Re: [evlog-dev] where is patch for kernel-2.4.21-20

On Wed, 2005-01-12 at 10:55 -0800, Hien Nguyen wrote:
> ...
> If all you need is to forward syslog to evlog then you don't need to
> patch kernel with evlog patch.
> ...
> Regarding slog_fwd, do you have any error message when you run that
> command. What is your libc.so version? Modify libc.so.x in
> /etc/evlog.d/libevlsyslog.conf with your libc.so version.

> soft rabbit wrote:
> 
> > ...There is another
> > problem exist when I forward the syslog to evlog, i use command
> > slog_fwd, but it cannot work....

I also have had trouble with slog_fwd.  After some consideration, it
seemed more supportable to modify sysklogd to be evlog-aware, rather
than use the slog_fwd hook.  Attached is a patch that applies cleanly to
the Debian version of sysklogd.  (Tested on 1.4.1-15 and 1.4.1-16, on an
ia64 platform.)  I don't know how different the Debian syslog source is
from upstream.

Using a patched version of sysklogd, the /etc/syslog.conf file will
recognize syntax such as:

  *.*;auth,authpriv.none          %evlog

and do the right thing.  As Hien points out, no kernel modifications are
necessary to get this level of functionality.

Hien, could I also get your (and the other developer's) comments on this
approach?  I assume you've considered it before.  From what I can tell:

  Positive
    Very straightforward approach
    Less version dependencies, more supportable
  Negative
    More overhead in logging from the kernel to evlog
    Requires that the syslog maintainer accept this patch

The last is probably the killer, unless evlog becomes more common.  

Also, in order for other mainstream packages to become evlog-aware,
evlog source should probably provide a small compile-only package
(probably just the necessary header files) so that something like an
evlog-aware sysklogd could be built without evlog being present on the
installed system.

Thoughts or comments.  Start a new thread for this discussion?

-- 
Bryan Sutula <[email protected]>
----------------------------------------------------


Index: debian/control
===================================================================
--- debian/control	(.../ags/cglinux/userspace/sysklogd/1.4.1-15)	(revision 2901)
+++ debian/control	(.../runk/cglinux/userspace/sysklogd)	(revision 2901)
@@ -2,11 +2,12 @@
 Section: base
 Priority: important
 Maintainer: Martin Schulze <[email protected]>
+Build-depends: evlog-dev (>=1.6.0)
 Standards-Version: 3.5.6.0
 
 Package: sysklogd
 Architecture: any
-Depends: ${shlibs:Depends}, klogd | linux-kernel-log-daemon
+Depends: ${shlibs:Depends}, klogd | linux-kernel-log-daemon, evlog (>= 1.6.0)
 Conflicts: syslogd
 Provides: syslogd, system-log-daemon
 Replaces: syslogd
Index: debian/changelog
===================================================================
--- debian/changelog	(.../ags/cglinux/userspace/sysklogd/1.4.1-15)	(revision 2901)
+++ debian/changelog	(.../runk/cglinux/userspace/sysklogd)	(revision 2901)
@@ -1,3 +1,18 @@
+sysklogd (1.4.1-15.1) unstable; urgency=low
+
+  * One comment change to the beta version below, updating version for
+    potential release, pending QA.
+  * Fixed build dependency line in wrong section of debian/control
+  * Updated man pages to reflect evlog addition
+
+ -- Bryan Sutula <[email protected]>  Sun, 07 Nov 2004 01:51:54 -0700
+
+sysklogd (1.4.1-15.0beta1) unstable; urgency=low
+
+  * Bryan's initial mods to add evlog as a logging destination.
+
+ -- Bryan Sutula <[email protected]>  Mon, 12 Oct 2004 14:35:00 -0600
+
 sysklogd (1.4.1-15) unstable; urgency=low
 
