From d4c048af3e275e90683ae6c49f9c0b2aea9f2f03 Mon Sep 17 00:00:00 2001 From: "Steven A. Falco" Date: Fri, 13 Apr 2012 15:14:31 +0200 Subject: Add a system property, PROP_SYS_UPTIME, to place up-time markers into rsyslog output. Here is an example template, where this is used: $template CoincidentFileFormat,"[UP=%$uptime%sec] %TIMESTAMP% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n" and here is an example line of output using the above template: [UP=20sec] Apr 12 21:50:00 atom kernel: imklog 5.8.7, log source = /proc/kmsg started. --- runtime/msg.c | 20 ++++++++++++++++++++ runtime/rsyslog.h | 1 + 2 files changed, 21 insertions(+) diff --git a/runtime/msg.c b/runtime/msg.c index a52d0cce..e1b3b0da 100644 --- a/runtime/msg.c +++ b/runtime/msg.c @@ -36,6 +36,7 @@ #include #include #include +#include #include #include #if HAVE_MALLOC_H @@ -568,6 +569,8 @@ rsRetVal propNameToID(cstr_t *pCSPropName, propid_t *pPropID) *pPropID = PROP_CEE; } else if(!strcmp((char*) pName, "$bom")) { *pPropID = PROP_SYS_BOM; + } else if(!strcmp((char*) pName, "$uptime")) { + *pPropID = PROP_SYS_UPTIME; } else { *pPropID = PROP_INVALID; iRet = RS_RET_VAR_NOT_FOUND; @@ -2548,6 +2551,23 @@ uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe, pRes = (uchar*) "\xEF\xBB\xBF"; *pbMustBeFreed = 0; break; + case PROP_SYS_UPTIME: + { + struct sysinfo s_info; + + if((pRes = (uchar*) MALLOC(sizeof(uchar) * 32)) == NULL) { + RET_OUT_OF_MEMORY; + } + *pbMustBeFreed = 1; + + if(sysinfo(&s_info) < 0) { + *pPropLen = sizeof("**SYSCALL FAILED**") - 1; + return(UCHAR_CONSTANT("**SYSCALL FAILED**")); + } + + snprintf((char*) pRes, sizeof(uchar) * 32, "%ld", s_info.uptime); + } + break; default: /* there is no point in continuing, we may even otherwise render the * error message unreadable. rgerhards, 2007-07-10 diff --git a/runtime/rsyslog.h b/runtime/rsyslog.h index 0922c1bb..baadf322 100644 --- a/runtime/rsyslog.h +++ b/runtime/rsyslog.h @@ -140,6 +140,7 @@ typedef uintTiny propid_t; #define PROP_CEE 200 #define PROP_CEE_ALL_JSON 201 #define PROP_SYS_BOM 159 +#define PROP_SYS_UPTIME 160 /* The error codes below are orginally "borrowed" from -- cgit v1.2.3 From 838f34dd2bc201b2718e0f94f2e285b3ddb1cc17 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Fri, 13 Apr 2012 15:15:09 +0200 Subject: doc: added new $uptime property --- doc/property_replacer.html | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/doc/property_replacer.html b/doc/property_replacer.html index 6456296a..f4c4238e 100644 --- a/doc/property_replacer.html +++ b/doc/property_replacer.html @@ -160,6 +160,10 @@ than messages generated somewhere. in templates for RFC5424 support, when the character set is know to be Unicode. +$uptime +system-uptime in seconds (as reported by operating system). + + $now The current date stamp in the format YYYY-MM-DD -- cgit v1.2.3 From 68538a9013c59036d8825ef97a0a91552a9e7e99 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Wed, 18 Apr 2012 15:13:27 +0200 Subject: bugfix: assigned ruleset was lost when using disk queues This looked quite