Menu

#53 Syslog facilities are handled incorrectly

v1.0 (example)
open
nobody
None
5
2016-02-23
2016-02-23
roguelazer
No

When logging to syslog, cgrulesengd initializes and uses syslog incorrectly, resulting in illegal facility/priority values being set.

The argument to openlog on line 882 of cgrulesengd.c ORs together the value of the facility and the priority; the third argument to openlog should just be the facility. In the event that the daemon cannot fork on startup, this error message is lost.

Additionally, and more noticably, every call to flog_write ends up calling vsyslog with the first argument being the result of a call to the (private, internal) macro LOG_MAKEPRI; the actual first argument to vsyslog should just be the priority (LOG_WARNING, LOG_DEBUG, etc., not to be confused with the PRI field in the RFC 3164/5424 syslog wire protocol), and should never include the facility value.

Combined, these result in cgrulesengd emitting syslog messages with PRI values that are way out of range -- the maximum permitted value is 191, but if configured to log to LOCAL7, cgrulesengd actually emits a PRI value of 455 (a newly-discovered LOG_LOCAL56). This results in the string syslog: unknown facility/priority: being constantly emitted to stderr, and warnings from any standards-compliant syslog daemon.

https://gist.github.com/Roguelazer/17c56345a2c9cf5dbabb contains a patch to fix this behavior.

Discussion


Log in to post a comment.

MongoDB Logo MongoDB