2020-11-09 05:23:58 +01:00
|
|
|
/* SPDX-License-Identifier: LGPL-2.1-or-later */
|
2012-08-22 03:21:03 +02:00
|
|
|
|
2012-08-24 01:46:38 +02:00
|
|
|
#include <stddef.h>
|
2012-08-22 03:21:03 +02:00
|
|
|
#include <sys/epoll.h>
|
2015-10-24 22:58:24 +02:00
|
|
|
#include <unistd.h>
|
2012-08-22 03:21:03 +02:00
|
|
|
|
2015-10-24 22:58:24 +02:00
|
|
|
#include "sd-messages.h"
|
|
|
|
|
2015-10-27 03:01:06 +01:00
|
|
|
#include "alloc-util.h"
|
2015-10-25 13:14:12 +01:00
|
|
|
#include "fd-util.h"
|
2016-11-07 16:14:59 +01:00
|
|
|
#include "format-util.h"
|
2015-10-27 01:02:30 +01:00
|
|
|
#include "io-util.h"
|
2012-08-22 03:36:29 +02:00
|
|
|
#include "journald-console.h"
|
2015-10-24 22:58:24 +02:00
|
|
|
#include "journald-kmsg.h"
|
|
|
|
#include "journald-server.h"
|
2015-10-25 13:14:12 +01:00
|
|
|
#include "journald-syslog.h"
|
2014-03-14 00:38:15 +01:00
|
|
|
#include "journald-wall.h"
|
2015-04-10 19:10:00 +02:00
|
|
|
#include "process-util.h"
|
2015-10-24 22:58:24 +02:00
|
|
|
#include "selinux-util.h"
|
|
|
|
#include "socket-util.h"
|
2015-10-27 01:26:31 +01:00
|
|
|
#include "stdio-util.h"
|
2015-10-24 22:58:24 +02:00
|
|
|
#include "string-util.h"
|
2015-10-27 00:40:25 +01:00
|
|
|
#include "syslog-util.h"
|
2012-08-22 03:21:03 +02:00
|
|
|
|
2012-09-17 23:59:26 +02:00
|
|
|
/* Warn once every 30s if we missed syslog message */
|
|
|
|
#define WARN_FORWARD_SYSLOG_MISSED_USEC (30 * USEC_PER_SEC)
|
|
|
|
|
2019-11-22 15:23:17 +01:00
|
|
|
static void forward_syslog_iovec(
|
|
|
|
Server *s,
|
|
|
|
const struct iovec *iovec,
|
|
|
|
unsigned n_iovec,
|
|
|
|
const struct ucred *ucred,
|
|
|
|
const struct timeval *tv) {
|
2013-03-25 00:59:00 +01:00
|
|
|
|
2020-03-02 14:44:31 +01:00
|
|
|
union sockaddr_union sa;
|
|
|
|
|
2013-03-25 00:59:00 +01:00
|
|
|
struct msghdr msghdr = {
|
|
|
|
.msg_iov = (struct iovec *) iovec,
|
|
|
|
.msg_iovlen = n_iovec,
|
|
|
|
};
|
2012-08-22 03:21:03 +02:00
|
|
|
struct cmsghdr *cmsg;
|
2020-04-24 23:54:25 +02:00
|
|
|
CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(struct ucred))) control;
|
2019-11-25 15:00:38 +01:00
|
|
|
const char *j;
|
|
|
|
int r;
|
2012-08-22 03:21:03 +02:00
|
|
|
|
|
|
|
assert(s);
|
|
|
|
assert(iovec);
|
|
|
|
assert(n_iovec > 0);
|
|
|
|
|
2019-11-25 15:00:38 +01:00
|
|
|
j = strjoina(s->runtime_directory, "/syslog");
|
|
|
|
r = sockaddr_un_set_path(&sa.un, j);
|
|
|
|
if (r < 0) {
|
|
|
|
log_debug_errno(r, "Forwarding socket path %s too long for AF_UNIX, not forwarding: %m", j);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2020-03-02 14:44:31 +01:00
|
|
|
msghdr.msg_name = &sa.sa;
|
|
|
|
msghdr.msg_namelen = r;
|
|
|
|
|
2012-08-22 03:21:03 +02:00
|
|
|
if (ucred) {
|
|
|
|
zero(control);
|
|
|
|
msghdr.msg_control = &control;
|
|
|
|
msghdr.msg_controllen = sizeof(control);
|
|
|
|
|
|
|
|
cmsg = CMSG_FIRSTHDR(&msghdr);
|
|
|
|
cmsg->cmsg_level = SOL_SOCKET;
|
|
|
|
cmsg->cmsg_type = SCM_CREDENTIALS;
|
|
|
|
cmsg->cmsg_len = CMSG_LEN(sizeof(struct ucred));
|
|
|
|
memcpy(CMSG_DATA(cmsg), ucred, sizeof(struct ucred));
|
|
|
|
msghdr.msg_controllen = cmsg->cmsg_len;
|
|
|
|
}
|
|
|
|
|
2020-10-26 16:31:07 +01:00
|
|
|
/* Forward the syslog message we received via /dev/log to /run/systemd/syslog. Unfortunately we
|
|
|
|
* currently can't set the SO_TIMESTAMP auxiliary data, and hence we don't. */
|
2012-08-22 03:21:03 +02:00
|
|
|
|
|
|
|
if (sendmsg(s->syslog_fd, &msghdr, MSG_NOSIGNAL) >= 0)
|
|
|
|
return;
|
|
|
|
|
|
|
|
/* The socket is full? I guess the syslog implementation is
|
|
|
|
* too slow, and we shouldn't wait for that... */
|
2012-09-17 23:59:26 +02:00
|
|
|
if (errno == EAGAIN) {
|
|
|
|
s->n_forward_syslog_missed++;
|
2012-08-22 03:21:03 +02:00
|
|
|
return;
|
2012-09-17 23:59:26 +02:00
|
|
|
}
|
2012-08-22 03:21:03 +02:00
|
|
|
|
2017-09-29 00:37:23 +02:00
|
|
|
if (ucred && IN_SET(errno, ESRCH, EPERM)) {
|
2012-08-22 03:21:03 +02:00
|
|
|
struct ucred u;
|
|
|
|
|
|
|
|
/* Hmm, presumably the sender process vanished
|
2015-01-13 11:53:25 +01:00
|
|
|
* by now, or we don't have CAP_SYS_AMDIN, so
|
|
|
|
* let's fix it as good as we can, and retry */
|
2012-08-22 03:21:03 +02:00
|
|
|
|
|
|
|
u = *ucred;
|
2017-07-20 16:19:18 +02:00
|
|
|
u.pid = getpid_cached();
|
2012-08-22 03:21:03 +02:00
|
|
|
