Re: [logs] Syslog payload format

From: Darren Reed (avalonat_private)
Date: Thu Dec 19 2002 - 07:45:45 PST

  • Next message: Chris Calabrese: "Re: [logs] Syslog payload format"

    In some mail from marc, sie said:
    > 
    > > Right now, I can do:
    > > 
    > > syslog(LOG_DAEMON|LOG_DEBUG, "debug: marcus login from %s", where);
    > > 
    > > How many lines of code is your library going to take and what
    > > benefit do they give me in this situation ?
    > 
    > I think we had this discussion before, and I suggested a
    > variadic interface. Like this:
    > 
    >   idsa_set(c,"debug","syslog",0,IDSA_R_NONE,IDSA_R_NONE,IDSA_R_NONE,
    >   "event",IDSA_T_STRING,"marcus login","from",IDSA_T_HOST,where,NULL);
    > 
    > which is about as compact as it gets without losing structure information.
    
    That's mamothly complex!
    
    > I'd be interested in knowing if there is a way which makes fewer
    > demands of an application programmer.
    
    Well, I suspect not :0
    
    The object should be to make using the complex logging much more sexy
    for serious logging (not the trivial stuff you do when developing) so
    that more people make better use of it.
    
    I suppose I should put forward how I think it should work :)
    
    My thinking (to date) has been along the lines of doing something
    like is done with writev() - ie.
    
    initlogging(name,options);
    logitems[0].type = STRING;
    logitems[0].value = "marcus login: from";
    logitems[1].type = HOSTNAME;
    logitems[1].value = where;
    addlogmessage(logtype,priority,logitems,2);
    
    Maybe this is good, maybe it's bad, but it gets away from
    varargs and is hopefully clear about relationship between type and
    object data.  It also has scope for holding more complex information
    for logging and that may be something that comes through in the XML
    which isn't possible with the above.
    e.g.
    
    char *fruit[5] = {"a", "b", c", "d", "e"};
    logitems[0].type = STRINGARRAY;
    logitems[0].count = 5;
    logitems[0].value = fruit;
    
    Personally, I hate the idea of having to program like this but nor
    does the idsa interface seem really attractive to me.
    
    Darren
    _______________________________________________
    LogAnalysis mailing list
    LogAnalysisat_private
    http://lists.shmoo.com/mailman/listinfo/loganalysis
    



    This archive was generated by hypermail 2b30 : Thu Dec 19 2002 - 19:28:09 PST