79 Commits

Author SHA1 Message Date
asif 29a5539949 feat(systemd): Update systemd unit-file
Update systemd unit-file to support v3 parameters. Use journald logging as the template example.
2026-07-25 04:33:35 -06:00
asif 0fe3535328 chore(ide): Delete notebook 2026-07-25 04:16:23 -06:00
asif 30bd4d230d docs(logwatch): Update readme
Update readme with changes for v3
2026-07-25 04:11:32 -06:00
asif 2d0188949b chore(ide): Update dictionary 2026-07-25 04:11:05 -06:00
asif c53b89667f feat(logwatch): Update logwatch files for v3
Add new timestamp template and delete the old one. Update report script file to use new 'status' tags to generate logwatch reports.
2026-07-25 03:46:41 -06:00
asif 9654bf7472 feat(log): Add 'SUCCESS' status
Tag successfully updated entries with a 'SUCCESS' tag instead of 'OK' for better log filtering and to allow for logwatch reporting.
2026-07-25 03:45:44 -06:00
asif d20be3e602 docs(readme): Update readme with v3 changes 2026-07-25 03:23:49 -06:00
asif 563ded005f docs(script): Fix script examples
Script examples referenced old log-file switches.
2026-07-25 01:52:27 -06:00
asif 977827b92d feat(logger): Remove unneeded file
This file was a test-file while testing different methods of writing to the journal. No longer needed.
2026-07-25 01:50:22 -06:00
asif 9ed3d1adc1 docs(script): Update embedded script examples
Proofreading. Add examples of using new log backends and formats.
2026-07-25 01:28:47 -06:00
asif 8540fe16b2 fix(log): Disallow multi-logging
Make logging options mutually-exclusive to avoid confusion.
2026-07-25 01:10:48 -06:00
asif 1fb44db8df chore(ide): Update notebook settings 2026-07-25 01:10:16 -06:00
asif 1144156613 feat(func): Write to journald
Function to write log entries to journald. Update writeLog steering function to use this new backend.
2026-07-25 00:45:18 -06:00
asif 45e5e17513 feat(func): Translate standardized log levels to journald 2026-07-25 00:42:06 -06:00
asif a92b341bc3 feat(log): merge feat/structured-logging
Merge structured logging feature branch into main.

Closes 2
2026-07-25 00:20:04 -06:00
asif 08a5c823d5 refactor(log): Use CLEF for JSON logs
Use Compact Log Event Format (CLEF) for JSON logs along with custom properties.
2026-07-24 04:41:23 -06:00
asif eafba0d67d perf(log): Use compact JSON for logging 2026-07-24 04:36:26 -06:00
asif e25bd9fb4d feat(func): Add JSON logging func
Update central logging steering function to reference this new JSON logging backend function.
2026-07-24 04:02:21 -06:00
asif bff59f5c1f chore(ide): Save custom dictionary 2026-07-24 04:01:35 -06:00
asif 539b80e4ec feat(script): Use HTTPS ip discovery links 2026-07-24 03:52:30 -06:00
asif 58520b3567 refactor(log): Remove redundant debug log handling
Debug-level logging is handled by the central logging steering function. Remove redundant code in backend plaint-text logging function.
2026-07-24 03:28:49 -06:00
asif 51bd6160f3 feat(func): Use centralized log func
Create single logging function that can be called and then forwards the request to the appropriate logging backend function for completion.
2026-07-24 03:25:29 -06:00
asif 8d3489ba00 fix(vars): Add missing LOG_PROGRAM_NAME var 2026-07-24 02:48:26 -06:00
asif 3b97d112ad feat(log): Add CF-ERR to operation attr
Update 'listCFErrors' function so that 'CF-ERR' is appended to the 'operation' field of the error log.
2026-07-24 02:44:22 -06:00
asif 1506d77ee9 refactor(func): Remove no-colourize functions 2026-07-24 02:17:06 -06:00
asif e4e967e227 feat(params): Cleanup journald pre-req fail msg 2026-07-24 02:16:08 -06:00
asif aebf8042e3 feat(params): Use badparam func to manage logging 2026-07-24 02:15:14 -06:00
asif 02e3e8d391 feat(log): Log parameter errors 2026-07-24 01:59:10 -06:00
asif 95682314de fix(params): Fix pre-flight console log dedup 2026-07-24 01:46:51 -06:00
asif 5bc3e7d587 feat(log): Enable debug level filtering 2026-07-24 01:18:16 -06:00
asif fca36ac119 feat(params): Add debug logging toggle 2026-07-24 01:13:40 -06:00
asif 2b0128d0c1 fix(log): Prevent preflight duplicate logging
Prevent writing preflight error messages to the console twice when using console logging mode.
2026-07-24 01:08:54 -06:00
asif c792ec8a0a feat(params): Add log type, fmt params
Add log type and format parameters. Update defaults. Update help script.
2026-07-24 01:03:28 -06:00
asif 1732de343d refactor(func): Remove unused functions
Remvoe the logging functions replaced by the new structured implementation.
2026-07-23 23:22:17 -06:00
asif 51b2b455a2 feat(log): Use plain-text logging for all messages
Convert all logging output to plain-text structured messages using new function.
2026-07-23 23:16:12 -06:00
asif f8f3bf1539 refactor(func): Change default err code to 0 2026-07-23 22:17:15 -06:00
asif f8908d7830 feat(func): Write modified syslog fmt msg
Take input parameters and generate a modified syslog-style log entry.
2026-07-23 21:59:58 -06:00
asif 8a5a72e15a feat(func): Convert to uniform log levels
Take input text with various references to log levels and return a standardized uppercase log level name.
2026-07-23 21:57:30 -06:00
asif 1da49b06db feat(func): Convert text ucase, lcase 2026-07-23 21:56:19 -06:00
asif 1336c8e63b feat(func): Retrieve machine host name 2026-07-23 21:55:56 -06:00
asif 450733a8d5 feat(func): Generate ISO-8601 timestamp 2026-07-23 21:55:25 -06:00
asif 92e69d1b85 fix(logger): Fix JournalD log levels
Log levels were reversed in the translation function.
2026-07-23 00:20:30 -06:00
asif 00ea88780d feat(logger): Echo vs return values from Translate func 2026-07-23 00:18:03 -06:00
asif d9aa8973a3 fix(logger): Perform cmd subst outside heredoc
Perform function and command value substitution outside the heredoc forwarded to logger for JournalD entries.
2026-07-23 00:17:42 -06:00
asif ec75cffbf1 fix(logger): Ensure log levels are lcase before standardization 2026-07-23 00:16:19 -06:00
asif b8fb744623 fix(logger): Fix error in json logger
Assignment to 'pid' argument was incorrect.
2026-07-22 23:50:33 -06:00
asif d0b2c781bf feat(logger): Update test cases
Update JSON and JOURNALD tests to match text tests and use new functions.
2026-07-22 23:48:16 -06:00
asif c4d28d1f8c fix(logger): Fix default subst
Default parameter substitution in all functions was incorrect.
2026-07-22 23:44:08 -06:00
asif f085838781 feat(logger): Add test with operation, error code 2026-07-22 23:42:52 -06:00
asif 4a6c339a07 fix(logger): Fix default subst
Default variable substitution in plain-text function was incorrect.
2026-07-22 23:42:33 -06:00
asif c94f12e976 fix(logger): Fix error in uppercase func
'upper' and 'lower' translate strings were not supplied separately.
2026-07-22 23:38:45 -06:00
asif 5443612381 feat(logger): Add plain-text test output 2026-07-22 23:35:08 -06:00
asif df144a5211 fix(logger): Remove errant 'fi' statements
Remove 'fi' statements left over from previous logic checks.
2026-07-22 23:33:49 -06:00
asif 04811805c3 feat(logger): Remove unused global vars 2026-07-22 23:25:28 -06:00
asif aa446c00e6 feat(logger): Update journal logging function
Use new standardized format fields.
2026-07-22 23:24:52 -06:00
asif 56a5ad59fe refactor(logger): Rename writeJournalLog function
Rename from 'writeJournalLog' to 'writeJournalDLog' for specificity.
2026-07-22 23:19:51 -06:00
asif ce1ab86d22 fix(logger): Fix JSON logger
Level and status were swapped. JSON output was missing new prefix information (timestamp, hostname, etc.)
2026-07-22 23:18:36 -06:00
asif cae57ccf6b feat(logger): Use standardized log levels for JSON 2026-07-22 23:15:44 -06:00
asif 0fcd0d9c13 refactor(logger): Use standardized log levels for plain-text 2026-07-22 23:15:11 -06:00
asif e411a35b93 feat(logger): Add log level translator functions 2026-07-22 23:13:58 -06:00
asif 0e787be456 feat(logger): Add lowercase function 2026-07-22 23:06:34 -06:00
asif 17c33d237f fix(logger): Ensure plain-text status is uppercase 2026-07-22 22:54:25 -06:00
asif 5b55ac95a3 feat(logger): Update JSON logger
Require message, level, and status. Reorganize JSON output to mirror modified syslog-style structure.
2026-07-22 22:53:38 -06:00
asif f4dc8f44b1 feat(logger): Handle plain-text insufficient information
Return without logging if message, level and/or status is not supplied.
2026-07-22 22:49:13 -06:00
asif 3792881529 feature(logger): Add plain-text logger function 2026-07-22 22:42:49 -06:00
asif c1f54a619c refactor(logger): Use ISO8601 timestamp 2026-07-22 21:52:53 -06:00
asif 4c997a6b7d feature [logger] add status logging param 2026-07-22 18:34:14 -06:00
asif 1824d9f139 feat(logger): Framework test file 2026-07-22 17:33:46 -06:00
asif 50b4cf105f chore(ide): Update IDE settings 2026-07-22 17:33:36 -06:00
asif 1e3b545a23 chore(ide): JetBrains IDE configuration files 2026-07-19 23:37:13 -06:00
asif 380509c966 chore(git): Update git control files 2026-07-19 23:36:58 -06:00
asif 71da487aa8 style(fmt): Reformat shell script 2026-07-19 23:33:56 -06:00
asif 3be6eaee0c [preflight] Add check for logger dependency
'logger' is required to facilitate logging to the journaling system.
2026-07-19 18:52:34 -06:00
asif 5c6c8ec4ea [params] Create journal logging switch
Create boolean variable to store journal logging preference.
Set to 'false' by default. Add parameter to activate this preference.
Update help to include this new parameter.