memcpy(CMSG_DATA(cmsg), &u, sizeof(struct ucred));
|
|
|
|
|
|
|
|
if (sendmsg(s->syslog_fd, &msghdr, MSG_NOSIGNAL) >= 0)
|
|
|
|
return;
|
|
|
|
|
2012-09-17 23:59:26 +02:00
|
|
|
if (errno == EAGAIN) {
|
|
|
|
s->n_forward_syslog_missed++;
|
2012-08-22 03:21:03 +02:00
|
|
|
return;
|
2012-09-17 23:59:26 +02:00
|
|
|
}
|
2012-08-22 03:21:03 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
if (errno != ENOENT)
|
2014-11-28 19:29:59 +01:00
|
|
|
log_debug_errno(errno, "Failed to forward syslog message: %m");
|
2012-08-22 03:21:03 +02:00
|
|
|
}
|
|
|
|
|
2018-05-30 16:27:22 +02:00
|
|
|
static void forward_syslog_raw(Server *s, int priority, const char *buffer, size_t buffer_len, const struct ucred *ucred, const struct timeval *tv) {
|
2012-08-22 03:21:03 +02:00
|
|
|
struct iovec iovec;
|
|
|
|
|
|
|
|
assert(s);
|
|
|
|
assert(buffer);
|
|
|
|
|
|
|
|
if (LOG_PRI(priority) > s->max_level_syslog)
|
|
|
|
return;
|
|
|
|
|
2018-05-30 16:27:22 +02:00
|
|
|
iovec = IOVEC_MAKE((char *) buffer, buffer_len);
|
2012-08-22 03:21:03 +02:00
|
|
|
forward_syslog_iovec(s, &iovec, 1, ucred, tv);
|
|
|
|
}
|
|
|
|
|
2014-11-02 21:46:42 +01:00
|
|
|
void server_forward_syslog(Server *s, int priority, const char *identifier, const char *message, const struct ucred *ucred, const struct timeval *tv) {
|
2012-08-22 03:21:03 +02:00
|
|
|
struct iovec iovec[5];
|
2015-02-03 18:17:00 +01:00
|
|
|
char header_priority[DECIMAL_STR_MAX(priority) + 3], header_time[64],
|
2017-12-14 19:02:29 +01:00
|
|
|
header_pid[STRLEN("[]: ") + DECIMAL_STR_MAX(pid_t) + 1];
|
2012-08-22 03:21:03 +02:00
|
|
|
int n = 0;
|
|
|
|
time_t t;
|
2018-06-25 19:55:25 +02:00
|
|
|
struct tm tm;
|
2017-09-21 13:52:34 +02:00
|
|
|
_cleanup_free_ char *ident_buf = NULL;
|
2012-08-22 03:21:03 +02:00
|
|
|
|
|
|
|
assert(s);
|
|
|
|
assert(priority >= 0);
|
|
|
|
assert(priority <= 999);
|
|
|
|
assert(message);
|
|
|
|
|
|
|
|
if (LOG_PRI(priority) > s->max_level_syslog)
|
|
|
|
return;
|
|
|
|
|
|
|
|
/* First: priority field */
|
2015-01-27 14:00:11 +01:00
|
|
|
xsprintf(header_priority, "<%i>", priority);
|
2017-09-21 13:52:34 +02:00
|
|
|
iovec[n++] = IOVEC_MAKE_STRING(header_priority);
|
2012-08-22 03:21:03 +02:00
|
|
|
|
|
|
|
/* Second: timestamp */
|
|
|
|
t = tv ? tv->tv_sec : ((time_t) (now(CLOCK_REALTIME) / USEC_PER_SEC));
|
2018-06-25 19:55:25 +02:00
|
|
|
if (!localtime_r(&t, &tm))
|
2012-08-22 03:21:03 +02:00
|
|
|
return;
|
2018-06-25 19:55:25 +02:00
|
|
|
if (strftime(header_time, sizeof(header_time), "%h %e %T ", &tm) <= 0)
|
2012-08-22 03:21:03 +02:00
|
|
|
return;
|
2017-09-21 13:52:34 +02:00
|
|
|
iovec[n++] = IOVEC_MAKE_STRING(header_time);
|
2012-08-22 03:21:03 +02:00
|
|
|
|
|
|
|
/* Third: identifier and PID */
|
|
|
|
if (ucred) {
|
|
|
|
if (!identifier) {
|
2020-10-27 09:55:59 +01:00
|
|
|
(void) get_process_comm(ucred->pid, &ident_buf);
|
2012-08-22 03:21:03 +02:00
|
|
|
identifier = ident_buf;
|
|
|
|
}
|
|
|
|
|
2015-01-27 14:00:11 +01:00
|
|
|
xsprintf(header_pid, "["PID_FMT"]: ", ucred->pid);
|
2012-08-22 03:21:03 +02:00
|
|
|
|
|
|
|
if (identifier)
|
2017-09-21 13:52:34 +02:00
|
|
|
iovec[n++] = IOVEC_MAKE_STRING(identifier);
|
2012-08-22 03:21:03 +02:00
|
|
|
|
2017-09-21 13:52:34 +02:00
|
|
|
iovec[n++] = IOVEC_MAKE_STRING(header_pid);
|
2012-08-22 03:21:03 +02:00
|
|
|
} else if (identifier) {
|
2017-09-21 13:52:34 +02:00
|
|
|
iovec[n++] = IOVEC_MAKE_STRING(identifier);
|
|
|
|
iovec[n++] = IOVEC_MAKE_STRING(": ");
|
2012-08-22 03:21:03 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Fourth: message */
|
2017-09-21 13:52:34 +02:00
|
|
|
iovec[n++] = IOVEC_MAKE_STRING(message);
|
2012-08-22 03:21:03 +02:00
|
|
|
|
|
|
|
forward_syslog_iovec(s, iovec, n, ucred, tv);
|
|
|
|
}
|
|
|
|
|
|
|
|
int syslog_fixup_facility(int priority) {
|
|
|
|
|
|
|
|
if ((priority & LOG_FACMASK) == 0)
|
|
|
|
return (priority & LOG_PRIMASK) | LOG_USER;
|
|
|
|
|
|
|
|
return priority;
|
|
|
|
}
|
|
|
|
|
2012-10-13 11:31:54 +02:00
|
|
|
size_t syslog_parse_identifier(const char **buf, char **identifier, char **pid) {
|
2012-08-22 03:21:03 +02:00
|
|
|
const char *p;
|
|
|
|
char *t;
|
|
|
|
size_t l, e;
|
|
|
|
|
|
|
|
assert(buf);
|
|
|
|
assert(identifier);
|
|
|
|
assert(pid);
|
|
|
|
|
|
|
|
p = *buf;
|
|
|
|
|
|
|
|
p += strspn(p, WHITESPACE);
