commit rsyslog.1232 for openSUSE:12.2:Update

Hello community, here is the log from the commit of package rsyslog.1232 for openSUSE:12.2:Update checked in at 2013-01-21 15:36:25 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:12.2:Update/rsyslog.1232 (Old) and /work/SRC/openSUSE:12.2:Update/.rsyslog.1232.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "rsyslog.1232", Maintainer is "" Changes: -------- New Changes file: --- /dev/null 2013-01-09 19:40:42.352580873 +0100 +++ /work/SRC/openSUSE:12.2:Update/.rsyslog.1232.new/rsyslog.changes 2013-01-21 15:36:26.000000000 +0100 @@ -0,0 +1,759 @@ +------------------------------------------------------------------- +Thu Jan 10 12:47:56 UTC 2013 - mt@suse.com + +- Check the existence of /etc/init.d/syslog script before calling + the restart_on_update and stop_on_removal macros to avoid errors + on update, reset the SYSLOG_DAEMON variable on removal only. + Since openSUSE 12.3, the syslog init script is not shipped any + more (bnc#790298,bnc#750478). + +------------------------------------------------------------------- +Wed Nov 21 15:36:12 UTC 2012 - mt@suse.com + +- imklog: fixed a conversion bug causing a <1sec incorrectness + of the message time (bnc#783967). + [0004-imklog-convert-to-kmsg-timestamp-s-us-to-ns-first.patch] +- imklog: added $klogParseKernelTimestamp option (default off), + wich reverts to the 5.8.x behavior to use receive time for the + kernel messages instead to try parse and convert the kernel + timestamp, what is not reliable on some hardware (bnc#783967). + [0003-imklog-added-klogParseKernelTimestamp-option.patch] +- imklog: added $klogKeepKernelTimestamp option (default off), + causing to not remove the kernel timestamp from the message + after a successful conversion (bnc#783967). + [0002-imklog-added-klogKeepKernelTimestamp-option.patch] + +------------------------------------------------------------------- +Tue Nov 13 10:31:24 UTC 2012 - mt@suse.com + +- imuxsock: do not log EAGAIN in nonblocking recvfrom (bnc#734672) + [0001-imuxsock-do-not-log-EAGAIN-in-nonblocking-recvfrom.patch] + +------------------------------------------------------------------- +Thu Oct 18 08:18:02 UTC 2012 - mt@suse.com + +- Updated to 5.10.1 [V5-stable] fixing the following issues: + - bugfix: imuxsock and imklog truncated head of received message + This happened only under some circumstances. Thanks to Marius + Tomaschewski, Florian Piekert and Milan Bartos for their help + in solving this issue (bnc#783177). + - enable DNS resolution in imrelp + Thanks to Apollon Oikonomopoulos for the patch + - bugfix: invalid property name in property-filter could cause + abort if action chaining (& operator) was used + http://bugzilla.adiscon.com/show_bug.cgi?id=355 + Thanks to pilou@gmx.com for the bug report + - bugfix: remove invalid socket option call from imuxsock + Thanks to Cristian Ionescu-Idbohrn and Jonny Törnbom + - bugfix: fixed wrong bufferlength for snprintf in tcpflood.c + when using the -f (dynafiles) option. + - fixed issues in build system (related to cust1 dummy plugin) + +------------------------------------------------------------------- +Tue Sep 18 14:43:30 UTC 2012 - mt@suse.com + +- Updated to 5.10.0 [V5-stable] (bnc#753077, bnc#778769), the actual + rsyslog v5-stable series, incorporating all fixes the 5.8.x [EOL + V5-stable] and changes from 5.9.x series. It turns off rate limiting + on unix socket by default (caused problems) and fixes privilege drop. + A digest of the changes (see ChangeLog for complete list): + - added capability to specify substrings for field extraction mode + - added configuration directives to customize queue light delay marks + - permit size modifiers (k,m,g,...) in integer config parameters + Thanks to Jo Rhett for the suggestion. + - added configuration directive to disable octet-counted framing + for imtcp, directive is $InputTCPServerSupportOctetCountedFraming + for imptcp, directive is $InputPTCPServerSupportOctetCountedFraming + - added capability to use a local interface IP address as fromhost-ip + for locally originating messages. New directive $LocalHostIPIF + - improved impstats subsystem, added many new counters + - enhanced module loader to not rely on PATH_MAX + - refactored imklog linux driver, now combined with BSD driver + The Linux driver no longer supports outdated kernel symbol resolution, + which was disabled by default for very long. Also overall cleanup, + resulting in much smaller code. Linux and BSD are now covered by a + single small driver. + - $IMUXSockRateLimitInterval DEFAULT CHANGED, was 5, now 0 + The new default turns off rate limiting. This was chosen as people + experienced problems with rate-limiting activated by default. Now it + needs an explicit opt-in by setting this parameter. + Thanks to Chris Gaffney for suggesting to make it opt-in; thanks to + many unnamed others who already had complained at the time Chris made + the suggestion ;-) + - imuxsock: added capability to "annotate" messages with "trusted + information", which contains some properties obtained from the system + and as such sure to not be faked. This is inspired by the similiar + idea introduced in systemd. + - removed dependency on gcrypt for recently-enough GnuTLS + see: http://bugzilla.adiscon.com/show_bug.cgi?id=289 + - added capability to emit config error location info for warnings + otherwise, omusrmsg's warning about new config format was not + accompanied by problem location. + - added support for obtaining timestamp for kernel message from message + If the kernel time-stamps messages, time is now take from that + timestamp instead of the system time when the message was read. This + provides much better accuracy. Thanks to Lennart Poettering for + suggesting this feature and his help during implementation. + - added support for obtaining timestamp from system for imuxsock + This permits to read the time a message was submitted to the system + log socket. Most importantly, this is provided in microsecond resolution. + So we are able to obtain high precision timestampis even for messages + that were - as is usual - not formatted with them. This also simplifies + things in regard to local time calculation in chroot environments. + Many thanks to Lennart Poettering for suggesting this feature, + providing some guidance on implementing it and coordinating getting the + necessary support into the Linux kernel. + - imfile: added $InputFileMaxLinesAtOnce directive + - enhanced imfile to support input batching + - added capability for imtcp and imptcp to activate keep-alive packets + at the socket layer. This has not been added to imttcp, as the latter is + only an experimental module, and one which did not prove to be useful. + reference: http://kb.monitorware.com/post20791.html + - added support to control KEEPALIVE settings in imptcp + this has not yet been added to imtcp, but could be done on request. + - $ActionName is now also used for naming of queues in impstats + as well as in the debug output + - bugfix: do not open files with full privileges, if privs will be dropped + This make the privilege drop code more bulletproof, but breaks Ubuntu's + work-around for log files created by external programs with the wrong + user and/or group. Note that it was long said that this "functionality" + would break once we go for serious privilege drop code, so hopefully + nobody still depends on it (and, if so, they lost...). + - bugfix: pipes not opened in full priv mode when privs are to be dropped + - better handling of queue i/o errors in disk queues. This is kind of a + bugfix, but a very intrusive one, this it goes into the devel version + first. Right now, "file not found" is handled and leads to the new + emergency mode, in which disk action is stopped and the queue run + in direct mode. An error message is emited if this happens. + - added support for user-level PRI provided via systemd + - added new config directive $InputTCPFlowControl to select if tcp + received messages shall be flagged as light delayable or not. + - enhanced omhdfs to support batching mode. This permits to