aboutsummaryrefslogtreecommitdiff
path: root/usr.sbin/syslogd
Commit message (Collapse)AuthorAgeFilesLines
* fix up documentation/comments: processname is not defined, but programnameJohn-Mark Gurney2020-12-102-6/+6
| | | | | | | | | | | is.. a couple other minor documentation fixes that igor caught... MFC after: 1 week Notes: svn path=/head/; revision=368529
* syslog.conf(5): Fix a few mandoc warningsGordon Bergling2020-11-201-4/+4
| | | | | | | | - new sentence, new line - skipping paragraph macro: Pp at the end of Sh Notes: svn path=/head/; revision=367900
* Fix build post-r367455.Cy Schubert2020-11-071-1/+1
| | | | | | | | MFC after: 2 weeks X-MFC with: r367455 Notes: svn path=/head/; revision=367459
* syslogd: Stop trying to send remote messages through special socketsBryan Drewery2020-11-071-3/+3
| | | | | | | | | | | | | | | | | | | Specifically this was causing the /dev/klog fd and the signal pipe handling fd to get a sendmsg(2) called on them and always returned [ENOTSOCK]. r310350 combined these sockets into the main socket list and properly skipped AF_UNSPEC at the sendmsg(2) call but later in r344739 it was broken such that these special sockets were no longer excluded since the AF_UNSPEC check specifically excluded these special sockets. Only these special sockets have sl_sa = NULL. The sl_family checks should be redundant now but are left in case of future changes so the intent is clearer. MFC after: 2 weeks Notes: svn path=/head/; revision=367455
* syslogd: Avoid trimming host names in RFC 5424 modeMark Johnston2020-10-091-2/+6
| | | | | | | | | | | | | RFC 5424 says that implementations should log hostnames in FQDN format. Only trim host names in RFC 3164 mode. PR: 250014 Submitted by: Dmitry Wagin <dmitry.wagin@ya.ru> MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D26644 Notes: svn path=/head/; revision=366576
* Restore local kernel "prog" filtering lost in r332099.Bryan Drewery2020-04-281-12/+74
| | | | | | | | | | | | | | | | | | | | This behavior is most relevant for ipfw(4) as documented in syslog.conf(5). The recent addition of property-based regex filters in r359327 is a fine workaround for this but the behavior was present since 1997 and documented. This only fixes local matching of the "kernel program". It does not change the forwarded format at all. On the remote side it will still be "kernel: ipfw:" and not be parsed as a kernel message. This matches old behavior. MFC after: 2 weeks Reviewed by: markj Relnotes: yes Differential Revision: https://reviews.freebsd.org/D24286 Notes: svn path=/head/; revision=360441
* Fix typo.Andrey V. Elsukov2020-03-261-1/+1
| | | | | | | MFC after: 2 weeks Notes: svn path=/head/; revision=359328
* Add property-based filters for syslogd.Andrey V. Elsukov2020-03-262-18/+440
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Property-based filters allow substring and regular expressions (see re_format(7)) matching against various message attributes. Filter specification starts with '#:' or ':' followed by three comma-separated fields property, operator, "value". Value must be double-quoted. A double quote and backslash must be escaped by a blackslash. Following properties are supported as test value: o msg - body of the message received; o programname - program name sent the message; o hostname - hostname of message's originator; o source - an alias for hostname. Supported operators: o contains - true if filter value is found as a substring of property; o isequal - true if filter value is equal to property; o startswith - true if property starts with filter value; o regex - true if property matches basic regular expression defined in filter value; o ereregex - true if property matches extended regular expression defined in filter value; Operator may be prefixed by '!' to invert compare logic or by 'icase_' to make comparison function case insensitive. Submitted by: Boris N. Lytochkin <lytboris at gmail com> MFC after: 2 weeks Relnotes: yes Differential Revision: https://reviews.freebsd.org/D23468 Notes: svn path=/head/; revision=359327
* log daemon.info to /var/log/daemon.log by defaultSteve Wills2019-09-171-0/+1
| | | | | | | | | | | | log daemon facility now that daemon(8) has syslog support which defaults to daemon facility, info priority Reviewed by: bapt Approved by: bapt Differential Revision: https://reviews.freebsd.org/D21561 Notes: svn path=/head/; revision=352460
