KRB5_OPENLOG(3)

NAME
krb5_initlog, krb5_openlog, krb5_closelog, krb5_addlog_dest, krb5_addlog_func, krb5_log, krb5_vlog, krb5_log_msg, krb5_vlog_msg - Heimdal logging functions

LIBRARY
Kerberos 5 Library (libkrb5, -lkrb5)

SYNOPSIS
#include <krb5.h>
typedef void
*krb5_log_log_func_t(const char *time, const char *message, void *data);
typedef void
*krb5_log_close_func_t(void *data);
krb5_error_code
krb5_addlog_dest(krb5_context context, krb5_log_facility *facility, const char *destination);
krb5_error_code
krb5_addlog_func(krb5_context context, krb5_log_facility *facility, int min, int max, krb5_log_log_func_t log, krb5_log_close_func_t close, void *data);
krb5_error_code
krb5_closelog(krb5_context context, krb5_log_facility *facility);
krb5_error_code
krb5_initlog(krb5_context context, const char *program, krb5_log_facility **facility);
krb5_error_code
krb5_log(krb5_context context, krb5_log_facility *facility, int level, const char *format, ...);
krb5_error_code
krb5_log_msg(krb5_context context, krb5_log_facility *facility, char **reply, int level, const char *format, ...);
krb5_error_code
krb5_openlog(krb5_context context, const char *program, krb5_log_facility **facility);
krb5_error_code
krb5_vlog(krb5_context context, krb5_log_facility *facility, int level, const char *format, va_list arglist);
krb5_error_code
krb5_vlog_msg(krb5_context context, krb5_log_facility *facility, char **reply, int level, const char *format, va_list arglist);

DESCRIPTION
These functions logs messages to one or more destinations.

The krb5_openlog() function creates a logging facility, that is used to log messages. A facility consists of one or more destinations (which can be files or syslog or some other device). The program parameter should be the generic name of the program that is doing the logging. This name is used to lookup which destinations to use. This information is contained in the logging section of the krb5.conf configuration file. If no entry is found for program, the entry for default is used, or if that is missing too, SYSLOG will be used as destination.

To close a logging facility, use the krb5_closelog() function.

To log a message to a facility use one of the functions krb5_log(), krb5_log_msg(), krb5_vlog(), or krb5_vlog_msg(). The functions ending in _msg return in reply a pointer to the message that just got logged. This string is allocated, and should be freed with free(). The format is a standard printf() style format string (but see the BUGS section).

If you want better control of where things gets logged, you can instead of using krb5_openlog() call krb5_initlog(), which just initializes a facility, but doesn't define any actual logging destinations. You can then add destinations with the krb5_addlog_dest() and krb5_addlog_func() functions. The first of these takes a string specifying a logging destination, and adds this to the facility. If you want to do some non-standard logging you can use the krb5_addlog_func() function, which takes a function to use when logging. The log function is called for each message with time being a string specifying the current time, and message the message to log. close is called when the facility is closed. You can pass application specific data in the data parameter. The min and max parameter are the same as in a destination (defined below). To specify a max of infinity, pass -1.

krb5_openlog() calls krb5_initlog() and then calls krb5_addlog_dest() for each destination found.

  Destinations
The defined destinations (as specified in krb5.conf) follows:

STDERR
    This logs to the program's stderr.

EFILE:/file
    Log to the specified file if it exists, otherwise do nothing. All writes will be appended to the end of the file and the file will be re-opened for each new write. Non-existence of the file is cached for 1 second which reduces the potential performance impact significantly. This is useful for defining a trace file which can be enabled without restarting a server.

FILE:/file
    Log to the specified file. All writes will be appended to the end of the file and the file will be re-opened for each new write.

FILE=/file
    On the first write, this form will truncate(2) the file and then append all subsequent messages whilst keeping the file descriptor open. This form is mainly for compatibility with MIT libkrb5.

DEVICE=/device
    This logs to the specified device, at present this is the same as FILE:/device.

CONSOLE
    Log to the console, this is the same as DEVICE=/dev/console.

SYSLOG[:priority[:facility]]
    Send messages to the syslog system, using priority, and facility. To get the name for one of these, you take the name of the macro passed to syslog(3), and remove the leading LOG_ (LOG_NOTICE becomes NOTICE). The default values (as well as the values used for unrecognised values), are ERR, and AUTH, respectively. See syslog(3) for a list of priorities and facilities.

Each destination may optionally be prepended with a range of logging levels, specified as min-max/. If the level parameter to krb5_log() is within this range (inclusive) the message gets logged to this destination, otherwise not. Either of the min and max valued may be omitted, in this case min is assumed to be 0, and max is assumed to be 3. If you don't include a dash, both min and max get set to the specified value.

The paths specified are subject to token expansion. For the purposes of logging, the most interesting token expansion is which calls strftime(3) on <string> with the localised current time of day.

  Levels
Each log message has a level as follows:

0   Critical conditions. This is a condition that should be corrected immediately, such as a corrupted Kerberos database.

1   Errors. These are errors that occur in the normal processing of requests.

2   Warning messages. On the KDC, this includes malformed requests and requests that are out of policy.

3   Informational messages.

4-6 Debugging messages with increasing obscurity as the level rises.

7   Tracing messages. These messages may be high volume and are likely to impact performance significantly. Notably, tracing messages may be emitted whilst locks are held.

EXAMPLES

    [logging]
    	kdc = 0/FILE:/var/log/kdc.log
    	kdc = 1-/SYSLOG:INFO:USER
    	default = STDERR

This will log all messages from the kdc program with level 0 to /var/log/kdc.log, other messages will be logged to syslog with priority LOG_INFO, and facility LOG_USER.

    [logging]
    	kdc = FILE:/var/log/kdc-%{strftime:%Y%m%d%H}
    	kdc = 4-/EFILE:/tmp/kdc-trace

This will log all messages from the kdc program with level 0 to 3 (inclusively) to a file whose name is generated using strftime(3). As the file is open(2) ed each time a log message is written, this can be used to write automatically rotating log files. All of the KDC debugging messages will be written into /tmp/kdc-trace but only if it exists.

SEE ALSO
syslog(3), krb5.conf(5)

BUGS
These functions use asprintf() to format the message. If your operating system does not have a working asprintf(), a replacement will be used. At present this replacement does not handle some correct conversion specifications (like floating point numbers). Until this is fixed, the use of these conversions should be avoided.

If logging is done to the syslog facility, these functions might not be thread-safe, depending on the implementation of openlog(), and syslog().