Commit Graph

354 Commits

Author SHA1 Message Date
John-Mark Gurney
37d8e9a326 fix up documentation/comments: processname is not defined, but programname
is..

a couple other minor documentation fixes that igor caught...

MFC after:	1 week
2020-12-10 23:23:42 +00:00
Gordon Bergling
cbf541311c syslog.conf(5): Fix a few mandoc warnings
- new sentence, new line
- skipping paragraph macro: Pp at the end of Sh
2020-11-20 16:50:52 +00:00
Cy Schubert
ce558a3f33 Fix build post-r367455.
MFC after:	2 weeks
X-MFC with:	r367455
2020-11-07 19:17:37 +00:00
Bryan Drewery
9470af395f syslogd: Stop trying to send remote messages through special sockets
Specifically this was causing the /dev/klog fd and the signal pipe
handling fd to get a sendmsg(2) called on them and always returned
[ENOTSOCK].

r310350 combined these sockets into the main socket list and properly
skipped AF_UNSPEC at the sendmsg(2) call but later in r344739 it was
broken such that these special sockets were no longer excluded since
the AF_UNSPEC check specifically excluded these special sockets. Only
these special sockets have sl_sa = NULL. The sl_family checks should
be redundant now but are left in case of future changes so the intent
is clearer.

MFC after:	2 weeks
2020-11-07 17:18:44 +00:00
Mark Johnston
b0eefff78b syslogd: Avoid trimming host names in RFC 5424 mode
RFC 5424 says that implementations should log hostnames in FQDN
format.  Only trim host names in RFC 3164 mode.

PR:		250014
Submitted by:	Dmitry Wagin <dmitry.wagin@ya.ru>
MFC after:	1 month
Differential Revision:	https://reviews.freebsd.org/D26644
2020-10-09 15:19:29 +00:00
Bryan Drewery
18bcf5a07d Restore local kernel "prog" filtering lost in r332099.
This behavior is most relevant for ipfw(4) as documented in syslog.conf(5).
The recent addition of property-based regex filters in r359327 is a
fine workaround for this but the behavior was present since 1997 and
documented.

This only fixes local matching of the "kernel program". It does not
change the forwarded format at all. On the remote side it will still
be "kernel: ipfw:" and not be parsed as a kernel message. This matches
old behavior.

MFC after:	2 weeks
Reviewed by:	markj
Relnotes:	yes
Differential Revision:	https://reviews.freebsd.org/D24286
2020-04-28 16:07:15 +00:00
Andrey V. Elsukov
ccf8b02c94 Fix typo.
MFC after:	2 weeks
2020-03-26 12:00:26 +00:00
Andrey V. Elsukov
7d367c51c8 Add property-based filters for syslogd.
Property-based filters allow substring and regular expressions
(see re_format(7)) matching against various message attributes.
Filter specification starts with '#:' or ':' followed by three
comma-separated fields property, operator, "value". Value must be
double-quoted. A double quote and backslash must be escaped by a
blackslash.

Following properties are supported as test value:
o msg - body of the message received;
o programname - program name sent the message;
o hostname - hostname of message's originator;
o source - an alias for hostname.

Supported operators:
o contains - true if filter value is found as a substring of property;
o isequal - true if filter value is equal to property;
o startswith - true if property starts with filter value;
o regex - true if property matches basic regular expression defined
    in filter value;
o ereregex - true if property matches extended regular expression
    defined in filter value;

Operator may be prefixed by '!' to invert compare logic or by
'icase_' to make comparison function case insensitive.

Submitted by:	Boris N. Lytochkin <lytboris at gmail com>
MFC after:	2 weeks
Relnotes:	yes
Differential Revision:	https://reviews.freebsd.org/D23468
2020-03-26 11:54:25 +00:00
Steve Wills
cd4b2a3c08 log daemon.info to /var/log/daemon.log by default
log daemon facility now that daemon(8) has syslog support which defaults to
daemon facility, info priority

Reviewed by:		bapt
Approved by:		bapt
Differential Revision:	https://reviews.freebsd.org/D21561
2019-09-17 20:03:20 +00:00
Bjoern A. Zeeb
9784899d58 Fix compilation of world with WITHOUT_{INET,INET6}_SUPPORT or both set.
Buildworld failed when both WITHOUT_INET6_SUPPORT and INET equivalent were set.
Fix netstat and syslogd by applying appropriate #ifdef INET/INET6 to make world
compile again.

