File 0001-imklog-kernel-timestamp-parsing.bnc783967.... of Package rsyslog

Overview Repositories Revisions Requests Users Attributes Meta

File 0001-imklog-kernel-timestamp-parsing.bnc783967.patch of Package rsyslog (Revision 29ad832afe915ae11a12295587cfe254)

Currently displaying revision 29ad832afe915ae11a12295587cfe254 , Show latest

From 4983890fa26a6c6443a1fec591c47956be8a5567 Mon Sep 17 00:00:00 2001
From: Rainer Gerhards <rgerhards@adiscon.com>
Date: Wed, 17 Oct 2012 17:17:43 +0200
Subject: [PATCH 1/5] imklog: add paramter "keepkerneltimestamp"

Thanks to Marius Tomaschweski for the suggestion and a patch (for v5)
that this commit bases on.
---
 doc/imklog.html         |    6 +++---
 plugins/imklog/bsd.c    |   25 ++++++++++++-------------
 plugins/imklog/imklog.c |    5 +++++
 plugins/imklog/imklog.h |    1 +
 4 Dateien geändert, 21 Zeilen hinzugefügt(+), 16 Zeilen entfernt(-)

diff --git a/doc/imklog.html b/doc/imklog.html
index 2e3b3bc..6ccdb5b 100644
--- a/doc/imklog.html
+++ b/doc/imklog.html
@@ -1,8 +1,8 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 <html><head>
-<meta http-equiv="Content-Language" content="en"><title>Kernel Log Input Module (imklog)</title>
-
+<title>Kernel Log Input Module (imklog)</title>
 </head>
+
 <body>
 <a href="rsyslog_conf_modules.html">back</a>
 
@@ -85,7 +85,7 @@ is needed to start pulling kernel messages. 
 This documentation is part of the
 <a href="http://www.rsyslog.com/">rsyslog</a>
 project. 
-Copyright &copy; 2008-2009 by <a href="http://www.gerhards.net/rainer">Rainer
+Copyright &copy; 2008-2012 by <a href="http://www.gerhards.net/rainer">Rainer
 Gerhards</a> and
 <a href="http://www.adiscon.com/">Adiscon</a>.
 Released under the GNU GPL version 3 or higher.
diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c
index d4f9f77..ad194b5 100644
--- a/plugins/imklog/bsd.c
+++ b/plugins/imklog/bsd.c
@@ -58,9 +58,6 @@ static int	fklog = -1;	/* kernel log fd */
 #ifdef OS_LINUX
 /* submit a message to imklog Syslog() API. In this function, we check if 
 * a kernel timestamp is present and, if so, extract and strip it.
- * Note: this is an extra processing step. We should revisit the whole
- * idea in v6 and remove all that old stuff that we do not longer need
- * (like symbol resolution). <-- TODO 
 * Note that this is heavily Linux specific and thus is not compiled or
 * used for BSD.
 * Special thanks to Lennart Poettering for suggesting on how to convert
@@ -73,7 +70,7 @@ static int	fklog = -1;	/* kernel log fd */
 * rgerhards, 2011-06-24
 */
 static void
-submitSyslog(int pri, uchar *buf)
+submitSyslog(modConfData_t *pModConf, int pri, uchar *buf)
 {
 	long secs;
 	long nsecs;
@@ -119,8 +116,10 @@ submitSyslog(int pri, uchar *buf)
 
 	/* we have a timestamp */
 	DBGPRINTF("kernel timestamp is %ld %ld\n", secs, nsecs);
-	bufsize= strlen((char*)buf);
-	memmove(buf+3, buf+i, bufsize - i + 1);
+	if(!pModConf->bKeepKernelStamp) {
+		bufsize= strlen((char*)buf);
+		memmove(buf+3, buf+i, bufsize - i + 1);
+	}
 
 	clock_gettime(CLOCK_MONOTONIC, &monotonic);
 	clock_gettime(CLOCK_REALTIME, &realtime);
@@ -146,7 +145,7 @@ done:
 }
 #else	/* now comes the BSD "code" (just a shim) */
 static void
-submitSyslog(int pri, uchar *buf)
+submitSyslog(modConfData_t *pModConf, int pri, uchar *buf)
 {
 	Syslog(pri, buf, NULL);
 }
@@ -196,7 +195,7 @@ finalize_it:
 /* Read kernel log while data are available, split into lines.
 */
 static void
-readklog(void)
+readklog(modConfData_t *pModConf)
 {
 	char *p, *q;
 	int len, i;
@@ -238,18 +237,18 @@ readklog(void)
 
