diff options
Diffstat (limited to 'nixpkgs/nixos/modules/services/logging')
| -rw-r--r-- | nixpkgs/nixos/modules/services/logging/SystemdJournal2Gelf.nix | 59 | ||||
| -rw-r--r-- | nixpkgs/nixos/modules/services/logging/awstats.nix | 123 | ||||
| -rw-r--r-- | nixpkgs/nixos/modules/services/logging/fluentd.nix | 58 | ||||
| -rw-r--r-- | nixpkgs/nixos/modules/services/logging/graylog.nix | 170 | ||||
| -rw-r--r-- | nixpkgs/nixos/modules/services/logging/heartbeat.nix | 74 | ||||
| -rw-r--r-- | nixpkgs/nixos/modules/services/logging/journalbeat.nix | 107 | ||||
| -rw-r--r-- | nixpkgs/nixos/modules/services/logging/journaldriver.nix | 112 | ||||
| -rw-r--r-- | nixpkgs/nixos/modules/services/logging/journalwatch.nix | 264 | ||||
| -rw-r--r-- | nixpkgs/nixos/modules/services/logging/klogd.nix | 37 | ||||
| -rw-r--r-- | nixpkgs/nixos/modules/services/logging/logcheck.nix | 237 | ||||
| -rw-r--r-- | nixpkgs/nixos/modules/services/logging/logrotate.nix | 46 | ||||
| -rw-r--r-- | nixpkgs/nixos/modules/services/logging/logstash.nix | 180 | ||||
| -rw-r--r-- | nixpkgs/nixos/modules/services/logging/rsyslogd.nix | 105 | ||||
| -rw-r--r-- | nixpkgs/nixos/modules/services/logging/syslog-ng.nix | 97 | ||||
| -rw-r--r-- | nixpkgs/nixos/modules/services/logging/syslogd.nix | 130 |
15 files changed, 1799 insertions, 0 deletions
diff --git a/nixpkgs/nixos/modules/services/logging/SystemdJournal2Gelf.nix b/nixpkgs/nixos/modules/services/logging/SystemdJournal2Gelf.nix new file mode 100644 index 000000000000..e90d9e7a12b6 --- /dev/null +++ b/nixpkgs/nixos/modules/services/logging/SystemdJournal2Gelf.nix @@ -0,0 +1,59 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let cfg = config.services.SystemdJournal2Gelf; +in + +{ options = { + services.SystemdJournal2Gelf = { + enable = mkOption { + type = types.bool; + default = false; + description = '' + Whether to enable SystemdJournal2Gelf. + ''; + }; + + graylogServer = mkOption { + type = types.string; + example = "graylog2.example.com:11201"; + description = '' + Host and port of your graylog2 input. This should be a GELF + UDP input. + ''; + }; + + extraOptions = mkOption { + type = types.string; + default = ""; + description = '' + Any extra flags to pass to SystemdJournal2Gelf. Note that + these are basically <literal>journalctl</literal> flags. + ''; + }; + + package = mkOption { + type = types.package; + default = pkgs.systemd-journal2gelf; + description = '' + SystemdJournal2Gelf package to use. + ''; + }; + + }; + }; + + config = mkIf cfg.enable { + systemd.services.SystemdJournal2Gelf = { + description = "SystemdJournal2Gelf"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + ExecStart = "${cfg.package}/bin/SystemdJournal2Gelf ${cfg.graylogServer} --follow ${cfg.extraOptions}"; + Restart = "on-failure"; + RestartSec = "30"; + }; + }; + }; +} \ No newline at end of file diff --git a/nixpkgs/nixos/modules/services/logging/awstats.nix b/nixpkgs/nixos/modules/services/logging/awstats.nix new file mode 100644 index 000000000000..612ae06d0a79 --- /dev/null +++ b/nixpkgs/nixos/modules/services/logging/awstats.nix @@ -0,0 +1,123 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.awstats; + package = pkgs.awstats; +in + +{ + options.services.awstats = { + enable = mkOption { + type = types.bool; + default = cfg.service.enable; + description = '' + Enable the awstats program (but not service). + Currently only simple httpd (Apache) configs are supported, + and awstats plugins may not work correctly. + ''; + }; + vardir = mkOption { + type = types.path; + default = "/var/lib/awstats"; + description = "The directory where variable awstats data will be stored."; + }; + + extraConfig = mkOption { + type = types.lines; + default = ""; + description = "Extra configuration to be appendend to awstats.conf."; + }; + + updateAt = mkOption { + type = types.nullOr types.string; + default = null; + example = "hourly"; + description = '' + Specification of the time at which awstats will get updated. + (in the format described by <citerefentry> + <refentrytitle>systemd.time</refentrytitle> + <manvolnum>7</manvolnum></citerefentry>) + ''; + }; + + service = { + enable = mkOption { + type = types.bool; + default = false; + description = ''Enable the awstats web service. This switches on httpd.''; + }; + urlPrefix = mkOption { + type = types.string; + default = "/awstats"; + description = "The URL prefix under which the awstats service appears."; + }; + }; + }; + + + config = mkIf cfg.enable { + environment.systemPackages = [ package.bin ]; + /* TODO: + - heed config.services.httpd.logPerVirtualHost, etc. + - Can't AllowToUpdateStatsFromBrowser, as CGI scripts don't have permission + to read the logs, and our httpd config apparently doesn't an option for that. + */ + environment.etc."awstats/awstats.conf".source = pkgs.runCommand "awstats.conf" + { preferLocalBuild = true; } + ( let + cfg-httpd = config.services.httpd; + logFormat = + if cfg-httpd.logFormat == "combined" then "1" else + if cfg-httpd.logFormat == "common" then "4" else + throw "awstats service doesn't support Apache log format `${cfg-httpd.logFormat}`"; + in + '' + sed \ + -e 's|^\(DirData\)=.*$|\1="${cfg.vardir}"|' \ + -e 's|^\(DirIcons\)=.*$|\1="icons"|' \ + -e 's|^\(CreateDirDataIfNotExists\)=.*$|\1=1|' \ + -e 's|^\(SiteDomain\)=.*$|\1="${cfg-httpd.hostName}"|' \ + -e 's|^\(LogFile\)=.*$|\1="${cfg-httpd.logDir}/access_log"|' \ + -e 's|^\(LogFormat\)=.