Reviewed by:		ngie, hrs, ume
Welcomed by:		Michael Dexter (D17040)
MFC after:		3 days
Differential Revision:	https://reviews.freebsd.org/D19418
2019-03-03 10:00:26 +00:00
Hiroki Sato
27a1e60984 Use struct addrinfo instead of struct sockaddr_storage
to store peer addresses.
2019-03-03 05:30:15 +00:00
Hajimu UMEMOTO
22cd7e923f An IPv6 address matching should be fixed. Specifying an IPv6
address by the -a option was broken since r309933.

Reported by:	"O. Hartmann" <ohartmann [...] walstatt.org>
MFC after:	1 week
2019-02-24 03:41:05 +00:00
Brad Davis
f1722afc8d Remove trailing slash in pathname so that valid METALOG is created in the
NO_ROOT case of make packages.

Submitted by:	Dan McGregor <dan.mcgregor@usask.ca>
Approved by:	re (rgrimes)
2018-08-25 20:19:16 +00:00
Brad Davis
64be79ef76 Move all syslogd related configs to usr.sbin/syslogd/
This helps with pkgbase as it switches these to use CONFS which properly tags
them as config files.

Approved by:	will (mentor)
Differential Revision:	https://reviews.freebsd.org/D16783
2018-08-21 17:01:47 +00:00
Ed Schouten
066a4ba169 Allow the use of slashes in process names of RFC 3164 formatted messages.
Tools such as Postfix use slashes in process names for hierarchy
(postfix/qmgr). By allowing these slashes, syslogd is able to extract
the process name and process ID nicely, so that they can be stored in
RFC 5424 message fields.

MFC after:	1 week
2018-07-07 11:53:39 +00:00
Ed Schouten
8ab684e234 Document that syslogd -v has no effect when RFC 5424 mode is enabled.
The variable it sets, LogFacPri, is only used in the RFC 3164 formatting
codepath.

PR:		229457
Reported by:	Andre Albsmeier
MFC after:	1 week
2018-07-02 11:02:27 +00:00
Ed Schouten
8a66bdb414 Restore the order in which RFC 3164 messages with fac/pri are formatted.
The refactoring of the syslogd code to format messages using iovecs
slightly altered the output of syslogd by placing the facility/priority
after the hostname, as opposed to printing it right before. This change
reverts the behaviour to be consistent with how it was before.

PR:		229457
Reported by:	Andre Albsmeier
MFC after:	1 week
2018-07-02 10:57:22 +00:00
Ed Schouten
531b456983 Still parse messages that don't contain an RFC 3164 timestamp.
The changes made in r326573 required that messages always start with an
RFC 3164 timestamp. It looks like certain devices, but also certain
logging libraries (Python 3's "logging" package) simply don't generate
RFC 3164 formatted messages containing a timestamp.

Make timestamps optional again. When the timestamp is missing, also
assume that the message contains no hostname. The first word of the
message likely already belongs to the message payload.

PR:		229236
Reported by:	Michael Grimm & Marek Zarychta
Reviewed by:	glebius (cursory)
MFC after:	1 week
2018-06-22 20:53:39 +00:00
Ed Schouten
8803b8597a Fix bad logic in iovlist_truncate().
To conform to RFC 5426, this function is intended to truncate messages
if they exceed the message size limits. Unfortunately, the amount of
space was computed the wrong way around, causing messages to be
truncated entirely.

Reported by:	Michael Grimm on stable@
MFC after:	3 days
2018-06-18 06:01:28 +00:00
Xin LI
5992da2c7b Correct size for allocation and bzero of fdsr.
MFC after:	2 weeks
2018-04-23 07:15:49 +00:00
Ed Schouten
5caf54c7a4 Use proper alphabetic sorting of options. 2018-04-15 08:44:26 +00:00
Ed Schouten
1a874a126a Add RFC 5424 syslog message output to syslogd.
- Move all of the code responsible for transmitting log messages into a
  separate function, fprintlog_write().
- Instead of manually modifying a list of iovecs, add a structure
  iovlist with some helper functions.
- Alter the F_FORW (UDP message forwarding) case to also use iovecs like
  the other cases. Use sendmsg() instead of sendto().
- In the case of F_FORW, truncate the message to a size dependent on the
  address family (AF_INET, AF_INET6), as proposed by RFC 5426.
- Move all traditional message formatting into fprintlog_bsd(). Get rid
  of some of the string copying and snprintf()'ing. Simply emit more
  iovecs to get the job done.
- Increase ttymsg()'s limit of 7 iovecs to 32. Add a definition for this
  limit, so it can be reused by iovlist.
- Add fprintlog_rfc5424() to emit RFC 5424 formatted log entries.
- Add a "-O" command line option to enable RFC 5424 formatting. It would
  have been nicer if we supported "-o rfc5424", just like on NetBSD.
  Unfortunately, the "-o" flag is already used for a different purpose
  on FreeBSD.
- Don't truncate hostnames in the RFC 5424 case, as suggested by that
  specific RFC.

