URL:
https://github.com/SSSD/sssd/pull/5477
Title: #5477: DEBUG: Use () in program identifier instead of []
alexey-tikhonov commented:
"""
Hi @sigv ,
at this point I'm a little bit confused what issue exactly we are trying to solve.
Initially #5431 was talking about the case:
- SSSD is built with --with-syslog=syslog
- syslog was trying to parse [] part of `debug_prg_name` as a PID
- the result was seen in journalctl output as malformed SYSLOG_IDENTIFIER and SYSLOG_PID
(and this was the issue)
Is this ^^ correct so far?
This specific case should be resolved with 18233532b72e62452eac6886652fa633ba055d8c as
this patch removes ident==debug_prg_name in case "--with-syslog=syslog" and
default is used instead. So instead of sssd[sudo] you should see sssd_sudo (no [])
Now this PR seems to talk about different case:
- SSSD is built with --with-syslog=journald
- and then logs are forwarded to syslog (journald composes TAG as SYSLOG_IDENTIFIER+[PID]
in the process)
- then, I guess, syslog gets wrong part of the TAG as a PID?
What is practical issue / consequences?
The thing is, RFC you mention:
1) says "Any non-alphanumeric character will terminate the TAG field and will be
assumed to be the starting character of the CONTENT field".
So strictly speaking replacement of [] with () doesn't look as a proper solution.
But I'm somewhat confused here: `man openlog`: "If ident is NULL, the program
name is used." and '_' is a perfectly fine in a program name, but it's
not alphanumeric character...
2) rfc3164 is obsoleted by rfc5424, and this rfc says "The TAG is now part of the
header, but not as a single field. The TAG has been split into APP-NAME, PROCID, and
MSGID." and "HEADER = PRI VERSION SP TIMESTAMP SP HOSTNAME SP APP-NAME SP PROCID
SP MSGID", where:
```
The APP-NAME field SHOULD identify the device or application that
originated the message. It is a string without further semantics.
It is intended for filtering messages on a relay or collector.
```
Take a note SP is used as a separator between header fields.
I don't see how "[]" in APP-NAME violates rfc5424 (please correct me if
I'm wrong)
Those two RFC are quite different that's why I ask for more details about your
setup.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/5477#issuecomment-772681879