[systemd-devel] systemd-logger and external syslog daemon

[Andrey Borzenkov]

On Fri, Mar 11, 2011 at 10:03 AM, Michael Biebl <mbiebl at gmail.com> wrote:
> For me the log messages actually look slightly different, as I also
> get the kernel timestamp and I also noticed a different problem:
>
> Mar 11 07:56:27 pluto kernel: imklog 5.7.8, log source = /proc/kmsg started.
> Mar 11 07:56:27 pluto rsyslogd: [origin software="rsyslogd"
> swVersion="5.7.8" x-pid="25093" x-info="http://www.rsyslog.com"] start
> Mar 11 07:56:27 pluto kernel: [ 5913.491848] michael[24089]: foo
> Mar 11 07:56:27 pluto kernel: [ 5918.029738] michael[24911]: bar
> Mar 11 07:56:27 pluto kernel: [ 5921.140864] michael[25078]: baz
>
> As you can see, when rsyslog starts up and flushes the kmsg queue, the
> log messages all have the same timestamp (Mar 11 07:56:27) and they
> come after the rsyslog startup message, although they were logged
> before the  rsyslog start.

But that was the case for as long as I remember. It is not systemd
specific in any way.

> Lennart argues, that this should be handles within the syslogd (in
> this case rsyslog 5.7.8), which should use the kernel time stamp to
> compute the correct time when the log message occurred.
>

Sounds quite reasonable :)

What would be also really nice - some systemd specific marker so
rsyslog could extract syslogd messages from kmsg. Not sure if it is
really doable without some gross kernel hack though.

Special severity level may be ... PRINTK_SYSTEMD? :)