From d15985bc4065b4c65f491e6a829379687b2f52f1 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Wed, 9 Apr 2008 12:36:09 +0200 Subject: pulled FreeBSD's klog functionality as a base --- plugins/imklog/bsd.c | 151 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 151 insertions(+) create mode 100644 plugins/imklog/bsd.c (limited to 'plugins/imklog/bsd.c') diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c new file mode 100644 index 00000000..25391980 --- /dev/null +++ b/plugins/imklog/bsd.c @@ -0,0 +1,151 @@ +/* klog for BSD, based on the FreeBSD syslogd implementation. + * + * This contains OS-specific functionality to read the BSD + * kernel log. For a general overview, see head comment in + * imklog.c. + * + * Copyright (C) 2008 by Rainer Gerhards for the modifications of + * the original FreeBSD sources. + * + * I would like to express my gratitude to those folks which + * layed an important foundation for rsyslog to build on. + * + * This file is part of rsyslog. + * + * Rsyslog is free software: you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * Rsyslog is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Rsyslog. If not, see . + * + * A copy of the GPL can be found in the file "COPYING" in this distribution. + * + * This file is based on earlier work included in the FreeBSD sources. We + * integrated it into the rsyslog project. The copyright below applies, and + * I also reproduce the original license under which we aquired the code: + * + * Copyright (c) 1983, 1988, 1993, 1994 + * The Regents of the University of California. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 4. Neither the name of the University nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * If you would like to use the code under the BSD license, you should + * aquire your own copy of BSD's syslogd, from which we have taken it. The + * code in this file is modified and may only be used under the terms of + * the GPLv3+ as specified above. + */ + + +/* open the kernel log -- rger */ +static void openKLog(void) +{ + if ((fklog = open(_PATH_KLOG, O_RDONLY, 0)) >= 0) + if (fcntl(fklog, F_SETFL, O_NONBLOCK) < 0) + fklog = -1; + if (fklog < 0) + dprintf("can't open %s (%d)\n", _PATH_KLOG, errno); +} + + +static int fklog = -1; /* /dev/klog */ +/* + * Read /dev/klog while data are available, split into lines. + */ +static void +readklog(void) +{ + char *p, *q, line[MAXLINE + 1]; + int len, i; + + len = 0; + for (;;) { + i = read(fklog, line + len, MAXLINE - 1 - len); + if (i > 0) { + line[i + len] = '\0'; + } else { + if (i < 0 && errno != EINTR && errno != EAGAIN) { + logerror("klog"); + fklog = -1; + } + break; + } + + for (p = line; (q = strchr(p, '\n')) != NULL; p = q + 1) { + *q = '\0'; + printsys(p); + } + len = strlen(p); + if (len >= MAXLINE - 1) { + printsys(p); + len = 0; + } + if (len > 0) + memmove(line, p, len + 1); + } + if (len > 0) + printsys(line); +} + +/* + * Take a raw input line from /dev/klog, format similar to syslog(). + */ +static void +printsys(char *msg) +{ + char *p, *q; + long n; + int flags, isprintf, pri; + + flags = ISKERNEL | SYNC_FILE | ADDDATE; /* fsync after write */ + p = msg; + pri = DEFSPRI; + isprintf = 1; + if (*p == '<') { + errno = 0; + n = strtol(p + 1, &q, 10); + if (*q == '>' && n >= 0 && n < INT_MAX && errno == 0) { + p = q + 1; + pri = n; + isprintf = 0; + } + } + /* + * Kernel printf's and LOG_CONSOLE messages have been displayed + * on the console already. + */ + if (isprintf || (pri & LOG_FACMASK) == LOG_CONSOLE) + flags |= IGN_CONS; + if (pri &~ (LOG_FACMASK|LOG_PRIMASK)) + pri = DEFSPRI; + logmsg(pri, p, LocalHostName, flags); +} + -- cgit v1.2.3 From 0b447f310ac057ba59f0238f5bd663c993a823c2 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Wed, 9 Apr 2008 09:06:40 +0200 Subject: implemented klog driver for BSD --- plugins/imklog/bsd.c | 107 ++++++++++++++++++++++++++++++--------------------- 1 file changed, 63 insertions(+), 44 deletions(-) (limited to 'plugins/imklog/bsd.c') diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c index 25391980..c1595669 100644 --- a/plugins/imklog/bsd.c +++ b/plugins/imklog/bsd.c @@ -64,21 +64,47 @@ * the GPLv3+ as specified above. */ +#ifdef HAVE_CONFIG_H +# include "config.h" +#endif +#include +#include +#include +#include -/* open the kernel log -- rger */ -static void openKLog(void) +#include "rsyslog.h" +#include "imklog.h" + +/* globals */ +static int fklog = -1; /* /dev/klog */ + +#ifndef _PATH_KLOG +# define _PATH_KLOG "/dev/klog" +#endif + +/* open the kernel log - will be called inside the willRun() imklog + * entry point. -- rgerhards, 20080-04-09 + */ +rsRetVal +klogWillRun(void) { - if ((fklog = open(_PATH_KLOG, O_RDONLY, 0)) >= 0) - if (fcntl(fklog, F_SETFL, O_NONBLOCK) < 0) - fklog = -1; - if (fklog < 0) - dprintf("can't open %s (%d)\n", _PATH_KLOG, errno); + DEFiRet; + + fklog = open(_PATH_KLOG, O_RDONLY, 0); + if (fklog < 0) { + dbgprintf("can't open %s (%d)\n", _PATH_KLOG, errno); + iRet = RS_RET_ERR; // TODO: better error code + } + + RETiRet; } -static int fklog = -1; /* /dev/klog */ -/* - * Read /dev/klog while data are available, split into lines. +/* Read /dev/klog while data are available, split into lines. + * Contrary to standard BSD syslogd, we do a blocking read. We can + * afford this as imklog is running on its own threads. So if we have + * a single file, it really doesn't matter if we wait inside a 1-file + * select or the read() directly. */ static void readklog(void) @@ -88,12 +114,15 @@ readklog(void) len = 0; for (;;) { + dbgprintf("----------imklog waiting for kernel log line\n"); i = read(fklog, line + len, MAXLINE - 1 - len); if (i > 0) { line[i + len] = '\0'; } else { if (i < 0 && errno != EINTR && errno != EAGAIN) { - logerror("klog"); + Syslog(LOG_ERR, + "imklog error %d reading kernel log - shutting down imklog", + errno); fklog = -1; } break; @@ -101,51 +130,41 @@ readklog(void) for (p = line; (q = strchr(p, '\n')) != NULL; p = q + 1) { *q = '\0'; - printsys(p); + Syslog(LOG_INFO, "%s", p); } len = strlen(p); if (len >= MAXLINE - 1) { - printsys(p); + Syslog(LOG_INFO, "%s", p); len = 0; } if (len > 0) memmove(line, p, len + 1); } if (len > 0) - printsys(line); + Syslog(LOG_INFO, "%s", line); } -/* - * Take a raw input line from /dev/klog, format similar to syslog(). + +/* to be called in the module's AfterRun entry point + * rgerhards, 2008-04-09 */ -static void -printsys(char *msg) +rsRetVal klogAfterRun(void) { - char *p, *q; - long n; - int flags, isprintf, pri; - - flags = ISKERNEL | SYNC_FILE | ADDDATE; /* fsync after write */ - p = msg; - pri = DEFSPRI; - isprintf = 1; - if (*p == '<') { - errno = 0; - n = strtol(p + 1, &q, 10); - if (*q == '>' && n >= 0 && n < INT_MAX && errno == 0) { - p = q + 1; - pri = n; - isprintf = 0; - } - } - /* - * Kernel printf's and LOG_CONSOLE messages have been displayed - * on the console already. - */ - if (isprintf || (pri & LOG_FACMASK) == LOG_CONSOLE) - flags |= IGN_CONS; - if (pri &~ (LOG_FACMASK|LOG_PRIMASK)) - pri = DEFSPRI; - logmsg(pri, p, LocalHostName, flags); + DEFiRet; + if(fklog != -1) + close(fklog); + RETiRet; } + + +/* to be called in the module's WillRun entry point, this is the main + * "message pull" mechanism. + * rgerhards, 2008-04-09 + */ +rsRetVal klogLogKMsg(void) +{ + DEFiRet; + readklog(); + RETiRet; +} -- cgit v1.2.3 From cac432e7cb65ea4694a183823267cbcd67e97ad6 Mon Sep 17 00:00:00 2001 From: Michael Biebl Date: Thu, 10 Apr 2008 09:52:37 +0200 Subject: Add missing include bsd.c uses strchr, strlen and memmove, so include string.h Signed-off-by: Rainer Gerhards --- plugins/imklog/bsd.c | 1 + 1 file changed, 1 insertion(+) (limited to 'plugins/imklog/bsd.c') diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c index c1595669..9989d5fb 100644 --- a/plugins/imklog/bsd.c +++ b/plugins/imklog/bsd.c @@ -71,6 +71,7 @@ #include #include #include +#include #include "rsyslog.h" #include "imklog.h" -- cgit v1.2.3 From 3669057997e7665735626fd29a40bd10e160c88f Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Mon, 14 Apr 2008 12:10:00 +0200 Subject: provided ability to discard non-kernel messages present in the kernel msg buffer This obviously happens on BSD (<118> markers seen). We now have the ability to allow or prevent it, with the default being not permitted. Should not at all affect other drivers, but it is implemented on a common code basis, not on the driver layer. --- plugins/imklog/bsd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'plugins/imklog/bsd.c') diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c index 9989d5fb..c12103f3 100644 --- a/plugins/imklog/bsd.c +++ b/plugins/imklog/bsd.c @@ -84,7 +84,7 @@ static int fklog = -1; /* /dev/klog */ #endif /* open the kernel log - will be called inside the willRun() imklog - * entry point. -- rgerhards, 20080-04-09 + * entry point. -- rgerhards, 2008-04-09 */ rsRetVal klogWillRun(void) -- cgit v1.2.3 From f8dff16a4a1d606f41d738f7381649282c74ca25 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Mon, 14 Apr 2008 14:44:32 +0200 Subject: cleanup of imklog + addtl. config directives - implemented $KLogInternalMsgFacility config directive - implemented $KLogPermitNonKernelFacility config directive - modified internal interfaces --- plugins/imklog/bsd.