1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Functions for writing log files. The code for maintaining datestamped
9 log files was originally contributed by Tony Sheen. */
14 #define LOG_NAME_SIZE 256
15 #define MAX_SYSLOG_LEN 870
17 #define LOG_MODE_FILE 1
18 #define LOG_MODE_SYSLOG 2
20 enum { lt_main, lt_reject, lt_panic, lt_debug };
22 static uschar *log_names[] = { US"main", US"reject", US"panic", US"debug" };
26 /*************************************************
27 * Local static variables *
28 *************************************************/
30 static uschar mainlog_name[LOG_NAME_SIZE];
31 static uschar rejectlog_name[LOG_NAME_SIZE];
32 static uschar debuglog_name[LOG_NAME_SIZE];
34 static uschar *mainlog_datestamp = NULL;
35 static uschar *rejectlog_datestamp = NULL;
37 static int mainlogfd = -1;
38 static int rejectlogfd = -1;
39 static ino_t mainlog_inode = 0;
40 static ino_t rejectlog_inode = 0;
42 static uschar *panic_save_buffer = NULL;
43 static BOOL panic_recurseflag = FALSE;
45 static BOOL syslog_open = FALSE;
46 static BOOL path_inspected = FALSE;
47 static int logging_mode = LOG_MODE_FILE;
48 static uschar *file_path = US"";
50 static size_t pid_position[2];
53 /* These should be kept in-step with the private delivery error
54 number definitions in macros.h */
56 static const uschar * exim_errstrings[] = {
79 US"Exim-imposed quota",
81 US"Delivery filter process failure",
82 US"Delivery add/remove header failure",
83 US"Delivery write incomplete error",
84 US"Some expansion failed",
85 US"Failed to get gid",
86 US"Failed to get uid",
87 US"Unset or non-existent transport",
88 US"MBX length mismatch",
89 US"Lookup failed routing or in smtp tpt",
90 US"Can't match format in appendfile",
91 US"Creation outside home in appendfile",
92 US"Can't check a list; lookup defer",
94 US"Failed to start TLS session",
95 US"Mandatory TLS session not started",
96 US"Failed to chown a file",
97 US"Failed to create a pipe",
99 US"When required by client",
100 US"Used internally in smtp transport",
101 US"RCPT gave 4xx error",
102 US"MAIL gave 4xx error",
103 US"DATA gave 4xx error",
104 US"Negotiation failed for proxy configured host",
105 US"Authenticator 'other' failure",
106 US"target not supporting SMTPUTF8",
109 US"Not time for routing",
110 US"Not time for local delivery",
111 US"Not time for any remote host",
112 US"Local-only delivery",
113 US"Domain in queue_domains",
114 US"Transport concurrency limit",
118 /************************************************/
122 return err < 0 ? exim_errstrings[-err] : CUS strerror(err);
125 /*************************************************
127 *************************************************/
129 /* The given string is split into sections according to length, or at embedded
130 newlines, and syslogged as a numbered sequence if it is overlong or if there is
131 more than one line. However, if we are running in the test harness, do not do
132 anything. (The test harness doesn't use syslog - for obvious reasons - but we
133 can get here if there is a failure to open the panic log.)
136 priority syslog priority
137 s the string to be written
143 write_syslog(int priority, const uschar *s)
148 if (running_in_test_harness) return;
150 if (!syslog_pid && LOGGING(pid))
151 s = string_sprintf("%.*s%s", (int)pid_position[0], s, s + pid_position[1]);
152 if (!syslog_timestamp)
154 len = log_timezone ? 26 : 20;
155 if (LOGGING(millisec)) len += 4;
164 #ifdef SYSLOG_LOG_PID
165 openlog(CS syslog_processname, LOG_PID|LOG_CONS, syslog_facility);
167 openlog(CS syslog_processname, LOG_CONS, syslog_facility);
173 /* First do a scan through the message in order to determine how many lines
174 it is going to end up as. Then rescan to output it. */
176 for (pass = 0; pass < 2; pass++)
180 const uschar * ss = s;
181 for (i = 1, tlen = len; tlen > 0; i++)
184 uschar *nlptr = Ustrchr(ss, '\n');
185 if (nlptr != NULL) plen = nlptr - ss;
186 #ifndef SYSLOG_LONG_LINES
187 if (plen > MAX_SYSLOG_LEN) plen = MAX_SYSLOG_LEN;
190 if (ss[plen] == '\n') tlen--; /* chars left */
192 if (pass == 0) linecount++; else
195 syslog(priority, "%.*s", plen, ss);
197 syslog(priority, "[%d%c%d] %.*s", i,
198 (ss[plen] == '\n' && tlen != 0)? '\\' : '/',
199 linecount, plen, ss);
202 if (*ss == '\n') ss++;
209 /*************************************************
211 *************************************************/
213 /* This is called when Exim is dying as a result of something going wrong in
214 the logging, or after a log call with LOG_PANIC_DIE set. Optionally write a
215 message to debug_file or a stderr file, if they exist. Then, if in the middle
216 of accepting a message, throw it away tidily by calling receive_bomb_out();
217 this will attempt to send an SMTP response if appropriate. Passing NULL as the
218 first argument stops it trying to run the NOTQUIT ACL (which might try further
219 logging and thus cause problems). Otherwise, try to close down an outstanding
223 s1 Error message to write to debug_file and/or stderr and syslog
224 s2 Error message for any SMTP call that is in progress
225 Returns: The function does not return
229 die(uschar *s1, uschar *s2)
233 write_syslog(LOG_CRIT, s1);
234 if (debug_file) debug_printf("%s\n", s1);
235 if (log_stderr != NULL && log_stderr != debug_file)
236 fprintf(log_stderr, "%s\n", s1);
238 if (receive_call_bombout) receive_bomb_out(NULL, s2); /* does not return */
239 if (smtp_input) smtp_closedown(s2);
240 exim_exit(EXIT_FAILURE, NULL);
245 /*************************************************
246 * Create a log file *
247 *************************************************/
249 /* This function is called to create and open a log file. It may be called in a
250 subprocess when the original process is root.
