On Wednesday, August 21, 2002, at 12:09 , Greg Black wrote: > Chris Adams wrote: > | No matter what format we use, what we really need is application > | support - in particular, some sort of transparent replacement for > syslog > | and some free logging modules for the popular languages which make it > | very easy for programmers to give sysadmins the sort of verbose log > | entries we need to solve problems. > > If it were only that simple -- many of the logs that we need to > take into consideration are generated by our OS or by utilities > that come with the OS and most of those use syslog and have > their traditional log message formats which won't be changed in > any kind of hurry. Whatever we do just has to take those logs > into consideration because we need to be able to make use of the > information they contain -- even if we do manage to persuade the > application authors to move to a new wonderful way of logging. That was what I meant by "transparent replacement for syslog": A syslogd (or asynchronous output reformatter) which could translate into the new format would cover a lot of ground. This could be fairly straight-forward if someone's existing log parsing code can be reused. Specialized reformatting modules for Apache would be fairly easy, particularly since Apache allows you to specify its log output format. The other thing which would be nice would be a replacement for syslog(3) and friends which can natively generate the new format. This could be kludged using something like LD_PRELOAD until support hit the system libraries. Chris _______________________________________________ LogAnalysis mailing list LogAnalysisat_private https://lists.shmoo.com/mailman/listinfo/loganalysis
This archive was generated by hypermail 2b30 : Wed Aug 21 2002 - 15:16:25 PDT