On Mon, Nov 15, 2010 at 03:42:21PM +0100, Bernd Schubert wrote:
> On Friday, November 12, 2010, Lars Ellenberg wrote:
> > On Fri, Nov 12, 2010 at 05:04:41PM +0100, bs_li...@aakef.fastmail.fm wrote:
> > > # HG changeset patch
> > > # User Bernd Schubert <bernd.schub...@fastmail.fm>
> > > # Date 1289577717 -3600
> > > # Node ID 975046c034e72b7edcdc5fcd2f14edcca83fe937
> > > # Parent b4cf81f29f57fa7b6afe1f6dfbf8efaa6511accd
> > > cl_log: Always print the common log entity to syslog messages
> > >
> > > Pacemaker logs a lot of messages to system logs and always
> > > with different entities. As different entities are difficult
> > > to filter out with a generic rule, we always add the common
> > > log entity for syslog messages. That allows to write a simple
> > > filter rules.
> > >
> > > Using local log facilities also often does not work out, as
> > > those can freely taken by any daemon. Especially when one relies
> > > on that to filter out messages from the generic log file
> > > (usually /var/log/messages), relying on a local facility might have
> > > unwanted side effects.
> > >
> > > Signed-off-by: Bernd Schubert <bschub...@ddn.com>
> > >
> > > diff --git a/lib/clplumbing/cl_log.c b/lib/clplumbing/cl_log.c
> > > --- a/lib/clplumbing/cl_log.c
> > > +++ b/lib/clplumbing/cl_log.c
> > > @@ -531,7 +531,7 @@ cl_direct_log(int priority, const char*
> > >
> > > int needprivs = !cl_have_full_privs();
> > >
> > > if (entity == NULL){
> > >
> > > - entity =cl_log_entity;
> > > + entity = cl_log_entity;
> > >
> > > }
> > >
> > > pristr = use_priority_str ? prio2str(priority) : "";
> > >
> > > @@ -541,13 +541,10 @@ cl_direct_log(int priority, const char*
> > >
> > > }
> > >
> > > if (syslog_enabled) {
> > >
> > > - if (entity) {
> > > - strncpy(common_log_entity, entity, MAXENTITY);
> > > - } else {
> > > - strncpy(common_log_entity, DFLT_ENTITY, MAXENTITY);
> > > - }
> > > -
> > > - common_log_entity[MAXENTITY-1] = '\0';
> > > + if (!entity)
> > > + entity = "";
> > > + snprintf(common_log_entity, MAXENTITY, "%s %s",
> > > + cl_log_entity, entity);
> >
> > This may truncate entity, and of course breaks existing filtering setups
> > that trigger on it. Are we sure that adding in the "cl_log_entity" to
> > the "entity" is worth it?
> > Alternatives (may be worse, I don't know):
> > rather prepend it to the message?
> > make sure cl_log_entity is very short?
> > Or does it fit for all practical purposes, anyways?
>
> In loggingdaemon.h:
>
> /* Messages sent to the logging daemon */
> #define LD_LOGIT 2
> #define MAXENTITY 32
>
>
> I don't think there is a risk to get above that. But I have no objections to
> increase it.
No, I don't think we can do that: as long as we use syslog,
we cannot simply change its settings for entity size.
> As I wrote in the patch comment, filter rules based on localX are not optimal
> and filtering on "localX *and* a-single-word" does not work, as there is no
> common-log entity so far (I always found that quite annoying).
I well understand the current complications of syslog filtering,
and think too that we should improve things.
My question was more like this:
we have:
Nov 14 06:39:37 barkeeper1 pengine: [5724]: info: determine_online_status: Node
barkeeper1 is online
A)
You change that by prepending $cl_log_entity to entity:
Nov 14 06:39:37 barkeeper1 $cl_log_entity pengine: [5724]: info:
determine_online_status: Node barkeeper1 is online
where "$cl_log_entity pengine" is the "entity" in syslog speak,
and must stay below 32 characters (ok, 31, probably).
B)
We could instead keep our entity as syslog entity as is,
and insert $cl_log_entity at either 1,2 or 3 in the message part:
1) before the pid, which is generated as part of the message by us anyways,
2) before the pristr, or
3) between pristr and message
Nov 14 06:39:37 barkeeper1 pengine: [5724]: info: determine_online_status:
Node barkeeper1 is online
^1 ^2 ^3
C)
Or even just
log cl_log_entity as syslog entity,
and move "our" entity before its [pid] into the message, like so:
Nov 14 06:39:37 barkeeper1 $cl_log_entity: pengine[5724]: info:
determine_online_status: Node barkeeper1 is online
where now only "$cl_log_entity" is the syslog entity. Maybe rename our
entity to subsystem, or some such, to avoid further misunderstandings.
I think I like this last one best, btw ;-)
For the log files written by logd, it does not make much difference.
For possibly database backed syslog derivatives,
or filters, it makes a difference.
As we likely break existing filtering setups anyways with any of these
suggestions, we can just as well try to get it right this time.
--
: Lars Ellenberg
: LINBIT | Your Way to High Availability
: DRBD/HA support and consulting http://www.linbit.com
DRBD® and LINBIT® are registered trademarks of LINBIT, Austria.
_______________________________________________________
Linux-HA-Dev: Linux-HA-Dev@lists.linux-ha.org
http://lists.linux-ha.org/mailman/listinfo/linux-ha-dev
Home Page: http://linux-ha.org/
