diff options
| -rw-r--r-- | ChangeLog | 3 | ||||
| -rw-r--r-- | plugins/imklog/imklog.c | 3 | ||||
| -rw-r--r-- | plugins/imtemplate/imtemplate.c | 9 | ||||
| -rw-r--r-- | plugins/imudp/imudp.c | 2 | ||||
| -rw-r--r-- | plugins/imuxsock/imuxsock.c | 2 | ||||
| -rw-r--r-- | syslogd.c | 27 | ||||
| -rw-r--r-- | syslogd.h | 4 | ||||
| -rw-r--r-- | tcpsyslog.c | 13 |
8 files changed, 38 insertions, 25 deletions
@@ -1,5 +1,8 @@ --------------------------------------------------------------------------- Version 3.11.3 (rgerhards), 2008-02-?? +- slightly improved man pages for novice users +- fixed a bug in imklog which lead to duplicate message content in + kernel logs --------------------------------------------------------------------------- Version 3.11.2 (rgerhards), 2008-02-15 - added the capability to monitor text files and process their content diff --git a/plugins/imklog/imklog.c b/plugins/imklog/imklog.c index 5bc0f068..6e6f486d 100644 --- a/plugins/imklog/imklog.c +++ b/plugins/imklog/imklog.c @@ -130,6 +130,8 @@ static rsRetVal writeSyslogV(int iPRI, const char *szFmt, va_list va) /* here we must create our message object and supply it to the message queue */ + CHKiRet(parseAndSubmitMessage(LocalHostName, msgBuf, strlen(msgBuf), MSG_DONT_PARSE_HOSTNAME)); +#if 0 CHKiRet(msgConstruct(&pMsg)); MsgSetUxTradMsg(pMsg, msgBuf); MsgSetRawMsg(pMsg, msgBuf); @@ -143,6 +145,7 @@ static rsRetVal writeSyslogV(int iPRI, const char *szFmt, va_list va) /* provide message to the queue engine */ logmsg(pMsg, INTERNAL_MSG); +#endif finalize_it: RETiRet; diff --git a/plugins/imtemplate/imtemplate.c b/plugins/imtemplate/imtemplate.c index 867f2778..e1e29ba6 100644 --- a/plugins/imtemplate/imtemplate.c +++ b/plugins/imtemplate/imtemplate.c @@ -255,10 +255,10 @@ CODESTARTrunInput * in syslogd.c (sorry, folks...). * * If you received a full syslog message that must be decoded by a message - * parser, printchopped() is the way to go. It's not just a funny name + * parser, parseAndSubmitMessage() is the way to go. It's not just a funny name * but also a quite some legacy. Consequently, its interface is, ummm, not * well designed. - * printchopped((char*)fromHost, (char*) pRcvBuf, lenRcvd, fd, bParseHost); + * parseAndSubmitMessage((char*)fromHost, (char*) pRcvBuf, lenRcvd, bParseHost); * fromHost * is the host that we received the message from (a string) * pRcvBuf @@ -268,14 +268,11 @@ CODESTARTrunInput * NOT a standard C-string. Most importantly it is NOT expected to be * \0-terminated. Thus the lenght is vitally imporant (if it is wrong, * rsyslogd will probably segfault). - * fd - * is the file descriptor that the message was received from. It is - * purely used for displaying purposes. If you don't have a file - * descriptor, simply provide the value 0. * bParseHost * is a boolean (0-no, 1-yes). It tells the parser whether or not * a hostname should be parsed from the message. This is important * for sources that are known not to provide a hostname. + * Use define MSG_PARSE_HOSTNAME and MSG_DONT_PARSE_HOSTNAME * * Another, more elaborate, way is to create the message object ourselves and * pass it to the rule engine. That way is more appropriate if the message diff --git a/plugins/imudp/imudp.c b/plugins/imudp/imudp.c index fa9db53a..fa979039 100644 --- a/plugins/imudp/imudp.c +++ b/plugins/imudp/imudp.c @@ -190,7 +190,7 @@ CODESTARTrunInput */ if(isAllowedSender(pAllowedSenders_UDP, (struct sockaddr *)&frominet, (char*)fromHostFQDN)) { - printchopped((char*)fromHost, (char*) pRcvBuf, l, udpLstnSocks[i+1], 1); + parseAndSubmitMessage((char*)fromHost, (char*) pRcvBuf, l, MSG_PARSE_HOSTNAME); } else { dbgprintf("%s is not an allowed sender\n", (char*)fromHostFQDN); if(option_DisallowWarning) { diff --git a/plugins/imuxsock/imuxsock.c b/plugins/imuxsock/imuxsock.c index 54bbe039..819057df 100644 --- a/plugins/imuxsock/imuxsock.c +++ b/plugins/imuxsock/imuxsock.c @@ -167,7 +167,7 @@ static rsRetVal readSocket(int fd, int bParseHost) iRcvd = recv(fd, line, MAXLINE - 1, 0); dbgprintf("Message from UNIX socket: #%d\n", fd); if (iRcvd > 0) { - printchopped(LocalHostName, line, iRcvd, fd, bParseHost); + parseAndSubmitMessage(LocalHostName, line, iRcvd, bParseHost); } else if (iRcvd < 0 && errno != EINTR) { char errStr[1024]; rs_strerror_r(errno, errStr, sizeof(errStr)); @@ -1265,7 +1265,10 @@ finalize_it: } -/* rgerhards, 2006-11-30: I have greatly changed this function. Formerly, +/* This takes a received message that must be decoded and submits it to + * the main message queue. The function calls the necessary parser. + * + * rgerhards, 2006-11-30: I have greatly changed this function. Formerly, * it tried to reassemble multi-part messages, which is a legacy stock * sysklogd concept. In essence, that was that messages not ending with * \0 were glued together. As far as I can see, this is a sysklogd @@ -1284,9 +1287,18 @@ finalize_it: * For rfc3195 support, we needed to modify the algo for host parsing, so we can * no longer rely just on the source (rfc3195d forwarded messages arrive via * unix domain sockets but contain the hostname). rgerhards, 2005-10-06 + * + * rgerhards, 2008-02-18: + * This function was previously called "printchopped"() and has been renamed + * as part of the effort to create a clean internal message submission interface. + * It also has been adopted to our usual calling interface, but currently does + * not provide any useful return states. But we now have the hook and things can + * improve in the future. <-- TODO! */ -void printchopped(char *hname, char *msg, int len, int fd, int bParseHost) +rsRetVal +parseAndSubmitMessage(char *hname, char *msg, int len, int bParseHost) { + DEFiRet; register int iMsg; char *pMsg; char *pData; @@ -1301,8 +1313,6 @@ void printchopped(char *hname, char *msg, int len, int fd, int bParseHost) assert(msg != NULL); assert(len >= 0); - dbgprintf("Message length: %d, File descriptor: %d.\n", len, fd); - /* we first check if we have a NUL character at the very end of the * message. This seems to be a frequent problem with a number of senders. * So I have now decided to drop these NULs. However, if they are intentional, @@ -1362,7 +1372,7 @@ void printchopped(char *hname, char *msg, int len, int fd, int bParseHost) logerrorInt("Uncompression of a message failed with return code %d " "- enable debug logging if you need further information. " "Message ignored.", ret); - return; /* unconditional exit, nothing left to do... */ + FINALIZE; /* unconditional exit, nothing left to do... */ } pData = deflateBuf; pEnd = deflateBuf + iLenDefBuf; @@ -1374,7 +1384,7 @@ void printchopped(char *hname, char *msg, int len, int fd, int bParseHost) if(len > 0 && *msg == 'z') { logerror("Received a compressed message, but rsyslogd does