diff options
30 files changed, 455 insertions, 172 deletions
@@ -1,4 +1,10 @@ --------------------------------------------------------------------------- +Version 7.3.4 [devel] 2012-11-?? +- bugfix: improper handling of backslash in string-type template()s +- bugfix: leading quote (") in string-type template() lead to thight loop + on startup +- bugfix: no error msg on invalid field option in legacy/string template +--------------------------------------------------------------------------- Version 7.3.3 [devel] 2012-11-07 - improved disk queue performance - bugfix: dynafile zip files could be corrupted @@ -58,6 +64,11 @@ Version 7.3.0 [devel] 2012-10-09 This is controlled by the new action parameter "VeryReliableZip". ---------------------------------------------------------------------------- Version 7.2.2 [v7-stable] 2012-10-?? +- doc improvements +- enabled to build without libuuid, at loss of uuid functionality + this enables smoother builds on older systems that do not support + libuuid. Loss of functionality should usually not matter too much as + uuid support has only recently been added and is very seldom used. - bugfix: omfwd did not properly support "template" parameter - bugfix: potential segfault when re_match() function was used Thanks to oxpa for the patch. @@ -65,6 +76,35 @@ Version 7.2.2 [v7-stable] 2012-10-?? - bugfix: potential abort of imtcp on rsyslogd shutdown - bugfix: imzmq3 segfault with PULL subscription Thanks to Martin Nilsson for the patch. +- bugfix: improper handling of backslash in string-type template()s +- bugfix: leading quote (") in string-type template() lead to thight loop + on startup +- bugfix: no error msg on invalid field option in legacy/string template +- bugfix: potential segfault due to invalid param handling in comparisons + This could happen in RainerScript comparisons (like contains); in some + cases an unitialized variable was accessed, which could lead to an + invalid free and in turn to a segfault. + closes: http://bugzilla.adiscon.com/show_bug.cgi?id=372 + Thanks to Georgi Georgiev for reporting this bug and his great help + in solving it. +- bugfix: no error msg on unreadable $IncludeConfig path +- bugfix: $IncludeConfig did not correctly process directories + closes: http://bugzilla.adiscon.com/show_bug.cgi?id=376 + The testbench was also enhanced to check for these cases. + Thanks to Georgi Georgiev for the bug report. +- bugfix: make rsyslog compile on kfreebsd again + closes: http://bugzilla.adiscon.com/show_bug.cgi?id=380 + Thanks to Guillem Jover for the patch. +- bugfix: garbled message if field name was used with jsonf property option + The length for the field name was invalidly computed, resulting in either + truncated field names or including extra random data. If the random data + contained NULs, the rest of the message became unreadable. + closes: http://bugzilla.adiscon.com/show_bug.cgi?id=374 +- bugfix: potential segfault at startup with property-based filter + If the property name was followed by a space before the comma, rsyslogd + aborted on startup. Note that no segfault could happen if the initial + startup went well (this was a problem with the config parser). + closes: http://bugzilla.adiscon.com/show_bug.cgi?id=381 ---------------------------------------------------------------------------- Version 7.2.1 [v7-stable] 2012-10-29 - bugfix: ruleset()-object did only support a single statement @@ -226,6 +266,12 @@ Version 6.6.1 [v6-stable] 2012-10-?? - fix API "glitch" in some plugins This did not affect users, but could have caused trouble in the future for developers. +- bugfix: no error msg on invalid field option in legacy/string template +- bugfix: no error msg on unreadable $IncludeConfig path +- bugfix: $IncludeConfig did not correctly process directories + closes: http://bugzilla.adiscon.com/show_bug.cgi?id=376 + The testbench was also enhanced to check for these cases. + Thanks to Georgi Georgiev for the bug report. --------------------------------------------------------------------------- Version 6.6.0 [v6-stable] 2012-10-22 This starts a new stable branch, based on the 6.5.x series, plus: @@ -873,6 +919,10 @@ expected that interfaces, even new ones, break during the initial syslog plain tcp input plugin (NOT supporting TLS!) [ported from v4] --------------------------------------------------------------------------- +Version 5.10.2 [V5-STABLE], 201?-??-?? +- bugfix: spurios error messages from imuxsock about (non-error) EAGAIN + Thanks to Marius Tomaschwesky for the patch. +--------------------------------------------------------------------------- Version 5.10.1 [V5-STABLE], 2012-10-17 - bugfix: imuxsock and imklog truncated head of received message This happened only under some circumstances. Thanks to Marius diff --git a/configure.ac b/configure.ac index a1fa7dd3..0d16f54e 100644 --- a/configure.ac +++ b/configure.ac @@ -35,7 +35,6 @@ PKG_PROG_PKG_CONFIG PKG_CHECK_MODULES(LIBESTR, libestr >= 0.1.2) PKG_CHECK_MODULES(LIBEE, libee >= 0.4.0) PKG_CHECK_MODULES([JSON_C], [json]) -PKG_CHECK_MODULES([LIBUUID], [uuid]) case "${host}" in *-*-linux*) @@ -115,7 +114,7 @@ AC_TYPE_SIGNAL AC_FUNC_STAT AC_FUNC_STRERROR_R AC_FUNC_VPRINTF -AC_CHECK_FUNCS([flock basename alarm