Skip to content
Advertisement

How to log to /var/log/mail.log using rsyslogd?

I am currently playing around with logging under Linux. I have made the following very simple test application (in plain C):

JavaScript

This “application” compiles, and when I execute it, it generates an entry in /var/log/syslog, but no entry in /var/log/mail.log and no entry in /var/log/mail.err.

Could somebody please explain why?

I am using rsyslogd on the test machine; this is the configuration from /etc/rsyslog.conf (please note that /etc/rsyslog.d is just empty, and that I have stripped out all comments and lines which clearly don’t have anything to do with the problem):

JavaScript

As far as I have understood from reading man rsyslog.conf, that configuration should make rsyslogd write messages for LOG_MAIL with priority LOG_ERR to /var/log/mail.err. I am somewhat mistrustful regarding the lines where the file path has a - prepended, though. I don’t know what this means because I could not find any hint in the manual.

So what is going wrong?

Advertisement

Answer

I hate answering my own question, but I think I have found a bug either in the documentation or in the source of glibc, and I’d like to have it documented for future visitors of this question.

From https://www.gnu.org/software/libc/manual/html_node/syslog_003b-vsyslog.html#syslog_003b-vsyslog (as per the time of this writing):

syslog submits the message with the facility and priority indicated by facility_priority. The macro LOG_MAKEPRI generates a facility/priority from a facility and a priority, as in the following example:

LOG_MAKEPRI(LOG_USER, LOG_WARNING)

Now look at some code from syslog.h as it resides on my test machine (Debian wheezy, up-to-date, no custom patches, non-relevant parts stripped out):

JavaScript

We are obviously having multiple problems here.

  • The comment at the top: If I have 3 bottom bits, then I have 29 top bits (and not 28). But this is a minor problem.

  • The facility codes are already defined as shifted-to-left by three bits. Using the macro LOG_MAKEPRI (as recommended by the manual page linked above) obviously shifts them to the left by three bits a second time, which clearly is wrong.

SOLUTION

The solution is simple: Don’t use that macro; instead, just OR the facility code and the priority code. I have tried that, and it worked. Error messages from my test programs are now logged as expected, according to the configuration of rsyslogd in /etc/rsyslog.conf.

I am quite surprised about that very obvious bug in syslog.h …

User contributions licensed under: CC BY-SA
8 People found this is helpful
Advertisement