<div dir="ltr"><div><div>Hi, <br><br></div><div>syslog-ng will happily parse RFC5424 formatted messages and can even convert RFC3164 to RFC5424 automatically. However RFC5424 only specifies network transports (in RFC5425 and 5426), and the syslog() API doesn't support that.<br>
</div><div><br></div><div>The question what you want to accomplish? if you want to send RFC5424 formatted messages, then the easiest is to format it yourself, send it using a socket and avoid using the syslog API in the libc.<br>
<br></div><div>syslog-ng will be able to parse RFC5424 even over a unix-dgram socket or a named pipe, like this:<br><br></div><div>unix-dgram("/dev/log" flags(syslog-protocol));<br><br></div><div>or<br><br></div>
<div>pipe("/tmp/named-pipe" flags(syslog-protocol));<br><br></div><div>After having received the logs this way, you need to decide the file format you want to use for your application. By default, syslog-ng uses a traditional "syslog" style output file, but you can change that too by using a custom template, that can reference RFC5424 fields:<br>
<br></div><div>file("/var/log/messages" template("$ISODATE $HOST $SDATA $MSGHDR$MSG\n"));<br><br></div><div>In this example, you'd add this would include structured data in your file format. You can also use straight RFC5424 records within a file, but that's not easily readable, but you can do that:<br>
<br>file("/var/log/messages" flags(syslog-protocol));<br><br></div><div>Or you can mimic the same format using the template() option.<br><br></div><div>Hope this helps,<br>Bazsi<br><br></div><div><br></div></div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Aug 7, 2014 at 4:11 PM, Jean Faye <span dir="ltr"><<a href="mailto:ismael.faye@yahoo.fr" target="_blank">ismael.faye@yahoo.fr</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div style="color:#000;background-color:#fff;font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;font-size:12pt">
<div><span>Hi all,</span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;background-color:transparent;font-style:normal"><span>Thank you for your answer. Now I am using unix-dgram("/dev/log") and it's working. I see my logs in the destination files.</span></div>
<div style="color:rgb(0,0,0);font-size:16px;font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;background-color:transparent;font-style:normal"><br><span></span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;background-color:transparent;font-style:normal">
<span>But those logs are not in IETF syslog format (RFC5424). I have this kind of logs:</span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;background-color:transparent;font-style:normal">
<br></div><div style="color:rgb(0,0,0);font-size:16px;font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;background-color:transparent;font-style:normal"> 2013-01-01T01:00:24+01:00 mymachine program[1173]: adjustement<br>
<span></span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;background-color:transparent;font-style:normal"><span><br></span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;background-color:transparent;font-style:normal">
<span>How can my C program generate logs in RFC5424 format? Can I still use syslog() call in C program to generate logs in RFC5424? <br></span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;background-color:transparent;font-style:normal">
<br><span></span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;background-color:transparent;font-style:normal"><span>And in order to receive the logs in RFC5424 format, is enough to have: source { unix-dgram ("/dev/log") flags(syslog-protocol);}; ?</span></div>
<div style="color:rgb(0,0,0);font-size:16px;font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;background-color:transparent;font-style:normal"><br><span></span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;background-color:transparent;font-style:normal">
<span>Concerning the date and time in the messages, what do we have to do in order to have it in UTC ?<br></span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;background-color:transparent;font-style:normal">
<br><span></span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;background-color:transparent;font-style:normal"><span>Thank you in advance.</span></div>
<div class=""><div style="color:rgb(0,0,0);font-size:16px;font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;background-color:transparent;font-style:normal"><span>Best regards,</span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;background-color:transparent;font-style:normal">
<span>Ismael Jean FAYE<br></span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;background-color:transparent;font-style:normal"><span><br>
