[rsyslog] Allow files to be created without CreateDirs

[William Tisäter]

I've debugged some more, this only happens when you trigger the repeat- 
loop to the missing directory.

E.g:

# logger -t non_existent_dir -p local0.crit test
# logger -t non_existent_dir -p local0.crit test
# logger -t existing_dir -p local0.crit test

Debug output from last command:

Filter: check for property 'programname' (value 'existing_dir') NOT  
regex '^[a-zA-Z_][a-zA-Z_]*$': FALSE
1092925760: Called fprintlog, logging to builtin-file (CritByDay)
1092925760: Called fprintlog, logging to builtin-file (CritByDay)
Filter: check for property 'msg' (value ' test') contains '(CRIT)':  
FALSE
1092925760: Called fprintlog, logging to builtin-file  
(DirByTagFileByDay)
1092925760: Called logerr, msg: Could not open dynamic file '/log/ 
non_existent_dir/2008-12-18.log' - discarding message
1092925760: logmsg: syslog.err<43>, flags 5, from '', msg Could not  
open dynamic file '/log/non_existent_dir/2008-12-18.log' - discarding  
message: No such file or directory
1092925760: Message has legacy syslog format.
1092925760: EnqueueMsg signaled condition (0)
1092925760: Removed entry 2 for file '[OPEN FAILED]' from dynaCache.
1092925760: Lone worker is running...
1092925760: msg repeated 1 times, 10 sec of 30.
Filter: check for property 'syslogfacility-text' (value 'syslog') NOT  
isequal 'local0': TRUE
1092925760: Called fprintlog, logging to builtin-discardsingleWorker:  
queue EMPTY, waiting for next message.


William Tisäter

Blocket.se - Sveriges största Köp & Sälj marknad
http://www.blocket.se/

On Dec 18, 2008, at 2:35 PM, William Tisäter wrote:

> Hi,
>
> Lets see if I can get this right:
>
> My modification in prepareFile() will return with (pData->fd = -1)  
> if the log file can't be created.
> In prepareDynFile() we run prepareFile() and return with -1 if pData- 
> >fd is set to -1.
> In writeFile() we run prepareDynFile() and return RS_RET_ERR if  
> prepareDynFile() is not returned with 0.
>
> writeFile() is wrapped in doAction().
>
> doAction() is exectued in fprintlog() where RS_RET_ERR never will be  
> catched. I discard the log message and sets the error flag to tell  
> the "msg repeated"-check to not log this message ("msg repeated" is  
> executed before we try to open the file if the message content match  
> the previous message).
>
> I tried without this catch in the first attempt, but I could see the  
> message stuck in the loop, every action to rsyslog tried to open the  
> file. This and some traffic volume caused rsyslog to hang (and use a  
> lot of i/o).
>
>
> William Tisäter
>
> Blocket.se - Sveriges största Köp & Sälj marknad
> http://www.blocket.se/
>
> On Dec 18, 2008, at 12:01 PM, Rainer Gerhards wrote:
>
>> Hi William,
>>
>> thanks for the bug report and the patch. I have now looked into the
>> issue and could reproduce the situation. The patch obviously resolves
>> it.
>>
>> There is one thing, though: I do not fully understand why you have
>> patched syslogd.c (RS_RET_ERR). I would appreciate if you could  
>> provide
>> a bit more insight into the problem you intend to solve. So far, I  
>> can
>> not see why this part of the patch is actually needed.
>>
>> I'll integrate the omfile part now. I will also see that I apply  
>> this to
>> the other official branches.
>>
>> Thanks,
>> Rainer
>>
>> On Tue, 2008-12-16 at 17:39 +0100, William Tisäter wrote:
>>> Hi,
>>>
>>> I don't know if this is an intended feature or not, but when
>>> CreateDirs is set to off, rsyslog can no longer create files (time
>>> stamp file names). Lets say you have a template for writing files: /
>>> log/<tag>/<date>.log, this will let anybody to create directories  
>>> in /
>>> log when CreateDirs is on. This may cause a lot of directories and  
>>> can
>>> be abused by regular users.
>>>
>>> I've patched 2.0.2 to separate file and directory creation here:
>>> https://bugzilla.redhat.com/attachment.cgi?id=327100
>>>
>>> And steps to reproduce this can be found here:
>>> https://bugzilla.redhat.com/show_bug.cgi?id=473419
>>>
>>> Comments anyone?
>>>
>>>
>>> William Tisäter
>>>
>>> Blocket.se - Sveriges största Köp & Sälj marknad
>>> http://www.blocket.se/
>>> _______________________________________________
>>> rsyslog mailing list
>>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> http://www.rsyslog.com
>>
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com