 		for (p = (char*)pRcv; (q = strchr(p, '\n')) != NULL; p = q + 1) {
 			*q = '\0';
-			submitSyslog(LOG_INFO, (uchar*) p);
+			submitSyslog(pModConf, LOG_INFO, (uchar*) p);
 		}
 		len = strlen(p);
 		if (len >= iMaxLine - 1) {
-			submitSyslog(LOG_INFO, (uchar*)p);
+			submitSyslog(pModConf, LOG_INFO, (uchar*)p);
 			len = 0;
 		}
 		if(len > 0)
 			memmove(pRcv, p, len + 1);
 	}
 	if (len > 0)
-		submitSyslog(LOG_INFO, pRcv);
+		submitSyslog(pModConf, LOG_INFO, pRcv);
 
 	if(pRcv != NULL && (size_t) iMaxLine >= sizeof(bufRcv) - 1)
 		free(pRcv);
@@ -278,10 +277,10 @@ rsRetVal klogAfterRun(modConfData_t *pModConf)
 * "message pull" mechanism.
 * rgerhards, 2008-04-09
 */
-rsRetVal klogLogKMsg(modConfData_t __attribute__((unused)) *pModConf)
+rsRetVal klogLogKMsg(modConfData_t *pModConf)
 {
 DEFiRet;
-	readklog();
+	readklog(pModConf);
 	RETiRet;
 }
 
diff --git a/plugins/imklog/imklog.c b/plugins/imklog/imklog.c
index 9332370..2897d76 100644
--- a/plugins/imklog/imklog.c
+++ b/plugins/imklog/imklog.c
@@ -91,6 +91,7 @@ static int bLegacyCnfModGlobalsPermitted;/* are legacy module-global config para
 static struct cnfparamdescr modpdescr[] = {
 	{ "logpath", eCmdHdlrGetWord, 0 },
 	{ "permitnonkernelfacility", eCmdHdlrBinary, 0 },
+	{ "keepkerneltimestamp", eCmdHdlrBinary, 0 },
 	{ "consoleloglevel", eCmdHdlrInt, 0 },
 	{ "internalmsgfacility", eCmdHdlrFacility, 0 }
 };
@@ -289,6 +290,7 @@ CODESTARTbeginCnfLoad
 	pModConf->pszPath = NULL;
 	pModConf->bPermitNonKernel = 0;
 	pModConf->console_log_level = -1;
+	pModConf->bKeepKernelStamp = 0;
 	pModConf->iFacilIntMsg = klogFacilIntMsg();
 	loadModConf->configSetViaV2Method = 0;
 	bLegacyCnfModGlobalsPermitted = 1;
@@ -322,6 +324,8 @@ CODESTARTsetModCnf
 			loadModConf->bPermitNonKernel = (int) pvals[i].val.d.n;
 		} else if(!strcmp(modpblk.descr[i].name, "consoleloglevel")) {
 			loadModConf->console_log_level= (int) pvals[i].val.d.n;
+		} else if(!strcmp(modpblk.descr[i].name, "keepkerneltimestamp")) {
+			loadModConf->bKeepKernelStamp = (int) pvals[i].val.d.n;
 		} else if(!strcmp(modpblk.descr[i].name, "internalmsgfacility")) {
 			loadModConf->iFacilIntMsg = (int) pvals[i].val.d.n;
 		} else {
@@ -347,6 +351,7 @@ CODESTARTendCnfLoad
 		loadModConf->bPermitNonKernel = cs.bPermitNonKernel;
 		loadModConf->iFacilIntMsg = cs.iFacilIntMsg;
 		loadModConf->console_log_level = cs.console_log_level;
+		loadModConf->bKeepKernelStamp = 0;
 		if((cs.pszPath == NULL) || (cs.pszPath[0] == '\0')) {
 			loadModConf->pszPath = NULL;
 			if(cs.pszPath != NULL)
diff --git a/plugins/imklog/imklog.h b/plugins/imklog/imklog.h
index acfb50a..6cd97c3 100644
--- a/plugins/imklog/imklog.h
+++ b/plugins/imklog/imklog.h
@@ -36,6 +36,7 @@ struct modConfData_s {
 	uchar *pszPath;
 	int console_log_level;
 	sbool bPermitNonKernel;
+	sbool bKeepKernelStamp; /* keep kernel timestamp instead of interpreting it */
 	sbool configSetViaV2Method;
 };
 
