|    <|  |  _  |  _  |  _  |    RFC3164 :: syslogd for Linux
|_____|___  |_____|__|__|__|_____|___  |_____|    RFC5424 :: w/NetBSD syslogp()
      |_____|                    |_____|

<23>Aug 24 05:14:15 192.0.2.1 myproc[8710]: Kilroy was here.
<23>1 2019-11-04T00:50:15.001234+01:00 troglobit myproc 8710 - - Kilroy was here.

Introduction

This is the continuation of the original Debian/Ubuntu syslog daemon, updated with full RFC3164 and RFC5424 support from NetBSD and FreeBSD. The package includes the libsyslog.{a,so} library with a syslog.h header replacement, the syslogd daemon, and a command line tool called logger.

libsyslog and syslog/syslog.h, derived directly from NetBSD, expose syslogp() and other new features available only in RFC5424:

The syslogd daemon is an enhanced version of the standard Berkeley utility program, updated with DNA from FreeBSD. It provides logging of messages received from the kernel, programs and facilities on the local host as well as messages from remote hosts. Although fully compatible with standard C-library implementations of the syslog() API (GLIBC, musl libc, uClibc), libsyslog must be used in your application to unlock the new RFC5424 syslogp() API.

The included logger tool is primarily made for use with sysklogd, but can be used stand-alone too. It is not command line compatible with the "standard" Linux logger tool from the bsdutils project. Instead it is compatible with the actual BSD logger tool(s) -- only major difference is its support for -I PID, similar to the bsdutils --id=PID. The logger tool can be used from the command line, or script, to send both RFC5424 (default) and old-style (BSD) RFC3164 formatted messages using libsyslog to syslogd for local processing, or to a remote server.

Main differences from the original sysklogd package are:

The separate klogd daemon is no longer part of the sysklogd project, syslogd now natively supports logging kernel messages as well
Major command line changes to syslogd, for compatibilty with *BSD
Supports include /etc/syslog.d/*.conf directive, see example .conf
Built-in log-rotation support, with compression by default, useful for embedded systems. No need for cron and/or a separate log rotate daemon
Full RFC3164 and RFC5424 support from NetBSD and FreeBSD
Support for sending RFC3164 style remote syslog messages, including timestamp and hostname. Defaults to send w/o for compatibility
Support for sending RFC5424 style remote syslog messages
Support for sending messages to a custom port on a remote server
Support for listening to a custom port
Support for remote peer filtering, from FreeBSD
Support for disabling DNS reverse lookups for each remote log message
Support for FreeBSD Secure Mode, remote logging enabled by default(!)
Includes a fit for purpose logger tool, compatible with syslogd, leveraging the full RFC5424 capabilities (msgid etc.)
Includes a syslog library and system header replacement for logging
FreeBSD socket receive buffer size patch
Avoid blocking syslogd if console is backed up
Touch PID file on SIGHUP, for integration with Finit
GNU configure & build system to ease porting/cross-compiling
Support for configuring remote syslog timeout

Please file bug reports, or send pull requests for bug fixes and/or proposed extensions at GitHub.

Using -lsyslog

libsyslog is by default installed as a library with a header file:

#include <syslog/syslog.h>

The output from the pkg-config tool holds no surprises:

$ pkg-config --libs --static --cflags libsyslog
-I/usr/local/include -L/usr/local/lib -lsyslog

The prefix path /usr/local/ shown here is only the default. Use the configure script to select a different prefix when installing libsyslog.

For GNU autotools based projects, instead of issuing the pkg-config command manually, use the following in configure.ac:

# Check for required libraries
PKG_CHECK_MODULES([syslog], [libsyslog >= 2.0])

and for your "proggy" in Makefile.am:

proggy_CFLAGS = $(syslog_CFLAGS)
proggy_LDADD  = $(syslog_LIBS)

The distribution comes with an example program that utilizes the NetBSD API and links against libsyslog.

Build & Install

The GNU Configure & Build system use /usr/local as the default install prefix. In many cases this is useful, but this means the configuration files and cache files will also use that same prefix. Most users have come to expect those files in /etc/ and /var/run/ and configure has a few useful options that are recommended to use:

./configure --prefix=/usr --sysconfdir=/etc --runstatedir=/run
make -j5
sudo make install-strip

You may want to remove the --prefix=/usr option. Most users prefer non-distro binaries in /usr/local or /opt.

Note: the --runstatedir option should point to a filesystem that is cleaned at reboot. syslogd relies on this for its syslogd.cache file, which keeps track of the last read kernel log message from /dev/kmsg.

Building from GIT

If you want to contribute, or just try out the latest but unreleased features, then you need to know a few things about the GNU build system:

configure.ac and a per-directory Makefile.am are key files
configure and Makefile.in are generated from autogen.sh, they are not stored in GIT but automatically generated for the release tarballs
Makefile is generated by configure script

To build from GIT you first need to clone the repository and run the autogen.sh script. This requires automake and autoconf to be installed on your system.

git clone https://github.com/troglobit/sysklogd.git
cd sysklogd/
./autogen.sh
./configure && make

GIT sources are a moving target and are not recommended for production systems, unless you know what you are doing!

Note: some systems may have an older, or a vanilla, version of the GNU autoconf package that does not support --runstatedir (above). Users on such systems are recommended to use --localstatedir, the $runstatedir used by sysklogd is derived from that if missing.

Origin & References

This is the continuation of the original sysklogd by Dr. G.W. Wettstein and Martin Schulze. Currently maintained, and almost completely rewritten by Joachim Wiberg, who spliced in fresh DNA strands from the NetBSD and FreeBSD projects. Much of the code base is NetBSD, but the command line interface is FreeBSD.

Note: the project name remains sysklogd, which was a combination of the names of the two main daemons, syslogd and klogd. However, since v2.0 klogd no longer exists, kernel logging is now native to syslogd.

The project was previously licensed under the GNU GPL, but since the removal of klogd, man pages, and resync with the BSDs the project is now 3-clause BSD licensed.

	The mark interval, as controlled by the
	.Fl m Ar INTV
	option, relies on an internal timer with 30 second granularity. Every
	30 seconds
	.Nm
	will attempt to log the text
	.Cd "-- MARK --"
	with (the internal) facility
	.Cd mark
	and priority
	.Cd info .
	Every log target is traversed, if at least
	.Ar INTV
	minutes have passed since the log target was written to, the mark is
	logged. Hence, it may be off by up to 30 seconds, this is by design.

troglobit / sysklogd Goto Github PK

sysklogd's Introduction

Table of Contents

Introduction

Using -lsyslog

Build & Install

Building from GIT

Origin & References

sysklogd's People

Contributors

Stargazers

Watchers

Forkers

sysklogd's Issues

Background

Problem report

Possible root cause/resolution

Recommend Projects

Recommend Topics

Recommend Org