summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--ChangeLog3
-rw-r--r--plugins/imklog/imklog.c3
-rw-r--r--plugins/imtemplate/imtemplate.c9
-rw-r--r--plugins/imudp/imudp.c2
-rw-r--r--plugins/imuxsock/imuxsock.c2
-rw-r--r--syslogd.c27
-rw-r--r--syslogd.h4
-rw-r--r--tcpsyslog.c13
8 files changed, 38 insertions, 25 deletions
diff --git a/ChangeLog b/ChangeLog
index 322aa6af..429477b5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,8 @@
---------------------------------------------------------------------------
Version 3.11.3 (rgerhards), 2008-02-??
+- slightly improved man pages for novice users
+- fixed a bug in imklog which lead to duplicate message content in
+ kernel logs
---------------------------------------------------------------------------
Version 3.11.2 (rgerhards), 2008-02-15
- added the capability to monitor text files and process their content
diff --git a/plugins/imklog/imklog.c b/plugins/imklog/imklog.c
index 5bc0f068..6e6f486d 100644
--- a/plugins/imklog/imklog.c
+++ b/plugins/imklog/imklog.c
@@ -130,6 +130,8 @@ static rsRetVal writeSyslogV(int iPRI, const char *szFmt, va_list va)
/* here we must create our message object and supply it to the message queue
*/
+ CHKiRet(parseAndSubmitMessage(LocalHostName, msgBuf, strlen(msgBuf), MSG_DONT_PARSE_HOSTNAME));
+#if 0
CHKiRet(msgConstruct(&pMsg));
MsgSetUxTradMsg(pMsg, msgBuf);
MsgSetRawMsg(pMsg, msgBuf);
@@ -143,6 +145,7 @@ static rsRetVal writeSyslogV(int iPRI, const char *szFmt, va_list va)
/* provide message to the queue engine */
logmsg(pMsg, INTERNAL_MSG);
+#endif
finalize_it:
RETiRet;
diff --git a/plugins/imtemplate/imtemplate.c b/plugins/imtemplate/imtemplate.c
index 867f2778..e1e29ba6 100644
--- a/plugins/imtemplate/imtemplate.c
+++ b/plugins/imtemplate/imtemplate.c
@@ -255,10 +255,10 @@ CODESTARTrunInput
* in syslogd.c (sorry, folks...).
*
* If you received a full syslog message that must be decoded by a message
- * parser, printchopped() is the way to go. It's not just a funny name
+ * parser, parseAndSubmitMessage() is the way to go. It's not just a funny name
* but also a quite some legacy. Consequently, its interface is, ummm, not
* well designed.
- * printchopped((char*)fromHost, (char*) pRcvBuf, lenRcvd, fd, bParseHost);
+ * parseAndSubmitMessage((char*)fromHost, (char*) pRcvBuf, lenRcvd, bParseHost);
* fromHost
* is the host that we received the message from (a string)
* pRcvBuf
@@ -268,14 +268,11 @@ CODESTARTrunInput
* NOT a standard C-string. Most importantly it is NOT expected to be
* \0-terminated. Thus the lenght is vitally imporant (if it is wrong,
* rsyslogd will probably segfault).
- * fd
- * is the file descriptor that the message was received from. It is
- * purely used for displaying purposes. If you don't have a file
- * descriptor, simply provide the value 0.
* bParseHost
* is a boolean (0-no, 1-yes). It tells the parser whether or not
* a hostname should be parsed from the message. This is important
* for sources that are known not to provide a hostname.