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) (limited to 'plugins/imklog/bsd.c') diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c index c12103f3..c5b79541 100644 --- a/plugins/imklog/bsd.c +++ b/plugins/imklog/bsd.c @@ -121,7 +121,7 @@ readklog(void) line[i + len] = '\0'; } else { if (i < 0 && errno != EINTR && errno != EAGAIN) { - Syslog(LOG_ERR, + imklogLogIntMsg(LOG_ERR, "imklog error %d reading kernel log - shutting down imklog", errno); fklog = -1; @@ -131,18 +131,18 @@ readklog(void) for (p = line; (q = strchr(p, '\n')) != NULL; p = q + 1) { *q = '\0'; - Syslog(LOG_INFO, "%s", p); + Syslog(LOG_INFO, p); } len = strlen(p); if (len >= MAXLINE - 1) { - Syslog(LOG_INFO, "%s", p); + Syslog(LOG_INFO, p); len = 0; } if (len > 0) memmove(line, p, len + 1); } if (len > 0) - Syslog(LOG_INFO, "%s", line); + Syslog(LOG_INFO, line); } @@ -169,3 +169,13 @@ rsRetVal klogLogKMsg(void) readklog(); RETiRet; } + + +/* provide the (system-specific) default facility for internal messages + * rgerhards, 2008-04-14 + */ +int +klogFacilIntMsg(void) +{ + return LOG_SYSLOG; +} -- cgit v1.2.3 From 318be337dd7f3ce1c1a308712e308f5b56ce9027 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Mon, 14 Apr 2008 13:35:19 +0200 Subject: fix compiler warning on char/uchar --- plugins/imklog/bsd.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'plugins/imklog/bsd.c') diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c index c5b79541..39b644c0 100644 --- a/plugins/imklog/bsd.c +++ b/plugins/imklog/bsd.c @@ -131,18 +131,18 @@ readklog(void) for (p = line; (q = strchr(p, '\n')) != NULL; p = q + 1) { *q = '\0'; - Syslog(LOG_INFO, p); + Syslog(LOG_INFO, (uchar*) p); } len = strlen(p); if (len >= MAXLINE - 1) { - Syslog(LOG_INFO, p); + Syslog(LOG_INFO, (uchar*)p); len = 0; } if (len > 0) memmove(line, p, len + 1); } if (len > 0) - Syslog(LOG_INFO, line); + Syslog(LOG_INFO, (uchar*)line); } -- cgit v1.2.3 From 1a9ac0ced72dd163228438af4f31f233fab20529 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Tue, 2 Sep 2008 11:38:31 +0200 Subject: removed compile time fixed message size limit (was 2K) The limit can now be set via $MaxMessageSize global config directive (finally gotten rid of MAXLINE ;)) --- plugins/imklog/bsd.c | 37 +++++++++++++++++++++++++++++-------- 1 file changed, 29 insertions(+), 8 deletions(-) (limited to 'plugins/imklog/bsd.c') diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c index 39b644c0..0a581081 100644 --- a/plugins/imklog/bsd.c +++ b/plugins/imklog/bsd.c @@ -110,15 +110,32 @@ klogWillRun(void) static void readklog(void) { - char *p, *q, line[MAXLINE + 1]; + char *p, *q; int len, i; + int iMaxLine; + uchar bufRcv[4096+1]; + uchar *pRcv = NULL; /* receive buffer */ + + iMaxLine = glbl.GetMaxLine(); + + /* we optimize performance: if iMaxLine is below 4K (which it is in almost all + * cases, we use a fixed buffer on the stack. Only if it is higher, heap memory + * is used. We could use alloca() to achive a similar aspect, but there are so + * many issues with alloca() that I do not want to take that route. + * rgerhards, 2008-09-02 + */ + if((size_t) iMaxLine < sizeof(bufRcv) - 1) { + pRcv = bufRcv; + } else { + CHKmalloc(pRcv = (uchar*) malloc(sizeof(uchar) * (iMaxLine + 1))); + } len = 0; for (;;) { - dbgprintf("----------imklog waiting for kernel log line\n"); - i = read(fklog, line + len, MAXLINE - 1 - len); + dbgprintf("----------imklog(BSD) waiting for kernel log line\n"); + i = read(fklog, pRcv + len, iMaxLine - len); if (i > 0) { - line[i + len] = '\0'; + pRcv[i + len] = '\0'; } else { if (i < 0 && errno != EINTR && errno != EAGAIN) { imklogLogIntMsg(LOG_ERR, @@ -129,20 +146,24 @@ readklog(void) break; } - for (p = line; (q = strchr(p, '\n')) != NULL; p = q + 1) { + for (p = pRcv; (q = strchr(p, '\n')) != NULL; p = q + 1) { *q = '\0'; Syslog(LOG_INFO, (uchar*) p); } len = strlen(p); - if (len >= MAXLINE - 1) { + if (len >= iMaxLine - 1) { Syslog(LOG_INFO, (uchar*)p); len = 0; } if (len > 0) - memmove(line, p, len + 1); + memmove(pRcv, p, len + 1); } if (len > 0) - Syslog(LOG_INFO, (uchar*)line); + Syslog(LOG_INFO, pRcv); + +finalize_it: + if(pRcv != NULL && (size_t) iMaxLine >= sizeof(bufRcv) - 1) + free(pRcv); } -- cgit v1.2.3 From 2275a915e02ca4fd1cd1b3c450b0089ae98bc907 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Mon, 24 Nov 2008 17:48:12 +0100 Subject: bugfix: imklog did not compile on freeBSD --- plugins/imklog/bsd.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'plugins/imklog/bsd.c') diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c index 0a581081..090c4e9b 100644 --- a/plugins/imklog/bsd.c +++ b/plugins/imklog/bsd.c @@ -116,7 +116,7 @@ readklog(void) uchar bufRcv[4096+1]; uchar *pRcv = NULL; /* receive buffer */ - iMaxLine = glbl.GetMaxLine(); + iMaxLine = klog_getMaxLine(); /* we optimize performance: if iMaxLine is below 4K (which it is in almost all * cases, we use a fixed buffer on the stack. Only if it is higher, heap memory @@ -127,7 +127,8 @@ readklog(void) if((size_t) iMaxLine < sizeof(bufRcv) - 1) { pRcv = bufRcv; } else { - CHKmalloc(pRcv = (uchar*) malloc(sizeof(uchar) * (iMaxLine + 1))); + if((pRcv = (uchar*) malloc(sizeof(uchar) * (iMaxLine + 1))) == NULL) + iMaxLine = sizeof(bufRcv) - 1; /* better this than noting */ } len = 0; @@ -161,7 +162,6 @@ readklog(void) if (len > 0) Syslog(LOG_INFO, pRcv); -finalize_it: if(pRcv != NULL && (size_t) iMaxLine >= sizeof(bufRcv) - 1) free(pRcv); } -- cgit v1.2.3 From ba4806a70439dd24dc98bd707893b1319dd5e3ef Mon Sep 17 00:00:00 2001 From: Michael Terry Date: Thu, 18 Jun 2009 13:51:17 -0400 Subject: add support for KLogPath --- plugins/imklog/bsd.