255 The file name has been build in a working buffer, so it is permissible to
256 overwrite it temporarily if it is necessary to create the directory.
258 Returns: a file descriptor, or < 0 on failure (errno set)
262 log_create(uschar *name)
268 O_CREAT|O_APPEND|O_WRONLY, LOG_MODE);
270 /* If creation failed, attempt to build a log directory in case that is the
273 if (fd < 0 && errno == ENOENT)
276 uschar *lastslash = Ustrrchr(name, '/');
278 created = directory_make(NULL, name, LOG_DIRECTORY_MODE, FALSE);
279 DEBUG(D_any) debug_printf("%s log directory %s\n",
280 created ? "created" : "failed to create", name);
282 if (created) fd = Uopen(name,
286 O_CREAT|O_APPEND|O_WRONLY, LOG_MODE);
294 /*************************************************
295 * Create a log file as the exim user *
296 *************************************************/
298 /* This function is called when we are root to spawn an exim:exim subprocess
299 in which we can create a log file. It must be signal-safe since it is called
300 by the usr1_handler().
305 Returns: a file descriptor, or < 0 on failure (errno set)
309 log_create_as_exim(uschar *name)
315 /* In the subprocess, change uid/gid and do the creation. Return 0 from the
316 subprocess on success. If we don't check for setuid failures, then the file
317 can be created as root, so vulnerabilities which cause setuid to fail mean
318 that the Exim user can use symlinks to cause a file to be opened/created as
319 root. We always open for append, so can't nuke existing content but it would
320 still be Rather Bad. */
324 if (setgid(exim_gid) < 0)
325 die(US"exim: setgid for log-file creation failed, aborting",
326 US"Unexpected log failure, please try later");
327 if (setuid(exim_uid) < 0)
328 die(US"exim: setuid for log-file creation failed, aborting",
329 US"Unexpected log failure, please try later");
330 _exit((log_create(name) < 0)? 1 : 0);
333 /* If we created a subprocess, wait for it. If it succeeded, try the open. */
335 while (pid > 0 && waitpid(pid, &status, 0) != pid);
336 if (status == 0) fd = Uopen(name,
340 O_APPEND|O_WRONLY, LOG_MODE);
342 /* If we failed to create a subprocess, we are in a bad way. We return
343 with fd still < 0, and errno set, letting the caller handle the error. */
351 /*************************************************
353 *************************************************/
355 /* This function opens one of a number of logs, creating the log directory if
356 it does not exist. This may be called recursively on failure, in order to open
359 The directory is in the static variable file_path. This is static so that it
360 the work of sorting out the path is done just once per Exim process.
362 Exim is normally configured to avoid running as root wherever possible, the log
363 files must be owned by the non-privileged exim user. To ensure this, first try
364 an open without O_CREAT - most of the time this will succeed. If it fails, try
365 to create the file; if running as root, this must be done in a subprocess to
369 fd where to return the resulting file descriptor
370 type lt_main, lt_reject, lt_panic, or lt_debug
371 tag optional tag to include in the name (only hooked up for debug)
377 open_log(int *fd, int type, uschar *tag)
381 uschar buffer[LOG_NAME_SIZE];
383 /* The names of the log files are controlled by file_path. The panic log is
384 written to the same directory as the main and reject logs, but its name does
385 not have a datestamp. The use of datestamps is indicated by %D/%M in file_path.