+ * Use define MSG_PARSE_HOSTNAME and MSG_DONT_PARSE_HOSTNAME
*
* Another, more elaborate, way is to create the message object ourselves and
* pass it to the rule engine. That way is more appropriate if the message
diff --git a/plugins/imudp/imudp.c b/plugins/imudp/imudp.c
index fa9db53a..fa979039 100644
--- a/plugins/imudp/imudp.c
+++ b/plugins/imudp/imudp.c
@@ -190,7 +190,7 @@ CODESTARTrunInput
*/
if(isAllowedSender(pAllowedSenders_UDP,
(struct sockaddr *)&frominet, (char*)fromHostFQDN)) {
- printchopped((char*)fromHost, (char*) pRcvBuf, l, udpLstnSocks[i+1], 1);
+ parseAndSubmitMessage((char*)fromHost, (char*) pRcvBuf, l, MSG_PARSE_HOSTNAME);
} else {
dbgprintf("%s is not an allowed sender\n", (char*)fromHostFQDN);
if(option_DisallowWarning) {
diff --git a/plugins/imuxsock/imuxsock.c b/plugins/imuxsock/imuxsock.c
index 54bbe039..819057df 100644
--- a/plugins/imuxsock/imuxsock.c
+++ b/plugins/imuxsock/imuxsock.c
@@ -167,7 +167,7 @@ static rsRetVal readSocket(int fd, int bParseHost)
iRcvd = recv(fd, line, MAXLINE - 1, 0);
dbgprintf("Message from UNIX socket: #%d\n", fd);
if (iRcvd > 0) {
- printchopped(LocalHostName, line, iRcvd, fd, bParseHost);
+ parseAndSubmitMessage(LocalHostName, line, iRcvd, bParseHost);
} else if (iRcvd < 0 && errno != EINTR) {
char errStr[1024];
rs_strerror_r(errno, errStr, sizeof(errStr));
diff --git a/syslogd.c b/syslogd.c
index 71378f6e..82fd7c74 100644
--- a/syslogd.c
+++ b/syslogd.c
@@ -1265,7 +1265,10 @@ finalize_it:
}
-/* rgerhards, 2006-11-30: I have greatly changed this function. Formerly,
+/* This takes a received message that must be decoded and submits it to
+ * the main message queue. The function calls the necessary parser.
+ *
+ * rgerhards, 2006-11-30: I have greatly changed this function. Formerly,
* it tried to reassemble multi-part messages, which is a legacy stock
* sysklogd concept. In essence, that was that messages not ending with
* \0 were glued together. As far as I can see, this is a sysklogd
@@ -1284,9 +1287,18 @@ finalize_it:
* For rfc3195 support, we needed to modify the algo for host parsing, so we can
* no longer rely just on the source (rfc3195d forwarded messages arrive via
* unix domain sockets but contain the hostname). rgerhards, 2005-10-06
+ *
+ * rgerhards, 2008-02-18:
+ * This function was previously called "printchopped"() and has been renamed
+ * as part of the effort to create a clean internal message submission interface.
+ * It also has been adopted to our usual calling interface, but currently does
+ * not provide any useful return states. But we now have the hook and things can
+ * improve in the future. <-- TODO!
*/
-void printchopped(char *hname, char *msg, int len, int fd, int bParseHost)
+rsRetVal
+parseAndSubmitMessage(char *hname, char *msg, int len, int bParseHost)
{
+ DEFiRet;
register int iMsg;
char *pMsg;
char *pData;
@@ -1301,8 +1313,6 @@ void printchopped(char *hname, char *msg, int len, int fd, int bParseHost)
assert(msg != NULL);
assert(len >= 0);
- dbgprintf("Message length: %d, File descriptor: %d.\n", len, fd);
-
/* we first check if we have a NUL character at the very end of the
* message. This seems to be a frequent problem with a number of senders.
* So I have now decided to drop these NULs. However, if they are intentional,
@@ -1362,7 +1372,7 @@ void printchopped(char *hname, char *msg, int len, int fd, int bParseHost)
logerrorInt("Uncompression of a message failed with return code %d "
"- enable debug logging if you need further information. "
"Message ignored.", ret);
- return; /* unconditional exit, nothing left to do... */
+ FINALIZE; /* unconditional exit, nothing left to do... */
}
pData = deflateBuf;
pEnd = deflateBuf + iLenDefBuf;
@@ -1374,7 +1384,7 @@ void printchopped(char *hname, char *msg, int len, int fd, int bParseHost)
if(len > 0 && *msg == 'z') {
logerror("Received a compressed message, but rsyslogd does not have compression "
"support enabled. The message will be ignored.");
- return;
+ FINALIZE;
}
# endif /* ifdef USE_NETZIP */
@@ -1396,7 +1406,7 @@ void printchopped(char *hname, char *msg, int len, int fd, int bParseHost)
*/
dbgprintf("internal error: iMsg > MAXLINE in printchopped()\n");
}
- return; /* in this case, we are done... nothing left we can do */
+ FINALIZE; /* in this case, we are done... nothing left we can do */
}
if(*pData == '\0') { /* guard against \0 characters... */
/* changed to the sequence (somewhat) proposed in
@@ -1439,7 +1449,8 @@ void printchopped(char *hname, char *msg, int len, int fd, int bParseHost)
/* typically, we should end up here! */
printline(hname, tmpline, bParseHost);
- return;
+finalize_it:
+ RETiRet;
}
/* rgerhards 2004-11-09: the following is a function that can be used
diff --git a/syslogd.h b/syslogd.h
index 43a95ae5..74ed6630 100644
--- a/syslogd.h
+++ b/syslogd.h
@@ -55,7 +55,9 @@ void logerrorVar(char *fmt, ...) __attribute__((format(printf, 1, 2)));
void logerrorSz(char *type, char *errMsg);
void logerrorInt(char *type, int iErr);
-void printchopped(char *hname, char *msg, int len, int fd, int iSourceType);
+#define MSG_PARSE_HOSTNAME 1
+#define MSG_DONT_PARSE_HOSTNAME 0
+rsRetVal parseAndSubmitMessage(char *hname, char *msg, int len, int bParseHost);
int isAllowedSender(struct AllowedSenders *pAllowRoot, struct sockaddr *pFrom, const char *pszFromHost);
void getCurrTime(struct syslogTime *t);
int formatTimestampToMySQL(struct syslogTime *ts, char* pDst, size_t iLenDst);
diff --git a/tcpsyslog.c b/tcpsyslog.c
index f8620e38..c02d44fc 100644
--- a/tcpsyslog.c
+++ b/tcpsyslog.c
@@ -564,8 +564,8 @@ void TCPSessPrepareClose(int iTCPSess)
* this case.
*/
dbgprintf("Extra data at end of stream in legacy syslog/tcp message - processing\n");
- printchopped(pTCPSessions[iTCPSess].fromHost, pTCPSessions[iTCPSess].msg,
- pTCPSessions[iTCPSess].iMsg, pTCPSessions[iTCPSess].sock, 1);
+ parseAndSubmitMessage(pTCPSessions[iTCPSess].fromHost, pTCPSessions[iTCPSess].msg,
+ pTCPSessions[iTCPSess].iMsg, MSG_PARSE_HOSTNAME);
pTCPSessions[iTCPSess].bAtStrtOfFram = 1;
}
}
@@ -703,8 +703,7 @@ int TCPSessDataRcvd(int iTCPSess, char *pData, int iLen)
/* emergency, we now need to flush, no matter if
* we are at end of message or not...
*/
- printchopped(pTCPSessions[iTCPSess].fromHost, pMsg, iMsg,
- pTCPSessions[iTCPSess].sock, 1);
+ parseAndSubmitMessage(pTCPSessions[iTCPSess].fromHost, pMsg, iMsg, MSG_PARSE_HOSTNAME);
iMsg = 0;
/* we might think if it is better to ignore the rest of the
* message than to treat it as a new one. Maybe this is a good
@@ -715,8 +714,7 @@ int TCPSessDataRcvd(int iTCPSess, char *pData, int iLen)
if(*pData == '\n' &&
pTCPSessions[iTCPSess].eFraming == TCP_FRAMING_OCTET_STUFFING) { /* record delemiter? */
- printchopped(pTCPSessions[iTCPSess].fromHost, pMsg, iMsg,
- pTCPSessions[iTCPSess].sock, 1);
+ parseAndSubmitMessage(pTCPSessions[iTCPSess].fromHost, pMsg, iMsg, MSG_PARSE_HOSTNAME);
iMsg = 0;
pTCPSessions[iTCPSess].bAtStrtOfFram = 1;
++pData;
@@ -730,8 +728,7 @@ int TCPSessDataRcvd(int iTCPSess, char *pData, int iLen)
pTCPSessions[iTCPSess].iOctetsRemain--;
if(pTCPSessions[iTCPSess].iOctetsRemain < 1) {
/* we have end of frame! */
- printchopped(pTCPSessions[iTCPSess].fromHost, pMsg, iMsg,
- pTCPSessions[iTCPSess].sock, 1);
+ parseAndSubmitMessage(pTCPSessions[iTCPSess].fromHost, pMsg, iMsg, MSG_PARSE_HOSTNAME);
iMsg = 0;
pTCPSessions[iTCPSess].bAtStrtOfFram = 1;
}