From 9584c81df387adcdcd7b84078eda48092049101d Mon Sep 17 00:00:00 2001
From: Rainer Gerhards
Date: Thu, 10 Apr 2008 08:06:48 +0200
Subject: added ommail.html - I forgot to add this file...
---
doc/ommail.html | 128 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 128 insertions(+)
create mode 100644 doc/ommail.html
diff --git a/doc/ommail.html b/doc/ommail.html
new file mode 100644
index 00000000..b6b7c2ad
--- /dev/null
+++ b/doc/ommail.html
@@ -0,0 +1,128 @@
+
+mail output module - sending syslog messages via mail
+
+
+
+Mail Output Module (ommail)
+Module Name: ommail
+Author: Rainer Gerhards
+<rgerhards@adiscon.com>
+Description:
+This module supports sending syslog messages via mail. Each
+syslog message is sent via its own mail. Obviously, you will want to
+apply rigorous filtering, otherwise your mailbox (and mail server) will
+be heavily spammed. The ommail plugin is primarily meant for alerting
+users. As such, it is assume that mails will only be sent in an
+extremely limited number of cases.
+Please note that ommail is especially well-suited to work in
+tandem with imfile to
+watch files for the occurence of specific things to be alerted on. So
+its scope is far broader than forwarding syslog messages to mail
+recipients.
+Ommail uses two templates, one for the mail body and one for the
+subject line. If neither is provided, a quite meaningless subject line
+is used and the mail body will be a syslog message just as if it were
+written to a file. It is expected that the users customizes both
+messages. In an effort to support cell phones (including SMS gateways),
+there is an option to turn off the body part at all. This is considered
+to be useful to send a short alert to a pager-like device.
+
+It is highly recommended to use the "$ActionExecOnlyOnceEveryInterval
+<seconds>" directive to limit the amount of
+mails that potentially be generated. With it, mails are sent at most in
+a <seconds> interval. This may be your life safer. And
+remember that an hour has 3,600 seconds, so if you would like to
+receive mails at most once every two hours, include a
+"$ActionExecOnlyOnceEveryInterval 7200" immediately before the ommail
+action. Messages sent more frequently are simpy discarded.
+Configuration Directives:
+
+- $ActionMailSMTPServer
+Name or IP address of the SMTP server to be used. Must currently be
+set. The default is 127.0.0.1, the SMTP server on the local machine.
+Obviously it is not good to expect one to be present on each machine,
+so this value should be specified.
+
+- $ActionMailSMTPPort
+Port number or name of the SMTP port to be used. The default is 25, the
+standard SMTP port.
+- $ActionMailFrom
+The email address used as the senders address. There is no default.
+- $ActionMailTo
+The recipients email address. There is no default.
+- $ActionMailSubject
+The name of the template
+to be used as the mail subject. If this is not specified, a more or
+less meaningless mail subject is generated (we don't tell you the exact
+text because that can change - if you want to have something specific,
+configure it!).
+- $ActionMailEnableBody
+Setting this to "off" permits to exclude the actual message body. This
+may be useful for pager-like devices or cell phone SMS messages. The
+default is "on", which is appropriate for allmost all cases. Turn it
+off only if you know exactly what you do!
+
+Caveats/Known Bugs:
+The current ommail implementation supports SMTP-direct mode
+only. In that mode, the plugin talks to the mail server via SMTP
+protocol. No other process is involved. This mode offers best
+reliability as it is not depending on any external entity except the
+mail server. Mail server downtime is acceptable if the action is put
+onto its own action queue, so that it may wait for the SMTP server to
+come back online. However, the module implements only the bare SMTP
+essentials. Most importantly, it does not provide any authentication
+capabilities. So your mail server must be configured to accept incoming
+mail from ommail without any authentication needs (this may be change
+in the future as need arises, but you may also be referred to
+sendmail-mode).
+In theory, ommail should also offer a mode where it uses the
+sendmail utility to send its mail (sendmail-mode).
+This is somewhat less reliable (because we depend on an entity we do
+not have close control over - sendmail). It also requires dramatically
+more system ressources, as we need to load the external process (but
+that should be no problem given the expected infrequent number of calls
+into this plugin). The big advantage of sendmail mode is that it
+supports all the bells and whistles of a full-blown SMTP implementation
+and may even work for local delivery without a SMTP server being
+present. Sendmail mode will be implemented as need arises. So if you
+need it, please drop us a line (I nobody does, sendmail mode will
+probably never be implemented).
