[systemd-devel] Fwd: kernel logging_journald_journalctl question

[Anne Mulhern]

Advice appreciated.

Thanks,

- mulhern

----- Forwarded Message -----
> From: "Anne Mulhern" <amulhern at redhat.com>
> To: "OS Development List" <os-devel-list at redhat.com>
> Sent: Thursday, July 9, 2015 4:46:13 PM
> Subject: kernel logging_journald_journalctl question
> 
> Hi!
> 
> My ultimate goal is that the following example line:
> 
> "journalctl _WWN=wwn-0x5002e10000000000"
> 
> should be meaningful, i.e.,
> * yield all log messages pertaining to a device w/ that particular wwn
> * the _WWN value should be guaranteed with the same certainty as journalctl's
> other unfakeable values with underscores, e.g., _UID.
> 
> One subgoal is, therefore, to make sure that _correct_ _WWN information gets
> into
> the journal when that information is available.
> 
> In principle, journal messages about devices that possess WWN's might
> originate in a
> variety of places. This makes things complicated, since it is possible that
> the appropriate way of discovering the WWN may vary with the origin of the
> message.
> (For example, lsscsi discovers the WWN of the current device by searching
> /dev/disk/by-id/.)
> 
> However, I'm focusing on messages that originate in the kernel via
> dev_printk() in
> the SCSI mid-layer. I infer that journald reads them from the kernel log
> buffer in the
> dev_kmsg_record() method. I also know that dev_printk guarantees to print two
> key/value pairs,
> SUBSYSTEM and DEVICE.
> 
> What is the best way to make information about the WWN available to journald?
> Can it reliably extract this information from the DEVICE field in the
> dev_kmsg_record()
> method? Is there a process that I don't know about that picks up messages
> from the kernel
> and augments them with extra metadata before they end up in /dev/kmsg that
> can be modified?
> Would dev_printk() itself have to be extended to include WWN information as
> another field
> in addition to SUBSYSTEM and DEVICE? Must I fall back on making sure that
> individual calls
> to dev_printk() include some essential information that can be parsed back
> out by journald?
> 
> It would also be nice to take into consideration that messages regarding
> devices could
> be logged from other sources, like the journald API, and it would be nice to
> reliably store
> the WWN information from those messages in the journal, as well.
> 
> Thanks in advance for any help,
> 
> - mulhern
> 
> 
> 
> 
> 
> 
> 
> 
>  
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
>