*$|\1=${logFormat}|' \ + < '${package.out}/wwwroot/cgi-bin/awstats.model.conf' > "$out" + echo '${cfg.extraConfig}' >> "$out" + ''); + + # The httpd sub-service showing awstats. + services.httpd.enable = mkIf cfg.service.enable true; + services.httpd.extraSubservices = mkIf cfg.service.enable [ { function = { serverInfo, ... }: { + extraConfig = + '' + Alias ${cfg.service.urlPrefix}/classes "${package.out}/wwwroot/classes/" + Alias ${cfg.service.urlPrefix}/css "${package.out}/wwwroot/css/" + Alias ${cfg.service.urlPrefix}/icons "${package.out}/wwwroot/icon/" + ScriptAlias ${cfg.service.urlPrefix}/ "${package.out}/wwwroot/cgi-bin/" + + <Directory "${package.out}/wwwroot"> + Options None + AllowOverride None + Order allow,deny + Allow from all + </Directory> + ''; + startupScript = + let + inherit (serverInfo.serverConfig) user group; + in pkgs.writeScript "awstats_startup.sh" + '' + mkdir -p '${cfg.vardir}' + chown '${user}:${group}' '${cfg.vardir}' + ''; + };}]; + + systemd.services.awstats-update = mkIf (cfg.updateAt != null) { + description = "awstats log collector"; + script = "exec '${package.bin}/bin/awstats' -update -config=awstats.conf"; + startAt = cfg.updateAt; + }; + }; + +} + diff --git a/nixpkgs/nixos/modules/services/logging/fluentd.nix b/nixpkgs/nixos/modules/services/logging/fluentd.nix new file mode 100644 index 000000000000..95825705d9d7 --- /dev/null +++ b/nixpkgs/nixos/modules/services/logging/fluentd.nix @@ -0,0 +1,58 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.fluentd; + + pluginArgs = concatStringsSep " " (map (x: "-p ${x}") cfg.plugins); +in { + ###### interface + + options = { + + services.fluentd = { + enable = mkOption { + type = types.bool; + default = false; + description = "Whether to enable fluentd."; + }; + + config = mkOption { + type = types.lines; + default = ""; + description = "Fluentd config."; + }; + + package = mkOption { + type = types.path; + default = pkgs.fluentd; + defaultText = "pkgs.fluentd"; + description = "The fluentd package to use."; + }; + + plugins = mkOption { + type = types.listOf types.path; + default = []; + description = '' + A list of plugin paths to pass into fluentd. It will make plugins defined in ruby files + there available in your config. + ''; + }; + }; + }; + + + ###### implementation + + config = mkIf cfg.enable { + systemd.services.fluentd = with pkgs; { + description = "Fluentd Daemon"; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + ExecStart = "${cfg.package}/bin/fluentd -c ${pkgs.writeText "fluentd.conf" cfg.config} ${pluginArgs}"; + ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID"; + }; + }; + }; +} diff --git a/nixpkgs/nixos/modules/services/logging/graylog.nix b/nixpkgs/nixos/modules/services/logging/graylog.nix new file mode 100644 index 000000000000..a889a44d4b2b --- /dev/null +++ b/nixpkgs/nixos/modules/services/logging/graylog.nix @@ -0,0 +1,170 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.graylog; + + confFile = pkgs.writeText "graylog.conf" '' + is_master = ${boolToString cfg.isMaster} + node_id_file = ${cfg.nodeIdFile} + password_secret = ${cfg.passwordSecret} + root_username = ${cfg.rootUsername} + root_password_sha2 = ${cfg.rootPasswordSha2} + elasticsearch_hosts = ${concatStringsSep "," cfg.elasticsearchHosts} + message_journal_dir = ${cfg.messageJournalDir} + mongodb_uri = ${cfg.mongodbUri} + plugin_dir = /var/lib/graylog/plugins + + ${cfg.extraConfig} + ''; + + glPlugins = pkgs.buildEnv { + name = "graylog-plugins"; + paths = cfg.plugins; + }; + +in + +{ + ###### interface + + options = { + + services.graylog = { + + enable = mkEnableOption "Graylog"; + + package = mkOption { + type = types.package; + default = pkgs.graylog; + defaultText = "pkgs.graylog"; + example = literalExample "pkgs.graylog"; + description = "Graylog package to use."; + }; + + user = mkOption { + type = types.str; + default = "graylog"; + example = literalExample "graylog"; + description = "User account under which graylog runs"; + }; + + isMaster = mkOption { + type = types.bool; + default = true; + description = "Whether this is the master instance of your Graylog cluster"; + }; + + nodeIdFile = mkOption { + type = types.str; + default = "/var/lib/graylog/server/node-id"; + description = "Path of the file containing the graylog node-id"; + }; + + passwordSecret = mkOption { + type = types.str; + description = '' + You MUST set a secret to secure/pepper the stored user passwords here. Use at least 64 characters. + Generate one by using for example: pwgen -N 1 -s 96 + ''; + }; + + rootUsername = mkOption { + type = types.str; + default = "admin"; + description = "Name of the default administrator user"; + }; + + rootPasswordSha2 = mkOption { + type = types.str; + example = "e3c652f0ba0b4801205814f8b6bc49672c4c74e25b497770bb89b22cdeb4e952"; + description = '' + You MUST specify a hash password for the root user (which you only need to initially set up the + system and in case you lose connectivity to your authentication backend) + This password cannot be changed using the API or via the web interface. If you need to change it, + modify it here. + Create one by using for example: echo -n yourpassword | shasum -a 256 + and use the resulting hash value as string for the option + ''; + }; + + elasticsearchHosts = mkOption { + type = types.listOf types.str; + example = literalExample ''[ "http://node1:9200" "http://user:password@node2:19200" ]''; + description = "List of valid URIs of the http ports of your elastic nodes. If one or more of your elasticsearch hosts require authentication, include the credentials in each node URI that requires authentication"; + }; + + messageJournalDir = mkOption { + type = types.str; + default = "/var/lib/graylog/data/journal"; + description = "The directory which will be used to store the message journal. The directory must be exclusively used by Graylog and must not contain any other files than the ones created by Graylog itself"; + }; + + mongodbUri = mkOption { + type = types.str; + default = "mongodb://localhost/graylog"; + description = "MongoDB connection string. See http://docs.mongodb.org/manual/reference/connection-string/ for details"; + }; + + extraConfig = mkOption { + type = types.lines; + default = ""; + description = "Any other configuration options you might want to add"; + }; + + plugins = mkOption { + description = "Extra graylog plugins"; + default = [ ]; + type = types.listOf types.package; + }; + + }; + }; + + + ###### implementation + + config = mkIf cfg.enable { + + users.users = mkIf (cfg.user == "graylog") { + graylog = { + uid = config.ids.uids.graylog; + description = "Graylog server daemon user"; + }; + }; + + systemd.tmpfiles.rules = [ + "d '${cfg.messageJournalDir}' - ${cfg.user} - - -" + ]; + + systemd.services.graylog = with pkgs; { + description = "Graylog Server"; + wantedBy = [ "multi-user.target" ]; + environment = { + JAVA_HOME = jre; + GRAYLOG_CONF = "${confFile}"; + }; + path = [ pkgs.jre_headless pkgs.which pkgs.procps ]; + preStart = '' + rm -rf /var/lib/graylog/plugins || true + mkdir -p /var/lib/graylog/plugins -m 755 + + mkdir -p "$(dirname ${cfg.nodeIdFile})" + chown -R ${cfg.user} "$(dirname ${cfg.nodeIdFile})" + + for declarativeplugin in `ls ${glPlugins}/bin/`; do + ln -sf ${glPlugins}/bin/$declarativeplugin /var/lib/graylog/plugins/$declarativeplugin + done + for includedplugin in `ls ${cfg.package}/plugin/`; do + ln -s ${cfg.package}/plugin/$includedplugin /var/lib/graylog/plugins/$includedplugin || true + done + ''; + serviceConfig = { + User="${cfg.user}"; + StateDirectory = "graylog"; + ExecStart = "${cfg.package}/bin/graylogctl run"; + }; + }; + }; +} diff --git a/nixpkgs/nixos/modules/services/logging/heartbeat.nix b/nixpkgs/nixos/modules/services/logging/heartbeat.nix new file mode 100644 index 000000000000..56fb4deabda5 --- /dev/null +++ b/nixpkgs/nixos/modules/services/logging/heartbeat.nix @@ -0,0 +1,74 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.heartbeat; + + heartbeatYml = pkgs.writeText "heartbeat.yml" '' + name: ${cfg.name} + tags: ${builtins.toJSON cfg.tags} + + ${cfg.extraConfig} + ''; + +in +{ + options = { + + services.heartbeat = { + + enable = mkEnableOption "heartbeat"; + + name = mkOption { + type = types.str; + default = "heartbeat"; + description = "Name of the beat"; + }; + + tags = mkOption { + type = types.listOf types.str; + default = []; + description = "Tags to place on the shipped log messages"; + }; + + stateDir = mkOption { + type = types.str; + default = "/var/lib/heartbeat"; + description = "The state directory. heartbeat's own logs and other data are stored here."; + }; + + extraConfig = mkOption { + type = types.lines; + default = '' + heartbeat.monitors: + - type: http + urls: ["http://localhost:9200"] + schedule: '@every 10s' + ''; + description = "Any other configuration options you want to add"; + }; + + }; + }; + + config = mkIf cfg.enable { + + systemd.tmpfiles.rules = [ + "d '${cfg.stateDir}' - nobody nogroup - -" + ]; + + systemd.services.heartbeat = with pkgs; { + description = "heartbeat log shipper"; + wantedBy = [ "multi-user.target" ]; + preStart = '' + mkdir -p "${cfg.stateDir}"/{data,logs} + ''; + serviceConfig = { + User = "nobody"; + AmbientCapabilities = "cap_net_raw"; + ExecStart = "${pkgs.heartbeat}/bin/heartbeat -c \"${heartbeatYml}\" -path.data \"${cfg.stateDir}/data\" -path.logs \"${cfg.stateDir}/logs\""; + }; + }; + }; +} diff --git a/nixpkgs/nixos/modules/services/logging/journalbeat.nix b/nixpkgs/nixos/modules/services/logging/journalbeat.nix new file mode 100644 index 000000000000..89f53b1b2454 --- /dev/null +++ b/nixpkgs/nixos/modules/services/logging/journalbeat.nix @@ -0,0 +1,107 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.journalbeat; + + lt6 = builtins.compareVersions cfg.package.version "6" < 0; + + journalbeatYml = pkgs.writeText "journalbeat.yml" '' + name: ${cfg.name} + tags: ${builtins.toJSON cfg.tags} + + ${optionalString lt6 "journalbeat.cursor_state_file: /var/lib/${cfg.stateDir}/cursor-state"} + + ${cfg.extraConfig} + ''; + +in +{ + options = { + + services.journalbeat = { + + enable = mkEnableOption "journalbeat"; + + package = mkOption { + type = types.package; + default = pkgs.journalbeat; + defaultText = "pkgs.journalbeat"; + example = literalExample "pkgs.journalbeat7"; + description = '' + The journalbeat package to use + ''; + }; + + name = mkOption { + type = types.str; + default = "journalbeat"; + description = "Name of the beat"; + }; + + tags = mkOption { + type = types.listOf types.str; + default = []; + description = "Tags to place on the shipped log messages"; + }; + + stateDir = mkOption { + type = types.str; + default = "journalbeat"; + description = '' + Directory below <literal>/var/lib/</literal> to store journalbeat's + own logs and other data. This directory will be created automatically + using systemd's StateDirectory mechanism. + ''; + }; + + extraConfig = mkOption { + type = types.lines; + default = optionalString lt6 '' + journalbeat: + seek_position: cursor + cursor_seek_fallback: tail + write_cursor_state: true + cursor_flush_period: 5s + clean_field_names: true + convert_to_numbers: false + move_metadata_to_field: journal + default_type: journal + ''; + description = "Any other configuration options you want to add"; + }; + + }; + }; + + config = mkIf cfg.enable { + + assertions = [ + { + assertion = !hasPrefix "/" cfg.stateDir; + message = + "The option services.journalbeat.stateDir shouldn't be an absolute directory." + + " It should be a directory relative to /var/lib/."; + } + ]; + + systemd.services.journalbeat = { + description = "Journalbeat log shipper"; + wantedBy = [ "multi-user.target" ]; + preStart = '' + mkdir -p ${cfg.stateDir}/data + mkdir -p ${cfg.stateDir}/logs + ''; + serviceConfig = { + StateDirectory = cfg.stateDir; + ExecStart = '' + ${cfg.package}/bin/journalbeat \ + -c ${journalbeatYml} \ + -path.data /var/lib/${cfg.stateDir}/data \ + -path.logs /var/lib/${cfg.stateDir}/logs''; + Restart = "always"; + }; + }; + }; +} diff --git a/nixpkgs/nixos/modules/services/logging/journaldriver.nix b/nixpkgs/nixos/modules/services/logging/journaldriver.nix new file mode 100644 index 000000000000..9bd581e9ec0e --- /dev/null +++ b/nixpkgs/nixos/modules/services/logging/journaldriver.nix @@ -0,0 +1,112 @@ +# This module implements a systemd service for running journaldriver, +# a log forwarding agent that sends logs from journald to Stackdriver +# Logging. +# +# It can be enabled without extra configuration when running on GCP. +# On machines hosted elsewhere, the other configuration options need +# to be set. +# +# For further information please consult the documentation in the +# upstream repository at: https://github.com/tazjin/journaldriver/ + +{ config, lib, pkgs, ...