[logs] liblog 0.1 available

krhat_private

Well, it seems that I've been beaten in the rush to get a next generation
syslog library out the door, but I'm not too far behind.  :)

Announcing liblog 0.1, a replacement for the standard Unix syslog(3) call and
its friends.  Excerpted from the readme:

-----
liblog is meant to be a replacement for the standard Unix syslog(3) call and
its friends. liblog provides structure to syslog messages. This makes them
easy to generate and easy to parse. For example, this is a real message
generated using liblog:

Jan 6 21:23:29 gauss TIME="2003-01-06T21:23:29.308134-08:00" FAC="mail"
LOG_PROG="master" LOG_PID="31867" LOG_UID="0" LOG_GID="0" PRI="6" FAC="mail"
LOG_TAG="postfix/master" MSG="daemon started"

The tags tell you that this message was sent at 21:23:29.308134 PST on January
6, 2003, to the "mail" facility by the program named "master" which had
process ID 18079, user ID 0, and group ID 0. The priority of the message was
6, which means that the message is informational. The program identifies
itself as "postfix/master", and the message it's giving you is "daemon
started".

Generating a well-formatted tag like this is very easy; in fact, this message
was generated without any changes whatsoever to Postfix. liblog replaces the
classical syslog suite with functions that help format your message for you
before they send it along in liblog's tagged format. In addition, liblog
provides its own suite of calls to help you generated well-tagged messages
with more structure than the classical syslog(3) call.

liblog is distributed under a BSD license[*]. The BSD license allows free use
and redistribution of liblog in any sort of program whatsoever. This means
that you are free to incorporate it into your own products if you so like, no
matter what those products are.

[*] Strictly speaking, a revised BSD license. liblog does not include the
advertising clause. 
-----

liblog-0.1 is currently available at:

http://darkstar.ucsd.edu/~krh/liblog/liblog-0.1.tar.gz

liblog is known to work on Redhat Linux 6.2 and OpenBSD 3.2, and it should
work on other platforms as well.  See the file INSTALL for directions.

While I'm talking, I may as well show off liblog's API.  This is a complete
program that demonstrates every function in liblog's API:

-----
#include <stdio.h>
#include <syslog.h>

#define BIG     1000

int
main(int argc, char *argv[])
{
        syslog_t        *one;
        syslog_t        *two;
        syslog_msg_t    *first_msg;
        syslog_msg_t    *second_msg;
        char    name[BIG];
        char    data[BIG];

        syslog_new(0);
        one = syslog_new_r(0);
        two = syslog_new_r(LOG_PERROR);

        syslog_stat(LOG_NDELAY);
        syslog_stat_r(one, LOG_CONS);

        syslog_tag("CHANNEL", "default", strlen("default"));
        syslog_tag_r(one, "CHANNEL", "one", strlen("one"));
        syslog_tag_r(two, "CHANNEL", "two", strlen("two"));

        first_msg = syslog_msg_new();

        fgets(name, BIG, stdin);
        fgets(data, BIG, stdin);

        name[strlen(name) - 1] = '\0';  /* Remove the trailing newline */

        /* strlen(data) - 1 is the length of the data without the trailing
         * newline.  It is safe only because fgets always returns a string.
         */
        syslog_msg_tag(first_msg, name, data, strlen(data) - 1);

        syslog_msg_send(first_msg);
        syslog_msg_send_r(one, first_msg);
        syslog_msg_send_r(two, first_msg);

        second_msg = syslog_msg_dup(first_msg);

        /* Priority six is informational */
        syslog_msg_tag(second_msg, "PRI", "6", 1);

        syslog_msg_send(second_msg);
        syslog_msg_send_r(one, second_msg);
        syslog_msg_send_r(two, second_msg);

        syslog_msg_untag(second_msg, name);

        syslog_msg_send(second_msg);
        syslog_msg_send_r(one, second_msg);
        syslog_msg_send_r(two, second_msg);

        syslog_untag("CHANNEL");
        syslog_untag_r(one, "CHANNEL");

        syslog_msg_send(second_msg);
        syslog_msg_send_r(one, second_msg);
        syslog_msg_send_r(two, second_msg);

        syslog_finish();
        syslog_finish_r(one);
        syslog_finish_r(two);

        return 0;
}
-----

(And regarding the version number, it'll stay below one until I feel like it
deserves otherwise.  Right now it does not.  (And if you read that syslog
message in the README really closely, you might be able to figure out why.
(See also the file BUGS.)))

-- 
Kyle R. Hofmann <krhat_private>
_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
http://lists.shmoo.com/mailman/listinfo/loganalysis