clock_gettime gethostbyname gethostname gettimeofday localtime_r memset mkdir regcomp select setid socket strcasecmp strchr strdup strerror strndup strnlen strrchr strstr strtol strtoul uname ttyname_r getline malloc_trim prctl epoll_create epoll_create1 fdatasync lseek64]) +AC_CHECK_FUNCS([flock basename alarm clock_gettime gethostbyname gethostname gettimeofday localtime_r memset mkdir regcomp select setid socket strcasecmp strchr strdup strerror strndup strnlen strrchr strstr strtol strtoul sysinfo uname ttyname_r getline malloc_trim prctl epoll_create epoll_create1 fdatasync lseek64]) # the check below is probably ugly. If someone knows how to do it in a better way, please # let me know! -- rgerhards, 2010-10-06 @@ -342,27 +341,6 @@ AC_ARG_ENABLE(kmsg, AM_CONDITIONAL(ENABLE_IMKMSG, test x$enable_kmsg = xyes) -# -# SYSLOG_UNIXAF -# -AC_MSG_CHECKING(for SYSLOG_UNIXAF support) -AC_ARG_ENABLE([unix], - [AS_HELP_STRING([--disable-unix], [Disable support for unix])], - [ - if test "x${enableval}" = "xyes"; then - AC_MSG_RESULT([yes]) - AC_DEFINE([SYSLOG_UNIXAF], [1], [Description]) - else - AC_MSG_RESULT([no]) - fi - ], - [ - # enabled by default - AC_MSG_RESULT([yes]) - AC_DEFINE([SYSLOG_UNIXAF], [1], [Description]) - ]) - - # inet AC_ARG_ENABLE(inet, [AS_HELP_STRING([--enable-inet],[Enable networking support @<:@default=yes@:>@])], @@ -729,6 +707,23 @@ AC_SUBST(SNMP_CFLAGS) AC_SUBST(SNMP_LIBS) +# uuid support +AC_ARG_ENABLE(uuid, + [AS_HELP_STRING([--enable-uuid],[Enable support for uuid generation @<:@default=yes@:>@])], + [case "${enableval}" in + yes) enable_elasticsearch="yes" ;; + no) enable_elasticsearch="no" ;; + *) AC_MSG_ERROR(bad value ${enableval} for --enable-uuid) ;; + esac], + [enable_uuid=yes] +) +if test "x$enable_elasticsearch" = "xyes"; then + PKG_CHECK_MODULES([LIBUUID], [uuid]) + AC_DEFINE(USE_LIBUUID, 1, [Define if you want to enable libuuid support]) +fi +AM_CONDITIONAL(ENABLE_UUID, test x$enable_uuid = xyes) + + # elasticsearch support AC_ARG_ENABLE(elasticsearch, [AS_HELP_STRING([--enable-elasticsearch],[Enable elasticsearch output module @<:@default=no@:>@])], @@ -1365,6 +1360,7 @@ echo " rsyslog runtime will be built: $enable_rsyslogrt" echo " rsyslogd will be built: $enable_rsyslogd" echo " GUI components will be built: $enable_gui" echo " Unlimited select() support enabled: $enable_unlimited_select" +echo " uuid support enabled: $enable_uuid" echo echo "---{ input plugins }---" echo " Klog functionality enabled: $enable_klog ($os_type)" diff --git a/doc/Makefile.am b/doc/Makefile.am index 962c06d4..a05edba5 100644 --- a/doc/Makefile.am +++ b/doc/Makefile.am @@ -131,6 +131,7 @@ html_files = \ rsyslog_conf_nomatch.html \ queues_analogy.html \ multi_ruleset.html \ + multi_ruleset_legacy_format.html \ dev_oplugins.html \ free_support.html \ imudp.html \ diff --git a/doc/imkmsg.html b/doc/imkmsg.html index 61068d09..23b96147 100644 --- a/doc/imkmsg.html +++ b/doc/imkmsg.html @@ -25,9 +25,11 @@ Log messages are parsed as necessary into rsyslog msg_t structure. Continuation as json key/value pairs and added into rsyslog's message json representation. </p> <p><b>Configuration Directives</b>:</p> -This module has no configuration directives. +<p>This module has no configuration directives.</p> <b>Caveats/Known Bugs:</b> -<p>This is Linux specific module and requires /dev/kmsg device with structured kernel logs. +<p>This module can't be used together with imklog module. When using one of them, make sure the other +one is not enabled.</p> +<p>This is Linux specific module and requires /dev/kmsg device with structured kernel logs.</p> <p><b>Sample:</b></p> <p>The following sample pulls messages from the /dev/kmsg log device. All parameters are left by default, which is usually a good idea. Please diff --git a/doc/multi_ruleset.html b/doc/multi_ruleset.html index da65b4ba..37c54065 100644 --- a/doc/multi_ruleset.html +++ b/doc/multi_ruleset.html @@ -31,7 +31,7 @@ You can think of a traditional config file just as a single default rule set, wh automatically bound to each of the inputs. This is even what actually happens. When rsyslog.conf is processed, the config file parser looks for the directive -<pre>$RuleSet <name> +<pre>ruleset(name="rulesetname"); </pre> <p>Where name is any name the user likes (but must not start with "RSYSLOG_", which @@ -63,7 +63,7 @@ to seperate the messages by any other method. <p>Binding to rulesets is input-specifc. For imtcp, this is done via the -<pre>$InputTCPServerBindRuleset <name> +<pre>input(type="imptcp" port="514" ruleset="rulesetname"); </pre> directive. Note that "name" must be the name of a ruleset that is already defined @@ -116,8 +116,12 @@ filters on the message, processes it and then discards it: <pre> # ... module loading ... # process remote messages -:fromhost-ip, isequal, "192.0.2.1" /var/log/remotefile -& ~ +if $fromhost-ip == '192.168.152.137' then { + action(type="omfile" file="/var/log/remotefile02") + stop + } + + # only messages not from 192.0.21 make it past this point # The authpriv file has restricted access. @@ -131,7 +135,7 @@ cron.