2026-07-19 18:49:34 -06:00
asif c7297a512c [version] Update version, modified date 2026-07-19 15:44:40 -06:00
Asif Bacchus fddb406717 fix error in hyperlink 2021-05-10 03:22:22 -06:00
Asif Bacchus 4ec190af47 update readme 2021-05-10 03:18:49 -06:00
Asif Bacchus 57ce2d1ac3 fixed headings so TOC links work 2021-05-10 03:09:30 -06:00
Asif Bacchus 1ffd374a4f fix: set TERM for tput if not set
- stop warning messages in syslog from systemd invocation
2021-05-10 02:55:16 -06:00
15 changed files with 1039 additions and 675 deletions
+19
View File
@@ -55,6 +55,23 @@
*.bat text eol=crlf
*.cmd text eol=crlf
# web frontend stack -- force LF so SRI hashes are always correct
*.html text eol=lf
*.htm text eol=lf
*.css text eol=lf
*.min.css text eol=lf
*.js text eol=lf
*.min.js text eol=lf
*.php text eol=lf
# Visual Studio projects (Rider also)
*.cs diff=csharp
*.sln merge=union
*.csproj merge=union
*.vbproj merge=union
*.fsproj merge=union
*.dbproj merge=union
# Serialisation
*.json text
*.toml text
@@ -79,3 +96,5 @@
.gitattributes export-ignore
.gitignore export-ignore
.gitkeep export-ignore
.idea export-ignore
.vscode export-ignore
+34
View File
@@ -1 +1,35 @@
#
# JetBrains exclusions
#
riderModule.iml
/_ReSharper.Caches/
# User-specific stuff
.idea/**/workspace.xml
.idea/**/tasks.xml
.idea/**/usage.statistics.xml
.idea/**/dictionaries
.idea/**/shelf
# Generated files
.idea/**/contentModel.xml
.idea/**/GitCommitMessageStorage.xml
# Sensitive or high-churn files
.idea/**/dataSources/
.idea/**/dataSources.ids
.idea/**/dataSources.local.xml
.idea/**/sqlDataSources.xml
.idea/**/dynamic.xml
.idea/**/uiDesigner.xml
.idea/**/dbnavigator.xml
# modules
.idea_modules/
# Editor-based Rest Client
.idea/httpRequests
# project-specific exclusions
*.log
+6
View File
@@ -0,0 +1,6 @@
<?xml version="1.0" encoding="UTF-8"?>
<project version="4">
<component name="DeveloperToolsToolWindowSettingsV1" lastSelectedContentNodeId="base64-encoder-decoder" pluginVersion="9.0.0">
<developerToolsConfigurations />
</component>
</project>
+15
View File
@@ -0,0 +1,15 @@
<?xml version="1.0" encoding="UTF-8"?>
<project version="4">
<component name="GitToolBoxProjectSettings">
<option name="commitMessageIssueKeyValidationOverride">
<BoolValueOverride>
<option name="enabled" value="true" />
</BoolValueOverride>
</option>
<option name="commitMessageValidationEnabledOverride">
<BoolValueOverride>
<option name="enabled" value="true" />
</BoolValueOverride>
</option>
</component>
</project>
+8
View File
@@ -0,0 +1,8 @@
<?xml version="1.0" encoding="UTF-8"?>
<project version="4">
<component name="UserContentModel">
<attachedFolders />
<explicitIncludes />
<explicitExcludes />
</component>
</project>
+8
View File
@@ -0,0 +1,8 @@
<?xml version="1.0" encoding="UTF-8"?>
<project version="4">
<component name="RiderProjectSettingsUpdater">
<option name="singleClickDiffPreview" value="1" />
<option name="unhandledExceptionsIgnoreList" value="1" />
<option name="vcsConfiguration" value="3" />
</component>
</project>
Generated
+6
View File
@@ -0,0 +1,6 @@
<?xml version="1.0" encoding="UTF-8"?>
<project version="4">
<component name="VcsDirectoryMappings">
<mapping directory="" vcs="Git" />
</component>
</project>
+6
View File
@@ -0,0 +1,6 @@
<wpf:ResourceDictionary xml:space="preserve" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" xmlns:s="clr-namespace:System;assembly=mscorlib" xmlns:ss="urn:shemas-jetbrains-com:settings-storage-xaml" xmlns:wpf="http://schemas.microsoft.com/winfx/2006/xaml/presentation">
<s:Boolean x:Key="/Default/UserDictionary/Words/=cfddns/@EntryIndexedValue">True</s:Boolean>
<s:Boolean x:Key="/Default/UserDictionary/Words/=ddns/@EntryIndexedValue">True</s:Boolean>
<s:Boolean x:Key="/Default/UserDictionary/Words/=logwatch/@EntryIndexedValue">True</s:Boolean>
<s:Boolean x:Key="/Default/UserDictionary/Words/=mydomain/@EntryIndexedValue">True</s:Boolean>
<s:Boolean x:Key="/Default/UserDictionary/Words/=myserver/@EntryIndexedValue">True</s:Boolean></wpf:ResourceDictionary>
+194 -85
View File
@@ -1,49 +1,69 @@
# CloudflareDDNS <!-- omit in toc -->
# CloudflareDDNS
Update your *existing* Cloudflare DNS records with your current (dynamic) IP address via systemd timers and a (POSIX) shell script.
Update your *existing* Cloudflare DNS records with your current (dynamic) IP address via systemd timers and a (POSIX)
shell script.
## Contents <!-- omit in toc -->
## Contents
<!-- toc -->
<!-- TOC -->
- [Prerequisites](#prerequisites)
- [cfddns&#46;sh](#cfddns%2346sh)
* [CloudflareDDNS](#cloudflareddns)
* [Contents](#contents)
* [Prerequisites](#prerequisites)
* [cfddns script](#cfddns-script)
* [Installation](#installation)
* [Usage](#usage)
+ [Parameters](#parameters)
- [Cloudflare credentials file](#cloudflare-credentials-file)
* [Parameters](#parameters)
* [Cloudflare credentials file](#cloudflare-credentials-file)
* [File structure](#file-structure)
* [Bearer token](#bearer-token)
* [Zone ID](#zone-id)
- [cfddns.service](#cfddnsservice)
* [IP4 and/or IP6](#ip4-andor-ip6)
+ [Examples](#examples)
- [cfddns.timer](#cfddnstimer)
* [cfddns systemd service unit](#cfddns-systemd-service-unit)
* [IP4 or IP6](#ip4-or-ip6)
* [Examples](#examples)
* [cfddns systemd timer unit](#cfddns-systemd-timer-unit)
* [Activation](#activation)
- [Logging](#logging)
* [Logging](#logging)
* [JSON format](#json-format)
* [SYSLOG format](#syslog-format)
* [Systemd journal (journald)](#systemd-journal-journald)
* [Using Logwatch to monitor this script](#using-logwatch-to-monitor-this-script)
* [Using Logrotate to control log file size](#using-logrotate-to-control-log-file-size)
- [Final thoughts](#final-thoughts)
* [Final thoughts](#final-thoughts)
<!-- tocstop -->
<!-- TOC -->
## Prerequisites
This script requires that `curl` and `jq` are installed. `curl` is used to interact with the Cloudflare API and `jq` is used to efficiently and reliably construct/deconstruct the JSON strings and arrays which is how the Cloudflare API communicates. In most cases you can install these programs using your package manager running as root or via sudo. On Debian/Ubuntu, for example, you would run:
This script requires that `curl` and `jq` are installed. `curl` is used to interact with the Cloudflare API and `jq` is
used to efficiently and reliably construct/deconstruct the JSON strings and arrays returned by the Cloudflare API. If
you want to log to the system journal (journald), then `logger` must also be installed. In most cases you can install
these programs using your package manager running as root or via sudo:
```bash
apt install -y curl jq
```sh
# Debian/Ubuntu
sudo apt update && sudo apt install -y curl jq bsdutils
# Arch
sudo pacman -Sy curl jq logger
# Redhat/CentOS/Fedora
sudo dnf install curl jq util-linux
# Redhat/CentOS/Fedora (older versions)
sudo yum install curl jq util-linux
```
While the script does *not* require root privileges, you will need sudo/root access to install the *systemd* service and timer.
> While the script does *not* require root privileges, you will need sudo/root access to install the *systemd* service
> and timer.
## cfddns&#46;sh
## cfddns script
### Installation
I recommend putting this script in your */usr/local/bin* directory or somewhere else in your path so it's easy to run.
1. Copy the script file to your desired path and rename if you want.
1. Copy the script file to your desired path and rename it if you want.
```Bash
sudo cp cfddns.sh /usr/local/bin/ # just copy it
@@ -56,11 +76,15 @@ I recommend putting this script in your */usr/local/bin* directory or somewhere
sudo chmod +x /usr/local/bin/cfddns.sh
```
> Note: You can rename *cfddns.sh* to anything you want, the script will auto-update itself. However, you **must** manually update the systemd service file (*cfddns.service*) `ExecStart` line as [explained below](#cfddns.service).
> Note: You can rename *cfddns.sh* to anything you want, the script will automatically use its current name. However,
> you **must** manually update the systemd service file (*cfddns.service*) `ExecStart` line
> as [explained below](#cfddns-script).
### Usage
If you run the script with no parameters, it will display the help screen. The script accepts several parameters with only one (1) being required. The parameters are summarized below. You can access the help screen and example usage screens by running:
If you run the script with no parameters, it will display the help screen. The script accepts several parameters with
only one (1) being required. The parameters are summarized below. You can access the help screen and example usage
screens by running:
```Bash
cfddns.sh --help # display help screen
@@ -70,34 +94,45 @@ cfddns.sh --examples # show script usage examples
#### Parameters
| Parameter | Description | Default | Required? |
|---|---|---|:---:|
|-r<br>--record<br>--records|The fully qualified hostname(s) that should be updated with new IP addresses. You can supply a comma-delimited list (no spaces) or just one. Note that the script can only update *either* A *or* AAAA records during a single run so you may need to batch your hostnames, depending on your set-up.<br>N.B. This script will only update *existing* host records, it will **not** create new ones!|none|YES|
|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------|:---------:|
| -r<br>--record<br>--records | The fully qualified hostname(s) that should be updated with new IP addresses. You can supply a comma-delimited list (no spaces) or just one. Note that the script can only update *either* A *or* AAAA records during a single run so you may need to batch your hostnames, depending on your set-up.<br>**N.B. This script will only update *existing* host records, it will _not_ create new ones!** | none | YES |
| -c<br>--cred<br>--creds<br>--credentials<br>-f | Full path to your CloudFlare credentials file. This file contains your access token and zone id. See the [relevant section](#cloudflare-credentials-file) of this readme for more information. | scriptPath/cloudflare.credentials | NO |
| -i<br>--ip<br>--ip-address<br>-a<br>--address | The IP address that should be used to update Host A/AAAA records. If you omit this value, the script will attempt to auto-detect your public IP4/IP6 address and use that as appropriate. Use this option to manually force a specific IP to be used or when auto-detection fails. Note that the script does *not* check your IP addresses for correctness or proper form! | IP4 auto-detect | NO |
| -4<br>--ip4<br>--ipv4 | Update Host A records only (IP4). The script can only update *either* A *or* AAAA records in a single run. If you specify this and also use the IP6 mode switch, the most recent one will take effect. | Enabled, update A records | NO |
| -6<br>--ip6<br>--ipv6 | Update Host AAAA records only (IP6). The script can only update *either* A *or* AAAA records in a single run. If you specify this and also use the IP4 mode switch, the most recent one will take effect. | Disabled, update A records | NO |
| | | | |
|-l<br>--log|Full path where the script should save its log. Recommend */var/log/scriptName.log*|scriptPath/scriptName.log|NO|
|--nc<br>--no-color<br>--no-colour|Do not use ANSI colour-coding when writing to the log. This is useful if you review the logs using a reader that does not support ANSI colour-coding and instead displays control symbols which makes your log difficult to read.|Disabled, do colourful logs|NO|
|--log-console|Output the log to the console instead of a log file. You may use `--nc` with this option also.|Disabled, write to log file|NO|
|--no-log|Do not write a log file or output to the console. You will not have **any** feedback from the script if you run in this mode so you will not know if updates were successful or not. Im not really sure why youd want this option, but its available.|Disabled, write to log file|NO|
| --log-file | Generate a log file and save it in the specified location. Only specify this option if you want to save the log file in a non-default location. If you want to save the log in the default location, omit this option. Recommend */var/log/scriptName.log* | scriptPath/scriptName.log | NO |
| --log-journal | Log to the system journal (journald) instead of a log file. Log entries are automatically tagged 'CFDDNS' for easier filtering. Format tags do NOT apply when using this option. Use `json` or `pretty-json` with `journalctl` to see all logged properties. | Disabled, write to log file | NO |
| --log-console | Write log entries to the console (stdout) instead of a log file. Using `--fmt-syslog` with this option is strongly recommended since JSON is difficult to read on the console. | Disabled, write to log file | NO |
| --no-log | Do *not* write a log file, write to the journal, or output to the console. You will not have **any** feedback from the script if you run in this mode so you will not know if updates were successful or not. Im not really sure why youd want this option, but its available. | Disabled, write to log file | NO |
| | | | |
| --fmt-json | Write the log file or console output in a structured *Compact Log Event Format (CLEF)* JSON format. You will probably need a log viewer to meaningfully parse the logs. | Enabled | NO |
| --fmt-syslog | Write the log file or console output in a modified plain-text *syslog* style. This option is recommended when using `--log-console` or if you need easily readable log files. While all log entries are *consistent* using this format, they are not *structured*. | Disabled, just JSON format | NO |
| | | | |
| -h<br>--help<br>-? | Display built-in help screen explaining these same parameters. | | |
|--examples|Display some usage examples. Sometimes it's just easier to understand by seeing rather than reading.|||
| --examples | Display some usage examples. Sometimes it's easier to understand by seeing rather than reading. | | |
## Cloudflare credentials file
This repo includes a sample credentials file (*cloudflare.credentials* at the root of the repo) with pretty self-explanatory variable names. The script reads this file to get the credentials it needs to connect to your Cloudflare account and update DNS entries. It should be noted that the script is designed to use a *bearer token* and **not** your username/password or your Global API token! Lets break this down in case things are a little fuzzy still...