increase + performance, as we now call the HDFS API with much larger message + sizes and far more infrequently + - bugfix: delayble source could block action queue, even if there was a + disk queue associated with it. The root cause of this problem was that + it makes no sense to delay messages once they arrive in the action queue + – the “input” that is being held in that case is the main queue worker, + what makes no sense. Thanks to Marcin for alerting us on this problem + and providing instructions to reproduce it. + - bugfix: disk queue was not persisted on shutdown, regression of fix to + http://bugzilla.adiscon.com/show_bug.cgi?id=299 + The new code also handles the case of shutdown of blocking light and + full delayable sources somewhat smarter and permits, assuming sufficient + timouts, to persist message up to the max queue capacity. Also some nits + in debug instrumentation have been fixed. + - add small delay (50ms) after sending shutdown message. There seem to be + cases where the shutdown message is otherwise not processed, not even + on an idle system. Thanks to Marcin for bringing this problem up. + - support for resolving huge groups + closes: http://bugzilla.adiscon.com/show_bug.cgi?id=310 + Thanks to Alec Warner for the patch + - bugfix: potential hang due to mutex deadlock + closes: http://bugzilla.adiscon.com/show_bug.cgi?id=316 + Thanks to Andreas Piesk for reporting&analyzing this bug as well as + providing patches and other help in resolving it. bugfix: property + PROCID empty instead of proper nilvalue if not present + If it is not present, it must have the nilvalue “-” as of RFC5424 + closes: http://bugzilla.adiscon.com/show_bug.cgi?id=332 + Thanks to John N for reporting this issue. + - bugfix: “last message repeated n times” message was missing hostname + Thanks to Zdenek Salvet for finding this bug and to Bodik for reporting + bugfix: multiple main queues with same queue file name was not detected + This lead to queue file corruption. While the root cause is a config + error, it is a bug that this important and hard to find config error + was not detected by rsyslog. + +------------------------------------------------------------------- +Mon May 7 10:31:08 UTC 2012 - mt@suse.com + +- Updated to 5.8.11 [V5-stable] 2012-05-03: + - bugfix: ommysql did not properly init/exit the mysql runtime + library this could lead to segfaults. Triggering condition: + multiple action instances using ommysql. Thanks to Tomas + Heinrich for reporting this problem and providing an initial + patch (which my solution is based on, I need to add more code + to clean the mess up). + - bugfix: rsyslog did not terminate when delayable inputs were + blocked due to unvailable sources. Fixes: + http://bugzilla.adiscon.com/show_bug.cgi?id=299 + Thanks to Marcin M for bringing up this problem and Andre + Lorbach for helping to reproduce and fix it. + - bugfix: active input in “light delay state” could block + rsyslog termination, at least for prolonged period of time + - bugfix: imptcp input name could not be set. Config directive + was accepted, but had no effect + bugfix: assigned ruleset was lost when using disk queues + This looked quite hard to diagnose for disk-assisted queues, + as the pure memory part worked well, but ruleset info was lost + for messages stored inside the disk queue. + - bugfix: hostname was not requeried on HUP + Thanks to Per Jessen for reporting this bug and Marius + Tomaschewski for his help in testing the fix. + - bugfix: inside queue.c, some thread cancel states were not + correctly reset. While this is a bug, we assume it did have + no practical effect because the reset as it was done was set + to the state the code actually had at this point. But better + fix this… ++++ 562 more lines (skipped) ++++ between /dev/null ++++ and /work/SRC/openSUSE:12.2:Update/.rsyslog.1232.new/rsyslog.changes New: ---- 0001-imuxsock-do-not-log-EAGAIN-in-nonblocking-recvfrom.patch 0002-imklog-added-klogKeepKernelTimestamp-option.patch 0003-imklog-added-klogParseKernelTimestamp-option.patch 0004-imklog-convert-to-kmsg-timestamp-s-us-to-ns-first.patch rsyslog-5.10.1.tar.bz2 rsyslog.changes rsyslog.conf.in rsyslog.d.remote.conf.in rsyslog.early.conf.in rsyslog.spec rsyslog.sysconfig ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ rsyslog.spec ++++++ ++++ 657 lines (skipped) ++++++ 0001-imuxsock-do-not-log-EAGAIN-in-nonblocking-recvfrom.patch ++++++

