Google

G. Pape
socklog

Name

socklog - small and secure syslogd replacement for use with djb's daemontools

Synopsis

socklog [ unix ] [ path ]
socklog inet [ ip ] [ port ]
socklog ucspi [ args ]

Description

socklog is run under daemontools' supervise(8), writing syslog messages it receives from unix domain socket path or an inet udp socket ip:port through a pipe provided by svscan(8) to a multilog(8) process.

socklog can be run as an ucspi application to listen to an unix domain stream socket and for more flexible distributed logging.

If the environment variables $UID and/or $GID are present, socklog will drop permissions to those ids after creating and binding the socket (not in ucspi mode).

socklog converts syslog facility and priority information to names (facility.priority:) as found in /usr/include/syslog.h at compile time if present.

On solaris socklog also accepts sun_stream as first argument. Please see the web page for details.

Unix Socket

socklog [ unix ] [ path ]

Starting socklog with the 1st argument unix, socklog will listen to the unix domain socket path. If path is omitted, the default /dev/log is used.

The 1st argument may be omitted, default is unix.

Inet Socket

socklog inet [ ip ] [ port ]

Starting socklog with the 1st argument inet, socklog will listen to the inet udp socket ip:port.

If ip starts with 0, socklog will bind to all local interfaces.

If port is less or equal 1024, socklog must be run by root.

port may be omitted, default is 514. ip may be omitted, default is 0.

socklog prepends a.b.c.d: to each syslog message it receives, where a.b.c.d is the ip address of the connecting system.

Ucspi Mode

socklog ucspi [ args ]

Starting socklog with the 1st argument ucspi, socklog will run as an ucspi application. Normally socklog will only be started in ucspi mode by an ucspi server tool, such as tcpserver(1) or unixserver.

For each arg, socklog will prepend $arg: to each syslog message, if the environment variable $arg is present (maximum is 8).

Examples

unix mode for listening on unix domain dgram socket /dev/log. a proper run file for supervise(8) is:

#!/bin/sh
exec 2>&1
exec envuidgid nobody socklog unix /dev/log

ucspi mode for listening on unix domain stream socket /dev/log. a proper run file for supervise(8) is:

#!/bin/sh
exec 2>&1
exec unixserver -U `id -u nobody` /dev/log \
socklog ucspi UNIXREMOTEEUID UNIXREMOTEEGID

inet mode for listening on udp network socket 0.0.0.0:514. a proper run file for supervise(8) is:

#!/bin/sh
exec 2>&1
exec envuidgid nobody socklog inet 0 514

See Also

svscan(8), supervise(8), multilog(8), tryto(1), uncat(1), tcpserver(1)

http://smarden.org/socklog/
http://cr.yp.to/daemontools.html

Author

Gerrit Pape <pape@smarden.org>

Table of Contents