On Fri, Aug 22, 2003 at 09:12:32AM +0100, Philip Hazel wrote: > Wow. That sounds like a dangerous recipe for letting bad users write a
> lot of junk to your syslog. Are your users particularly well-behaved? :-)
No, of course they are not... Last time I checked, "well-behaved user"
was third on the list of rare species, right after unicorn and the dodo.
That's why they can select fields, patterns and actions in the web
interface, which, after some sanity checking, creates the filter script
for them. For every rule it also generates a logwrite-statement.
> I'm afraid I'm not happy with this because of the possibility of abuse.
> It seems to me to be something that very, very few sites would actually
> want to do.
Ah yes, seems I'm a bit narrow minded and focuesed on our setup, where
users have no direct means of changing the filter file. Of course that
would offer the possibility of filling up the file system, generating
fake messages, et al...
> You could write a long-running daemon that listens on a named pipe
> (FIFO) or Unix domain socket, and copies anything it reads to syslog.
