[systemd-devel] systemd-logger and external syslog daemon

[Rainer Gerhards]

> -----Original Message-----
> From: Lennart Poettering [mailto:lennart at poettering.net]
> Sent: Friday, March 11, 2011 5:06 PM
> To: Rainer Gerhards
> Cc: Michael Biebl; Andrey Borzenkov; Mike Kazantsev; systemd-
> devel at lists.freedesktop.org
> Subject: Re: [systemd-devel] systemd-logger and external syslog daemon
> 
> On Fri, 11.03.11 08:09, Rainer Gerhards (rgerhards at hq.adiscon.com) wrote:
> 
> > > As you can see, when rsyslog starts up and flushes the kmsg queue,
> > > the log messages all have the same timestamp (Mar 11 07:56:27) and
> > > they come after the rsyslog startup message, although they were
> > > logged before the  rsyslog start.
> > > Lennart argues, that this should be handles within the syslogd (in
> > > this case rsyslog 5.7.8), which should use the kernel time stamp to
> > > compute the correct time when the log message occured.
> > >
> > > Rainer, can you share any insight on this matter?
> >
> > Lennart recommended that to me and I had some code in place to do it.
> > However, at that time this did not work because the kernel did not
> > record that timestamp. This was added a while later, but I did not yet
> > revisit that issue. I was a bit hesitant to dig into this issue as I
> > found no simple enough method to setup a system with systemd (I know
> > it's important, but there are many other important things as well...).
> > I'll see that I can at least see what kernel patch needs to be present.
> 
> Nah, these are actually two different things. The SO_TIMESTAMP stuff does
> not matter in this context.
> 
> What I'd like to see that SO_TIMESTAMP is used when messages come in via
> /dev/log.
> 
> And for messages coming in from /proc/kmsg it would be cool to parse the
> kernel timestamps that (optionally) are in the message prefix in the []
part.

Got it -- but "optionally" does not sound too good. What if systemd's minimal
syslog implementation would guarantee that a timestamp is written for
"forwarded" logs?

Rainer