}: + +with lib; let cfg = config.services.journaldriver; +in { + options.services.journaldriver = { + enable = mkOption { + type = types.bool; + default = false; + description = '' + Whether to enable journaldriver to forward journald logs to + Stackdriver Logging. + ''; + }; + + logLevel = mkOption { + type = types.str; + default = "info"; + description = '' + Log level at which journaldriver logs its own output. + ''; + }; + + logName = mkOption { + type = with types; nullOr str; + default = null; + description = '' + Configures the name of the target log in Stackdriver Logging. + This option can be set to, for example, the hostname of a + machine to improve the user experience in the logging + overview. + ''; + }; + + googleCloudProject = mkOption { + type = with types; nullOr str; + default = null; + description = '' + Configures the name of the Google Cloud project to which to + forward journald logs. + + This option is required on non-GCP machines, but should not be + set on GCP instances. + ''; + }; + + logStream = mkOption { + type = with types; nullOr str; + default = null; + description = '' + Configures the name of the Stackdriver Logging log stream into + which to write journald entries. + + This option is required on non-GCP machines, but should not be + set on GCP instances. + ''; + }; + + applicationCredentials = mkOption { + type = with types; nullOr path; + default = null; + description = '' + Path to the service account private key (in JSON-format) used + to forward log entries to Stackdriver Logging on non-GCP + instances. + + This option is required on non-GCP machines, but should not be + set on GCP instances. + ''; + }; + }; + + config = mkIf cfg.enable { + systemd.services.journaldriver = { + description = "Stackdriver Logging journal forwarder"; + script = "${pkgs.journaldriver}/bin/journaldriver"; + after = [ "network-online.target" ]; + wantedBy = [ "multi-user.target" ]; + + serviceConfig = { + Restart = "always"; + DynamicUser = true; + + # This directive lets systemd automatically configure + # permissions on /var/lib/journaldriver, the directory in + # which journaldriver persists its cursor state. + StateDirectory = "journaldriver"; + + # This group is required for accessing journald. + SupplementaryGroups = "systemd-journal"; + }; + + environment = { + RUST_LOG = cfg.logLevel; + LOG_NAME = cfg.logName; + LOG_STREAM = cfg.logStream; + GOOGLE_CLOUD_PROJECT = cfg.googleCloudProject; + GOOGLE_APPLICATION_CREDENTIALS = cfg.applicationCredentials; + }; + }; + }; +} diff --git a/nixpkgs/nixos/modules/services/logging/journalwatch.nix b/nixpkgs/nixos/modules/services/logging/journalwatch.nix new file mode 100644 index 000000000000..576c646c0f58 --- /dev/null +++ b/nixpkgs/nixos/modules/services/logging/journalwatch.nix @@ -0,0 +1,264 @@ +{ config, lib, pkgs, ... }: +with lib; + +let + cfg = config.services.journalwatch; + user = "journalwatch"; + # for journal access + group = "systemd-journal"; + dataDir = "/var/lib/${user}"; + + journalwatchConfig = pkgs.writeText "config" ('' + # (File Generated by NixOS journalwatch module.) + [DEFAULT] + mail_binary = ${cfg.mailBinary} + priority = ${toString cfg.priority} + mail_from = ${cfg.mailFrom} + '' + + optionalString (cfg.mailTo != null) '' + mail_to = ${cfg.mailTo} + '' + + cfg.extraConfig); + + journalwatchPatterns = pkgs.writeText "patterns" '' + # (File Generated by NixOS journalwatch module.) + + ${mkPatterns cfg.filterBlocks} + ''; + + # empty line at the end needed to to separate the blocks + mkPatterns = filterBlocks: concatStringsSep "\n" (map (block: '' + ${block.match} + ${block.filters} + + '') filterBlocks); + + # can't use joinSymlinks directly, because when we point $XDG_CONFIG_HOME + # to the /nix/store path, we still need the subdirectory "journalwatch" inside that + # to match journalwatch's expectations + journalwatchConfigDir = pkgs.runCommand "journalwatch-config" + { preferLocalBuild = true; allowSubstitutes = false; } + '' + mkdir -p $out/journalwatch + ln -sf ${journalwatchConfig} $out/journalwatch/config + ln -sf ${journalwatchPatterns} $out/journalwatch/patterns + ''; + + +in { + options = { + services.journalwatch = { + enable = mkOption { + type = types.bool; + default = false; + description = '' + If enabled, periodically check the journal with journalwatch and report the results by mail. + ''; + }; + + priority = mkOption { + type = types.int; + default = 6; + description = '' + Lowest priority of message to be considered. + A value between 7 ("debug"), and 0 ("emerg"). Defaults to 6 ("info"). + If you don't care about anything with "info" priority, you can reduce + this to e.g. 5 ("notice") to considerably reduce the amount of + messages without needing many <option>filterBlocks</option>. + ''; + }; + + # HACK: this is a workaround for journalwatch's usage of socket.getfqdn() which always returns localhost if + # there's an alias for the localhost on a separate line in /etc/hosts, or take for ages if it's not present and + # then return something right-ish in the direction of /etc/hostname. Just bypass it completely. + mailFrom = mkOption { + type = types.str; + default = "journalwatch@${config.networking.hostName}"; + description = '' + Mail address to send journalwatch reports from. + ''; + }; + + mailTo = mkOption { + type = types.nullOr types.str; + default = null; + description = '' + Mail address to send journalwatch reports to. + ''; + }; + + mailBinary = mkOption { + type = types.path; + default = "/run/wrappers/bin/sendmail"; + description = '' + Sendmail-compatible binary to be used to send the messages. + ''; + }; + + extraConfig = mkOption { + type = types.str; + default = ""; + description = '' + Extra lines to be added verbatim to the journalwatch/config configuration file. + You can add any commandline argument to the config, without the '--'. + See <literal>journalwatch --help</literal> for all arguments and their description. + ''; + }; + + filterBlocks = mkOption { + type = types.listOf (types.submodule { + options = { + match = mkOption { + type = types.str; + example = "SYSLOG_IDENTIFIER = systemd"; + description = '' + Syntax: <literal>field = value</literal> + Specifies the log entry <literal>field</literal> this block should apply to. + If the <literal>field</literal> of a message matches this <literal>value</literal>, + this patternBlock's <option>filters</option> are applied. + If <literal>value</literal> starts and ends with a slash, it is interpreted as + an extended python regular expression, if not, it's an exact match. + The journal fields are explained in systemd.journal-fields(7). + ''; + }; + + filters = mkOption { + type = types.str; + example = '' + (Stopped|Stopping|Starting|Started) .