logging: default rules come from the init script, not a trailing fallback rule

rsyslog flagged the fallback action after the include as unreachable (the rendered rules end in stop). The forgefirm-logging init script now writes a default rules file when the render leaves none, and the shipped rsyslog.conf carries only the include.
This commit is contained in:
ScottW514
2026-08-15 15:27:24 -04:00
parent 298d711533
commit 7487f907f4
2 changed files with 21 additions and 10 deletions
@@ -35,12 +35,8 @@ template(name="ff_line" type="list") {
}
# The rendered per-logger rules (levels, remote target). Every message
# is consumed there (each block ends in stop).
# is consumed there (each block ends in stop). The forgefirm-logging
# init script guarantees the file exists before this daemon starts: it
# writes a default rules file (everything to system/, info and above)
# if the render fails.
include(file="/data/forgefirm/rsyslog-forgefirm.conf" mode="optional")
# Reached only if the rules file is missing (a boot where the render
# failed): keep everything, on disk, at info and above.
if $syslogseverity <= 6 then action(type="omfile"
file="/data/log/forgefirm/system/system.log" template="ff_line"
asyncWriting="on" flushOnTXEnd="off" flushInterval="1"
fileCreateMode="0640" dirCreateMode="0755" createDirs="on")
@@ -22,10 +22,25 @@ CONF=/etc/logrotate.conf
PIDFILE=/var/run/forgefirm-logging.pid
LEGACY=/data/forgefirm/legacy-logs
RULES=/data/forgefirm/rsyslog-forgefirm.conf
render() {
[ -x "$FORGECTRL" ] || return 0
# syslog is not up yet at this point: report to the console
"$FORGECTRL" --render-syslog || echo "forgefirm-logging: render-syslog failed"
if [ -x "$FORGECTRL" ]; then
"$FORGECTRL" --render-syslog || echo "forgefirm-logging: render-syslog failed"
fi
[ -s "$RULES" ] && return 0
# No rules (render failed, or a first boot without the daemon):
# keep everything on disk under system/, info and above, so the
# boot is not lost. Replaced by the real render at the next boot.
echo "forgefirm-logging: writing default rules to $RULES"
mkdir -p /data/forgefirm /data/log/forgefirm/system
cat > "$RULES" <<'EOF'
# DEFAULT rules - forgectrl --render-syslog did not run; everything to
# system/ at info and above. Rewritten at the next boot.
if $syslogseverity <= 6 then action(type="omfile" file="/data/log/forgefirm/system/system.log" template="ff_line" asyncWriting="on" flushOnTXEnd="off" flushInterval="1" fileCreateMode="0640" dirCreateMode="0755" createDirs="on")
stop
EOF
}
# Files written by ForgeFIRM before it logged through syslog. Moved, not