This repo includes a sample credentials file (*cloudflare.credentials* at the root of the repo) with pretty
self-explanatory variable names. The script reads this file to get the credentials it needs to connect to your
Cloudflare account and update DNS entries. It should be noted that the script is designed to use a *bearer token* and
**not** your username/password or your Global API token! Lets break this down in case things are a little fuzzy
still...
### File structure
The file is a basic shell script variables file. Make sure you **do not** put spaces between the variable name, equal sign and the value. Also, **do not** add any executable code since it will be run! The file should contain values for the following two variables:
The file is a basic shell script variables file. Make sure you **do not** put spaces between the variable name, equal
sign and the value. Also, **do not** add any executable code since it will be run! The file should contain values for
the following two variables:
| Variable | Value |
| -------- | ------------------------------------------------------------ |
|----------|----------------------------------------------------------------------------------------------|
| cfKey | The bearer token granting access to *edit* the DNS records of the zone (domain) in question. |
| cfZoneId | The Cloudflare Zone ID of the zone (domain) you wish to update. |
You can add comments if youd like since the script will ignore them. In the end, your file should look something like this, but obviously with your data instead of this nonsense sample information:
You can add comments if youd like since the script will ignore them. In the end, your file should look something like
this, but obviously with your data instead of this nonsense sample information:
```ini
#
@@ -109,24 +144,44 @@ cfZoneId=83d564234134513245311b23412331dd
```
You can save the file as anything you like and anywhere youd like as long as you inform the script of its location using the `--credentials` parameter. By default, the script will look for a file named *cloudflare.credentials* in the same path as the script.
You can save the file as anything you like and anywhere youd like as long as you inform the script of its location
using the `--credentials` parameter. By default, the script will look for a file named *cloudflare.credentials* at the
same path as the script.
Please remember that this file basically contains a password! As a result, it should be protected and access limited to
the root account:
```bash
chown root:root /path/to/cloudflare.credentials
chmod 600 /path/to/cloudflare.credentials
```
### Bearer token
I chose to use an API bearer token instead of a username/password or Global API token for security reasons. Your username/password and Global API token provide unfettered access to your account so if anyone gets hold of them, they can do anything to your account. An API bearer token, by contrast, can only do what you authorize it to do and you can revoke it at any time. Therefore, I suggest making a bearer token that is based on the “Edit zone DNS” template and restricted to the specific domain/zone you wish to update. Cloudflare provides an [excellent article](https://support.cloudflare.com/hc/en-us/articles/200167836-Managing-API-Tokens-and-Keys) on how to generate this token.
I chose to use an API bearer token instead of a username/password or Global API token for security reasons. Your
username/password and Global API token provide unfettered access to your account, so if anyone gets hold of them, they
can do anything to your account. An API bearer token, by contrast, only permits actions you explicitly authorize when
you create it, and you can revoke it at any time. Therefore, I suggest making a bearer token that is based on the
“Edit zone DNS” template and restricted to the specific domain/zone you wish to update. Cloudflare provides
an [excellent article](https://support.cloudflare.com/hc/en-us/articles/200167836-Managing-API-Tokens-and-Keys) on how
to generate this token.
> N.B. This is a breaking change from previous versions of this script!
### Zone ID
This is required by the Cloudflare API so it knows which zone you are editing and can check the permissions of the bearer token. This script only caters to one zone so likely only one domain per configuration file. If you need to update multiple zones, you can have multiple configuration files and call them as required on separate invocations of the script.
This is required by the Cloudflare API so it knows which zone you are editing and can check the permissions of the
bearer token. This script only caters to one zone, so likely only one domain per configuration file. If you need to
update multiple zones, you can have multiple configuration files and call them as required on separate invocations of
the script.
To get your Zone ID, log into your Cloudflare account and open the domain in question. On the overview page, scroll down a bit and look to the right. You will see your Zone ID listed there. Copy that string into your configuration file.
To get your Zone ID, log into your Cloudflare account and open the domain in question. On the overview page, scroll down
a bit and look to the right. You will see your Zone ID listed there. Copy that string into your configuration file.
## cfddns systemd service unit
## cfddns.service
This file **must** be copied to your */etc/systemd/system* directory (or equivalent directory if you're not running Debian/Ubuntu). If you change the name of the cfddns&#46;sh file, you must update the filename in the `ExecStart` line as shown below:
For the easiest implementation, this file should be copied to your */etc/systemd/system* directory. If you change the
name of the *cfddns.sh* file, you must update the filename in the `ExecStart` line as shown below:
````Ini
...
@@ -136,32 +191,34 @@ ExecStart=/full/path/to/your/renamed.file -parameter1 -parameter2 -parameter...
...
````
Dont forget to reload systemd after copying this file so it is recognized by the system! On most systems you can do this by running the following as root or via sudo:
### IP4 or IP6
```bash
systemctl daemon-reload
```
### IP4 and/or IP6
The cfddns.service file includes two *ExecStart* lines, one without a specified IP-protocol parameter (default IP4) and the other with the -6 (IP6) parameter. The service will run the cfddns&#46;sh script in default (IP4) mode with specified parameters first and then will run the script again in IP6 mode with specified parameters.
The cfddns.service file includes two *ExecStart* lines, one without a specified IP-protocol parameter (default IP4) and
the other with the -6 (IP6) parameter. The service will run the cfddns&#46;sh script in default (IP4) mode with
specified parameters first and then will run the script again in IP6 mode with specified parameters.
*Note: The parameters *can be different* in each case.*
> **N.B.** This is a `oneshot` type systemd unit-file, so we can have multiple `ExecStart` lines.
#### Examples
1. **Only update A records**
Update *mail<span>.example.com* A record with the current auto-detected public IP4 address of this machine and log results to */var/log/cfddns.log*.
Update the `A` record for *mail.example.com* with the current auto-detected public IP4 address of this machine and
log in JSON format (default) to */var/log/cfddns.log*. Note our Cloudflare credentials file is located in the *root
user's home* directory.
```Ini
[Service]
Type=oneshot
ExecStart=/usr/local/bin/cfddns.sh -c /root/cloudflare.credentials -r mail.example.com -l /var/log/cfddns.log
ExecStart=/usr/local/bin/cfddns.sh -c /root/cloudflare.credentials -r mail.example.com --log-file /var/log/cfddns.log
...
```
2. **Only update AAAA records**
Update *git<span>.example.com* and *mail<span>.example.com* AAAA records with the current auto-detected public IP6 address of this machine. Log will be stored in the same directory as the script file (/usr/local/bin).
Update `AAAA` records for *git.example.com* and *mail.example.com* with the current auto-detected public IP6 address
of this machine. The log will be stored in the same directory as the script file (default) and will be
JSON-formatted (default). In this case, the Cloudflare credentials file is located in */home/johndoe*.
```Ini
[Service]
@@ -171,21 +228,29 @@ The cfddns.service file includes two *ExecStart* lines, one without a specified
```
3. **Update A records then AAAA records**
Update *mail<span>.example.com* A record with auto-detected public IP4 address of this machine and write to log file stored at */var/log/DDNS_IP4.log*. Then, update both *mail<span>.example.com* and *git<span>.example.com* AAAA records with the specified IP6 address and write to log file at */var/log/DDNS_IP6.log*.
Update the `A` record for *mail.example.com* with the auto-detected public IP4 address of this machine. Then, update
`AAAA` records for both *mail.example.com* and *git.example.com* with the *specified IP6 address*. In both cases, we
are logging to the system journal (journald). Also notice that the Cloudflare credentials file is located in
different
places for each script call.
```Ini
[Service]
Type=oneshot
# update IP4 addresses
ExecStart=/usr/local/bin/cfddns.sh -c /dir1/account.cf -r mail.example.com -l /var/log/DDNS_IP4.log
ExecStart=/usr/local/bin/cfddns.sh -c /dir1/account.cf -r mail.example.com --log-journal
# update IP6 addresses
ExecStart=/usr/local/bin/cfddns.sh -6 -c /dir2/cloudflare.details -r mail.example.com,git.example.com --ip fd3f:e6db:9817:df84::a001 -l /var/log/DDNS_IP6.log
ExecStart=/usr/local/bin/cfddns.sh -6 -c /dir2/cloudflare.details -r mail.example.com,git.example.com --ip fd3f:e6db:9817:df84::a001 --log-journal
...
```
## cfddns.timer
## cfddns systemd timer unit
This is the timer file that tells your system how often to call the *cfddns.service* file which runs the *cfddns&#46;sh* script. By default, the timer is set for 5 minutes after the system boots up (to allow for other processes to initialize even on slower systems like a RasPi) and is then run every 15 minutes thereafter. Remember when setting your timer that Cloudflare limits API calls to 1200 every 5 minutes.
Again, for the easiest configuration, this file should be copied to your */etc/systemd/system* directory. This timer
file unit tells your system how often to call the *cfddns.service* file which runs the *cfddns.sh* script. By default,
the timer is set for 5 minutes after the system boots up (to allow for other processes to initialize even on slower
systems like a RasPi) and is then run every 15 minutes thereafter. Remember when setting your timer that Cloudflare
limits API calls to 1200 every 5 minutes.
You can change the timer by modifying the relevant section of the *cfddns.timer* file:
@@ -195,8 +260,17 @@ OnBootSec=5min
OnUnitActiveSec=15min
```
*OnBootSec* is how long to wait after the system boots up before executing the *cfddns.service*. *OnUnitActiveSec* will then wait the specified time from that first (after boot) call or after the timer is explicitly started before calling *cfddns.service* again. I recommend setting OnUnitActiveSec to a low value (like 2 minutes) for testing then setting it to a more reasonable time (like 15
minutes) after everything is working.
*OnBootSec* is how long to wait after the system boots up before executing the *cfddns.service*. *OnUnitActiveSec* will
then wait the specified time from that first (after boot) call or after the timer is explicitly started before calling
*cfddns.service* again. I recommend setting OnUnitActiveSec to a low value (like 2 minutes) for testing, then setting it
to a more reasonable time (like 15 minutes) after everything is working.
Remember to reload `systemd` after youve copied both the systemd unit and this timer unit. Run the following as root or
via sudo:
```sh
systemctl daemon-reload
```
### Activation
@@ -220,43 +294,78 @@ systemctl status cfddns.timer
It is NOT necessary to enable/start the *cfddns.service*, only the timer needs to be active.
Also remember that if you make changes to settings like `OnUnitActiveSec` while testing, or after testing is complete,
you *must* reload the systemd daemon! It will restart the appropriate units for you, and your new settings will take
effect immediately.
## Logging
The script logs every major action it takes and provides details on any errors it encounters in the log file (see the [parameters section](#parameters) for details about setting log location and name). If errors are encountered, they are colour coded red and an explanation of the error code is provided.
The script logs every major action it takes and provides details on any errors it encounters in the log file. Refer
to the [parameters section](#parameters) for details about setting log location and name. Starting in version 3.0, the
entire logging system outputs structured **JSON** by default.
While the log file is as terse as I felt reasonable, you may still want to configure any log-watch programs to further filter things for you so you don't have to review this log as part of your daily routine. To make that easier, the following conventions are observed in the log file and can be used to program your log-watch system:
> PLEASE remember to review your current log review/parsing system if upgrading from previous versions since this is a
> **major** change to how logging works.
- Specific update process errors: **[TIMESTAMP] ERR: message**
- These can be counted/filtered separately if you only care about update errors and not any other errors.
- Error messages: **[TIMESTAMP] ERROR: message (code: number)**
- Only one summary error message will be displayed for any/all update errors. This message contains a tally of failed updates. If you want to count individual update errors, filter for the above process error message format.
- While process error messages only relate to updates, these general error messages are logged for a variety of error conditions so its a good idea to include them in any filters.
- Cloudflare API error messages: **[TIMESTAMP] CF-ERR: message (code: cf-error-code)**
- These are only logged when update process errors occur so that you can see exactly what the Cloudflare API is complaining about.
