Attachment 152539 Details for Bug 236356 – sample dispatcher. It can be started by syslogd via -D option.

sample dispatcher. It can be started by syslogd via -D option.

skeleton.c (text/x-csrc), 2.85 KB, created by Peter Vrabec on 2007-04-13 13:09:25 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Peter Vrabec

Created: 2007-04-13 13:09:25 UTC

Size: 2.85 KB

patch

obsolete

>/* skeleton.c --
> * 
> * This is a sample program that you can customize to create your own syslog
> * event handler. It will be started by syslog via the dispatcher option on
> * command line. This program can be built as follows:
> *
> * gcc skeleton.c -o skeleton
> */
>
>#include <stdio.h>
>#include <sys/types.h>
>#include <sys/uio.h>
>#include <unistd.h>
>#include <stdlib.h>
>#include <signal.h>
>#include <fcntl.h>
>#include <errno.h>
>#include <string.h>
>#include <locale.h>
>
>#include "sysklogd-dispatch.h"
>
>
>// Local data
>static volatile int signaled = 0;
>static int pipe_fd;
>static const char *pgm = "skeleton";
>
>// Local functions
>static int event_loop(void);
>
>// SIGTERM handler
>static void term_handler( int sig )
>{
>	signaled = 1;
>}
>
>/*
> * main is started by sysklogd. See dispatcher in auditd.conf
> */
>int main(int argc, char *argv[])
>{
>	struct sigaction sa;
>
>	setlocale (LC_ALL, "");
>	fprintf(stderr, "starting skeleton...\n");
>
>#ifndef DEBUG
>	// Make sure we are root
>	if (getuid() != 0) {
>		fprintf(stderr, "You must be root to run this program.");
>		return 4;
>	}
>#endif
>
>	// register sighandlers
>	sa.sa_flags = 0 ;
>	sa.sa_handler = term_handler;
>	sigemptyset( &sa.sa_mask ) ;
>	sigaction( SIGTERM, &sa, NULL );
>	sa.sa_handler = term_handler;
>	sigemptyset( &sa.sa_mask ) ;
>	sigaction( SIGCHLD, &sa, NULL );
>	sa.sa_handler = SIG_IGN;
>	sigaction( SIGHUP, &sa, NULL );
>	(void)chdir("/");
>
>	// change over to pipe_fd
>	pipe_fd = dup(0);
>	close(0);
>	open("/dev/null", O_RDONLY);
>	fcntl(pipe_fd, F_SETFD, FD_CLOEXEC);
>
>	// Start the program
>	return event_loop();
>}
>
>static int event_loop(void)
>{
>	void* data;
>	struct iovec vec[2];
>	struct sysklogd_dispatcher_header hdr;
>
>	/* Allocate data structures */
>	data = malloc(MAXLINE);
>	if (data == NULL) {
>		fprintf(stderr, "Cannot allocate buffer\n");
>		return 1;
>	}
>	memset(data, 0, MAXLINE);
>	memset(&hdr, 0, sizeof(hdr));
>
>	do {
>		int rc;
>		struct timeval tv;
>		fd_set fd;
>
>		tv.tv_sec = 1;
>		tv.tv_usec = 0;
>		FD_ZERO(&fd);
>		FD_SET(pipe_fd, &fd);
>		rc = select(pipe_fd+1, &fd, NULL, NULL, &tv);
>		if (rc == 0) 
>			continue;
>		 else if (rc == -1)
>			break;
>
>		/* Get header first. it is fixed size */
>		vec[0].iov_base = (void*)&hdr;
>		vec[0].iov_len = sizeof(hdr);
>
>		rc = readv(pipe_fd, vec, 1);
>		if (rc == 0 || rc == -1) {
>			fprintf(stderr, "rc == %d(%s)\n", rc, strerror(errno));
>			break;
>		}
>
>		/* Analyze header */
>			/*nothing to do at the momemnt */
>
>        	/* Next payload */
>		vec[1].iov_base = data;
>		vec[1].iov_len = MAXLINE; 
>
>		rc = readv(pipe_fd, &vec[1], 1);
>		if (rc == 0 || rc == -1) {
>			fprintf(stderr, "rc == %d(%s)\n", rc, strerror(errno));
>			break;
>		}
>
>		/* handle events here. Just for illustration, we print
>		   to stderr, but you will want to do something else. */
>		fprintf(stderr,"type=%d, payload size=%d\n", 
>			hdr.type, hdr.size);
>		fprintf(stderr,"data=\"%.*s\"\n", hdr.size,
>			(char *)data);
>
>	} while(!signaled);
>
>	return 0;
>}
>

Actions: View

Attachments on bug 236356: 152537 | 152539