From caaa4820b076b225ab43fb7b3051947d232d29ad Mon Sep 17 00:00:00 2001 From: Marius Tomaschewski Date: Tue, 13 Nov 2012 11:26:39 +0100 References: bnc#734672 Upstream: merged Url: http://git.adiscon.com/?p=rsyslog.git;a=commit;h=a378fa8d6525d96c66331b2ad44... Subject: [PATCH] imuxsock: do not log EAGAIN in nonblocking recvfrom

--- plugins/imuxsock/imuxsock.c | 2 +- 1 Datei geändert, 1 Zeile hinzugefügt(+), 1 Zeile entfernt(-) diff --git a/plugins/imuxsock/imuxsock.c b/plugins/imuxsock/imuxsock.c index cbb09b6..7520554 100644 --- a/plugins/imuxsock/imuxsock.c +++ b/plugins/imuxsock/imuxsock.c @@ -863,7 +863,7 @@ static rsRetVal readSocket(lstn_t *pLstn) } } CHKiRet(SubmitMsg(pRcv, iRcvd, pLstn, cred, ts)); - } else if(iRcvd < 0 && errno != EINTR) { + } else if(iRcvd < 0 && errno != EINTR && errno != EAGAIN) { char errStr[1024]; rs_strerror_r(errno, errStr, sizeof(errStr)); dbgprintf("UNIX socket error: %d = %s.\n", errno, errStr); -- 1.7.10.4 ++++++ 0002-imklog-added-klogKeepKernelTimestamp-option.patch ++++++

From 1149eb6987df77d97466dcbcc30c577a67ff5fd7 Mon Sep 17 00:00:00 2001 From: Marius Tomaschewski Date: Wed, 21 Nov 2012 13:46:58 +0100 References: bnc#783967 Upstream: merged Url: http://git.adiscon.com/?p=rsyslog.git;a=commit;h=318a6fb577a6e5af558b70232bb... Subject: [PATCH] imklog: added $klogKeepKernelTimestamp option

When enabled, the kernel [timestamp] remains at begin of each message, even it is used for the message time too. --- doc/imklog.html | 5 +++++ plugins/imklog/bsd.c | 6 ++++-- plugins/imklog/imklog.c | 3 +++ plugins/imklog/imklog.h | 1 + 4 Dateien geändert, 13 Zeilen hinzugefügt(+), 2 Zeilen entfernt(-) diff --git a/doc/imklog.html b/doc/imklog.html index 2e3b3bc..268c661 100644 --- a/doc/imklog.html +++ b/doc/imklog.html @@ -65,6 +65,11 @@ Linux only, ignored on other platforms (but may be specified)</li> former klogd -2 option<br> Linux only, ignored on other platforms (but may be specified)<br style="font-weight: bold;"> </li> +<li><b>$klogKeepKernelTimestamp</b> [on/<b>off</b>] +If enabled, this option causes to keep the [timestamp] provided by the kernel at the begin +of in each message rather than to remove it, when it could be parsed and converted into +local time for use as regular message time. +</li> </ul> <b>Caveats/Known Bugs:</b> <p>This is obviously platform specific and requires platform diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c index bb45c97..ec4110d 100644 --- a/plugins/imklog/bsd.c +++ b/plugins/imklog/bsd.c @@ -119,8 +119,10 @@ submitSyslog(int pri, uchar *buf) /* we have a timestamp */ DBGPRINTF("kernel timestamp is %ld %ld\n", secs, nsecs); - bufsize= strlen((char*)buf); - memmove(buf+3, buf+i, bufsize - i + 1); + if(!bKeepKernelStamp) { + bufsize= strlen((char*)buf); + memmove(buf+3, buf+i, bufsize - i + 1); + } clock_gettime(CLOCK_MONOTONIC, &monotonic); clock_gettime(CLOCK_REALTIME, &realtime); diff --git a/plugins/imklog/imklog.c b/plugins/imklog/imklog.c index aa50008..563b499 100644 --- a/plugins/imklog/imklog.c +++ b/plugins/imklog/imklog.c @@ -77,6 +77,7 @@ int symbols_twice = 0; int use_syscall = 0; int symbol_lookup = 0; /* on recent kernels > 2.6, the kernel does this */ int bPermitNonKernel = 0; /* permit logging of messages not having LOG_KERN facility */ +int bKeepKernelStamp = 0; /* keep the kernel timestamp in the message */ int iFacilIntMsg; /* the facility to use for internal messages (set by driver) */ uchar *pszPath = NULL; int console_log_level = -1; @@ -305,6 +306,7 @@ static rsRetVal resetConfigVariables(uchar __attribute__((unused)) *pp, void __a symfile = NULL; symbol_lookup = 0; bPermitNonKernel = 0; + bKeepKernelStamp = 0; if(pszPath != NULL) { free(pszPath); pszPath = NULL; @@ -332,6 +334,7 @@ CODEmodInit_QueryRegCFSLineHdlr CHKiRet(omsdRegCFSLineHdlr((uchar *)"klogpermitnonkernelfacility", 0, eCmdHdlrBinary, NULL, &bPermitNonKernel, STD_LOADABLE_MODULE_ID)); CHKiRet(omsdRegCFSLineHdlr((uchar *)"klogconsoleloglevel", 0, eCmdHdlrInt, NULL, &console_log_level, STD_LOADABLE_MODULE_ID)); CHKiRet(omsdRegCFSLineHdlr((uchar *)"kloginternalmsgfacility", 0, eCmdHdlrFacility, NULL, &iFacilIntMsg, STD_LOADABLE_MODULE_ID)); + CHKiRet(omsdRegCFSLineHdlr((uchar *)"klogkeepkerneltimestamp", 0, eCmdHdlrBinary, NULL, &bKeepKernelStamp, STD_LOADABLE_MODULE_ID)); CHKiRet(omsdRegCFSLineHdlr((uchar *)"resetconfigvariables", 1, eCmdHdlrCustomHandler, resetConfigVariables, NULL, STD_LOADABLE_MODULE_ID)); ENDmodInit /* vim:set ai: diff --git a/plugins/imklog/imklog.h b/plugins/imklog/imklog.h index 7a060df..03fb973 100644 --- a/plugins/imklog/imklog.h +++ b/plugins/imklog/imklog.h @@ -52,6 +52,7 @@ extern char *symfile; extern int console_log_level; extern int dbgPrintSymbols; extern uchar *pszPath; +extern int bKeepKernelStamp; /* the functions below may be called by the drivers */ rsRetVal imklogLogIntMsg(int priority, char *fmt, ...) __attribute__((format(printf,2, 3))); -- 1.7.10.4 ++++++ 0003-imklog-added-klogParseKernelTimestamp-option.patch ++++++

From 2d560d1bf2db31716458a650e7d9094e0a4597cc Mon Sep 17 00:00:00 2001 From: Marius Tomaschewski Date: Wed, 21 Nov 2012 13:47:19 +0100 References: bnc#783967 Upstream: merged Url: http://git.adiscon.com/?p=rsyslog.git;a=commit;h=f040bde7a0454dfbc7def36a288... Subject: [PATCH] imklog: added $klogParseKernelTimestamp option

When enabled, kernel message [timestamp] is converted for message time. Default is to use receive time as in 5.8.x and before, because the clock used to create the timestamp is not supposed to be as accurate as the monotonic clock (depends on hardware and kernel) resulting in differences between kernel and system messages which occurred at same time. --- doc/imklog.html | 10 +++++++++- plugins/imklog/bsd.c | 3 +++ plugins/imklog/imklog.c | 3 +++ plugins/imklog/imklog.h | 1 + 4 Dateien geändert, 16 Zeilen hinzugefügt(+), 1 Zeile entfernt(-) diff --git a/doc/imklog.html b/doc/imklog.html index 268c661..05292dd 100644 --- a/doc/imklog.html +++ b/doc/imklog.html @@ -65,10 +65,18 @@ Linux only, ignored on other platforms (but may be specified)</li> former klogd -2 option<br> Linux only, ignored on other platforms (but may be specified)<br style="font-weight: bold;"> </li> +<li><b>$klogParseKernelTimestamp</b> [on/<b>off</b>] +If enabled and the kernel creates a timestamp for its log messages, this timestamp will be +parsed and converted into regular message time instead to use the receive time of the kernel +message (as in 5.8.x and before). Default is to not parse the kernel timestamp, because the +clock used by the kernel to create the timestamps is not supposed to be as accurate as the +monotonic clock required to convert it. Depending on the hardware and kernel, it can result +in message time differences between kernel and system messages which occurred at same time. +</li> <li><b>$klogKeepKernelTimestamp</b> [on/<b>off</b>] If enabled, this option causes to keep the [timestamp] provided by the kernel at the begin of in each message rather than to remove it, when it could be parsed and converted into -local time for use as regular message time. +local time for use as regular message time. Only used, when $klogParseKernelTimestamp is on. </li> </ul> <b>Caveats/Known Bugs:</b> diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c index ec4110d..0603237 100644 --- a/plugins/imklog/bsd.c +++ b/plugins/imklog/bsd.c @@ -85,6 +85,9 @@ submitSyslog(int pri, uchar *buf) struct timeval tv; struct timeval *tp = NULL; + if(!bParseKernelStamp) + goto done; + if(buf[3] != '[') goto done; DBGPRINTF("imklog: kernel timestamp detected, extracting it\n"); diff --git a/plugins/imklog/imklog.c b/plugins/imklog/imklog.c index 563b499..e953651 100644 --- a/plugins/imklog/imklog.c +++ b/plugins/imklog/imklog.c @@ -77,6 +77,7 @@ int symbols_twice = 0; int use_syscall = 0; int symbol_lookup = 0; /* on recent kernels > 2.6, the kernel does this */ int bPermitNonKernel = 0; /* permit logging of messages not having LOG_KERN facility */ +int bParseKernelStamp = 0; /* if try to parse kernel timestamps for message time */ int bKeepKernelStamp = 0; /* keep the kernel timestamp in the message */ int iFacilIntMsg; /* the facility to use for internal messages (set by driver) */ uchar *pszPath = NULL; @@ -306,6 +307,7 @@ static rsRetVal resetConfigVariables(uchar __attribute__((unused)) *pp, void __a symfile = NULL; symbol_lookup = 0; bPermitNonKernel = 0; + bParseKernelStamp = 0; bKeepKernelStamp = 0; if(pszPath != NULL) { free(pszPath); @@ -334,6 +336,7 @@ CODEmodInit_QueryRegCFSLineHdlr CHKiRet(omsdRegCFSLineHdlr((uchar *)"klogpermitnonkernelfacility", 0, eCmdHdlrBinary, NULL, &bPermitNonKernel, STD_LOADABLE_MODULE_ID)); CHKiRet(omsdRegCFSLineHdlr((uchar *)"klogconsoleloglevel", 0, eCmdHdlrInt, NULL, &console_log_level, STD_LOADABLE_MODULE_ID)); CHKiRet(omsdRegCFSLineHdlr((uchar *)"kloginternalmsgfacility", 0, eCmdHdlrFacility, NULL, &iFacilIntMsg, STD_LOADABLE_MODULE_ID)); + CHKiRet(omsdRegCFSLineHdlr((uchar *)"klogparsekerneltimestamp", 0, eCmdHdlrBinary, NULL, &bParseKernelStamp, STD_LOADABLE_MODULE_ID)); CHKiRet(omsdRegCFSLineHdlr((uchar *)"klogkeepkerneltimestamp", 0, eCmdHdlrBinary, NULL, &bKeepKernelStamp, STD_LOADABLE_MODULE_ID)); CHKiRet(omsdRegCFSLineHdlr((uchar *)"resetconfigvariables", 1, eCmdHdlrCustomHandler, resetConfigVariables, NULL, STD_LOADABLE_MODULE_ID)); ENDmodInit diff --git a/plugins/imklog/imklog.h b/plugins/imklog/imklog.h index 03fb973..c93a53b 100644 --- a/plugins/imklog/imklog.h +++ b/plugins/imklog/imklog.h @@ -52,6 +52,7 @@ extern char *symfile; extern int console_log_level; extern int dbgPrintSymbols; extern uchar *pszPath; +extern int bParseKernelStamp; extern int bKeepKernelStamp; /* the functions below may be called by the drivers */ -- 1.7.10.4 ++++++ 0004-imklog-convert-to-kmsg-timestamp-s-us-to-ns-first.patch ++++++

From 3ba75ad2f5338a59e1442462dff5eb83ab26cef9 Mon Sep 17 00:00:00 2001 From: Marius Tomaschewski Date: Wed, 21 Nov 2012 13:47:44 +0100 References: bnc#783967 Upstream: merged Url: http://git.adiscon.com/?p=rsyslog.git;a=commit;h=b78af2aaf546cee90671513be39... Subject: [PATCH] imklog: convert to kmsg timestamp's us to ns first

--- plugins/imklog/bsd.c | 1 + 1 Datei geändert, 1 Zeile hinzugefügt(+) diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c index 0603237..d079072 100644 --- a/plugins/imklog/bsd.c +++ b/plugins/imklog/bsd.c @@ -114,6 +114,7 @@ submitSyslog(int pri, uchar *buf) nsecs = nsecs * 10 + buf[i] - '0'; ++i; } + nsecs *= 1000; /* convert to ns first */ if(buf[i] != ']') { DBGPRINTF("no trailing ']' --> no kernel timestamp\n"); goto done; /* no TS! */ -- 1.7.10.4 ++++++ rsyslog.conf.in ++++++ ## ## === When you're using remote logging, enable on-disk queues === ## === in rsyslog.d/remote.conf. When neccesary also set the === ## === SYSLOG_REQUIRES_NETWORK=yes in /etc/sysconfig/syslog, === ## === e.g. when rsyslog has to receive on a specific IP only. === ## ## Note, that when the MYSQL, PGSQL, GSSAPI, GnuTLS or SNMP modules ## (provided in separate rsyslog-module-* packages) are enabled, the ## configuration can't be used on a system with /usr on a remote ## filesystem, except on newer systems where initrd mounts /usr. ## [The modules are linked against libraries installed bellow of ## /usr thus also installed in /usr/lib*/rsyslog because of this.] ## # # if you experience problems, check # http://www.rsyslog.com/troubleshoot for assistance # and report them at http://bugzilla.novell.com/ # # since rsyslog v3: load input modules # If you do not load inputs, nothing happens! # provides --MARK-- message capability (every 1 hour) $ModLoad immark.so $MarkMessagePeriod 3600 # provides support for local system logging (e.g. via logger command) $ModLoad imuxsock.so # reduce dupplicate log messages (last message repeated n