* + (Reached target|Stopped target) .* + ''; + description = '' + The filters to apply on all messages which satisfy <option>match</option>. + Any of those messages that match any specified filter will be removed from journalwatch's output. + Each filter is an extended Python regular expression. + You can specify multiple filters and separate them by newlines. + Lines starting with '#' are comments. Inline-comments are not permitted. + ''; + }; + }; + }); + + example = [ + # examples taken from upstream + { + match = "_SYSTEMD_UNIT = systemd-logind.service"; + filters = '' + New session [a-z]?\d+ of user \w+\. + Removed session [a-z]?\d+\. + ''; + } + + { + match = "SYSLOG_IDENTIFIER = /(CROND|crond)/"; + filters = '' + pam_unix\(crond:session\): session (opened|closed) for user \w+ + \(\w+\) CMD .* + ''; + } + ]; + + # another example from upstream. + # very useful on priority = 6, and required as journalwatch throws an error when no pattern is defined at all. + default = [ + { + match = "SYSLOG_IDENTIFIER = systemd"; + filters = '' + (Stopped|Stopping|Starting|Started) .* + (Created slice|Removed slice) user-\d*\.slice\. + Received SIGRTMIN\+24 from PID .* + (Reached target|Stopped target) .* + Startup finished in \d*ms\. + ''; + } + ]; + + + description = '' + filterBlocks can be defined to blacklist journal messages which are not errors. + Each block matches on a log entry field, and the filters in that block then are matched + against all messages with a matching log entry field. + + All messages whose PRIORITY is at least 6 (INFO) are processed by journalwatch. + If you don't specify any filterBlocks, PRIORITY is reduced to 5 (NOTICE) by default. + + All regular expressions are extended Python regular expressions, for details + see: http://doc.pyschools.com/html/regex.html + ''; + }; + + interval = mkOption { + type = types.str; + default = "hourly"; + description = '' + How often to run journalwatch. + + The format is described in systemd.time(7). + ''; + }; + accuracy = mkOption { + type = types.str; + default = "10min"; + description = '' + The time window around the interval in which the journalwatch run will be scheduled. + + The format is described in systemd.time(7). + ''; + }; + }; + }; + + config = mkIf cfg.enable { + + users.users.${user} = { + isSystemUser = true; + home = dataDir; + group = group; + }; + + systemd.tmpfiles.rules = [ + # present since NixOS 19.09: remove old stateful symlink join directory, + # which has been replaced with the journalwatchConfigDir store path + "R ${dataDir}/config" + ]; + + systemd.services.journalwatch = { + + environment = { + # journalwatch stores the last processed timpestamp here + # the share subdirectory is historic now that config home lives in /nix/store, + # but moving this in a backwards-compatible way is much more work than what's justified + # for cleaning that up. + XDG_DATA_HOME = "${dataDir}/share"; + XDG_CONFIG_HOME = journalwatchConfigDir; + }; + serviceConfig = { + User = user; + Group = group; + Type = "oneshot"; + # requires a relative directory name to create beneath /var/lib + StateDirectory = user; + StateDirectoryMode = 0750; + ExecStart = "${pkgs.python3Packages.journalwatch}/bin/journalwatch mail"; + # lowest CPU and IO priority, but both still in best-effort class to prevent starvation + Nice=19; + IOSchedulingPriority=7; + }; + }; + + systemd.timers.journalwatch = { + description = "Periodic journalwatch run"; + wantedBy = [ "timers.target" ]; + timerConfig = { + OnCalendar = cfg.interval; + AccuracySec = cfg.accuracy; + Persistent = true; + }; + }; + + }; + + meta = { + maintainers = with lib.maintainers; [ florianjacob ]; + }; +} diff --git a/nixpkgs/nixos/modules/services/logging/klogd.nix b/nixpkgs/nixos/modules/services/logging/klogd.nix new file mode 100644 index 000000000000..2d1f515da920 --- /dev/null +++ b/nixpkgs/nixos/modules/services/logging/klogd.nix @@ -0,0 +1,37 @@ +{ config, lib, pkgs, ... }: + +with lib; + +{ + ###### interface + + options = { + + services.klogd.enable = mkOption { + type = types.bool; + default = versionOlder (getVersion config.boot.kernelPackages.kernel) "3.5"; + description = '' + Whether to enable klogd, the kernel log message processing + daemon. Since systemd handles logging of kernel messages on + Linux 3.5 and later, this is only useful if you're running an + older kernel. + ''; + }; + + }; + + + ###### implementation + + config = mkIf config.services.klogd.enable { + systemd.services.klogd = { + description = "Kernel Log Daemon"; + wantedBy = [ "multi-user.target" ]; + path = [ pkgs.sysklogd ]; + unitConfig.ConditionVirtualization = "!systemd-nspawn"; + script = + "klogd -c 1 -2 -n " + + "-k $(dirname $(readlink -f /run/booted-system/kernel))/System.map"; + }; + }; +} diff --git a/nixpkgs/nixos/modules/services/logging/logcheck.nix b/nixpkgs/nixos/modules/services/logging/logcheck.nix new file mode 100644 index 000000000000..f139190a1709 --- /dev/null +++ b/nixpkgs/nixos/modules/services/logging/logcheck.nix @@ -0,0 +1,237 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.logcheck; + + defaultRules = pkgs.runCommand "logcheck-default-rules" { preferLocalBuild = true; } '' + cp -prd ${pkgs.logcheck}/etc/logcheck $out + chmod u+w $out + rm -r $out/logcheck.