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'plugins/imklog/bsd.c') diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c index 090c4e9b..6d7b6c98 100644 --- a/plugins/imklog/bsd.c +++ b/plugins/imklog/bsd.c @@ -83,6 +83,11 @@ static int fklog = -1; /* /dev/klog */ # define _PATH_KLOG "/dev/klog" #endif +static uchar *GetPath(void) +{ + return pszPath ? pszPath : _PATH_KLOG; +} + /* open the kernel log - will be called inside the willRun() imklog * entry point. -- rgerhards, 2008-04-09 */ @@ -91,9 +96,9 @@ klogWillRun(void) { DEFiRet; - fklog = open(_PATH_KLOG, O_RDONLY, 0); + fklog = open(GetPath(), O_RDONLY, 0); if (fklog < 0) { - dbgprintf("can't open %s (%d)\n", _PATH_KLOG, errno); + dbgprintf("can't open %s (%d)\n", GetPath(), errno); iRet = RS_RET_ERR; // TODO: better error code } -- cgit v1.2.3 From e04e1b50025f5fa9c26abd946190dce8f797d08f Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Thu, 22 Oct 2009 11:33:38 +0200 Subject: enhanced test environment (including testbench) support for enhancing probability of memory addressing failure by using non-NULL default value for malloced memory (optional, only if requested by configure option). This helps to track down some otherwise undetected issues within the testbench and is expected to be very useful in the future. --- plugins/imklog/bsd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'plugins/imklog/bsd.c') diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c index 6d7b6c98..b7899353 100644 --- a/plugins/imklog/bsd.c +++ b/plugins/imklog/bsd.c @@ -75,6 +75,7 @@ #include "rsyslog.h" #include "imklog.h" +#include "debug.h" /* globals */ static int fklog = -1; /* /dev/klog */ @@ -132,7 +133,7 @@ readklog(void) if((size_t) iMaxLine < sizeof(bufRcv) - 1) { pRcv = bufRcv; } else { - if((pRcv = (uchar*) malloc(sizeof(uchar) * (iMaxLine + 1))) == NULL) + if((pRcv = (uchar*) MALLOC(sizeof(uchar) * (iMaxLine + 1))) == NULL) iMaxLine = sizeof(bufRcv) - 1; /* better this than noting */ } -- cgit v1.2.3 From 0a24b3afc093e16038da170458e2ecb68b363bdd Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Tue, 19 Oct 2010 12:39:48 +0200 Subject: fixing some compile problems on FreeBSD --- plugins/imklog/bsd.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'plugins/imklog/bsd.c') diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c index 6d7b6c98..cecf21c4 100644 --- a/plugins/imklog/bsd.c +++ b/plugins/imklog/bsd.c @@ -85,7 +85,7 @@ static int fklog = -1; /* /dev/klog */ static uchar *GetPath(void) { - return pszPath ? pszPath : _PATH_KLOG; + return pszPath ? pszPath : (uchar*) _PATH_KLOG; } /* open the kernel log - will be called inside the willRun() imklog @@ -96,7 +96,7 @@ klogWillRun(void) { DEFiRet; - fklog = open(GetPath(), O_RDONLY, 0); + fklog = open((char*)GetPath(), O_RDONLY, 0); if (fklog < 0) { dbgprintf("can't open %s (%d)\n", GetPath(), errno); iRet = RS_RET_ERR; // TODO: better error code @@ -152,7 +152,7 @@ readklog(void) break; } - for (p = pRcv; (q = strchr(p, '\n')) != NULL; p = q + 1) { + for (p = (char*)pRcv; (q = strchr(p, '\n')) != NULL; p = q + 1) { *q = '\0'; Syslog(LOG_INFO, (uchar*) p); } -- cgit v1.2.3 From 47729f3b9362f7956c936088ac4bb703633cb33b Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Fri, 24 Jun 2011 17:07:11 +0200 Subject: added support for obtaining timestamp for kernel message from message If the kernel time-stamps messages, time is now take from that timestamp instead of the system time when the message was read. This provides much better accuracy. Thanks to Lennart Poettering for suggesting this feature and his help during implementation. --- plugins/imklog/bsd.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'plugins/imklog/bsd.c') diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c index 0a4c7cd4..930bbd11 100644 --- a/plugins/imklog/bsd.c +++ b/plugins/imklog/bsd.c @@ -155,18 +155,18 @@ readklog(void) for (p = (char*)pRcv; (q = strchr(p, '\n')) != NULL; p = q + 1) { *q = '\0'; - Syslog(LOG_INFO, (uchar*) p); + Syslog(LOG_INFO, (uchar*) p, NULL); } len = strlen(p); if (len >= iMaxLine - 1) { - Syslog(LOG_INFO, (uchar*)p); + Syslog(LOG_INFO, (uchar*)p, NULL); len = 0; } if (len > 0) memmove(pRcv, p, len + 1); } if (len > 0) - Syslog(LOG_INFO, pRcv); + Syslog(LOG_INFO, pRcv, NULL); if(pRcv != NULL && (size_t) iMaxLine >= sizeof(bufRcv) - 1) free(pRcv); -- cgit v1.2.3 From 01405d78f4a8c090d5abe37380d60cff252efdc6 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Mon, 23 Jan 2012 18:05:07 +0100 