* Fix compilation of world with WITHOUT_{INET,INET6}_SUPPORT or both set.Bjoern A. Zeeb2019-03-031-1/+7
| | | | | | | | | | | | | | Buildworld failed when both WITHOUT_INET6_SUPPORT and INET equivalent were set. Fix netstat and syslogd by applying appropriate #ifdef INET/INET6 to make world compile again. Reviewed by: ngie, hrs, ume Welcomed by: Michael Dexter (D17040) MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D19418 Notes: svn path=/head/; revision=344740
* Use struct addrinfo instead of struct sockaddr_storageHiroki Sato2019-03-031-20/+31
| | | | | | | to store peer addresses. Notes: svn path=/head/; revision=344739
* An IPv6 address matching should be fixed. Specifying an IPv6Hajimu UMEMOTO2019-02-241-2/+2
| | | | | | | | | | address by the -a option was broken since r309933. Reported by: "O. Hartmann" <ohartmann [...] walstatt.org> MFC after: 1 week Notes: svn path=/head/; revision=344491
* Remove trailing slash in pathname so that valid METALOG is created in theBrad Davis2018-08-251-1/+1
| | | | | | | | | | NO_ROOT case of make packages. Submitted by: Dan McGregor <dan.mcgregor@usask.ca> Approved by: re (rgrimes) Notes: svn path=/head/; revision=338319
* Move all syslogd related configs to usr.sbin/syslogd/Brad Davis2018-08-215-0/+57
| | | | | | | | | | | This helps with pkgbase as it switches these to use CONFS which properly tags them as config files. Approved by: will (mentor) Differential Revision: https://reviews.freebsd.org/D16783 Notes: svn path=/head/; revision=338146
* Allow the use of slashes in process names of RFC 3164 formatted messages.Ed Schouten2018-07-071-1/+1
| | | | | | | | | | | | Tools such as Postfix use slashes in process names for hierarchy (postfix/qmgr). By allowing these slashes, syslogd is able to extract the process name and process ID nicely, so that they can be stored in RFC 5424 message fields. MFC after: 1 week Notes: svn path=/head/; revision=336060
* Document that syslogd -v has no effect when RFC 5424 mode is enabled.Ed Schouten2018-07-021-1/+5
| | | | | | | | | | | | The variable it sets, LogFacPri, is only used in the RFC 3164 formatting codepath. PR: 229457 Reported by: Andre Albsmeier MFC after: 1 week Notes: svn path=/head/; revision=335862
* Restore the order in which RFC 3164 messages with fac/pri are formatted.Ed Schouten2018-07-021-2/+3
| | | | | | | | | | | | | | The refactoring of the syslogd code to format messages using iovecs slightly altered the output of syslogd by placing the facility/priority after the hostname, as opposed to printing it right before. This change reverts the behaviour to be consistent with how it was before. PR: 229457 Reported by: Andre Albsmeier MFC after: 1 week Notes: svn path=/head/; revision=335861
* Still parse messages that don't contain an RFC 3164 timestamp.Ed Schouten2018-06-221-55/+57
| | | | | | | | | | | | | | | | | | | The changes made in r326573 required that messages always start with an RFC 3164 timestamp. It looks like certain devices, but also certain logging libraries (Python 3's "logging" package) simply don't generate RFC 3164 formatted messages containing a timestamp. Make timestamps optional again. When the timestamp is missing, also assume that the message contains no hostname. The first word of the message likely already belongs to the message payload. PR: 229236 Reported by: Michael Grimm & Marek Zarychta Reviewed by: glebius (cursory) MFC after: 1 week Notes: svn path=/head/; revision=335565
* Fix bad logic in iovlist_truncate().Ed Schouten2018-06-181-2/+2
| | | | | | | | | | | | | To conform to RFC 5426, this function is intended to truncate messages if they exceed the message size limits. Unfortunately, the amount of space was computed the wrong way around, causing messages to be truncated entirely. Reported by: Michael Grimm on stable@ MFC after: 3 days Notes: svn path=/head/; revision=335314
* Correct size for allocation and bzero of fdsr.Xin LI2018-04-231-2/+2
| | | | | | | MFC after: 2 weeks Notes: svn path=/head/; revision=332877
* Use proper alphabetic sorting of options.Ed Schouten2018-04-151-15/+15
| | | | Notes: svn path=/head/; revision=332511
* Add RFC 5424 syslog message output to syslogd.Ed Schouten2018-04-152-163/+299
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Move all of the code responsible for transmitting log messages into a separate function, fprintlog_write(). - Instead of manually modifying a list of iovecs, add a structure iovlist with some helper functions. - Alter the F_FORW (UDP message forwarding) case to also use iovecs like the other cases. Use sendmsg() instead of sendto(). - In the case of F_FORW, truncate the message to a size dependent on the address family (AF_INET, AF_INET6), as proposed by RFC 5426. - Move all traditional message formatting into fprintlog_bsd(). Get rid of some of the string copying and snprintf()'ing. Simply emit more iovecs to get the job done. - Increase ttymsg()'s limit of 7 iovecs to 32. Add a definition for this limit, so it can be reused by iovlist. - Add fprintlog_rfc5424() to emit RFC 5424 formatted log entries. - Add a "-O" command line option to enable RFC 5424 formatting. It would have been nicer if we supported "-o rfc5424", just like on NetBSD. Unfortunately, the "-o" flag is already used for a different purpose on FreeBSD. - Don't truncate hostnames in the RFC 5424 case, as suggested by that specific RFC. For people interested in using this, this feature can be enabled by adding the following line to /etc/rc.conf: syslogd_flags="-s -O rfc5424" Differential Revision: https://reviews.freebsd.org/D15011 Notes: svn path=/head/; revision=332510
* Fix enough warnings that we can build syslogd on all targets at WARNS=6.Ed Schouten2018-04-072-5/+5
| | | | | | | | | This also fixes the build on MIPS. Reported by: cy (MIPS build failure) Notes: svn path=/head/; revision=332165
* Push RFC 5424 message format from logmsg() into fprintlog().Ed Schouten2018-04-061-72/+78
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now that all of parsemsg() parses both RFC 3164 and 5424 messages and hands them to logmsg(), alter the latter to properly forward all RFC 5424 message attributes to fprintlog(). While there, make some minor cleanups to this code: - Instead of extending the existing code that compares hostnames and message bodies for deduplication, print all of the relevant message fields into a single string that we can compare ('saved'). - No longer let the behaviour of fprintflog() depend on whether 'msg == NULL' to print repetition messages, Simply decompose this function into fprintlog_first() and fprintlog_successive(). This makes the interpretation of function arguments less magical and also allows us to get consistent behaviour across RFC 3164 and 5424 when adding support for the RFC 5424 output format. - As RFC 5424 syslog messages have a dedicated application name field, alter the repetition messages to be printed on behalf of syslogd on the current system. Change these messages to use the local hostname, so that it's obvious which syslogd instance detected the repetition. Remove f_prevhost, as it has now become unnecessary. - Remove a useless strdup(). Deconsting the message string is safe in this specific case. Notes: svn path=/head/; revision=332118
* Remove some places where error messages are prefixed with "syslogd".Ed Schouten2018-04-061-16/+16
| | | | | | | | Due to using RFC 5424, the application name is stored in a dedicated field. It can simply be passed as an argument to logmsg() now. Notes: svn path=/head/; revision=332111
* Properly respect the passed in hostname for RFC 5424 messages.Ed Schouten2018-04-061-1/+3
| | | | | | | | Only override the hostname in case none is provided or when remote hostnames should be ignored. Notes: svn path=/head/; revision=332110
* Add RFC 5424 syslog message parsing to syslogd.Ed Schouten2018-04-061-120/+440
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Syslogd currently uses the RFC 3164 format for its log messages.One limitation of RFC 3164 is that it cannot be used to log entries with sub-second precision timestamps. One of our users has expressed a desire for doing this for doing some basic performance measurements. This change attempts to make a first cut at switching to RFC 5424 based logging. The first step is to alter syslogd's input path to properly parse such messages. It alters the logmsg() prototype to match the fields of RFC 5424. The parsemsg() function is extended to parse both RFC 3164 and 5424 messages and call into logmsg() accordingly. Additional changes include: - Introducing proper parsing of timestamps, so that they can be printed in any desired output format. This means we need to infer the year and timezone for RFC 3164 timestamps. - Removing ISKERNEL. This can now be realised by simply providing an APP-NAME (== "kernel"). - Extending RFC 3164 parsing to trim off the TAG prefix and using that to derive APP-NAME and PROCID. - Increase MAXLINE. RFC 5424 mentions we should support 2k messages. Differential Revision: https://reviews.freebsd.org/D14926 Notes: svn path=/head/; revision=332099
* Fix whitespace issues in r330034. No functional changes.Gleb Smirnoff2018-03-201-9/+9
| | | | Notes: svn path=/head/; revision=331270
* Fix two memory leaks in syslogdDavid Bright2018-02-261-3/+12
| | | | | | | | | | | | | | | | | | A memory leak in syslogd for processing of forward actions was reported. This modification adapts the patch submitted with that bug to fix the leak. While testing the modification, another leak was also found and fixed. PR: 198385 Submitted by: Sreeram <sreeramabs@yahoo.com> Reported by: Sreeram <sreeramabs@yahoo.com> Reviewed by: hrs MFC after: 1 week Sponsored by: Dell EMC Differential Revision: https://reviews.freebsd.org/D14510 Notes: svn path=/head/; revision=330034
* When parsing remote messages, require them to have standard timestampGleb Smirnoff2017-12-052-62/+105
| | | | | | | | | | | | | | | | field, and support properly parse out the hostname as described by RFC3164, which wasn't done before. However, don't discard message if it doesn't have hostname, for compatibility. Enable logging of the message supplied hostname instead of real hostname with -H switch. PR: 200933 Reported by: Konstantin Pavlov <thresh nginx.com> MFC after: 2 months Notes: svn path=/head/; revision=326573
* Revert r325558 as it is incorrect.Gleb Smirnoff2017-11-281-14/+1
| | | | Notes: svn path=/head/; revision=326339
* Fix obvious NULL pointer dereference from r310350.Gleb Smirnoff2017-11-281-6/+5
| | | | Notes: svn path=/head/; revision=326338
* General further adoption of SPDX licensing ID tags.Pedro F. Giffuni2017-11-202-2/+6
| | | | | | | | | | | | | | | | | Mainly focus on files that use BSD 3-Clause license. The Software Package Data Exchange (SPDX) group provides a specification to make it easier for automated tools to detect and summarize well known opensource licenses. We are gradually adopting the specification, noting that the tags are considered only advisory and do not, in any way, superceed or replace the license texts. Special thanks to Wind River for providing access to "The Duke of Highlander" tool: an older (2014) run over FreeBSD tree was useful as a starting point. Notes: svn path=/head/; revision=326025
* When parsing UDP messages skip optional hostname as described byGleb Smirnoff2017-11-081-1/+14
| | | | | | | | | | | | RFC 3164. PR: 200933 Submitted by: maxim Reported by: Konstantin Pavlov <thresh nginx.com> MFC after: 2 weeks Notes: svn path=/head/; revision=325558
* DIRDEPS_BUILD: Update dependencies.Bryan Drewery2017-10-311-1/+0
| | | | | | | Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=325188
* Fix another logic bug that came out of recent syslogd refactoring and exposed byMaxim Sobolev2017-04-151-5/+10
| | | | | | | | | | | the r316874: don't call shutdown(2) on all sockets, but only net ones, which seems to be the behaviour existed before that refactoring. Also don't call listen(2) in datagram sockets and fix misplaced debug messages while I am here. Reported by: peter Notes: svn path=/head/; revision=316973
* Since shutdown(2) on datagram socket is no longer a NOP after rev 316874Maxim Sobolev2017-04-151-2/+5
| | | | | | | | | | don't bother to select/recv on that socket. This prevents syslogd(8) from spinning endlessly when started with the -s option (default). Reported by: peter Notes: svn path=/head/; revision=316951
* Fix a regression which prevented an IPv6 address in a -b option fromHiroki Sato2017-03-201-1/+9
| | | | | | | | | | working. PR: 217939 Differential Revision: https://reviews.freebsd.org/D10064 Notes: svn path=/head/; revision=315643
* syslogd: try to print out a more helpful message in socksetup(..) if/whenEnji Cooper2017-03-201-1/+10
| | | | | | | | | | | | getaddrinfo fails If the asprintf call fails, fall back to the old code (as a last ditch effort to provide the end-user with helpful output). Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=315622
* syslogd: fix dprintf in socksetup(..)Enji Cooper2017-03-201-1/+2
| | | | | | | | | | | | | - Make the explanation more complete - Correct a minor grammar nit with verb tense. - Don't emit the message if `pe->pe_name` is NULL (it doesn't have much value). MFC after: 1 week Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=315620
* syslogd: don't leak `f` on failure in cfline(..)Enji Cooper2017-03-201-0/+2