|
|
|
|
l = strcspn(p, WHITESPACE);
|
|
|
|
|
|
|
|
if (l <= 0 ||
|
|
|
|
p[l-1] != ':')
|
2012-10-13 11:31:54 +02:00
|
|
|
return 0;
|
2012-08-22 03:21:03 +02:00
|
|
|
|
|
|
|
e = l;
|
|
|
|
l--;
|
|
|
|
|
2018-08-08 08:06:36 +02:00
|
|
|
if (l > 0 && p[l-1] == ']') {
|
2012-08-22 03:21:03 +02:00
|
|
|
size_t k = l-1;
|
|
|
|
|
|
|
|
for (;;) {
|
|
|
|
|
|
|
|
if (p[k] == '[') {
|
|
|
|
t = strndup(p+k+1, l-k-2);
|
|
|
|
if (t)
|
|
|
|
*pid = t;
|
|
|
|
|
|
|
|
l = k;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (k == 0)
|
|
|
|
break;
|
|
|
|
|
|
|
|
k--;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
t = strndup(p, l);
|
|
|
|
if (t)
|
|
|
|
*identifier = t;
|
|
|
|
|
2018-08-10 04:07:54 +02:00
|
|
|
/* Single space is used as separator */
|
|
|
|
if (p[e] != '\0' && strchr(WHITESPACE, p[e]))
|
|
|
|
e++;
|
2018-08-08 08:06:36 +02:00
|
|
|
|
2018-08-10 14:55:09 +02:00
|
|
|
l = (p - *buf) + e;
|
2012-08-22 03:21:03 +02:00
|
|
|
*buf = p + e;
|
2018-08-10 14:55:09 +02:00
|
|
|
return l;
|
2012-08-22 03:21:03 +02:00
|
|
|
}
|
|
|
|
|
2018-07-05 00:17:55 +02:00
|
|
|
static int syslog_skip_timestamp(const char **buf) {
|
2012-08-22 03:24:46 +02:00
|
|
|
enum {
|
|
|
|
LETTER,
|
|
|
|
SPACE,
|
|
|
|
NUMBER,
|
|
|
|
SPACE_OR_NUMBER,
|
|
|
|
COLON
|
|
|
|
} sequence[] = {
|
|
|
|
LETTER, LETTER, LETTER,
|
|
|
|
SPACE,
|
|
|
|
SPACE_OR_NUMBER, NUMBER,
|
|
|
|
SPACE,
|
|
|
|
SPACE_OR_NUMBER, NUMBER,
|
|
|
|
COLON,
|
|
|
|
SPACE_OR_NUMBER, NUMBER,
|
|
|
|
COLON,
|
|
|
|
SPACE_OR_NUMBER, NUMBER,
|
|
|
|
SPACE
|
|
|
|
};
|
|
|
|
|
2018-07-05 00:17:55 +02:00
|
|
|
const char *p, *t;
|
2012-08-22 03:24:46 +02:00
|
|
|
unsigned i;
|
|
|
|
|
|
|
|
assert(buf);
|
|
|
|
assert(*buf);
|
|
|
|
|
2018-07-05 00:17:55 +02:00
|
|
|
for (i = 0, p = *buf; i < ELEMENTSOF(sequence); i++, p++) {
|
2012-08-22 03:24:46 +02:00
|
|
|
if (!*p)
|
2018-07-05 00:17:55 +02:00
|
|
|
return 0;
|
2012-08-22 03:24:46 +02:00
|
|
|
|
|
|
|
switch (sequence[i]) {
|
|
|
|
|
|
|
|
case SPACE:
|
|
|
|
if (*p != ' ')
|
2018-07-05 00:17:55 +02:00
|
|
|
return 0;
|
2012-08-22 03:24:46 +02:00
|
|
|
break;
|
|
|
|
|
|
|
|
case SPACE_OR_NUMBER:
|
|
|
|
if (*p == ' ')
|
|
|
|
break;
|
|
|
|
|
2017-11-19 19:06:10 +01:00
|
|
|
_fallthrough_;
|
2012-08-22 03:24:46 +02:00
|
|
|
case NUMBER:
|
|
|
|
if (*p < '0' || *p > '9')
|
2018-07-05 00:17:55 +02:00
|
|
|
return 0;
|
2012-08-22 03:24:46 +02:00
|
|
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
case LETTER:
|
|
|
|
if (!(*p >= 'A' && *p <= 'Z') &&
|
|
|
|
!(*p >= 'a' && *p <= 'z'))
|
2018-07-05 00:17:55 +02:00
|
|
|
return 0;
|
2012-08-22 03:24:46 +02:00
|
|
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
case COLON:
|
|
|
|
if (*p != ':')
|
2018-07-05 00:17:55 +02:00
|
|
|
return 0;
|
2012-08-22 03:24:46 +02:00
|
|
|
break;
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-07-05 00:17:55 +02:00
|
|
|
t = *buf;
|
2012-08-22 03:24:46 +02:00
|
|
|
*buf = p;
|
2018-07-05 00:17:55 +02:00
|
|
|
return p - t;
|
2012-08-22 03:24:46 +02:00
|
|
|
}
|
|
|
|
|
2012-08-22 03:21:03 +02:00
|
|
|
void server_process_syslog_message(
|
2016-05-05 22:26:09 +02:00
|
|
|
Server *s,
|
|
|
|
const char *buf,
|
2018-06-08 11:41:08 +02:00
|
|
|
size_t raw_len,
|
2016-05-05 22:26:09 +02:00
|
|
|
const struct ucred *ucred,
|
|
|
|
const struct timeval *tv,
|
|
|
|
const char *label,
|
|
|
|
size_t label_len) {
|
2012-08-22 03:21:03 +02:00
|
|
|
|
2018-07-05 00:17:55 +02:00
|
|
|
char *t, syslog_priority[sizeof("PRIORITY=") + DECIMAL_STR_MAX(int)],
|
|
|
|
syslog_facility[sizeof("SYSLOG_FACILITY=") + DECIMAL_STR_MAX(int)];
|
|
|
|
const char *msg, *syslog_ts, *a;
|
2018-08-08 05:50:39 +02:00
|
|
|
_cleanup_free_ char *identifier = NULL, *pid = NULL,
|
|
|
|
*dummy = NULL, *msg_msg = NULL, *msg_raw = NULL;
|
2017-07-17 23:36:35 +02:00
|
|
|
int priority = LOG_USER | LOG_INFO, r;
|
|
|
|
ClientContext *context = NULL;
|
core: implement /run/systemd/units/-based path for passing unit info from PID 1 to journald
And let's make use of it to implement two new unit settings with it:
1. LogLevelMax= is a new per-unit setting that may be used to configure
log priority filtering: set it to LogLevelMax=notice and only
messages of level "notice" and lower (i.e. more important) will be
processed, all others are dropped.
