<html>
<head>
<base href="https://bugs.freedesktop.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - RFE: journald to send logs via network"
href="https://bugs.freedesktop.org/show_bug.cgi?id=77013">77013</a>
</td>
</tr>
<tr>
<th>Assignee</th>
<td>systemd-bugs@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Summary</th>
<td>RFE: journald to send logs via network
</td>
</tr>
<tr>
<th>QA Contact</th>
<td>systemd-bugs@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Reporter</th>
<td>duncan@innes.net
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Other
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Component</th>
<td>general
</td>
</tr>
<tr>
<th>Product</th>
<td>systemd
</td>
</tr></table>
<p>
<div>
<pre>Functionality that exists in rsyslogd to send logs to remote locations on the
network should be replicated in jornald.
This would avoid the requirement for external programs shipping journalctl
entries.
The option to transmit data over encrypted connections would be beneficial.
The option to transmit data as JSON would also be beneficial.
The ability to add custom tags to JSON output would assist larger
organisations.
Use case:
It's hard to think of an organisation that doesn't consolidate it's logs in
some way on a centralised system. Whilst there may be external processes (e.g.
rsyslog) that can fill this gap, a native feed from journald would be the
cleanest method from the end-user perspective.
Encrypted transmission would satisfy the security aspect of the transmission.
The ability to transmit as JSON would fit in with the way that many centralised
log storage mechanisms are going (especially the open source ones).
The ability to insert custom tags & data to JSON would allow larger
organisations to group data by system type without having to parse data and
amend it before inserting it into the database of choice. (e.g. all clustered
servers could add a "cluster_name": "$CLUSTER_NAME" field to allow logs to be
viewed by cluster rather than individual hosts.) Some of this can be done by
tasks/filters on the central system, but the ability for clients to add custom
tags reduces the overall load & complexity of the system.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>