On Tue, 3 Mar 2015, Rainer Gerhards wrote:
2015-03-03 16:42 GMT+01:00 Thomas D. <[email protected]>:
Hi,
quick update: Yes, the "problem" is related to util-linux which now
defaults
to rfc5424 [1].
messages crossed ... good to know.
I downgraded to util-linux-2.25.2 and the test is passing...
The right "solution" seems to be to use "--rfc3164" for current util-linux
packages in the test until rsyslog does support rfc5424.
Final question: Does the new default RFC5424 support in util-linux cause
any
harm to rsyslog because rsyslog is not RFC5424 ready like you (Rainer)
wrote
in your last mail or was it a misunderstanding (and it is just the test
which is expecting rfc3164 instead of rfc5424)?
RFC5424 is supported everywhere, but not in imuxsock. That is because years
ago there was a long discussion that the log socket is really not using
syslog format but rather a canned and fixed format. To implement something
I don't exactly remember and don't like to dig up we changed imuxsock to
not use the regular parsers but rather a custom one based on that "fixed"
format. IIRC that was in the context of something that needed to be changed
with systemd.
I have recently lost most interest in imuxsock as all major distros have
voiced to use journald, and journald recommends to use imjournal in
contrast to imuxsock, so all topics related to imuxsock now have a very low
priority. Given our discussion here, I will however see what it would take
to make it optionally use the regular parser interface.
I'm seeing more recognition that the journald causes performance problems, and
systemd has recently added the ability for journald to _not_ take over /dev/log.
So I am far less convinced than you are that imuxsock is dead code to be ignored
and phased out.
adding the ability for imuxsock and imfile to use configurable parsers would be
very handy. I hope it ends up being simple to do.
I'll note that the message posted was not quite rfc5424, it's missing the '1'
and '<pri>' sections (unless they were stripped out by the default parser)
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