2. LogExtraFields= is a new per-unit setting for configuring per-unit
journal fields, that are implicitly included in every log record
generated by the unit's processes. It takes field/value pairs in the
form of FOO=BAR.
Also, related to this, one exisiting unit setting is ported to this new
facility:
3. The invocation ID is now pulled from /run/systemd/units/ instead of
cgroupfs xattrs. This substantially relaxes requirements of systemd
on the kernel version and the privileges it runs with (specifically,
cgroupfs xattrs are not available in containers, since they are
stored in kernel memory, and hence are unsafe to permit to lesser
privileged code).
/run/systemd/units/ is a new directory, which contains a number of files
and symlinks encoding the above information. PID 1 creates and manages
these files, and journald reads them from there.
Note that this is supposed to be a direct path between PID 1 and the
journal only, due to the special runtime environment the journal runs
in. Normally, today we shouldn't introduce new interfaces that (mis-)use
a file system as IPC framework, and instead just an IPC system, but this
is very hard to do between the journal and PID 1, as long as the IPC
system is a subject PID 1 manages, and itself a client to the journal.
This patch cleans up a couple of types used in journal code:
specifically we switch to size_t for a couple of memory-sizing values,
as size_t is the right choice for everything that is memory.
Fixes: #4089
Fixes: #3041
Fixes: #4441
2017-11-02 19:43:32 +01:00
|
|
|
struct iovec *iovec;
|
2018-07-05 00:17:55 +02:00
|
|
|
size_t n = 0, m, i, leading_ws, syslog_ts_len;
|
journal: store the original syslog input as SYSLOG_RAW=
This allows the original stream to be recreated and/or verified. The new field
is written if any stripping was done or if the input message contained embeded
NULs.
$ printf '<13>Sep 15 15:07:58 HOST: x\0y' | nc -w1 -u -U /run/systemd/journal/dev-log
$ journalctl -o json-pretty ...
{
...
"MESSAGE" : "x",
"SYSLOG_RAW" : [ 60, 49, 51, 62, 83, 101, 112, 32, 49, 53, 32, 49, 53, 58, 48, 55, 58, 53, 56, 32, 72, 79, 83, 84, 58, 32, 120, 0, 121 ]
}
$ journalctl -o export ... | cat -v
...
MESSAGE=x
SYSLOG_RAW
^]^@^@^@^@^@^@^@<13>Sep 15 15:07:58 HOST: x^@y
This mostly fixes #4863.
2018-06-08 13:52:22 +02:00
|
|
|
bool store_raw;
|
2012-08-22 03:21:03 +02:00
|
|
|
|
|
|
|
assert(s);
|
|
|
|
assert(buf);
|
2018-06-08 11:41:08 +02:00
|
|
|
/* The message cannot be empty. */
|
|
|
|
assert(raw_len > 0);
|
|
|
|
/* The buffer NUL-terminated and can be used a string. raw_len is the length
|
|
|
|
* without the terminating NUL byte, the buffer is actually one bigger. */
|
|
|
|
assert(buf[raw_len] == '\0');
|
2012-08-22 03:21:03 +02:00
|
|
|
|
core: implement /run/systemd/units/-based path for passing unit info from PID 1 to journald
And let's make use of it to implement two new unit settings with it:
1. LogLevelMax= is a new per-unit setting that may be used to configure
log priority filtering: set it to LogLevelMax=notice and only
messages of level "notice" and lower (i.e. more important) will be
processed, all others are dropped.
2. LogExtraFields= is a new per-unit setting for configuring per-unit
journal fields, that are implicitly included in every log record
generated by the unit's processes. It takes field/value pairs in the
form of FOO=BAR.
Also, related to this, one exisiting unit setting is ported to this new
facility:
3. The invocation ID is now pulled from /run/systemd/units/ instead of
cgroupfs xattrs. This substantially relaxes requirements of systemd
on the kernel version and the privileges it runs with (specifically,
cgroupfs xattrs are not available in containers, since they are
stored in kernel memory, and hence are unsafe to permit to lesser
privileged code).
/run/systemd/units/ is a new directory, which contains a number of files
and symlinks encoding the above information. PID 1 creates and manages
these files, and journald reads them from there.
Note that this is supposed to be a direct path between PID 1 and the
journal only, due to the special runtime environment the journal runs
in. Normally, today we shouldn't introduce new interfaces that (mis-)use
a file system as IPC framework, and instead just an IPC system, but this
is very hard to do between the journal and PID 1, as long as the IPC
system is a subject PID 1 manages, and itself a client to the journal.
This patch cleans up a couple of types used in journal code:
specifically we switch to size_t for a couple of memory-sizing values,
as size_t is the right choice for everything that is memory.