</span></div> <div><br><br></div></div><div style="display:block"> <div style="font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;font-size:12pt"> <div style="font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;font-size:12pt">
<div dir="ltr"> <font face="Arial"> Le Mercredi 6 août 2014 17h14, Evan Rempel <<a href="mailto:erempel@uvic.ca" target="_blank">erempel@uvic.ca</a>> a écrit :<br> </font> </div><div><div class="h5"> <br><br> <div>
Your C program is using the syslog API to the kernel. This will only ever be available via<br clear="none">the /dev/log mechanism exposed by the kernel.<br clear="none"><br clear="none">Your current syslog-ng.conf
file specifies a source of<br clear="none"><br clear="none"> source s_mysource {<br clear="none"> pipe("/tmp/pipe" pad_size(2048));<br clear="none"> };<br clear="none"><br clear="none"><br clear="none">
which is not where the C call of syslog() sends the syslog messages.<br clear="none"><br clear="none">Like Balazs stated, you need to use the syslog-ng system() source or define a syslog-ng source containing unix-dgram("/dev/log")<br clear="none">
in order to read out the messages produced by the call to syslog() from your C program.<br clear="none"><br clear="none">Evan.<br clear="none"><br clear="none"><br clear="none">On
08/06/2014 07:49 AM, Balazs Scheidler wrote:<br clear="none">> Hi,<br clear="none">><br clear="none">> You seem to have defined the source as a named pipe whereas the libc usually uses a UNIX domain socket to send messages.<br clear="none">
><br clear="none">> Why don't you simply use the system() source? Or at least define use unix-dgram("/dev/log")<br clear="none">><br clear="none">> On Aug 6, 2014 11:11 AM, "Jean Faye" <<a shape="rect" href="mailto:ismael.faye@yahoo.fr" target="_blank">ismael.faye@yahoo.fr</a> <mailto:<a shape="rect" href="mailto:ismael.faye@yahoo.fr" target="_blank">ismael.faye@yahoo.fr</a>>> wrote:<br clear="none">
><br clear="none">><br clear="none">><br clear="none">> Hi all,<br clear="none">> I want to use syslog-ng to log the messages generated by my application implemented in C language. I added this in the code:<br clear="none">
><br clear="none">> char *log="rtcd";<br clear="none">> printf("[%s] RTC adjustement\n",__func__);<br clear="none">> openlog(log, LOG_PID, LOG_LOCAL0);<br clear="none">
> syslog(LOG_DEBUG, "[FIJ] RTC adjustement");<br clear="none">> closelog();<br clear="none">><br clear="none">><br clear="none">> For me,
according to the syslog-ng file, the files /var/log/ldb/GENTrace.log, /var/log/ldb/SUTrace.log, /var/log/ldb/WANTrace.log and /var/log/ldb/CPLTrace.log must be created and must contain the syslog message.<br clear="none">
> But I got no messages in my destination files. You can see the content of my syslog-ng.conf file bellow.<br clear="none">><br clear="none">> Is it the right way to log the messages sent by C program? What can explain that I got no messages in the destinations files?<br clear="none">
><br clear="none">> I am using syslog-ng 3.5.4.1 provided by yocto. And in the script which run the binary (initscript file) I remove the line below:<br clear="none">><br clear="none">> . /etc/init.d/functions<br clear="none">
><br clear="none">> Why are you using the line? Is it necessary to use it?<br clear="none">><br clear="none">> Concerning log file rotation, How can we manage it using syslog-ng? For example I want to have a destination file with a size maximum = 2Mo and if the size is greater than the max size, I have to save the current one and create a new one. On my system I can have max 4 files (4 x 2Mo). How can I manage this kind of rotation?<br clear="none">
><br clear="none">> Thanks in advance.<br clear="none">> Best regards,<br clear="none">> Ismael Jean FAYE<br clear="none">><br clear="none">> @version: 3.5<br clear="none">> #<br clear="none">
> # Syslog-ng configuration file, compatible with default Debian syslogd<br clear="none">> # installation. Originally written by anonymous (I can't find his name)<br clear="none">> # Revised, and rewrited by me (SZALAY Attila <<a shape="rect" href="mailto:sasa@debian.org" target="_blank">sasa@debian.org</a> <mailto:<a shape="rect" href="mailto:sasa@debian.org" target="_blank">sasa@debian.org</a>>>)<br clear="none">
><br clear="none">> # First, set some global options.<br clear="none">> options { chain_hostnames(off); flush_lines(0); use_dns(no); use_fqdn(no);<br clear="none">> owner("root"); group("adm"); perm(0640);
stats_freq(0);<br clear="none">> bad_hostname("^gconfd$");create_dirs(yes);<br clear="none">> };<br clear="none">><br clear="none">> ########################<br clear="none">> # Sources<br clear="none">