386 When opening the panic log, if %D or %M is present, we remove the datestamp
387 from the generated name; if it is at the start, remove a following
388 non-alphanumeric character as well; otherwise, remove a preceding
389 non-alphanumeric character. This is definitely kludgy, but it sort of does what
390 people want, I hope. */
392 ok = string_format(buffer, sizeof(buffer), CS file_path, log_names[type]);
394 /* Save the name of the mainlog for rollover processing. Without a datestamp,
395 it gets statted to see if it has been cycled. With a datestamp, the datestamp
396 will be compared. The static slot for saving it is the same size as buffer,
397 and the text has been checked above to fit, so this use of strcpy() is OK. */
399 if (type == lt_main && string_datestamp_offset >= 0)
401 Ustrcpy(mainlog_name, buffer);
402 mainlog_datestamp = mainlog_name + string_datestamp_offset;
405 /* Ditto for the reject log */
407 else if (type == lt_reject && string_datestamp_offset >= 0)
409 Ustrcpy(rejectlog_name, buffer);
410 rejectlog_datestamp = rejectlog_name + string_datestamp_offset;
413 /* and deal with the debug log (which keeps the datestamp, but does not
416 else if (type == lt_debug)
418 Ustrcpy(debuglog_name, buffer);
421 /* this won't change the offset of the datestamp */
422 ok2 = string_format(buffer, sizeof(buffer), "%s%s",
425 Ustrcpy(debuglog_name, buffer);
429 /* Remove any datestamp if this is the panic log. This is rare, so there's no
430 need to optimize getting the datestamp length. We remove one non-alphanumeric
431 char afterwards if at the start, otherwise one before. */
433 else if (string_datestamp_offset >= 0)
435 uschar *from = buffer + string_datestamp_offset;
436 uschar *to = from + string_datestamp_length;
437 if (from == buffer || from[-1] == '/')
439 if (!isalnum(*to)) to++;
443 if (!isalnum(from[-1])) from--;
446 /* This strcpy is ok, because we know that to is a substring of from. */
451 /* If the file name is too long, it is an unrecoverable disaster */
454 die(US"exim: log file path too long: aborting",
455 US"Logging failure; please try later");
457 /* We now have the file name. Try to open an existing file. After a successful
458 open, arrange for automatic closure on exec(), and then return. */
464 O_APPEND|O_WRONLY, LOG_MODE);
469 (void)fcntl(*fd, F_SETFD, fcntl(*fd, F_GETFD) | FD_CLOEXEC);
474 /* Open was not successful: try creating the file. If this is a root process,
475 we must do the creating in a subprocess set to exim:exim in order to ensure
476 that the file is created with the right ownership. Otherwise, there can be a
477 race if another Exim process is trying to write to the log at the same time.
478 The use of SIGUSR1 by the exiwhat utility can provoke a lot of simultaneous
483 /* If we are already running as the Exim user (even if that user is root),
484 we can go ahead and create in the current process. */
486 if (euid == exim_uid) *fd = log_create(buffer);
488 /* Otherwise, if we are root, do the creation in an exim:exim subprocess. If we
489 are neither exim nor root, creation is not attempted. */
491 else if (euid == root_uid) *fd = log_create_as_exim(buffer);
493 /* If we now have an open file, set the close-on-exec flag and return. */
498 (void)fcntl(*fd, F_SETFD, fcntl(*fd, F_GETFD) | FD_CLOEXEC);
503 /* Creation failed. There are some circumstances in which we get here when
504 the effective uid is not root or exim, which is the problem. (For example, a
505 non-setuid binary with log_arguments set, called in certain ways.) Rather than
506 just bombing out, force the log to stderr and carry on if stderr is available.
509 if (euid != root_uid && euid != exim_uid && log_stderr != NULL)
511 *fd = fileno(log_stderr);
515 /* Otherwise this is a disaster. This call is deliberately ONLY to the panic
516 log. If possible, save a copy of the original line that was being logged. If we
517 are recursing (can't open the panic log either), the pointer will already be
520 if (!panic_save_buffer)
521 if ((panic_save_buffer = US malloc(LOG_BUFFER_SIZE)))
522 memcpy(panic_save_buffer, log_buffer, LOG_BUFFER_SIZE);
524 log_write(0, LOG_PANIC_DIE, "Cannot open %s log file \"%s\": %s: "
525 "euid=%d egid=%d", log_names[type], buffer, strerror(errno), euid, getegid());
533 if (type == lt_debug) unlink(CS debuglog_name);
538 /*************************************************
539 * Add configuration file info to log line *
540 *************************************************/
542 /* This is put in a function because it's needed twice (once for debugging,
546 ptr pointer to the end of the line we are building
549 Returns: updated pointer
553 log_config_info(uschar *ptr, int flags)
555 Ustrcpy(ptr, "Exim configuration error");
558 if ((flags & (LOG_CONFIG_FOR & ~LOG_CONFIG)) != 0)
560 Ustrcpy(ptr, " for ");
564 if ((flags & (LOG_CONFIG_IN & ~LOG_CONFIG)) != 0)
565 ptr += sprintf(CS ptr, " in line %d of %s", config_lineno, config_filename);
567 Ustrcpy(ptr, ":\n ");
572 /*************************************************
573 * A write() operation failed *
574 *************************************************/
576 /* This function is called when write() fails on anything other than the panic
577 log, which can happen if a disk gets full or a file gets too large or whatever.
