[systemd-devel] Linux Journal API/client lib

[Rainer Gerhards]

On Fri, Dec 2, 2011 at 6:59 PM, Kay Sievers <kay.sievers at vrfy.org> wrote:
> On Fri, Dec 2, 2011 at 17:02, Rainer Gerhards <rgerhards at gmail.com> wrote:
>> On Fri, Dec 2, 2011 at 4:39 PM, Kay Sievers <kay.sievers at vrfy.org> wrote:
>
>>> /dev/log will be read by journald. The syslog.socket filedescriptor
>>> that the syslog daemon receives, will be provided by journald and have
>>> all the messages which are received by /dev/log and the human readable
>>> part that is received over the native journal interface.
>>
>> This excludes the metadata, right? I'd say you should reconsider this,
>> probably as a config option (metadata is especially useful if
>> developers use the new capabilities and do not provide any
>> human-readable form, or at least with partial info only in the human
>> readable form).
>>
>> I guess if this is provided, there would hardly be a need for syslogd
>> to pull the information from the journal.
>
> Well, if syslogd, or any other consumer, is interested in the
> metadata, it should not rely in /dev/log. /dev/log will probably stay
> what it is which is mostly plain old syslog with a header and a
> timestamp and the human readable string. All stuff that wants the
> metadata should use the proper API and get the records from there. The
> '/dev/log proxy' is just to ensure full syslogd compatibility, not to
> provide any new data which do not really fit into the plaintext file
> format.

Why are you making it deliberately hard to interoperate? If you
already supply the event you gather via the log socket, why not
provide the complete set of information (probably as an opt-in
feature)? That way the syslogd would not need a specific input
capability (input module in rsyslog terms) to capture the log data.
Things could just remain as is. What you call the "plaintext file
format" issue is being solved anyhow in the meantime. Look at RFC5424
or CEE. So how to encode the fields is actually not a question at all.
If you provide proper formatting, the syslogd would not even need to
be aware of what's going on... (at least for CEE, rsyslog also has a
parser for structured data in legacy syslog, but that's non-standard).

Rainer