Logging
All logging in the server is unified through a single logging subsystem. Unfortunately, we still don't generate all the logs we could, but we hope to rectify in time. Nevertheless, the logs that are generated may be sent to a given file, to syslog, or even to online operators – or any combination of these three methods.
All logs are classified by a "subsystem" and a "level". The subsystem is a major classification, and each subsystem may be configured individually. The level classification is used to indicate how important the message is; subsystems may be configured to omot log messages with less than a certain importance – not unlike syslog.
Levels#
As stated above, levels are used to classify the importance of a log message. The most important
level is CRIT, and the lest important is DEBUG. Each of the levels are also mapped to a
corresponding syslog level, and some may even force generation of certain types of server notices.
CRIT#
Used for very criticial notifications, such as server termination. This is mapped to the
corresponding CRIT syslog priority. This will also generate server notices to the SNO_OLDSNO
server notice mask.
ERROR#
Used to report important error conditions. This mapped to the corresponding ERR syslog priority.
WARNING#
Used to warn about certain conditions. This is mapped to the corresponding WARNING syslog priority.
NOTICE#
Used for reporting important information. This is mapped to the corresponding NOTICE syslog priority.
TRACE#
Used to trace operation of the server. This is mapped to the corresponding INFO syslog priority.
INFO#
Used for reporting unimportant, but potentially useful, information. This is mapped to the
corresponding INFO syslog priority.
DEBUG#
Used for reporting debugging information. This is mapped to the corresponding 'DEBUG' syslog
priority. This will also generate server notices to the SNO_DEBUG server notice mask.
Subsystems#
All of the available subsystems are described below, along with their default configuration. There
are no default log files to log to, and the default logging level is INFO, unless the server is
compuiled with debugging enabled. This means that only notices of importance INFO or higher will
be logged.
SYSTEM#
Used to report information that affects the server as a whole. By default, log messages to this subsystem go nowhere.
CONFIG#
Used to report information concerning the configuration file. By default, log messages to this
subsystem go to the default syslog facility, which defaults to USER, and to the SNO_OLDSNO
server notice mask.
OPERMODE#
Used to report usage of the OPMODE and CLEARMODE commands. By default, log messages to this
subsystem go to the SNO_HACK4 server notice mask.
GLINE#
Used to report usage of the GLINE and SHUN commands. By default, log messages to this subsystem
go to the SNO_GLINE server notice mask.
JUPE#
Used to report usage of the JUPE command. By default, log messages to this subsystem go to the
SNO_NETWORK server notice mask.
WHO#
Used to report usage of the extended features of the WHO command (commonly referred to as WHOX). By default, log messages to this subsystem go nowhere.
NETWORK#
Used to report net junctions and breaks. By default, log messages to this subsystem go to the
SNO_NETWORK server notice mask.
OPERKILL#
Used to report usage of the KILL command by IRC operators. By default, log messages to this subsystem go nowhere.
SERVKILL#
Used to report usage of KILL by other servers. By default, log messages to this subsystem go nowhere.
USER#
Used to report user sign-ons and sign-offs. By default, log messages to this subsystem go nowhere.
OPER#
Used to report usage of the OPER command, both successful and unsuccessful attempts. By default,
log messages to this subsystem go to the SNO_OLDREALOP server notice mask.
RESOLVER#
Used to report error messages or other conditions from the resolver and authentication system. By default, log messages to this subsystem go nowhere.
SOCKET#
Used to report problems with sockets. By default, log messages to this subsystem go nowhere.
IAUTH#
Used to report connects, disconnects and errors for the IAuth authorization mechanism. By default,
log messages to this subsystem go to the SNO_NETWORK server notice mask.
DEBUG#
Used only when debugging is enabled. All log messages to this subsystem go either to the console or
to the debug log file compiled into the server, as well as to the SNO_DEBUG server notice mask.
This is the only subsystem with a default log file.
Configuration#
The true power of the logging subsystem comes from its extremely flexible configuration. The default server facility can be configured, as can the facility for each individual subsystem described above. Moreover, administrators can configure the server to log to specific files, send selected log messages to operators subscribed to any server notice mask, and even change the default log level for each subsystem.
The logging subsystem has a set of tables mapping names to the numerical values used internally. Subsystems, levels, syslog facilities, and server notice masks are all configured using strings. These tables even include special strings, such as “DEFAULT” and “NONE.” Each possible configuration piece is described below.
Default syslog facility#
The IRC server has a default facility that it uses when sending log messages to syslog. The default facility may be overridden for each individual subsystem, but the default itself can be changed with an appropriate Feature block entry in the configuration file.
The facility normally defaults to USER, but may be configured to be any of AUTH, CRON, DAEMON,
LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7, LPR, MAIL, NEWS,
USER, or UUCP. Some systems also have the AUTHPRIV facility.
To configure this default, add a Feature block line to the configuration file that looks like:
"LOG" = "<facility>";
Where <facility> is the desired default syslog facility.
Log files#
Each subsystem may be configured to send its log messages to any single log file with a Feature block entry like:
"LOG" = "<subsys>" "FILE" "<file>";
Where <subsys> is one of the subsystem names described above, and <file> is the file name for the log file. The file name may be relative to the server’s data directory (“DPATH”), or it may be an absolute path name.
If you're using chroot, absolute path names will be relative to the server's root directory.
Logging to syslog#
By default, except for the CONFIG subsystem, no logs are sent to syslog. This can be overridden
using an Feature block entry like the following:
"LOG" = "<subsys>" "FACILITY" "<facility>";
Where <subsys> is one of the subsystem names described above, and <facility> is one of the facility names listed in the "Default syslog facility" section.
The facility string may also be “NONE,” to turn off syslog for that subsystem, and “DEFAULT,” to use
the server’s default facility. Please don’t confuse a DEFAULT facility with the default for a
particular subsystem; only the CONFIG subsystem defaults to DEFAULT, whereas all the rest default
to NONE.
Logging via server notices#
Log messages can be sent to online IRC operators. Many subsystems actually default to this behavior, in fact. For security, log messages containing IP addresses or other extremely sensitive data will never be sent via server notices, but all others can be sent to a specific server notice mask.
The available mask names are:
- OLDSNO
- SERVKILL
- OPERKILL
- HACK2
- HACK3
- UNAUTH
- TCPCOMMON
- TOOMANY
- HACK4
- GLINE
- NETWORK
- IPMISMATCH
- THROTTLE
- OLDREALOP
- CONNEXIT
- DEBUG
The special mask name “NONE” inhibits sending of server notices for a particular subsystem.
The Feature block entry for this configuration looks like:
"LOG" = "<subsys>" "SNOMASK" "<mask>";
Where <subsys> is one of the subsystem names described above, and <mask> is one of the mask names.
Setting minimum logging level#
The minimum log level for a particular subsystem may be set with a Feature block entry like:
"LOG" = "<subsys>" "LEVEL" "<level>";
Where <subsys> is one of the subsystem names described above, and <level> is one of the level names described above.