578 We try to save the relevant message in the panic_save buffer before crashing
581 The potential invoker should probably not call us for EINTR -1 writes. But
582 otherwise, short writes are bad as we don't do non-blocking writes to fds
583 subject to flow control. (If we do, that's new and the logic of this should
587 name the name of the log being written
588 length the string length being written
589 rc the return value from write()
591 Returns: does not return
595 log_write_failed(uschar *name, int length, int rc)
597 int save_errno = errno;
599 if (!panic_save_buffer)
600 if ((panic_save_buffer = US malloc(LOG_BUFFER_SIZE)))
601 memcpy(panic_save_buffer, log_buffer, LOG_BUFFER_SIZE);
603 log_write(0, LOG_PANIC_DIE, "failed to write to %s: length=%d result=%d "
604 "errno=%d (%s)", name, length, rc, save_errno,
605 (save_errno == 0)? "write incomplete" : strerror(save_errno));
611 /*************************************************
612 * Write to an fd, retrying after signals *
613 *************************************************/
615 /* Basic write to fd for logs, handling EINTR.
618 fd the fd to write to
619 buf the string to write
620 length the string length being written
623 length actually written, persisting an errno from write()
626 write_to_fd_buf(int fd, const uschar *buf, size_t length)
629 size_t total_written = 0;
630 const uschar *p = buf;
631 size_t left = length;
635 wrote = write(fd, p, left);
636 if (wrote == (ssize_t)-1)
638 if (errno == EINTR) continue;
641 total_written += wrote;
650 return total_written;
658 int sep = ':'; /* Fixed separator - outside use */
660 const uschar *tt = US LOG_FILE_PATH;
661 while ((t = string_nextinlist(&tt, &sep, log_buffer, LOG_BUFFER_SIZE)))
663 if (Ustrcmp(t, "syslog") == 0 || t[0] == 0) continue;
664 file_path = string_copy(t);
673 if (mainlogfd < 0) return;
674 (void)close(mainlogfd);
679 /*************************************************
680 * Write message to log file *
681 *************************************************/
683 /* Exim can be configured to log to local files, or use syslog, or both. This
684 is controlled by the setting of log_file_path. The following cases are
687 log_file_path = "" write files in the spool/log directory
688 log_file_path = "xxx" write files in the xxx directory
689 log_file_path = "syslog" write to syslog
690 log_file_path = "syslog : xxx" write to syslog and to files (any order)
692 The message always gets '\n' added on the end of it, since more than one
693 process may be writing to the log at once and we don't want intermingling to
694 happen in the middle of lines. To be absolutely sure of this we write the data
695 into a private buffer and then put it out in a single write() call.
697 The flags determine which log(s) the message is written to, or for syslogging,
698 which priority to use, and in the case of the panic log, whether the process
699 should die afterwards.
701 The variable really_exim is TRUE only when exim is running in privileged state
702 (i.e. not with a changed configuration or with testing options such as -brw).
703 If it is not, don't try to write to the log because permission will probably be
706 Avoid actually writing to the logs when exim is called with -bv or -bt to
707 test an address, but take other actions, such as panicking.
709 In Exim proper, the buffer for building the message is got at start-up, so that
710 nothing gets done if it can't be got. However, some functions that are also
711 used in utilities occasionally obey log_write calls in error situations, and it
712 is simplest to put a single malloc() here rather than put one in each utility.
713 Malloc is used directly because the store functions may call log_write().
715 If a message_id exists, we include it after the timestamp.
718 selector write to main log or LOG_INFO only if this value is zero, or if
719 its bit is set in log_selector[0]
720 flags each bit indicates some independent action:
721 LOG_SENDER add raw sender to the message
722 LOG_RECIPIENTS add raw recipients list to message
723 LOG_CONFIG add "Exim configuration error"
724 LOG_CONFIG_FOR add " for " instead of ":\n "
725 LOG_CONFIG_IN add " in line x[ of file y]"
726 LOG_MAIN write to main log or syslog LOG_INFO
727 LOG_REJECT write to reject log or syslog LOG_NOTICE
728 LOG_PANIC write to panic log or syslog LOG_ALERT
729 LOG_PANIC_DIE write to panic log or LOG_ALERT and then crash
730 format a printf() format
731 ... arguments for format
737 log_write(unsigned int selector, int flags, const char *format, ...)