-- 
1.7.10.4

From 24e74d95c03bdf44f40ad41a4f6d4fabef0bca2c Mon Sep 17 00:00:00 2001
From: Marius Tomaschewski <mt@suse.de>
Date: Wed, 21 Nov 2012 13:47:19 +0100
Subject: [PATCH 2/5] imklog: added paramter "parseKernelTimestamp"

When enabled, kernel message [timestamp] is converted for message time.
Default is to use receive time as in 5.8.x and before, because the clock
used to create the timestamp is not supposed to be as accurate as the
monotonic clock (depends on hardware and kernel) resulting in differences
between kernel and system messages which occurred at same time.
---
 plugins/imklog/bsd.c    |    3 +++
 plugins/imklog/imklog.c |    5 +++++
 plugins/imklog/imklog.h |    3 ++-
 3 Dateien geändert, 10 Zeilen hinzugefügt(+), 1 Zeile entfernt(-)

diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c
index ad194b5..0930d61 100644
--- a/plugins/imklog/bsd.c
+++ b/plugins/imklog/bsd.c
@@ -82,6 +82,9 @@ submitSyslog(modConfData_t *pModConf, int pri, uchar *buf)
 	struct timeval tv;
 	struct timeval *tp = NULL;
 
+	if(!pModConf->bParseKernelStamp)
+		goto done;
+
 	if(buf[3] != '[')
 		goto done;
 	DBGPRINTF("imklog: kernel timestamp detected, extracting it\n");
diff --git a/plugins/imklog/imklog.c b/plugins/imklog/imklog.c
index 2897d76..8471daa 100644
--- a/plugins/imklog/imklog.c
+++ b/plugins/imklog/imklog.c
@@ -91,6 +91,7 @@ static int bLegacyCnfModGlobalsPermitted;/* are legacy module-global config para
 static struct cnfparamdescr modpdescr[] = {
 	{ "logpath", eCmdHdlrGetWord, 0 },
 	{ "permitnonkernelfacility", eCmdHdlrBinary, 0 },
+	{ "parsekerneltimestamp", eCmdHdlrBinary, 0 },
 	{ "keepkerneltimestamp", eCmdHdlrBinary, 0 },
 	{ "consoleloglevel", eCmdHdlrInt, 0 },
 	{ "internalmsgfacility", eCmdHdlrFacility, 0 }
@@ -290,6 +291,7 @@ CODESTARTbeginCnfLoad
 	pModConf->pszPath = NULL;
 	pModConf->bPermitNonKernel = 0;
 	pModConf->console_log_level = -1;
+	pModConf->bParseKernelStamp = 0;
 	pModConf->bKeepKernelStamp = 0;
 	pModConf->iFacilIntMsg = klogFacilIntMsg();
 	loadModConf->configSetViaV2Method = 0;
@@ -324,6 +326,8 @@ CODESTARTsetModCnf
 			loadModConf->bPermitNonKernel = (int) pvals[i].val.d.n;
 		} else if(!strcmp(modpblk.descr[i].name, "consoleloglevel")) {
 			loadModConf->console_log_level= (int) pvals[i].val.d.n;
+		} else if(!strcmp(modpblk.descr[i].name, "parsekerneltimestamp")) {
+			loadModConf->bParseKernelStamp = (int) pvals[i].val.d.n;
 		} else if(!strcmp(modpblk.descr[i].name, "keepkerneltimestamp")) {
 			loadModConf->bKeepKernelStamp = (int) pvals[i].val.d.n;
 		} else if(!strcmp(modpblk.descr[i].name, "internalmsgfacility")) {
@@ -351,6 +355,7 @@ CODESTARTendCnfLoad
 		loadModConf->bPermitNonKernel = cs.bPermitNonKernel;
 		loadModConf->iFacilIntMsg = cs.iFacilIntMsg;
 		loadModConf->console_log_level = cs.console_log_level;
+		loadModConf->bParseKernelStamp = 0;
 		loadModConf->bKeepKernelStamp = 0;
 		if((cs.pszPath == NULL) || (cs.pszPath[0] == '\0')) {
 			loadModConf->pszPath = NULL;
diff --git a/plugins/imklog/imklog.h b/plugins/imklog/imklog.h
index 6cd97c3..6022f5e 100644
--- a/plugins/imklog/imklog.h
+++ b/plugins/imklog/imklog.h
@@ -36,7 +36,8 @@ struct modConfData_s {
 	uchar *pszPath;
 	int console_log_level;
 	sbool bPermitNonKernel;
-	sbool bKeepKernelStamp;  /* keep kernel timestamp instead of interpreting it */
+	sbool bParseKernelStamp; /* if try to parse kernel timestamps for message time */
+	sbool bKeepKernelStamp;  /* keep the kernel timestamp in the message */
 	sbool configSetViaV2Method;
 };
 