Subject: refactored imklog linux driver, now combined with BSD driver The Linux driver no longer supports outdated kernel symbol resolution, which was disabled by default for very long. Also overall cleanup, resulting in much smaller code. Linux and BSD are now covered by a single small driver. --- plugins/imklog/bsd.c | 244 ++++++++++++++++++++++++++++++++++----------------- 1 file changed, 165 insertions(+), 79 deletions(-) (limited to 'plugins/imklog/bsd.c') diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c index 930bbd11..eaf8e5ca 100644 --- a/plugins/imklog/bsd.c +++ b/plugins/imklog/bsd.c @@ -1,69 +1,30 @@ -/* klog for BSD, based on the FreeBSD syslogd implementation. +/* combined imklog driver for BSD and Linux * * This contains OS-specific functionality to read the BSD - * kernel log. For a general overview, see head comment in - * imklog.c. + * or Linux kernel log. For a general overview, see head comment in + * imklog.c. This started out as the BSD-specific drivers, but it + * turned out that on modern Linux the implementation details + * are very small, and so we use a single driver for both OS's with + * a little help of conditional compilation. * - * Copyright (C) 2008 by Rainer Gerhards for the modifications of - * the original FreeBSD sources. - * - * I would like to express my gratitude to those folks which - * layed an important foundation for rsyslog to build on. + * Copyright 2008-2012 Adiscon GmbH * * This file is part of rsyslog. * - * Rsyslog is free software: you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * Rsyslog is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with Rsyslog. If not, see . - * - * A copy of the GPL can be found in the file "COPYING" in this distribution. - * - * This file is based on earlier work included in the FreeBSD sources. We - * integrated it into the rsyslog project. The copyright below applies, and - * I also reproduce the original license under which we aquired the code: - * - * Copyright (c) 1983, 1988, 1993, 1994 - * The Regents of the University of California. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 4. Neither the name of the University nor the names of its contributors - * may be used to endorse or promote products derived from this software - * without specific prior written permission. - * - * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND - * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE - * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL - * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS - * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT - * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY - * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF - * SUCH DAMAGE. - * - * If you would like to use the code under the BSD license, you should - * aquire your own copy of BSD's syslogd, from which we have taken it. The - * code in this file is modified and may only be used under the terms of - * the GPLv3+ as specified above. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * -or- + * see COPYING.ASL20 in the source distribution + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. */ - #ifdef HAVE_CONFIG_H # include "config.h" #endif @@ -72,18 +33,124 @@ #include #include #include +#include +#ifdef OS_LINUX +# include +#endif #include "rsyslog.h" -#include "imklog.h" +#include "srUtils.h" #include "debug.h" +#include "imklog.h" /* globals */ -static int fklog = -1; /* /dev/klog */ +static int fklog = -1; /* kernel log fd */ #ifndef _PATH_KLOG -# define _PATH_KLOG "/dev/klog" +# ifdef OS_LINUX +# define _PATH_KLOG "/proc/kmsg" +# else +# define _PATH_KLOG "/dev/klog" +# endif #endif + +#ifdef OS_LINUX +/* submit a message to imklog Syslog() API. In this function, we check if + * a kernel timestamp is present and, if so, extract and strip it. + * Note: this is an extra processing step. We should revisit the whole + * idea in v6 and remove all that old stuff that we do not longer need + * (like symbol resolution). <-- TODO + * Note that this is heavily Linux specific and thus is not compiled or + * used for BSD. + * Special thanks to Lennart Poettering for suggesting on how to convert + * the kernel timestamp to a realtime timestamp. This method depends on + * the fact the the kernel timestamp is written using the monotonic clock. + * Shall that change (very unlikely), this code must be changed as well. Note + * that due to the way we generate the delta, we are unable to write the + * absolutely correct timestamp (system call overhead of the clock calls + * prevents us from doing so). However, the difference is very minor. + * rgerhards, 2011-06-24 + */ +static void +submitSyslog(int pri, uchar *buf) +{ + long secs; + long nsecs; + long secOffs; + long nsecOffs; + unsigned i; + unsigned bufsize; + struct timespec monotonic, realtime; + struct