On Linux, use a dgram reader for /dev/kmsg, because it works almost exactly like a dgram source anyway, and a dgram reader is more efficient than the indented-multiline one. Also, change the system() source to not enforce indentedn-multiline on /dev/kmsg anymore, since with the change to affile, there's no need to. Signed-off-by: Gergely Nagy <algernon@balabit.hu> --- modules/affile/affile.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/modules/affile/affile.c b/modules/affile/affile.c index d756070..265a3d5 100644 --- a/modules/affile/affile.c +++ b/modules/affile/affile.c @@ -28,6 +28,7 @@ #include "gprocess.h" #include "stats.h" #include "mainloop.h" +#include "logproto-dgram-server.h" #include "logproto-record-server.h" #include "logproto-text-server.h" #include "logproto-indented-multiline-server.h" @@ -55,6 +56,16 @@ affile_is_linux_proc_kmsg(const gchar *filename) } static inline gboolean +affile_is_linux_dev_kmsg(const gchar *filename) +{ +#ifdef __linux__ + if (strcmp(filename, "/dev/kmsg") == 0) + return TRUE; +#endif + return FALSE; +} + +static inline gboolean affile_is_device_node(const gchar *filename) { struct stat st; @@ -211,6 +222,8 @@ affile_sd_construct_proto(AFFileSourceDriver *self, gint fd) return log_proto_padded_record_server_new(transport, proto_options, self->pad_size); else if (affile_is_linux_proc_kmsg(self->filename->str)) return log_proto_linux_proc_kmsg_reader_new(transport, proto_options); + else if (affile_is_linux_dev_kmsg(self->filename->str)) + return log_proto_dgram_server_new(transport, proto_options); else if (self->reader_options.flags & LR_INDENTED_ML) return log_proto_indented_multiline_server_new(transport, proto_options); else -- 1.7.10.4