745 /* If panic_recurseflag is set, we have failed to open the panic log. This is
746 the ultimate disaster. First try to write the message to a debug file and/or
747 stderr and also to syslog. If panic_save_buffer is not NULL, it contains the
748 original log line that caused the problem. Afterwards, expire. */
750 if (panic_recurseflag)
752 uschar *extra = (panic_save_buffer == NULL)? US"" : panic_save_buffer;
753 if (debug_file != NULL) debug_printf("%s%s", extra, log_buffer);
754 if (log_stderr != NULL && log_stderr != debug_file)
755 fprintf(log_stderr, "%s%s", extra, log_buffer);
756 if (*extra != 0) write_syslog(LOG_CRIT, extra);
757 write_syslog(LOG_CRIT, log_buffer);
758 die(US"exim: could not open panic log - aborting: see message(s) above",
759 US"Unexpected log failure, please try later");
762 /* Ensure we have a buffer (see comment above); this should never be obeyed
763 when running Exim proper, only when running utilities. */
766 if (!(log_buffer = US malloc(LOG_BUFFER_SIZE)))
768 fprintf(stderr, "exim: failed to get store for log buffer\n");
769 exim_exit(EXIT_FAILURE, NULL);
772 /* If we haven't already done so, inspect the setting of log_file_path to
773 determine whether to log to files and/or to syslog. Bits in logging_mode
774 control this, and for file logging, the path must end up in file_path. This
775 variable must be in permanent store because it may be required again later in
780 BOOL multiple = FALSE;
781 int old_pool = store_pool;
783 store_pool = POOL_PERM;
785 /* If nothing has been set, don't waste effort... the default values for the
786 statics are file_path="" and logging_mode = LOG_MODE_FILE. */
790 int sep = ':'; /* Fixed separator - outside use */
792 const uschar *ss = log_file_path;
794 while ((s = string_nextinlist(&ss, &sep, log_buffer, LOG_BUFFER_SIZE)))
796 if (Ustrcmp(s, "syslog") == 0)
797 logging_mode |= LOG_MODE_SYSLOG;
798 else if ((logging_mode & LOG_MODE_FILE) != 0) multiple = TRUE;
801 logging_mode |= LOG_MODE_FILE;
803 /* If a non-empty path is given, use it */
806 file_path = string_copy(s);
808 /* If the path is empty, we want to use the first non-empty, non-
809 syslog item in LOG_FILE_PATH, if there is one, since the value of
810 log_file_path may have been set at runtime. If there is no such item,
811 use the ultimate default in the spool directory. */
814 set_file_path(); /* Empty item in log_file_path */
815 } /* First non-syslog item in log_file_path */
816 } /* Scan of log_file_path */
819 /* If no modes have been selected, it is a major disaster */
821 if (logging_mode == 0)
822 die(US"Neither syslog nor file logging set in log_file_path",
823 US"Unexpected logging failure");
825 /* Set up the ultimate default if necessary. Then revert to the old store
826 pool, and record that we've sorted out the path. */
828 if ((logging_mode & LOG_MODE_FILE) != 0 && file_path[0] == 0)
829 file_path = string_sprintf("%s/log/%%slog", spool_directory);
830 store_pool = old_pool;
831 path_inspected = TRUE;
833 /* If more than one file path was given, log a complaint. This recursive call
834 should work since we have now set up the routing. */
837 log_write(0, LOG_MAIN|LOG_PANIC,
838 "More than one path given in log_file_path: using %s", file_path);
841 /* If debugging, show all log entries, but don't show headers. Do it all
842 in one go so that it doesn't get split when multi-processing. */
849 Ustrcpy(ptr, "LOG:");
852 /* Show the selector that was passed into the call. */
854 for (i = 0; i < log_options_count; i++)
856 unsigned int bitnum = log_options[i].bit;
857 if (bitnum < BITWORDSIZE && selector == BIT(bitnum))
860 Ustrcpy(ptr, log_options[i].name);
865 ptr += sprintf(CS ptr, "%s%s%s%s\n ",
866 ((flags & LOG_MAIN) != 0)? " MAIN" : "",
867 ((flags & LOG_PANIC) != 0)? " PANIC" : "",
868 ((flags & LOG_PANIC_DIE) == LOG_PANIC_DIE)? " DIE" : "",
869 ((flags & LOG_REJECT) != 0)? " REJECT" : "");
871 if ((flags & LOG_CONFIG) != 0) ptr = log_config_info(ptr, flags);
873 va_start(ap, format);
874 if (!string_vformat(ptr, LOG_BUFFER_SIZE - (ptr-log_buffer)-1, format, ap))
875 Ustrcpy(ptr, "**** log string overflowed log buffer ****");
880 debug_printf("%s", log_buffer);
883 /* If no log file is specified, we are in a mess. */
885 if ((flags & (LOG_MAIN|LOG_PANIC|LOG_REJECT)) == 0)
886 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "log_write called with no log "
889 /* There are some weird circumstances in which logging is disabled. */
893 DEBUG(D_any) debug_printf("log writing disabled\n");
897 /* Handle disabled reject log */
899 if (!write_rejectlog) flags &= ~LOG_REJECT;
901 /* Create the main message in the log buffer. Do not include the message id
902 when called by a utility. */
905 ptr += sprintf(CS ptr, "%s ", tod_stamp(tod_log));
909 if (!syslog_pid) pid_position[0] = ptr - log_buffer; /* remember begin … */
910 ptr += sprintf(CS ptr, "[%d] ", (int)getpid());
911 if (!syslog_pid) pid_position[1] = ptr - log_buffer; /* … and end+1 of the PID */
914 if (really_exim && message_id[0] != 0)
915 ptr += sprintf(CS ptr, "%s ", message_id);
917 if ((flags & LOG_CONFIG) != 0) ptr = log_config_info(ptr, flags);
919 va_start(ap, format);
920 if (!string_vformat(ptr, LOG_BUFFER_SIZE - (ptr-log_buffer)-1, format, ap))
921 Ustrcpy(ptr, "**** log string overflowed log buffer ****\n");
925 /* Add the raw, unrewritten, sender to the message if required. This is done
926 this way because it kind of fits with LOG_RECIPIENTS. */
928 if ((flags & LOG_SENDER) != 0 &&
929 ptr < log_buffer + LOG_BUFFER_SIZE - 10 - Ustrlen(raw_sender))
930 ptr += sprintf(CS ptr, " from <%s>", raw_sender);
932 /* Add list of recipients to the message if required; the raw list,
933 before rewriting, was saved in raw_recipients. There may be none, if an ACL
934 discarded them all. */
936 if ((flags & LOG_RECIPIENTS) != 0 && ptr < log_buffer + LOG_BUFFER_SIZE - 6 &&
937 raw_recipients_count > 0)
940 ptr += sprintf(CS ptr, " for");
941 for (i = 0; i < raw_recipients_count; i++)
943 uschar * s = raw_recipients[i];
944 if (log_buffer + LOG_BUFFER_SIZE - ptr < Ustrlen(s) + 3) break;
945 ptr += sprintf(CS ptr, " %s", s);
949 ptr += sprintf(CS ptr, "\n");
950 length = ptr - log_buffer;
952 /* Handle loggable errors when running a utility, or when address testing.