- Specific update process warnings: **[TIMESTAMP] WARN: message**
- These can be counted/filtered separately from general warning messages. Presently, there are *no* general warning messages.
- Warning messages: **[TIMESTAMP] WARNING: message**
- Summary of each type of warning. Contains a tally of the specific warning.
- Currently, warnings are only issued for hostnames that are not found (i.e. update process warnings).
- Success messages: **[TIMESTAMP] SUCCESS: message**
- Each successful update generates a success message. There is no process or tally message.
- Already up-to-date: **[TIMESTAMP] IP address for {fqdn} is already up-to-date**
- Already up-to-date host entries generate a success message but you may still want to filter for them separately using this criteria.
- A session log always starts with **[TIMESTAMP] -- Cloudflare DDNS update-script: starting --**
- A successful session log always ends with **[TIMESTAMP] -- Cloudflare DDNS update-script: completed successfully --**
- A session ending with errors always ends with **[TIMESTAMP] -- Cloudflare DDNS update-script: completed with error(s) --**
**IMPORTANT:** This script uses the same log file for its output (unless you specify a different log file each time it
is run) therefore, you should avoid switiching formats within existing log files. For example, if you are using the
default log file, and run the script once with `--fmt-syslog` then switch to the default `--fmt-json`, parsing your log
will become very difficult. If you are switching log formats, it is best to start with a fresh log file.
### JSON format
This is the default logging format since it allows for easy parsing and filtering of log entries while still retaining a
structured format. I chose to implement a modified [Compact Log Event Format (CLEF)](https://clef-json.org) with the
following format for every message (expanded for readability, the log file is not 'pretty-printed'):
```json
{
"@t": "ISO-8601 timestamp",
"@m": "message describing the event",
"@l": "log level",
"hostname": "hostname of the machine executing the script",
"programName": "CFDDNS",
"pid": "PID of the process executing the script",
"status": "status of the operation being logged",
"operation": "short-name of the operation being logged",
"code": "numeric 'exit code' of the operation being logged"
}
```
### SYSLOG format
The SYSLOG format (`--fmt-syslog`) is a modified version of the typical plain-text *nix syslog format. This format is
useful when outputting the log to the console or when you need a very human-friendly format for the log files since you
will be manually parsing them. While the plain-text format is not *structured*, it is *consistent*:
```text
ISO-8601 timestamp hostname CFDDNS[pid]: LOG_LEVEL STATUS MESSAGE (OPERATION:CODE)
```
### Systemd journal (journald)
When using the `--log-journal` option, all logging will be sent to `journald` using its format. All log messages are
tagged `CFDDNS` to make filtering easier. Additional information logged with each entry can be exposed using the `json`
or `json-pretty` output options for `journalctl`.
### Using Logwatch to monitor this script
If you are using the Logwatch package to monitor your system, see the README in the */etc/logwatch* folder for details about the pre-configured service files already done for you :-)
If you are using the Logwatch package to monitor your system, see the README in the */etc/logwatch* folder for details
about the pre-configured service files already done for you :-)
### Using Logrotate to control log file size
Logrotate is pre-installed on standard Debian/Ubuntu distributions and is a great way to automatically rotate your log files and control how many old logs you keep on your system so they don't accumulate and eat up your disk space. I've included a sample configuration file you can copy to your */etc/logrotate.d/* folder. This file is set up to rotate your logs once a week, keep 3 weeks worth of history (compressed) and delete all logs older than that. The configuration file is located in this git archive at
*/etc/logrotate.d/cfddns* and is fully commented to help you customize it to suit your needs.
Logrotate is pre-installed on most linux distributions and is a great way to automatically rotate your log
files and control how many old logs you keep on your system so they don't accumulate and eat up your disk space. I've
included a sample configuration file you can copy to your */etc/logrotate.d/* folder. This file is set up to rotate your
logs once a week, keep 3 weeks worth of history (compressed) and delete all logs older than that. The configuration file
is located in this git archive at */etc/logrotate.d/cfddns* and is fully commented to help you customize it to suit your
needs.
## Final thoughts
Hopefully this helps you with an easy and reliable way to update your Cloudflare DNS entries with a dynamic IP address. Please feel free to comment and provide feedback and suggestions to make this script better!
Hopefully, this helps you with an easy and reliable way to update your Cloudflare DNS entries with a dynamic IP address.
Please feel free to comment and provide feedback and suggestions to make this script better!
Please check out my blog at [https://mytechiethoughts.com](https://mytechiethoughts.com) where I tackle problems like this all the time and find free/cheap solutions to tech problems.
Please check out my blog at [https://mytechiethoughts.com](https://mytechiethoughts.com) where I tackle problems like
this all the time and find free/inexpensive solutions to tech problems.
+2 -2
View File
@@ -4,8 +4,8 @@ After=network.target
[Service]
Type=oneshot
ExecStart=/usr/local/bin/cfddns.sh -c /path/to/account.details -r server.domain.tld -l /var/log/cfddns.log
ExecStart=/usr/local/bin/cfddns.sh -6 -c /path/to/account.details -r server.domain.tld -l /var/log/cfddns.log
ExecStart=/usr/local/bin/cfddns.sh -c /path/to/account.details -r server.domain.tld --log-journal
ExecStart=/usr/local/bin/cfddns.sh -6 -c /path/to/account.details -r server.domain.tld --log-journal
[Install]
WantedBy=multi-user.target
+300 -196
View File
@@ -3,11 +3,13 @@
#
# update Cloudflare DNS records with current (dynamic) IP address
# Script by Asif Bacchus <asif@bacchus.cloud>
# Last modified: May 7, 2021
# Last modified: July 19, 2026
# Version 3.0
#
### text formatting presets using tput
if command -v tput >/dev/null; then
[ -z "$TERM" ] && export TERM=xterm
bold=$(tput bold)
cyan=$(tput setaf 6)
err=$(tput bold)$(tput setaf 1)
@@ -29,81 +31,187 @@ else
width=80
fi
### functions
badParam() {
if [ "$1" = "null" ]; then
printf "\n%sERROR: '%s' cannot have a NULL (empty) value.\n" "$err" "$2"
printf "%sPlease use '--help' for assistance.%s\n\n" "$cyan" "$norm"
([ "$logToConsole" -eq 0 ]) && writeLog \
"${2} cannot have a NULL (empty) value" "critical" "fail" "preexec" 1
exit 1
elif [ "$1" = "dne" ]; then
printf "\n%sERROR: '%s %s'\n" "$err" "$2" "$3"
printf "file or directory does not exist or is empty.%s\n\n" "$norm"
([ "$logToConsole" -eq 0 ]) && writeLog \
"${3}: file or directory does not exist or is empty" "critical" "fail" "preexec" 1
exit 1
elif [ "$1" = "errMsg" ]; then
printf "\n%sERROR: %s%s\n\n" "$err" "$2" "$norm"
([ "$logToConsole" -eq 0 ]) && writeLog \
"${2%%\Exit*}" "fatal" "fail" "preexec" 1
exit 1
fi
}
exitError() {
case "$1" in
3)
errMsg="Unable to connect to Cloudflare servers. This is probably a temporary networking issue. Please try again later."
;;
10)
errMsg="Unable to auto-detect IP address. Try again later or supply the IP address to be used."
;;
20)
errMsg="Cloudflare authorized email address (cfEmail) is either null or undefined. Please check your Cloudflare credentials file."
;;
21)
errMsg="Cloudflare authorized API key (cfKey) is either null or undefined. Please check your Cloudflare credentials file."
;;
22)
errMsg="Cloudflare zone id (cfZoneId) is either null or undefined. Please check your Cloudflare credentials file."
;;
25)
errMsg="Cloudflare API error. Please review any 'CF-ERR:' lines in this log for details."
;;
26)
errMsg="${failedHostCount} host update(s) failed. Any 'CF-ERR:' lines noted in this log may help determine what went wrong."
;;
*)
writeLog error "An unspecified error occurred. (code: 99)"
printf "%s[%s] -- Cloudflare DDNS update-script: completed with error(s) --%s\n" "$err" "$(stamp)" "$norm" >>"$logFile"
exit 99
;;
esac
writeLog error "$errMsg" "$1"
printf "%s[%s] -- Cloudflare DDNS update-script: completed with error(s) --%s\n" "$err" "$(stamp)" "$norm" >>"$logFile"
exit "$1"
getHostname() {
(hostname -s)
}
exitOK() {
printf "%s[%s] -- Cloudflare DDNS update-script: completed successfully --%s\n" "$ok" "$(stamp)" "$norm" >>"$logFile"
exit 0
getTimeStamp() {
(date -u +"%Y-%m-%dT%H:%M:%SZ")
}
lowercase() {
echo "$1" | tr '[:upper:]' '[:lower:]'
}
uppercase() {
echo "$1" | tr '[:lower:]' '[:upper:]'
}
# 1: cloudflare error object, 2: operation identifier
listCFErrors() {
# extract error codes and messages in separate variables, replace newlines with underscores
codes="$(printf "%s" "$1" | jq -r '.errors | .[] | .code' | tr '\n' '_')"
messages="$(printf "%s" "$1" | jq -r '.errors | .[] | .message' | tr '\n' '_')"
# iterate codes and messages and assemble into coherent messages in log
# iterate codes and messages, assemble into a coherent log message
while [ -n "$codes" ] && [ -n "$messages" ]; do
# get first code and message in respective sets
# get the first code and message in respective sets
code="${codes%%_*}"
message="${messages%%_*}"
# update codes and messages sets by removing first item in each set
# update sets of codes and messages by removing the first item (above) in each set
codes="${codes#*_}"
messages="${messages#*_}"
# output to log
writeLog cf "$message" "$code"
writeLog "${message}" "err" "fail" "$2:CF-ERR" "$code"
done
}
standardizeLogLevels() {
LEVEL_TO_STANDARDIZE="$(lowercase "$1")"
case "$LEVEL_TO_STANDARDIZE" in
"critical" | "crit" | "fatal")
echo "CRIT"
;;
"error" | "err")
echo "ERR"
;;
"warning" | "warn")
echo "WARN"
;;
"information" | "info")
echo "INFO"
;;
"debug" | "verbose")
echo "DEBUG"
;;
*)
echo "INFO"
;;
esac
}
translateLogLevelsToJournalD() {
LEVEL_TO_TRANSLATE="$(standardizeLogLevels "$1")"
case "$LEVEL_TO_TRANSLATE" in
"CRIT")
echo 2
;;
"ERR")
echo 3
;;
"WARN")
echo 4
;;
"INFO")
echo 6
;;
"DEBUG")
echo 7
;;
*)
echo 6
esac
}
# $1: message, $2: level, $3: status, [$4: operation], [$5: code]
writeJournalDLog() {
# not enough information to generate a meaningful log message
if [ -z "$1" ] || [ $# -lt 3 ]; then
return
fi
J_TIMESTAMP="$(getTimeStamp)"
J_PID="$$"
J_PRIO="$(translateLogLevelsToJournalD "$2")"
J_STAT="$(uppercase "$3")"
logger --journald <<end
SYSLOG_TIMESTAMP=${J_TIMESTAMP}
SYSLOG_FACILITY=3
SYSLOG_IDENTIFIER=${LOG_PROGRAM_NAME}
SYSLOG_PID=${J_PID}
PRIORITY=${J_PRIO}
STATUS=${J_STAT}
MESSAGE=$1
OPERATION=${4:-UNSPECIFIED}
ERRNO=${5:-0}
end
return
}
# $1: message, $2: level, $3: status, [$4: operation], [$5: code]
writeJsonLog() {
# not enough information to generate a meaningful log message
if [ -z "$1" ] || [ $# -lt 3 ]; then
return
fi
JSON_PROPS="$(
jq --null-input -c \
--arg timestamp "$(getTimeStamp)" \
--arg hostname "$(getHostname)" \
--arg pName "$LOG_PROGRAM_NAME" \
--arg pid "$$" \
--arg level "$(standardizeLogLevels "$2")" \
--arg status "$(uppercase "$3")" \
--arg message "$1" \
--arg operation "${4:-UNSPECIFIED}" \
--arg code "${5:-0}" \
'{"@t":$timestamp, "@m":$message, "@l":$level, "hostname":$hostname, "programName":$pName, "pid":$pid, "status":$status, "operation":$operation, "code":$code}' \
)"
printf "%s\n" "$JSON_PROPS" >>"$logFile"
return
}
# modified syslog fmt: <ISO-8601 timestamp> <hostname> <tag>[pid]: [LEVEL:$2] [STATUS:$3] <MESSAGE:$1> (<OPERATION:$4>:<CODE:$5>)
writePlainTextLog() {
# not enough information to generate a meaningful log message
if [ -z "$1" ] || [ $# -lt 3 ]; then
return
fi
printf "%s %s %s[%s]: [%s] [%s] %s (%s:%s)\n" \
"$(getTimeStamp)" "$(getHostname)" "$LOG_PROGRAM_NAME" "$$" \
"$(standardizeLogLevels "$2")" "$(uppercase "$3")" "$1" "${4:-UNSPECIFIED}" "${5:-0}" \
>>"$logFile"
}
writeLog() {
([ "$logToNone" -eq 1 ]) && return
PT_LOG_LEVEL="$(standardizeLogLevels "$2")"
([ "$logDebug" -eq 0 ] && [ "$PT_LOG_LEVEL" = "DEBUG" ]) && return
([ "$logToJournal" -eq 1 ]) && writeJournalDLog "$@" && return
([ "$useJsonLogFmt" -eq 1 ]) && writeJsonLog "$@" && return
([ "$useSyslogLogFmt" -eq 1 ]) && writePlainTextLog "$@" && return
}
scriptExamples() {
newline
printf "Update Cloudflare DNS host A/AAAA records with current IP address.\n"
@@ -111,22 +219,31 @@ scriptExamples() {
textBlock "${magenta}--- usage examples ---${norm}"
newline
textBlockSwitches "${scriptName} -r myserver.mydomain.net"
textBlock "Update Cloudflare DNS records for myserver.mydomain.net with the auto-detected public IP4 address. Credentials will be expected in the default location and the log will be written in the default location also."
