Implementation-filled fields in https://fedorahosted.org/lumberjack/wiki/FieldList
by Miloslav Trmač
Hello,
when discussing a lumberjack-enabling patch set, it was pointed out that [ugp]id fields should be filled based on SCM_RIGHTS - and the Fedora configuration we are considering actually does that.
Both rsyslog's imuxsock and libumberlog add the following fields:
* pid
* uid
* gid
(and each adds some other fields that the other does not).
Is there a consensus to mark these three as "to be filled by log implementation, not by applications? If so, I'll go ahead and edit the wiki.
Thank you,
Mirek
11 years, 7 months
lumberjack cookie
by Rainer Gerhards
Hi all,
at least some of us seem to share a concern that CEE will depart from what it was early this year into a big monster effort that needs complete software overhaul. That would obviously be quite incompatible with what we are trying to do.
With the lumberjack-enabled software not yet rolled out widely, I think we have a final time to make a decision on the cookie. Currently we use "@cee" to detect lumberjack-enabled message content. With the potential fork of the efforts, I think it would probably be wiser to change that to something like "@lj:" (or similar).
This change would hurt rsyslog (and our Windows products) a little, but I get the impression that this may be a wise step in the long term.
Comments (especially from other implementers)?
Rainer
11 years, 7 months
Announcing ceelog-0.1 - comments wanted
by Miloslav Trmač
Hello,
I have just published a 0.1 of ceelog/libceelog at https://fedorahosted.org/ceelog/ :
Tarball at https://fedorahosted.org/releases/c/e/ceelog/ceelog-0.1.tar.xz
git http://git.fedorahosted.org/cgit/ceelog.git/. A full README is appended below.
Comments (on project name, API design, command-line tool wishlist), testing, review, contributions of any kind are very welcome - on the list, in trac, to me privately, in any way you find convenient.
Mirek
About
=====
The ceelog project provides libceelog, a library for receiving, filtering and
searching a stream or log of CEE/Lumberjack syslog records, and an associated
command-line tool, named ceelog.
The goal is to abstract the user from the backend storage (files, some kind
of local indexed storage, a remote database) and to provide efficient log
processing tools that can be used in applications and scripts for automated
log processing.
The project's home page is at https://fedorahosted.org/ceelog/ .
To get you started
==================
The ceelog(1) tool reads the "default" event source and outputs events matching
a filter. Currently, the "default" event source is hardcoded to
/var/log/messages.
Example filters:
* A regexp (matches the unstructured event text, or the "msg" field for
CEE/Lumberjack structured events)
ceelog '/DHCP/'
* A field comparison (matches a CEE/Lumberjack field)
ceelog 'uid == 0'
ceelog 'uid != 0'
ceelog 'trusted!uid == 0'
ceelog 'username ~ /^guest-/'
ceelog 'username !~ /^guest-/'
* A combination of the above
ceelog 'trusted!uid == 0 && username ~ /^guest-/'
See the source code in src/ceelog.c for an example of a subset of the API.
Roadmap
=======
* Add "Live log file" input source that can handle messages being appended and
log rotation.
* Document the filter expression format.
* Document ceelog(1).
* Get as close to 100% test coverage as possible.
* Support best-effort saving/restoring the current position in a source.
* Add better support for JSON types.
* Implement MongoDB input source.
* Support searching directly in the input source (e.g. to evaluate the filter
server-side).
* ceelog(1) improvements:
- Input processing (e.g. output only the last N recent events, block for
more incoming events)
- Output formatting (e.g. only output some structured fields)
- Statistics/table output (group matching events by one field, output counts)
Bugs
====
Please consider reporting the bug to your distribution's bug tracking system.
Otherwise, please report bugs at https://fedorahosted.org/volume_key/ . Bug
reports with patches are especially welcome.
11 years, 7 months