Hi,
I want to store all syslog messages received from a specific host
into a single log file. For programs this is already implemented
for !prog blocks. So do the same with +host for hostnames.
This implementation is based on a diff that Gregory Edigarov sent
to me. So there is at least one other user who needs this.
I have an alternative diff, that changes the facility in the sending
syslogd. When you specify @remotehost:514/local7 in the sending
syslog.conf, then you can use the facilty on the receiving side to
split the messages.
What is the best solution?
- Match on the hostname at the receiving side.
- Change the facility at the sending side.
- Commit both and let the user configure what fits in his environmet.
bluhm
Index: usr.sbin/syslogd/syslog.conf.5
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/usr.sbin/syslogd/syslog.conf.5,v
retrieving revision 1.31
diff -u -p -r1.31 syslog.conf.5
--- usr.sbin/syslogd/syslog.conf.5 10 Feb 2015 18:42:08 -0000 1.31
+++ usr.sbin/syslogd/syslog.conf.5 27 Jun 2015 21:09:02 -0000
@@ -121,6 +121,17 @@ can be used to ensure that any ensuing b
or
.Em !!prog ) .
.Pp
+Blocks starting with
+.Em +host
+or
+.Em ++host
+or
+.Em +*
+work the same way as their
+.Em prog
+counterparts, but they match on the hostname instead of the program
+name.
+.Pp
See
.Xr syslog 3
for further descriptions of both the
Index: usr.sbin/syslogd/syslogd.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/usr.sbin/syslogd/syslogd.c,v
retrieving revision 1.164
diff -u -p -r1.164 syslogd.c
--- usr.sbin/syslogd/syslogd.c 15 Jun 2015 21:42:15 -0000 1.164
+++ usr.sbin/syslogd/syslogd.c 28 Jun 2015 10:17:12 -0000
@@ -135,6 +135,7 @@ struct filed {
time_t f_time; /* time this was last written */
u_char f_pmask[LOG_NFACILITIES+1]; /* priority mask */
char *f_program; /* program this applies to */
+ char *f_hostname; /* host this applies to */
union {
char f_uname[MAXUNAMES][UT_NAMESIZE+1];
struct {
@@ -298,7 +299,7 @@ void ctlconn_writecb(int, short, void *
void ctlconn_logto(char *);
void ctlconn_cleanup(void);
-struct filed *cfline(char *, char *);
+struct filed *cfline(char *, char *, char *);
void cvthname(struct sockaddr *, char *, size_t);
int decode(const char *, const CODE *);
void die(int);
@@ -1131,6 +1132,9 @@ logmsg(int pri, char *msg, char *from, i
if (f->f_program)
if (strcmp(prog, f->f_program) != 0)
continue;
+ if (f->f_hostname)
+ if (strcmp(from, f->f_hostname) != 0)
+ continue;
if (f->f_type == F_CONSOLE && (flags & IGN_CONS))
continue;
@@ -1595,7 +1599,7 @@ die(int signo)
void
init(void)
{
- char prog[NAME_MAX+1], *cline, *p;
+ char progblock[NAME_MAX+1], hostblock[NAME_MAX+1], *cline, *p;
struct filed_list mb;
struct filed *f, *m;
FILE *cf;
@@ -1642,8 +1646,8 @@ init(void)
(void)close(f->f_file);
break;
}
- if (f->f_program)
- free(f->f_program);
+ free(f->f_program);
+ free(f->f_hostname);
if (f->f_type == F_MEMBUF) {
f->f_program = NULL;
dprintf("add %p to mb\n", f);
@@ -1656,9 +1660,10 @@ init(void)
/* open the configuration file */
if ((cf = priv_open_config()) == NULL) {
dprintf("cannot open %s\n", ConfFile);
- SIMPLEQ_INSERT_TAIL(&Files, cfline("*.ERR\t/dev/console", "*"),
- f_next);
- SIMPLEQ_INSERT_TAIL(&Files, cfline("*.PANIC\t*", "*"), f_next);
+ SIMPLEQ_INSERT_TAIL(&Files,
+ cfline("*.ERR\t/dev/console", "*", "*"), f_next);
+ SIMPLEQ_INSERT_TAIL(&Files,
+ cfline("*.PANIC\t*", "*", "*"), f_next);
Initialized = 1;
return;
}
@@ -1668,12 +1673,14 @@ init(void)
*/
cline = NULL;
s = 0;
- strlcpy(prog, "*", sizeof(prog));
+ strlcpy(progblock, "*", sizeof(progblock));
+ strlcpy(hostblock, "*", sizeof(hostblock));
while (getline(&cline, &s, cf) != -1) {
/*
* check for end-of-section, comments, strip off trailing
- * spaces and newline character. !prog is treated
- * specially: the following lines apply only to that program.