953 Write to log_stderr unless debugging (when it will already have been written),
954 or unless there is no log_stderr (expn called from daemon, for example). */
956 if (!really_exim || log_testing_mode)
958 if (debug_selector == 0 && log_stderr != NULL &&
959 (selector == 0 || (selector & log_selector[0]) != 0))
962 fprintf(log_stderr, "LOG: %s", CS(log_buffer + 20)); /* no timestamp */
964 fprintf(log_stderr, "%s", CS log_buffer);
966 if ((flags & LOG_PANIC_DIE) == LOG_PANIC_DIE) exim_exit(EXIT_FAILURE, US"");
970 /* Handle the main log. We know that either syslog or file logging (or both) is
971 set up. A real file gets left open during reception or delivery once it has
972 been opened, but we don't want to keep on writing to it for too long after it
973 has been renamed. Therefore, do a stat() and see if the inode has changed, and
976 if ( flags & LOG_MAIN
977 && (!selector || selector & log_selector[0]))
979 if ( logging_mode & LOG_MODE_SYSLOG
980 && (syslog_duplication || !(flags & (LOG_REJECT|LOG_PANIC))))
981 write_syslog(LOG_INFO, log_buffer);
983 if (logging_mode & LOG_MODE_FILE)
987 /* Check for a change to the mainlog file name when datestamping is in
988 operation. This happens at midnight, at which point we want to roll over
989 the file. Closing it has the desired effect. */
991 if (mainlog_datestamp)
993 uschar *nowstamp = tod_stamp(string_datestamp_type);
994 if (Ustrncmp (mainlog_datestamp, nowstamp, Ustrlen(nowstamp)) != 0)
996 (void)close(mainlogfd); /* Close the file */
997 mainlogfd = -1; /* Clear the file descriptor */
998 mainlog_inode = 0; /* Unset the inode */
999 mainlog_datestamp = NULL; /* Clear the datestamp */
1003 /* Otherwise, we want to check whether the file has been renamed by a
1004 cycling script. This could be "if else", but for safety's sake, leave it as
1005 "if" so that renaming the log starts a new file even when datestamping is
1009 if (Ustat(mainlog_name, &statbuf) < 0 || statbuf.st_ino != mainlog_inode)
1012 /* If the log is closed, open it. Then write the line. */
1016 open_log(&mainlogfd, lt_main, NULL); /* No return on error */
1017 if (fstat(mainlogfd, &statbuf) >= 0) mainlog_inode = statbuf.st_ino;
1020 /* Failing to write to the log is disastrous */
1022 written_len = write_to_fd_buf(mainlogfd, log_buffer, length);
1023 if (written_len != length)
1025 log_write_failed(US"main log", length, written_len);
1026 /* That function does not return */
1031 /* Handle the log for rejected messages. This can be globally disabled, in
1032 which case the flags are altered above. If there are any header lines (i.e. if
1033 the rejection is happening after the DATA phase), log the recipients and the
1036 if ((flags & LOG_REJECT) != 0)
1040 if (header_list != NULL && LOGGING(rejected_header))
1042 if (recipients_count > 0)
1046 /* List the sender */
1048 string_format(ptr, LOG_BUFFER_SIZE - (ptr-log_buffer),
1049 "Envelope-from: <%s>\n", sender_address);
1052 /* List up to 5 recipients */
1054 string_format(ptr, LOG_BUFFER_SIZE - (ptr-log_buffer),
1055 "Envelope-to: <%s>\n", recipients_list[0].address);
1058 for (i = 1; i < recipients_count && i < 5; i++)
1060 string_format(ptr, LOG_BUFFER_SIZE - (ptr-log_buffer), " <%s>\n",
1061 recipients_list[i].address);
1065 if (i < recipients_count)
1067 (void)string_format(ptr, LOG_BUFFER_SIZE - (ptr-log_buffer),
1073 /* A header with a NULL text is an unfilled in Received: header */
1075 for (h = header_list; h; h = h->next) if (h->text)
1077 BOOL fitted = string_format(ptr, LOG_BUFFER_SIZE - (ptr-log_buffer),
1078 "%c %s", h->type, h->text);
1080 if (!fitted) /* Buffer is full; truncate */
1082 ptr -= 100; /* For message and separator */
1083 if (ptr[-1] == '\n') ptr--;
1084 Ustrcpy(ptr, "\n*** truncated ***\n");
1090 length = ptr - log_buffer;
1093 /* Write to syslog or to a log file */
1095 if ((logging_mode & LOG_MODE_SYSLOG) != 0 &&
1096 (syslog_duplication || (flags & LOG_PANIC) == 0))
1097 write_syslog(LOG_NOTICE, log_buffer);
1099 /* Check for a change to the rejectlog file name when datestamping is in
1100 operation. This happens at midnight, at which point we want to roll over
1101 the file. Closing it has the desired effect. */
1103 if ((logging_mode & LOG_MODE_FILE) != 0)
1105 struct stat statbuf;
1107 if (rejectlog_datestamp)