textBlock "Update Cloudflare DNS records for 'myserver.mydomain.net' with the auto-detected public IP4 address. Credentials will be expected in the default location. The log will be written to the default location in the default JSON format."
newline
textBlockSwitches "${scriptName} -r myserver.mydomain.net -6"
textBlock "Same as above, but update AAAA host records with the auto-detected public IP6 address."
newline
textBlockSwitches "${scriptName} -r myserver.mydomain.net,myserver2.mydomain.net -l /var/log/cfddns.log --nc"
textBlock "Update DNS entries for both listed hosts using auto-detected IP4 address. Write a non-coloured log to '/var/log/cfddns.log'."
textBlockSwitches "${scriptName} -r myserver.mydomain.net --fmt-syslog"
textBlock "Same as the first example, but the log file will be written in plain-text format instead of JSON."
newline
textBlockSwitches "${scriptName} -r myserver.mydomain.net,myserver2.mydomain.net -l /var/log/cfddns.log --ip6 --ip fd21:7a62:2737:9c3a::a151"
textBlock "Update DNS AAAA entries for listed hosts using the *specified* IP address. Write a colourful log to the location specified."
textBlockSwitches "${scriptName} -r myserver.mydomain.net --log-console --fmt-syslog"
textBlock "Same as the first example, but the log will be written to the console (stdout) in plain-text instead of a log file."
newline
textBlockSwitches "${scriptName} -r myserver.mydomain.net -c /root/cloudflare.creds -l /var/log/cfddns.log --ip 1.2.3.4"
textBlock "Update DNS A entry for listed hostname with the provided IP address. Read cloudflare credentials file from specified location, save log in specified location."
textBlockSwitches "${scriptName} -r myserver.mydomain.net --log-journal"
textBlock "Same as the first example, but the log will be written to the journal (journald) instead of a log file. A tag of 'CFDDNS' is automatically applied to make filtering easier."
newline
textBlockSwitches "${scriptName} -r myserver.mydomain.net -c /root/cloudflare.creds -l /var/log/cfddns.log -6 -i fd21:7a62:2737:9c3a::a151"
textBlock "Exact same as above, but change the AAAA record. This is how you run the script once for IP4 and again for IP6."
textBlockSwitches "${scriptName} -r myserver.mydomain.net,myserver2.mydomain.net --log-file /var/log/cfddns.log"
textBlock "Update DNS entries for both listed hosts using the auto-detected IP4 address. Write the log file to the specified location."
newline
textBlockSwitches "${scriptName} -r myserver.mydomain.net,myserver2.mydomain.net --log-file /var/log/cfddns.log --ip6 --ip fd21:7a62:2737:9c3a::a151"
textBlock "Update DNS AAAA entries for listed hosts using the *specified* IP address. Write the log to the location specified."
newline
textBlockSwitches "${scriptName} -r myserver.mydomain.net --ip 1.2.3.4 -c /root/cloudflare.creds --log-file /var/log/cfddns.log --fmt-syslog"
textBlock "Update DNS A entry for 'myserver.mydomain.net' with the *specified* IP address. Read the Cloudflare credentials file from the specified location. Save a plain-text (syslog-style) log in the specified location."
newline
textBlockSwitches "${scriptName} -r myserver.mydomain.net -6 -i fd21:7a62:2737:9c3a::a151 -c /root/cloudflare.creds --log-file /var/log/cfddns.log --fmt-syslog"
textBlock "Exact same as above, but change the AAAA record. This is an example of how you run the script once for IP4 and again for IP6."
exit 0
}
@@ -137,30 +254,42 @@ scriptHelp() {
textBlock "The only required parameter is '--records' which is a comma-delimited list of hostnames to update. However, there are several other options which may be useful to implement."
textBlock "Parameters are listed below and followed by a description of their effect. If a default value exists, it will be listed on the following line in (parentheses)."
newline
textBlock "${magenta}--- script related parameters ---${norm}"
textBlock "${magenta}--- script-related parameters ---${norm}"
newline
textBlockSwitches "-c | --cred | --creds | --credentials | -f (deprecated, backward-compatibility)"
textBlock "Path to file containing your Cloudflare *token* credentials. Please refer to the repo README for more information on format, etc."
textBlock "Path to the file containing your Cloudflare *token* credentials. Please refer to the repo README for more information on format, etc."
textBlockDefaults "(${accountFile})"
newline
textBlockSwitches "-l | --log"
textBlock "Path where the log file should be written."
textBlockSwitches "--log-file"
textBlock "Path where the log file should be written. Script will use file-based logging."
textBlockDefaults "(${logFile})"
newline
textBlockSwitches "--nc | --no-color | --no-colour"
textBlock "Switch value. Disables ANSI colours in the log. Useful if you review the logs using a reader that does not parse ANSI colour codes."
textBlockDefaults "(disabled: print logs in colour)"
newline
textBlockSwitches "--log-console"
textBlock "Switch value. Output log to console (stdout) instead of a log file. Can be combined with --nc if desired."
textBlockDefaults "(disabled: output to log file)"
textBlock "Switch value. Script will use console-based (stdout) logging."
textBlockDefaults "(disabled: use file-based logging)"
newline
textBlockSwitches "--no-log"
textBlock "Switch value. Do not create a log (i.e. no console, no file). You will not have *any* output from the script if you choose this option, so you will not know if updates succeeded or failed."
textBlockDefaults "(disabled: output to log file)"
textBlockSwitches "--log-journal"
textBlock "Switch value. Script will use journald-based logging."
textBlockDefaults "(disabled: use file-based logging)"
newline
textBlockSwitches "--log-none"
textBlock "Switch value. Script will not log anything. You will not have *any* output from the script if you choose this option, so you will not know if updates succeed or fail."
textBlockDefaults "(disabled: use file-based logging)"
newline
textBlockSwitches "--log-debug"
textBlock "Switch value. Log 'debug' level messages. This should normally remain disabled."
textBlockDefaults "(disabled: do not log 'debug' messages)"
newline
textBlockSwitches "--fmt-json"
textBlock "Switch value. Use JSON formatted key-value pair structured logging format. Best when using a log parsing tool or log management system to read your log files. Does not apply when using '--log-journal'."
textBlockDefaults "(enabled)"
newline
textBlockSwitches "--fmt-syslog"
textBlock "Switch value. Use a modified syslog (plain-text) format for log messages. Ideal when logging to the console. Does not apply when using '--log-journal'."
textBlockDefaults "(disabled: use structured JSON logging)"
newline
textBlockSwitches "-h | --help | -?"
textBlock "Display this help screen."
textBlock "Display this information screen."
newline
textBlockSwitches "--examples"
textBlock "Show some usage examples."
@@ -171,7 +300,7 @@ scriptHelp() {
textBlock "Comma-delimited list of hostnames for which IP addresses should be updated in Cloudflare DNS. This parameter is REQUIRED. Note that this script will only *update* records, it will not create new ones. If you supply hostnames that are not already defined in DNS, the script will log a warning and will skip those hostnames."
newline
textBlockSwitches "-i | --ip | --ip-address | -a | --address"
textBlock "New IP address for DNS host records. If you omit this, the script will attempt to auto-detect your public IP address and use that."
textBlock "New IP address for DNS host records. If you omit this, the script will attempt to auto-detect your public IP address and use that. N.B. IP addresses are *not* parsed for correctness."
newline
textBlockSwitches "-4 | --ip4 | --ipv4"
textBlock "Switch value. Update Host 'A' records (IP4) only. Note that this script can only update either A *or* AAAA records. If you need to update both, you'll have to run the script once in IP4 mode and again in IP6 mode. If you specify both this switch and the IP6 switch, the last one specified will take effect."
