On Wed, 28 Mar 2012, Rainer Gerhards wrote:
[mailto:lumberjack-developers-bounces@lists.fedorahosted.org] On Behalf
I see there being value in having the cee-syslog replacement library that sends the metadata structured around the existing unstructured log data. It's not as good as a full structured log, but it's a lot better than the existing situation.
Well, I think if you want just this, it can be obtained right now without een a new lib or so. Actually, this is the focus of liblognorm and syslog-ng's patterndb, to extract nv pairs from semistructured data. I think this *is* pretty important stuff. Other metadata you can get via SCM_CREDENTIALS (and I still think this is the preferred way from a trust perspective).
First off, I agree with you about SCM_CREDENTIALS
other than that, trying to guess the structure after the fact, especially with unstructured log messages from whatever source, is significantly harder to do right all the time than dealing with structured data.
just look at all the guesswork (and how frequently it goes wrong) that is in the syslog parser to figure out the date, hostname, and syslogtag fields. If we can avoid that with a library change, I think it's well worth it.
David Lang