1109 uschar *nowstamp = tod_stamp(string_datestamp_type);
1110 if (Ustrncmp (rejectlog_datestamp, nowstamp, Ustrlen(nowstamp)) != 0)
1112 (void)close(rejectlogfd); /* Close the file */
1113 rejectlogfd = -1; /* Clear the file descriptor */
1114 rejectlog_inode = 0; /* Unset the inode */
1115 rejectlog_datestamp = NULL; /* Clear the datestamp */
1119 /* Otherwise, we want to check whether the file has been renamed by a
1120 cycling script. This could be "if else", but for safety's sake, leave it as
1121 "if" so that renaming the log starts a new file even when datestamping is
1124 if (rejectlogfd >= 0)
1126 if (Ustat(rejectlog_name, &statbuf) < 0 ||
1127 statbuf.st_ino != rejectlog_inode)
1129 (void)close(rejectlogfd);
1131 rejectlog_inode = 0;
1135 /* Open the file if necessary, and write the data */
1137 if (rejectlogfd < 0)
1139 open_log(&rejectlogfd, lt_reject, NULL); /* No return on error */
1140 if (fstat(rejectlogfd, &statbuf) >= 0) rejectlog_inode = statbuf.st_ino;
1143 written_len = write_to_fd_buf(rejectlogfd, log_buffer, length);
1144 if (written_len != length)
1146 log_write_failed(US"reject log", length, written_len);
1147 /* That function does not return */
1153 /* Handle the panic log, which is not kept open like the others. If it fails to
1154 open, there will be a recursive call to log_write(). We detect this above and
1155 attempt to write to the system log as a last-ditch try at telling somebody. In
1156 all cases except mua_wrapper, try to write to log_stderr. */
1158 if ((flags & LOG_PANIC) != 0)
1160 if (log_stderr != NULL && log_stderr != debug_file && !mua_wrapper)
1161 fprintf(log_stderr, "%s", CS log_buffer);
1163 if ((logging_mode & LOG_MODE_SYSLOG) != 0)
1164 write_syslog(LOG_ALERT, log_buffer);
1166 /* If this panic logging was caused by a failure to open the main log,
1167 the original log line is in panic_save_buffer. Make an attempt to write it. */
1169 if ((logging_mode & LOG_MODE_FILE) != 0)
1171 panic_recurseflag = TRUE;
1172 open_log(&paniclogfd, lt_panic, NULL); /* Won't return on failure */
1173 panic_recurseflag = FALSE;
1175 if (panic_save_buffer != NULL)
1177 int i = write(paniclogfd, panic_save_buffer, Ustrlen(panic_save_buffer));
1178 i = i; /* compiler quietening */
1181 written_len = write_to_fd_buf(paniclogfd, log_buffer, length);
1182 if (written_len != length)
1184 int save_errno = errno;
1185 write_syslog(LOG_CRIT, log_buffer);
1186 sprintf(CS log_buffer, "write failed on panic log: length=%d result=%d "
1187 "errno=%d (%s)", length, (int)written_len, save_errno, strerror(save_errno));
1188 write_syslog(LOG_CRIT, log_buffer);
1189 flags |= LOG_PANIC_DIE;
1192 (void)close(paniclogfd);
1195 /* Give up if the DIE flag is set */
1197 if ((flags & LOG_PANIC_DIE) != LOG_PANIC)
1198 die(NULL, US"Unexpected failure, please try later");
1204 /*************************************************
1205 * Close any open log files *
1206 *************************************************/
1212 { (void)close(mainlogfd); mainlogfd = -1; }
1213 if (rejectlogfd >= 0)
1214 { (void)close(rejectlogfd); rejectlogfd = -1; }
1216 syslog_open = FALSE;
1221 /*************************************************
1222 * Multi-bit set or clear *
1223 *************************************************/
1225 /* These functions take a list of bit indexes (terminated by -1) and
1226 clear or set the corresponding bits in the selector.
1229 selector address of the bit string
1230 selsize number of words in the bit string
1231 bits list of bits to set
1235 bits_clear(unsigned int *selector, size_t selsize, int *bits)
1237 for(; *bits != -1; ++bits)
1238 BIT_CLEAR(selector, selsize, *bits);
1242 bits_set(unsigned int *selector, size_t selsize, int *bits)
1244 for(; *bits != -1; ++bits)
1245 BIT_SET(selector, selsize, *bits);
1250 /*************************************************
1251 * Decode bit settings for log/debug *
1252 *************************************************/
1254 /* This function decodes a string containing bit settings in the form of +name
1255 and/or -name sequences, and sets/unsets bits in a bit string accordingly. It
1256 also recognizes a numeric setting of the form =<number>, but this is not
1257 intended for user use. It's an easy way for Exim to pass the debug settings
1258 when it is re-exec'ed.
