Bug 220884 - syslogd doesn't include all files in include directories
Summary: syslogd doesn't include all files in include directories
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: 11.0-STABLE
Hardware: Any Any
: --- Affects Many People
Assignee: freebsd-bugs mailing list
URL:
Keywords: patch
: 221742 225452 (view as bug list)
Depends on:
Blocks:
 
Reported: 2017-07-20 16:03 UTC by Dan McGregor
Modified: 2018-07-06 19:58 UTC (History)
10 users (show)

See Also:


Attachments
syslogd.c patch (624 bytes, patch)
2017-08-09 08:18 UTC, Alexander Zagrebin
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Dan McGregor 2017-07-20 16:03:14 UTC
When multiple files exist in /etc/syslog.d or /usr/local/etc/syslog.d, only the last on processed has any effect on the syslog configuration. This does work as expected in CURRENT.

Starting syslogd verbosely on a default system (with /etc/syslog.d/ppp.conf and /etc/syslog.d/ftp.conf), and /usr/local/etc/syslog.d/dhcpd.conf gives the following output:

===== BEGIN =====
cfline("*.err;kern.warning;auth.notice;mail.crit                /dev/console", f, "*", "*")
cfline("*.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err   /var/log/messages", f, "*", "*")
cfline("security.*                                      /var/log/security", f, "*", "*")
cfline("auth.info;authpriv.info                         /var/log/auth.log", f, "*", "*")
cfline("mail.info                                       /var/log/maillog", f, "*", "*")
cfline("cron.*                                          /var/log/cron", f, "*", "*")
cfline("*.=debug                                        /var/log/debug.log", f, "-devd", "*")
cfline("*.emerg                                         *", f, "-devd", "*")
Trying to include files in '/etc/syslog.d'
reading /etc/syslog.d/ftp.conf
cfline("ftp.info                                        /var/log/xferlog", f, "*", "*")
reading /etc/syslog.d/ppp.conf
cfline("*.*                                             /var/log/ppp.log", f, "ppp", "*")
Trying to include files in '/usr/local/etc/syslog.d'
reading /usr/local/etc/syslog.d/dhcpd.conf
cfline("*.*                                             /var/log/dhcpd.log", f, "dhcpd,dhclient", "*")
4 3 2 3 5 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 X CONSOLE: /dev/console
7 5 2 5 5 5 6 3 5 5 X 5 5 5 5 5 5 5 5 5 5 5 5 5 X FILE: /var/log/messages
X X X X X X X X X X X X X 7 X X X X X X X X X X X FILE: /var/log/security
X X X X 6 X X X X X 6 X X X X X X X X X X X X X X FILE: /var/log/auth.log
X X 6 X X X X X X X X X X X X X X X X X X X X X X FILE: /var/log/maillog
X X X X X X X X X 7 X X X X X X X X X X X X X X X FILE: /var/log/cron
7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 X FILE: /var/log/debug.log (-devd)
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 X WALL:  (-devd)
7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 X FILE: /var/log/dhcpd.log (dhcpd,dhclient)
===== END =====

The entries from /etc/syslog.d/ftp.log and /etc/syslog.d/ppp.conf are ignored or discarded. The expected behaviour (as seen in CURRENT) is:

===== BEGIN =====
cfline("*.err;kern.warning;auth.notice;mail.crit                /dev/console", f, "*", "*")
cfline("*.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err   /var/log/messages", f, "*", "*")
cfline("security.*                                      /var/log/security", f, "*", "*")
cfline("auth.info;authpriv.info                         /var/log/auth.log", f, "*", "*")
cfline("mail.info                                       /var/log/maillog", f, "*", "*")
cfline("cron.*                                          /var/log/cron", f, "*", "*")
cfline("*.=debug                                        /var/log/debug.log", f, "-devd", "*")
cfline("*.emerg                                         *", f, "-devd", "*")
Trying to include files in '/etc/syslog.d'
reading /etc/syslog.d/ftp.conf
cfline("ftp.info                                        /var/log/xferlog", f, "*", "*")
reading /etc/syslog.d/ppp.conf
cfline("*.*                                             /var/log/ppp.log", f, "ppp", "*")
Trying to include files in '/usr/local/etc/syslog.d'
reading /usr/local/etc/syslog.d/dhcpd.conf
cfline("*.*                                             /var/log/dhcpd.log", f, "dhcpd,dhclient", "*")
4 3 2 3 5 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 X CONSOLE: /dev/console
7 5 2 5 5 5 6 3 5 5 X 5 5 5 5 5 5 5 5 5 5 5 5 5 X FILE: /var/log/messages
X X X X X X X X X X X X X 7 X X X X X X X X X X X FILE: /var/log/security
X X X X 6 X X X X X 6 X X X X X X X X X X X X X X FILE: /var/log/auth.log
X X 6 X X X X X X X X X X X X X X X X X X X X X X FILE: /var/log/maillog
X X X X X X X X X 7 X X X X X X X X X X X X X X X FILE: /var/log/cron
7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 X FILE: /var/log/debug.log (-devd)
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 X WALL:  (-devd)
X X X X X X X X X X X 6 X X X X X X X X X X X X X FILE: /var/log/xferlog
7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 X FILE: /var/log/ppp.log (ppp)
7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 X FILE: /var/log/dhcpd.log (dhcpd,dhclient)
===== END =====