For people interested in using this, this feature can be enabled by
adding the following line to /etc/rc.conf:

  syslogd_flags="-s -O rfc5424"

Differential Revision:	https://reviews.freebsd.org/D15011
2018-04-15 08:34:16 +00:00
Ed Schouten
671d700167 Fix enough warnings that we can build syslogd on all targets at WARNS=6.
This also fixes the build on MIPS.

Reported by:	cy (MIPS build failure)
2018-04-07 09:03:51 +00:00
Ed Schouten
b484e3fee4 Push RFC 5424 message format from logmsg() into fprintlog().
Now that all of parsemsg() parses both RFC 3164 and 5424 messages and
hands them to logmsg(), alter the latter to properly forward all RFC
5424 message attributes to fprintlog(). While there, make some minor
cleanups to this code:

- Instead of extending the existing code that compares hostnames and
  message bodies for deduplication, print all of the relevant message
  fields into a single string that we can compare ('saved').

- No longer let the behaviour of fprintflog() depend on whether
  'msg == NULL' to print repetition messages, Simply decompose this
  function into fprintlog_first() and fprintlog_successive(). This
  makes the interpretation of function arguments less magical and also
  allows us to get consistent behaviour across RFC 3164 and 5424 when
  adding support for the RFC 5424 output format.

- As RFC 5424 syslog messages have a dedicated application name field,
  alter the repetition messages to be printed on behalf of syslogd on
  the current system. Change these messages to use the local hostname,
  so that it's obvious which syslogd instance detected the repetition.
  Remove f_prevhost, as it has now become unnecessary.

- Remove a useless strdup(). Deconsting the message string is safe in
  this specific case.
2018-04-06 17:16:50 +00:00
Ed Schouten
228e9d5bd8 Remove some places where error messages are prefixed with "syslogd".
Due to using RFC 5424, the application name is stored in a dedicated
field. It can simply be passed as an argument to logmsg() now.
2018-04-06 16:26:46 +00:00
Ed Schouten
10b154332d Properly respect the passed in hostname for RFC 5424 messages.
Only override the hostname in case none is provided or when remote
hostnames should be ignored.
2018-04-06 16:24:03 +00:00
Ed Schouten
77f0ef9a96 Add RFC 5424 syslog message parsing to syslogd.
Syslogd currently uses the RFC 3164 format for its log messages.One
limitation of RFC 3164 is that it cannot be used to log entries with
sub-second precision timestamps. One of our users has expressed a desire
for doing this for doing some basic performance measurements.

This change attempts to make a first cut at switching to RFC 5424 based
logging. The first step is to alter syslogd's input path to properly
parse such messages. It alters the logmsg() prototype to match the
fields of RFC 5424. The parsemsg() function is extended to parse both
RFC 3164 and 5424 messages and call into logmsg() accordingly.

Additional changes include:

- Introducing proper parsing of timestamps, so that they can be printed
  in any desired output format. This means we need to infer the year and
  timezone for RFC 3164 timestamps.
- Removing ISKERNEL. This can now be realised by simply providing an
  APP-NAME (== "kernel").
- Extending RFC 3164 parsing to trim off the TAG prefix and using that
  to derive APP-NAME and PROCID.
- Increase MAXLINE. RFC 5424 mentions we should support 2k messages.

Differential Revision:	https://reviews.freebsd.org/D14926
2018-04-06 12:57:01 +00:00
Gleb Smirnoff
c176562d38 Fix whitespace issues in r330034. No functional changes. 2018-03-20 22:00:58 +00:00
David Bright
9176635592 Fix two memory leaks in syslogd
A memory leak in syslogd for processing of forward actions was
reported. This modification adapts the patch submitted with that bug
to fix the leak. While testing the modification, another leak was also
found and fixed.

PR:		198385
Submitted by:	Sreeram <sreeramabs@yahoo.com>
Reported by:	Sreeram <sreeramabs@yahoo.com>
Reviewed by:	hrs
MFC after:	1 week
Sponsored by:	Dell EMC
Differential Revision:	https://reviews.freebsd.org/D14510
2018-02-26 19:27:59 +00:00
Gleb Smirnoff
50387adce2 When parsing remote messages, require them to have standard timestamp
field, and support properly parse out the hostname as described by RFC3164,
which wasn't done before.  However, don't discard message if it doesn't
have hostname, for compatibility.

Enable logging of the message supplied hostname instead of real hostname
with -H switch.

PR:		200933
Reported by:	Konstantin Pavlov <thresh nginx.com>
MFC after:	2 months
2017-12-05 19:54:55 +00:00
Gleb Smirnoff
eb7ec39704 Revert r325558 as it is incorrect. 2017-11-28 19:25:01 +00:00
Gleb Smirnoff
09f876612c Fix obvious NULL pointer dereference from r310350. 2017-11-28 19:18:00 +00:00
Pedro F. Giffuni
8a16b7a18f General further adoption of SPDX licensing ID tags.
Mainly focus on files that use BSD 3-Clause license.

The Software Package Data Exchange (SPDX) group provides a specification
to make it easier for automated tools to detect and summarize well known
opensource licenses. We are gradually adopting the specification, noting
that the tags are considered only advisory and do not, in any way,
superceed or replace the license texts.

Special thanks to Wind River for providing access to "The Duke of
Highlander" tool: an older (2014) run over FreeBSD tree was useful as a
starting point.
2017-11-20 19:49:47 +00:00
Gleb Smirnoff
b9a63e5c3a When parsing UDP messages skip optional hostname as described by
RFC 3164.

PR:		200933
Submitted by:	maxim
Reported by:	Konstantin Pavlov <thresh nginx.com>
MFC after:	2 weeks
2017-11-08 16:45:53 +00:00
Bryan Drewery
ea825d0274 DIRDEPS_BUILD: Update dependencies.
Sponsored by:	Dell EMC Isilon
2017-10-31 00:07:04 +00:00
Maxim Sobolev
023653459a Fix another logic bug that came out of recent syslogd refactoring and exposed by
the r316874: don't call shutdown(2) on all sockets, but only net ones, which seems
to be the behaviour existed before that refactoring. Also don't call listen(2)
in datagram sockets and fix misplaced debug messages while I am here.

Reported by: peter
2017-04-15 18:20:11 +00:00
Maxim Sobolev
b98582b146 Since shutdown(2) on datagram socket is no longer a NOP after rev 316874
don't bother to select/recv on that socket. This prevents syslogd(8)
from spinning endlessly when started with the -s option (default).

Reported by:	peter
2017-04-15 02:24:22 +00:00
Hiroki Sato
f7f99edf3f Fix a regression which prevented an IPv6 address in a -b option from
working.

PR:	217939
Differential Revision:	https://reviews.freebsd.org/D10064
2017-03-20 17:46:33 +00:00
Enji Cooper
b79299b5e7 syslogd: try to print out a more helpful message in socksetup(..) if/when
getaddrinfo fails

If the asprintf call fails, fall back to the old code (as a last ditch effort
to provide the end-user with helpful output).

Sponsored by:	Dell EMC Isilon
2017-03-20 06:12:55 +00:00
Enji Cooper
9c2aa0a0a3 syslogd: fix dprintf in socksetup(..)
- Make the explanation more complete
- Correct a minor grammar nit with verb tense.
- Don't emit the message if `pe->pe_name` is NULL (it doesn't
  have much value).

MFC after:	1 week
Sponsored by:	Dell EMC Isilon
2017-03-20 05:12:27 +00:00
Enji Cooper
4863f2fc55 syslogd: don't leak f on failure in cfline(..)
Free `f` if an unknown priority or facility is parsed with the function.

