[systemd-devel] Multiline log mesages in journal

[Marti Raudsepp]

Hi list,

Some applications, such as PostgreSQL have log messages consisting of
multiple lines. When reporting to syslog, these messages are
artificially split into multiple log lines. But it would be nice to
get rid of that legacy with journal -- to prevent lines from being
interleaved with other unrelated log messages and to make the lives of
log scrapers easier. Also, other fields don't need to be duplicated
for each message line.

However, currently whenever applications send a message to the journal
that includes newlines, it gets displayed as "[##B blob data]"

I hereby propose that the "short" output mode should first split the
message into separate lines, and then simply repeat the timestamp/etc
prefix for each line. Perhaps with a limit on the number of max lines
per message. e.g:

Mar 07 12:23:57 host postgres[6326]: line1
Mar 07 12:23:57 host postgres[6326]: line2

If this is considered a good idea, I can have a try at implementing it.

Some examples of multiline log messages:

LOG: checkpoints are occurring too frequently (2 seconds apart)
HINT: Consider increasing the configuration parameter "checkpoint_segments".

ERROR:  deadlock detected
DETAIL:  Process 5463 waits for ShareLock on transaction 113367268;
blocked by process 5457.
        Process 5457 waits for ShareLock on transaction 113367000;
blocked by process 5463.
        Process 5463: SELECT sys_stats_daily();
        Process 5457: SELECT schedule_process_entry( 20382 )
HINT:  See server log for query details.
CONTEXT:  SQL statement "SELECT 1 FROM ONLY "public"."loan_annex" x
WHERE "annex_id" OPERATOR(pg_catalog.=) $1 FOR SHARE OF x"
        SQL function "stats_investment_make_prognosis" statement 2
        SQL statement "SELECT stats_investment_make_prognosis()"
        PL/pgSQL function "sys_stats_daily" line 25 at PERFORM
STATEMENT:  SELECT sys_stats_daily();

Regards,
Marti