timeval tv; + struct timeval *tp = NULL; + + if(buf[3] != '[') + goto done; + DBGPRINTF("imklog: kernel timestamp detected, extracting it\n"); + + /* we now try to parse the timestamp. iff it parses, we assume + * it is a timestamp. Otherwise we know for sure it is no ts ;) + */ + i = 4; /* first digit after '[' */ + secs = 0; + while(buf[i] && isdigit(buf[i])) { + secs = secs * 10 + buf[i] - '0'; + ++i; + } + if(buf[i] != '.') { + DBGPRINTF("no dot --> no kernel timestamp\n"); + goto done; /* no TS! */ + } + + ++i; /* skip dot */ + nsecs = 0; + while(buf[i] && isdigit(buf[i])) { + nsecs = nsecs * 10 + buf[i] - '0'; + ++i; + } + if(buf[i] != ']') { + DBGPRINTF("no trailing ']' --> no kernel timestamp\n"); + goto done; /* no TS! */ + } + ++i; /* skip ']' */ + + /* we have a timestamp */ + DBGPRINTF("kernel timestamp is %ld %ld\n", secs, nsecs); + bufsize= strlen((char*)buf); + memcpy(buf+3, buf+i, bufsize - i + 1); + + clock_gettime(CLOCK_MONOTONIC, &monotonic); + clock_gettime(CLOCK_REALTIME, &realtime); + secOffs = realtime.tv_sec - monotonic.tv_sec; + nsecOffs = realtime.tv_nsec - monotonic.tv_nsec; + if(nsecOffs < 0) { + secOffs--; + nsecOffs += 1000000000l; + } + + nsecs +=nsecOffs; + if(nsecs > 999999999l) { + secs++; + nsecs -= 1000000000l; + } + secs += secOffs; + tv.tv_sec = secs; + tv.tv_usec = nsecs / 1000; + tp = &tv; + +done: + Syslog(pri, buf, tp); +} +#else /* now comes the BSD "code" (just a shim) */ +static void +submitSyslog(int pri, uchar *buf) +{ + Syslog(pri, buf, NULL); +} +#endif /* #ifdef LINUX */ + + static uchar *GetPath(void) { return pszPath ? pszPath : (uchar*) _PATH_KLOG; @@ -95,23 +162,36 @@ static uchar *GetPath(void) rsRetVal klogWillRun(void) { + char errmsg[2048]; + int r; DEFiRet; fklog = open((char*)GetPath(), O_RDONLY, 0); if (fklog < 0) { - dbgprintf("can't open %s (%d)\n", GetPath(), errno); - iRet = RS_RET_ERR; // TODO: better error code + imklogLogIntMsg(RS_RET_ERR_OPEN_KLOG, "imklog: cannot open kernel log(%s): %s.", + GetPath(), rs_strerror_r(errno, errmsg, sizeof(errmsg))); + ABORT_FINALIZE(RS_RET_ERR_OPEN_KLOG); + } + +# ifdef OS_LINUX + /* Set level of kernel console messaging.. */ + if(console_log_level != -1) { + r = klogctl(8, NULL, console_log_level); + if(r != 0) { + imklogLogIntMsg(LOG_WARNING, "imklog: cannot set console log level: %s", + rs_strerror_r(errno, errmsg, sizeof(errmsg))); + /* make sure we do not try to re-set! */ + console_log_level = -1; + } } +# endif /* #ifdef OS_LINUX */ +finalize_it: RETiRet; } -/* Read /dev/klog while data are available, split into lines. - * Contrary to standard BSD syslogd, we do a blocking read. We can - * afford this as imklog is running on its own threads. So if we have - * a single file, it really doesn't matter if we wait inside a 1-file - * select or the read() directly. +/* Read kernel log while data are available, split into lines. */ static void readklog(void) @@ -119,13 +199,14 @@ readklog(void) char *p, *q; int len, i; int iMaxLine; - uchar bufRcv[4096+1]; + uchar bufRcv[128*1024+1]; + char errmsg[2048]; uchar *pRcv = NULL; /* receive buffer */ iMaxLine = klog_getMaxLine(); - /* we optimize performance: if iMaxLine is below 4K (which it is in almost all - * cases, we use a fixed buffer on the stack. Only if it is higher, heap memory + /* we optimize performance: if iMaxLine is below our fixed size buffer (which + * usually is sufficiently large), we use this buffer. if it is higher, heap memory * is used. We could use alloca() to achive a similar aspect, but there are so * many issues with alloca() that I do not want to take that route. * rgerhards, 2008-09-02 @@ -139,15 +220,15 @@ readklog(void) len = 0; for (;;) { - dbgprintf("----------imklog(BSD) waiting for kernel log line\n"); + dbgprintf("imklog(BSD/Linux) waiting for kernel log line\n"); i = read(fklog, pRcv + len, iMaxLine - len); if (i > 0) { pRcv[i + len] = '\0'; } else { if (i < 0 && errno != EINTR && errno != EAGAIN) { imklogLogIntMsg(LOG_ERR, - "imklog error %d reading kernel log - shutting down imklog", - errno); + "imklog: error reading kernel log - shutting down: %s", + rs_strerror_r(errno, errmsg, sizeof(errmsg))); fklog = -1; } break; @@ -155,18 +236,18 @@ readklog(void) for (p = (char*)pRcv; (q = strchr(p, '\n')) != NULL; p = q + 1) { *q = '\0'; - Syslog(LOG_INFO, (uchar*) p, NULL); + submitSyslog(LOG_INFO, (uchar*) p); } len = strlen(p); if (len >= iMaxLine - 1) { - Syslog(LOG_INFO, (uchar*)p, NULL); + submitSyslog(LOG_INFO, (uchar*)p); len = 0; } - if (len > 0) + if(len > 0) memmove(pRcv, p, len + 1); } if (len > 0) - Syslog(LOG_INFO, pRcv, NULL); + submitSyslog(LOG_INFO, pRcv); if(pRcv != NULL && (size_t) iMaxLine >= sizeof(bufRcv) - 1) free(pRcv); @@ -181,6 +262,11 @@ rsRetVal klogAfterRun(void) DEFiRet; if(fklog != -1) close(fklog); +# ifdef OS_LINUX + /* Turn on logging of messages to console, but