@@ -186,10 +315,6 @@ scriptHelp() {
exit 0
}
stamp() {
(date +%F" "%T)
}
newline() {
printf "\n"
}
@@ -206,60 +331,25 @@ textBlockSwitches() {
printf "%s%s%s\n" "$cyan" "$1" "$norm"
}
writeLog() {
case "$1" in
cf)
printf "[%s] CF-ERR: %s (code: %s)\n" "$(stamp)" "$2" "$3" >>"$logFile"
;;
err)
printf "%s[%s] ERR: %s%s\n" "$err" "$(stamp)" "$2" "$norm" >>"$logFile"
;;
error)
printf "%s[%s] ERROR: %s (code: %s)%s\n" "$err" "$(stamp)" "$2" "$3" "$norm" >>"$logFile"
;;
process)
printf "%s[%s] %s... %s" "$cyan" "$(stamp)" "$2" "$norm" >>"$logFile"
;;
process-done)
printf "%s%s%s\n" "$cyan" "$2" "$norm" >>"$logFile"
;;
process-error)
printf "%sERROR%s\n" "$err" "$norm" >>"$logFile"
;;
process-warning)
printf "%s%s%s\n" "$warn" "$2" "$norm" >>"$logFile"
;;
stamped)
printf "[%s] %s\n" "$(stamp)" "$2" >>"$logFile"
;;
success)
printf "%s[%s] SUCCESS: %s%s\n" "$ok" "$(stamp)" "$2" "$norm" >>"$logFile"
;;
warn)
printf "%s[%s] WARN: %s%s\n" "$warn" "$(stamp)" "$2" "$norm" >>"$logFile"
;;
warning)
printf "%s[%s] WARNING: %s%s\n" "$warn" "$(stamp)" "$2" "$norm" >>"$logFile"
;;
*)
printf "%s\n" "$2" >>"$logFile"
;;
esac
}
### default variable values
LOG_PROGRAM_NAME="CFDDNS"
scriptPath="$(CDPATH='' \cd -- "$(dirname -- "$0")" && pwd -P)"
scriptName="$(basename "$0")"
logFile="$scriptPath/${scriptName%.*}.log"
logToJournal=0
logToConsole=0
logToNone=0
logDebug=0
useJsonLogFmt=1
useSyslogLogFmt=0
accountFile="$scriptPath/cloudflare.credentials"
colourizeLogFile=1
dnsRecords=""
dnsSeparator=","
ipAddress=""
ip4=1
ip6=0
ip4DetectionSvc="http://ipv4.icanhazip.com"
ip6DetectionSvc="http://ipv6.icanhazip.com"
ip4DetectionSvc="https://ipv4.icanhazip.com"
ip6DetectionSvc="https://ipv6.icanhazip.com"
invalidDomainCount=0
failedHostCount=0
@@ -277,8 +367,8 @@ while [ $# -gt 0 ]; do
# display sample commands
scriptExamples
;;
-l | --log)
# set log file location
--log-file)
# use file-based logging at the specified location
if [ -n "$2" ]; then
logFile="${2%/}"
shift
@@ -287,19 +377,35 @@ while [ $# -gt 0 ]; do
fi
;;
--log-console)
# log to the console instead of a file
# use console-based logging
logFile="/dev/stdout"
logToConsole=1
;;
--no-log)
--log-journal)
# use journald-based logging
logToJournal=1
;;
--log-none)
# do not log anything
logFile="/dev/null"
logToNone=1
;;
--nc | --no-color | --no-colour)
# do not colourize log file
colourizeLogFile=0
--log-debug)
# log debugging messages
logDebug=1
;;
--fmt-json)
# use JSON log formatting
useJsonLogFmt=1
useSyslogLogFmt=0
;;
--fmt-syslog)
# use modified syslog plain-text log formatting
useSyslogLogFmt=1
useJsonLogFmt=0
;;
-c | --cred* | -f)
# path to Cloudflare credentials file
# path to the Cloudflare credentials file
if [ -n "$2" ]; then
if [ -f "$2" ] && [ -s "$2" ]; then
accountFile="${2%/}"
@@ -342,6 +448,8 @@ while [ $# -gt 0 ]; do
*)
printf "\n%sUnknown option: %s\n" "$err" "$1"
printf "%sUse '--help' for valid options.%s\n\n" "$cyan" "$norm"
([ "$logToConsole" -eq 0 ]) && writeLog \
"Unknown script parameter: '${1}'" "critical" "fail" "preexec" 1
exit 1
;;
esac
@@ -350,41 +458,36 @@ done
### pre-flight checks
if ! command -v curl >/dev/null; then
printf "\n%sThis script requires 'curl' be installed and accessible. Exiting.%s\n\n" "$err" "$norm"
printf "\n%sThis script requires that 'curl' is installed and accessible. Exiting.%s\n\n" "$err" "$norm"
([ "$logToConsole" -eq 0 ]) && writeLog "'curl' must be installed and accessible" "fatal" "fail" "preexec" 2
exit 2
fi
if ! command -v jq >/dev/null; then
printf "\n%sThis script requires 'jq' be installed and accessible. Exiting.%s\n\n" "$err" "$norm"
printf "\n%sThis script requires that 'jq' is installed and accessible. Exiting.%s\n\n" "$err" "$norm"
([ "$logToConsole" -eq 0 ]) && writeLog "'jq' must be installed and accessible" "fatal" "fail" "preexec" 2
exit 2
fi
[ -z "$dnsRecords" ] && badParam errMsg "You must specify at least one DNS record to update. Exiting."
# verify credentials file exists and is not empty (default check)
if [ ! -f "$accountFile" ] || [ ! -s "$accountFile" ]; then
badParam errMsg "Cannot find Cloudflare credentials file (${accountFile}). Exiting."
if [ -z "$dnsRecords" ]; then
badParam errMsg "You must specify at least one DNS record to update. Exiting."
fi
# turn off log file colourization if parameter is set
if [ "$colourizeLogFile" -eq 0 ]; then
bold=""
cyan=""
err=""
magenta=""
norm=""
ok=""
warn=""
yellow=""
# verify the credentials file exists and is not empty (default check)
if [ ! -f "$accountFile" ] || [ ! -s "$accountFile" ]; then
badParam errMsg "Cannot find the Cloudflare credentials file (${accountFile}) or it is empty. Exiting."
fi
if [ "$logToJournal" -eq 1 ] && ! command -v logger >/dev/null 2>&1; then
printf "\n%sThis script requires that 'logger' is installed to write journald entries. Exiting.%s\n\n" "$err" "$norm"
exit 2
fi
### initial log entries
{
printf "%s[%s] -- Cloudflare DDNS update-script: starting --%s\n" "$ok" "$(stamp)" "$norm"
printf "Parameters:\n"
printf "script path: %s\n" "$scriptPath/$scriptName"
printf "credentials file: %s\n" "$accountFile"
writeLog "starting '${scriptName}'" "info" "ok" "script"
writeLog "script path: ${scriptPath}/${scriptName}" "debug" "ok" "startup"
writeLog "credentials file: ${accountFile}" "debug" "ok" "startup"
if [ "$ip4" -eq 1 ]; then
printf "mode: IP4\n"
writeLog "mode: IPv4" "debug" "ok" "startup"
elif [ "$ip6" -eq 1 ]; then
printf "mode: IP6\n"
writeLog "mode: IPv6" "debug" "ok" "startup"
fi
# detect and report IP address
@@ -392,19 +495,21 @@ fi
# detect public ip address
if [ "$ip4" -eq 1 ]; then
if ! ipAddress="$(curl -s $ip4DetectionSvc)"; then
printf "ddns ip address:%s ERROR%s\n" "$err" "$norm"
exitError 10
writeLog \
"Unable to auto-detect this machine's public IP address; try again later or supply the IP address to be used" "err" "fail" "detectip" 10
exit 10
fi
fi
if [ "$ip6" -eq 1 ]; then
if ! ipAddress="$(curl -s $ip6DetectionSvc)"; then
printf "ddns ip address:%s ERROR%s\n" "$err" "$norm"
exitError 10
writeLog \
"Unable to auto-detect this machine's public IP address; try again later or supply the IP address to be used" "err" "fail" "detectip" 10
exit 10
fi
fi
printf "ddns ip address (detected): %s\n" "$ipAddress"
writeLog "DDNS IP address (detected): $ipAddress" "info" "ok" "startup"
else
printf "ddns ip address (supplied): %s\n" "$ipAddress"
writeLog "DDNS IP address (supplied): $ipAddress" "info" "ok" "startup"
fi
# iterate DNS records to update
@@ -413,15 +518,13 @@ fi
record="${dnsRecordsToUpdate%%${dnsSeparator}*}"
dnsRecordsToUpdate="${dnsRecordsToUpdate#*${dnsSeparator}}"
if [ -z "$record" ]; then continue; fi
printf "updating record: %s\n" "$record"
if [ -z "$record" ]; then
continue
fi
writeLog "DNS host record '${record}' queued for update" "info" "ok" "startup"
done
printf "(end of parameter list)\n"
} >>"$logFile"
### read Cloudflare credentials
writeLog process "Reading Cloudflare credentials"
case "$accountFile" in
/*)
# absolute path, use as-is
@@ -435,14 +538,14 @@ case "$accountFile" in
;;
esac
if [ -z "$cfKey" ]; then
writeLog process-error
exitError 21
writeLog "Cloudflare authorized API key (cfKey) is either null or undefined; please check your Cloudflare credentials file" "err" "fail" "creds" 21
exit 21
fi
if [ -z "$cfZoneId" ]; then
writeLog process-error
exitError 22
writeLog "Cloudflare zone id (cfZoneId) is either null or undefined; please check your Cloudflare credentials file" "err" "fail" "creds" 22
exit 22
fi
writeLog process-done "DONE"
writeLog "Cloudflare credentials file read successfully" "debug" "ok" "creds"
### connect to Cloudflare and do what needs to be done!
dnsRecordsToUpdate="$dnsRecords$dnsSeparator"
@@ -457,70 +560,69 @@ while [ -n "$dnsRecordsToUpdate" ] && [ "$dnsRecordsToUpdate" != "$dnsSeparator"
record="${dnsRecordsToUpdate%%${dnsSeparator}*}"
dnsRecordsToUpdate="${dnsRecordsToUpdate#*${dnsSeparator}}"
if [ -z "$record" ]; then continue; fi
writeLog process "Processing ${record}"
# exit if curl/network error
if ! cfLookup="$(curl -s -X GET "https://api.cloudflare.com/client/v4/zones/${cfZoneId}/dns_records?name=${record}&type=${recordType}" \
-H "Authorization: Bearer ${cfKey}" \
-H "Content-Type: application/json")"; then
writeLog process-error
exitError 3
if [ -z "$record" ]; then
continue
fi
# exit if API error
# exit here since API errors on GET request probably indicates authentication error which would affect all remaining operations
# no reason to continue processing other hosts and pile-up errors which might look like a DoS attempt
# exit if curl/network error
if ! cfLookup="$(
curl -s -X GET "https://api.cloudflare.com/client/v4/zones/${cfZoneId}/dns_records?name=${record}&type=${recordType}" \
-H "Authorization: Bearer ${cfKey}" \
-H "Content-Type: application/json"
)"; then
writeLog "Unable to connect to Cloudflare servers; please try again later." "err" "fail" "cflogin" 3
exit 3
fi
# an API error on this GET request likely indicates an authentication error that would affect all remaining operations
# no reason to continue processing other dns records and pile-up errors which might look like a DoS attempt
cfSuccess="$(printf "%s" "$cfLookup" | jq -r '.success')"
if [ "$cfSuccess" = "false" ]; then
writeLog process-error
listCFErrors "$cfLookup"
exitError 25
listCFErrors "$cfLookup" "cflogin"
writeLog "Cloudflare API error; review any previously logged 'CF-ERR:' lines for details." "err" "fail" "cflogin" 25
exit 25
fi
resultCount="$(printf "%s" "$cfLookup" | jq '.result_info.count')"
# skip to next host if cannot find existing host record (this script *updates* only, does not create!)
# skip to the next host if an existing host record cannot be found (this script *updates* only, does not create!)
if [ "$resultCount" = "0" ]; then
# warn if record of host not found
writeLog process-warning "NOT FOUND"
writeLog warn "Cannot find existing record to update for DNS entry: ${record}"
writeLog "Cannot find an existing record matching '${record}' to update" "warn" "warn" "ddns"
invalidDomainCount=$((invalidDomainCount + 1))
continue
fi
objectId=$(printf "%s" "$cfLookup" | jq -r '.result | .[] | .id')
currentIpAddr=$(printf "%s" "$cfLookup" | jq -r '.result | .[] | .content')
writeLog process-done "FOUND: IP = ${currentIpAddr}"
writeLog "The current IP address for '${record}' is ${currentIpAddr}" "debug" "ok" "ddns"
# skip to next hostname if record already up-to-date
# skip to next hostname if record already up to date
if [ "$currentIpAddr" = "$ipAddress" ]; then
writeLog stamped "IP address for ${record} is already up-to-date"
writeLog "The IP address for '${record}' is already up to date" "info" "ok" "ddns"
continue
fi
# update record
writeLog process "Updating IP address for ${record}"
updateJSON="$(jq -n --arg key0 content --arg value0 "${ipAddress}" '{($key0):$value0}')"
# exit if curl/network error
if ! cfResult="$(curl -s -X PATCH "https://api.cloudflare.com/client/v4/zones/${cfZoneId}/dns_records/${objectId}" \
if ! cfResult="$(
curl -s -X PATCH "https://api.cloudflare.com/client/v4/zones/${cfZoneId}/dns_records/${objectId}" \
-H "Authorization: Bearer ${cfKey}" \
-H "Content-Type: application/json" \
--data "${updateJSON}")"; then
writeLog process-error
exitError 3
--data "${updateJSON}"
)"; then
writeLog "Unable to connect to Cloudflare servers; please try again later." "err" "fail" "ddns" 3
exit 3
fi
# note update success or failure
cfSuccess="$(printf "%s" "$cfResult" | jq '.success')"
if [ "$cfSuccess" = "true" ]; then
writeLog process-done "DONE"
writeLog success "IP address for ${record} updated."
writeLog "The IP address for '${record}' successfully updated" "info" "success" "ddns"
else
writeLog process-error
listCFErrors "$cfResult"
writeLog err "Unable to update IP address for ${record}"
listCFErrors "$cfResult" "ddns"
writeLog "Unable to update the IP address for '${record}'" "err" "fail" "ddns"
# do not exit with error, API error here is probably an update issue specific to this host
# increment counter and note it after all processing finished
failedHostCount=$((failedHostCount + 1))
@@ -529,12 +631,14 @@ done
# exit
if [ "$invalidDomainCount" -ne 0 ]; then
writeLog warning "${invalidDomainCount} invalid host(s) supplied for updating."
writeLog "${invalidDomainCount} invalid host(s) were supplied for updating" "warn" "warn" "ddns"
fi
if [ "$failedHostCount" -ne 0 ]; then
exitError 26
writeLog \
"${failedHostCount} host update(s) failed; review 'CF-ERR:' lines in this log to help determine what may have gone wrong" "err" "fail" "ddns" 26
exit 26
else
exitOK
writeLog "${scriptName} completed successfully" "info" "ok" "script"
fi
### exit return codes
+133 -77
View File
@@ -1,50 +1,66 @@
# Using Logwatch to monitor Cloudflare DDNS updater script <!-- omit in toc -->
# Using Logwatch to monitor the Cloudflare DDNS updater script
The Cloudflare DDNS update script's log file has been set up so that utilities like Logwatch can easily parse it. In order to make that happen, a LogFile Group file, Service and Script have to be created for Logwatch to generate reports. The correct (general) directory structure has been created in this git archive already. Below are the details of each file.