+Sample:
+The following sample alerts the operator if the string "hard
+disk fatal failure" is present inside a syslog message. The mail server
+at mail.example.net is used and the subject shall be "disk problem on
+<hostname>". Note how \r\n is included inside the body
+text
+to create line breaks. A message is sent at most once every 6 hours,
+any other messages are silently discarded (or, to be precise, not being
+forwarded - they are still being processed by the rest of the
+configuration file).
+
+
+
+A more advanced example plus a discussion on using the email feature
+inside a reliable system can be found in Rainer's blogpost
+"Why
+is native email capability an advantage for a syslogd?"
+[rsyslog.conf overview]
+[manual index] [rsyslog site]
+This documentation is part of the
+rsyslog
+project.
+Copyright © 2008 by Rainer
+Gerhards and
+Adiscon.
+Released under the GNU GPL version 3 or higher.
+
\ No newline at end of file
--
cgit
From 4339d44b29aea69634abece7026ecf0154cb03c7 Mon Sep 17 00:00:00 2001
From: Rainer Gerhards
Date: Thu, 10 Apr 2008 08:13:54 +0200
Subject: project status is now a web-exclusive
... and no longer part of the tarball. This solves a couple
of update issues when new versions inside the other branches
are released. It is still kept in git, so that we have a record
of it. To make sure which version the documentation is, the
version info has been moved to the main manual page.
---
doc/Makefile.am | 1 -
doc/manual.html | 7 +++++--
2 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/doc/Makefile.am b/doc/Makefile.am
index 57e93a6f..5dba5e89 100644
--- a/doc/Makefile.am
+++ b/doc/Makefile.am
@@ -18,7 +18,6 @@ html_files = \
rsyslog_recording_pri.html \
rsyslog_stunnel.html \
professional_support.html \
- status.html \
syslog-protocol.html \
version_naming.html \
contributors.html \
diff --git a/doc/manual.html b/doc/manual.html
index d4e00155..2e030ab5 100644
--- a/doc/manual.html
+++ b/doc/manual.html
@@ -31,9 +31,12 @@ relay chains while at the same time being very easy to setup
for the novice user. And as we know what enterprise users really need, there is also professional rsyslog support available directly from the source!
-Visit the rsyslog status page to obtain current
+
This documentation is for version 2.0.5 of rsyslog.
+Visit the rsyslog status page to obtain current
+version information and project status.
-version information and ports. If you like rsyslog, you might want to lend us
+version information and ports.
+If you like rsyslog, you might want to lend us
a helping hand. It doesn't require a lot of time - even a single mouse click
--
cgit
From aeed303e2bb63794aea7bf80c733a85e37862fe2 Mon Sep 17 00:00:00 2001
From: Rainer Gerhards
Date: Fri, 11 Apr 2008 11:12:05 +0200
Subject: preparing for 3.15.1
---
ChangeLog | 4 +++-
doc/manual.html | 2 +-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index 645c06c3..b6de47b3 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,5 @@
---------------------------------------------------------------------------
-Version 3.15.1 (rgerhards), 2008-04-??
+Version 3.15.1 (rgerhards), 2008-04-11
- bugfix: some messages were emited without hostname
- disabled atomic operations for the time being because they introduce some
cross-platform trouble - need to see how to fix this in the best
@@ -12,6 +12,8 @@ Version 3.15.1 (rgerhards), 2008-04-??
happens during startup)
- bugfix: memory leaks in script engine
- bugfix: $hostname and $fromhost in RainerScript did not work
+This release also includes all changes applied to the stable versions
+up to today.
---------------------------------------------------------------------------
Version 3.15.0 (rgerhards), 2008-04-01
- major new feature: imrelp/omrelp support reliable delivery of syslog
diff --git a/doc/manual.html b/doc/manual.html
index 9d4dbefd..2e0c22ac 100644
--- a/doc/manual.html
+++ b/doc/manual.html
@@ -17,7 +17,7 @@ relay chains while at the same time being very easy to setup for the
novice user. And as we know what enterprise users really need, there is
also professional
rsyslog support available directly from the source!
-This documentation is for version 3.14.2 of rsyslog.
+
This documentation is for version 3.15.1 (beta branch) of rsyslog.
Visit the rsyslog status page to obtain current
version information and project status.
If you like rsyslog, you might
--
cgit
From bcd2661167998b7a986f31e5f6f3b691ab0a662a Mon Sep 17 00:00:00 2001
From: Rainer Gerhards
Date: Fri, 11 Apr 2008 11:15:21 +0200
Subject: bumped version number
---
ChangeLog | 2 ++
configure.ac | 2 +-
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/ChangeLog b/ChangeLog
index b6de47b3..d7103f48 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,6 @@
---------------------------------------------------------------------------
+Version 3.15.2 (rgerhards), 2008-04-??
