[systemd-devel] systemd-logger and external syslog daemon

[Lennart Poettering]

On Fri, 11.03.11 08:09, Rainer Gerhards (rgerhards at hq.adiscon.com) wrote:

> > As you can see, when rsyslog starts up and flushes the kmsg queue, the
> > log messages all have the same timestamp (Mar 11 07:56:27) and they
> > come after the rsyslog startup message, although they were logged
> > before the  rsyslog start.
> > Lennart argues, that this should be handles within the syslogd (in
> > this case rsyslog 5.7.8), which should use the kernel time stamp to
> > compute the correct time when the log message occured.
> > 
> > Rainer, can you share any insight on this matter?
> 
> Lennart recommended that to me and I had some code in place to do it.
> However, at that time this did not work because the kernel did not record
> that timestamp. This was added a while later, but I did not yet revisit that
> issue. I was a bit hesitant to dig into this issue as I found no simple
> enough method to setup a system with systemd (I know it's important, but
> there are many other important things as well...). I'll see that I can at
> least see what kernel patch needs to be present. 

Nah, these are actually two different things. The SO_TIMESTAMP stuff
does not matter in this context.

What I'd like to see that SO_TIMESTAMP is used when messages come in via
/dev/log. 

And for messages coming in from /proc/kmsg it would be cool to parse the
kernel timestamps that (optionally) are in the message prefix in the []
part.

Lennart

-- 
Lennart Poettering - Red Hat, Inc.