Skip to content

fix(journal): treat missing PRIORITY field as unknown, not Emergency#840

Open
aki1770-del wants to merge 1 commit into
COVESA:masterfrom
aki1770-del:fix/journal-missing-priority-731
Open

fix(journal): treat missing PRIORITY field as unknown, not Emergency#840
aki1770-del wants to merge 1 commit into
COVESA:masterfrom
aki1770-del:fix/journal-missing-priority-731

Conversation

@aki1770-del
Copy link
Copy Markdown

Problem

In get_journal_msg(), the PRIORITY field is read into buffer_priority and then passed to atoi():

dlt_system_journal_get(j, buffer_priority, "PRIORITY", sizeof(buffer_priority));
...
systemd_loglevel = atoi(buffer_priority);

When a journal entry has no PRIORITY field — common for auditd messages with _TRANSPORT=auditdlt_system_journal_get() leaves buffer_priority as an empty string. atoi("") returns 0, which maps to severity level 0 (Emergency/Alert/Critical):

case 0:     /* Emergency */
case 1:     /* Alert */
case 2:     /* Critical */
    loglevel = DLT_LOG_FATAL;

All auditd log entries are thus emitted as DLT_LOG_FATAL with the label "Emergency:", regardless of their actual content.

Fixes #731.

Fix

Check buffer_priority[0] != '\0' before calling atoi(). Use -1 as a sentinel when the field is absent — -1 does not match any switch case, so the code falls through to default: loglevel = DLT_LOG_INFO, and the printed label shows prio_unknown: which accurately reflects the missing field.

systemd_loglevel = (buffer_priority[0] != '\0') ? atoi(buffer_priority) : -1;

Testing

Verified: auditd journal entries without PRIORITY are logged at DLT_LOG_INFO with label prio_unknown: after the fix.

When a journal entry has no PRIORITY field (common for auditd
messages with _TRANSPORT=audit), dlt_system_journal_get() leaves
buffer_priority empty. The subsequent atoi(buffer_priority)
call returns 0 because atoi("") == 0, which maps to severity 0
(Emergency/Alert/Critical) in get_journal_msg().

This caused all auditd journal entries to appear as Emergency-
level DLT messages, masking their true (benign) nature.

Fix: check for an empty buffer before calling atoi. Use -1 as
a sentinel value so that the switch falls through to the default
DLT_LOG_INFO branch, and the priority label printed in the
message shows "prio_unknown:" rather than "Emergency:".

Fixes COVESA#731
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Incorrect log level assignment for auditd messages without PRIORITY field

1 participant