MAN page from Old RedHat 5.X sysklogd-1.3-22.i386.rpm

SYSKLOGD

Section: Linux System Administration (8)
Updated: 13 December 1995
Index

NAME

sysklogd - Linux system logging utilities.

SYNOPSIS

syslogd[ -d ][ -f config file][ -h ][ -l hostlist][ -m interval] [ -n ][ -psocket][ -r ][ -s domainlist][ -v ]

DESCRIPTION

Sysklogdprovides two system utilities which provide support forsystem logging and kernel message trapping. Support of both internet andunix domain sockets enables this utility package to support both localand remote logging.

System logging is provided by a version of syslogd(8)derived from thestock BSD sources. Support for kernel logging is provided by theklogd(8)utility which allows kernel logging to be conducted in either astandalone fashion or as a client of syslogd.

Syslogdprovides a kind of logging that many modern programs use. Every loggedmessage contains at least a time and a hostname field, normally aprogram name field, too, but that depends on how trusty the loggingprogram is.

While thesyslogdsources have been heavily modified a couple of notesare in order. First of all there has been a systematic attempt toinsure that syslogd follows its default, standard BSD behavior.The second important concept to note is that this version of syslogdinteracts transparently with the version of syslog found in thestandard libraries. If a binary linked to the standard sharedlibraries fails to function correctly we would like an example of theanomalous behavior.

The main configuration file/etc/syslog.confor an alternative file, given with the -foption, is read at startup. Any lines that begin with the hash mark(``#'') and empty lines are ignored. If an error occurs during parsingthe whole line is ignored.

OPTIONS

-d: Turns on debug mode. Using this the daemon will not proceed a fork(2)to set itself in the background, but opposite to that stay in theforeground and write much debug information on the current tty. See theDEBUGGING section for more information.
-f config file: Specify an alternative configuration file instead of/etc/syslog.conf,which is the default.
-h: By default syslogd will not forward messages it receives from remote hosts.Specifying this switch on the command line will cause the log daemon toforward any remote messages it receives to forwarding hosts which have beendefined.
-l hostlist: Specify a hostname that should be logged only with its simple hostnameand not the fqdn. Multiple hosts may be specified using the colon(``:'') separator.
-m interval: Thesyslogdlogs a mark timestamp regularly. The defaultinterval between two -- MARK -- lines is 20 minutes. Thiscan be changed with this option.
-n: Avoid auto-backgrounding. This is needed especially if thesyslogdis started and controlled byinit(8).
-p socket: You can specify an alternative unix domain socket instead of/dev/log.
-r: This option will enable the facility to receive message from thenetwork using an internet domain socket with the syslog service (see services(5)).The default is to not receive any messages from the network.
This option is introduced in version 1.3 of the sysklogdpackage. Please note that the default behavior is the opposite ofhow older versions behave, so you might have to turn this on.
-s domainlist: Specify a domainname that should be stripped off beforelogging. Multiple domains may be specified using the colon (``:'')separator. Remember that the first match is used, not the best.
-v: Print version and exit.

SIGNALS

Syslogdreacts to a set of signals. You may easily send a signal tosyslogdusing the following:

kill -SIGNAL `cat /var/run/syslogd.pid`

SIGHUP: This letssyslogdperform a re-initialization. All open files are closed, theconfiguration file (default is /etc/syslog.conf)will be reread and thesyslog(3)facility is started again.
SIGTERM: Thesyslogdwill die.
SIGINT, SIGQUIT: If debugging is enabled these are ignored, otherwise syslogdwill die.
SIGUSR1: Switch debugging on/off. This option can only be used ifsyslogdis started with the-ddebug option.
SIGCHLD: Wait for childs if some were born, because of wall'ing messages.
SIGALRM: Every timesyslogdreceives this signal it will log the mark line. Normally this is doneby alarm(2).

CONFIGURATION FILE SYNTAX DIFFERENCES

Syslogduses a slightly different syntax for its configuration file thanthe original BSD sources. Originally all messages of a specific priorityand above were forwarded to the log file.

For example the following line caused ALL output from daemons usingthe daemon facilities (debug is the lowest priority, so every higherwill also match) to go into /usr/adm/daemons:

        # Sample syslog.conf        daemon.debug                    /usr/adm/daemons

Under the new scheme this behavior remains the same. The differenceis the addition of four new specifiers, the asterisk (*)wildcard, the equation sign (=), the exclamation mark(!), and the minus sign (-).

The * specifies that all messages for thespecified facility are to be directed to the destination. Note thatthis behavior is degenerate with specifying a priority level of debug.Users have indicated that the asterisk notation is more intuitive.

The = wildcard is used to restrict logging to the specified priorityclass. This allows, for example, routing only debug messages to aparticular logging source.

For example the following line insyslog.confwould direct debug messages from all sources to the/usr/adm/debugfile.