In -CURRENT the entries from /etc/syslog.d/ppp.conf and ftp.conf are not ignored.
Comment 1 Alexander Zagrebin 2017-08-09 08:18:23 UTC
Created attachment 185188 [details]
syslogd.c patch
Comment 2 Alexander Zagrebin 2017-08-09 08:19:09 UTC
Comment on attachment 185188 [details]
syslogd.c patch

I can confirm that.
There is bug in the usr.sbin/syslogd/syslogd.c
An attached patch fixes issue.
Comment 3 Yasuhiro KIMURA 2017-09-09 11:04:20 UTC
(In reply to Alexander Zagrebin from comment #1)

I tried this patch with 11.1-RELEASE and confirmed the bug is fixed.
I hope this patch is also applied to releng/11.1 branch.
Comment 4 Ed Maste freebsd_committer 2017-09-09 13:42:41 UTC
*** Bug 221742 has been marked as a duplicate of this bug. ***
Comment 5 Dan McGregor 2017-09-15 17:44:38 UTC
I'll also confirm this patch corrects the issue. I fixed it locally by just using syslogd from current. I'm not sure which would be the preferred fix.
Comment 6 Thomas Steen Rasmussen / Tykling 2017-09-20 14:53:56 UTC
Patch also solves the issue for me. An MFC would be very nice, and maybe an erratta for 11.1 REL.
Comment 7 Ollivier Robert freebsd_committer 2017-12-29 16:49:01 UTC
Patch committed in r327348.  Thanks.
Comment 8 commit-hook freebsd_committer 2017-12-29 16:49:19 UTC
A commit references this bug:

Author: roberto
Date: Fri Dec 29 16:48:14 UTC 2017
New revision: 327348
URL: https://svnweb.freebsd.org/changeset/base/327348

Log:
  In stable/11, support for including config. files is broken and only the
  last one is taken into account.

  Code in 12-CURRENT s different and works so commit is in stable/11.

  Patch by Alexander Zagrebin <alex@zagrebin.ru> in the PR.

  PR:		220884
  Relnotes:	yes
  Submitted by:	Dan McGregor <dan.mcgregor@usask.ca>

Changes:
  stable/11/usr.sbin/syslogd/syslogd.c
Comment 9 Mark Johnston freebsd_committer 2018-05-18 15:46:21 UTC
*** Bug 225452 has been marked as a duplicate of this bug. ***
Comment 10 Serge 2018-05-31 22:54:47 UTC
I wonder if this patch will be issued as erratum for 11.1-RELEASE. I've just spent a full day trying to understand what is wrong with my syslog.d configuration on a 11.1-RELEASE-p10 system until I found this entry. This bug is so fundamental that even after I discovered on my own that the problem is related to file naming, I still could not believe it was not an obscure fault of mine. 

Of course, now I can work around this bug, but I find it exceedingly strange that at the current patch level 10 it is *still* not corrected as an erratum.
Comment 11 Mark Felder freebsd_committer 2018-06-03 15:09:12 UTC
Let me shake some people down next week at BSDCan and see if I can get this finally taken care of.
Comment 12 Serge 2018-06-04 04:59:33 UTC
Thanks, Mark. I appreciate that, better late than never. The other problem with this bug is that although it is reasonably well documented, the search query to find it is not very obvious. It took me a few tries to get this and related threads in the search results.

Thanks again.
Comment 13 Mark Felder freebsd_committer 2018-07-06 19:58:53 UTC
It is my understanding that this is fixed in 11.2-RELEASE. I haven't tested.(In reply to Serge from comment #12)

With 11.2-RELEASE on the way it wasn't a priority to make this an ERRATA. Sorry, but at least we have a RELEASE with the fix now.