Fixes: #4089
Fixes: #3041
Fixes: #4441
2017-11-02 19:43:32 +01:00
|
|
|
if (ucred && pid_is_valid(ucred->pid)) {
|
|
|
|
r = client_context_get(s, ucred->pid, ucred, label, label_len, NULL, &context);
|
|
|
|
if (r < 0)
|
|
|
|
log_warning_errno(r, "Failed to retrieve credentials for PID " PID_FMT ", ignoring: %m", ucred->pid);
|
|
|
|
}
|
|
|
|
|
2018-06-08 11:41:08 +02:00
|
|
|
/* We are creating a copy of the message because we want to forward the original message
|
|
|
|
verbatim to the legacy syslog implementation */
|
|
|
|
for (i = raw_len; i > 0; i--)
|
2018-05-30 16:27:22 +02:00
|
|
|
if (!strchr(WHITESPACE, buf[i-1]))
|
|
|
|
break;
|
|
|
|
|
2018-06-08 11:41:08 +02:00
|
|
|
leading_ws = strspn(buf, WHITESPACE);
|
2018-05-30 16:27:22 +02:00
|
|
|
|
2018-08-08 05:40:44 +02:00
|
|
|
if (i == 0)
|
|
|
|
/* The message contains only whitespaces */
|
|
|
|
msg = buf + raw_len;
|
|
|
|
else if (i == raw_len)
|
2018-06-08 11:41:08 +02:00
|
|
|
/* Nice! No need to strip anything on the end, let's optimize this a bit */
|
|
|
|
msg = buf + leading_ws;
|
|
|
|
else {
|
2018-08-08 05:50:39 +02:00
|
|
|
msg = dummy = new(char, i - leading_ws + 1);
|
|
|
|
if (!dummy) {
|
|
|
|
log_oom();
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
memcpy(dummy, buf + leading_ws, i - leading_ws);
|
|
|
|
dummy[i - leading_ws] = 0;
|
2018-06-08 11:41:08 +02:00
|
|
|
}
|
2018-05-30 16:27:22 +02:00
|
|
|
|
journal: store the original syslog input as SYSLOG_RAW=
This allows the original stream to be recreated and/or verified. The new field
is written if any stripping was done or if the input message contained embeded
NULs.
$ printf '<13>Sep 15 15:07:58 HOST: x\0y' | nc -w1 -u -U /run/systemd/journal/dev-log
$ journalctl -o json-pretty ...
{
...
"MESSAGE" : "x",
"SYSLOG_RAW" : [ 60, 49, 51, 62, 83, 101, 112, 32, 49, 53, 32, 49, 53, 58, 48, 55, 58, 53, 56, 32, 72, 79, 83, 84, 58, 32, 120, 0, 121 ]
}
$ journalctl -o export ... | cat -v
...
MESSAGE=x
SYSLOG_RAW
^]^@^@^@^@^@^@^@<13>Sep 15 15:07:58 HOST: x^@y
This mostly fixes #4863.
2018-06-08 13:52:22 +02:00
|
|
|
/* We will add the SYSLOG_RAW= field when we stripped anything
|
|
|
|
* _or_ if the input message contained NUL bytes. */
|
|
|
|
store_raw = msg != buf || strlen(msg) != raw_len;
|
|
|
|
|
2018-06-08 11:41:08 +02:00
|
|
|
syslog_parse_priority(&msg, &priority, true);
|
2012-08-22 03:21:03 +02:00
|
|
|
|
core: implement /run/systemd/units/-based path for passing unit info from PID 1 to journald
And let's make use of it to implement two new unit settings with it:
1. LogLevelMax= is a new per-unit setting that may be used to configure
log priority filtering: set it to LogLevelMax=notice and only
messages of level "notice" and lower (i.e. more important) will be
processed, all others are dropped.
2. LogExtraFields= is a new per-unit setting for configuring per-unit
journal fields, that are implicitly included in every log record
generated by the unit's processes. It takes field/value pairs in the
form of FOO=BAR.
Also, related to this, one exisiting unit setting is ported to this new
facility:
3. The invocation ID is now pulled from /run/systemd/units/ instead of
cgroupfs xattrs. This substantially relaxes requirements of systemd
on the kernel version and the privileges it runs with (specifically,
cgroupfs xattrs are not available in containers, since they are
stored in kernel memory, and hence are unsafe to permit to lesser
privileged code).
/run/systemd/units/ is a new directory, which contains a number of files
and symlinks encoding the above information. PID 1 creates and manages
these files, and journald reads them from there.
Note that this is supposed to be a direct path between PID 1 and the
journal only, due to the special runtime environment the journal runs
in. Normally, today we shouldn't introduce new interfaces that (mis-)use
a file system as IPC framework, and instead just an IPC system, but this
is very hard to do between the journal and PID 1, as long as the IPC
system is a subject PID 1 manages, and itself a client to the journal.
This patch cleans up a couple of types used in journal code:
specifically we switch to size_t for a couple of memory-sizing values,
as size_t is the right choice for everything that is memory.
Fixes: #4089
Fixes: #3041
Fixes: #4441
2017-11-02 19:43:32 +01:00
|
|
|
if (!client_context_test_priority(context, priority))
|
|
|
|
return;
|
|
|
|
|
2018-07-05 00:17:55 +02:00
|
|
|
syslog_ts = msg;
|
|
|
|
syslog_ts_len = syslog_skip_timestamp(&msg);
|
|
|
|
if (syslog_ts_len == 0)
|
|
|
|
/* We failed to parse the full timestamp, store the raw message too */
|
|
|
|
store_raw = true;
|
|
|
|
|
2018-06-08 11:41:08 +02:00
|
|
|
syslog_parse_identifier(&msg, &identifier, &pid);
|
2012-08-22 03:21:03 +02:00
|
|
|
|
2018-06-08 11:41:08 +02:00
|
|
|
if (s->forward_to_syslog)
|
|
|
|
forward_syslog_raw(s, priority, buf, raw_len, ucred, tv);
|
2012-08-22 03:21:03 +02:00
|
|
|
|
|
|
|
if (s->forward_to_kmsg)
|
2018-05-30 16:27:22 +02:00
|
|
|
server_forward_kmsg(s, priority, identifier, msg, ucred);
|
2012-08-22 03:21:03 +02:00
|
|
|
|
|
|
|
if (s->forward_to_console)
|
2018-05-30 16:27:22 +02:00
|
|
|
server_forward_console(s, priority, identifier, msg, ucred);
|
2012-08-22 03:21:03 +02:00
|
|
|
|
2014-03-14 00:38:15 +01:00
|
|
|
if (s->forward_to_wall)
|
2018-05-30 16:27:22 +02:00
|
|
|
server_forward_wall(s, priority, identifier, msg, ucred);
|
2014-03-14 00:38:15 +01:00
|
|
|
|
2018-07-05 00:17:55 +02:00
|
|
|
m = N_IOVEC_META_FIELDS + 8 + client_context_extra_fields_n_iovec(context);
|
core: implement /run/systemd/units/-based path for passing unit info from PID 1 to journald
And let's make use of it to implement two new unit settings with it:
1. LogLevelMax= is a new per-unit setting that may be used to configure
log priority filtering: set it to LogLevelMax=notice and only
messages of level "notice" and lower (i.e. more important) will be
processed, all others are dropped.