| | | | | | | | | | | | Free `f` if an unknown priority or facility is parsed with the function. MFC after: 1 week Reported by: Coverity CID: 1368068 Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=315618
* syslogd: fix memory leaks in main(..) and allowaddr(..)Enji Cooper2017-03-151-12/+18
| | | | | | | | | | | | | | | | | | | - main(..): free memory assigned to fdsr before calling die(..). - allowaddr(..): free memory assigned to ap before returning from the function early. Add a `err` goto label to reduce freeaddrinfo/free(ap) logic duplication. MFC after: 1 week X-MFC notes: some of this is dependent on refactoring not MFCed Reported by: clang static analyzer, Coverity CID: 1367750 (ap leakage in allowaddr(..)) Submitted by: Tom Rix <trix@juniper.net> Reviewed by: ngie Sponsored by: Dell EMC Isilon, Juniper Differential Revision: D10004 Notes: svn path=/head/; revision=315322
* Correct nuance of -a :service -> "*" in r314563, r314585Enji Cooper2017-03-041-2/+2
| | | | | | | | | | | | | | | | | My attempt to correct the sender/receiver behavior was incorrect. The source port of the sender for forwarded datagrams is filtered with -a, and my change in r314585 didn't clarify that point at all. Wording is based on suggestion by hrs. MFC after: 28 days X-MFC with: r314563, r314585 Reported by: hrs In collaboration with: hrs, rgrimes Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=314642
* Correct verb change for service => `*` after r314563Enji Cooper2017-03-031-1/+1
| | | | | | | | | | | | | `*` means that packets will be received from a remote peer on any port. Since the point of interest is the syslogd instance (not the remote peer), the appropriate verb is "received", not "sent". MFC after: 1 month X-MFC with: r314563 Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=314585
* Wordsmith syslogd(8)Enji Cooper2017-03-021-12/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | - Clarify -p/-S options by using appropriate subject-verb modifiers (verb and modifiers suggested that the subject should have been singular). - Simplify/correct -a description: -- Be more terse when describing IPv4 (the "usual dotted notation" isn't necessarily well understood by the reader). Being blunt and saying "IPv4 address" with an optional netmask is. -- prefixlen is the appropriate terminology for IPv6. -- mask/prefixlen is optional, not required (as noted later on in the section). -- split up IPv4/IPv6 use so to clarify both forms. -- Fix wordiness when describing the optional "service" specifier. - -T: Use "cannot" instead of "can't" [*]. Bump .Dd for the changes. MFC after: 1 month Reported by: igor [*] Reviewed by: hrs Sponsored by: Dell EMC Isilon Differential Revision: https://reviews.freebsd.org/D9855 Notes: svn path=/head/; revision=314563
* Renumber copyright clause 4Warner Losh2017-02-284-4/+4
| | | | | | | | | | | | Renumber cluase 4 to 3, per what everybody else did when BSD granted them permission to remove clause 3. My insistance on keeping the same numbering for legal reasons is too pedantic, so give up on that point. Submitted by: Jan Schaumann <jschauma@stevens.edu> Pull Request: https://github.com/freebsd/freebsd/pull/96 Notes: svn path=/head/; revision=314436
* Parameterize out the length of struct filed->f_lasttime as `MAXDATELEN`Enji Cooper2017-02-251-4/+6
| | | | | | | | | | | | | | | | This removes the hardcoded value for the field (16) and the equivalent hardcoded lengths in logmsg(..). This change is being done to help stage future work to add RFC5424/RFC5434 support to syslogd(8). Obtained from: Isilon OneFS (dcd33d13da) (as part of a larger change) Submitted by: John Bauman <john.bauman@isilon.com> MFC after: 2 weeks Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=314233
* Use SRCTOP instead of .CURDIR relative paths with ".."Enji Cooper2017-02-241-2/+2
| | | | | | | | | | This simplifies pathing in make/displayed output MFC after: 1 week Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=314226
* Sort sys/ #includes some moreEnji Cooper2017-02-071-2/+2
| | | | | | | | | MFC after: 1 week X-MFC with: r313358 Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=313360
* Sort sys/ #includes and zap an unnecessary trailing space nearbyEnji Cooper2017-02-071-7/+7
| | | | | | | | MFC after: 1 week Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=313358
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-28 09:16:47 +0000