mirror of
https://github.com/rsyslog/rsyslog.git
synced 2025-12-19 16:10:43 +01:00
90308823df
In the community we frequently discuss handling of oversize messages. David Lang rightfully suggested to create a central capability inside rsyslog core to handle them. We need to make a distinction between input and output messages. Also, input messages frequently need to have some size restrictions done at a lower layer (e.g. protocol layer) for security reasons. Nevertheless, we should have a central capability * for cases where it need not be handled at a lower level * as a safeguard when a module invalidly emits it (imfile is an example, see https://github.com/rsyslog/rsyslog/pull/2632 for a try to fix it on the module level - we will replace that with the new capability described here). The central capability works on message submission, and so cannot be circumvented. It has these capabilities: * overisze message handling modes: - truncate message - split message this is of questionable use, but also often requested. In that mode, the oversize message content is split into multiple messages. Usually, this ends up with message segments where all but the first is lost anyhow as the regular filter rules do not match the other fragments. As it is requested, we still implemented it. - accept message as is, even if oversize This may be required for some cases. Most importantly, it makes quite some sense when writing messages to file, where oversize does not matter (accept from a DoS PoV). * report message to a special "oversize message log file" (not via the regular engine, as that would obviously cause another oversize message) This commit, as the title says, handles oversize INPUT messages. see also https://github.com/rsyslog/rsyslog/issues/2190 closes https://github.com/rsyslog/rsyslog/issues/2681 closes https://github.com/rsyslog/rsyslog/issues/498 Note: this commit adds global parameters: * "oversizemsg.errorfile", is used to specify the location of the oversize message log file. * "oversizemsg.report", is used to control if an error shall be reported when an oversize message is seen. The default it "on". * add global parameter "oversizemsg.input.mode" is used to specify the mode with which oversized messages will be handled.
50 lines
2.2 KiB
C
50 lines
2.2 KiB
C
/* This file is an aid to support non-modular object accesses
|
|
* while we do not have fully modularized everything. Once this is
|
|
* done, this file can (and should) be deleted. Presence of it
|
|
* also somewhat indicates that the runtime library is not really
|
|
* yet a runtime library, because it depends on some functionality
|
|
* residing somewhere else.
|
|
*
|
|
* Copyright 2007-2014 Rainer Gerhards and Adiscon GmbH.
|
|
*
|
|
* This file is part of rsyslog.
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
* -or-
|
|
* see COPYING.ASL20 in the source distribution
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
#ifndef DIRTY_H_INCLUDED
|
|
#define DIRTY_H_INCLUDED 1
|
|
|
|
rsRetVal __attribute__((deprecated)) multiSubmitMsg(multi_submit_t *pMultiSub);
|
|
rsRetVal ATTR_NONNULL() multiSubmitMsg2(multi_submit_t *const pMultiSub); /* friends only! */
|
|
rsRetVal submitMsg2(smsg_t *pMsg);
|
|
rsRetVal __attribute__((deprecated)) submitMsg(smsg_t *pMsg);
|
|
rsRetVal multiSubmitFlush(multi_submit_t *pMultiSub);
|
|
rsRetVal logmsgInternal(const int iErr, const syslog_pri_t pri, const uchar *const msg, int flags);
|
|
rsRetVal __attribute__((deprecated)) parseAndSubmitMessage(const uchar *hname,
|
|
const uchar *hnameIP, const uchar *msg, const int len,
|
|
const int flags, const flowControl_t flowCtlType,
|
|
prop_t *pInputName, const struct syslogTime *stTime,
|
|
const time_t ttGenTime, ruleset_t *pRuleset);
|
|
rsRetVal createMainQueue(qqueue_t **ppQueue, uchar *pszQueueName, struct nvlst *lst);
|
|
rsRetVal startMainQueue(qqueue_t *pQueue);
|
|
|
|
extern int MarkInterval;
|
|
extern qqueue_t *pMsgQueue; /* the main message queue */
|
|
#define CONF_VERIFY_PARTIAL_CONF 0x02 /* bit: partial configuration to be checked */
|
|
extern int iConfigVerify; /* is this just a config verify run? */
|
|
extern int bHaveMainQueue;
|
|
|
|
#endif /* #ifndef DIRTY_H_INCLUDED */
|