From 54cee2ce69c5bbd96aa51ac8636f4b029e2ceb75 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Tue, 29 Nov 2011 12:36:36 +0100 Subject: imuxsock: added capability to "annotate" messages with "trusted information", which contains some properties obtained from the system and as such sure to not be faked. This is inspired by the similiar idea introduced in systemd. --- doc/imuxsock.html | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) (limited to 'doc/imuxsock.html') diff --git a/doc/imuxsock.html b/doc/imuxsock.html index 58b3ae54..f80bc598 100644 --- a/doc/imuxsock.html +++ b/doc/imuxsock.html @@ -49,6 +49,15 @@ are places as quickly as possible into the processing queues. If you would like flow control, you need to enable it via the $SystemLogSocketFlowControl and $InputUnixListenSocketFlowControl config directives. Just make sure you thought about the implications. Note that for many systems, turning on flow control does not hurt. +

Starting with rsyslog 5.9.4, +trusted syslog properties +are available. These require a recent enough Linux Kernel and access to the /proc file +system. In other words, this may not work on all platforms and may not work fully when +privileges are dropped (depending on how they are dropped). Note that trusted properties +can be very useful, but also typically cause the message to grow rather large. Also, the +format of log messages is obviously changed by adding the trusted properties at the end. +For these reasons, the feature is not enabled by default. If you want to use it, +you must turn it on (via $SystemLogSocketAnnotate and $InputUnixListenSocketAnnotate).

Configuration Directives:

+ Caveats/Known Bugs: