Syslog-NG: Possible to disable "keep_hostname" but enable for a specific filter? - syslog

Was wondering if this was possible at all. I am currently facing a situation where I have a legacy NG system with a number of sources integrated. We are working to slowly transition off of this particular instance, but to do this I need to make sure that the messages that are emitted retain their source host.
Unfortunately, when this legacy environment was crafted, the keep_hostname option was set to false, which meant that the engineers focused on source log specific HOST extraction.
As I am working to tee the data off to the new system, I need the data to retain its source hostname. Ideally one would just flip keep_hostname to yes, but there is too much risk right now as it could impact how data is being parsed throughout the system.
My ask is, while keep_hostname is globally disabled, is there a way that I can enable it within a filter or destination?

Doing this with a globally disabled keep-hostname() option is not really possible as the original host information is lost.
When keep-hostname(no) is used, a feature called "store-raw-message" can be enabled which stores the entire incoming message in the $RAWMSG macro. The raw message definitely contains the original hostname, but then it is up to you to extract the host from the whole message.
My ask is, while keep_hostname is globally disabled, is there a way that I can enable it within a filter or destination?
You can achieve something similar the other way around:
Setting keep-hostname() to yes keeps the original host name intact, but you will have 2 different macros:
$HOST contains the original hostname
$HOST_FROM contains the "source's" hostname
Applying a rewrite rule which overrides $HOST with $HOST_FROM can be added to paths where you want to retain the old behavior.

Related

One account is migrating. How do I stop local delivery for that single domain and use a different mail server?

I have one account, domainABC.com that is moving to another provider. The same users have another domain, domainXYZ.com that is remaining on the server. These accounts email back and forth.
To avoid local deliveries, do I need to do anything more than remove domainABC.com from /var/qmail/control/virtualdomains and /var/qmail/control/rcpthosts ?
Do I also need to add an entry in /var/qmail/control/smptroutes
Many Thanks!
I'm assuming you're using a fairly vanilla qmail or netqmail system. What you propose is basically enough but note the following:
Send qmail-send a HUP signal to tell it to re-read virtualdomains once you've changed it.
Be aware that there may be an entry/entries for the target of the virtualdomains line (domain:target) in the qmail-users database (see man page for qmail-users); you may like to remove this line if it's not in use by any other line in virtualdomains to keep things tidy. If there's no entry then target will be the username configured for that virtual domain.
In particular I'd advise against an entry in smtproutes since the DNS should be sufficient; it creates an extra bit of unnecessary configuration that could cause confusion in future.
Once the domain is absent from virtualdomains and rcpthosts and qmail-send restarted, qmail is no longer configured for local delivery of the domain, so will consider it to be a remote domain and act accordingly (DNS lookup and remote delivery etc).

Serving static content programmatically from Servlet - does the spec have anything available or i should roll a custom one?

I have a db with original file names, location to files on disk, meta data like user that owns file... Those files on disk are with scrambled names. When user requests a file, the servlet will check whether he's authorized, then send the file in it's original name.
While researching on the subject i've found several cases that cover that issue, but nothing specific to mine.
Essentially there are 2 solutions:
A custom servlet that handles headers and other stuff the Default Servlet containers don't: http://balusc.omnifaces.org/2009/02/fileservlet-supporting-resume-and.html
Then there is the quick and easy one of just using the Default Servlet and do some path remapping. For ex., in Undertow you configure the Undertow subsystem and add file handlers in the standalone.xml that map http://example.com/content/ to /some/path/on/disk/with/files .
So i am leaning towards solution 1, since solution 2 is a straight path remap and i need to change file names on the fly.
I don't want to reinvent the hot water. And both solutions are non standard. So if i decide to migrate app server to other than Wildfly, it will be problematic. Is there a better way? How would you approach this problem?
While your problem is a fairly common one there isn't necessarily a standards based solution for every possible design challenge.
I don't think the #2 solution will be sufficient - what if two threads try to manipulate the file at the same time? If someone got the link to the file could they share it?
I've implemented something very similar to your #1 solution - the key there is that even if the link to the file got out no one could reuse the link as it requires security. You would just "return" a 401 or 403 for the resource.
Another possibility depends on how you're hosted. Amazon S3 allows you to generate a signed URL that has a limited time to live. In this way your server isn't sending the file directly. It is either sending a redirect or a URL to the front end to use. Keep the lifetime at like 15 seconds (depending on your needs) and then the URL is no longer valid.
I believe that the other cloud providers have a similar capability too.

How to detect changes in /proc/net/ files?