* /var/log/cron ... more ... </pre> -<p>Note the tilde character, which is the discard action!. Also note that we assume that +<p>Note that "stop" is the discard action!. Also note that we assume that 192.0.2.1 is the sole remote sender (to keep it simple). <p>With multiple rulesets, we can simply define a dedicated ruleset for the remote reception @@ -141,66 +145,15 @@ case and bind it to the receiver. This may be written as follows: # ... module loading ... # process remote messages # define new ruleset and add rules to it: -$RuleSet remote -*.* /var/log/remotefile +ruleset(name="remote"){ + action(type="omfile" file="/var/log/remotefile") +} # only messages not from 192.0.21 make it past this point -# bind ruleset to tcp listener -$InputTCPServerBindRuleset remote -# and activate it: -$InputTCPServerRun 10514 - -# switch back to the default ruleset: -$RuleSet RSYSLOG_DefaultRuleset -# The authpriv file has restricted access. -authpriv.* /var/log/secure -# Log all the mail messages in one place. -mail.* /var/log/maillog -# Log cron stuff -cron.* /var/log/cron -# Everybody gets emergency messages -*.emerg * -... more ... +# bind ruleset to tcp listener and activate it: +input(type="imptcp" port="10514" ruleset="remote") </pre> -<p>Here, we need to switch back to the default ruleset after we have defined our custom -one. This is why I recommend a different ordering, which I find more intuitive. The sample -below has it, and it leads to the same results: - -<pre> -# ... module loading ... -# at first, this is a copy of the unmodified rsyslog.conf -# The authpriv file has restricted access. -authpriv.* /var/log/secure -# Log all the mail messages in one place. -mail.* /var/log/maillog -# Log cron stuff -cron.* /var/log/cron -# Everybody gets emergency messages -*.emerg * -... more ... -# end of the "regular" rsyslog.conf. Now come the new definitions: - -# process remote messages -# define new ruleset and add rules to it: -$RuleSet remote -*.* /var/log/remotefile - -# bind ruleset to tcp listener -$InputTCPServerBindRuleset remote -# and activate it: -$InputTCPServerRun 10514 -</pre> - -<p>Here, we do not switch back to the default ruleset, because this is not needed as it is -completely defined when we begin the "remote" ruleset. - -<p>Now look at the examples and compare them to the single-ruleset solution. You will notice -that we do <b>not</b> need a real filter in the multi-ruleset case: we can simply use -"*.*" as all messages now means all messages that are being processed by this -rule set and all of them come in via the TCP receiver! This is what makes using multiple -rulesets so much easier. - <h3>Split local and remote logging for three different ports</h3> <p>This example is almost like the first one, but it extends it a little bit. While it is very similar, I hope it is different enough to provide a useful example why you may want @@ -217,47 +170,34 @@ written to 10516's general log file. <pre> # ... module loading ... -# at first, this is a copy of the unmodified rsyslog.conf -# The authpriv file has restricted access. -authpriv.* /var/log/secure -# Log all the mail messages in one place. -mail.* /var/log/maillog -# Log cron stuff -cron.* /var/log/cron -# Everybody gets emergency messages -*.emerg * -... more ... -# end of the "regular" rsyslog.conf. Now come the new definitions: - # process remote messages -#define rulesets first -$RuleSet remote10514 -*.* /var/log/remote10514 - -$RuleSet remote10515 -*.* /var/log/remote10515 +ruleset(name="remote10514"){ + action(type="omfile" file="/var/log/remote10514") +} -$RuleSet remote10516 -mail.* /var/log/mail10516 -& ~ -# note that the discard-action will prevent this messag from -# being written to the remote10516 file - as usual... -*.* /var/log/remote10516 +ruleset(name="remote10515"){ + action(type="omfile" file="/var/log/remote10515") +} -# and now define listners bound to the relevant ruleset -$InputTCPServerBindRuleset remote10514 -$InputTCPServerRun 10514 +ruleset(name="test1"){ + if prifilt("mail.*") then { + /var/log/mail10516 + stop + # note that the stop-command will prevent this message from + # being written to the remote10516 file - as usual... + } + /var/log/remote10516 +} -$InputTCPServerBindRuleset remote10515 -$InputTCPServerRun 10515 -$InputTCPServerBindRuleset remote10516 -$InputTCPServerRun 10516 +# and now define listners bound to the relevant ruleset +input(type="imptcp" port="10514" ruleset="remote10514") +input(type="imptcp" port="10515" ruleset="remote10515") +input(type="imptcp" port="10516" ruleset="remote10516") </pre> -<p>Note that the "mail.*" rule inside the "remote10516" ruleset does -not affect processing inside any other rule set, including the default rule set. + <h2>Performance</h2> @@ -289,10 +229,6 @@ dedicated queue for each of the inputs. <p>By default, rulesets do <b>not</b> have their own queue. It must be activated via the <a href="rsconf1_rulesetcreatemainqueue.html">$RulesetCreateMainQueue</a> directive. -<h3>Future Enhancements</h3> -<p>In the long term, multiple rule sets will probably lay the foundation for even better -optimizations. So it is not a bad idea to get aquainted with them. - <p>[<a href="manual.html">manual index</a>] [<a href="http://www.rsyslog.com/">rsyslog site</a>]</p> <p><font size="2">This documentation is part of the <a href="http://www.rsyslog.com/">rsyslog</a> project.