/* The kernel log module.
*
* This is an abstracted module. As Linux and BSD kernel log is conceptually the
* same, we do not do different input plugins for them but use
* imklog in both cases, just with different "backend drivers" for
* the different platforms. This also enables a rsyslog.conf to
* be used on multiple platforms without the need to take care of
* what the kernel log is coming from.
*
* See platform-specific files (e.g. linux.c, bsd.c) in the plugin's
* working directory. For other systems with similar kernel logging
* functionality, no new input plugin shall be written but rather a
* driver be developed for imklog. Please note that imklog itself is
* mostly concerned with handling the interface. Any real action happens
* in the drivers, as things may be pretty different on different
* platforms.
*
* Please note that this file replaces the klogd daemon that was
* also present in pre-v3 versions of rsyslog.
*
* To test under Linux:
* echo test1 > /dev/kmsg
*
* Copyright (C) 2008-2011 by Rainer Gerhards and Adiscon GmbH
*
* This file is part of rsyslog.
*
* Rsyslog is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* Rsyslog is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with Rsyslog. If not, see .
*
* A copy of the GPL can be found in the file "COPYING" in this distribution.
*/
#include "config.h"
#include "rsyslog.h"
#include
#include
#include
#include
#include
#include
#include "dirty.h"
#include "cfsysline.h"
#include "obj.h"
#include "msg.h"
#include "module-template.h"
#include "datetime.h"
#include "imklog.h"
#include "glbl.h"
#include "prop.h"
#include "unicode-helper.h"
MODULE_TYPE_INPUT
MODULE_TYPE_NOKEEP
MODULE_CNFNAME("imklog")
/* Module static data */
DEF_IMOD_STATIC_DATA
DEFobjCurrIf(datetime)
DEFobjCurrIf(glbl)
DEFobjCurrIf(prop)
/* config settings */
typedef struct configSettings_s {
int dbgPrintSymbols; /* this one is extern so the helpers can access it! */
int symbols_twice;
int use_syscall;
int symbol_lookup; /* on recent kernels > 2.6, the kernel does this */
int bPermitNonKernel; /* permit logging of messages not having LOG_KERN facility */
int iFacilIntMsg; /* the facility to use for internal messages (set by driver) */
uchar *pszPath;
int console_log_level;
char *symfile; /* TODO: actually unsued currently! */
} configSettings_t;
static configSettings_t cs;
static modConfData_t *loadModConf = NULL;/* modConf ptr to use for the current load process */
static modConfData_t *runModConf = NULL;/* modConf ptr to use for the current load process */
static prop_t *pInputName = NULL; /* there is only one global inputName for all messages generated by this module */
static prop_t *pLocalHostIP = NULL; /* a pseudo-constant propterty for 127.0.0.1 */
static inline void
initConfigSettings(void)
{
cs.dbgPrintSymbols = 0;
cs.symbols_twice = 0;
cs.use_syscall = 0;
cs.symbol_lookup = 0;
cs.bPermitNonKernel = 0;
cs.console_log_level = -1;
cs.pszPath = NULL;
cs.symfile = NULL;
cs.iFacilIntMsg = klogFacilIntMsg();
}
/* enqueue the the kernel message into the message queue.
* The provided msg string is not freed - thus must be done
* by the caller.
* rgerhards, 2008-04-12
*/
static rsRetVal
enqMsg(uchar *msg, uchar* pszTag, int iFacility, int iSeverity, struct timeval *tp)
{
struct syslogTime st;
msg_t *pMsg;
DEFiRet;
assert(msg != NULL);
assert(pszTag != NULL);
if(tp == NULL) {
CHKiRet(msgConstruct(&pMsg));
} else {
datetime.timeval2syslogTime(tp, &st);
CHKiRet(msgConstructWithTime(&pMsg, &st, tp->tv_sec));
}
MsgSetFlowControlType(pMsg, eFLOWCTL_LIGHT_DELAY);
MsgSetInputName(pMsg, pInputName);
MsgSetRawMsgWOSize(pMsg, (char*)msg);
MsgSetMSGoffs(pMsg, 0); /* we do not have a header... */
MsgSetRcvFrom(pMsg, glbl.GetLocalHostNameProp());
MsgSetRcvFromIP(pMsg, pLocalHostIP);
MsgSetHOSTNAME(pMsg, glbl.GetLocalHostName(), ustrlen(glbl.GetLocalHostName()));
MsgSetTAG(pMsg, pszTag, ustrlen(pszTag));
pMsg->iFacility = LOG_FAC(iFacility);
pMsg->iSeverity = LOG_PRI(iSeverity);
CHKiRet(submitMsg(pMsg));
finalize_it:
RETiRet;
}
/* parse the PRI from a kernel message. At least BSD seems to have
* non-kernel messages inside the kernel log...
* Expected format: "". piPri is only valid if the function
* successfully returns. If there was a proper pri ppSz is advanced to the
* position right after ">".