        # Sample syslog.conf        *.=debug                        /usr/adm/debug

The ! is used to exclude logging of the specifiedpriorities. This affects all (!) possibilities of specifying priorities.

For example the following lines would log all messages of the facilitymail except those with the priority info to the/usr/adm/mail file. And all messages from news.info (including) to news.crit(excluding) would be logged to the/usr/adm/newsfile.

        # Sample syslog.conf        mail.*;mail.!=info              /usr/adm/mail        news.info;news.!crit    /usr/adm/news

You may use it intuitively as an exception specifier. The abovementioned interpretation is simply inverted. Doing that you may use

        mail.none

        mail.!*

        mail.!debug

to skip every message that comes with a mail facility. There is muchroom to play with it. :-)

The - may only be used to prefix a filename if you want to omitsync'ing the file after every write to it.

This may take some acclimatization for those individuals used to thepure BSD behavior but testers have indicated that this syntax issomewhat more flexible than the BSD behavior. Note that these changesshould not affect standardsyslog.conf(5)files. You must specificallymodify the configuration files to obtain the enhanced behavior.

SUPPORT FOR REMOTE LOGGING

These modifications provide network support to the syslogd facility.Network support means that messages can be forwarded from one noderunning syslogd to another node running syslogd where they will beactually logged to a disk file.

To enable this you have to specify the-roption on the command line. The default behavior is thatsyslogdwon't listen to the network.

The strategy is to have syslogd listen on a unix domain socket forlocally generated log messages. This behavior will allow syslogd tointer-operate with the syslog found in the standard C library. At thesame time syslogd listens on the standard syslog port for messagesforwarded from other hosts. To have this work correctly theservices(5)files (typically found in/etc)must have the followingentry:

        syslog          514/udp

If this entry is missingsyslogdneither can receive remote messages nor send them, because the UDPport cant be opened. Instead syslogdwill die immediately, blowing out an error message.

To cause messages to be forwarded to another host replacethe normal file line in thesyslog.conffile with the name of the host to which the messages is to be sentprepended with an @.

For example, to forwardALLmessages to a remote host use thefollowingsyslog.confentry:

        # Sample syslogd configuration file to        # messages to a remote host forward all.        *.*                     @hostname

To forward all kernel messages to a remote host theconfiguration file would be as follows:

        # Sample configuration file to forward all kernel        # messages to a remote host.        kern.*          @hostname

If the remote hostname cannot be resolved at startup, because thename-server might not be accessible (it may be started after syslogd)you don't have to worry.Syslogdwill retry to resolve the name ten times and then complain. Anotherpossibility to avoid this is to place the hostname in/etc/hosts.

With normalsyslogdsyou would get syslog-loops if you send out messages that were receivedfrom a remote host to the same host (or more complicated to a thirdhost that sends it back to the first one, and so on). In my domain(Infodrom Oldenburg) we accidently got one and our disks filled upwith the same single message. :-(

To avoid this in further times no messages that were received from aremote host are sent out to another (or the same) remote hostanymore. If there are scenarios where this doesn't make sense, pleasedrop me (Joey) a line.

If the remote host is located in the same domain as the host, syslogdis running on, only the simple hostname will be logged instead ofthe whole fqdn.

In a local network you may provide a central log server to have allthe important information kept on one machine. If the network consistsof different domains you don't have to complain about logging fullyqualified names instead of simple hostnames. You may want to use thestrip-domain feature-sof this server. You can tell thesyslogdto strip off several domains other than the one the server is locatedin and only log simple hostnames.

Using the-loption there's also a possibility to define single hosts as localmachines. This, too, results in logging only their simple hostnamesand not the fqdns.

OUTPUT TO NAMED PIPES (FIFOs)

This version of syslogd has support for logging output to named pipes(fifos). A fifo or named pipe can be used as a destination for logmessages by prepending a pipy symbol (``|'') to the name of thefile. This is handy for debugging. Note that the fifo must be createdwith the mkfifo command before syslogd is started.

The following configuration file routes debug messages from thekernel to a fifo:

        # Sample configuration to route kernel debugging        # messages ONLY to /usr/adm/debug which is a        # named pipe.        kern.=debug                     |/usr/adm/debug

INSTALLATION CONCERNS

There is probably one important consideration when installing thisversion of syslogd. This version of syslogd is dependent on properformatting of messages by the syslog function. The functioning of thesyslog function in the shared libraries changed somewhere in theregion of libc.so.4.[2-4].n. The specific change was tonull-terminate the message before transmitting it to the /dev/logsocket. Proper functioning of this version of syslogd is dependent onnull-termination of the message.

This problem will typically manifest itself if old statically linkedbinaries are being used on the system. Binaries using old versions ofthe syslog function will cause empty lines to be logged followed bythe message with the first character in the message removed.Relinking these binaries to newer versions of the shared librarieswill correct this problem.

