On Wed, 28 Mar 2012, Gergely Nagy wrote:
"Rainer Gerhards" rgerhards@hq.adiscon.com writes:
Nope, it isn't. But turning legacy apps syslog() messages into a JSON-payloaded thing is already a win, imo, as the syslogds don't have to go to extra lengths to accept both legacy and @cee logs.
Where ist he win? Besides, we always must process legacy logs as they may come in via the network. And cee-enhanced syslog also comes in via the network. So cookie check and appropriate action is required in any way, isn?t it?
Not if you LD_PRELOAD the lib on the whole network (which I've done on my systems). In that case, you can get rid of the cookie check.
you can't LD_PRELOAD on a Cisco switch.
but that said, you can configure your syslog server in such a way that the non-structured sources go to a different IP/port than your structured sources, and then have the one syslog server change them to all be structured before they go to processing.
David Lang