Splitting relayd log entries from /var/log/daemon

[J65nko]

Part of growing up is that you get your own things. You get your own bike instead of sharing it with a sibling. You get your own bedroom, car etc.

So I decided to give relayd(8) a log file of its own and not having to share it with other daemons in /var/log/daemon

After some experimentation I found that the following works:

 #       $OpenBSD: syslog.conf,v 1.20 2016/12/27 13:38:14 jca Exp $
#

# --- 
!!relayd
*.*                                                     /var/log/relayd

*.notice;auth,authpriv,cron,ftp,kern,lpr,mail,user.none /var/log/messages
kern.debug;syslog,user.info                             /var/log/messages
auth.info                                               /var/log/authlog
authpriv.debug                                          /var/log/secure
cron.info                                               /var/cron/log
daemon.info                                             /var/log/daemon
[snip]
# Uncomment to log messages from doas(1) to its own log file.  Matches are done
# based on the program name.
# Program-specific logs:
#!doas
#*.*                                                    /var/log/doas

When I had those two lines at the end (after the doas entry), relayd log entries, although going to /var/log/relayd still were also logged in var/log/daemon.

From syslog.conf(5)

Each block of lines is separated from the previous block by a tag. The
tag is a line beginning with !prog and each block will be associated with
calls to syslog from that specific program (matched using glob(7) rules).
When a message matches multiple blocks, the action of each matching block
is taken. If no tag is specified at the beginning of the file, every
line is checked for a match and acted upon (at least until a tag is
found).

!!prog causes the subsequent block to abort evaluation when a message
matches, ensuring that only a single set of actions is taken. !* can be
used to ensure that any ensuing blocks are further evaluated (i.e.
cancelling the effect of a !prog or !!prog).

To ensure the new settings are being used, remember to restart or reload the syslogd(8) daemon

# rcctl restart syslogd
syslogd(ok)
syslogd(ok)

[IdOp]

I'm a bit confused. In your example, there appears to be a single block, beginning with the tag !!relayd. (At least, ignoring the [snip].) But certainly the line "daemon.info /var/log/daemon" seems to be part of that first block, and not part of a subsequent block. So why is it not executed? I'm probably missing something simple.

[J65nko]

I have to admit I am now confused too. I thought that "!!relayd" acted similar to a "quick" rule in the pf firewall.
And it indeed does....Relayd is now logging to its own log.

But all other logging has stopped.. For example no more ssh logins in /var/log/authlog.

So I moved it back to the end under the commented 'doas' line and am trying with specifying something other than that *.* wildcard.


!relayd
daemon.info still logs to its own log file, as well as "/var/log/daemon".

So now the question is how to stop logging to the "/var/log/daemon".?
But right now I have no time to pursue this any further.

Feel free to test and with this shell script

#!/bin/sh

INTERVAL=10
PRIORITY="-p daemon.info"

echo Starting $0 ...... | logger $PRIORITY -t $0

while true ; do
    sleep $INTERVAL
    echo Testing sleeping $INTERVAL seconds ... at $(date)
done 2>&1 | logger $PRIORITY -t $0

[IdOp]

I think I've resolved the source of my confusion. By "subsequent block" I think they mean the block immediately after the !!prog . I was originally thinking of the !!prog tag as being part of the block, but a careful reading of the man page is more consistent with the tag as not being part of the block, rather it separates blocks.

So I think this would explain why you only get the one action, and only for relayd, because you have only one block and its associated tag is !!relayd.

I'll try to look at it more later, given time, regarding how to get it to do what you want.

[IdOp]

Ah-ha! Look at the EXAMPLES section of syslog.conf(5), right at the very start.

You may need a third line in your relayd section, consisting of only !*

Hopefully that will work.

[J65nko]

Originally Posted by IdOp

Ah-ha! Look at the EXAMPLES section of syslog.conf(5), right at the very start.

You may need a third line in your relayd section, consisting of only !*

Yes, thank you That made it work. But actually this solution is mentioned in the quotation from the syslog.conf manpage in http://daemonforums.org/showthread.p...1762#post70868 (last paragraph of quote)

[J65nko]

The solution:

#       $OpenBSD: syslog.conf,v 1.20 2016/12/27 13:38:14 jca Exp $
#

# --- relayd messages in separate log
# Logfiles already have to exist with the correct permissions
# syslogd does not create them for you!