times) $RepeatedMsgReduction on # kernel logging (may be also provided by /sbin/klogd) # see also http://www.rsyslog.com/doc-imklog.html. $ModLoad imklog.so # set log level 1 (same as in /etc/sysconfig/syslog). $klogConsoleLogLevel 1 # # Use traditional log format by default. To change a single # file to use rsyslog format (high-precision timestamps), # append ";RSYSLOG_FileFormat" to the filename. See # http://www.rsyslog.com/doc/rsyslog_conf_templates.html # for more informations. # $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # # Include config generated by /etc/init.d/syslog script # using the SYSLOGD_ADDITIONAL_SOCKET* variables in the # /etc/sysconfig/syslog file. # $IncludeConfig ADDITIONAL_SOCKETS # # Include config files, that the admin provided? : # $IncludeConfig ETC_RSYSLOG_D_GLOB ### # print most important on tty10 and on the xconsole pipe # if ( \ /* kernel up to warning except of firewall */ \ ($syslogfacility-text == 'kern') and \ ($syslogseverity <= 4 /* warning */ ) and not \ ($msg contains 'IN=' and $msg contains 'OUT=') \ ) or ( \ /* up to errors except of facility authpriv */ \ ($syslogseverity <= 3 /* errors */ ) and not \ ($syslogfacility-text == 'authpriv') \ ) \ then /dev/tty10 & |/dev/xconsole # Emergency messages to everyone logged on (wall) *.emerg :omusrmsg:* # enable this, if you want that root is informed # immediately, e.g. of logins #*.alert root # # firewall messages into separate file and stop their further processing # if ($syslogfacility-text == 'kern') and \ ($msg contains 'IN=' and $msg contains 'OUT=') \ then -/var/log/firewall & ~ # # acpid messages into separate file and stop their further processing # # => all acpid messages for debuging (uncomment if needed): #if ($programname == 'acpid' or $syslogtag == '[acpid]:') then \ # -/var/log/acpid # # => up to notice (skip info and debug) if ($programname == 'acpid' or $syslogtag == '[acpid]:') and \ ($syslogseverity <= 5 /* notice */) \ then -/var/log/acpid & ~ # # NetworkManager into separate file and stop their further processing # if ($programname == 'NetworkManager') or \ ($programname startswith 'nm-') \ then -/var/log/NetworkManager & ~ # # email-messages # mail.* -/var/log/mail mail.info -/var/log/mail.info mail.warning -/var/log/mail.warn mail.err /var/log/mail.err # # news-messages # news.crit -/var/log/news/news.crit news.err -/var/log/news/news.err news.notice -/var/log/news/news.notice # enable this, if you want to keep all news messages # in one file #news.* -/var/log/news.all # # Warnings in one file # *.=warning;*.=err -/var/log/warn *.crit /var/log/warn # # the rest in one file # *.*;mail.none;news.none -/var/log/messages # # enable this, if you want to keep all messages # in one file #*.* -/var/log/allmessages # # Some foreign boot scripts require local7 # local0,local1.* -/var/log/localmessages local2,local3.* -/var/log/localmessages local4,local5.* -/var/log/localmessages local6,local7.* -/var/log/localmessages ### ++++++ rsyslog.d.remote.conf.in ++++++ ## ## === When you're using remote logging, enable on-disk queues === ## === in rsyslog.d/remote.conf. When neccesary also set the === ## === SYSLOG_REQUIRES_NETWORK=yes in /etc/sysconfig/syslog, === ## === e.g. when rsyslog has to receive on a specific IP only. === ## ## Note, that when the MYSQL, PGSQL, GSSAPI, GnuTLS or SNMP modules ## (provided in separate rsyslog-module-* packages) are enabled, the ## configuration can't be used on a system with /usr on a remote ## filesystem, except on newer systems where initrd mounts /usr. ## [The modules are linked against libraries installed bellow of ## /usr thus also installed in /usr/lib*/rsyslog because of this.] ## # ######### Enable On-Disk queues for remote logging ########## # # An on-disk queue is created for this action. If the remote host is # down, messages are spooled to disk and sent when it is up again. # #$WorkDirectory RSYSLOG_SPOOL_DIR # where to place spool files #$ActionQueueFileName uniqName # unique name prefix for spool files #$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible) #$ActionQueueSaveOnShutdown on # save messages to disk on shutdown #$ActionQueueType LinkedList # run asynchronously #$ActionResumeRetryCount -1 # infinite retries if host is down # ######### Sending Messages to Remote Hosts ########## # Remote Logging using TCP for reliable delivery # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional #*.