<br> diff --git a/doc/multi_ruleset_legacy_format.html b/doc/multi_ruleset_legacy_format.html new file mode 100644 index 00000000..5a9e7a4a --- /dev/null +++ b/doc/multi_ruleset_legacy_format.html @@ -0,0 +1,192 @@ +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> +<html><head> +<title>Multiple Rulesets in legacy format</title></head> +<body> +<h1>Multiple Rulesets in rsyslog</h1> +<p>Starting with version 4.5.0 and 5.1.1, <a href="http://www.rsyslog.com">rsyslog</a> supports +multiple rulesets within a single configuration. +This is especially useful for routing the recpetion of remote messages to a set of specific rules. +Note that the input module must support binding to non-standard rulesets, so the functionality +may not be available with all inputs.<p> +<b>Attention: this guide is shortened and only contains the samples in legacy format.</b> +Please follow this link to the full guide in the new config format "list": <a href="http://www.rsyslog.com/doc/multi_ruleset.html">http://www.rsyslog.com/doc/multi_ruleset.html<a> + + +<h2>Examples</h2> +<h3>Split local and remote logging</h3> +<p>Let's say you have a pretty standard system that logs its local messages to the usual +bunch of files that are specified in the default rsyslog.conf. As an example, your rsyslog.conf +might look like this: + +<pre> +# ... module loading ... +# The authpriv file has restricted access. +authpriv.* /var/log/secure +# Log all the mail messages in one place. +mail.* /var/log/maillog +# Log cron stuff +cron.* /var/log/cron +# Everybody gets emergency messages +*.emerg * +... more ... +</pre> + +<p>Now, you want to add receive messages from a remote system and log these to +a special file, but you do not want to have these messages written to the files +specified above. The traditional approach is to add a rule in front of all others that +filters on the message, processes it and then discards it: + +<pre> +# ... module loading ... +# process remote messages +:fromhost-ip, isequal, "192.0.2.1" /var/log/remotefile +& ~ +# only messages not from 192.0.21 make it past this point + +# The authpriv file has restricted access. +authpriv.* /var/log/secure +# Log all the mail messages in one place. +mail.* /var/log/maillog +# Log cron stuff +cron.* /var/log/cron +# Everybody gets emergency messages +*.emerg * +... more ... +</pre> + +<p>Note the tilde character, which is the discard action!. Also note that we assume that +192.0.2.1 is the sole remote sender (to keep it simple). + +<p>With multiple rulesets, we can simply define a dedicated ruleset for the remote reception +case and bind it to the receiver. This may be written as follows: + +<pre> +# ... module loading ... +# process remote messages +# define new ruleset and add rules to it: +$RuleSet remote +*.* /var/log/remotefile +# only messages not from 192.0.21 make it past this point + +# bind ruleset to tcp listener +$InputTCPServerBindRuleset remote +# and activate it: +$InputTCPServerRun 10514 + +# switch back to the default ruleset: +$RuleSet RSYSLOG_DefaultRuleset +# The authpriv file has restricted access. +authpriv.* /var/log/secure +# Log all the mail messages in one place. +mail.* /var/log/maillog +# Log cron stuff +cron.* /var/log/cron +# Everybody gets emergency messages +*.emerg * +... more ... +</pre> + +<p>Here, we need to switch back to the default ruleset after we have defined our custom +one. This is why I recommend a different ordering, which I find more intuitive. The sample +below has it, and it leads to the same results: + +<pre> +# ... module loading ... +# at first, this is a copy of the unmodified rsyslog.conf +# The authpriv file has restricted access. +authpriv.* /var/log/secure +# Log all the mail messages in one place. +mail.* /var/log/maillog +# Log cron stuff +cron.* /var/log/cron +# Everybody gets emergency messages +*.emerg * +... more ... +# end of the "regular" rsyslog.conf. Now come the new definitions: + +# process remote messages +# define new ruleset and add rules to it: +$RuleSet remote +*.* /var/log/remotefile + +# bind ruleset to tcp listener +$InputTCPServerBindRuleset remote +# and activate it: +$InputTCPServerRun 10514 +</pre> + +<p>Here, we do not switch back to the default ruleset, because this is not needed as it is +completely defined when we begin the "remote" ruleset. + +<p>Now look at the examples and compare them to the single-ruleset solution. You will notice +that we do <b>not</b> need a real filter in the multi-ruleset case: we can simply use +"*.*" as all messages now means all messages that are being processed by this +rule set and all of them come in via the TCP receiver! This is what makes using multiple +rulesets so much easier. + +<h3>Split local and remote logging for three different ports</h3> +<p>This example is almost like the first one, but it extends it a little bit. While it is +very similar, I hope it is different enough to provide a useful example why you may want +to have more than two rulesets. + +<p>Again, we would like to use the "regular" log files for local logging, only. But +this time we set up three syslog/tcp listeners, each one listening to a different +port (in this example 10514, 10515, and 10516). Logs received from these receivers shall go into +different files. Also, logs received from 10516 (and only from that port!) with +"mail.