The Cloudflare DDNS update script's log file has been set up so that utilities like Logwatch can easily parse it. To
make that happen, a LogFile Group file, Service and Script have to be created for Logwatch to generate reports.
The correct (general) directory structure has been created in this git archive already. Below are the details of each
file.
You can implement this setup easily by copying it into your */etc/logwatch* directory and then modifying the files as necessary:
You can implement this setup easily by copying it into your */etc/logwatch* directory and then modifying the files as
necessary:
```bash
cd /etc/logwatch
cp -R /path/to/CloudflareDDNS_repo/etc/logwatch/* ./
```
If you need help getting logwatch installed and set-up, please [check out my blog post](#https://mytechiethoughts.com/linux/easily-monitor-your-logs-using-logwatch/).
If you need help getting logwatch installed and set-up,
please [check out my blog post](#https://mytechiethoughts.com/linux/easily-monitor-your-logs-using-logwatch/).
## Contents <!-- omit in toc -->
> **IMPORTANT:** Starting with version 3.0 of the `cfddns` script, you *MUST* use the `--fmt-syslog` parameter when
> running the `cfddns` script. Otherwise, your log file will be in JSON format, and the supplied templates will not
> work.
<!-- toc -->
## Contents
- [LogFile Group file (/etc/logwatch/conf/logfiles/cfddns.conf)](#logfile-group-file-etclogwatchconflogfilescfddnsconf)
<!-- TOC -->
* [Using Logwatch to monitor the Cloudflare DDNS updater script](#using-logwatch-to-monitor-the-cloudflare-ddns-updater-script)
* [Contents](#contents)
* [LogFile Group file](#logfile-group-file)
* [Log file location](#log-file-location)
* [Archive location and name format](#archive-location-and-name-format)
* [External script for timestamp processing](#external-script-for-timestamp-processing)
- [Service definition file (/etc/logwatch/conf/services/cfddns.conf)](#service-definition-file-etclogwatchconfservicescfddnsconf)
* [Service definition file](#service-definition-file)
* [LogFile Group file definition](#logfile-group-file-definition)
* [Report title](#report-title)
* [Detail level](#detail-level)
- [Service script (/etc/logwatch/scripts/services/cfddns)](#service-script-etclogwatchscriptsservicescfddns)
* [Service script](#service-script)
* [Detail levels](#detail-levels)
- [Timestamp processing script (/etc/logwatch/scripts/shared/sqfullstampanywhere)](#timestamp-processing-script-etclogwatchscriptssharedsqfullstampanywhere)
* [Timestamp processing script](#timestamp-processing-script)
* [The time format specification](#the-time-format-specification)
* [The search REGEX](#the-search-regex)
- [Testing](#testing)
- [Final thoughts](#final-thoughts)
* [Testing](#testing)
* [Final thoughts](#final-thoughts)
<!-- tocstop -->
<!-- TOC -->
## LogFile Group file (/etc/logwatch/conf/logfiles/cfddns.conf)
## LogFile Group file
> This file is located within the repo at */etc/logwatch/conf/logfiles/cfddns.conf*
### Log file location
Update this as needed to point to the location and name of the log file generated by the updater script. Remember, by default, the log file is created in the same directory as the script itself.
Update this as needed to point to the location and name of the log file generated by the updater script. Remember, by
default, the log file is created in the same directory as the script itself.
```Ini
LogFile = /path/to/your/cfddns.log
...
```
Best practices suggest you use the `--log` flag to change this location to something like */var/log/cfddns.log*, for example. In that case, the entry would look like:
Best practices suggest you use the `--log-file` flag to change this location to something like */var/log/cfddns.log*,
for
example. In that case, the entry would look like:
```Ini
LogFile = /var/log/cfddns.log
@@ -53,7 +69,10 @@ LogFile = /var/log/cfddns.log
### Archive location and name format
If you want Logwatch to process old (archived) log files generated by something like *Logrotate*, then you have to specify the location and file name format of those files. I've included the generalized compressed format of such rotated files as the default in the script. Suppose you store your log files in the recommended location (*/var/log/*) and are using *Logrotate* with compression enabled, the archive line would look like:
If you want Logwatch to process old (archived) log files generated by something like *Logrotate*, then you have to
specify the location and file name format of those files. I've included the generalized compressed format of such
rotated files as the default in the script. Suppose you store your log files in the recommended location (*/var/log/*)
and are using *Logrotate* with compression enabled, the archive line would look like:
```Ini
...
@@ -61,29 +80,37 @@ Archive = /var/log/cfddns.log.?.gz
...
```
This would tell Logwatch, when the archive option is set to true, that your *cfddns.log* files are archived as: *cfddns.log.1.gz*, *cfddns.log.2.gz*, etc. and are all located in */var/log/*.
This would tell Logwatch, when the archive option is set to true, that your *cfddns.log* files are archived as:
*cfddns.log.1.gz*, *cfddns.log.2.gz*, etc. and are all located in */var/log/*.
> Note: This line is totally optional and only used if you set the archive option in Logwatch to true. You can comment/delete this line if you wish.
> Note: This line is totally optional and only used if you set the archive option in Logwatch to true. You can
> comment/delete this line if you wish.
### External script for timestamp processing
Since the log file uses a non-standard (according to Logwatch) method of date-stamping, a custom filter had to be created. See the [relevant](#timestamp-processing-script-etclogwatchscriptssharedsqfullstampanywhere) section of this document for more information.
Since the log file uses a non-standard (according to Logwatch) method of date-stamping, a custom filter had to be
created. See the [relevant](#timestamp-processing-script) section of this
document for more information.
The script file is called with an asterisk (*\**) before the filename.
The script file is called with an asterisk (*) before the filename.
```Ini
...
*sqFullStampAnywhere
*iso8601timestamp
...
```
If you change the name of this file, you will have to change this line. Remember that whatever you type here as a name is converted to all-lowercase so your filename should be all lowercase also.
If you change the name of this file, you will have to change this line. Remember that whatever you type here as a name
is converted to all-lowercase so your filename should be all lowercase also.
## Service definition file (/etc/logwatch/conf/services/cfddns.conf)
## Service definition file
> This file is located within the repo at */etc/logwatch/conf/services/cfddns.conf*
### LogFile Group file definition
The service file needs to know what group of log files it is responsible for processing. This MUST match the name of your *LogFile Group file*:
The service file needs to know what group of log files it is responsible for processing. This MUST match the name of
your *LogFile Group file*:
```Ini
LogFile = cfddns
@@ -94,15 +121,20 @@ If you change your LogFile Group filename, then update it here also without the
### Report title
The Logwatch output file (html or text) is divided into sections. You can define the title to be anything that has meaning for you. I have arbitrarily chosen *"CloudFlare DDNS update"* but you can change it to anything you want by modifying the line:
The Logwatch output file (HTML or text) is divided into sections. You can define the title to be anything that has
meaning for you. I have arbitrarily chosen *"CloudFlare DDNS update"* but you can change it to anything you want by
modifying the line:
```Ini
...
Title = "CloudFlare DDNS update"
```
### Detail level
If you want to set the *detail* level of this service differently from your other services (which will use the *--detail* switch value or the value in your *logwatch.conf*), then you can define that level here. By default, it appears like this in the service configuration file:
If you want to set the *detail* level of this service differently from your other services (which will use the
*--detail* switch value or the value in your *logwatch.conf*), then you can define that level here. By default, it
appears like this in the service configuration file:
```Ini
...
@@ -111,7 +143,8 @@ If you want to set the *detail* level of this service differently from your othe
# Detail = 0
```
Simply change it to the value you want enforced. For example, here I'm setting it to output level 5 regardless of whatever settings everything else is using.
Simply change it to the value you want enforced. For example, here I'm setting it to output level 5 regardless of
whatever settings everything else is using.
```Ini
# Override the detail level for this service
@@ -119,12 +152,17 @@ Simply change it to the value you want enforced. For example, here I'm setting
Detail = 5
```
## Service script (/etc/logwatch/scripts/services/cfddns)
## Service script
Logwatch calls any script with a name that **matches the service name**. You'll notice that I just named everything *cfddns* to keep things simple. You can change this to whatever you want. If you changed the service name to *"cloudflare*.conf", for example, you would have to rename this script file to "*cloudflare*" with no extension. Note: The script is a PERL file (note the
shebang) but it can be written in any language.
> This file is located within the repo at */etc/logwatch/scripts/services/cfddns*
In essence, Logwatch just spits out the log file(s) defined in the LogFile Group file as standard input (STDIN) for the script and then takes whatever is output (STDOUT) from the script to assemble into its report.
Logwatch calls any script with a name that **matches the service name**. You'll notice that I just named everything
*cfddns* to keep things simple. You can change this to whatever you want. If you changed the service name to
"*cloudflare*.conf", for example, you would have to rename this script file to "*cloudflare*" with no extension.
Note: The script is a PERL file (note the shebang), but it can be written in any language.
In essence, Logwatch just spits out the log file(s) defined in the LogFile Group file as standard input (STDIN) for the
script and then takes whatever is output (STDOUT) from the script to assemble into its report.
### Detail levels
@@ -133,50 +171,71 @@ The script supports four (4) detail levels as follows:
- **Level 0: Summary output only**
- This will display a simple aggregate of status message categories over the reporting period:
- Entries successfully updated
- Entries already up-to-date
- Entries already up to date
- Hosts failed to update
- Undefined hosts (i.e. requested to update but record doesnt exist)
- Total warning messages
- Total errors
- **This is the recommended reporting level.** It does not take up much space and is quick to read. If you see successful updates and/or up-to-date numbers match what you expect and no errors logged, then you can assume things are working properly. If the numbers arent right or you see errors/warnings, then you can investigate the situation by consulting the actual logs or increasing the detail level in logwatch.
- **This is the recommended reporting level.** It does not take up much space and is quick to read. If you see
successful updates and/or up-to-date numbers match what you expect and no errors logged, then you can assume
things are working properly. If the numbers arent right or you see errors/warnings, then you can investigate the
situation by consulting the actual logs or increasing the detail level in logwatch.
- For example: Lets suppose you are running an update every 15 minutes. Doing the math...
- For example, lets suppose you are running an update every 15 minutes. Doing the math...
$$
(update_{success}) + (update_{up-to-date}) = (24h \times 60min)/15min = 96
$$
Therefore, you expect to see Entries successfully updated and Entries already up-to-date total *96*. If thats the case and no errors or warnings are logged, things are ok. Pretty easy, right? Thats why this is the recommended filter setting.
Therefore, you expect to see Entries successfully updated and Entries already up to date total *96*. If thats
the case and no errors or warnings are logged, things are ok. Pretty easy, right? Thats why this is the
recommended filter setting.
- **Levels 1-4: Critical messages**
- This uses the data which is summarized by Level 0 but outputs the *actual messages* in the log file. For example, you will see the actual text of the errors logged instead of just a total number of errors. This level of reporting is useful when *initially* monitoring the script's operation since you can see the text of any generated errors.
- Levels 1, 2, 3 & 4 are identical so pick your favourite number.
- This uses the data which is summarized by Level 0 but outputs the *actual messages* in the log file. For example,
you will see the actual text of the errors logged instead of just a total number of errors. This level of
reporting is useful when *initially* monitoring the script's operation since you can see the text of any generated
errors.
