write custom timestamp into syslog using syslog.h

Question

my program get events from remote systems, every event contains an timestamp. I want to log this events to syslog using the event timestamp instead of systemtime.

Is there any way to send a custom header to syslog deamon ?

I'm using rsyslog on debian

EDIT:

The "events" are generated by some "bare-metal" devices. My application is a gateway between a realtime-ethernet (EthernetPOWERLINK) and a normal network.

I want to save them in micro-second precision, because its important to know in wich sequence they are occoured.

So i need the exact timestamp created by the bare-metal devices. I'like to put this events into syslog. I did not found any lib (except syslog.h) to write into syslog).

I really need to build the packages myself and send them to rsyslog deamon ?

Answer 1

Ok've solved this, by enabling networking support (TCP) and micro seconds timer in rsyslog configuration.

Accroding to RFC 5424 my application build raw syslog messages and sends them via TCP (port 514) to the deamon. Thanks to Nominal Animal, but i've no choice...

Answer 2

No, don't open that can of worms.

If you allow the sender to specify the timestamp, you allow an attacker to spoof the timestamps of events they wish to hide. That kind of defeats the entire purpose (security-wise) of using a separate machine for logging.

What you can do, however, is compare the current time and the timestamp, and include that at the start of every logged message, using something like

struct timespec   now;
struct timespec   timestamp;
double            delta;

int               priority = facility | level;
const char *const message;

delta = difftime(timestamp.tv_sec,   now.tv_sec)
      + ((double)timestamp.tv_nsec - now.tv_nsec) / 1000000000.0;

syslog(priority, "[%+.0fs] %s\n", delta, message);

On a typically configured Linux machine, that should produce something similar to

Jan 18 08:01:02 hostname service: [-1s] Original message

assuming the message took at least half a second to arrive. If hostname has its clock running fast, the delta would be positive. Normally, the delta is zero. In the case of a very slow network, the delta is negative, since the original event happened in the past relative to the timestamp shown.

If you already have infrastructure in place to monitor the logged messages, you can have a daemon or a cron script read the log files, and generate new log files (not via syslog(), but simply with string and file operations) with the timestamps adjusted by the specified delta. However, that must be done with extreme care, recognizing unacceptable or unexpectedly changing deltas, or maybe flagging them somehow.

If you write your log file monitoring/display widgets, then you can very easily let the user switch between "actual" (syslog) or "derived" (syslog + delta) timestamps, as the delta is trivial to extract from the logged lines if always present; even then, you must be careful to let the user know if a delta is out of bounds or changes unexpectedly, as such a change is most always informative to the user. (If it is not nefarious, it does mean there is something iffy with the machine timekeeping; time should not just jump around. Even NTP adjustments should be quite smooth.)

---

If you insist on opening that can of worms, just produce your own log files. Many applications do. It's not like syslog() was a magic bullet or a strict requirement for reliable logging, after all.

If your log-receiving application runs as a specific user and group, you can create /var/log/yourlogs/ owned by root user and that group, and save your log files there. Set the directory mode to 02770 (drwxrws--- or u=rwx,g=rwxs,o=), and all files created in that directory will automatically be owned by the same group (that's what the setgid bit, s, does for directories). You just need to make sure your service sets umask to 002 (and uses 0666 or 0660 mode flags when creating log files), so that they stay group-readable and group-writable.

Log rotation (archiving and/or deleting old log files, mailing logs) is usually a separate service, provided by the logrotate package, and configured by dropping a service-specific configuration file in /etc/logrotate.d/ at installation time. In other words, even if you write your own log files, do not rotate them; use the existing service for this. It makes life much easier for your users, us system administrators. (Note: Setting umask 002 at the start of the log rotate scripts is very useful in the above directory case; created files will then be group-writable. umask 022 will make them group-read-only.)

Answer 3

You can write a raw log message to the /dev/log file. This is a Unix domain socket from where the syslog server reads the messages, as they are written with the syslog() function.

I'm not sure about portability since the message format written by syslog() does not seem to follow the RFC 5424. I can only share my findings with busybox and its syslogd and nc utilities.

syslog() function writes messages as datagrams in the form <PRI>Mon DD HH:MM:SS message, where PRI is a priority, i.e. a decimal number computed as facility | severity, followed by a timestamp and a message.

With nc -u local:/dev/log, you can write UDP datagrams to the domain socket directly. For example, writing <84>Apr 3 07:27:20 hello world results in a Apr 3 07:27:20 hostname authpriv.warn hello world line in /var/log/messages.

Then you are free to extend the timestamp with the microseconds precision. Anyway, you need to make sure your syslog server implementation accepts such form. In case of busybox, I had to modify the source code.

Note: Busybox needs to be configured with enabled CONFIG_NC_EXTRA, CONFIG_NC_110_COMPAT and CONFIG_FEATURE_UNIX_LOCAL options to allow for opening /dev/log with nc.