tech-userlevel archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

SoC: Improve syslogd

I am preparing a Summer of Code application and would like to introduce my project and myself, hoping for some feedback and advice.

I want to implement the upcoming IETF standards for Syslog ( In order of priority: syslog-transport-tls, syslog-protocol, and syslog-sign.

- transport-tls defines the network protocol to send syslog over TLS (instead of UDP), thus providing a reliable and authenticated transport. In addition to reliable network transport I also consider a modified local log submission (from syslog(3) to syslogd) to use a stream instead of a datagram socket, thus providing reliable submission and possible rate limits.

- syslog-protocol defines a new layout for syslog lines; the most important additions are full timestamps (with year and timezone) and structured data with name=value pairs. This enables all programs to declare semantic content (uid, client IP, return codes, etc) so an automatic log-monitoring only has to know the used namespace instead of all possible messages.

- syslog-sign defines signature messages for authentication, integrity and correct sequencing of syslog messages. (For this part I am going to build upon the afaik only existing implementation by Albert Mietus.)

To my knowledge that would be one of the first implementations of these
protocols (which hopefully will be published as RFCs this summer). It will provide NetBSD (and probably the other BSDs as well) with an advanced, reliable, and secure syslogd, saving admins the time and effort to install packages and set up custom logging solutions just to get secure transport to their central logserver.

A little about myself: I study computer science at the University of Potsdam, Germany. Beside my studies I administer some FreeBSD servers and have already set up a logging infrastructure using syslog-ng and stunnel, resulting in a talk about Logging at the Chemnitzer Linuxtage 2007 (german only).


Home | Main Index | Thread Index | Old Index