   * Applied patch by Steve Grubb <[email protected]> to adjust memory
Index: sysklogd.8
===================================================================
--- sysklogd.8	(.../ags/cglinux/userspace/sysklogd/1.4.1-15)	(revision 2901)
+++ sysklogd.8	(.../runk/cglinux/userspace/sysklogd)	(revision 2901)
@@ -1,8 +1,9 @@
 .\" Copyright 1994 Dr. Greg Wettstein, Enjellic Systems Development.
 .\" May be distributed under the GNU General Public License
 .\" Sun Aug 30 11:35:55 MET: Martin Schulze: Updates
+.\" Sun, 07 Nov 2004 01:38:43 -0700: Bryan Sutula: Update
 .\"
-.TH SYSKLOGD 8 "12 October 1998" "Version 1.3" "Linux System Administration"
+.TH SYSKLOGD 8 "7 November 2004" "Version 1.4.1" "Linux System Administration"
 .SH NAME
 sysklogd \- Linux system logging utilities.
 .SH SYNOPSIS
@@ -410,6 +411,21 @@
 	# named pipe.
 	kern.=debug			|/usr/adm/debug
 .fi
+
+.SH OUTPUT TO EVLOG EVENT LOGGING SYSTEM
+This version of syslogd has support for logging output to the evlog
+event logging system.  In order to log to evlog, use the special destination
+.BR %evlog .
+.IP
+The following configuration file copies /var/log/syslog messages to
+evlog as well:
+.IP
+.nf
+	# Sample configuration to copy /var/log/syslog
+	# messages to evlog as well.
+	*.*;auth,authpriv.none          -/var/log/syslog
+	*.*;auth,authpriv.none          %evlog
+.fi
 .LP
 .SH INSTALLATION CONCERNS
 There is probably one important consideration when installing this
Index: syslogd.c
===================================================================
--- syslogd.c	(.../ags/cglinux/userspace/sysklogd/1.4.1-15)	(revision 2901)
+++ syslogd.c	(.../runk/cglinux/userspace/sysklogd)	(revision 2901)
@@ -500,6 +500,11 @@
 #include <paths.h>
 #endif
 
+#ifdef SYSLOG_EVLOG			/* Enables the ability to use evlog */
+#include <posix_evlog.h>
+#include <evlog.h>
+#endif
+
 #ifndef UTMP_FILE
 #ifdef UTMP_FILENAME
 #define UTMP_FILE UTMP_FILENAME
@@ -661,10 +666,11 @@
 #define F_FORW_SUSP	7		/* suspended host forwarding */
 #define F_FORW_UNKN	8		/* unknown host forwarding */
 #define F_PIPE		9		/* named pipe */
+#define F_EVLOG		10		/* forward to evlog subsystem */
 char	*TypeNames[] = {
 	"UNUSED",	"FILE",		"TTY",		"CONSOLE",
 	"FORW",		"USERS",	"WALL",		"FORW(SUSPENDED)",
-	"FORW(UNKNOWN)", "PIPE"
+	"FORW(UNKNOWN)", "PIPE",	"EVLOG"
 };
 
 struct	filed *Files = (struct filed *) 0;
@@ -786,7 +792,7 @@
 	int len, num_fds;
 #else /* __GLIBC__ */
 #ifndef TESTING
-	size_t len;
+	socklen_t len;
 #endif
 	int num_fds;
 #endif /* __GLIBC__ */
@@ -1864,6 +1870,68 @@
 		v->iov_len = 2;
 		wallmsg(f, iov);
 		break;
+
+#ifdef SYSLOG_EVLOG			/* Will not see this case unless
+					 * compiled with SYSLOG_EVLOG
+					 */
+	case F_EVLOG:			/* Write to evlog facility */
+		f->f_time = now;
+		dprintf("log facility: evlog\n");
+
+		/* Note in this that we aren't using any of the repeated
+		 * message stuff.  Relying on evlog's ability to take care
+		 * that, if desired.
+		 *
+		 * flags (parm 7) could include:
+		 *	EVL_KERNEL_EVENT
+		 *	EVL_INITIAL_BOOT_EVENT
+		 *	EVL_KERNTIME_LOCAL
+		 *	EVL_INTERRUPT
+		 *	EVL_PRINTK
+		 * Not including any of these right now because we don't
+		 * have this level of detail.  In particular, EVL_KERNEL_EVENT
+		 * is not allowed from userspace.
+		 *
+		 * Note that syslog LOG_PRI(pri) is identical to evlog's
+		 * posix_log_severity_t, so we won't try to translate.
+		 * Ditto for LOG_FAC(pri).
+		 */
+		{	/* Local variables will be handy */
+			int	fac = LOG_FAC(f->f_prevpri);
+			int	pri = LOG_PRI(f->f_prevpri);
+
+			/* MARK's had a bogus facility.  This could be a
+			 * syslog bug, but don't want to make that deep
+			 * of a change with this patch.
+			 */
+			if (flags & MARK) { /* MARK's had a bogus facility */
+				fac = LOG_SYSLOG >> 3;
+			}
+
+#if 0
+			/* BJS haven't looked at printk's with no <n> yet. */
+			fprintf(stderr, "debug: facility = %d, pri = %d\n",
+				fac, pri);
+#endif
+
+			errno = 0;
+			if (posix_log_write(fac << 3,
+					    fac ?
+						EVL_SYSLOG_MESSAGE :
+						EVL_PRINTK_MESSAGE,
+					    pri,
+					    f->f_prevline, f->f_prevlen + 1,
+					    POSIX_LOG_STRING, 0)) {
+				int e = errno;
+				dprintf("posix_log_write error: %d = %s.\n", 
+					e, strerror(e));
+				errno = e;
+				logerror("posix_log_write");
+			}
+		}
+		break;
+#endif
+
 	} /* switch */
 	if (f->f_type != F_FORW_UNKN)
 		f->f_prevcount = 0;
@@ -2630,6 +2698,29 @@
 #endif
 		break;
 