only if a log level was speficied */ + if(console_log_level != -1) + klogctl(7, NULL, 0); +# endif RETiRet; } -- cgit v1.2.3 From 49a5c0c3b9dbb91e3cdd97b2975a3e12c53fe73e Mon Sep 17 00:00:00 2001 From: Marius Tomaschewski Date: Wed, 17 Oct 2012 11:29:45 +0200 Subject: imklog: skip leading spaces in kernel timestamp --- plugins/imklog/bsd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'plugins/imklog/bsd.c') diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c index eaf8e5ca..428d3cc2 100644 --- a/plugins/imklog/bsd.c +++ b/plugins/imklog/bsd.c @@ -92,7 +92,9 @@ submitSyslog(int pri, uchar *buf) /* we now try to parse the timestamp. iff it parses, we assume * it is a timestamp. Otherwise we know for sure it is no ts ;) */ - i = 4; /* first digit after '[' */ + i = 4; /* space or first digit after '[' */ + while(buf[i] && isspace(buf[i])) + ++i; /* skip space */ secs = 0; while(buf[i] && isdigit(buf[i])) { secs = secs * 10 + buf[i] - '0'; -- cgit v1.2.3 From 51754401f72376ea5f1c5b74b9c1772ab6f7ae4f Mon Sep 17 00:00:00 2001 From: Marius Tomaschewski Date: Wed, 17 Oct 2012 11:55:34 +0200 Subject: imklog: use memmove to remove kernel timestamp --- plugins/imklog/bsd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'plugins/imklog/bsd.c') diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c index 428d3cc2..bb45c97a 100644 --- a/plugins/imklog/bsd.c +++ b/plugins/imklog/bsd.c @@ -120,7 +120,7 @@ submitSyslog(int pri, uchar *buf) /* we have a timestamp */ DBGPRINTF("kernel timestamp is %ld %ld\n", secs, nsecs); bufsize= strlen((char*)buf); - memcpy(buf+3, buf+i, bufsize - i + 1); + memmove(buf+3, buf+i, bufsize - i + 1); clock_gettime(CLOCK_MONOTONIC, &monotonic); clock_gettime(CLOCK_REALTIME, &realtime); -- cgit v1.2.3 From fa4119e8747eaec739e38e600cae0308db5367e9 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Wed, 17 Oct 2012 17:17:43 +0200 Subject: imklog: add paramter "keepkerneltimestamp" Thanks to Marius Tomaschweski for the suggestion and a patch (for v5) that this commit bases on. --- plugins/imklog/bsd.c | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) (limited to 'plugins/imklog/bsd.c') diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c index d4f9f773..ad194b58 100644 --- a/plugins/imklog/bsd.c +++ b/plugins/imklog/bsd.c @@ -58,9 +58,6 @@ static int fklog = -1; /* kernel log fd */ #ifdef OS_LINUX /* submit a message to imklog Syslog() API. In this function, we check if * a kernel timestamp is present and, if so, extract and strip it. - * Note: this is an extra processing step. We should revisit the whole - * idea in v6 and remove all that old stuff that we do not longer need - * (like symbol resolution). <-- TODO * Note that this is heavily Linux specific and thus is not compiled or * used for BSD. * Special thanks to Lennart Poettering for suggesting on how to convert @@ -73,7 +70,7 @@ static int fklog = -1; /* kernel log fd */ * rgerhards, 2011-06-24 */ static void -submitSyslog(int pri, uchar *buf) +submitSyslog(modConfData_t *pModConf, int pri, uchar *buf) { long secs; long nsecs; @@ -119,8 +116,10 @@ submitSyslog(int pri, uchar *buf) /* we have a timestamp */ DBGPRINTF("kernel timestamp is %ld %ld\n", secs, nsecs); - bufsize= strlen((char*)buf); - memmove(buf+3, buf+i, bufsize - i + 1); + if(!pModConf->bKeepKernelStamp) { + bufsize= strlen((char*)buf); + memmove(buf+3, buf+i, bufsize - i + 1); + } clock_gettime(CLOCK_MONOTONIC, &monotonic); clock_gettime(CLOCK_REALTIME, &realtime); @@ -146,7 +145,7 @@ done: } #else /* now comes the BSD "code" (just a shim) */ static void -submitSyslog(int pri, uchar *buf) +submitSyslog(modConfData_t *pModConf, int pri, uchar *buf) { Syslog(pri, buf, NULL); } @@ -196,7 +195,7 @@ finalize_it: /* Read kernel log while data are available, split into lines. */ static void -readklog(void) +readklog(modConfData_t *pModConf) { char *p, *q; int len, i; @@ -238,18 +237,18 @@ readklog(void) for (p = (char*)pRcv; (q = strchr(p, '\n')) != NULL; p = q + 1) { *q = '\0'; - submitSyslog(LOG_INFO, (uchar*) p); + submitSyslog(pModConf, LOG_INFO, (uchar*) p); } len = strlen(p); if (len >= iMaxLine - 1) { - submitSyslog(LOG_INFO, (uchar*)p); + submitSyslog(pModConf, LOG_INFO, (uchar*)p); len = 0; } if(len > 0) memmove(pRcv, p, len + 1); } if (len > 0) - submitSyslog(LOG_INFO, pRcv); + submitSyslog(pModConf, LOG_INFO, pRcv); if(pRcv != NULL && (size_t) iMaxLine >= sizeof(bufRcv) - 1) free(pRcv); @@ -278,10 +277,10 @@ rsRetVal klogAfterRun(modConfData_t *pModConf) * "message pull" mechanism. * rgerhards, 2008-04-09 */ -rsRetVal klogLogKMsg(modConfData_t __attribute__((unused)) *pModConf) +rsRetVal klogLogKMsg(modConfData_t *pModConf) { DEFiRet; - readklog(); + readklog(pModConf); RETiRet; } -- cgit v1.2.3 From 318a6fb577a6e5af558b70232bb0a19871399d13 Mon Sep 17 00:00:00 2001 From: Marius Tomaschewski Date: Wed, 21 Nov 2012 13:46:58 +0100 Subject: imklog: added $klogKeepKernelTimestamp option When enabled, the kernel [timestamp] remains at begin of each message, even it is used for the message time too. --- plugins/imklog/bsd.