-- 
1.7.10.4

From 64bab984a1f7deece7c7b32b056c68b56b71ee77 Mon Sep 17 00:00:00 2001
From: Marius Tomaschewski <mt@suse.de>
Date: Wed, 21 Nov 2012 15:41:12 +0100
Subject: [PATCH 3/5] imklog: allow $klogParse- and KeepKernelTimestamp

---
 plugins/imklog/imklog.c |   14 ++++++++++++--
 1 Datei geändert, 12 Zeilen hinzugefügt(+), 2 Zeilen entfernt(-)

diff --git a/plugins/imklog/imklog.c b/plugins/imklog/imklog.c
index 8471daa..0aec108 100644
--- a/plugins/imklog/imklog.c
+++ b/plugins/imklog/imklog.c
@@ -80,6 +80,8 @@ typedef struct configSettings_s {
 	int iFacilIntMsg; /* the facility to use for internal messages (set by driver) */
 	uchar *pszPath;
 	int console_log_level; /* still used for BSD */
+	int bParseKernelStamp;
+	int bKeepKernelStamp;
 } configSettings_t;
 static configSettings_t cs;
 
@@ -112,6 +114,8 @@ static inline void
 initConfigSettings(void)
 {
 	cs.bPermitNonKernel = 0;
+	cs.bParseKernelStamp = 0;
+	cs.bKeepKernelStamp = 0;
 	cs.console_log_level = -1;
 	cs.pszPath = NULL;
 	cs.iFacilIntMsg = klogFacilIntMsg();
@@ -355,8 +359,8 @@ CODESTARTendCnfLoad
 		loadModConf->bPermitNonKernel = cs.bPermitNonKernel;
 		loadModConf->iFacilIntMsg = cs.iFacilIntMsg;
 		loadModConf->console_log_level = cs.console_log_level;
-		loadModConf->bParseKernelStamp = 0;
-		loadModConf->bKeepKernelStamp = 0;
+		loadModConf->bParseKernelStamp = cs.bParseKernelStamp;;
+		loadModConf->bKeepKernelStamp = cs.bKeepKernelStamp;
 		if((cs.pszPath == NULL) || (cs.pszPath[0] == '\0')) {
 			loadModConf->pszPath = NULL;
 			if(cs.pszPath != NULL)
@@ -431,6 +435,8 @@ ENDqueryEtryPt
 static rsRetVal resetConfigVariables(uchar __attribute__((unused)) *pp, void __attribute__((unused)) *pVal)
 {
 	cs.bPermitNonKernel = 0;
+	cs.bParseKernelStamp = 0;
+	cs.bKeepKernelStamp = 0;
 	if(cs.pszPath != NULL) {
 		free(cs.pszPath);
 		cs.pszPath = NULL;
@@ -468,6 +474,10 @@ CODEmodInit_QueryRegCFSLineHdlr
 			NULL, NULL, STD_LOADABLE_MODULE_ID));
 	CHKiRet(regCfSysLineHdlr2((uchar *)"klogpermitnonkernelfacility", 0, eCmdHdlrBinary,
 			NULL, &cs.bPermitNonKernel, STD_LOADABLE_MODULE_ID, &bLegacyCnfModGlobalsPermitted));
+	CHKiRet(regCfSysLineHdlr2((uchar *)"klogparsekerneltimestamp", 0, eCmdHdlrBinary,
+			NULL, &cs.bParseKernelStamp, STD_LOADABLE_MODULE_ID, &bLegacyCnfModGlobalsPermitted));
+	CHKiRet(regCfSysLineHdlr2((uchar *)"klogkeepkerneltimestamp", 0, eCmdHdlrBinary,
+			NULL, &cs.bKeepKernelStamp, STD_LOADABLE_MODULE_ID, &bLegacyCnfModGlobalsPermitted));
 	CHKiRet(regCfSysLineHdlr2((uchar *)"klogconsoleloglevel", 0, eCmdHdlrInt,
 			NULL, &cs.console_log_level, STD_LOADABLE_MODULE_ID, &bLegacyCnfModGlobalsPermitted));
 	CHKiRet(regCfSysLineHdlr2((uchar *)"kloginternalmsgfacility", 0, eCmdHdlrFacility,
-- 
1.7.10.4