I'm looking forward to create a network monitor by looking into the contents of /proc/net folder. It's my specific requirement that I can't do any packet sniffing or anything like that. All my source is /proc/net.For example I can get all the active TCP connection details from /proc/net/tcp etc.
The contents of these files keep on changing, so I want to read these files continuously but also I need to read only when it's contents changes, that is if there is no network connected the file contents won't change and I don't' need to read them.
I looked into inotify but it does not detect the changes in /proc/net/ files.
inotifywatch /proc/net/
Continuous polling I guess will be ineffective. So looking for a suggestion..
Thanks in advance..
Did you check the gio libraries? You can add a watch to an open file, and specify on which events you get a callback.
https://developer.gnome.org/glib/stable/glib-IO-Channels.html
Also, this might be of interest to you (it seems newer versions would have this patch already included):
https://gitorious.org/gnome-essentials/glib/commit/68f9255ec6434b25339cfd6055013e898730d0e7
https://www.google.com.ar/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0CCEQFjAB&url=https%3A%2F%2Fmail.gnome.org%2Farchives%2Fcommits-list%2F2011-September%2Fmsg13539.html&ei=02qMVJ7cHse1sQTm2oKwDg&usg=AFQjCNEJpurm10iskmcHVkc81oAv8_7MLQ&sig2=e48bXfZxW_BwvNCjdpsfSw&bvm=bv.81828268,d.cWc

How to find the Port ID in Biztalk 2010?

I have configured a receiving port named it "SalesOrder" It contains a receiving location of File Type.
Now when i use this receiving port in a Send port i define a filter like this :
BTS.ReceivePortName==SalesOrder
I start the ports and it works just fine.
Now question is if i want to us the filter like this :
BTS.ReceivePortID=="Where do i get the Port ID"
How can i find the PortID in Biztalk 2010.
There isn't an easy way of getting to the ReceivePortID. The id will also change when creating, deleting, setting up new port and of course as you move you configuration between environments. It's much more common practice to set up these kind of filter based on ReceivePortName instead as this (hopefully) doesn't change as much.
Best practice in my opinion is however to not use these kind of filters that are tied to the configuration but to rather set up filters based on message types and order other promoted properties. Using promoted properties over configuration will also create a more flexible and more loosely coupled solution.

Determining the set of message destinations at runtime in BizTalk application

I’m a complete newbie at BizTalk and I need to create a BizTalk 2006 application which broadcasts messages in a specific way. I’m not asking for a complete solution, but for advise and guidelines, which capabilities of BizTalk I should use.
There’s a message source, for simplicity, say, a directory where the user adds files to publish them. There are several subscribers, each having a directory to receive published files. The number of subscribers can vary in the course of exploitation of the program. There are also some rules which determine if a particular subscriber needs to receive a particular file, based on the filename. For example, each subscriber has a pattern or mask of filename which files they receives must match. Those rules (for example, patterns) can change in time as well.
I don’t know how to do this. Create a set of send ports at runtime, each for each destination? Is it possible? Use one port changing its binding? Would it work correctly with concurrent sendings? Are there other ways?
EDIT
I realized my question may be to obscure and general to prefer one answer over another to accept. So I just upvoted them.
You could look at using dynamic send ports to achieve this - if your subscribers are truly dynamic. This introduces a bit of complexity since you'll need to use an orchestration to configure the send port's properties based on your rules.
If you can, try and remove the complexity. If you know that you don't need to be truly dynamic when adding subscribers (i.e. a subscriber and it's rules can be configured one time only) and you have a manageable number of subscribers then I would suggest configuring each subscriber using it's own send port and use a filter to create subscriptions based on message context properties. The beauty of this approach is that you don't need to create and deploy an orchestration and this becomes a highly performant and scalable solution.
If the changes to the destination are going to be frequent, you are right in seeking a more dynamic solution. One nice solution is using dynamic send ports and the Business Rules Engine. You create rule set for the messages you are receving. This could be based on a destination property or customer ID in the message. Using these facts, the rules engine can return a bunch of information like file mask, server name, ip address of deleiver server, etc. You can thenuse this information to configure the dynamic send in the orchestration. The real nice thing here is that you can update the rule set in the rules engine without redeploying the whole solution. As a newb, these are some advanced concepts, but not as diificult as you may think.
For a simpler solution, you might want to look at setting the FILE Send adapters properties via it's Propery Schema (ie. File name, Directory, etc.). You could pull these values from a database with a helper class inside an expresison shape. On each message ogig out, use the property shcema to set where the message will be sent and named. This way, you just update the database as things change.
Good Luck!

Resources