* rgerhards, 2008-04-14
*/
static rsRetVal
parsePRI(uchar **ppSz, int *piPri)
{
DEFiRet;
int i;
uchar *pSz;
assert(ppSz != NULL);
pSz = *ppSz;
assert(pSz != NULL);
assert(piPri != NULL);
if(*pSz != '<' || !isdigit(*(pSz+1)))
ABORT_FINALIZE(RS_RET_INVALID_PRI);
++pSz;
i = 0;
while(isdigit(*pSz)) {
i = i * 10 + *pSz++ - '0';
}
if(*pSz != '>')
ABORT_FINALIZE(RS_RET_INVALID_PRI);
/* OK, we have a valid PRI */
*piPri = i;
*ppSz = pSz + 1; /* update msg ptr to position after PRI */
finalize_it:
RETiRet;
}
/* log an imklog-internal message
* rgerhards, 2008-04-14
*/
rsRetVal imklogLogIntMsg(int priority, char *fmt, ...)
{
DEFiRet;
va_list ap;
uchar msgBuf[2048]; /* we use the same size as sysklogd to remain compatible */
uchar *pLogMsg;
va_start(ap, fmt);
vsnprintf((char*)msgBuf, sizeof(msgBuf) / sizeof(char), fmt, ap);
pLogMsg = msgBuf;
va_end(ap);
logmsgInternal(NO_ERRCODE ,priority, msgBuf, 0);
RETiRet;
}
/* log a kernel message. If tp is non-NULL, it contains the message creation
* time to use.
* rgerhards, 2008-04-14
*/
rsRetVal Syslog(int priority, uchar *pMsg, struct timeval *tp)
{
int pri = -1;
rsRetVal localRet;
DEFiRet;
/* then check if we have two PRIs. This can happen in case of systemd,
* in which case the second PRI is the rigth one.
* TODO: added kernel timestamp support to this PoC. -- rgerhards, 2011-03-18
*/
if(pMsg[3] == '<') { /* could be a pri... */
uchar *pMsgTmp = pMsg + 3;
localRet = parsePRI(&pMsgTmp, &pri);
if(localRet == RS_RET_OK && pri >= 8 && pri <= 192) {
/* *this* is our PRI */
DBGPRINTF("imklog detected secondary PRI in klog msg\n");
pMsg = pMsgTmp;
priority = pri;
}
}
if(pri == -1) {
localRet = parsePRI(&pMsg, &priority);
if(localRet != RS_RET_INVALID_PRI && localRet != RS_RET_OK)
FINALIZE;
}
/* if we don't get the pri, we use whatever we were supplied */
/* ignore non-kernel messages if not permitted */
if(cs.bPermitNonKernel == 0 && LOG_FAC(priority) != LOG_KERN)
FINALIZE; /* silently ignore */
iRet = enqMsg((uchar*)pMsg, (uchar*) "kernel:", LOG_FAC(priority), LOG_PRI(priority), tp);
finalize_it:
RETiRet;
}
/* helper for some klog drivers which need to know the MaxLine global setting. They can
* not obtain it themselfs, because they are no modules and can not query the object hander.
* It would probably be a good idea to extend the interface to support it, but so far
* we create a (sufficiently valid) work-around. -- rgerhards, 2008-11-24
*/
int klog_getMaxLine(void)
{
return glbl.GetMaxLine();
}
BEGINrunInput
CODESTARTrunInput
/* this is an endless loop - it is terminated when the thread is
* signalled to do so. This, however, is handled by the framework,
* right into the sleep below.
*/
while(!pThrd->bShallStop) {
/* klogLogKMsg() waits for the next kernel message, obtains it
* and then submits it to the rsyslog main queue.
* rgerhards, 2008-04-09
*/
CHKiRet(klogLogKMsg(runModConf));
}
finalize_it:
ENDrunInput
BEGINbeginCnfLoad
CODESTARTbeginCnfLoad
loadModConf = pModConf;
pModConf->pConf = pConf;
/* init legacy config vars */
initConfigSettings();
ENDbeginCnfLoad
BEGINendCnfLoad
CODESTARTendCnfLoad
/* persist module-specific settings from legacy config system */
loadModConf->dbgPrintSymbols = cs.dbgPrintSymbols;
loadModConf->symbols_twice = cs.symbols_twice;
loadModConf->use_syscall = cs.use_syscall;
loadModConf->bPermitNonKernel = cs.bPermitNonKernel;
loadModConf->iFacilIntMsg = cs.iFacilIntMsg;
loadModConf->console_log_level = cs.console_log_level;
if((cs.pszPath == NULL) || (cs.pszPath[0] == '\0')) {
loadModConf->pszPath = NULL;
if(cs.pszPath != NULL)
free(cs.pszPath);
} else {