- Levels 1, 2, 3 & 4 are identical, so pick your favourite number.
- **Level 5: Verbose output**
- Like the previous level, this outputs the actual messages found in the log file. However, it also includes *CF-ERR* tags and tally count messages. This can help you pinpoint why the Cloudflare API is rejecting your requests by letting you see things like authentication errors or malformed addresses, etc.
- Honestly, this is not much more information than L1-L4 and is often a better choice while debugging any issues since you get the Cloudflare API messages.
- This level of output is much more verbose than the summary report. It also takes *much* more time and patience to review so it is only recommended when youre dealing with issues.
- Like the previous level, this outputs the actual messages found in the log file. However, it also includes
*CF-ERR* tags and tally count messages. This can help you pinpoint why the Cloudflare API is rejecting your
requests by letting you see things like authentication errors or malformed addresses, etc.
- Honestly, this is not much more information than L1-L4 and is often a better choice while debugging any issues
since you get the Cloudflare API messages.
- This level of output is much more verbose than the summary report. It also takes *much* more time and patience to
review, so it is only recommended when youre dealing with issues.
- This is *not* recommended for day-to-day or routine reports.
- **Levels 6+: Complete log file dump**
- Any number greater than 5 passed as a detail level will trigger the script to dump the entire log file out to Logwatch line-by-line. This is really only useful during debugging or dealing with serious issues where you do not have access to the actual log file. While this is an exact echo of the log file, it likely will not be colour-coded which makes it harder to review.
- Any number greater than 5 passed as a detail level will trigger the script to dump the entire log file out to
Logwatch line-by-line. This is really only useful during debugging or dealing with serious issues where you do not
have access to the actual log file.
- **Use this detail level only when you need to see the entire log file and cannot otherwise access the log file.**
- Depending on how your logwatch treats this log dump, you may see gibberish control codes like *\e[0m;]*. If this is the case, run the script with the `--no-colour` or `--nc` option to remove ANSI colour formatting.
## Timestamp processing script (/etc/logwatch/scripts/shared/sqfullstampanywhere)
## Timestamp processing script
This is basically a modified version of the '*applyeurodate*' script that comes with Logwatch. It had to be modified to search within [square brackets] and to accept characters coming before the stamp (i.e. ANSI colour codes). If you change the '**stamp**' variable in the updater script to update the timestamp to your liking (which to totally fine!) then you'll probably have to update this file. There are two lines you need to modify to suit your new '**stamp**' variable.
> This file is located within the repo at */etc/logwatch/scripts/shared/iso8601timestamp*
> This entire section is only applicable if you are a very curious person or if you change the hard-coded stamp function in the script. If you did not make any changes and you like a little mystery in your life, you can safely skip this entire section.
This is a modified version of the '*applyeurodate*' script that comes with Logwatch. If you change
the '**stamp**' variable in the `cfddns` script to modify the timestamp to your liking (which is totally fine!) then
you'll probably have to update this file. There are two lines you need to modify to suit your new '**stamp**' variable.
> This entire section is only applicable if you are an inquisitive person or if you change the hard-coded stamp
> function in the script. If you did not make any changes and you like a little mystery in your life, you can safely
> skip this entire section.
### The time format specification
'*$SearchDate*' is the variable used in the PERL script to do exactly what it says, search for the date stamp. I have it set up to look for the format '*year-month-date hour:minute:second*'. Note, we don't care about brackets or anything here, we're just defining the format of the date/time stamp.
'*$SearchDate*' is the variable used in the PERL script to do exactly what it says, search for the date stamp. I have it
set up to look for the format '*year-month-dateThour:minute:secondZ*', which is the ISO-8601 format.
```Perl
...
$SearchDate = TimeFilter('%Y-%m-%d %H:%M:%S');
$SearchDate = TimeFilter('%Y-%m-%dT%H:%M:%SZ');
...
```
If you changed the '**stamp**' variable so it was formatted as '*month/day/year hour:minute*' (ex: '*[09/27/2018 18:38]*') then you'd update the **$SearchDate** variable as follows (note: no mention of the square brackets!):
If you changed the '**stamp**' variable so it was formatted as '*month/day/year hour:minute*'
(ex: '*09/27/2018 18:38*') then you'd update the **$SearchDate** variable as follows:
```Perl
...
@@ -186,31 +245,8 @@ $SearchDate = TimeFilter('%m/%d/%Y %H:%M');
### The search REGEX
The PERL script uses a '*regular expression*' (REGEX) to search within the log file for '*$SearchDate*'. For the default date stamp, this specification looks like:
```Perl
...
if ($ThisLine =~ m/\[$SearchDate\] /o) {
...
```
The REGEX appears between '*m/*' and '*/o*'. In this case, it searches for '*$SearchDate*' inside [square brackets] appearing anywhere on the line. This is because ANSI colour-codes often appear before the date stamp in the default log file. If you have modified this so that your date stamp appears at the beginning of the line and in the example format in the section above (using slashes instead of dashes) then you'd rewrite this REGEX as follows:
```Perl
...
if ($ThisLine =~ m/^\[$SearchDate\] /o) {
...
```
or using regular brackets anywhere on the line:
```Perl
...
if ($ThisLine =~ m/\($SearchDate\) /o) {
...
```
or without any brackets but appearing at the beginning of the line:
The PERL script uses a '*regular expression*' (REGEX) to search within the log file for '*$SearchDate*'. For the default
date stamp, this specification looks like:
```Perl
...
@@ -218,12 +254,30 @@ if ($ThisLine =~ m/^$SearchDate /o) {
...
```
The REGEX appears between '*m/*' and '*/o*'. In this case, it searches for '*$SearchDate*' appearing at the
beginning (^) of the line. If you want to search anywhere in the line instead of the beginning, remove the caret (^):
```Perl
...
if ($ThisLine =~ m/$SearchDate /o) {
...
```
or maybe you changed the date stamp to appear in square brackets at the start of the line:
```Perl
...
if ($ThisLine =~ m/^\[$SearchDate\] /o) {
...
```
## Testing
Run *logwatch --help* and note the options. You can test just this service locally on your screen with the following command (assuming you kept default names for everything):
Run *logwatch --help* and note the options. You can test just this service locally on your screen with the following
command (assuming you kept default names for everything):
```Bash
# Summary output, entire duration of log file
# Summary output, entire duration of the log file
logwatch --service cfddns --output stdout --format text --range all --detail 0
# Minimal detail, yesterday only
@@ -235,4 +289,6 @@ logwatch --service cfddns --output stdout --format text --range today --detail 5
## Final thoughts
That's it! I'm a horrible PERL programmer so if anyone can optimize/improve the script file used for Logwatch then please do it! Otherwise, I hope this made sense and helped you integrate the updater script with Logwatch for easy monitoring :-)
That's it! I'm a horrible PERL programmer, so if anyone can optimize/improve the script file used for Logwatch, then
please do it! Otherwise, I hope this made sense and helped you integrate the updater script with Logwatch for easy
monitoring :-)
+1 -1
View File
@@ -10,4 +10,4 @@ Archive = /path/to/your/logfile.ext.?.gz
# You don't need to change this unless you have altered the 'stamp' variable in
# the script in which case you will want to update the regex in the custom pl
# script below
*sqFullStampAnywhere
*iso8601timestamp
+16 -22
View File
@@ -4,7 +4,7 @@
# $Id$
#############################################################################
# Log: CloudFlare updater script (cfddns)
# Revision 2.1 2021/05/08
# Revision 3.0 2026/07/25
# Written by Asif Bacchus
#############################################################################
@@ -31,22 +31,22 @@ my $key;
if ($detailLevel == 0) {
### process logfile and summarize message types
while (defined(my $ThisLine = <STDIN>)) {
if ($ThisLine =~ /ERR: Unable to update IP address/) {
if ($ThisLine =~ /[FAIL] Unable to update the IP address for/) {
$summaryFailedUpdate++;
}
elsif ($ThisLine =~ /ERROR: /) {
elsif ($ThisLine =~ /[FAIL] /) {
$summaryErr++;
}
elsif ($ThisLine =~ /WARN: Cannot find existing record/) {
elsif ($ThisLine =~ /[WARN] Cannot find an existing record matching/) {
$summaryInvalidHost++;
}
elsif ($ThisLine =~ /WARNING: /){
elsif ($ThisLine =~ /[WARN] /){
$summaryWarning++;
}
elsif ($ThisLine =~ /SUCCESS: /) {
elsif ($ThisLine =~ /[SUCCESS] /) {
$summaryUpdated++;
}
elsif ($ThisLine =~ /already up-to-date/) {
elsif ($ThisLine =~ /already up to date/) {
$summaryUpToDate++;
}
}
@@ -56,7 +56,7 @@ if ($detailLevel == 0) {
$reportHash{"Entries successfully updated"} = $summaryUpdated;
}
if ($summaryUpToDate > 0) {
$reportHash{"Entries already up-to-date"} = $summaryUpToDate;
$reportHash{"Entries already up to date"} = $summaryUpToDate;
}
if ($summaryFailedUpdate > 0) {
$reportHash{"Hosts failed to update"} = $summaryFailedUpdate;
@@ -80,16 +80,16 @@ if ($detailLevel == 0) {
### a summary count
elsif ($detailLevel >= 1 && $detailLevel <= 4) {
while (defined(my $ThisLine = <STDIN>)) {
if ($ThisLine =~ /ERR: /) {
if ($ThisLine =~ /[ERR] /) {
print $ThisLine;
}
elsif ($ThisLine =~ /WARN: /) {
elsif ($ThisLine =~ /[WARN] /) {
print $ThisLine;
}
elsif ($ThisLine =~ /SUCCESS: /) {
elsif ($ThisLine =~ /[SUCCESS] /) {
print $ThisLine;
}
elsif ($ThisLine =~ /already up-to-date/) {
elsif ($ThisLine =~ /already up to date/) {
print $ThisLine;
}
}
@@ -98,25 +98,19 @@ elsif ($detailLevel >= 1 && $detailLevel <= 4) {
### debugging messages
elsif ($detailLevel == 5) {
while (defined(my $ThisLine = <STDIN>)) {
if ($ThisLine =~ /ERR: /) {
print $ThisLine;
}
elsif ($ThisLine =~ /ERROR: /) {
if ($ThisLine =~ /[ERR] /) {
print $ThisLine;
}
elsif ($ThisLine =~ /CF-ERR: /) {
print $ThisLine;
}
elsif ($ThisLine =~ /WARN: /) {
elsif ($ThisLine =~ /[WARN] /) {
print $ThisLine;
}
elsif ($ThisLine =~ /WARNING: /) {
elsif ($ThisLine =~ /[SUCCESS] /) {
print $ThisLine;
}
elsif ($ThisLine =~ /SUCCESS: /) {
print $ThisLine;
}
elsif ($ThisLine =~ /already up-to-date/) {
elsif ($ThisLine =~ /already up to date/) {
print $ThisLine;
}
}
@@ -5,9 +5,8 @@
##########################################################################
###############################################################################
## Filter dates in full-date-time international format, surrounded by square
## brackets located anywhere on a given line
## Format: '[%Y-%m-%d %H:%M:%S]'
## Filter dates in ISO-8601 format located at the start of a given line
## Format: '%Y-%m-%dT%H:%M:%SZ'
###############################################################################
use Logwatch ':dates';
@@ -15,7 +14,7 @@ use Logwatch ':dates';
my $Debug = $ENV{'LOGWATCH_DEBUG'} || 0;
### Specify the format of the date/time stamp itself
$SearchDate = TimeFilter('%Y-%m-%d %H:%M:%S');
$SearchDate = TimeFilter('%Y-%m-%dT%H:%M:%SZ');
if ( $Debug > 5 ) {
print STDERR "DEBUG: Inside FullDateTime...\n";
@@ -24,7 +23,7 @@ if ( $Debug > 5 ) {
while (defined($ThisLine = <STDIN>)) {
### specify the regex that defines how to find 'SearchDate'
if ($ThisLine =~ m/\[$SearchDate\] /o) {
if ($ThisLine =~ m/^$SearchDate /o) {
print $ThisLine;
}
}