2. LogExtraFields= is a new per-unit setting for configuring per-unit
journal fields, that are implicitly included in every log record
generated by the unit's processes. It takes field/value pairs in the
form of FOO=BAR.
Also, related to this, one exisiting unit setting is ported to this new
facility:
3. The invocation ID is now pulled from /run/systemd/units/ instead of
cgroupfs xattrs. This substantially relaxes requirements of systemd
on the kernel version and the privileges it runs with (specifically,
cgroupfs xattrs are not available in containers, since they are
stored in kernel memory, and hence are unsafe to permit to lesser
privileged code).
/run/systemd/units/ is a new directory, which contains a number of files
and symlinks encoding the above information. PID 1 creates and manages
these files, and journald reads them from there.
Note that this is supposed to be a direct path between PID 1 and the
journal only, due to the special runtime environment the journal runs
in. Normally, today we shouldn't introduce new interfaces that (mis-)use
a file system as IPC framework, and instead just an IPC system, but this
is very hard to do between the journal and PID 1, as long as the IPC
system is a subject PID 1 manages, and itself a client to the journal.
This patch cleans up a couple of types used in journal code:
specifically we switch to size_t for a couple of memory-sizing values,
as size_t is the right choice for everything that is memory.
Fixes: #4089
Fixes: #3041
Fixes: #4441
2017-11-02 19:43:32 +01:00
|
|
|
iovec = newa(struct iovec, m);
|
|
|
|
|
2017-09-21 13:52:34 +02:00
|
|
|
iovec[n++] = IOVEC_MAKE_STRING("_TRANSPORT=syslog");
|
2012-08-22 03:21:03 +02:00
|
|
|
|
2016-01-12 15:34:20 +01:00
|
|
|
xsprintf(syslog_priority, "PRIORITY=%i", priority & LOG_PRIMASK);
|
2017-09-21 13:52:34 +02:00
|
|
|
iovec[n++] = IOVEC_MAKE_STRING(syslog_priority);
|
2012-08-22 03:21:03 +02:00
|
|
|
|
2014-11-03 20:24:43 +01:00
|
|
|
if (priority & LOG_FACMASK) {
|
2016-01-12 15:34:20 +01:00
|
|
|
xsprintf(syslog_facility, "SYSLOG_FACILITY=%i", LOG_FAC(priority));
|
2017-09-21 13:52:34 +02:00
|
|
|
iovec[n++] = IOVEC_MAKE_STRING(syslog_facility);
|
2014-11-03 20:24:43 +01:00
|
|
|
}
|
2012-08-22 03:21:03 +02:00
|
|
|
|
|
|
|
if (identifier) {
|
2018-07-05 00:17:55 +02:00
|
|
|
a = strjoina("SYSLOG_IDENTIFIER=", identifier);
|
|
|
|
iovec[n++] = IOVEC_MAKE_STRING(a);
|
2012-08-22 03:21:03 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
if (pid) {
|
2018-07-05 00:17:55 +02:00
|
|
|
a = strjoina("SYSLOG_PID=", pid);
|
|
|
|
iovec[n++] = IOVEC_MAKE_STRING(a);
|
2012-08-22 03:21:03 +02:00
|
|
|
}
|
|
|
|
|
2018-07-05 00:17:55 +02:00
|
|
|
if (syslog_ts_len > 0) {
|
2018-10-19 17:07:46 +02:00
|
|
|
const size_t hlen = STRLEN("SYSLOG_TIMESTAMP=");
|
2018-07-05 00:17:55 +02:00
|
|
|
|
2018-08-08 05:48:47 +02:00
|
|
|
t = newa(char, hlen + syslog_ts_len);
|
2018-07-05 00:17:55 +02:00
|
|
|
memcpy(t, "SYSLOG_TIMESTAMP=", hlen);
|
|
|
|
memcpy(t + hlen, syslog_ts, syslog_ts_len);
|
|
|
|
|
|
|
|
iovec[n++] = IOVEC_MAKE(t, hlen + syslog_ts_len);
|
2012-08-22 03:21:03 +02:00
|
|
|
}
|
|
|
|
|
2018-08-08 05:50:39 +02:00
|
|
|
msg_msg = strjoin("MESSAGE=", msg);
|
|
|
|
if (!msg_msg) {
|
|
|
|
log_oom();
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
iovec[n++] = IOVEC_MAKE_STRING(msg_msg);
|
journal: store the original syslog input as SYSLOG_RAW=
This allows the original stream to be recreated and/or verified. The new field
is written if any stripping was done or if the input message contained embeded
NULs.
$ printf '<13>Sep 15 15:07:58 HOST: x\0y' | nc -w1 -u -U /run/systemd/journal/dev-log
$ journalctl -o json-pretty ...
{
...
"MESSAGE" : "x",
"SYSLOG_RAW" : [ 60, 49, 51, 62, 83, 101, 112, 32, 49, 53, 32, 49, 53, 58, 48, 55, 58, 53, 56, 32, 72, 79, 83, 84, 58, 32, 120, 0, 121 ]
}
$ journalctl -o export ... | cat -v
...
MESSAGE=x
SYSLOG_RAW
^]^@^@^@^@^@^@^@<13>Sep 15 15:07:58 HOST: x^@y
This mostly fixes #4863.
2018-06-08 13:52:22 +02:00
|
|
|
|
|
|
|
if (store_raw) {
|
2018-10-19 17:07:46 +02:00
|
|
|
const size_t hlen = STRLEN("SYSLOG_RAW=");
|
journal: store the original syslog input as SYSLOG_RAW=
This allows the original stream to be recreated and/or verified. The new field
is written if any stripping was done or if the input message contained embeded
NULs.
$ printf '<13>Sep 15 15:07:58 HOST: x\0y' | nc -w1 -u -U /run/systemd/journal/dev-log
$ journalctl -o json-pretty ...
{
...
"MESSAGE" : "x",
"SYSLOG_RAW" : [ 60, 49, 51, 62, 83, 101, 112, 32, 49, 53, 32, 49, 53, 58, 48, 55, 58, 53, 56, 32, 72, 79, 83, 84, 58, 32, 120, 0, 121 ]
}
$ journalctl -o export ... | cat -v
...
MESSAGE=x
SYSLOG_RAW
^]^@^@^@^@^@^@^@<13>Sep 15 15:07:58 HOST: x^@y
This mostly fixes #4863.
