> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of [email protected] > Sent: Wednesday, October 05, 2011 1:08 PM > To: rsyslog-users > Subject: Re: [rsyslog] How to generate RFC 5424 log data from my application > > On Wed, 5 Oct 2011, Pablo Chacin wrote: > > > Hi David > >> you need the software that creates them to do the formatting > > Exactly, question is, is there any? should I do it "by hand" and if so, how? > >> yes, rsyslog handles RFC5424, you may note that the author of that > >> RFC is the primary author of rsyslog. > > > > I understand that rsyslog handles RFC5424. My question was more about > > this > > scenario: if my application uses the standard syslog calls to generate > > log messages, but the message text is formatted following the RFC5424 > > specifications (in particular, adding the tags), will this be enough > > for rsyslog to recognise the format and process it properly? > > > > More over, will this format be a valid message format for the syslog API? > > will it accept the tags? > > rsyslog doesn't process the tags, the message is just one long string, so it > doesn't matter what the body of the message is, rsyslog will send it on (or > write it out). the only differences at the transport layer are in the header and > timestamp, the message itself is not interpreted by rsyslog (unless you do > advanced filtering, but even that's string manipulation)
Yeah, that's really a sad story :-( The POSIX API does not at all support RFC5424 and there currently is no valid way to do that. I was tempted to write a small library the provides this ability, but stepped back from that because it sounds like an awful idea to try to bring this as a standard into all Linux distros. Someone (sorry, forgot the name, maybe it was Martin who wrote the FreeBSD RFC5424 enhancement) suggested that we use some specific format inside the syslog() api for that path. Out of the bad choices, this seems to be the least worse one. But I have not yet really begun to look at this. Maybe some thing I finally should put on the agenda (interest in RFC5424 seems to increase, so it may be the right time now). Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