> ########################<br clear="none">><br clear="none">> source s_mysource {<br clear="none">> pipe("/tmp/pipe" pad_size(2048));<br clear="none">> };<br clear="none">><br clear="none">
> ########################<br clear="none">> # Destinations<br clear="none">>
########################<br clear="none">><br clear="none">> destination d_GEN {<br clear="none">> file("/var/log/ldb/GENTrace.log");<br clear="none">> };<br clear="none">
><br clear="none">> destination d_SU {<br clear="none">> file("/var/log/ldb/SUTrace.log");<br clear="none">> };<br clear="none">><br clear="none">> destination d_WAN {<br clear="none">
> file("/var/log/ldb/WANTrace.log");<br clear="none">>
};<br clear="none">><br clear="none">> destination d_CPL {<br clear="none">> file("/var/log/ldb/CPLTrace.log");<br clear="none">> };<br clear="none">><br clear="none">
> ########################<br clear="none">> # Filters<br clear="none">> ########################<br clear="none">><br clear="none">> filter f_GEN {<br clear="none">> #facility(local0) and filter(nom_du_composant_applicatif);<br clear="none">
>
#facility(local0) and filter(f_debug);<br clear="none">> facility(local0);<br clear="none">> };<br clear="none">><br clear="none">> filter f_SU {<br clear="none">> #facility(local0) and filter(nom_du_composant_applicatif);<br clear="none">
> #facility(local0) and filter(f_debug);<br clear="none">> facility(local0);<br clear="none">> };<br clear="none">><br clear="none">> filter f_WAN {<br clear="none">
> #facility(local0) and filter(nom_du_composant_applicatif);<br clear="none">> #facility(local0) and filter(f_debug);<br clear="none">> facility(local0);<br clear="none">
> };<br clear="none">><br clear="none">> filter f_CPL {<br clear="none">> #facility(local0) and filter(nom_du_composant_applicatif);<br clear="none">> #facility(local0) and filter(f_debug);<br clear="none">
> facility(local0);<br clear="none">> };<br clear="none">><br clear="none">> ########################<br clear="none">> # Log paths<br clear="none">> ########################<br clear="none">
><br clear="none">> log { source(s_mysource); filter(f_GEN); destination(d_GEN); };<br clear="none">> log { source(s_mysource); filter(f_SU); destination(d_SU); };<br clear="none">> log { source(s_mysource); filter(f_WAN); destination(d_WAN); };<br clear="none">
> log { source(s_mysource); filter(f_CPL); destination(d_CPL); };<br clear="none">><br clear="none">><br clear="none">><br clear="none">><br clear="none">> Le Mardi 5 août 2014 16h05, Jean Faye <<a shape="rect" href="mailto:ismael.faye@yahoo.fr" target="_blank">ismael.faye@yahoo.fr</a> <mailto:<a shape="rect" href="mailto:ismael.faye@yahoo.fr" target="_blank">ismael.faye@yahoo.fr</a>>> a écrit :<br clear="none">
><br clear="none">><br clear="none">> confirm a6d843f7ad7d1dbf1fefb6f12432e54941a680a9<br clear="none">><br clear="none">> Hi all,<br clear="none">> I want to use syslog-ng to log the messages generated by my application implemented in C language. I
added this in the code:<br clear="none">><br clear="none">> char *log="rtcd";<br clear="none">> printf("[%s] RTC adjustement\n",__func__);<br clear="none">> openlog(log, LOG_PID, LOG_LOCAL0);<br clear="none">
> syslog(LOG_DEBUG, "[FIJ] RTC adjustement");<br clear="none">> closelog();<br clear="none">><br clear="none">><br clear="none">> For me, according to the syslog-ng file, the files /var/log/ldb/GENTrace.log, /var/log/ldb/SUTrace.log, /var/log/ldb/WANTrace.log and /var/log/ldb/CPLTrace.log must be created and must contain the syslog message.<br clear="none">
> But I got no messages in my destination files. You can see the content of my syslog-ng.conf file bellow.<br clear="none">><br clear="none">> Is it the right way to log the messages sent by C program? What can explain that I got no messages in the destinations files?<br clear="none">
><br clear="none">> Concerning log file rotation, How can we manage it using syslog-ng? For example I want to have a destination file with a size maximum = 2Mo and if the size is greater than the max size, I have to save the current one and create a new one. On my system I can have max 4 files (4 x 2Mo). How can I manage this kind of rotation?<br clear="none">
><br clear="none">> Thanks in advance.<br clear="none">> Best regards,<br clear="none">> Ismael Jean FAYE<br clear="none">><br clear="none">> @version: 3.5<br clear="none">> #<br clear="none">
> # Syslog-ng configuration file, compatible with default Debian syslogd<br clear="none">> # installation. Originally written by anonymous (I can't find his name)<br clear="none">> # Revised, and rewrited by me (SZALAY Attila <<a shape="rect" href="mailto:sasa@debian.org" target="_blank">sasa@debian.org</a> <mailto:<a shape="rect" href="mailto:sasa@debian.org" target="_blank">sasa@debian.org</a>>>)<br clear="none">