*" priority, shall be written into a specif file and <b>not</b> be +written to 10516's general log file. + +<p>This is the config: + +<pre> +# ... module loading ... +# at first, this is a copy of the unmodified rsyslog.conf +# The authpriv file has restricted access. +authpriv.* /var/log/secure +# Log all the mail messages in one place. +mail.* /var/log/maillog +# Log cron stuff +cron.* /var/log/cron +# Everybody gets emergency messages +*.emerg * +... more ... +# end of the "regular" rsyslog.conf. Now come the new definitions: + +# process remote messages + +#define rulesets first +$RuleSet remote10514 +*.* /var/log/remote10514 + +$RuleSet remote10515 +*.* /var/log/remote10515 + +$RuleSet remote10516 +mail.* /var/log/mail10516 +& ~ +# note that the discard-action will prevent this messag from +# being written to the remote10516 file - as usual... +*.* /var/log/remote10516 + +# and now define listners bound to the relevant ruleset +$InputTCPServerBindRuleset remote10514 +$InputTCPServerRun 10514 + +$InputTCPServerBindRuleset remote10515 +$InputTCPServerRun 10515 + +$InputTCPServerBindRuleset remote10516 +$InputTCPServerRun 10516 +</pre> + +<p>Note that the "mail.*" rule inside the "remote10516" ruleset does +not affect processing inside any other rule set, including the default rule set. + + +<p>[<a href="manual.html">manual index</a>] [<a href="http://www.rsyslog.com/">rsyslog site</a>]</p> +<p><font size="2">This documentation is part of the <a href="http://www.rsyslog.com/">rsyslog</a> +project.<br> +Copyright © 2009 by <a href="http://www.gerhards.net/rainer">Rainer Gerhards</a> and +<a href="http://www.adiscon.com/">Adiscon</a>. +Released under the GNU GPL version 3 or higher.</font></p> +</body></html> diff --git a/doc/rsyslog_conf_filter.html b/doc/rsyslog_conf_filter.html index 3efa3967..a795193f 100644 --- a/doc/rsyslog_conf_filter.html +++ b/doc/rsyslog_conf_filter.html @@ -197,9 +197,14 @@ of the property value. For example, if you search for "val" with <p>it will be a match if msg contains "values are in this message" but it won't match if the msg contains "There are values in this message" (in the later case, contains would match). Please note -that "startswith" is by far faster than regular expressions. So even -once they are implemented, it can make very much sense -(performance-wise) to use "startswith".</p> +that "startswith" is by far faster than regular expressions. So +it makes very much sense (performance-wise) to use "startswith".</p> +<p>Note: when processing syslog messages, please note that $msg usually +starts with a space. The reason for this is RFC3164. Please read the +<a href="http://www.rsyslog.com/log-normalization-and-the-leading-space/">detail +description</a> of what that means to you. In short, you need to make sure +that you include the first space if you use "startswith", otherwise you will +not get matches. </td> </tr> <tr> diff --git a/doc/rsyslog_conf_global.html b/doc/rsyslog_conf_global.html index a4d760eb..651808f6 100644 --- a/doc/rsyslog_conf_global.html +++ b/doc/rsyslog_conf_global.html @@ -67,7 +67,7 @@ default 0 (no delay). Simple rate-limiting!]</li> <li>$ActionQueueDiscardMark <number> [default 9750]</li> <li>$ActionQueueDiscardSeverity <number> -[*numerical* severity! default 4 (warning)]</li> +[*numerical* severity! default 8 (nothing discarded)]</li> <li>$ActionQueueFileName <name></li> <li>$ActionQueueHighWaterMark <number> [default 8000]</li> diff --git a/grammar/rainerscript.c b/grammar/rainerscript.c index 36254632..27ff5376 100644 --- a/grammar/rainerscript.c +++ b/grammar/rainerscript.c @@ -1230,7 +1230,7 @@ evalStrArrayCmp(es_str_t *estr_l, struct cnfarray* ar, int cmpop) #define FREE_TWO_STRINGS \ if(bMustFree) es_deleteStr(estr_r); \ - if(expr->r->nodetype != 'A' && r.datatype == 'S') es_deleteStr(r.d.estr); \ + if(expr->r->nodetype != 'S' && expr->r->nodetype != 'A' && r.datatype == 'S') es_deleteStr(r.d.estr); \ if(bMustFree2) es_deleteStr(estr_l); \ if(l.datatype == 'S') es_deleteStr(l.d.estr) @@ -2761,42 +2761,56 @@ int cnfDoInclude(char *name) { char *cfgFile; + char *finalName; unsigned i; int result; glob_t cfgFiles; struct stat fileInfo; + char nameBuf[MAXFNAME+1]; + + finalName = name; + if(stat(name, &fileInfo) == 0) { + /* stat usually fails if we have a wildcard - so this does NOT indicate error! */ + if(S_ISDIR(fileInfo.st_mode)) { + /* if we have a directory, we need to add "*" to get its files */ + snprintf(nameBuf, sizeof(nameBuf), "%s*", name); + finalName = nameBuf; + } + } + + /* Use GLOB_MARK to append a trailing slash for directories. */ + /* Use GLOB_NOMAGIC to detect wildcards that match nothing. */ + result = glob(finalName, GLOB_MARK | GLOB_NOMAGIC, NULL, &cfgFiles); + + /* Silently ignore wildcards that match nothing */ + if(result == GLOB_NOMATCH) { + return 1; + } - /* Use GLOB_MARK to append a trailing slash for directories. - * Required by doIncludeDirectory(). - */ - result = glob(name, GLOB_MARK, NULL, &cfgFiles); if(result == GLOB_NOSPACE || result == GLOB_ABORTED) { -#if 0 char