Re: [logs] Syslog payload format

From: wolfgangat_private
Date: Fri Dec 20 2002 - 04:14:05 PST

  • Next message: Rainer Gerhards: "RE: [logs] Syslog payload format"

    Darren Reed wrote:
    > In some mail from Marcus J. Ranum, sie said:
    > [...]
    > > so how about an event logging API that vaguely resembles
    > > something like:
    
    > The biggest problem any change is going to have is dealing with
    > convincing programmers that the extra effort is worthwhile.
    
    > Right now, I can do:
    
    > syslog(LOG_DAEMON|LOG_DEBUG, "debug: marcus login from %s", where);
    
    If we think of a small, easy, painless minimalistic solution for getting
    a limited amount of semantics into the logging process, how about replacing
    the call above with something like
    
    xnewsyslog(LOG_DAEMON|LOG_DEBUG, "debug: %u %t from %h",
      "marcus", "login", where);
    
    We could define a small number of tags like %u for a user id, %t for an
    event type and %h for a host id. If our "logging backend" is a new logging
    system, it could keep that information e.g. by tagging the log message
    components and if we have "classic syslog" we just treat them like %s.
    
    -- 
    Wolfgang Zenker                                  Mail: W.Zenkerat_private
    JPAVES Unix Online GmbH                          Fon:  (+49) 721 / 955 40 60
    Kaiserallee 87                                   Fax:  (+49) 721 / 955 40 62
    D-76185 Karlsruhe                                Web:  www.jpaves.com
    _______________________________________________
    LogAnalysis mailing list
    LogAnalysisat_private
    http://lists.shmoo.com/mailman/listinfo/loganalysis
    



    This archive was generated by hypermail 2b30 : Fri Dec 20 2002 - 20:07:10 PST