socklog - small and secure replacement for syslogd

Benefits
Configuration
Examples
Network logging
Log events notification

The socklog-conf program
The socklog program
The tryto program
The uncat program

• receiving syslog messages from an unix domain socket (/dev/log) and writing them to various files on disk depending on facility and priority.
• receiving syslog messages from an udp socket (0.0.0.0:514) and writing them to various files on disk depending on facility and priority.
• writing received syslog messages to an udp socket (a.b.c.d:514)

socklog provides the first two features with the help of daemontools' svscan, supervise and multilog, provides a different network logging concept and additionally does log event notification.

multilog has a built in logfile rotation based on file size, so there is no need for any cron jobs or similar to rotate the logs. Log partitions can be calculated properly.

socklog runs on Linux, glibc 2.1.0 or higher, or dietlibc, OpenBSD, and FreeBSD. socklog reportedly runs on Solaris and NetBSD. If it runs for you on any other operating systems, please let me know.

socklog is small, secure, reliable.

socklog can be run as an ucspi application to listen to an unix domain stream socket and for centralized or more flexible distributed logging (see network logging).

If socklog listens to an udp socket, it prepends ip: (a.b.c.d: ) to each syslog message it receives, where a.b.c.d is the ip address of the connecting system.

If the environment variables $UID and/or $GID are present, socklog will drop permissions to those ids after creating and binding to the socket (not in ucspi mode).

socklog converts syslog facility and priority information to names (facility.priority) as found in /usr/include/syslog.h at compile time if present, you can use this for multilog's line selecting by pattern.

  #!/bin/sh
  exec 2>&1
  exec envuidgid nobody socklog unix /dev/log

A proper log/run file for supervise is:

  #!/bin/sh
  LOGDIR=/var/log/socklog
  exec setuidgid log multilog s4999999 n10 ${LOGDIR}/main \
    s999999 n5 -* +kern.* ${LOGDIR}/kern \
    s999999 n5 -* +user.* ${LOGDIR}/user \
    s999999 n5 -* +mail.* ${LOGDIR}/mail \
    s999999 n5 -* +daemon.* ${LOGDIR}/daemon \
    s999999 n5 -* +auth.* +authpriv.* ${LOGDIR}/auth \
    s999999 n5 -* +syslog.* ${LOGDIR}/syslog \
    s999999 n5 -* +news.* ${LOGDIR}/news \
    s999999 n5 -* +cron.* ${LOGDIR}/cron \
    s999999 n5 -* +ftp.* ${LOGDIR}/ftp \
    s999999 n5 -* +local*.* ${LOGDIR}/local \
    s999999 n5 -* +*.debug* ${LOGDIR}/debug

  deb http://smarden.org/pape/Debian sarge unofficial
  deb-src http://smarden.org/pape/Debian sarge unofficial

  deb http://smarden.org/pape/Debian woody unofficial
  deb-src http://smarden.org/pape/Debian woody unofficial

  # apt-get update

  # apt-get install socklog