not have compression " "support enabled. The message will be ignored."); - return; + FINALIZE; } # endif /* ifdef USE_NETZIP */ @@ -1396,7 +1406,7 @@ void printchopped(char *hname, char *msg, int len, int fd, int bParseHost) */ dbgprintf("internal error: iMsg > MAXLINE in printchopped()\n"); } - return; /* in this case, we are done... nothing left we can do */ + FINALIZE; /* in this case, we are done... nothing left we can do */ } if(*pData == '\0') { /* guard against \0 characters... */ /* changed to the sequence (somewhat) proposed in @@ -1439,7 +1449,8 @@ void printchopped(char *hname, char *msg, int len, int fd, int bParseHost) /* typically, we should end up here! */ printline(hname, tmpline, bParseHost); - return; +finalize_it: + RETiRet; } /* rgerhards 2004-11-09: the following is a function that can be used @@ -55,7 +55,9 @@ void logerrorVar(char *fmt, ...) __attribute__((format(printf, 1, 2))); void logerrorSz(char *type, char *errMsg); void logerrorInt(char *type, int iErr); -void printchopped(char *hname, char *msg, int len, int fd, int iSourceType); +#define MSG_PARSE_HOSTNAME 1 +#define MSG_DONT_PARSE_HOSTNAME 0 +rsRetVal parseAndSubmitMessage(char *hname, char *msg, int len, int bParseHost); int isAllowedSender(struct AllowedSenders *pAllowRoot, struct sockaddr *pFrom, const char *pszFromHost); void getCurrTime(struct syslogTime *t); int formatTimestampToMySQL(struct syslogTime *ts, char* pDst, size_t iLenDst); diff --git a/tcpsyslog.c b/tcpsyslog.c index f8620e38..c02d44fc 100644 --- a/tcpsyslog.c +++ b/tcpsyslog.c @@ -564,8 +564,8 @@ void TCPSessPrepareClose(int iTCPSess) * this case. */ dbgprintf("Extra data at end of stream in legacy syslog/tcp message - processing\n"); - printchopped(pTCPSessions[iTCPSess].fromHost, pTCPSessions[iTCPSess].msg, - pTCPSessions[iTCPSess].iMsg, pTCPSessions[iTCPSess].sock, 1); + parseAndSubmitMessage(pTCPSessions[iTCPSess].fromHost, pTCPSessions[iTCPSess].msg, + pTCPSessions[iTCPSess].iMsg, MSG_PARSE_HOSTNAME); pTCPSessions[iTCPSess].bAtStrtOfFram = 1; } } @@ -703,8 +703,7 @@ int TCPSessDataRcvd(int iTCPSess, char *pData, int iLen) /* emergency, we now need to flush, no matter if * we are at end of message or not... */ - printchopped(pTCPSessions[iTCPSess].fromHost, pMsg, iMsg, - pTCPSessions[iTCPSess].sock, 1); + parseAndSubmitMessage(pTCPSessions[iTCPSess].fromHost, pMsg, iMsg, MSG_PARSE_HOSTNAME); iMsg = 0; /* we might think if it is better to ignore the rest of the * message than to treat it as a new one. Maybe this is a good @@ -715,8 +714,7 @@ int TCPSessDataRcvd(int iTCPSess, char *pData, int iLen) if(*pData == '\n' && pTCPSessions[iTCPSess].eFraming == TCP_FRAMING_OCTET_STUFFING) { /* record delemiter? */ - printchopped(pTCPSessions[iTCPSess].fromHost, pMsg, iMsg, - pTCPSessions[iTCPSess].sock, 1); + parseAndSubmitMessage(pTCPSessions[iTCPSess].fromHost, pMsg, iMsg, MSG_PARSE_HOSTNAME); iMsg = 0; pTCPSessions[iTCPSess].bAtStrtOfFram = 1; ++pData; @@ -730,8 +728,7 @@ int TCPSessDataRcvd(int iTCPSess, char *pData, int iLen) pTCPSessions[iTCPSess].iOctetsRemain--; if(pTCPSessions[iTCPSess].iOctetsRemain < 1) { /* we have end of frame! */ - printchopped(pTCPSessions[iTCPSess].fromHost, pMsg, iMsg, - pTCPSessions[iTCPSess].sock, 1); + parseAndSubmitMessage(pTCPSessions[iTCPSess].fromHost, pMsg, iMsg, MSG_PARSE_HOSTNAME); iMsg = 0; pTCPSessions[iTCPSess].bAtStrtOfFram = 1; } |