Send logs from the linelog module to stdout
Hi, I am running radiusd in Docker container. In configuration radiusd.conf I had set the user and group variable to drop permission after the start. Radiusd process is started with `-fl stdout` to redirect radiusd process logs to stdout and let Docker collect necessary logs. But in the linelog module if I will use /dev/stdout as filename radiusd seems can't open it for writing. Also, Docker requires `tty=true`, or permissions to /dev/stdout granted only to root. May I ask if there is an option that I am missing, to redirect linelog output to stdout? Best regards, Valdimir
On Sep 19, 2023, at 2:19 PM, work vlpl <thework.vlpl@gmail.com> wrote:
Hi, I am running radiusd in Docker container. In configuration radiusd.conf I had set the user and group variable to drop permission after the start. Radiusd process is started with `-fl stdout` to redirect radiusd process logs to stdout and let Docker collect necessary logs.
OK.
But in the linelog module if I will use /dev/stdout as filename radiusd seems can't open it for writing. Also, Docker requires `tty=true`, or permissions to /dev/stdout granted only to root. May I ask if there is an option that I am missing, to redirect linelog output to stdout?
This is a question for Docker, not for FreeRADIUS. When the server runs on a normal system, it can write to /dev/stdout. Alan DeKok.
On 19/09/2023 20:34, Alan DeKok wrote:
On Sep 19, 2023, at 2:19 PM, work vlpl <thework.vlpl@gmail.com> wrote:
But in the linelog module if I will use /dev/stdout as filename radiusd seems can't open it for writing. Also, Docker requires `tty=true`, or permissions to /dev/stdout granted only to root. May I ask if there is an option that I am missing, to redirect linelog output to stdout?
From what I remember the easiest way to do this is to get FreeRADIUS to write to syslog, and then configure some kind of syslogd to also run inside the container to dump to stdout or wherever you want.
This is a question for Docker, not for FreeRADIUS.
Agreed. -- Matthew
On Tue, 19 Sept 2023 at 21:34, Alan DeKok <aland@deployingradius.com> wrote:
This is a question for Docker, not for FreeRADIUS.
When the server runs on a normal system, it can write to /dev/stdout.
Yes, I understand that Docker puts additional limitations, and by default puts such permission restrictions on /dev/stdout file, which prevents freeradius from writing logs to that file. But for example, when freeradius in debug mode i.e. "-fxxl stdout" I see data from the linelog module instructions, so I hope there is nothing too wrong with the idea of redirecting linelog output to stdout. Also, code that writes data to files in linelog module does a bit more with files than just printing data to stdout/stderr, like checking permissions, and other things. There is already a code branch to deal with "syslog" destination, may I ask you to consider adding something like that for stdout/stderr destination? diff --git a/src/modules/rlm_linelog/rlm_linelog.c b/src/modules/rlm_linelog/rlm_linelog.c index 8f381fc7ca..90268041cc 100644 --- a/src/modules/rlm_linelog/rlm_linelog.c +++ b/src/modules/rlm_linelog/rlm_linelog.c @@ -250,6 +250,11 @@ static rlm_rcode_t CC_HINT(nonnull) mod_do_linelog(void *instance, REQUEST *requ } #endif + if (strcmp(inst->filename, "stdout") == 0) { + fprintf(stdout, "%s", line); + return RLM_MODULE_OK; + } + /* * We're using a real filename now. */
On Sep 20, 2023, at 8:00 AM, work vlpl <thework.vlpl@gmail.com> wrote:
Yes, I understand that Docker puts additional limitations, and by default puts such permission restrictions on /dev/stdout file, which prevents freeradius from writing logs to that file.
But for example, when freeradius in debug mode i.e. "-fxxl stdout" I see data from the linelog module instructions, so I hope there is nothing too wrong with the idea of redirecting linelog output to stdout.
When you pass "-l stdout" to the server, it doesn't open /dev/stdout. It just keeps using the existing file handle that was passed to it by Docker.
Also, code that writes data to files in linelog module does a bit more with files than just printing data to stdout/stderr, like checking permissions, and other things. There is already a code branch to deal with "syslog" destination, may I ask you to consider adding something like that for stdout/stderr destination?
You're welcome to send a patch. Alan DeKok.
participants (3)
-
Alan DeKok -
Matthew Newton -
work vlpl