[systemd-devel] in-kernel structured logging

[Zbigniew Jędrzejewski-Szmek]

On Thu, Jul 30, 2015 at 12:16:03PM -0400, Anne Mulhern wrote:
> Hi!
> 
> This is really closely related to my previous question re. formalizing an API.
> 
> In the design document (https://docs.google.com/document/pub?id=1IC9yOXj7j6cdLLxWEBAGRL6wl97tFxgjLUEHIX3MSTs)
> there is a statement about a future intention to support "in-kernel structured logging".
> 
> Are things like dev_printk() considered to have achieved that, or is something more planned for the future?

One thing is the basic support for structured logs, which was
implemented, another is patching all the places which produce logs
to attach useful metadata. This is only partially done.
If you look at kernel logs from a boot, even basic things
like the priority are set semi-randomly. So from the kernel
the state could be described as POC.

>From systemd side, we have the fields, but we don't do interesting
things with them. One problem is that the kernel gives us tags
like _KERNEL_DEVICE=+scsi:8:0:3:0 which are dynamic, and change
between boots. For the logs to be useful, we would have to map
those to some static identifiers. It would be nice to tell journalctl
"give me all logs about /dev/sda", but we're not there yet.

Zbyszek