+ * spaces and newline character. !progblock and +hostblock
+ * are treated specially: the following lines apply only to
+ * that program.
*/
for (p = cline; isspace((unsigned char)*p); ++p)
continue;
@@ -1685,18 +1692,37 @@ init(void)
p++;
if (!*p || (*p == '*' && (!p[1] ||
isspace((unsigned char)p[1])))) {
- strlcpy(prog, "*", sizeof(prog));
+ strlcpy(progblock, "*", sizeof(progblock));
continue;
}
for (i = 0; i < NAME_MAX; i++) {
if (!isalnum((unsigned char)p[i]) &&
p[i] != '-' && p[i] != '!')
break;
- prog[i] = p[i];
+ progblock[i] = p[i];
}
- prog[i] = 0;
+ progblock[i] = 0;
continue;
}
+ if (*p == '+') {
+ p++;
+ while (isspace((unsigned char)*p))
+ p++;
+ if (!*p || (*p == '*' && (!p[1] ||
+ isspace((unsigned char)p[1])))) {
+ strlcpy(hostblock, "*", sizeof(hostblock));
+ continue;
+ }
+ for (i = 0; i < NAME_MAX; i++) {
+ if (!isalnum((unsigned char)p[i]) &&
+ p[i] != '-' && p[i] != '+')
+ break;
+ hostblock[i] = p[i];
+ }
+ hostblock[i] = 0;
+ continue;
+ }
+
p = cline + strlen(cline);
while (p > cline)
if (!isspace((unsigned char)*--p)) {
@@ -1704,7 +1730,7 @@ init(void)
break;
}
*p = '\0';
- f = cfline(cline, prog);
+ f = cfline(cline, progblock, hostblock);
if (f != NULL)
SIMPLEQ_INSERT_TAIL(&Files, f, f_next);
}
@@ -1791,8 +1817,10 @@ init(void)
break;
}
- if (f->f_program)
- printf(" (%s)", f->f_program);
+ if (f->f_program || f->f_hostname)
+ printf(" (%s, %s)",
+ f->f_program ? f->f_program : "*",
+ f->f_hostname ? f->f_hostname : "*");
printf("\n");
}
}
@@ -1818,14 +1846,21 @@ find_dup(struct filed *f)
case F_CONSOLE:
case F_PIPE:
if (strcmp(list->f_un.f_fname, f->f_un.f_fname) == 0 &&
- progmatches(list->f_program, f->f_program))
+ progmatches(list->f_program, f->f_program) &&
+ progmatches(list->f_hostname, f->f_hostname)) {
+ dprintf("duplicate %s\n", f->f_un.f_fname);
return (list);
+ }
break;
case F_MEMBUF:
if (strcmp(list->f_un.f_mb.f_mname,
f->f_un.f_mb.f_mname) == 0 &&
- progmatches(list->f_program, f->f_program))
+ progmatches(list->f_program, f->f_program) &&
+ progmatches(list->f_hostname, f->f_hostname)) {
+ dprintf("duplicate membuf %s\n",
+ f->f_un.f_mb.f_mname);
return (list);
+ }
break;
}
}
@@ -1836,7 +1871,7 @@ find_dup(struct filed *f)
* Crack a configuration file line
*/
struct filed *
-cfline(char *line, char *prog)
+cfline(char *line, char *progblock, char *hostblock)
{
int i, pri;
size_t rb_len;
@@ -1845,7 +1880,8 @@ cfline(char *line, char *prog)
struct filed *xf, *f, *d;
struct timeval to;
- dprintf("cfline(\"%s\", f, \"%s\")\n", line, prog);
+ dprintf("cfline(\"%s\", f, \"%s\", \"%s\")\n",
+ line, progblock, hostblock);
errno = 0; /* keep strerror() stuff out of logerror messages */
@@ -1857,15 +1893,19 @@ cfline(char *line, char *prog)
f->f_pmask[i] = INTERNAL_NOPRI;
/* save program name if any */
- if (*prog == '!') {
+ f->f_quick = 0;
+ if (*progblock == '!') {
+ progblock++;
f->f_quick = 1;
- prog++;
- } else
- f->f_quick = 0;
- if (!strcmp(prog, "*"))
- prog = NULL;
- else
- f->f_program = strdup(prog);
+ }
+ if (*hostblock == '+') {
+ hostblock++;
+ f->f_quick = 1;
+ }
+ if (strcmp(progblock, "*") != 0)
+ f->f_program = strdup(progblock);
+ if (strcmp(hostblock, "*") != 0)
+ f->f_hostname = strdup(hostblock);
/* scan through the list of selectors */
for (p = line; *p && *p != '\t';) {