MFC after:	1 week
Reported by:	Coverity
CID:		1368068
Sponsored by:	Dell EMC Isilon
2017-03-20 04:25:40 +00:00
Enji Cooper
a393b6c82f syslogd: fix memory leaks in main(..) and allowaddr(..)
- main(..): free memory assigned to fdsr before calling die(..).
- allowaddr(..): free memory assigned to ap before returning from the
  function early. Add a `err` goto label to reduce freeaddrinfo/free(ap)
  logic duplication.

MFC after:	1 week
X-MFC notes:	some of this is dependent on refactoring not MFCed
Reported by:	clang static analyzer, Coverity
CID:		1367750 (ap leakage in allowaddr(..))
Submitted by:	Tom Rix <trix@juniper.net>
Reviewed by:	ngie
Sponsored by:	Dell EMC Isilon, Juniper
Differential Revision:	D10004
2017-03-15 18:15:30 +00:00
Enji Cooper
6dbd2714db Correct nuance of -a :service -> "*" in r314563, r314585
My attempt to correct the sender/receiver behavior was incorrect.
The source port of the sender for forwarded datagrams is filtered
with -a, and my change in r314585 didn't clarify that point at all.

Wording is based on suggestion by hrs.

MFC after:	28 days
X-MFC with:	r314563, r314585
Reported by:	hrs
In collaboration with:	hrs, rgrimes
Sponsored by:	Dell EMC Isilon
2017-03-04 06:19:41 +00:00
Enji Cooper
3dd94b6769 Correct verb change for service => * after r314563
`*` means that packets will be received from a remote peer on any port.
Since the point of interest is the syslogd instance (not the remote peer),
the appropriate verb is "received", not "sent".

MFC after:	1 month
X-MFC with:	r314563
Sponsored by:	Dell EMC Isilon
2017-03-03 06:13:59 +00:00
Enji Cooper
bc4536df9d Wordsmith syslogd(8)
- Clarify -p/-S options by using appropriate subject-verb modifiers
  (verb and modifiers suggested that the subject should have been
  singular).
- Simplify/correct -a description:
-- Be more terse when describing IPv4 (the "usual dotted notation"
   isn't necessarily well understood by the reader). Being blunt and
   saying "IPv4 address" with an optional netmask is.
-- prefixlen is the appropriate terminology for IPv6.
-- mask/prefixlen is optional, not required (as noted later on in the
   section).
-- split up IPv4/IPv6 use so to clarify both forms.
-- Fix wordiness when describing the optional "service" specifier.
- -T: Use "cannot" instead of "can't" [*].

Bump .Dd for the changes.

MFC after:	1 month
Reported by:	igor [*]
Reviewed by:	hrs
Sponsored by:	Dell EMC Isilon
Differential Revision:	https://reviews.freebsd.org/D9855
2017-03-02 18:07:19 +00:00
Warner Losh
fbbd9655e5 Renumber copyright clause 4
Renumber cluase 4 to 3, per what everybody else did when BSD granted
them permission to remove clause 3. My insistance on keeping the same
numbering for legal reasons is too pedantic, so give up on that point.

Submitted by:	Jan Schaumann <jschauma@stevens.edu>
Pull Request:	https://github.com/freebsd/freebsd/pull/96
2017-02-28 23:42:47 +00:00
Enji Cooper
15f0eea574 Parameterize out the length of struct filed->f_lasttime as MAXDATELEN
This removes the hardcoded value for the field (16) and the equivalent
hardcoded lengths in logmsg(..).

This change is being done to help stage future work to add RFC5424/RFC5434
support to syslogd(8).

Obtained from:	Isilon OneFS (dcd33d13da) (as part of a larger change)
Submitted by:	John Bauman <john.bauman@isilon.com>
MFC after:	2 weeks
Sponsored by:	Dell EMC Isilon
2017-02-25 00:12:29 +00:00
Enji Cooper
8fe70bb8f2 Use SRCTOP instead of .CURDIR relative paths with ".."
This simplifies pathing in make/displayed output

MFC after:	1 week
Sponsored by:	Dell EMC Isilon
2017-02-24 21:35:59 +00:00
Enji Cooper
916aa57754 Sort sys/ #includes some more
MFC after:	1 week
X-MFC with:	r313358
Sponsored by:	Dell EMC Isilon
2017-02-07 01:28:55 +00:00
Enji Cooper
688e4de4e7 Sort sys/ #includes and zap an unnecessary trailing space nearby
MFC after:	1 week
Sponsored by:	Dell EMC Isilon
2017-02-07 00:47:33 +00:00