Re: [logs] Syslog payload format

Previous message: Marcus J. Ranum: "Re: [logs] Syslog payload format"
In reply to: Balazs Scheidler: "Re: [logs] Syslog payload format"
Next in thread: Tina Bird: "Re: [logs] Syslog payload format"
Next in thread: Marcus J. Ranum: "Re: [logs] Syslog payload format"
Reply: Tina Bird: "Re: [logs] Syslog payload format"
Reply: Balazs Scheidler: "Re: [logs] Syslog payload format"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

mjrat_private

Balazs Scheidler wrote:
>xnewsyslog(LOG_DAEMON | LOG_INFO, 
>           "User logged in", 
>           "%(user)s %(tty)s %(host)s",
>           "marcus", "ttyp6", host);

This is horrible. You're basically doing the same thing as
"old" syslog: you're sticking arbitrary strings out there with
no mark-up regarding their semantics.

Right now the assembled log-weenies of the world are fighting
a battle (that is about to become hugely expensive) to apply
significance (i.e.: semantic value) to log data. Continuing to
encourage client-side APIs that are devoid of additional
semantic data is not helping anything. We may as well stick
with stupid old syslog (but fix the transports) and call it sucky
enough.

mjr. 
---
Marcus J. Ranum				http://www.ranum.com
Computer and Communications Security	mjrat_private

_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
http://lists.shmoo.com/mailman/listinfo/loganalysis