Hi, UDPAdaptor can record syslog logs but the log entry is tagged with Chukwa internal data type at adaptor start up time. I am thinking to extend UDPAdaptor to record syslog messages with small enhancements. SyslogAdaptor can extract facility name field from syslog message to tag facility name as the data type. This would provide the ability to invoke different demux parsers base on the facility name in syslog. HOSTNAME can also be mapped to source for Chukwa chunk meta data.
My use case is to configure hadoop log4j.properties to log everything through org.apache.log4j.net.SyslogAppender to one SysLogAdaptor on the local Chukwa agent, and invokes different parsers for audit log and name node log. Facility name is some what limited, but it should be enough type left to manage hadoop log files. Suggestion and feedbacks are welcome. regards, Eric
