[systemd-devel] systemd-logger and external syslog daemon

[Lennart Poettering]

On Fri, 11.03.11 10:37, Andrey Borzenkov (arvidjaar at mail.ru) wrote:

> 
> On Fri, Mar 11, 2011 at 10:03 AM, Michael Biebl <mbiebl at gmail.com> wrote:
> > For me the log messages actually look slightly different, as I also
> > get the kernel timestamp and I also noticed a different problem:
> >
> > Mar 11 07:56:27 pluto kernel: imklog 5.7.8, log source = /proc/kmsg started.
> > Mar 11 07:56:27 pluto rsyslogd: [origin software="rsyslogd"
> > swVersion="5.7.8" x-pid="25093" x-info="http://www.rsyslog.com"] start
> > Mar 11 07:56:27 pluto kernel: [ 5913.491848] michael[24089]: foo
> > Mar 11 07:56:27 pluto kernel: [ 5918.029738] michael[24911]: bar
> > Mar 11 07:56:27 pluto kernel: [ 5921.140864] michael[25078]: baz
> >
> > As you can see, when rsyslog starts up and flushes the kmsg queue, the
> > log messages all have the same timestamp (Mar 11 07:56:27) and they
> > come after the rsyslog startup message, although they were logged
> > before the  rsyslog start.
> 
> But that was the case for as long as I remember. It is not systemd
> specific in any way.
> 
> > Lennart argues, that this should be handles within the syslogd (in
> > this case rsyslog 5.7.8), which should use the kernel time stamp to
> > compute the correct time when the log message occurred.
> >
> 
> Sounds quite reasonable :)
> 
> What would be also really nice - some systemd specific marker so
> rsyslog could extract syslogd messages from kmsg. Not sure if it is
> really doable without some gross kernel hack though.
> 
> Special severity level may be ... PRINTK_SYSTEMD? :)

I see no need for anything systemd specific, and systemd is not actually
the only usespace system that logs to to kmsg, at least dracut and udev
do that too.

To recognize userspace messages proper support for the facility bits in
the <xxx> prefix of kmsg messages would probably be best.

Lennart

-- 
Lennart Poettering - Red Hat, Inc.