errStr[1024]; rs_strerror_r(errno, errStr, sizeof(errStr)); - errmsg.LogError(0, RS_RET_FILE_NOT_FOUND, "error accessing config file or directory '%s': %s", - pattern, errStr); - ABORT_FINALIZE(RS_RET_FILE_NOT_FOUND); -#endif - dbgprintf("includeconfig glob error %d\n", errno); + parser_errmsg("error accessing config file or directory '%s': %s", + finalName, errStr); return 1; } for(i = 0; i < cfgFiles.gl_pathc; i++) { cfgFile = cfgFiles.gl_pathv[i]; - - if(stat(cfgFile, &fileInfo) != 0) - continue; /* continue with the next file if we can't stat() the file */ + if(stat(cfgFile, &fileInfo) != 0) { + char errStr[1024]; + rs_strerror_r(errno, errStr, sizeof(errStr)); + parser_errmsg("error accessing config file or directory '%s': %s", + cfgFile, errStr); + continue; + } if(S_ISREG(fileInfo.st_mode)) { /* config file */ dbgprintf("requested to include config file '%s'\n", cfgFile); cnfSetLexFile(cfgFile); } else if(S_ISDIR(fileInfo.st_mode)) { /* config directory */ - if(strcmp(name, cfgFile)) { - /* do not include ourselves! */ - dbgprintf("requested to include directory '%s'\n", cfgFile); - cnfDoInclude(cfgFile); - } + dbgprintf("requested to include directory '%s'\n", cfgFile); + cnfDoInclude(cfgFile); } else { dbgprintf("warning: unable to process IncludeConfig directive '%s'\n", cfgFile); } @@ -262,7 +262,7 @@ rsRetVal parsDelimCStr(rsParsObj *pThis, cstr_t **ppCStr, char cDelim, int bTrim pC = rsCStrGetBufBeg(pThis->pCStr) + pThis->iCurrPos; - while(pThis->iCurrPos < rsCStrLen(pThis->pCStr) && *pC != cDelim && *pC != ' ') { + while(pThis->iCurrPos < rsCStrLen(pThis->pCStr) && *pC != cDelim) { CHKiRet(cstrAppendChar(pCStr, bConvLower ? tolower(*pC) : *pC)); ++pThis->iCurrPos; ++pC; diff --git a/plugins/imkmsg/kmsg.c b/plugins/imkmsg/kmsg.c index 9ad98da4..b771d68a 100644 --- a/plugins/imkmsg/kmsg.c +++ b/plugins/imkmsg/kmsg.c @@ -32,7 +32,9 @@ #include <errno.h> #include <string.h> #include <ctype.h> +#ifdef OS_LINUX #include <sys/klog.h> +#endif #include <json/json.h> #include "rsyslog.h" diff --git a/plugins/imrelp/imrelp.c b/plugins/imrelp/imrelp.c index 31f82b14..dc67f4fe 100644 --- a/plugins/imrelp/imrelp.c +++ b/plugins/imrelp/imrelp.c @@ -321,7 +321,14 @@ ENDactivateCnf BEGINfreeCnf + instanceConf_t *inst, *del; CODESTARTfreeCnf + for(inst = pModConf->root ; inst != NULL ; ) { + free(inst->pszBindPort); + del = inst; + inst = inst->next; + free(del); + } ENDfreeCnf /* This is used to terminate the plugin. Note that the signal handler blocks diff --git a/plugins/imuxsock/imuxsock.c b/plugins/imuxsock/imuxsock.c index 1b7dface..9e60c9dc 100644 --- a/plugins/imuxsock/imuxsock.c +++ b/plugins/imuxsock/imuxsock.c @@ -980,7 +980,7 @@ static rsRetVal readSocket(lstn_t *pLstn) } } CHKiRet(SubmitMsg(pRcv, iRcvd, pLstn, cred, ts)); - } else if(iRcvd < 0 && errno != EINTR) { + } else if(iRcvd < 0 && errno != EINTR && errno != EAGAIN) { char errStr[1024]; rs_strerror_r(errno, errStr, sizeof(errStr)); DBGPRINTF("UNIX socket error: %d = %s.\n", errno, errStr); diff --git a/plugins/mmaudit/mmaudit.c b/plugins/mmaudit/mmaudit.c index 4934312b..018e1771 100644 --- a/plugins/mmaudit/mmaudit.c +++ b/plugins/mmaudit/mmaudit.c @@ -67,12 +67,8 @@ DEFobjCurrIf(errmsg); DEF_OMOD_STATIC_DATA typedef struct _instanceData { -} instanceData; - -typedef struct configSettings_s { int dummy; /* remove when the first real parameter is needed */ -} configSettings_t; -static configSettings_t cs; +} instanceData; BEGINinitConfVars /* (re)set config variables to default values */ CODESTARTinitConfVars diff --git a/runtime/module-template.h b/runtime/module-template.h index 9dd759a5..72a139c4 100644 --- a/runtime/module-template.h +++ b/runtime/module-template.h @@ -246,7 +246,8 @@ static rsRetVal dbgPrintInstInfo(void *pModData)\ instanceData *pData = NULL; #define CODESTARTdbgPrintInstInfo \ - pData = (instanceData*) pModData; + pData = (instanceData*) pModData; \ + (void)pData; /* prevent compiler warning if unused! */ #define ENDdbgPrintInstInfo \ RETiRet;\ diff --git a/runtime/msg.c b/runtime/msg.c index de0ca553..d648bb92 100644 --- a/runtime/msg.c +++ b/runtime/msg.c @@ -45,7 +45,9 @@ #if HAVE_MALLOC_H # include <malloc.h> #endif -#include <uuid/uuid.h> +#ifdef USE_LIBUUID + #include <uuid/uuid.h> +#endif #include "rsyslog.h" #include "srUtils.h" #include "stringbuf.h" @@ -559,8 +561,10 @@ propNameStrToID(uchar *pName, propid_t *pPropID) *pPropID = PROP_MSGID; } else if(!strcmp((char*) pName, "parsesuccess")) { *pPropID = PROP_PARSESUCCESS; +#ifdef USE_LIBUUID } else if(!strcmp((char*) pName, "uuid")) { *pPropID = PROP_UUID; +#endif /* here start system properties (those, that do not relate to the message itself */ } else if(!strcmp((char*) pName, "$now")) { *pPropID = PROP_SYS_NOW; @@ -1450,6 +1454,7 @@ char *getProtocolVersionString(msg_t *pM) return(pM->iProtocolVersion ? "1" : "0"); } +#ifdef USE_LIBUUID /* note: libuuid seems not to be thread-safe, so we need * to get some safeguards in place. */ @@ -1504,6 +1509,7 @@ void getUUID(msg_t *pM, uchar **pBuf, int *piLen) } dbgprintf("[getUUID] END\n"); } +#endif void getRawMsg(msg_t *pM, uchar **pBuf, int *piLen) @@ -2970,9 +2976,11 @@ uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe, case PROP_MSGID: pRes = (uchar*)getMSGID(pMsg); break; +#ifdef USE_LIBUUID