diff options
| -rw-r--r-- | ChangeLog | 38 | ||||
| -rw-r--r-- | doc/imklog.html | 13 | ||||
| -rw-r--r-- | plugins/imklog/bsd.c | 49 | ||||
| -rw-r--r-- | plugins/imklog/imklog.c | 17 | ||||
| -rw-r--r-- | plugins/imklog/imklog.h | 2 |
5 files changed, 91 insertions, 28 deletions
@@ -14,6 +14,23 @@ Version 6.6.1 [v6-stable] 2012-10-?? closes: http://bugzilla.adiscon.com/show_bug.cgi?id=376 The testbench was also enhanced to check for these cases. Thanks to Georgi Georgiev for the bug report. +- bugfix: spurios error messages from imuxsock about (non-error) EAGAIN + Thanks to Marius Tomaschweski for the patch. +- imklog: added $klogParseKernelTimestamp option + When enabled, kernel message [timestamp] is converted for message time. + Default is to use receive time as in 5.8.x and before, because the clock + used to create the timestamp is not supposed to be as accurate as the + monotonic clock (depends on hardware and kernel) resulting in differences + between kernel and system messages which occurred at same time. + Thanks to Marius Tomaschweski for the patch. +- imklog: added $klogKeepKernelTimestamp option + When enabled, the kernel [timestamp] remains at begin of + each message, even it is used for the message time too. + Thanks to Marius Tomaschweski for the patch. +- bugfix: imklog mistakenly took kernel timestamp subseconds as nanoseconds + ... actually, they are microseconds. So the fractional part of the + timestamp was not properly formatted. + Thanks to Marius Tomaschweski for the bug report and the patch idea. --------------------------------------------------------------------------- Version 6.6.0 [v6-stable] 2012-10-22 This starts a new stable branch, based on the 6.5.x series, plus: @@ -82,7 +99,7 @@ all these patches here are present in 6.6.0. Thanks to Michael Biebl for reporting & suggestions - bugfix: imuxsock and imklog truncated head of received message This happened only under some circumstances. Thanks to Marius - Tomaschwesky, Florian Piekert and Milan Bartos for their help in + Tomaschweski, Florian Piekert and Milan Bartos for their help in solving this issue. - change lumberjack cookie to "@cee:" from "@cee: " CEE originally specified the cookie with SP, whereas other lumberjack @@ -667,12 +684,27 @@ expected that interfaces, even new ones, break during the initial --------------------------------------------------------------------------- Version 5.10.2 [V5-STABLE], 201?-??-?? - bugfix: spurios error messages from imuxsock about (non-error) EAGAIN - Thanks to Marius Tomaschwesky for the patch. + Thanks to Marius Tomaschweski for the patch. +- imklog: added $klogParseKernelTimestamp option + When enabled, kernel message [timestamp] is converted for message time. + Default is to use receive time as in 5.8.x and before, because the clock + used to create the timestamp is not supposed to be as accurate as the + monotonic clock (depends on hardware and kernel) resulting in differences + between kernel and system messages which occurred at same time. + Thanks to Marius Tomaschweski for the patch. +- imklog: added $klogKeepKernelTimestamp option + When enabled, the kernel [timestamp] remains at begin of + each message, even it is used for the message time too. + Thanks to Marius Tomaschweski for the patch. +- bugfix: imklog mistakenly took kernel timestamp subseconds as nanoseconds + ... actually, they are microseconds. So the fractional part of the + timestamp was not properly formatted. + Thanks to Marius Tomaschweski for the bug report and the patch idea. --------------------------------------------------------------------------- Version 5.10.1 [V5-STABLE], 2012-10-17 - bugfix: imuxsock and imklog truncated head of received message This happened only under some circumstances. Thanks to Marius - Tomaschwesky, Florian Piekert and Milan Bartos for their help in + Tomaschweski, Florian Piekert and Milan Bartos for their help in solving this issue. - enable DNS resolution in