1260 The option table is a list of names and bit indexes. The index -1
1261 means "set all bits, except for those listed in notall". The notall
1262 list is terminated by -1.
1264 The action taken for bad values varies depending upon why we're here.
1265 For log messages, or if the debugging is triggered from config, then we write
1266 to the log on the way out. For debug setting triggered from the command-line,
1267 we treat it as an unknown option: error message to stderr and die.
1270 selector address of the bit string
1271 selsize number of words in the bit string
1272 notall list of bits to exclude from "all"
1273 string the configured string
1274 options the table of option names
1276 which "log" or "debug"
1277 flags DEBUG_FROM_CONFIG
1279 Returns: nothing on success - bomb out on failure
1283 decode_bits(unsigned int *selector, size_t selsize, int *notall,
1284 uschar *string, bit_table *options, int count, uschar *which, int flags)
1287 if (string == NULL) return;
1291 char *end; /* Not uschar */
1292 memset(selector, 0, sizeof(*selector)*selsize);
1293 *selector = strtoul(CS string+1, &end, 0);
1294 if (*end == 0) return;
1295 errmsg = string_sprintf("malformed numeric %s_selector setting: %s", which,
1300 /* Handle symbolic setting */
1307 bit_table *start, *end;
1309 while (isspace(*string)) string++;
1310 if (*string == 0) return;
1312 if (*string != '+' && *string != '-')
1314 errmsg = string_sprintf("malformed %s_selector setting: "
1315 "+ or - expected but found \"%s\"", which, string);
1319 adding = *string++ == '+';
1321 while (isalnum(*string) || *string == '_') string++;
1325 end = options + count;
1329 bit_table *middle = start + (end - start)/2;
1330 int c = Ustrncmp(s, middle->name, len);
1333 if (middle->name[len] != 0) c = -1; else
1335 unsigned int bit = middle->bit;
1341 memset(selector, -1, sizeof(*selector)*selsize);
1342 bits_clear(selector, selsize, notall);
1345 memset(selector, 0, sizeof(*selector)*selsize);
1348 BIT_SET(selector, selsize, bit);
1350 BIT_CLEAR(selector, selsize, bit);
1352 break; /* Out of loop to match selector name */
1355 if (c < 0) end = middle; else start = middle + 1;
1356 } /* Loop to match selector name */
1360 errmsg = string_sprintf("unknown %s_selector setting: %c%.*s", which,
1361 adding? '+' : '-', len, s);
1364 } /* Loop for selector names */
1366 /* Handle disasters */
1369 if (Ustrcmp(which, "debug") == 0)
1371 if (flags & DEBUG_FROM_CONFIG)
1373 log_write(0, LOG_CONFIG|LOG_PANIC, "%s", errmsg);
1376 fprintf(stderr, "exim: %s\n", errmsg);
1379 else log_write(0, LOG_CONFIG|LOG_PANIC_DIE, "%s", errmsg);
1384 /*************************************************
1385 * Activate a debug logfile (late) *
1386 *************************************************/
1388 /* Normally, debugging is activated from the command-line; it may be useful
1389 within the configuration to activate debugging later, based on certain
1390 conditions. If debugging is already in progress, we return early, no action
1391 taken (besides debug-logging that we wanted debug-logging).
1393 Failures in options are not fatal but will result in paniclog entries for the
1396 The first use of this is in ACL logic, "control = debug/tag=foo/opts=+expand"
1397 which can be combined with conditions, etc, to activate extra logging only
1398 for certain sources. The second use is inetd wait mode debug preservation. */
1401 debug_logging_activate(uschar *tag_name, uschar *opts)
1407 debug_printf("DEBUGGING ACTIVATED FROM WITHIN CONFIG.\n"
1408 "DEBUG: Tag=\"%s\" opts=\"%s\"\n", tag_name, opts ? opts : US"");
1412 if (tag_name != NULL && (Ustrchr(tag_name, '/') != NULL))
1414 log_write(0, LOG_MAIN|LOG_PANIC, "debug tag may not contain a '/' in: %s",
1419 debug_selector = D_default;
1421 decode_bits(&debug_selector, 1, debug_notall, opts,
1422 debug_options, debug_options_count, US"debug", DEBUG_FROM_CONFIG);
1424 /* When activating from a transport process we may never have logged at all
1425 resulting in certain setup not having been done. Hack this for now so we
1426 do not segfault; note that nondefault log locations will not work */
1428 if (!*file_path) set_file_path();
1430 open_log(&fd, lt_debug, tag_name);
1433 debug_file = fdopen(fd, "w");
1435 log_write(0, LOG_MAIN|LOG_PANIC, "unable to open debug log");
1440 debug_logging_stop(void)
1442 if (!debug_file || !debuglog_name[0]) return;
1447 unlink_log(lt_debug);