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'plugins/imklog/bsd.c') diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c index bb45c97a..ec4110da 100644 --- a/plugins/imklog/bsd.c +++ b/plugins/imklog/bsd.c @@ -119,8 +119,10 @@ submitSyslog(int pri, uchar *buf) /* we have a timestamp */ DBGPRINTF("kernel timestamp is %ld %ld\n", secs, nsecs); - bufsize= strlen((char*)buf); - memmove(buf+3, buf+i, bufsize - i + 1); + if(!bKeepKernelStamp) { + bufsize= strlen((char*)buf); + memmove(buf+3, buf+i, bufsize - i + 1); + } clock_gettime(CLOCK_MONOTONIC, &monotonic); clock_gettime(CLOCK_REALTIME, &realtime); -- cgit v1.2.3 From f040bde7a0454dfbc7def36a288bc70c58d878af Mon Sep 17 00:00:00 2001 From: Marius Tomaschewski Date: Wed, 21 Nov 2012 13:47:19 +0100 Subject: imklog: added $klogParseKernelTimestamp option When enabled, kernel message [timestamp] is converted for message time. Default is to use receive time as in 5.8.x and before, because the clock used to create the timestamp is not supposed to be as accurate as the monotonic clock (depends on hardware and kernel) resulting in differences between kernel and system messages which occurred at same time. --- plugins/imklog/bsd.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'plugins/imklog/bsd.c') diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c index ec4110da..06032373 100644 --- a/plugins/imklog/bsd.c +++ b/plugins/imklog/bsd.c @@ -85,6 +85,9 @@ submitSyslog(int pri, uchar *buf) struct timeval tv; struct timeval *tp = NULL; + if(!bParseKernelStamp) + goto done; + if(buf[3] != '[') goto done; DBGPRINTF("imklog: kernel timestamp detected, extracting it\n"); -- cgit v1.2.3 From b78af2aaf546cee90671513be39d8e3717f2ace6 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Thu, 22 Nov 2012 08:57:57 +0100 Subject: bugfix: imklog mistakenly took kernel timestamp subseconds as nanoseconds ... actually, they are microseconds. So the fractional part of the timestamp was not properly formatted. Thanks to Marius Tomaschwesky for the bug report and the patch idea. --- plugins/imklog/bsd.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) (limited to 'plugins/imklog/bsd.c') diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c index 06032373..17d4bead 100644 --- a/plugins/imklog/bsd.c +++ b/plugins/imklog/bsd.c @@ -76,9 +76,9 @@ static void submitSyslog(int pri, uchar *buf) { long secs; - long nsecs; + long usecs; long secOffs; - long nsecOffs; + long usecOffs; unsigned i; unsigned bufsize; struct timespec monotonic, realtime; @@ -109,9 +109,9 @@ submitSyslog(int pri, uchar *buf) } ++i; /* skip dot */ - nsecs = 0; + usecs = 0; while(buf[i] && isdigit(buf[i])) { - nsecs = nsecs * 10 + buf[i] - '0'; + usecs = usecs * 10 + buf[i] - '0'; ++i; } if(buf[i] != ']') { @@ -121,7 +121,7 @@ submitSyslog(int pri, uchar *buf) ++i; /* skip ']' */ /* we have a timestamp */ - DBGPRINTF("kernel timestamp is %ld %ld\n", secs, nsecs); + DBGPRINTF("kernel timestamp is %ld %ld\n", secs, usecs); if(!bKeepKernelStamp) { bufsize= strlen((char*)buf); memmove(buf+3, buf+i, bufsize - i + 1); @@ -130,20 +130,20 @@ submitSyslog(int pri, uchar *buf) clock_gettime(CLOCK_MONOTONIC, &monotonic); clock_gettime(CLOCK_REALTIME, &realtime); secOffs = realtime.tv_sec - monotonic.tv_sec; - nsecOffs = realtime.tv_nsec - monotonic.tv_nsec; - if(nsecOffs < 0) { + usecOffs = (realtime.tv_nsec - monotonic.tv_nsec) / 1000; + if(usecOffs < 0) { secOffs--; - nsecOffs += 1000000000l; + usecOffs += 1000000l; } - nsecs +=nsecOffs; - if(nsecs > 999999999l) { + usecs += usecOffs; + if(usecs > 999999l) { secs++; - nsecs -= 1000000000l; + usecs -= 1000000l; } secs += secOffs; tv.tv_sec = secs; - tv.tv_usec = nsecs / 1000; + tv.tv_usec = usecs; tp = &tv; done: -- cgit v1.2.3 From 1afd79df5f1da6ce6da8dd594bc4fb32796acb9b Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Tue, 15 Jan 2013 14:27:33 +0100 Subject: bugfix: imklog issued wrong facility in error messages ...what could lead to problems in other parts of the code --- plugins/imklog/bsd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'plugins/imklog/bsd.c') diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c index 0fbee491..9c2eebb2 100644 --- a/plugins/imklog/bsd.c +++ b/plugins/imklog/bsd.c @@ -172,7 +172,7 @@ klogWillRun(modConfData_t *pModConf) fklog = open((char*)GetPath(pModConf), O_RDONLY, 0); if (fklog < 0) { - imklogLogIntMsg(RS_RET_ERR_OPEN_KLOG, "imklog: cannot open kernel log(%s): %s.", + imklogLogIntMsg(LOG_ERR, "imklog: cannot open kernel log(%s): %s.", GetPath(pModConf), rs_strerror_r(errno, errmsg, sizeof(errmsg))); ABORT_FINALIZE(RS_RET_ERR_OPEN_KLOG); } -- cgit v1.2.3