2018-06-08 13:52:22 +02:00
|
|
|
|
2018-08-08 05:50:39 +02:00
|
|
|
msg_raw = new(char, hlen + raw_len);
|
|
|
|
if (!msg_raw) {
|
|
|
|
log_oom();
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
memcpy(msg_raw, "SYSLOG_RAW=", hlen);
|
|
|
|
memcpy(msg_raw + hlen, buf, raw_len);
|
journal: store the original syslog input as SYSLOG_RAW=
This allows the original stream to be recreated and/or verified. The new field
is written if any stripping was done or if the input message contained embeded
NULs.
$ printf '<13>Sep 15 15:07:58 HOST: x\0y' | nc -w1 -u -U /run/systemd/journal/dev-log
$ journalctl -o json-pretty ...
{
...
"MESSAGE" : "x",
"SYSLOG_RAW" : [ 60, 49, 51, 62, 83, 101, 112, 32, 49, 53, 32, 49, 53, 58, 48, 55, 58, 53, 56, 32, 72, 79, 83, 84, 58, 32, 120, 0, 121 ]
}
$ journalctl -o export ... | cat -v
...
MESSAGE=x
SYSLOG_RAW
^]^@^@^@^@^@^@^@<13>Sep 15 15:07:58 HOST: x^@y
This mostly fixes #4863.
2018-06-08 13:52:22 +02:00
|
|
|
|
2018-08-08 05:50:39 +02:00
|
|
|
iovec[n++] = IOVEC_MAKE(msg_raw, hlen + raw_len);
|
journal: store the original syslog input as SYSLOG_RAW=
This allows the original stream to be recreated and/or verified. The new field
is written if any stripping was done or if the input message contained embeded
NULs.
$ printf '<13>Sep 15 15:07:58 HOST: x\0y' | nc -w1 -u -U /run/systemd/journal/dev-log
$ journalctl -o json-pretty ...
{
...
"MESSAGE" : "x",
"SYSLOG_RAW" : [ 60, 49, 51, 62, 83, 101, 112, 32, 49, 53, 32, 49, 53, 58, 48, 55, 58, 53, 56, 32, 72, 79, 83, 84, 58, 32, 120, 0, 121 ]
}
$ journalctl -o export ... | cat -v
...
MESSAGE=x
SYSLOG_RAW
^]^@^@^@^@^@^@^@<13>Sep 15 15:07:58 HOST: x^@y
This mostly fixes #4863.
2018-06-08 13:52:22 +02:00
|
|
|
}
|
2012-08-22 03:21:03 +02:00
|
|
|
|
core: implement /run/systemd/units/-based path for passing unit info from PID 1 to journald
And let's make use of it to implement two new unit settings with it:
1. LogLevelMax= is a new per-unit setting that may be used to configure
log priority filtering: set it to LogLevelMax=notice and only
messages of level "notice" and lower (i.e. more important) will be
processed, all others are dropped.
2. LogExtraFields= is a new per-unit setting for configuring per-unit
journal fields, that are implicitly included in every log record
generated by the unit's processes. It takes field/value pairs in the
form of FOO=BAR.
Also, related to this, one exisiting unit setting is ported to this new
facility:
3. The invocation ID is now pulled from /run/systemd/units/ instead of
cgroupfs xattrs. This substantially relaxes requirements of systemd
on the kernel version and the privileges it runs with (specifically,
cgroupfs xattrs are not available in containers, since they are
stored in kernel memory, and hence are unsafe to permit to lesser
privileged code).
/run/systemd/units/ is a new directory, which contains a number of files
and symlinks encoding the above information. PID 1 creates and manages
these files, and journald reads them from there.
Note that this is supposed to be a direct path between PID 1 and the
journal only, due to the special runtime environment the journal runs
in. Normally, today we shouldn't introduce new interfaces that (mis-)use
a file system as IPC framework, and instead just an IPC system, but this
is very hard to do between the journal and PID 1, as long as the IPC
system is a subject PID 1 manages, and itself a client to the journal.
This patch cleans up a couple of types used in journal code:
specifically we switch to size_t for a couple of memory-sizing values,
as size_t is the right choice for everything that is memory.
Fixes: #4089
Fixes: #3041
Fixes: #4441
2017-11-02 19:43:32 +01:00
|
|
|
server_dispatch_message(s, iovec, n, m, context, tv, priority, 0);
|
2012-08-22 03:21:03 +02:00
|
|
|
}
|
|
|
|
|
2019-11-25 15:00:38 +01:00
|
|
|
int server_open_syslog_socket(Server *s, const char *syslog_socket) {
|
2014-11-02 21:46:42 +01:00
|
|
|
int r;
|
2012-08-22 03:21:03 +02:00
|
|
|
|
|
|
|
assert(s);
|
2019-11-25 15:00:38 +01:00
|
|
|
assert(syslog_socket);
|
2012-08-22 03:21:03 +02:00
|
|
|
|
|
|
|
if (s->syslog_fd < 0) {
|
2020-03-02 15:51:31 +01:00
|
|
|
union sockaddr_union sa;
|
|
|
|
socklen_t sa_len;
|
2019-11-25 15:00:38 +01:00
|
|
|
|
|
|
|
r = sockaddr_un_set_path(&sa.un, syslog_socket);
|
|
|
|
if (r < 0)
|
|
|
|
return log_error_errno(r, "Unable to use namespace path %s for AF_UNIX socket: %m", syslog_socket);
|
2020-03-02 15:51:31 +01:00
|
|
|
sa_len = r;
|
2019-11-25 15:00:38 +01:00
|
|
|
|
2012-08-22 03:21:03 +02:00
|
|
|
s->syslog_fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
|
2014-11-28 19:57:32 +01:00
|
|
|
if (s->syslog_fd < 0)
|
|
|
|
return log_error_errno(errno, "socket() failed: %m");
|
2012-08-22 03:21:03 +02:00
|
|
|
|
2018-10-15 12:08:30 +02:00
|
|
|
(void) sockaddr_un_unlink(&sa.un);
|