* + ''; + + rulesDir = pkgs.symlinkJoin + { name = "logcheck-rules-dir"; + paths = ([ defaultRules ] ++ cfg.extraRulesDirs); + }; + + configFile = pkgs.writeText "logcheck.conf" cfg.config; + + logFiles = pkgs.writeText "logcheck.logfiles" cfg.files; + + flags = "-r ${rulesDir} -c ${configFile} -L ${logFiles} -${levelFlag} -m ${cfg.mailTo}"; + + levelFlag = getAttrFromPath [cfg.level] + { "paranoid" = "p"; + "server" = "s"; + "workstation" = "w"; + }; + + cronJob = '' + @reboot logcheck env PATH=/run/wrappers/bin:$PATH nice -n10 ${pkgs.logcheck}/sbin/logcheck -R ${flags} + 2 ${cfg.timeOfDay} * * * logcheck env PATH=/run/wrappers/bin:$PATH nice -n10 ${pkgs.logcheck}/sbin/logcheck ${flags} + ''; + + writeIgnoreRule = name: {level, regex, ...}: + pkgs.writeTextFile + { inherit name; + destination = "/ignore.d.${level}/${name}"; + text = '' + ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ ${regex} + ''; + }; + + writeIgnoreCronRule = name: {level, user, regex, cmdline, ...}: + let escapeRegex = escape (stringToCharacters "\\[]{}()^$?*+|."); + cmdline_ = builtins.unsafeDiscardStringContext cmdline; + re = if regex != "" then regex else if cmdline_ == "" then ".*" else escapeRegex cmdline_; + in writeIgnoreRule "cron-${name}" { + inherit level; + regex = '' + (/usr/bin/)?cron\[[0-9]+\]: \(${user}\) CMD \(${re}\)$ + ''; + }; + + levelOption = mkOption { + default = "server"; + type = types.enum [ "workstation" "server" "paranoid" ]; + description = '' + Set the logcheck level. + ''; + }; + + ignoreOptions = { + options = { + level = levelOption; + + regex = mkOption { + default = ""; + type = types.str; + description = '' + Regex specifying which log lines to ignore. + ''; + }; + }; + }; + + ignoreCronOptions = { + options = { + user = mkOption { + default = "root"; + type = types.str; + description = '' + User that runs the cronjob. + ''; + }; + + cmdline = mkOption { + default = ""; + type = types.str; + description = '' + Command line for the cron job. Will be turned into a regex for the logcheck ignore rule. + ''; + }; + + timeArgs = mkOption { + default = null; + type = types.nullOr (types.str); + example = "02 06 * * *"; + description = '' + "min hr dom mon dow" crontab time args, to auto-create a cronjob too. + Leave at null to not do this and just add a logcheck ignore rule. + ''; + }; + }; + }; + +in +{ + options = { + services.logcheck = { + enable = mkOption { + default = false; + type = types.bool; + description = '' + Enable the logcheck cron job. + ''; + }; + + user = mkOption { + default = "logcheck"; + type = types.str; + description = '' + Username for the logcheck user. + ''; + }; + + timeOfDay = mkOption { + default = "*"; + example = "6"; + type = types.str; + description = '' + Time of day to run logcheck. A logcheck will be scheduled at xx:02 each day. + Leave default (*) to run every hour. Of course when nothing special was logged, + logcheck will be silent. + ''; + }; + + mailTo = mkOption { + default = "root"; + example = "you@domain.com"; + type = types.str; + description = '' + Email address to send reports to. + ''; + }; + + level = mkOption { + default = "server"; + type = types.str; + description = '' + Set the logcheck level. Either "workstation", "server", or "paranoid". + ''; + }; + + config = mkOption { + default = "FQDN=1"; + type = types.string; + description = '' + Config options that you would like in logcheck.conf. + ''; + }; + + files = mkOption { + default = [ "/var/log/messages" ]; + type = types.listOf types.path; + example = [ "/var/log/messages" "/var/log/mail" ]; + description = '' + Which log files to check. + ''; + }; + + extraRulesDirs = mkOption { + default = []; + example = "/etc/logcheck"; + type = types.listOf types.path; + description = '' + Directories with extra rules. + ''; + }; + + ignore = mkOption { + default = {}; + description = '' + This option defines extra ignore rules. + ''; + type = with types; attrsOf (submodule ignoreOptions); + }; + + ignoreCron = mkOption { + default = {}; + description = '' + This option defines extra ignore rules for cronjobs. + ''; + type = with types; attrsOf (submodule ignoreCronOptions); + }; + + extraGroups = mkOption { + default = []; + type = types.listOf types.str; + example = [ "postdrop" "mongodb" ]; + description = '' + Extra groups for the logcheck user, for example to be able to use sendmail, + or to access certain log files. + ''; + }; + + }; + }; + + config = mkIf cfg.enable { + services.logcheck.extraRulesDirs = + mapAttrsToList writeIgnoreRule cfg.ignore + ++ mapAttrsToList writeIgnoreCronRule cfg.ignoreCron; + + users.users = optionalAttrs (cfg.user == "logcheck") (singleton + { name = "logcheck"; + uid = config.ids.uids.logcheck; + shell = "/bin/sh"; + description = "Logcheck user account"; + extraGroups = cfg.extraGroups; + }); + + system.activationScripts.logcheck = '' + mkdir -m 700 -p /var/{lib,lock}/logcheck + chown ${cfg.user} /var/{lib,lock}/logcheck + ''; + + services.cron.systemCronJobs = + let withTime = name: {timeArgs, ...}: timeArgs != null; + mkCron = name: {user, cmdline, timeArgs, ...}: '' + ${timeArgs} ${user} ${cmdline} + ''; + in mapAttrsToList mkCron (filterAttrs withTime cfg.ignoreCron) + ++ [ cronJob ]; + }; +} diff --git a/nixpkgs/nixos/modules/services/logging/logrotate.nix b/nixpkgs/nixos/modules/services/logging/logrotate.nix new file mode 100644 index 000000000000..fdd9f0f3e5c2 --- /dev/null +++ b/nixpkgs/nixos/modules/services/logging/logrotate.nix @@ -0,0 +1,46 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.logrotate; + + configFile = pkgs.writeText "logrotate.conf" + cfg.config; + +in +{ + options = { + services.logrotate = { + enable = mkOption { + type = lib.types.bool; + default = false; + description = '' + Enable the logrotate cron job + ''; + }; + + config = mkOption { + default = ""; + type = types.lines; + description = '' + The contents of the logrotate config file + ''; + }; + }; + }; + + config = mkIf cfg.enable { + systemd.services.logrotate = { + description = "Logrotate Service"; + wantedBy = [ "multi-user.target" ]; + startAt = "*-*-* *:05:00"; + + serviceConfig.Restart = "no"; + serviceConfig.User = "root"; + script = '' + exec ${pkgs.logrotate}/sbin/logrotate ${configFile} + ''; + }; + }; +} diff --git a/nixpkgs/nixos/modules/services/logging/logstash.nix b/nixpkgs/nixos/modules/services/logging/logstash.nix new file mode 100644 index 000000000000..9b707e9deb58 --- /dev/null +++ b/nixpkgs/nixos/modules/services/logging/logstash.nix @@ -0,0 +1,180 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.logstash; + pluginPath = lib.concatStringsSep ":" cfg.plugins; + havePluginPath = lib.length cfg.plugins > 0; + ops = lib.optionalString; + verbosityFlag = "--log.level " + cfg.logLevel; + + pluginsPath = "--path.plugins ${pluginPath}"; + + logstashConf = pkgs.writeText "logstash.conf" '' + input { + ${cfg.inputConfig} + } + + filter { + ${cfg.filterConfig} + } + + output { + ${cfg.outputConfig} + } + ''; + + logstashSettingsYml = pkgs.writeText "logstash.yml" cfg.extraSettings; + + logstashSettingsDir = pkgs.runCommand "logstash-settings" { + inherit logstashSettingsYml; + preferLocalBuild = true; + } '' + mkdir -p $out + ln -s $logstashSettingsYml $out/logstash.yml + ''; +in + +{ + ###### interface + + options = { + + services.logstash = { + + enable = mkOption { + type = types.bool; + default = false; + description = "Enable logstash."; + }; + + package = mkOption { + type = types.package; + default = pkgs.logstash; + defaultText = "pkgs.logstash"; + example = literalExample "pkgs.logstash5"; + description = "Logstash package to use."; + }; + + plugins = mkOption { + type = types.listOf types.path; + default = [ ]; + example = literalExample "[ pkgs.logstash-contrib ]"; + description = "The paths to find other logstash plugins in."; + }; + + dataDir = mkOption { + type = types.str; + default = "/var/lib/logstash"; + description = '' + A path to directory writable by logstash that it uses to store data. + Plugins will also have access to this path. + ''; + }; + + logLevel = mkOption { + type = types.enum [ "debug" "info" "warn" "error" "fatal" ]; + default = "warn"; + description = "Logging verbosity level."; + }; + + filterWorkers = mkOption { + type = types.int; + default = 1; + description = "The quantity of filter workers to run."; + }; + + listenAddress = mkOption { + type = types.str; + default = "127.0.0.1"; + description = "Address on which to start webserver."; + }; + + port = mkOption { + type = types.str; + default = "9292"; + description = "Port on which to start webserver."; + }; + + inputConfig = mkOption { + type = types.lines; + default = ''generator { }''; + description = "Logstash input configuration."; + example = '' + # Read from journal + pipe { + command => "''${pkgs.systemd}/bin/journalctl -f -o json" + type => "syslog" codec => json {} + } + ''; + }; + + filterConfig = mkOption { + type = types.lines; + default = ""; + description = "logstash filter configuration."; + example = '' + if [type] == "syslog" { + # Keep only relevant systemd fields + # http://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html + prune { + whitelist_names => [ + "type", "@timestamp", "@version", + "MESSAGE", "PRIORITY", "SYSLOG_FACILITY" + ] + } + } + ''; + }; + + outputConfig = mkOption { + type = types.lines; + default = ''stdout { codec => rubydebug }''; + description = "Logstash output configuration."; + example = '' + redis { host => ["localhost"] data_type => "list" key => "logstash" codec => json } + elasticsearch { } + ''; + }; + + extraSettings = mkOption { + type = types.lines; + default = ""; + description = "Extra Logstash settings in YAML format."; + example = '' + pipeline: + batch: + size: 125 + delay: 5 + ''; + }; + + + }; + }; + + + ###### implementation + + config = mkIf cfg.enable { + systemd.services.logstash = with pkgs; { + description = "Logstash Daemon"; + wantedBy = [ "multi-user.target" ]; + environment = { JAVA_HOME = jre; }; + path = [ pkgs.bash ]; + serviceConfig = { + ExecStartPre = ''${pkgs.coreutils}/bin/mkdir -p "${cfg.dataDir}" ; ${pkgs.coreutils}/bin/chmod 700 "${cfg.dataDir}"''; + ExecStart = concatStringsSep " " (filter (s: stringLength s != 0) [ + "${cfg.package}/bin/logstash" + "-w ${toString cfg.filterWorkers}" + (ops havePluginPath pluginsPath) + "${verbosityFlag}" + "-f ${logstashConf}" + "--path.settings ${logstashSettingsDir}" + "--path.data ${cfg.dataDir}" + ]); + }; + }; + }; +} diff --git a/nixpkgs/nixos/modules/services/logging/rsyslogd.nix b/nixpkgs/nixos/modules/services/logging/rsyslogd.nix new file mode 100644 index 000000000000..1ea96b8f1325 --- /dev/null +++ b/nixpkgs/nixos/modules/services/logging/rsyslogd.nix @@ -0,0 +1,105 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + + cfg = config.services.rsyslogd; + + syslogConf = pkgs.writeText "syslog.conf" '' + $ModLoad imuxsock + $SystemLogSocketName /run/systemd/journal/syslog + $WorkDirectory /var/spool/rsyslog + + ${cfg.defaultConfig} + ${cfg.extraConfig} + ''; + + defaultConf = '' + # "local1" is used for dhcpd messages. + local1.* -/var/log/dhcpd + + mail.* -/var/log/mail + + *.=warning;*.=err -/var/log/warn + *.crit /var/log/warn + + *.*;mail.none;local1.none -/var/log/messages + ''; + +in + +{ + ###### interface + + options = { + + services.rsyslogd = { + + enable = mkOption { + type = types.bool; + default = false; + description = '' + Whether to enable syslogd. Note that systemd also logs + syslog messages, so you normally don't need to run syslogd. + ''; + }; + + defaultConfig = mkOption { + type = types.string; + default = defaultConf; + description = '' + The default <filename>syslog.conf</filename> file configures a + fairly standard setup of log files, which can be extended by + means of <varname>extraConfig</varname>. + ''; + }; + + extraConfig = mkOption { + type = types.string; + default = ""; + example = "news.