+---------------------------------------------------------------------------
Version 3.15.1 (rgerhards), 2008-04-11
- bugfix: some messages were emited without hostname
- disabled atomic operations for the time being because they introduce some
diff --git a/configure.ac b/configure.ac
index c58c2173..4d5bec51 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2,7 +2,7 @@
# Process this file with autoconf to produce a configure script.
AC_PREREQ(2.61)
-AC_INIT([rsyslog],[3.15.1],[rsyslog@lists.adiscon.com])
+AC_INIT([rsyslog],[3.15.2],[rsyslog@lists.adiscon.com])
AM_INIT_AUTOMAKE
AC_CONFIG_SRCDIR([syslogd.c])
AC_CONFIG_HEADERS([config.h])
--
cgit
From 2b51fcab7b8f16ae9a970670d89e31deef4fe1e1 Mon Sep 17 00:00:00 2001
From: Rainer Gerhards
Date: Fri, 11 Apr 2008 15:08:09 +0200
Subject: applied patch from Tiziano Müller to remove some compiler warnings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
---
ChangeLog | 3 ++-
obj.c | 3 ++-
stringbuf.h | 3 +++
template.h | 2 ++
4 files changed, 9 insertions(+), 2 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index 00ec3f12..9b3e6233 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,8 +1,9 @@
---------------------------------------------------------------------------
-Version 3.14.2 (rgerhards), 2008-04-??
+Version 3.14.3 (rgerhards), 2008-04-??
- bugfix: omsnmp had a too-small sized buffer for hostname+port. This
could not lead to a segfault, as snprintf() was used, but could cause
some trouble with extensively long hostnames.
+- applied patch from Tiziano Müller to remove some compiler warnings
---------------------------------------------------------------------------
Version 3.14.2 (rgerhards), 2008-04-09
- bugfix: segfault with expression-based filters
diff --git a/obj.c b/obj.c
index 2f16669a..bb907d4f 100644
--- a/obj.c
+++ b/obj.c
@@ -85,6 +85,7 @@
#include "stream.h"
#include "modules.h"
#include "errmsg.h"
+#include "cfsysline.h"
/* static data */
DEFobjCurrIf(obj) /* we define our own interface, as this is expected by some macros! */
@@ -1328,7 +1329,7 @@ objClassInit(modInfo_t *pModInfo)
/* init classes we use (limit to as few as possible!) */
CHKiRet(errmsgClassInit(pModInfo));
- CHKiRet(cfsyslineInit(pModInfo));
+ CHKiRet(cfsyslineInit());
CHKiRet(varClassInit(pModInfo));
CHKiRet(moduleClassInit(pModInfo));
CHKiRet(objUse(var, CORE_COMPONENT));
diff --git a/stringbuf.h b/stringbuf.h
index aa31884e..0d617699 100644
--- a/stringbuf.h
+++ b/stringbuf.h
@@ -161,4 +161,7 @@ rsRetVal rsCStrAppendCStr(cstr_t *pThis, cstr_t *pstrAppend);
#define rsCStrGetBufBeg(x) ((x)->pBuf)
+rsRetVal strInit();
+rsRetVal strExit();
+
#endif /* single include */
diff --git a/template.h b/template.h
index eb9f3045..40ccfa50 100644
--- a/template.h
+++ b/template.h
@@ -111,6 +111,8 @@ void tplLastStaticInit(struct template *tpl);
rsRetVal tplToString(struct template *pTpl, msg_t *pMsg, uchar** ppSz);
void doSQLEscape(uchar **pp, size_t *pLen, unsigned short *pbMustBeFreed, int escapeMode);
+rsRetVal templateInit();
+
#endif /* #ifndef TEMPLATE_H_INCLUDED */
/* vim:set ai:
*/
--
cgit
From 07c0fcdfc8815ce6b82376d9d312b4e86ed29743 Mon Sep 17 00:00:00 2001
From: Peter Vrabec
Date: Fri, 11 Apr 2008 16:02:04 +0200
Subject: added gssapi overview/howto thanks to Peter Vrabec
Signed-off-by: Rainer Gerhards
---
ChangeLog | 1 +
doc/gssapi.html | 118 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
doc/gssapi.png | Bin 0 -> 35638 bytes
doc/manual.html | 11 +++---
4 files changed, 124 insertions(+), 6 deletions(-)
create mode 100644 doc/gssapi.html
create mode 100644 doc/gssapi.png
diff --git a/ChangeLog b/ChangeLog
index 9b3e6233..24718766 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,6 +4,7 @@ Version 3.14.3 (rgerhards), 2008-04-??
could not lead to a segfault, as snprintf() was used, but could cause
some trouble with extensively long hostnames.