hard to diagnose for disk-assisted queues, as the pure memory part worked well, but ruleset info was lost for messages stored inside the disk queue. --- ChangeLog | 4 ++++ runtime/msg.c | 24 +++++++++++++++++++++--- runtime/ruleset.c | 10 +++++----- runtime/ruleset.h | 15 +++++++++++++++ 4 files changed, 45 insertions(+), 8 deletions(-) diff --git a/ChangeLog b/ChangeLog index 8a0d8474..bdf714bf 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,9 @@ --------------------------------------------------------------------------- Version 5.8.11 [V5-stable] 2012-04-?? +- bugfix: assigned ruleset was lost when using disk queues + This looked quite hard to diagnose for disk-assisted queues, as the + pure memory part worked well, but ruleset info was lost for messages + stored inside the disk queue. - bugfix: hostname was not requeried on HUP Thanks to Per Jessen for reporting this bug and Marius Tomaschewski for his help in testing the fix. diff --git a/runtime/msg.c b/runtime/msg.c index 31863b2d..5eab751d 100644 --- a/runtime/msg.c +++ b/runtime/msg.c @@ -1057,6 +1057,12 @@ static rsRetVal MsgSerialize(msg_t *pThis, strm_t *pStrm) objSerializePTR(pStrm, pCSAPPNAME, CSTR); objSerializePTR(pStrm, pCSPROCID, CSTR); objSerializePTR(pStrm, pCSMSGID, CSTR); + + if(pThis->pRuleset != NULL) { + rulesetGetName(pThis->pRuleset)); + CHKiRet(obj.SerializeProp(pStrm, UCHAR_CONSTANT("pszRuleset"), PROPTYPE_PSZ, + rulesetGetName(pThis->pRuleset))); + } /* offset must be serialized after pszRawMsg, because we need that to obtain the correct * MSG size. @@ -1663,6 +1669,16 @@ void MsgSetRuleset(msg_t *pMsg, ruleset_t *pRuleset) } +/* rgerhards 2012-04-18: set associated ruleset (by ruleset name) + * If ruleset cannot be found, no update is done. + */ +static void +MsgSetRulesetByName(msg_t *pMsg, cstr_t *rulesetName) +{ + rulesetGetRuleset(&(pMsg->pRuleset), rsCStrGetSzStrNoNULL(rulesetName)); +} + + /* set TAG in msg object * (rewritten 2009-06-18 rgerhards) */ @@ -1671,8 +1687,6 @@ void MsgSetTAG(msg_t *pMsg, uchar* pszBuf, size_t lenBuf) uchar *pBuf; assert(pMsg != NULL); -dbgprintf("MsgSetTAG in: len %d, pszBuf: %s\n", lenBuf, pszBuf); - freeTAG(pMsg); pMsg->iLenTAG = lenBuf; @@ -1692,7 +1706,6 @@ dbgprintf("MsgSetTAG in: len %d, pszBuf: %s\n", lenBuf, pszBuf); memcpy(pBuf, pszBuf, pMsg->iLenTAG); pBuf[pMsg->iLenTAG] = '\0'; /* this also works with truncation! */ -dbgprintf("MsgSetTAG exit: pMsg->iLenTAG %d, pMsg->TAG.szBuf: %s\n", pMsg->iLenTAG, pMsg->TAG.szBuf); } @@ -3200,8 +3213,13 @@ rsRetVal MsgSetProperty(msg_t *pThis, var_t *pProp) memcpy(&pThis->tRcvdAt, &pProp->val.vSyslogTime, sizeof(struct syslogTime)); } else if(isProp("tTIMESTAMP")) { memcpy(&pThis->tTIMESTAMP, &pProp->val.vSyslogTime, sizeof(struct syslogTime)); + } else if(isProp("pszRuleset")) { + MsgSetRulesetByName(pThis, pProp->val.pStr); } else if(isProp("pszMSG")) { dbgprintf("no longer supported property pszMSG silently ignored\n"); + } else { + dbgprintf("unknown supported property '%s' silently ignored\n", + rsCStrGetSzStrNoNULL(pProp->pcsName)); } finalize_it: diff --git a/runtime/ruleset.c b/runtime/ruleset.c index 5ee2a55a..8e241c8a 100644 --- a/runtime/ruleset.c +++ b/runtime/ruleset.c @@ -315,8 +315,8 @@ GetRulesetQueue(ruleset_t *pThis) /* Find the ruleset with the given name and return a pointer to its object. */ -static rsRetVal -GetRuleset(ruleset_t **ppRuleset, uchar *pszName) +rsRetVal +rulesetGetRuleset(ruleset_t **ppRuleset, uchar *pszName) { DEFiRet; assert(ppRuleset != NULL); @@ -338,7 +338,7 @@ SetDefaultRuleset(uchar *pszName) DEFiRet; assert(pszName != NULL); - CHKiRet(GetRuleset(&pRuleset, pszName)); + CHKiRet(rulesetGetRuleset(&pRuleset, pszName)); pDfltRuleset = pRuleset; dbgprintf("default rule set changed to %p: '%s'\n", pRuleset, pszName); @@ -356,7 +356,7 @@ SetCurrRuleset(uchar *pszName) DEFiRet; assert(pszName != NULL); - CHKiRet(GetRuleset(&pRuleset, pszName)); + CHKiRet(rulesetGetRuleset(&pRuleset, pszName)); pCurrRuleset = pRuleset; dbgprintf("current rule set changed to %p: '%s'\n", pRuleset, pszName); @@ -591,7 +591,7 @@ CODESTARTobjQueryInterface(ruleset) pIf->SetName = setName; pIf->DebugPrintAll = debugPrintAll; pIf->GetCurrent = GetCurrent; - pIf->GetRuleset = GetRuleset; + pIf->GetRuleset = rulesetGetRuleset; pIf->SetDefaultRuleset = SetDefaultRuleset; pIf->SetCurrRuleset = SetCurrRuleset; pIf->GetRulesetQueue = GetRulesetQueue; diff --git a/runtime/ruleset.h b/runtime/ruleset.h index b055a71d..52e633eb 100644 --- a/runtime/ruleset.h +++ b/runtime/ruleset.h @@ -54,6 +54,7 @@ BEGINinterface(ruleset) /* name must also be changed in ENDinterface macro! */ qqueue_t* (*GetRulesetQueue)(ruleset_t*); /* v3, 2009-11-04 */ parserList_t* (*GetParserList)(msg_t *); + /* v4 */ ENDinterface(ruleset) #define rulesetCURR_IF_VERSION 4 /* increment whenever you change the interface structure! */ @@ -61,4 +62,18 @@ ENDinterface(ruleset) /* prototypes */ PROTOTYPEObj(ruleset); + +/* Get name associated to ruleset. This function cannot fail (except, + * of course, if previously something went really wrong). Returned + * pointer is read-only. + * rgerhards, 2012-04-18 + */ +static inline uchar* +rulesetGetName(ruleset_t *pRuleset) +{ + return pRuleset->pszName; +} + + +rsRetVal rulesetGetRuleset(ruleset_t **ppRuleset, uchar *pszName); #endif /* #ifndef INCLUDED_RULESET_H */ -- cgit v1.2.3 From 7cb5f0cb8c98408bc46f2c07d8480b70d816de7a Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Wed, 18 Apr 2012 16:21:15 +0200 Subject: fixed compile bug actually a regression from last bugfix - I just wonder why the other machine did not complain :-S --- runtime/msg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/runtime/msg.c b/runtime/msg.c index 5eab751d..7b94228c 100644 --- a/runtime/msg.c +++ b/runtime/msg.c @@ -1059,7 +1059,7 @@ static rsRetVal MsgSerialize(msg_t *pThis, strm_t *pStrm) objSerializePTR(pStrm, pCSMSGID, CSTR); if(pThis->pRuleset != NULL) { - rulesetGetName(pThis->pRuleset)); + rulesetGetName(pThis->pRuleset); CHKiRet(obj.SerializeProp(pStrm, UCHAR_CONSTANT("pszRuleset"), PROPTYPE_PSZ, rulesetGetName(pThis->pRuleset))); } -- cgit v1.2.3