Bug 11540 - WebUI: allow changing rsyslog protocol
Summary: WebUI: allow changing rsyslog protocol
Status: CLOSED FIXED
Alias: None
Product: IPFire
Classification: Unclassified
Component: --- (show other bugs)
Version: 2
Hardware: all All
: Will only affect a few users Balancing
Assignee: Peter Müller
QA Contact:
URL:
Keywords:
Depends on: 11574
Blocks:
  Show dependency treegraph
 
Reported: 2017-11-03 15:30 UTC by Peter Müller
Modified: 2018-01-10 17:36 UTC (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Peter Müller 2017-11-03 15:30:37 UTC
Currently, changing the protocol used with a remote syslog server is not possible (UDP is used by default).

However, logging via TCP is more reliable and might be favoured in some environments. The web interface should allow to change the transport protocol used by rsyslog (UDP or TCP).
Comment 1 Michael Tremer 2017-11-06 19:15:02 UTC
I have never used this and I don't know anyone who is.

Would you like to work on this yourself and create this bug to let us know or did you just want to report this?
Comment 2 Peter Müller 2017-11-06 19:24:35 UTC
(In reply to Michael Tremer from comment #1)
> I have never used this and I don't know anyone who is.
Well, I use this for quite a while and I am happy with it.

It is useful in case you do not want the firewall machine to send log summary
mails or want the logs to be saved at a different place, too. However, with UDP,
this is more or less like a lottery game. :-|
> 
> Would you like to work on this yourself and create this bug to let us know
> or did you just want to report this?
It was intended that I work on this - but looking at the Perl script, I am not quite sure if this is such an easy task. That's why I did not assign it to me.
Comment 3 Michael Tremer 2017-11-07 12:21:52 UTC
(In reply to Peter Müller from comment #2)
> (In reply to Michael Tremer from comment #1)
> > I have never used this and I don't know anyone who is.
> Well, I use this for quite a while and I am happy with it.
> 
> It is useful in case you do not want the firewall machine to send log summary
> mails or want the logs to be saved at a different place, too. However, with
> UDP,
> this is more or less like a lottery game. :-|
> > 
> > Would you like to work on this yourself and create this bug to let us know
> > or did you just want to report this?
> It was intended that I work on this - but looking at the Perl script, I am
> not quite sure if this is such an easy task. That's why I did not assign it
> to me.

That one is an easy one: https://cgit.ipfire.org/ipfire-2.x.git/tree/html/cgi-bin/logs.cgi/config.dat

Maybe you can have a go and if you get stuck just send me an email?!
Comment 4 Peter Müller 2017-11-08 17:38:48 UTC
I am currently trying to do so.

The CGI file (and the translations) is already updated, but the settings are written to rsyslogd by a C program, which has not been touched for quite a few years... *sigh*

Unfortunately, C is a little bit beyond my scope (I am not that familiar with programming, as you may noticed. :-| ), but I will try.
Comment 5 Peter Müller 2017-11-12 08:27:27 UTC
Sent in a patch series, but the C diff likely contains errors. :-|
Comment 6 Peter Müller 2017-11-19 15:16:10 UTC
Sent in second version of the C patch, should be OK AFAIK.
Comment 7 Peter Müller 2017-12-13 19:25:56 UTC
Fixed in Core Update 117.
Comment 8 Peter Müller 2018-01-07 14:05:35 UTC
Saving the settings results in a segfault caused by the C program:

Jan  7 14:00:01 firewall kernel: syslogdctrl[32260]: segfault at 0 ip 00006d5bca1970f2 sp 000079c0d1549018 error 6 in libc-2.25.so[6d5bca0f1000+1ba000]
Jan  7 14:00:01 firewall kernel: grsec: Segmentation fault occurred at            (nil) in /usr/local/bin/syslogdctrl[syslogdctrl:32260] uid/euid:0/0 gid/egid:0/0, parent /srv/web/ipfire/cgi-bin/logs.cgi/config.dat[config.dat:32167] uid/euid:99/99 gid/egid:99/99

This happens for both UDP and TCP.
Comment 9 Michael Tremer 2018-01-10 17:36:29 UTC
Technically this can be closed. We shipped this.