- applied patch from Tiziano Müller to remove some compiler warnings
+- added gssapi overview/howto thanks to Peter Vrabec
---------------------------------------------------------------------------
Version 3.14.2 (rgerhards), 2008-04-09
- bugfix: segfault with expression-based filters
diff --git a/doc/gssapi.html b/doc/gssapi.html
new file mode 100644
index 00000000..400be4a3
--- /dev/null
+++ b/doc/gssapi.html
@@ -0,0 +1,118 @@
+
+GSSAPI module support in rsyslog v3
+
+
+
+GSSAPI module support in rsyslog v3
+What is it good for.
+
+-
+client-serverauthentication
+-
+Log
+messages encryption
+
+
+Requirements.
+
+
+- Kerberos infrastructure
+- rsyslog, rsyslog-gssapi
+
+
+Configuration.
+
+Let's assume there are 3 machines in kerberos Realm:
+
+- the
+first is running KDC (Kerberos Authentication Service and Key
+Distribution Center),
+- the second is a client sending its logs to the server,
+- the third is receiver, gathering all logs.
+
+
+1.
+KDC:
+
+- Kerberos
+database must be properly set-up on KDC machine first. Use
+kadmin/kadmin.local to do that. Two principals need to be add in our
+case:
+
+
+-
+
sender@REALM.ORG
+
+
+
+
+- client must have ticket for pricipal sender
+- REALM.ORG is kerberos Realm
+
+
+- host/receiver.mydomain.com@REALM.ORG - service principal
+
+
+- Use ktadd to export service principal and transfer it to
+/etc/krb5.keytab
+on receiver
+
+2. CLIENT:
+
+
+- set-up rsyslog, in /etc/rsyslog.conf
+- $ModLoad omgssapi.so - load output gss module
+- $GSSForwardServiceName
+otherThanHost - set the name of service principal, "host" is the
+default one
+- *.* :omgssapi:receiver.mydomain.com - action line, forward
+logs to receiver
+- kinit root - get the TGT ticket
+- service rsyslog start
+
+
+
+3. SERVER:
+
+
+-
+
set-up
+rsyslog, in /etc/rsyslog.conf
+
+-
+
$ModLoad
+imgssapi.so - load input gss module
+
+-
+
$InputGSSServerServiceName
+otherThanHost - set the name of service principal, "host" is the
+default one
+
+-
+
$InputGSSServerPermitPlainTCP
+on - accept GSS and TCP connections (not authenticated senders), off by
+default
+
+-
+
$InputGSSServerRun
+514 - run server on port
+
+-
+
service
+rsyslog start
+
+
+The picture demonstrate
+how things work.
+
+
+[rsyslog.conf overview]
+[manual index] [rsyslog site]
+This documentation is part of the
+rsyslog
+project.
+Copyright © 2008 by Rainer
+Gerhards and
+Adiscon.
+Released under the GNU GPL version 3 or higher.
+
\ No newline at end of file
diff --git a/doc/gssapi.png b/doc/gssapi.png
new file mode 100644
index 00000000..c82baa52
Binary files /dev/null and b/doc/gssapi.png differ
diff --git a/doc/manual.html b/doc/manual.html
index 9d4dbefd..8bdee8b7 100644
--- a/doc/manual.html
+++ b/doc/manual.html
@@ -1,6 +1,5 @@
-rsyslog documentation
-
+rsyslog documentation
RSyslog - Documentation
Rsyslog
@@ -18,9 +17,9 @@ novice user. And as we know what enterprise users really need, there is
also professional
rsyslog support available directly from the source!
This documentation is for version 3.14.2 of rsyslog.
-Visit the rsyslog status page
to obtain current
+Visit the rsyslog status page to obtain current
version information and project status.
-
If you like rsyslog, you might
+
If you like rsyslog, you might
want to lend us a helping hand. It doesn't require a lot of
time - even a single mouse click helps. Learn how to help the rsyslog project.
Due to popular demand, there is now a side-by-side comparison
@@ -64,7 +63,7 @@ php-syslog-ng with rsyslog
recording
the syslog priority (severity and facility) to the log file
preserving
-syslog sender over NAT (online only)
+syslog sender over NAT (online only)an overview and howto of rsyslog gssapi support
debug support in rsyslog
the rsyslog message
queue object
@@ -100,4 +99,4 @@ may find
Rainer's
blog an
interesting read (filter on syslog and rsyslog tags).
-
+