><br clear="none">> # First, set some global options.<br clear="none">> options { chain_hostnames(off); flush_lines(0); use_dns(no); use_fqdn(no);<br clear="none">> owner("root"); group("adm"); perm(0640); stats_freq(0);<br clear="none">
> bad_hostname("^gconfd$");create_dirs(yes);<br clear="none">> };<br clear="none">><br clear="none">> ########################<br clear="none">> # Sources<br clear="none">> ########################<br clear="none">
><br clear="none">> source s_mysource {<br clear="none">> pipe("/tmp/pipe" pad_size(2048));<br clear="none">> };<br clear="none">><br clear="none">> ########################<br clear="none">
> # Destinations<br clear="none">> ########################<br clear="none">><br clear="none">> destination d_GEN {<br clear="none">> file("/var/log/ldb/GENTrace.log");<br clear="none">
> };<br clear="none">><br clear="none">> destination d_SU {<br clear="none">> file("/var/log/ldb/SUTrace.log");<br clear="none">> };<br clear="none">><br clear="none">
> destination d_WAN {<br clear="none">> file("/var/log/ldb/WANTrace.log");<br clear="none">> };<br clear="none">><br clear="none">> destination d_CPL {<br clear="none">
> file("/var/log/ldb/CPLTrace.log");<br clear="none">> };<br clear="none">><br clear="none">> ########################<br clear="none">> # Filters<br clear="none">
> ########################<br clear="none">><br clear="none">> #filter f_GEN {<br clear="none">> #facility(local0) and filter(nom_du_composant_applicatif);<br clear="none">> #facility(local0) and filter(f_debug);<br clear="none">
> #facility(local0);<br clear="none">> #};<br clear="none">><br clear="none">> filter f_SU {<br clear="none">> #facility(local0) and filter(nom_du_composant_applicatif);<br clear="none">
> #facility(local0) and filter(f_debug);<br clear="none">>
facility(local0);<br clear="none">> };<br clear="none">><br clear="none">> filter f_WAN {<br clear="none">> #facility(local0) and filter(nom_du_composant_applicatif);<br clear="none">
> #facility(local0) and filter(f_debug);<br clear="none">> facility(local0);<br clear="none">> };<br clear="none">><br clear="none">> filter f_CPL {<br clear="none">
>
#facility(local0) and filter(nom_du_composant_applicatif);<br clear="none">> #facility(local0) and filter(f_debug);<br clear="none">> facility(local0);<br clear="none">> };<br clear="none">
><br clear="none">> ########################<br clear="none">> # Log paths<br clear="none">> ########################<br clear="none">><br clear="none">> #log { source(s_mysource); filter(f_GEN); destination(d_GEN); };<br clear="none">
> log { source(s_mysource); filter(f_SU); destination(d_SU); };<br clear="none">> log { source(s_mysource); filter(f_WAN); destination(d_WAN); };<br clear="none">> log { source(s_mysource); filter(f_CPL); destination(d_CPL); };<br clear="none">
><br clear="none">><br clear="none">><br clear="none">><br clear="none">> ______________________________________________________________________________<br clear="none">> Member info: <a shape="rect" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br clear="none">
> Documentation: <a shape="rect" href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br clear="none">> FAQ: <a shape="rect" href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br clear="none">
><br clear="none">><br clear="none">><br clear="none">><br clear="none">> ______________________________________________________________________________<br clear="none">> Member info: <a shape="rect" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br clear="none">
> Documentation: <a shape="rect" href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br clear="none">> FAQ: <a shape="rect" href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br clear="none">
><br clear="none"><br clear="none"><br clear="none">-- <br clear="none">Evan Rempel <a shape="rect" href="mailto:erempel@uvic.ca" target="_blank">erempel@uvic.ca</a><br clear="none">
Senior Systems Administrator <a href="tel:250.721.7691" value="+12507217691" target="_blank">250.721.7691</a><br clear="none">Data Centre Services, University Systems, University of
Victoria<div><br clear="none">______________________________________________________________________________<br clear="none">Member info: <a shape="rect" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br clear="none">
Documentation: <a shape="rect" href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br clear="none">FAQ: <a shape="rect" href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br clear="none">
</div><br><br></div> </div></div></div> </div> </div> </div></div><br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br><br clear="all"><br>-- <br>Bazsi
</div>