Syslog - doubt

Syslog - doubt

[Suriya Narayanan M S]

Hi all,
	The following program writes 2 messages to
syslog
/********** Begin code ***********/
#include <syslog.h>
int main()
{
        openlog("Test of syslog",0,0);
        syslog(LOG_EMERG,"Hello World\n");
        syslog(LOG_EMERG,"Good Bye World\n");
        closelog();
        return 0;
}
/**********End code ***************/

If someone executes this program repeatedly
of from a loop, syslog would become too large.
Is something wrong?  Can access to syslog
be restrcted?

Bye,
Suriya Narayanan M S
-- 
Guru Brahma Gurur Vishnu
Gurur Dhevo Maheshwaraha
Gurur Saakshaath Parabramha
Thasmai Shree Gurave Namaha

Public key at www.keyserver.net
-
To unsubscribe from this list: send the line "unsubscribe linux-newbie" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.linux-learn.org/faqs

Re: Syslog - doubt

[Jos Lemmerling]

On Wed, 5 Jun 2002, Suriya Narayanan M S wrote:

> Hi all,
> 	The following program writes 2 messages to
> syslog
> /********** Begin code ***********/
> #include <syslog.h>
> int main()
> {
>         openlog("Test of syslog",0,0);
>         syslog(LOG_EMERG,"Hello World\n");
>         syslog(LOG_EMERG,"Good Bye World\n");
>         closelog();
>         return 0;
> }
> /**********End code ***************/
> 
> If someone executes this program repeatedly
> of from a loop, syslog would become too large.
> Is something wrong?  Can access to syslog
> be restrcted?

perhaps you can build some sort of a test in your program so the program
doesn't "flood" the syslog. I've some messages in my syslog: "last 
message repeated n times". Maybe something like that is what you're
looking for?


HTH

--
Jos Lemmerling on Debian GNU/Linux			jos(@)lemmerling(.net)



-
To unsubscribe from this list: send the line "unsubscribe linux-newbie" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.linux-learn.org/faqs

Re: Syslog - doubt

[Steven Smith]

[-- Attachment #1: Type: text/plain, Size: 1067 bytes --]

> If someone executes this program repeatedly
> of from a loop, syslog would become too large.
> Is something wrong?  Can access to syslog
> be restrcted?
Good question. I can't see any ways to limit the rate at which
a given user can send messages, and the sysklogd man page lists this as
a flaw in the current implementation. This is somewhat worrying.

On the other hand, you can quite easily prevent certain users from
logging any messages at all, if you only log messages from the local
machine. syslogd listens on a Unix socket, usually /dev/log, for incoming
messages, and if a user doesn't have write permission on that socket,
they can't put anything in the syslog. So, what I would do is this:

1) Create a new group called logging
2) Place all of the users and services which need to make entries in the
   syslog in this group
3) chgrp logging /dev/log
4) chmod o-rw /dev/log

Of course, this doesn't help if you use network logging as well. The
easiest way of restricting this is probably using the kernel packet
filters.

Steven Smith,
sos22@cam.ac.uk.

[-- Attachment #2: Type: application/pgp-signature, Size: 232 bytes --]