Second, the main purpose of umberlog is the LD_PRELOAD thing. That it has a few extras, is a side-effect, which I personally find convenient. But the main reason for the library's existence is its ability to change how syslog() works, with neither source changes, nor recompilation.
Is it really? I thought the idea was initiated when we discussed providing the ability to an app to pass name/value pairs, something that the existing syslog api cannot do. The addition of metadata nv pairs, IIRC, came at a somewhat later stage.
I don't see much value in these metadata over SCM_CREDENTIALS-obtained metadata. I know umberlog can do this without a syslogd, but with the major implementations participating in this effort is that really a big point?
So IMHO the extended ul_syslog() API is the really important part.
Rainer