2012-08-22 03:21:03 +02:00
|
|
|
|
2020-03-02 15:51:31 +01:00
|
|
|
r = bind(s->syslog_fd, &sa.sa, sa_len);
|
2014-11-28 19:57:32 +01:00
|
|
|
if (r < 0)
|
|
|
|
return log_error_errno(errno, "bind(%s) failed: %m", sa.un.sun_path);
|
2012-08-22 03:21:03 +02:00
|
|
|
|
2015-04-13 04:43:08 +02:00
|
|
|
(void) chmod(sa.un.sun_path, 0666);
|
2012-08-22 03:21:03 +02:00
|
|
|
} else
|
2018-10-12 18:26:02 +02:00
|
|
|
(void) fd_nonblock(s->syslog_fd, true);
|
2012-08-22 03:21:03 +02:00
|
|
|
|
2018-10-18 19:48:18 +02:00
|
|
|
r = setsockopt_int(s->syslog_fd, SOL_SOCKET, SO_PASSCRED, true);
|
2014-11-28 19:57:32 +01:00
|
|
|
if (r < 0)
|
2018-10-18 19:48:18 +02:00
|
|
|
return log_error_errno(r, "SO_PASSCRED failed: %m");
|
2012-08-22 03:21:03 +02:00
|
|
|
|
2017-05-02 18:42:19 +02:00
|
|
|
if (mac_selinux_use()) {
|
2018-10-18 19:48:18 +02:00
|
|
|
r = setsockopt_int(s->syslog_fd, SOL_SOCKET, SO_PASSSEC, true);
|
2013-10-10 16:35:44 +02:00
|
|
|
if (r < 0)
|
2018-10-18 19:48:18 +02:00
|
|
|
log_warning_errno(r, "SO_PASSSEC failed: %m");
|
2013-10-10 16:35:44 +02:00
|
|
|
}
|
2012-08-22 03:21:03 +02:00
|
|
|
|
2018-10-18 19:48:18 +02:00
|
|
|
r = setsockopt_int(s->syslog_fd, SOL_SOCKET, SO_TIMESTAMP, true);
|
2014-11-28 19:57:32 +01:00
|
|
|
if (r < 0)
|
2018-10-18 19:48:18 +02:00
|
|
|
return log_error_errno(r, "SO_TIMESTAMP failed: %m");
|
2012-08-22 03:21:03 +02:00
|
|
|
|
2015-01-04 22:09:07 +01:00
|
|
|
r = sd_event_add_io(s->event, &s->syslog_event_source, s->syslog_fd, EPOLLIN, server_process_datagram, s);
|
2014-11-28 18:23:20 +01:00
|
|
|
if (r < 0)
|
|
|
|
return log_error_errno(r, "Failed to add syslog server fd to event loop: %m");
|
2012-08-22 03:21:03 +02:00
|
|
|
|
2016-01-08 21:11:44 +01:00
|
|
|
r = sd_event_source_set_priority(s->syslog_event_source, SD_EVENT_PRIORITY_NORMAL+5);
|
|
|
|
if (r < 0)
|
|
|
|
return log_error_errno(r, "Failed to adjust syslog event source priority: %m");
|
|
|
|
|
2012-08-22 03:21:03 +02:00
|
|
|
return 0;
|
|
|
|
}
|
2012-09-17 23:59:26 +02:00
|
|
|
|
|
|
|
void server_maybe_warn_forward_syslog_missed(Server *s) {
|
|
|
|
usec_t n;
|
2016-05-05 22:24:36 +02:00
|
|
|
|
2012-09-17 23:59:26 +02:00
|
|
|
assert(s);
|
|
|
|
|
|
|
|
if (s->n_forward_syslog_missed <= 0)
|
|
|
|
return;
|
|
|
|
|
|
|
|
n = now(CLOCK_MONOTONIC);
|
|
|
|
if (s->last_warn_forward_syslog_missed + WARN_FORWARD_SYSLOG_MISSED_USEC > n)
|
|
|
|
return;
|
|
|
|
|
2017-10-30 20:01:50 +01:00
|
|
|
server_driver_message(s, 0,
|
tree-wide: add SD_ID128_MAKE_STR, remove LOG_MESSAGE_ID
Embedding sd_id128_t's in constant strings was rather cumbersome. We had
SD_ID128_CONST_STR which returned a const char[], but it had two problems:
- it wasn't possible to statically concatanate this array with a normal string
- gcc wasn't really able to optimize this, and generated code to perform the
"conversion" at runtime.
Because of this, even our own code in coredumpctl wasn't using
SD_ID128_CONST_STR.
Add a new macro to generate a constant string: SD_ID128_MAKE_STR.
It is not as elegant as SD_ID128_CONST_STR, because it requires a repetition
of the numbers, but in practice it is more convenient to use, and allows gcc
to generate smarter code:
$ size .libs/systemd{,-logind,-journald}{.old,}
text data bss dec hex filename
1265204 149564 4808 1419576 15a938 .libs/systemd.old
1260268 149564 4808 1414640 1595f0 .libs/systemd
246805 13852 209 260866 3fb02 .libs/systemd-logind.old
240973 13852 209 255034 3e43a .libs/systemd-logind
146839 4984 34 151857 25131 .libs/systemd-journald.old
146391 4984 34 151409 24f71 .libs/systemd-journald
It is also much easier to check if a certain binary uses a certain MESSAGE_ID:
$ strings .libs/systemd.old|grep MESSAGE_ID
MESSAGE_ID=%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x
MESSAGE_ID=%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x
MESSAGE_ID=%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x
MESSAGE_ID=%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x
$ strings .libs/systemd|grep MESSAGE_ID
MESSAGE_ID=c7a787079b354eaaa9e77b371893cd27
MESSAGE_ID=b07a249cd024414a82dd00cd181378ff
MESSAGE_ID=641257651c1b4ec9a8624d7a40a9e1e7
MESSAGE_ID=de5b426a63be47a7b6ac3eaac82e2f6f
MESSAGE_ID=d34d037fff1847e6ae669a370e694725
MESSAGE_ID=7d4958e842da4a758f6c1cdc7b36dcc5
MESSAGE_ID=1dee0369c7fc4736b7099b38ecb46ee7
MESSAGE_ID=39f53479d3a045ac8e11786248231fbf
MESSAGE_ID=be02cf6855d2428ba40df7e9d022f03d
MESSAGE_ID=7b05ebc668384222baa8881179cfda54
MESSAGE_ID=9d1aaa27d60140bd96365438aad20286
2016-11-06 18:48:23 +01:00
|
|
|
"MESSAGE_ID=" SD_MESSAGE_FORWARD_SYSLOG_MISSED_STR,
|
2015-11-08 20:05:55 +01:00
|
|
|
LOG_MESSAGE("Forwarding to syslog missed %u messages.",
|
|
|
|
s->n_forward_syslog_missed),
|
|
|
|
NULL);
|
2012-09-17 23:59:26 +02:00
|
|
|
|
|
|
|
s->n_forward_syslog_missed = 0;
|
|
|
|
s->last_warn_forward_syslog_missed = n;
|
|
|
|
}
|