* @@remote-host # Remote Logging using UDP # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional #*.* @remote-host # ######### Receiving Messages from Remote Hosts ########## # TCP Syslog Server: # provides TCP syslog reception and GSS-API (if compiled to support it) #$ModLoad imtcp.so # load module ##$UDPServerAddress 10.10.0.1 # force to listen on this IP only, ## # needs SYSLOG_REQUIRES_NETWORK=yes. #$InputTCPServerRun <port> # Starts a TCP server on selected port # UDP Syslog Server: #$ModLoad imudp.so # provides UDP syslog reception ##$UDPServerAddress 10.10.0.1 # force to listen on this IP only, ## # needs SYSLOG_REQUIRES_NETWORK=yes. #$UDPServerRun 514 # start a UDP syslog server at standard port 514 ########### Encrypting Syslog Traffic with TLS ########## # -- TLS Syslog Server: ## make gtls driver the default #$DefaultNetstreamDriver gtls # ## certificate files #$DefaultNetstreamDriverCAFile ETC_RSYSLOG_D_DIR/ca.pem #$DefaultNetstreamDriverCertFile ETC_RSYSLOG_D_DIR/server_cert.pem #$DefaultNetstreamDriverKeyFile ETC_RSYSLOG_D_DIR/server_key.pem # #$ModLoad imtcp # load TCP listener # #$InputTCPServerStreamDriverMode 1 # run driver in TLS-only mode #$InputTCPServerStreamDriverAuthMode anon # client is NOT authenticated #$InputTCPServerRun 10514 # start up listener at port 10514 # # -- TLS Syslog Client: ## certificate files - just CA for a client #$DefaultNetstreamDriverCAFile ETC_RSYSLOG_D_DIR/ca.pem # ## set up the action #$DefaultNetstreamDriver gtls # use gtls netstream driver #$ActionSendStreamDriverMode 1 # require TLS for the connection #$ActionSendStreamDriverAuthMode anon # server is NOT authenticated #*.* @@(o)server.example.net:10514 # send (all) messages ++++++ rsyslog.early.conf.in ++++++ ## ## NOTE: This config file is obsolete and will be dropped in ## further package versions. Even while early syslog ## start, the /etc/rsyslog.conf file is used now. ## See rsyslog.conf and remote.conf for more details. ## ## We still ship the file, because systemd does not ## provide a way to execute syslog-service-generator. ## $IncludeConfig ETC_RSYSLOG_CONF ### ++++++ rsyslog.sysconfig ++++++ ## Type: list(@RSYSLOGD_VERSION@) ## Default: "@RSYSLOGD_VERSION@" ## Config: "" ## ServiceRestart: syslog # # The native version compatibility level of the current rsyslogd. # # Note, that this variable is read-only -- please do not change it! # Instead, please adopt the RSYSLOGD_COMPAT_VERSION variable. # # This variable will be updated while every installation/upgrade of # the rsyslog daemon package. # RSYSLOGD_NATIVE_VERSION="@RSYSLOGD_VERSION@" ## Type: integer(0:@RSYSLOGD_VERSION@) ## Default: "" ## Config: "" ## ServiceRestart: syslog # # Version compatibility level to run rsyslogd with (-c parameter). # Set to the desired version number rsyslogd shall be compatible with. # # Default is to run in native mode if the currently installed rsyslog # daemon version. # # Note: Changes to this variable may need adoption of the config file # or break features used in the /etc/init.d/syslog script by default. # RSYSLOGD_COMPAT_VERSION="" ## Type: string ## Default: "" ## Config: "" ## ServiceRestart: syslog # # Parameters for rsyslogd, except of the version compatibility (-c) # and the config file (-f), because they're used by sysconfig and # earlysysconfig init scripts. # # See also the RSYSLOGD_COMPAT_VERSION variable in this file, the # documentation provided in /usr/share/doc/packages/rsyslog/doc by # the rsyslog-doc package and the rsyslogd(8) and rsyslog.conf(5) # manual pages. # RSYSLOGD_PARAMS="" -- To unsubscribe, e-mail: opensuse-commit+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-commit+help@opensuse.org