diff options
| author | Rainer Gerhards <rgerhards@adiscon.com> | 2011-03-18 14:21:09 +0100 |
|---|---|---|
| committer | Rainer Gerhards <rgerhards@adiscon.com> | 2011-03-18 14:21:09 +0100 |
| commit | bb67fd7fbf99ce0ec01b347fad5d1d9d101bfa5d (patch) | |
| tree | ec467b96d9b511d887e945bc938b6e7522189104 /plugins/imklog | |
| parent | f057fb2db388cc16475f9c5a7de64aeb1f3bdb43 (diff) | |
| download | rsyslog-bb67fd7fbf99ce0ec01b347fad5d1d9d101bfa5d.tar.gz rsyslog-bb67fd7fbf99ce0ec01b347fad5d1d9d101bfa5d.tar.xz rsyslog-bb67fd7fbf99ce0ec01b347fad5d1d9d101bfa5d.zip | |
experimental: support for systemd-induced second PRI in klog
if systemd writes a kernel log entry with a non-kernel priority,
the priority recorded in the kernel log will be wrong. However,
it will be immediately followed by another priority (with the
kernel timestamp in between, if enabled). So imklog now tries
to see if there is a second PRI and, if so, uses it. Note that
we already support non-kernel PRIs in the kernel log, as this
was done in BSD for quite some while. HOWEVER the config
statement "$klogpermitnonkernelfacility on" must be used to
permit this (otherwise non kernel messages are dropped).
Sample of a such a message on a kernel without timestamping
enabled:
$ echo '<14>text' > /dev/kmsg
$ dmesg -r
<4><14>text
NOTE: support for timestamp is NOT YET ENABLED!
Diffstat (limited to 'plugins/imklog')
| -rw-r--r-- | plugins/imklog/imklog.c | 24 |
1 files changed, 20 insertions, 4 deletions
diff --git a/plugins/imklog/imklog.c b/plugins/imklog/imklog.c index 69c8cd1a..c09fa4d8 100644 --- a/plugins/imklog/imklog.c +++ b/plugins/imklog/imklog.c @@ -186,12 +186,28 @@ rsRetVal imklogLogIntMsg(int priority, char *fmt, ...) rsRetVal Syslog(int priority, uchar *pMsg) { DEFiRet; + int pri = -1; rsRetVal localRet; - /* Output using syslog */ - localRet = parsePRI(&pMsg, &priority); - if(localRet != RS_RET_INVALID_PRI && localRet != RS_RET_OK) - FINALIZE; + /* first check if we have two PRIs. This can happen in case of systemd, + * in which case the second PRI is the rigth one. + * TODO: added kernel timestamp support to this PoC. -- rgerhards, 2011-03-18 + */ + if(pMsg[3] == '<') { /* could be a pri... */ + uchar *pMsgTmp = pMsg + 3; + localRet = parsePRI(&pMsgTmp, &pri); + if(localRet == RS_RET_OK && pri >= 8 && pri <= 192) { + /* *this* is our PRI */ + DBGPRINTF("imklog detected secondary PRI in klog msg\n"); + pMsg = pMsgTmp; + priority = pri; + } + } + if(pri == -1) { + localRet = parsePRI(&pMsg, &priority); + if(localRet != RS_RET_INVALID_PRI && localRet != RS_RET_OK) + FINALIZE; + } /* if we don't get the pri, we use whatever we were supplied */ /* ignore non-kernel messages if not permitted */ |