user rsyslog/syslog

user rsyslog/syslog

[Ran Shalit]

Hello,

I am trying to write to rsyslog from application.
With openlog(..., LOG_USER), it works fine and I find the log in
/var/log/user.log (it is defines in /etc/rsyslog.d/50-defaults.conf )
But we need to enable different applications to have each its own log file.
I tried to use LOG_LOCAL0 instead and configured it in
/etc/rsyslog.d/50-defaults.conf the same way as user:

local0.* action
{
  type="omfile"
 FILE="/var/log/local0.log"
 FileOwner="root"
 FileGroup="adm"

}

I then did
1. /etc/init.d/rsyslog stop
2. /etc/init.d/rsyslog start
I see no warnings or errors, and I started the application trying to
write to LOG_LOCAL0, But there is no new file created, no logs.

Is there any idea whatws wrong, or how I can achieve this multi user's logs ?

Thank you,
Ran

user rsyslog/syslog

[Ruben Safir]

On 02/24/2016 02:36 AM, Ran Shalit wrote:
> Hello,

systemd?

> 
> I am trying to write to rsyslog from application.
> With openlog(..., LOG_USER), it works fine and I find the log in
> /var/log/user.log (it is defines in /etc/rsyslog.d/50-defaults.conf )
> But we need to enable different applications to have each its own log file.
> I tried to use LOG_LOCAL0 instead and configured it in
> /etc/rsyslog.d/50-defaults.conf the same way as user:
> 
> local0.* action
> {
>   type="omfile"
>  FILE="/var/log/local0.log"
>  FileOwner="root"
>  FileGroup="adm"
> 
> }
> 
> I then did
> 1. /etc/init.d/rsyslog stop
> 2. /etc/init.d/rsyslog start
> I see no warnings or errors, and I started the application trying to
> write to LOG_LOCAL0, But there is no new file created, no logs.
> 
> Is there any idea whatws wrong, or how I can achieve this multi user's logs ?
> 
> Thank you,
> Ran
> 
> _______________________________________________
> Kernelnewbies mailing list
> Kernelnewbies at kernelnewbies.org
> http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
> 


-- 
So many immigrant groups have swept through our town
that Brooklyn, like Atlantis, reaches mythological
proportions in the mind of the world - RI Safir 1998
http://www.mrbrklyn.com

DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002
http://www.nylxs.com - Leadership Development in Free Software
http://www2.mrbrklyn.com/resources - Unpublished Archive
http://www.coinhangout.com - coins!
http://www.brooklyn-living.com

Being so tracked is for FARM ANIMALS and and extermination camps,
but incompatible with living as a free human being. -RI Safir 2013

user rsyslog/syslog

[Valdis.Kletnieks at vt.edu]

On Wed, 24 Feb 2016 09:36:54 +0200, Ran Shalit said:

> I am trying to write to rsyslog from application.
> With openlog(..., LOG_USER), it works fine and I find the log in
> /var/log/user.log (it is defines in /etc/rsyslog.d/50-defaults.conf )
> But we need to enable different applications to have each its own log file.
> I tried to use LOG_LOCAL0 instead and configured it in
> /etc/rsyslog.d/50-defaults.conf the same way as user:
>
> local0.* action
> {
>   type="omfile"
>  FILE="/var/log/local0.log"
>  FileOwner="root"
>  FileGroup="adm"
>
> }
>
> I then did
> 1. /etc/init.d/rsyslog stop
> 2. /etc/init.d/rsyslog start
> I see no warnings or errors, and I started the application trying to
> write to LOG_LOCAL0, But there is no new file created, no logs.
>
> Is there any idea whatws wrong, or how I can achieve this multi user's logs ?

Not really a kernel issue, is it?  But anyhow....

First thing to do is to make sure your code checks the return code
from openlog().

The next thing to check is that your application is actually trying to
log to LOCAL0.  Using the debugging tool of your choice, ensure that control
flow reaches the syslog() statement. Make sure that it's using LOCAL0.

Define an action for *.* dumping to /var/log/everything.log - does your
message show up in there?

In other words, all the usual userspace debugging.. start at the beginning
and trace through the flow.

And since rsyslog allows regex matching, maybe you should be letting all the
applications continue logging to LOG_USER, and then use filters
of the form 'programname startswith app1', 'programname startswith app2',
and so on to select based on the program name.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 848 bytes
Desc: not available
Url : http://lists.kernelnewbies.org/pipermail/kernelnewbies/attachments/20160224/15fcee38/attachment.bin 

user rsyslog/syslog

[Ran Shalit]

On Wed, Feb 24, 2016 at 10:17 AM,  <Valdis.Kletnieks@vt.edu> wrote:
> On Wed, 24 Feb 2016 09:36:54 +0200, Ran Shalit said:
>
>> I am trying to write to rsyslog from application.
>> With openlog(..., LOG_USER), it works fine and I find the log in
>> /var/log/user.log (it is defines in /etc/rsyslog.d/50-defaults.conf )
>> But we need to enable different applications to have each its own log file.
>> I tried to use LOG_LOCAL0 instead and configured it in
>> /etc/rsyslog.d/50-defaults.conf the same way as user:
>>
>> local0.* action
>> {
>>   type="omfile"
>>  FILE="/var/log/local0.log"
>>  FileOwner="root"
>>  FileGroup="adm"
>>
>> }
>>
>> I then did
>> 1. /etc/init.d/rsyslog stop
>> 2. /etc/init.d/rsyslog start
>> I see no warnings or errors, and I started the application trying to
>> write to LOG_LOCAL0, But there is no new file created, no logs.
>>
>> Is there any idea whatws wrong, or how I can achieve this multi user's logs ?
>
> Not really a kernel issue, is it?  But anyhow....
>
> First thing to do is to make sure your code checks the return code
> from openlog().
>
> The next thing to check is that your application is actually trying to
> log to LOCAL0.  Using the debugging tool of your choice, ensure that control
> flow reaches the syslog() statement. Make sure that it's using LOCAL0.
>
> Define an action for *.* dumping to /var/log/everything.log - does your
> message show up in there?
>
> In other words, all the usual userspace debugging.. start at the beginning
> and trace through the flow.
>
> And since rsyslog allows regex matching, maybe you should be letting all the
> applications continue logging to LOG_USER, and then use filters
> of the form 'programname startswith app1', 'programname startswith app2',
> and so on to select based on the program name.
>
Hi Vladis,

Thanks a lot.
I see that openlog has not retuen value, and it seems that only
openlog get the LOG_USER (or LOG_LOCAL0) arguments.
the other functions such as syslog does not use it at all, for example:

openlog("Logs", "", LOG_USER);
syslog(LOG_INFO, "Start logging");
closelog();

Anyway, on debugging I seet that these routines are called, but
nothing gets into the expected localX files. It only works with the
USER file.

Maybe the last suggestion will be the most practical if this issue
can't be resolved, which means that I will use one file for all logs,
in which each line will have its own tag string according to the
application.

Thanks,
Ran

user rsyslog/syslog

[Valdis.Kletnieks at vt.edu]

On Wed, 24 Feb 2016 14:20:23 +0200, Ran Shalit said:

> Maybe the last suggestion will be the most practical if this issue
> can't be resolved, which means that I will use one file for all logs,
> in which each line will have its own tag string according to the
> application.

No, what you do is you use an rsyslog filter on the program name,
and use that to route each program's logs to a different file.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 848 bytes
Desc: not available
Url : http://lists.kernelnewbies.org/pipermail/kernelnewbies/attachments/20160224/f4cbea80/attachment.bin