Both thesyslogd(8) and the klogd(8)can either be run frominit(8)or started as part of the rc.*sequence. If it is started from init the option -n must be set,otherwise you'll get tons of syslog daemons started. This is because init(8)depends on the process ID.

SECURITY THREATS

There is the potential for the syslogd daemon to beused as a conduit for a denial of service attack. Thanks go to JohnMorrison (jmorrisoAATTrflab.ee.ubc.ca) for alerting me to this potential.A rogue program(mer) could very easily flood the syslogd daemon withsyslog messages resulting in the log files consuming all the remainingspace on the filesystem. Activating logging over the inet domainsockets will of course expose a system to risks outside of programs orindividuals on the local machine.

There are a number of methods of protecting a machine:

1.: Implement kernel firewalling to limit which hosts or networks haveaccess to the 514/UDP socket.
2.: Logging can be directed to an isolated or non-root filesystem which,if filled, will not impair the machine.
3.: The ext2 filesystem can be used which can be configured to limit acertain percentage of a filesystem to usage by root only. NOTEthat this will require syslogd to be run as a non-root process.ALSO NOTE that this will prevent usage of remote logging sincesyslogd will be unable to bind to the 514/UDP socket.
4.: Disabling inet domain sockets will limit risk to the local machine.
5.: Use step 4 and if the problem persists and is not secondary to a rogueprogram/daemon get a 3.5 ft (approx. 1 meter) length of sucker rod*and have a chat with the user in question.
Sucker rod def. --- 3/4, 7/8 or 1in. hardened steel rod, malethreaded on each end. Primary use in the oil industry in WesternNorth Dakota and other locations to pump 'suck' oil from oil wells.Secondary uses are for the construction of cattle feed lots and fordealing with the occasional recalcitrant or belligerent individual.

DEBUGGING

When debugging is turned on using-doption thensyslogdwill be very verbose by writing much of what it does on stdout. Wheneverthe configuration file is reread and re-parsed you'll see a tabular,corresponding to the internal data structure. This tabular consists offour fields:

number: This field contains a serial number starting by zero. This numberrepresents the position in the internal data structure (i.e. thearray). If one number is left out then there might be an error in thecorresponding line in/etc/syslog.conf.
pattern: This field is tricky and represents the internal structureexactly. Every column stands for a facility (refer tosyslog(3)).As you can see, there are still some facilities left free for formeruse, only the left most are used. Every field in a column representsthe priorities (refer tosyslog(3)).
action: This field describes the particular action that takes place whenever amessage is received that matches the pattern. Refer to thesyslog.conf(5)manpage for all possible actions.
arguments: This field shows additional arguments to the actions in the lastfield. For file-logging this is the filename for the logfile; foruser-logging this is a list of users; for remote logging this is thehostname of the machine to log to; for console-logging this is theused console; for tty-logging this is the specified tty; wall has noadditional arguments.

FILES

/etc/syslog.conf: Configuration file forsyslogd.Seesyslog.conf(5)for exact information.
/dev/log: The Unix domain socket to from where local syslog messages are read.
/var/run/syslogd.pid: The file containing the process id of syslogd.

BUGS

If an error occurs in one line the whole rule is ignored.

Syslogddoesn't change the filemode of opened logfiles at any stage ofprocess. If a file is created it is world readable. If you want toavoid this, you have to create it and change permissions on your own.This could be done in combination with rotating logfiles using the savelog(8)program that is shipped in the smail3.x distribution. Remember that it might be a security hole ifeverybody is able to read auth.* messages as these might containpasswords.

COLLABORATORS

Syslogdis taken from BSD sources, Greg Wettstein (gregAATTwind.rmcc.com)performed the port to Linux, Martin Schulze (joeyAATTlinux.de)fixed some bugs and added several new features.Klogd was originally written by Steve Lord (lordAATTcray.com), Greg Wettsteinmade major improvements.

Dr. Greg Wettstein
Enjellic Systems Development
Oncology Research Division Computing Facility
Roger Maris Cancer Center
Fargo, ND
gregAATTwind.rmcc.com
Stephen Tweedie
Department of Computer Science
Edinburgh University, Scotland
sctAATTdcs.ed.ac.uk
Juha Virtanen
jiiveeAATThut.fi
Shane Alderton
shaneAATTscs.apana.org.au
Martin Schulze
Infodrom Oldenburg
joeyAATTlinux.de

Index

NAME
SYNOPSIS
DESCRIPTION
OPTIONS
SIGNALS
CONFIGURATION FILE SYNTAX DIFFERENCES
SUPPORT FOR REMOTE LOGGING
OUTPUT TO NAMED PIPES (FIFOs)
INSTALLATION CONCERNS
SECURITY THREATS
DEBUGGING
FILES
BUGS
SEE ALSO
COLLABORATORS

This document was created byman2html,using the manual pages.