imrelp Thanks to Apollon Oikonomopoulos for the patch diff --git a/doc/imklog.html b/doc/imklog.html index 2e3b3bc2..05292ddf 100644 --- a/doc/imklog.html +++ b/doc/imklog.html @@ -65,6 +65,19 @@ Linux only, ignored on other platforms (but may be specified)</li> former klogd -2 option<br> Linux only, ignored on other platforms (but may be specified)<br style="font-weight: bold;"> </li> +<li><b>$klogParseKernelTimestamp</b> [on/<b>off</b>] +If enabled and the kernel creates a timestamp for its log messages, this timestamp will be +parsed and converted into regular message time instead to use the receive time of the kernel +message (as in 5.8.x and before). Default is to not parse the kernel timestamp, because the +clock used by the kernel to create the timestamps is not supposed to be as accurate as the +monotonic clock required to convert it. Depending on the hardware and kernel, it can result +in message time differences between kernel and system messages which occurred at same time. +</li> +<li><b>$klogKeepKernelTimestamp</b> [on/<b>off</b>] +If enabled, this option causes to keep the [timestamp] provided by the kernel at the begin +of in each message rather than to remove it, when it could be parsed and converted into +local time for use as regular message time. Only used, when $klogParseKernelTimestamp is on. +</li> </ul> <b>Caveats/Known Bugs:</b> <p>This is obviously platform specific and requires platform diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c index d4f9f773..cddc6737 100644 --- a/plugins/imklog/bsd.c +++ b/plugins/imklog/bsd.c @@ -73,18 +73,21 @@ static int fklog = -1; /* kernel log fd */ * rgerhards, 2011-06-24 */ static void -submitSyslog(int pri, uchar *buf) +submitSyslog(modConfData_t *pModConf, int pri, uchar *buf) { long secs; - long nsecs; + long usecs; long secOffs; - long nsecOffs; + long usecOffs; unsigned i; unsigned bufsize; struct timespec monotonic, realtime; struct timeval tv; struct timeval *tp = NULL; + if(!pModConf->bParseKernelStamp) + goto done; + if(buf[3] != '[') goto done; DBGPRINTF("imklog: kernel timestamp detected, extracting it\n"); @@ -106,9 +109,9 @@ submitSyslog(int pri, uchar *buf) } ++i; /* skip dot */ - nsecs = 0; + usecs = 0; while(buf[i] && isdigit(buf[i])) { - nsecs = nsecs * 10 + buf[i] - '0'; + usecs = usecs * 10 + buf[i] - '0'; ++i; } if(buf[i] != ']') { @@ -118,27 +121,29 @@ submitSyslog(int pri, uchar *buf) ++i; /* skip ']' */ /* we have a timestamp */ - DBGPRINTF("kernel timestamp is %ld %ld\n", secs, nsecs); - bufsize= strlen((char*)buf); - memmove(buf+3, buf+i, bufsize - i + 1); + DBGPRINTF("kernel timestamp is %ld %ld\n", secs, usecs); + if(!pModConf->bKeepKernelStamp) { + bufsize= strlen((char*)buf); + memmove(buf+3, buf+i, bufsize - i + 1); + } clock_gettime(CLOCK_MONOTONIC, &monotonic); clock_gettime(CLOCK_REALTIME, &realtime); secOffs = realtime.tv_sec - monotonic.tv_sec; - nsecOffs = realtime.tv_nsec - monotonic.tv_nsec; - if(nsecOffs < 0) { + usecOffs = (realtime.tv_nsec - monotonic.tv_nsec) / 1000; + if(usecOffs < 0) { secOffs--; - nsecOffs += 1000000000l; + usecOffs += 1000000l; } - nsecs +=nsecOffs; - if(nsecs > 999999999l) { + usecs += usecOffs; + if(usecs > 999999l) { secs++; - nsecs -= 1000000000l; + usecs -= 1000000l; } secs += secOffs; tv.tv_sec = secs; - tv.tv_usec = nsecs / 1000; + tv.tv_usec = usecs; tp = &tv; done: @@ -146,7 +151,7 @@ done: } #else /* now comes the BSD "code" (just a shim) */ static void -submitSyslog(int pri, uchar *buf) +submitSyslog(modConfData_t *pModConf, int pri, uchar *buf) { Syslog(pri, buf, NULL); } @@ -196,7 +201,7 @@ finalize_it: /* Read kernel log while data are available, split into lines. */ static void -readklog(void) +readklog(modConfData_t *pModConf) { char *p, *q; int len, i; @@ -238,18 +243,18 @@ readklog(void) for (p = (char*)pRcv; (q = strchr(p, '\n')) != NULL; p = q + 1) { *q = '\0'; - submitSyslog(LOG_INFO, (uchar*) p); + submitSyslog(pModConf, LOG_INFO, (uchar*) p); } len = strlen(p); if (len >= iMaxLine - 1) { - submitSyslog(LOG_INFO, (uchar*)p); + submitSyslog(pModConf, LOG_INFO, (uchar*)p); len = 0; } if(len > 0) memmove(pRcv, p, len + 1); } if (len > 0) - submitSyslog(LOG_INFO, pRcv); + submitSyslog(pModConf, LOG_INFO, pRcv); if(pRcv != NULL && (size_t) iMaxLine >= sizeof(bufRcv) - 1) free(pRcv); @@ -278,10 +283,10 @@ rsRetVal klogAfterRun(modConfData_t *pModConf) * "message pull" mechanism. * rgerhards, 2008-04-09 */ -rsRetVal klogLogKMsg(modConfData_t __attribute__((unused)) *pModConf) +rsRetVal klogLogKMsg(modConfData_t *pModConf) { DEFiRet; - readklog(); + readklog(pModConf); RETiRet; } diff --git a/plugins/imklog/imklog.c b/plugins/imklog/imklog.c index 93323707..7a1078f8 100644 --- a/plugins/imklog/imklog.c +++ b/plugins/imklog/imklog.c @@ -77,6 +77,8 @@ DEFobjCurrIf(errmsg) /* config settings */ typedef struct configSettings_s { int bPermitNonKernel; /* permit logging of messages not having LOG_KERN facility */ + int bParseKernelStamp; /* if try to parse kernel timestamps for message time */ + int bKeepKernelStamp; /* keep the kernel timestamp in the message */ int iFacilIntMsg; /* the facility to use for internal messages (set by driver) */ uchar *pszPath; int console_log_level; /* still used for BSD */ @@ -100,16 +102,15 @@ static struct cnfparamblk modpblk = modpdescr }; - - static prop_t *pInputName = NULL; /* there is only one global inputName for all messages generated by this module */ static prop_t *pLocalHostIP = NULL; /* a pseudo-constant propterty for 127.0.0.1 */ - static inline void initConfigSettings(void) { cs.bPermitNonKernel = 0; + cs.bParseKernelStamp = 0; + cs.bKeepKernelStamp = 0; cs.console_log_level = -1; cs.pszPath = NULL; cs.iFacilIntMsg = klogFacilIntMsg(); @@ -288,6 +289,8 @@ CODESTARTbeginCnfLoad /* init our settings */ pModConf->pszPath = NULL; pModConf->bPermitNonKernel = 0; + pModConf->bParseKernelStamp = 0; + pModConf->bKeepKernelStamp = 0; pModConf->console_log_level = -1; pModConf->iFacilIntMsg = klogFacilIntMsg(); loadModConf->configSetViaV2Method = 0; @@ -345,6 +348,8 @@ CODESTARTendCnfLoad if(!loadModConf->configSetViaV2Method) { /* persist module-specific settings from legacy config system */ loadModConf->bPermitNonKernel = cs.bPermitNonKernel; + loadModConf->bParseKernelStamp = cs.bParseKernelStamp; + loadModConf->bKeepKernelStamp = cs.bKeepKernelStamp; loadModConf->iFacilIntMsg = cs.iFacilIntMsg; loadModConf->console_log_level = cs.console_log_level; if((cs.pszPath == NULL) || (cs.pszPath[0] == '\0')) { @@ -421,6 +426,8 @@ ENDqueryEtryPt static rsRetVal resetConfigVariables(uchar __attribute__((unused)) *pp, void __attribute__((unused)) *pVal) { cs.bPermitNonKernel = 0; + cs.bParseKernelStamp = 0; + cs.bKeepKernelStamp = 0; if(cs.pszPath != NULL) { free(cs.pszPath); cs.pszPath = NULL; @@ -462,6 +469,10 @@ CODEmodInit_QueryRegCFSLineHdlr NULL, &cs.console_log_level, STD_LOADABLE_MODULE_ID, &bLegacyCnfModGlobalsPermitted)); CHKiRet(regCfSysLineHdlr2((uchar *)"kloginternalmsgfacility", 0, eCmdHdlrFacility, NULL, &cs.iFacilIntMsg, STD_LOADABLE_MODULE_ID, &bLegacyCnfModGlobalsPermitted)); + CHKiRet(regCfSysLineHdlr2((uchar *)"klogparsekerneltimestamp", 0, eCmdHdlrBinary, + NULL, &cs.bParseKernelStamp, STD_LOADABLE_MODULE_ID, &bLegacyCnfModGlobalsPermitted)); + CHKiRet(regCfSysLineHdlr2((uchar *)"klogkeepkerneltimestamp", 0, eCmdHdlrBinary, + NULL, &cs.bKeepKernelStamp, STD_LOADABLE_MODULE_ID, &bLegacyCnfModGlobalsPermitted)); CHKiRet(omsdRegCFSLineHdlr((uchar *)"resetconfigvariables", 1, eCmdHdlrCustomHandler, resetConfigVariables, NULL, STD_LOADABLE_MODULE_ID)); ENDmodInit diff --git a/plugins/imklog/imklog.h b/plugins/imklog/imklog.h index acfb50ab..fa517ccc 100644 --- a/plugins/imklog/imklog.h +++ b/plugins/imklog/imklog.h @@ -36,6 +36,8 @@ struct modConfData_s { uchar *pszPath; int console_log_level; sbool bPermitNonKernel; + sbool bParseKernelStamp; + sbool bKeepKernelStamp; sbool configSetViaV2Method; }; |