!!relayd
daemon.info                                             /var/log/relayd
!*


*.notice;auth,authpriv,cron,ftp,kern,lpr,mail,user.none /var/log/messages
kern.debug;syslog,user.info                             /var/log/messages

[IdOp]

Originally Posted by J65nko

Yes, thank you That made it work.

That's great to hear.

But actually this solution is mentioned in the quotation from the syslog.conf manpage in http://daemonforums.org/showthread.p...1762#post70868 (last paragraph of quote)

Indeed the !* is mentioned there in the text, I read it many times without following, and still cannot see how it jives with what is given in the example.

[J65nko]

After configuring relayd(8) not to log to /var/log/daemon but to a log file by itself, I used the following entry in newsyslog.conf(8) to rotate and compress these logs:

# logfile_name          owner:group     mode count size when  flags
/var/log/daemon                         640  5     300  *     Z
[snip]
/var/log/relayd                         644  10    1024  *    Z

Because originally it logged to /var/log/daemon I assume it does not need a pkill command like httpd:

/var/www/logs/access.log                644  4     *    $W0   Z "pkill -USR1 -u root -U root -x httpd"

[J65nko]

newsyslog will be run by cron every hour.
But you can view what newsyslog(8) will do if you run it from the command line with the -vn option:

$ doas newsyslog -vn 

/var/cron/log <3Z>: size (KB): 2.96 [10] --> skipping
/var/log/authlog <7Z>: age (hr): 37 [168] --> skipping
/var/log/daemon <5Z>: size (KB): 26.21 [300] --> skipping
/var/log/lpd-errs <7Z>: size (KB): 0.00 [10] --> skipping
/var/log/maillog <7Z>: age (hr): 13 [24] --> skipping
/var/log/messages <5Z>: size (KB): 39.05 [300] --> skipping
/var/log/secure <7Z>: age (hr): 37 [168] --> skipping
/var/log/wtmp <7B>: --> will trim at Thu Sep  1 04:00:00 2022
/var/log/xferlog <7Z>: size (KB): 0.00 [250] --> skipping

/var/log/pflog <3ZB>: size (KB): 250.57 [250] --> trimming log....
        rm -f /var/log/pflog.2 /var/log/pflog.2.gz
        rm -f /var/log/pflog.3 /var/log/pflog.3.gz
        mv /var/log/pflog.1.gz /var/log/pflog.2.gz
        chmod 600 /var/log/pflog.2.gz
        chown 0:0 /var/log/pflog.2.gz
        mv /var/log/pflog.0.gz /var/log/pflog.1.gz
        chmod 600 /var/log/pflog.1.gz
        chown 0:0 /var/log/pflog.1.gz
        mktemp /var/log/pflog.XXXXXXXXXX
        mv /var/log/pflog to /var/log/pflog.0
        chmod 600 /var/log/pflog.0
        chown 0:0 /var/log/pflog.0
        mv /var/log/pflog.XXXXXXXXXX to /var/log/pflog

/var/log/relayd <20Z>: size (KB): 687.08 [1024] --> skipping
/var/www/logs/http80_access.log <8Z>: size (KB): 965.35 [1024] --> skipping
/var/www/logs/http80_error.log <8Z>: size (KB): 675.55 [1024] --> skipping
run pkill -HUP -u root -U root -t - -x pflogd
gzip /var/log/pflog.0

You see that var/log/relayd at this moment is 687.08 KB which is less than the 1024 KB needed to be rotated.

But /var/log/pflog will be rotated/trimmed and gzipped at the next hourly run.
The pflog files are:

ls -l /var/log/pflog*
-rw-------  1 root  wheel  267799 Aug 21 04:42 /var/log/pflog
-rw-------  1 root  wheel   62760 Aug 21 00:00 /var/log/pflog.0.gz
-rw-------  1 root  wheel   65112 Aug 20 18:00 /var/log/pflog.1.gz
-rw-------  1 root  wheel   63971 Aug 20 12:00 /var/log/pflog.2.gz