loadModConf->pszPath = cs.pszPath;
}
cs.pszPath = NULL;
if((cs.symfile == NULL) || (cs.symfile[0] == '\0')) {
loadModConf->symfile = NULL;
if(cs.symfile != NULL)
free(cs.symfile);
} else {
loadModConf->symfile = cs.symfile;
}
cs.symfile = NULL;
loadModConf = NULL; /* done loading */
/* free legacy config vars */
free(cs.pszPath);
cs.pszPath = NULL;
free(cs.symfile);
cs.symfile = NULL;
ENDendCnfLoad
BEGINcheckCnf
CODESTARTcheckCnf
ENDcheckCnf
BEGINactivateCnfPrePrivDrop
CODESTARTactivateCnfPrePrivDrop
runModConf = pModConf;
iRet = klogWillRun(runModConf);
ENDactivateCnfPrePrivDrop
BEGINactivateCnf
CODESTARTactivateCnf
ENDactivateCnf
BEGINfreeCnf
CODESTARTfreeCnf
ENDfreeCnf
BEGINwillRun
CODESTARTwillRun
ENDwillRun
BEGINafterRun
CODESTARTafterRun
iRet = klogAfterRun(runModConf);
ENDafterRun
BEGINmodExit
CODESTARTmodExit
if(pInputName != NULL)
prop.Destruct(&pInputName);
if(pLocalHostIP != NULL)
prop.Destruct(&pLocalHostIP);
/* release objects we used */
objRelease(glbl, CORE_COMPONENT);
objRelease(datetime, CORE_COMPONENT);
objRelease(prop, CORE_COMPONENT);
ENDmodExit
BEGINqueryEtryPt
CODESTARTqueryEtryPt
CODEqueryEtryPt_STD_IMOD_QUERIES
CODEqueryEtryPt_STD_CONF2_QUERIES
CODEqueryEtryPt_STD_CONF2_PREPRIVDROP_QUERIES
ENDqueryEtryPt
static rsRetVal resetConfigVariables(uchar __attribute__((unused)) *pp, void __attribute__((unused)) *pVal)
{
cs.dbgPrintSymbols = 0;
cs.symbols_twice = 0;
cs.use_syscall = 0;
cs.symfile = NULL;
cs.symbol_lookup = 0;
cs.bPermitNonKernel = 0;
if(cs.pszPath != NULL) {
free(cs.pszPath);
cs.pszPath = NULL;
}
cs.iFacilIntMsg = klogFacilIntMsg();
return RS_RET_OK;
}
BEGINmodInit()
CODESTARTmodInit
*ipIFVersProvided = CURR_MOD_IF_VERSION; /* we only support the current interface specification */
CODEmodInit_QueryRegCFSLineHdlr
CHKiRet(objUse(datetime, CORE_COMPONENT));
CHKiRet(objUse(glbl, CORE_COMPONENT));
CHKiRet(objUse(prop, CORE_COMPONENT));
/* we need to create the inputName property (only once during our lifetime) */
CHKiRet(prop.CreateStringProp(&pInputName, UCHAR_CONSTANT("imklog"), sizeof("imklog") - 1));
CHKiRet(prop.CreateStringProp(&pLocalHostIP, UCHAR_CONSTANT("127.0.0.1"), sizeof("127.0.0.1") - 1));
/* init legacy config settings */
initConfigSettings();
CHKiRet(omsdRegCFSLineHdlr((uchar *)"debugprintkernelsymbols", 0, eCmdHdlrBinary,
NULL, &cs.dbgPrintSymbols, STD_LOADABLE_MODULE_ID, eConfObjGlobal));
CHKiRet(omsdRegCFSLineHdlr((uchar *)"klogpath", 0, eCmdHdlrGetWord,
NULL, &cs.pszPath, STD_LOADABLE_MODULE_ID, eConfObjGlobal));
CHKiRet(omsdRegCFSLineHdlr((uchar *)"klogsymbollookup", 0, eCmdHdlrBinary,
NULL, &cs.symbol_lookup, STD_LOADABLE_MODULE_ID, eConfObjGlobal));
CHKiRet(omsdRegCFSLineHdlr((uchar *)"klogsymbolstwice", 0, eCmdHdlrBinary,
NULL, &cs.symbols_twice, STD_LOADABLE_MODULE_ID, eConfObjGlobal));
CHKiRet(omsdRegCFSLineHdlr((uchar *)"klogusesyscallinterface", 0, eCmdHdlrBinary,
NULL, &cs.use_syscall, STD_LOADABLE_MODULE_ID, eConfObjGlobal));
CHKiRet(omsdRegCFSLineHdlr((uchar *)"klogpermitnonkernelfacility", 0, eCmdHdlrBinary,
NULL, &cs.bPermitNonKernel, STD_LOADABLE_MODULE_ID, eConfObjGlobal));
CHKiRet(omsdRegCFSLineHdlr((uchar *)"klogconsoleloglevel", 0, eCmdHdlrInt,
NULL, &cs.console_log_level, STD_LOADABLE_MODULE_ID, eConfObjGlobal));
CHKiRet(omsdRegCFSLineHdlr((uchar *)"kloginternalmsgfacility", 0, eCmdHdlrFacility,
NULL, &cs.iFacilIntMsg, STD_LOADABLE_MODULE_ID, eConfObjGlobal));
CHKiRet(omsdRegCFSLineHdlr((uchar *)"resetconfigvariables", 1, eCmdHdlrCustomHandler,
resetConfigVariables, NULL, STD_LOADABLE_MODULE_ID, eConfObjGlobal));
ENDmodInit
/* vim:set ai:
*/