case PROP_UUID: getUUID(pMsg, &pRes, &bufLen); break; +#endif case PROP_PARSESUCCESS: pRes = (uchar*)getParseSuccess(pMsg); break; @@ -3065,8 +3073,8 @@ uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe, *pbMustBeFreed = 0; break; case PROP_SYS_UPTIME: -# ifdef OS_SOLARIS - pRes = (uchar*) "UPTIME NOT available under Solaris"; +# ifndef HAVE_SYSINFO + pRes = (uchar*) "UPTIME NOT available on this system"; *pbMustBeFreed = 0; # else { diff --git a/runtime/stringbuf.c b/runtime/stringbuf.c index e7fd72c2..5bca009d 100644 --- a/runtime/stringbuf.c +++ b/runtime/stringbuf.c @@ -482,6 +482,8 @@ rsRetVal cstrTrimTrailingWhiteSpace(cstr_t *pThis) register uchar *pC; rsCHECKVALIDOBJECT(pThis, OIDrsCStr); + if(pThis->iStrLen == 0) + goto done; /* empty string -> nothing to trim ;) */ i = pThis->iStrLen; pC = pThis->pBuf + i - 1; while(i > 0 && isspace((int)*pC)) { @@ -492,7 +494,7 @@ rsRetVal cstrTrimTrailingWhiteSpace(cstr_t *pThis) pThis->iStrLen = i; pThis->pBuf[pThis->iStrLen] = '0'; /* we always have this space */ - return RS_RET_OK; +done: return RS_RET_OK; } /* compare two string objects - works like strcmp(), but operates @@ -584,9 +584,14 @@ tplConstruct(rsconf_t *conf) /* helper to tplAddLine. Parses a constant and generates * the necessary structure. + * Paramter "bDoEscapes" is to support legacy vs. v6+ config system. In + * legacy, we must do escapes ourselves, whereas v6+ passes in already + * escaped strings (which we are NOT permitted to further escape, this would + * cause invalid result strings!). Note: if escapes are not permitted, + * quotes (") are just a regular character and do NOT terminate the constant! * returns: 0 - ok, 1 - failure */ -static int do_Constant(unsigned char **pp, struct template *pTpl) +static int do_Constant(unsigned char **pp, struct template *pTpl, int bDoEscapes) { register unsigned char *p; cstr_t *pStrB; @@ -604,8 +609,8 @@ static int do_Constant(unsigned char **pp, struct template *pTpl) /* process the message and expand escapes * (additional escapes can be added here if needed) */ - while(*p && *p != '%' && *p != '\"') { - if(*p == '\\') { + while(*p && *p != '%' && !(bDoEscapes && *p == '\"')) { + if(bDoEscapes && *p == '\\') { switch(*++p) { case '\0': /* the best we can do - it's invalid anyhow... */ @@ -763,7 +768,8 @@ static void doOptions(unsigned char **pp, struct templateEntry *pTpe) } else if(!strcmp((char*)Buf, "mandatory-field")) { pTpe->data.field.options.bMandatory = 1; } else { - dbgprintf("Invalid field option '%s' specified - ignored.\n", Buf); + errmsg.LogError(0, NO_ERRCODE, "template error: invalid field option '%s' " + "specified - ignored", Buf); } } @@ -1128,7 +1134,7 @@ static int do_Parameter(unsigned char **pp, struct template *pTpl) } } else { pTpe->fieldName = ustrdup(cstrGetSzStrNoNULL(pStrField)); - pTpe->lenFieldName = cstrLen(pStrProp); + pTpe->lenFieldName = ustrlen(pTpe->fieldName); cstrDestruct(&pStrField); } if(pTpe->fieldName == NULL) @@ -1271,7 +1277,7 @@ struct template *tplAddLine(rsconf_t *conf, char* pName, uchar** ppRestOfConfLin do_Parameter(&p, pTpl); break; default: /* constant */ - do_Constant(&p, pTpl); + do_Constant(&p, pTpl, 1); break; } if(*p == '"') {/* end of template string? */ @@ -1868,7 +1874,7 @@ tplProcessCnf(struct cnfobj *o) do_Parameter(&p, pTpl); break; default: /* constant */ - do_Constant(&p, pTpl); + do_Constant(&p, pTpl, 0); break; } } diff --git a/tests/Makefile.am b/tests/Makefile.am index 5bcaea75..a673ef1e 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -73,6 +73,9 @@ TESTS += \ rscript_ruleset_call.sh \ cee_simple.sh \ cee_diskqueue.sh \ + incltest.sh \ + incltest_dir.sh \ + incltest_dir_wildcard.sh \ linkedlistqueue.sh if HAVE_VALGRIND @@ -291,6 +294,13 @@ EXTRA_DIST= 1.rstest 2.rstest 3.rstest err1.rstest \ testsuites/cee_simple.conf \ cee_diskqueue.sh \ testsuites/cee_diskqueue.conf \ + incltest.sh \ + testsuites/incltest.conf \ + incltest_dir.sh \ + testsuites/incltest_dir.conf \ + incltest_dir_wildcard.sh \ + testsuites/incltest_dir_wildcard.conf \ + testsuites/incltest.d/include.conf \ linkedlistqueue.sh \ testsuites/linkedlistqueue.conf \ da-mainmsg-q.sh \ diff --git a/tests/diag.sh b/tests/diag.sh index bd38b29d..02b24c5b 100755 --- a/tests/diag.sh +++ b/tests/diag.sh @@ -10,8 +10,8 @@ #valgrind="valgrind --tool=helgrind --log-fd=1" #valgrind="valgrind --tool=exp-ptrcheck --log-fd=1" #set -o xtrace -#export RSYSLOG_DEBUG="debug nologfuncflow noprintmutexaction nostdout" -#export RSYSLOG_DEBUGLOG="log" +export RSYSLOG_DEBUG="debug nologfuncflow noprintmutexaction nostdout" +export RSYSLOG_DEBUGLOG="log" case $1 in 'init') $srcdir/killrsyslog.sh # kill rsyslogd if it runs for some reason cp $srcdir/testsuites/diag-common.conf diag-common.conf diff --git a/tests/incltest.sh b/tests/incltest.sh new file mode 100755 index 00000000..8e3fe454 --- /dev/null +++ b/tests/incltest.sh @@ -0,0 +1,11 @@ +echo =============================================================================== +echo \[incltest.sh\]: test $IncludeConfig for specific file + +source $srcdir/diag.sh init +source $srcdir/diag.sh startup incltest.conf +# 100 messages are enough - the question is if the include is read ;) +source $srcdir/diag.sh injectmsg 