[systemd-devel] [PATCH] journald: Introduce RFC 5424 syslog

[Lennart Poettering]

On Thu, 19.02.15 13:28, Susant Sahani (susant at redhat.com) wrote:

> This patch adds support for RFC 5424 syslog format to journald. Journald
> can now forward logs to a multicast UDP group.
> 
> RFC 5424 format:
> <PRI>VERSION SP TIMESTAMP SP HOSTNAME SP APP-NAME SP PROCID SP MSGID SP
> [SD-ID]s SP MSG

Hmm, wasn't the last proposal we discussed to do this in an auxiliary
daemmon, possibly in systemd-journal-upload or so, but not in
journald?

I see two problems with journald: first of all, for security reasons I
am conservative about making it deal with the network
directly. Opening up such a basic daemon to the network is a something
i'd prefer to avoid.

The other thing is that journald runs really really early during boot,
at a time where the network is unlikely to be up. This means that
early boot msgs could never be delivered via syslog...

I'd really prefer a scheme where this syslog broadcaster can be run
relatively late at boot and where it tries to repeatedly send the
messages, until sendmsg() actually succeeds. i.e. using the journal
cursor logic it would not send a log message until the point where the
previous message was delivered with a successful sendmsg(). Wth such a
scheme all early boot msgs would be dumped on the network the moment
the network is up.

Zbigniew, do you have more ideas about this?

Lennart

-- 
Lennart Poettering, Red Hat