Re: [logs] Syslog payload format

avalonat_private

In some mail from marc, sie said:
> 
> > Right now, I can do:
> > 
> > syslog(LOG_DAEMON|LOG_DEBUG, "debug: marcus login from %s", where);
> > 
> > How many lines of code is your library going to take and what
> > benefit do they give me in this situation ?
> 
> I think we had this discussion before, and I suggested a
> variadic interface. Like this:
> 
>   idsa_set(c,"debug","syslog",0,IDSA_R_NONE,IDSA_R_NONE,IDSA_R_NONE,
>   "event",IDSA_T_STRING,"marcus login","from",IDSA_T_HOST,where,NULL);
> 
> which is about as compact as it gets without losing structure information.

That's mamothly complex!

> I'd be interested in knowing if there is a way which makes fewer
> demands of an application programmer.

Well, I suspect not :0

The object should be to make using the complex logging much more sexy
for serious logging (not the trivial stuff you do when developing) so
that more people make better use of it.

I suppose I should put forward how I think it should work :)

My thinking (to date) has been along the lines of doing something
like is done with writev() - ie.

initlogging(name,options);
logitems[0].type = STRING;
logitems[0].value = "marcus login: from";
logitems[1].type = HOSTNAME;
logitems[1].value = where;
addlogmessage(logtype,priority,logitems,2);

Maybe this is good, maybe it's bad, but it gets away from
varargs and is hopefully clear about relationship between type and
object data.  It also has scope for holding more complex information
for logging and that may be something that comes through in the XML
which isn't possible with the above.
e.g.

char *fruit[5] = {"a", "b", c", "d", "e"};
logitems[0].type = STRINGARRAY;
logitems[0].count = 5;
logitems[0].value = fruit;

Personally, I hate the idea of having to program like this but nor
does the idsa interface seem really attractive to me.

Darren
_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
http://lists.shmoo.com/mailman/listinfo/loganalysis