+	case '%':			/* As with '@', behavior is to silently
+					 * ignore config files with facilities
+					 * that haven't been compiled into
+					 * syslog.  Is this a good choice, here
+					 * and below?  BJS
+					 */
+		dprintf("logging facility: %s\n", p);	/*ASP*/
+		/* What facility is being requested? */
+		if (strcmp(++p, "evlog") == 0) {
+#ifdef SYSLOG_EVLOG
+			f->f_type = F_EVLOG;
+#endif
+		}
+		/* Other logging facilities could go here, e.g.:
+		 *	else if (strcmp(p,"xxx") == 0) {
+		 *	}
+		 */
+		else {
+			/* Same comment--silently ignoring unknown facilities */
+			dprintf("Unknown facility: %s\n", p);
+		}
+		break;
+
         case '|':
 	case '/':
 		(void) strcpy(f->f_un.f_fname, p);
Index: syslog.conf.5
===================================================================
--- syslog.conf.5	(.../ags/cglinux/userspace/sysklogd/1.4.1-15)	(revision 2901)
+++ syslog.conf.5	(.../runk/cglinux/userspace/sysklogd)	(revision 2901)
@@ -17,7 +17,9 @@
 .\" along with this program; if not, write to the Free Software
 .\" Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111, USA.
 .\"
-.TH SYSLOG.CONF 5 "1 January 1998" "Version 1.3" "Linux System Administration"
+.\" Sun, 07 Nov 2004 01:38:43 -0700: Bryan Sutula: Update
+.\"
+.TH SYSLOG.CONF 5 "7 November 2004" "Version 1.4.1" "Linux System Administration"
 .SH NAME
 syslog.conf \- syslogd(8) configuration file
 .SH DESCRIPTION
@@ -179,6 +181,15 @@
 host, if all other machines will log remotely to that.  This tears down
 administration needs.
 
+.SS Evlog Event Logging System
+This 
+.BR syslogd (8)
+allows logging to the
+.B evlog
+event logging system.
+To log to evlog, use the special destination
+.BR %evlog .
+
 .SS List of Users
 Usually critical messages are also directed to ``root'' on that
 machine.  You can specify a list of users that shall get the message by
Index: Makefile
===================================================================
--- Makefile	(.../ags/cglinux/userspace/sysklogd/1.4.1-15)	(revision 2901)
+++ Makefile	(.../runk/cglinux/userspace/sysklogd)	(revision 2901)
@@ -23,6 +23,9 @@
 # uncommenting the following define.
 # LIBS = ${LIBS} -linux
 
+# For syslog --> evlog support, need to link with libevl.a
+LIBS = -levl
+
 # Define the following to impart start-up delay in klogd.  This is
 # useful if klogd is started simultaneously or in close-proximity to syslogd.
 # KLOGD_START_DELAY = -DKLOGD_DELAY=5
@@ -45,6 +48,7 @@
 SYSLOGD_PIDNAME = -DSYSLOGD_PIDNAME=\"syslogd.pid\"
 
 SYSLOGD_FLAGS= -DSYSLOG_INET -DSYSLOG_UNIXAF -DNO_SCCS ${FSSTND} \
+	-DSYSLOG_EVLOG \
 	${SYSLOGD_PIDNAME}
 SYSLOG_FLAGS= -DALLOW_KERNEL_LOGGING
 KLOGD_FLAGS = ${FSSTND} ${KLOGD_START_DELAY}




-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt