Rainer Gerhards e0dcad6cdf
pmrfc3164: add headerless message detection and handling
This patch adds a robust, optional mechanism for handling "headerless" input—
log messages that do not conform to traditional syslog formatting.

- **Headerless detection (opt-in)**
  - Controlled by the new `detect.headerless` boolean (default: off)
  - Detects messages with **no PRI** and **no valid timestamp**
  - Excludes structured inputs (e.g. JSON starting with `{` or `[`) as
    before
  - Injects default `hostname` and `tag` values
  - Flags message internally as `HEADERLESS_MSG` for further processing

- **Fallback processing options**
  - `headerless.ruleset`: route headerless messages to a dedicated ruleset
  - `headerless.errorfile`: optionally store raw input to a file
  - `headerless.drop`: discard headerless messages early if desired

- **Thread-safe HUP signal handling**
  - New `doHUPParser` entry point allows safe log rotation for error file
  - Follows standard reopen-on-write pattern post-HUP

- **Testing & Maintenance**
  - Adds two test cases: `pmrfc3164-headerless.sh` and `pmrfc3164-drop.sh`
  - Extends documentation for all new parameters
  - Cleans up code formatting, includes, and bumps copyright

Some environments produce mixed or malformed input streams. This patch enables
early, lightweight detection of non-syslog input, with customizable recovery
and routing strategies. It avoids unnecessary parsing work and gives operators
better tools to isolate or discard garbage input—without breaking legacy behavior.
2025-07-31 10:39:24 +02:00
..
2022-02-17 10:54:12 +01:00
2020-01-19 16:09:44 +01:00
2022-02-17 10:54:12 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-11 16:30:26 +01:00
2022-02-17 10:54:12 +01:00
2022-02-17 10:54:12 +01:00
2022-02-17 10:54:12 +01:00
2018-11-14 11:56:57 -05:00
2019-12-27 13:57:25 +01:00
2019-12-27 14:14:54 +01:00
2018-11-14 11:56:57 -05:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2019-12-27 13:57:25 +01:00
2023-11-24 13:18:46 +01:00
2019-08-20 09:11:16 +02:00
2020-01-19 16:09:44 +01:00
2022-07-15 15:46:27 +02:00
2019-07-30 09:00:01 +02:00
2020-01-19 16:09:44 +01:00
2019-12-27 13:57:25 +01:00
2025-06-08 11:29:49 +02:00
2020-01-19 16:09:44 +01:00
2019-12-27 13:57:25 +01:00
2019-12-27 13:57:25 +01:00
2018-11-14 11:56:57 -05:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2022-07-15 10:14:33 +02:00
2020-01-19 16:09:44 +01:00
2020-01-19 16:09:44 +01:00
2022-07-13 14:31:51 +02:00

This directory contains the rsyslog testbench. It is slowly
evolving. New tests are always welcome. So far, most tests check
out the functionality of a single module. More complex tests are
welcome.

For a simple sample, see rtinit.c, which does a simple
init/deinit check of the runtime system.

Test Naming
===========

Test that use valgrind shall end in "-vg.sh".
Test that use valgrind's helgrind thread debugger shall end in "-vgthread.sh".

Setting up Test Environments
============================

Setting up MariaDB/MySQL
------------------------
to create the necessary user:

echo "create user 'rsyslog'@'localhost' identified by 'testbench';" | mysql -u root
mysql -u root < ../plugins/ommysql/createDB.sql
echo "grant all on Syslog.* to 'rsyslog'@'localhost';" | mysql -u root

openSUSE
--------
To configure system properties like hostname and firewall, use the
graphical "yast2" administration tool. Note the ssh-access by default
is disable in the firewall!

Before running tests
====================
make check - this will compile all of the C code used in the tests, as well as
do any other preparations, and will start running all of the tests.  Ctrl-C to
stop running all of the tests.

Running all tests
=================
make check

Running named tests
===================
make testname.log

For example, to run the imfile-basic.sh test, use

    make imfile-basic.log

Test output is in imfile-basic.log

To re-run the test, first remove imfile-basic.log then make again

Or an alternative option is to run

    make check TESTS='imfile-basic.sh'

* Using gdb to debug rsyslog during a test run

Edit your test like this:

    . $srcdir/diag.sh startup
    if [ -n "${USE_GDB:-}" ] ; then
        echo attach gdb here
        sleep 54321 || :
    fi

Run your test in the background:

    USE_GDB=1 make mytest.sh.log &

Tail mytest.sh.log until you see 'attach gdb here'.  The log should also
tell you what is the rsyslogd pid.

   gdb ../tools/rsyslogd $rsyslogd_pid

Set breakpoints, whatever, then 'continue'

In another window, do ps -ef|grep 54321, then kill that pid

Core Dump Analysis
==================
The testbench contains some limited (yet useful) support for automatically
analyzing core dumps. In order for this to work, obviously core files need
to be generated. This often doesn't work as intended. If you hit this problem,
check

1. ulimit -c unlimited (or a reasonable limit)
   Note that root may need to increase a system-wide limit, which is
   usually recorded in /etc/security/limits.conf
   You need:
   *     soft    core      unlimited

2. cat  /proc/sys/kernel/core_pattern"
   On systemd systems (and some others), the pattern is changed to save
   core files so that systemd can import them -- with the result that the
   testbench doesn't see them any longer. We require classic format, which
   can be set via
   $ sudo bash -c "echo \"core\" > /proc/sys/kernel/core_pattern"

Note that you probably want to do neither of these changes to a production
system.