0 100 +source $srcdir/diag.sh shutdown-when-empty # shut down rsyslogd when done processing messages +source $srcdir/diag.sh wait-shutdown +source $srcdir/diag.sh seq-check 0 99 +source $srcdir/diag.sh exit diff --git a/tests/incltest_dir.sh b/tests/incltest_dir.sh new file mode 100755 index 00000000..3716a695 --- /dev/null +++ b/tests/incltest_dir.sh @@ -0,0 +1,11 @@ +echo =============================================================================== +echo \[incltest_dir.sh\]: test $IncludeConfig for directories + +source $srcdir/diag.sh init +source $srcdir/diag.sh startup incltest_dir.conf +# 100 messages are enough - the question is if the include is read ;) +source $srcdir/diag.sh injectmsg 0 100 +source $srcdir/diag.sh shutdown-when-empty # shut down rsyslogd when done processing messages +source $srcdir/diag.sh wait-shutdown +source $srcdir/diag.sh seq-check 0 99 +source $srcdir/diag.sh exit diff --git a/tests/incltest_dir_wildcard.sh b/tests/incltest_dir_wildcard.sh new file mode 100755 index 00000000..0dcad34d --- /dev/null +++ b/tests/incltest_dir_wildcard.sh @@ -0,0 +1,11 @@ +echo =============================================================================== +echo \[incltest_dir_wildcard.sh\]: test $IncludeConfig for directories with wildcards + +source $srcdir/diag.sh init +source $srcdir/diag.sh startup incltest_dir_wildcard.conf +# 100 messages are enough - the question is if the include is read ;) +source $srcdir/diag.sh injectmsg 0 100 +source $srcdir/diag.sh shutdown-when-empty # shut down rsyslogd when done processing messages +source $srcdir/diag.sh wait-shutdown +source $srcdir/diag.sh seq-check 0 99 +source $srcdir/diag.sh exit diff --git a/tests/testsuites/incltest.conf b/tests/testsuites/incltest.conf new file mode 100644 index 00000000..737018cd --- /dev/null +++ b/tests/testsuites/incltest.conf @@ -0,0 +1,5 @@ +# see .sh file for description +# rgerhards, 2009-11-30 +$IncludeConfig diag-common.conf + +$IncludeConfig testsuites/incltest.d/include.conf diff --git a/tests/testsuites/incltest.d/include.conf b/tests/testsuites/incltest.d/include.conf new file mode 100644 index 00000000..39a2ea70 --- /dev/null +++ b/tests/testsuites/incltest.d/include.conf @@ -0,0 +1,2 @@ +$template outfmt,"%msg:F,58:2%\n" +:msg, contains, "msgnum:" ./rsyslog.out.log;outfmt diff --git a/tests/testsuites/incltest_dir.conf b/tests/testsuites/incltest_dir.conf new file mode 100644 index 00000000..421349d2 --- /dev/null +++ b/tests/testsuites/incltest_dir.conf @@ -0,0 +1,5 @@ +# see .sh file for description +# rgerhards, 2009-11-30 +$IncludeConfig diag-common.conf + +$IncludeConfig testsuites/incltest.d/ diff --git a/tests/testsuites/incltest_dir_wildcard.conf b/tests/testsuites/incltest_dir_wildcard.conf new file mode 100644 index 00000000..0d7e6782 --- /dev/null +++ b/tests/testsuites/incltest_dir_wildcard.conf @@ -0,0 +1,5 @@ +# see .sh file for description +# rgerhards, 2009-11-30 +$IncludeConfig diag-common.conf + +$IncludeConfig testsuites/incltest.d/*.conf diff --git a/tools/rsyslog.conf.5 b/tools/rsyslog.conf.5 index 641ba9ba..fe9e083b 100644 --- a/tools/rsyslog.conf.5 +++ b/tools/rsyslog.conf.5 @@ -415,7 +415,7 @@ To escape: .sp 0 \\ = \\\\ --> '\\' is used to escape (as in C) .sp 0 -$template TraditionalFormat,"%timegenerated% %HOSTNAME% %syslogtag%%msg%\n" +$template TraditionalFormat,"%timegenerated% %HOSTNAME% %syslogtag%%msg%\\n" Properties can be accessed by the property replacer (see there for details). @@ -487,7 +487,7 @@ A template that resembles traditional syslogd file output: .RS $template TraditionalFormat,"%timegenerated% %HOSTNAME% .sp 0 -%syslogtag%%msg:::drop-last-lf%\n" +%syslogtag%%msg:::drop-last-lf%\\n" .RE A template that tells you a little more about the message: @@ -495,7 +495,7 @@ A template that tells you a little more about the message: .RS $template precise,"%syslogpriority%,%syslogfacility%,%timegenerated%,%HOSTNAME%, .sp 0 -%syslogtag%,%msg%\n" +%syslogtag%,%msg%\\n" .RE A template for RFC 3164 format: @@ -507,7 +507,7 @@ $template RFC3164fmt,"<%PRI%>%TIMESTAMP% %HOSTNAME% %syslogtag%%msg%" A template for the format traditionally used for user messages: .sp .RS -$template usermsg," XXXX%syslogtag%%msg%\n\r" +$template usermsg," XXXX%syslogtag%%msg%\\n\\r" .RE And a template with the traditional wall-message format: diff --git a/tools/rsyslogd.8 b/tools/rsyslogd.8 index 9ded4b9b..620006f2 100644 --- a/tools/rsyslogd.8 +++ b/tools/rsyslogd.8 @@ -128,8 +128,8 @@ may not support it. .B "\-D" Runs the Bison config parser in debug mode. This may help when hard to find syntax errors are reported. Please note that the output generated is deeply -.TP technical and orignally targeted towards developers. +.TP .B "\-d" Turns on debug mode. Using this the daemon will not proceed a .BR fork (2) diff --git a/tools/syslogd.c b/tools/syslogd.c index a2ce6469..0bac0acd 100644 --- a/tools/syslogd.c +++ b/tools/syslogd.c @@ -1340,6 +1340,11 @@ static void printVersion(void) #else printf("\tRuntime Instrumentation (slow code):\tNo\n"); #endif +#ifdef USE_LIBUUID + printf("\tuuid support:\t\t\t\tYes\n"); +#else + printf("\tuuid support:\t\t\t\tNo\n"); +#endif printf("\nSee http://www.rsyslog.com for more information.\n"); } |