Friday January 07, 2005

Syslog and a brief diversion into smf
A question that I've had mailed into me by friends and aquaintances a few times over the last few years is how do I prevent remote machines from logging to my machine. Seeing as it arrived in again today I figured its time for a quick blog on it.

To disable remote machines using your syslog you just edit /etc/default/syslog and add the line

LOG_FROM_REMOTE=NO

The thing is this got me thinking, application developers tend to use syslog quite a lot, but you don't see people using it within scripts etc on a very regular basis. I guess for most things its overkill, but lets say you have a script that is going to create a lot of log data, and in an age old manner your doing something along the lines of open file, append message, close file. All well and good, but quite an expensive operation. Lets say that you want to use syslog to log these items instead, how would you do it?

Editing syslog.conf

For each facility we then have associated levels which we can specify actions for. These levels are listed in syslog.conf(4). For the purposes of our example lets say I'm interested in the levels of err, warning, info and debug, and I want any messages like these logged out to /var/log/mytestlog. So in our /etc/syslog.conf file we add the following

local7.warning                                  /var/log/mytestlog
local7.info                                     /var/log/mytestlog
local7.debug                                    /var/log/mytestlog
local7.err                                      /var/log/mytestlog

Next up we need to ensure the file actually exists as syslog just appends to it, so just touch the file. And finally we restart syslog. This actually gives us a nice opportunity to take a quick look at smf(5).

A Quick Diversion into SMF

# svcs -l svc:/system/system-log
fmri         svc:/system/system-log:default
name         system log
enabled      true
state        online
next_state   none
restarter    svc:/system/svc/restarter:default
contract_id  95
dependency   require_all/none svc:/milestone/single-user (online)
dependency   require_all/none svc:/system/filesystem/local (online)

# svcadm -v restart svc:/system/system-log
Action restart set for svc:/system/system-log:default.
# svcs -l svc:/system/system-log
fmri         svc:/system/system-log:default
name         system log
enabled      true
state        online
next_state   none
restarter    svc:/system/svc/restarter:default
contract_id  96
dependency   require_all/none svc:/milestone/single-user (online)
dependency   require_all/none svc:/system/filesystem/local (online)

# pgrep syslogd
1262
# pkill syslogd
# pgrep syslogd
1273
# svcs -l svc:/system/system-log
fmri         svc:/system/system-log:default
name         system log
enabled      true
state        online
next_state   none
restarter    svc:/system/svc/restarter:default
contract_id  98
dependency   require_all/none svc:/milestone/single-user (online)
dependency   require_all/none svc:/system/filesystem/local (online)

Testing our config

# logger -p local7.info "mad demented monkeys abound"
# more /var/log/mytestlog
Jan  7 04:38:35 dhcp-syd04-12-6 fintanr: [ID 702911 local7.info] mad demented monkeys abound

Using Our Custom Syslog In A CGI Script

#!/usr/bin/perl

use CGI qw(:standard);
use CGI::Carp qw(fatalsToBrowser);
use Sys::Syslog;
use strict;

my $message = "Test Info Message";

my $cgi = new CGI;

print $cgi->header();
my ($d, $m) = (localtime)[3,4];

openlog("testSyslog.pl", "info", "local7");
syslog("info", "%s - %02d/%02d/%02d ", $message, ++$m, $d);
closelog();

printf("Logged - %s - %02d/%02d", $message, $m, $d);

# tail -f /var/log/mytestlog
Jan  7 04:38:35 dhcp-syd04-12-6 fintanr: [ID 702911 local7.info] mad demented monkeys abound
Jan  7 04:46:20 dhcp-syd04-12-6 testSyslog.pl: Test Info Message - 01/07