2015-03-03 18:57 GMT+01:00 David Lang <[email protected]>: > On Tue, 3 Mar 2015, Rainer Gerhards wrote: > > 2015-03-03 16:42 GMT+01:00 Thomas D. <[email protected]>: >> >> Hi, >>> >>> quick update: Yes, the "problem" is related to util-linux which now >>> defaults >>> to rfc5424 [1]. >>> >>> messages crossed ... good to know. >>> >> >> >> I downgraded to util-linux-2.25.2 and the test is passing... >>> >>> The right "solution" seems to be to use "--rfc3164" for current >>> util-linux >>> packages in the test until rsyslog does support rfc5424. >>> >>> Final question: Does the new default RFC5424 support in util-linux cause >>> any >>> harm to rsyslog because rsyslog is not RFC5424 ready like you (Rainer) >>> wrote >>> in your last mail or was it a misunderstanding (and it is just the test >>> which is expecting rfc3164 instead of rfc5424)? >>> >>> >>> RFC5424 is supported everywhere, but not in imuxsock. That is because >> years >> ago there was a long discussion that the log socket is really not using >> syslog format but rather a canned and fixed format. To implement something >> I don't exactly remember and don't like to dig up we changed imuxsock to >> not use the regular parsers but rather a custom one based on that "fixed" >> format. IIRC that was in the context of something that needed to be >> changed >> with systemd. >> >> I have recently lost most interest in imuxsock as all major distros have >> voiced to use journald, and journald recommends to use imjournal in >> contrast to imuxsock, so all topics related to imuxsock now have a very >> low >> priority. Given our discussion here, I will however see what it would take >> to make it optionally use the regular parser interface. >> > > I'm seeing more recognition that the journald causes performance problems, > and systemd has recently added the ability for journald to _not_ take over > /dev/log. >
interesting... > > So I am far less convinced than you are that imuxsock is dead code to be > ignored and phased out. > > sounds so. As I wrote, I am already working on it (but will stop at 95% today ;)). > adding the ability for imuxsock and imfile to use configurable parsers > would be very handy. I hope it ends up being simple to do. > Note that imfile uses configurable parsers. What you mean (I guess) is different, that is *input parser*, something not yet present. It's on my list, but I am hindered on doing that because none (except Radu!) has so far contributed logs which I would like to use for some real-world testing. > > I'll note that the message posted was not quite rfc5424, it's missing the > '1' and '<pri>' sections (unless they were stripped out by the default > parser) > > That diagnosis result was "MSG" after being parsed. We've not yet seen the raw message. Currently I assume it is 5424, looking at the posted patch to logger makes this probable. Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
