<div dir="ltr">Thanks for this.<div><br></div><div>I suspect I might have been unclear. The systemd service I'm using is the one installed by the EPEL package is the traditional charon called using /usr/libexec/strongswan/starter, not the newer charon-systemd variant. </div><div><br></div><div>The service file for this is:</div><div><br></div><div><div><font face="monospace, monospace">[Unit]</font></div><div><font face="monospace, monospace">Description=strongSwan IPsec IKEv1/IKEv2 daemon using ipsec.conf</font></div><div><font face="monospace, monospace">After=syslog.target</font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace">[Service]</font></div><div><font face="monospace, monospace">ExecStart=/usr/sbin/strongswan start --nofork</font></div><div><font face="monospace, monospace">StandardOutput=syslog</font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace">[Install]</font></div><div><font face="monospace, monospace">WantedBy=multi-user.target</font></div></div><div><br></div><div>What is the purpose of <font face="monospace, monospace">StandardOutput=syslog</font> in this unit file? This version of charon does do its own logging to syslog (which is also stored in the journal when using systemd). But having <font face="monospace, monospace">StandardOutput=syslog</font> in the unit file is causing the duplicate log entries (one written directly to syslog, the other written to stdout and then copied to syslog by systemd). I think it would be helpful to change this to <font face="monospace, monospace">StandardOutput=null</font> to avoid these duplicate log entries in the default installed configuration. </div><div><br></div><div>Using charon-systemd would be a better long-term solution, I'd just rather use the EPEL package than build my own package that uses charon-systemd and keep it up to date with security fixes etc.</div><div><br></div><div>Thanks again,</div><div><br></div><div>James Birkett</div></div><div class="gmail_extra"><br><div class="gmail_quote">On 13 October 2016 at 00:29, Andreas Steffen <span dir="ltr"><<a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi James,<br>
<br>
yes, with systemd and journalctl active you have to remove the<br>
syslog daemon section from strongswan.conf. If you want to change<br>
the defaults of the systemd logging you can do this in a charon.journal<br>
section in strongswan.conf. And I personally prefer an additional<br>
level 0 output going to auth.log. Here is an example of mine:<br>
<br>
charon-systemd {<br>
journal {<br>
default = 1<br>
tnc = 2<br>
imv = 2<br>
pts = 2<br>
}<br>
syslog {<br>
auth {<br>
default = 0<br>
}<br>
}<br>
}<br>
<br>
Best regards<br>
<br>
Andreas<div><div class="h5"><br>
<br>
On 12.10.2016 08:48, James Birkett wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
Out of the box I seem to get every log message from strongswan<br>
duplicated, once logged by "charon", then again by "strongswan" after a<br>
delay, e.g.<br>
<br>
Oct 10 12:26:32 sapphire charon: 05[ENC] generating INFORMATIONAL_V1<br>
request 1411728704 [ HASH N(DPD) ]<br>
<br>
followed later by:<br>
<br>
Oct 10 12:29:32 sapphire strongswan[19104]: 05[ENC] generating<br>
INFORMATIONAL_V1 request 1411728704 [ HASH N(DPD) ]<br>
<br>
I believe this is because the systemd unit file (strongswan.service) has<br>
the line:<br>
StandardOutput=syslog, causing systemd to relay everything to syslog,<br>
but the default /etc/strongswan/strongswan.d/c<wbr>haron-logging.conf also<br>
has a syslog section so charon logs directly to syslog itself as well.<br>
<br>
I suspect the delay between the two copies of the log entries may be<br>
related to buffering on standard out, since the logs from "strongswan"<br>
always appear in batches with the same timestamp, but I'm not sure.<br>
<br>
In my case I'm using strongswan-5.4.0 on Centos 7 from EPEL<br>
<a href="http://koji.fedoraproject.org/koji/buildinfo?buildID=774748" rel="noreferrer" target="_blank">http://koji.fedoraproject.org/<wbr>koji/buildinfo?buildID=774748</a> but I have<br>
checked the strongswan 5.5 tarball and it appears the systemd unit file<br>
and charon-logging.conf are unchanged.<br>
<br>
I'm not really sure if this is a bug or something specific to my syslog<br>
configuration, but given that charon is logging to syslog itself in the<br>
default configuration, would it make more sense to set "StandardOutput =<br>
null" from the unit file instead? I have made this change on my own<br>
system and it appears to have the desired result.<br>
<br>
Thanks,<br>
<br>
James Birkett<br>
<br>
<br>
<br></div></div>
Scanned by CyberHound <<a href="http://cyberhound.com/" rel="noreferrer" target="_blank">http://cyberhound.com/</a>><br>
<br>
*Confidentiality Notice:* This email, including any attachments, is<br>
confidential and may be privileged. If you are not the intended<br>
recipient please notify the sender immediately and delete it. You should<br>
not copy it or use it for any purpose or disclose its contents to any<br>
other person without CyberHound's prior written permission. CyberHound<br>
Pty Ltd reserves the right to monitor all email communications passing<br>
through its networks and devices.<br>
<br>
<br>
______________________________<wbr>_________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a><br>
<a href="https://lists.strongswan.org/mailman/listinfo/users" rel="noreferrer" target="_blank">https://lists.strongswan.org/m<wbr>ailman/listinfo/users</a><br>
<br><span class="HOEnZb"><font color="#888888">
</font></span></blockquote><span class="HOEnZb"><font color="#888888">
<br>
-- <br>
==============================<wbr>==============================<wbr>==========<br>
Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.<wbr>org</a><br>
strongSwan - the Open Source VPN Solution! <a href="http://www.strongswan.org" rel="noreferrer" target="_blank">www.strongswan.org</a><br>
Institute for Internet Technologies and Applications<br>
University of Applied Sciences Rapperswil<br>
CH-8640 Rapperswil (Switzerland)<br>
==============================<wbr>=============================[<wbr>ITA-HSR]==<br>
<br>
<br>
Scanned by CyberHound<br>
(<a href="http://cyberhound.com/" rel="noreferrer" target="_blank">http://cyberhound.com/</a>)<br>
<br>
</font></span><br>______________________________<wbr>_________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br>
<a href="https://lists.strongswan.org/mailman/listinfo/users" rel="noreferrer" target="_blank">https://lists.strongswan.org/<wbr>mailman/listinfo/users</a><br></blockquote></div><br></div>
<br><br>
<br>
Scanned by <a href="http://cyberhound.com/">CyberHound</a>
<br><br>
<font size="-3"><b>Confidentiality Notice:</b>
This email, including any attachments, is confidential and may be privileged. If you are not the intended recipient please notify the sender immediately and delete it. You should not copy it or use it for any purpose or disclose its contents to any other person without CyberHound's prior written permission. CyberHound Pty Ltd reserves the right to monitor all email communications passing through its networks and devices.
</font>