From 3ce3f458f4ac088d3e650ad939500e72b35d1758 Mon Sep 17 00:00:00 2001
From: Marius Tomaschewski <mt@suse.de>
Date: Wed, 21 Nov 2012 13:47:44 +0100
Subject: [PATCH 4/5] imklog: convert to kmsg timestamp's us to ns first

---
 plugins/imklog/bsd.c |    1 +
 1 Datei geändert, 1 Zeile hinzugefügt(+)

diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c
index 0930d61..2dc7527 100644
--- a/plugins/imklog/bsd.c
+++ b/plugins/imklog/bsd.c
@@ -111,6 +111,7 @@ submitSyslog(modConfData_t *pModConf, int pri, uchar *buf)
 		nsecs = nsecs * 10 + buf[i] - '0';
 		++i;
 	}
+	nsecs *= 1000; /* convert to ns first */
 	if(buf[i] != ']') {
 		DBGPRINTF("no trailing ']' --> no kernel timestamp\n");
 		goto done; /* no TS! */
-- 
1.7.10.4

From f8565e506fe01839035d40e12c2d13c1d15da45f Mon Sep 17 00:00:00 2001
From: Marius Tomaschewski <mt@suse.de>
Date: Thu, 22 Nov 2012 15:05:52 +0100
Subject: [PATCH 5/5] imklog: added $klogParse/KeepKernelTimestamp docs

---
 doc/imklog.html |   13 +++++++++++++
 1 Datei geändert, 13 Zeilen hinzugefügt(+)

diff --git a/doc/imklog.html b/doc/imklog.html
index 6ccdb5b..294e2b7 100644
--- a/doc/imklog.html
+++ b/doc/imklog.html
@@ -65,6 +65,19 @@ Linux only, ignored on other platforms (but may be specified)</li>
 former klogd -2 option 
 Linux only, ignored on other platforms (but may be specified) 
 </li>
+<li>$klogParseKernelTimestamp [on/off] 
+If enabled and the kernel creates a timestamp for its log messages, this timestamp will be
+parsed and converted into regular message time instead to use the receive time of the kernel
+message (as in 5.8.x and before). Default is to not parse the kernel timestamp, because the
+clock used by the kernel to create the timestamps is not supposed to be as accurate as the
+monotonic clock required to convert it. Depending on the hardware and kernel, it can result
+in message time differences between kernel and system messages which occurred at same time.
+</li>
+<li>$klogKeepKernelTimestamp [on/off] 
+If enabled, this option causes to keep the [timestamp] provided by the kernel at the begin
+of in each message rather than to remove it, when it could be parsed and converted into
+local time for use as regular message time. Only used, when $klogParseKernelTimestamp is on.
+</li>
 </ul>
 Caveats/Known Bugs:
 This is obviously platform specific and requires platform
-- 
1.7.10.4

Places

File 0001-imklog-kernel-timestamp-parsing.bnc783967.patch of Package rsyslog (Revision 29ad832afe915ae11a12295587cfe254)

Places