[systemd-devel] syslog CEE support for the journal

[Lennart Poettering]

On Tue, 05.03.13 17:25, David Strauss (david at davidstrauss.net) wrote:

> Has CEE seen any widespread deployment? It would be straightforward to
> add the following to the journal:
> 
>  * Optional conversion of non-binary fields to CEE for forwarding to syslog
>  * Conversion of CEE to journal fields within the systemd syslog server
>  * Conversion of CEE to journal fields when a service logs messages
> with syslog-style priority line prefixes
> 
> I proposed something similar to the third during the journal hackfest
> in San Francisco, but my initial work looked for JSON. It would be
> cleaner to support CEE and extend our existing support for
> stdout/stderr being syslog-formatted when detected as such.
> 
> I'm bringing this up because of some remarks [1] I posted on systemd's
> journal versus syslog.
> 
> [1] https://plus.google.com/116504510413299636245/posts/V4X3AfcRyMe

Quite frankly CEE in my eyes seems to be something that is unlikely to
take off. Much like project lumberjack I seriously doubt this will be
the big winner. Judging by its mailing list lumberjack is pretty much
dead, and i figure CEE is not more alive either...

I am quite fine with the formats we currently support in systemd, and I
am not a fan of adding too many variables to the game. So, we can
reconsider adding CEE support if it turned out to become more popular
but I certainly don't think systemd should be the vehicle to achieve
that.

And technically, CEE tries to do structured logging within the classic
syslog protocol. I think that's already a pretty bad idea, since as
undefined as syslog has been during its life, one thing is certain:
syslog implementations will truncate long lines if they see fit, and by
sticking JSON into it, this will be truncated, too. Also, which admin
wants to see juge serialized JSON fields formatted in single lines in
/var/log/messages anyway?

Lennart

-- 
Lennart Poettering - Red Hat, Inc.