* -/var/log/news"; + description = '' + Additional text appended to <filename>syslog.conf</filename>, + i.e. the contents of <varname>defaultConfig</varname>. + ''; + }; + + extraParams = mkOption { + type = types.listOf types.str; + default = [ ]; + example = [ "-m 0" ]; + description = '' + Additional parameters passed to <command>rsyslogd</command>. + ''; + }; + + }; + + }; + + + ###### implementation + + config = mkIf cfg.enable { + + environment.systemPackages = [ pkgs.rsyslog ]; + + systemd.services.syslog = + { description = "Syslog Daemon"; + + requires = [ "syslog.socket" ]; + + wantedBy = [ "multi-user.target" ]; + + serviceConfig = + { ExecStart = "${pkgs.rsyslog}/sbin/rsyslogd ${toString cfg.extraParams} -f ${syslogConf} -n"; + ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p /var/spool/rsyslog"; + # Prevent syslogd output looping back through journald. + StandardOutput = "null"; + }; + }; + + }; + +} diff --git a/nixpkgs/nixos/modules/services/logging/syslog-ng.nix b/nixpkgs/nixos/modules/services/logging/syslog-ng.nix new file mode 100644 index 000000000000..65e103ac2ba5 --- /dev/null +++ b/nixpkgs/nixos/modules/services/logging/syslog-ng.nix @@ -0,0 +1,97 @@ +{ config, pkgs, lib, ... }: + +with lib; + +let + + cfg = config.services.syslog-ng; + + syslogngConfig = pkgs.writeText "syslog-ng.conf" '' + ${cfg.configHeader} + ${cfg.extraConfig} + ''; + + ctrlSocket = "/run/syslog-ng/syslog-ng.ctl"; + pidFile = "/run/syslog-ng/syslog-ng.pid"; + persistFile = "/var/syslog-ng/syslog-ng.persist"; + + syslogngOptions = [ + "--foreground" + "--module-path=${concatStringsSep ":" (["${cfg.package}/lib/syslog-ng"] ++ cfg.extraModulePaths)}" + "--cfgfile=${syslogngConfig}" + "--control=${ctrlSocket}" + "--persist-file=${persistFile}" + "--pidfile=${pidFile}" + ]; + +in { + + options = { + + services.syslog-ng = { + enable = mkOption { + type = types.bool; + default = false; + description = '' + Whether to enable the syslog-ng daemon. + ''; + }; + package = mkOption { + type = types.package; + default = pkgs.syslogng; + defaultText = "pkgs.syslogng"; + description = '' + The package providing syslog-ng binaries. + ''; + }; + extraModulePaths = mkOption { + type = types.listOf types.str; + default = []; + example = literalExample '' + [ "''${pkgs.syslogng_incubator}/lib/syslog-ng" ] + ''; + description = '' + A list of paths that should be included in syslog-ng's + <literal>--module-path</literal> option. They should usually + end in <literal>/lib/syslog-ng</literal> + ''; + }; + extraConfig = mkOption { + type = types.lines; + default = ""; + description = '' + Configuration added to the end of <literal>syslog-ng.conf</literal>. + ''; + }; + configHeader = mkOption { + type = types.lines; + default = '' + @version: 3.6 + @include "scl.conf" + ''; + description = '' + The very first lines of the configuration file. Should usually contain + the syslog-ng version header. + ''; + }; + }; + }; + + config = mkIf cfg.enable { + systemd.services.syslog-ng = { + description = "syslog-ng daemon"; + preStart = "mkdir -p /{var,run}/syslog-ng"; + wantedBy = [ "multi-user.target" ]; + after = [ "multi-user.target" ]; # makes sure hostname etc is set + serviceConfig = { + Type = "notify"; + PIDFile = pidFile; + StandardOutput = "null"; + Restart = "on-failure"; + ExecStart = "${cfg.package}/sbin/syslog-ng ${concatStringsSep " " syslogngOptions}"; + ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID"; + }; + }; + }; + +} diff --git a/nixpkgs/nixos/modules/services/logging/syslogd.nix b/nixpkgs/nixos/modules/services/logging/syslogd.nix new file mode 100644 index 000000000000..fe0b0490811d --- /dev/null +++ b/nixpkgs/nixos/modules/services/logging/syslogd.nix @@ -0,0 +1,130 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + + cfg = config.services.syslogd; + + syslogConf = pkgs.writeText "syslog.conf" '' + ${if (cfg.tty != "") then "kern.warning;*.err;authpriv.none /dev/${cfg.tty}" else ""} + ${cfg.defaultConfig} + ${cfg.extraConfig} + ''; + + defaultConf = '' + # Send emergency messages to all users. + *.emerg * + + # "local1" is used for dhcpd messages. + local1.* -/var/log/dhcpd + + mail.* -/var/log/mail + + *.=warning;*.=err -/var/log/warn + *.crit /var/log/warn + + *.*;mail.none;local1.none -/var/log/messages + ''; + +in + +{ + ###### interface + + options = { + + services.syslogd = { + + enable = mkOption { + type = types.bool; + default = false; + description = '' + Whether to enable syslogd. Note that systemd also logs + syslog messages, so you normally don't need to run syslogd. + ''; + }; + + tty = mkOption { + type = types.str; + default = "tty10"; + description = '' + The tty device on which syslogd will print important log + messages. Leave this option blank to disable tty logging. + ''; + }; + + defaultConfig = mkOption { + type = types.lines; + default = defaultConf; + description = '' + The default <filename>syslog.conf</filename> file configures a + fairly standard setup of log files, which can be extended by + means of <varname>extraConfig</varname>. + ''; + }; + + enableNetworkInput = mkOption { + type = types.bool; + default = false; + description = '' + Accept logging through UDP. Option -r of syslogd(8). + ''; + }; + + extraConfig = mkOption { + type = types.lines; + default = ""; + example = "news.* -/var/log/news"; + description = '' + Additional text appended to <filename>syslog.conf</filename>, + i.e. the contents of <varname>defaultConfig</varname>. + ''; + }; + + extraParams = mkOption { + type = types.listOf types.str; + default = [ ]; + example = [ "-m 0" ]; + description = '' + Additional parameters passed to <command>syslogd</command>. + ''; + }; + + }; + + }; + + + ###### implementation + + config = mkIf cfg.enable { + + assertions = + [ { assertion = !config.services.rsyslogd.enable; + message = "rsyslogd conflicts with syslogd"; + } + ]; + + environment.systemPackages = [ pkgs.sysklogd ]; + + services.syslogd.extraParams = optional cfg.enableNetworkInput "-r"; + + # FIXME: restarting syslog seems to break journal logging. + systemd.services.syslog = + { description = "Syslog Daemon"; + + requires = [ "syslog.socket" ]; + + wantedBy = [ "multi-user.target" ]; + + serviceConfig = + { ExecStart = "${pkgs.sysklogd}/sbin/syslogd ${toString cfg.extraParams} -f ${syslogConf} -n"; + # Prevent syslogd output looping back through journald. + StandardOutput = "null"; + }; + }; + + }; + +} |