From owner-freebsd-hackers@freebsd.org Mon Oct 1 08:25:31 2018 Return-Path: Delivered-To: freebsd-hackers@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id A919410A3E60 for ; Mon, 1 Oct 2018 08:25:31 +0000 (UTC) (envelope-from ed@nuxi.nl) Received: from mail-ed1-x52c.google.com (mail-ed1-x52c.google.com [IPv6:2a00:1450:4864:20::52c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 2AD7E945DF for ; Mon, 1 Oct 2018 08:25:30 +0000 (UTC) (envelope-from ed@nuxi.nl) Received: by mail-ed1-x52c.google.com with SMTP id f38-v6so13349426edd.8 for ; Mon, 01 Oct 2018 01:25:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nuxi-nl.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ydb91vgq7iKhWLTpCiZfIpgKP4Bns1thdXlsz5er2p0=; b=AXBTxpW3wlBHDQ+L1RzUKNMMMRZ8/tnd/B5z5C8cqWrxvkJokVOHF7jDsjXEqXqHbn 3u3u5y7yiumWH6AxH30okmDmT866eEkUorSlirW23IJNyPZNDMkYukoM4oiXoJFlf5Fh Z1zLqwvxiUaMW2HDXtjr/54xVyqlo+/z4NyJaojx1p0sy1I0Kz9kbGaj3vMgCqTtEzMm wub8MDT4/Bzet3z3CN3rfwlzFlZDGUhNAAVzHVc3zISDjZJFbCajDuZVsybYHTe2jZmt LH5KgNN3rN2Bq2BMT3Ush+9RXLDN6Ds9SfO3FfpEa1RxEB0BXJONd6DfbVFWCYgyirFd 44Ow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ydb91vgq7iKhWLTpCiZfIpgKP4Bns1thdXlsz5er2p0=; b=SiFJpUXNxK+Rw55Z0vn2NckqPFjw/wfPAapc4pUHHnScMN/wNXCK7cVQLD20D8+n9s jP++qoDm8y42cXoTi0t2dr2LJxhskgQ7Jg8qo88baM9fhpKhecIrugst3CJjwquxBzLG IgE0ogmy05rBrf/7u/KsYDLwG+jVc0MQyeaQ+dGexwUV2AUUYRLal5gjFMxAXpTG96XB sVkZ/wpoJtdrTNsJEdPR/bETcBc8FZr+NrdG0kEkreE9vWQsz+uzQoVhzT1TKpO7qyAi PSdSgqW6gbauRoq/7mgRE/3uoeHMluXFNK/p2q/MsehyEf9Jq+03ml34pEH+IJwTX1oi TJ4g== X-Gm-Message-State: ABuFfogkwTiQCP1UMN59Ufe7RKQ86B+7Ttt7bt88/jUWJkpfXpR8qH7d QUmWtJFqzpAYXBltA2O8JFngRuGsjPdmrW4uUYmS3Los X-Google-Smtp-Source: ACcGV618gEqw/sY+QcWuJqc5KR+QuE8AH618EmO54NSTdsuVvHxo1j+6+YIXz3wBLc/mbMLNTecnYEiPC8keTK6xgHw= X-Received: by 2002:a50:a825:: with SMTP id j34-v6mr14239740edc.258.1538382329205; Mon, 01 Oct 2018 01:25:29 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Ed Schouten Date: Mon, 1 Oct 2018 10:25:03 +0200 Message-ID: Subject: Re: Syslogd less verbose logging with rfc5424 To: timp87@gmail.com Cc: FreeBSD Hackers Content-Type: text/plain; charset="UTF-8" X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Oct 2018 08:25:32 -0000 Hi Pavel, Op zo 30 sep. 2018 om 12:13 schreef Pavel Timofeev : > There was a great work to bring rfc5424 date format to syslogd(8). See > https://svnweb.freebsd.org/base?view=revision&revision=332510 > > I've been using it on CURRENT since it was imported. > I'm happy I can finally get syslog messages with high time precision > w/o installing rsyslog or another syslog implementation. Great to hear you like it! > The thing I really don't like is that syslogd puts severity and > priority to log files next to timestamp. > In my opinion severity and priority is not needed in 99% of cases, > only in debugging corner cases. While high precision timestamp is the > main thing what people like rfc 5424 for. This is just my opinion. > So for "-O rfc5424" I'd like to have the same behavior as for rfc > 3164, i. e. do not log severity and priority by default and if needed > use '-v' option to enable those. But it was decided and documented > that '-v' won't have any effect for rfc 5425 > https://svnweb.freebsd.org/base?view=revision&revision=335862 > > The first thing I'd like to suggest is to make rfc 5424 logging the > same way as for rfc 3164, i. e. make '-v' option work the same. > If community is not agree with me, I'd like to suggest another thing: > have another option/flag for syslogd(8) to disable severity and > priority logging if one use rfc 5424. I'm on the fence what the right approach is here. The problem is that newsyslog's RFC5424 support also writes the priority/facility number and has no way to suppress it. This means that if we were to remove it from syslogd, we should also add a corresponding switch to syslogd. That said, my biggest annoyance with the priority/facility number at the start is not that it takes up space. It's that it's not always the same width (1-3 columns for the number). This causes log entries to be aligned inconsistently. This could easily be solved by adding some leading zeroes, if it weren't for the fact that RFC 5424 explicitly disallows it. That said, I'd be amazed if that would cause problems in practice. A middle ground would be to add leading zeroes when we don't write messages across the network. That way we improve readability, while still allowing log entries to be ingested by other systems that use RFC 5424. -- Ed Schouten