On Fri, 12.10.12 15:29, Bill Nottingham (notting@xxxxxxxxxx) wrote: Heya, > And we've got a lot of technology going around. journald - that's > technology. rsyslog - that's technology. libumberlog & ceelog - that's > technology. THis really makes me wonder where CEE actually belongs in this. Is anybody using this currently? What area is this supposed to cover that is not already covered by the journal or rsyslog? Is there really room for another format besides BSD syslog and journal records? So, what's our story here with CEE? > If people want CEE format logs, or plain text logs, maybe journald should > grow those as output formats. To me it appears that CEE isn't widely accepted so far (heck, not even properly defined as multiple different vocabularies for fields are floating around), and I am bit unsure where it really fits in the big picture. I am a bit conservative in adding output formatting for CEE if it isn't clear that there is a need for CEE, that it's going to stick around for long and we actually have people using this. > Or maybe rsyslog should produce those formats. Maybe rsyslog should > grow a journald plugin, so instead of duplicating some of journald's > code for associating entries with pid/exec/etc., it can read the > already annotated journal stream and add its own metadata & spit out > whatever formats it wants. (Maybe it already does this!) Yes, this would certainly be useful. If rsyslog wants access to the full data stream systemd generates then using our C APIs is a good choice, it will get all meta data, and can process them the way they want. > Maybe rsyslog or journald should take over audit logging in some way. Since the audit logs contain a lot of useful data we definitely want to acquire auditing as another input for the journal. In fact, Eric has been working on kernel support to allow the journal to get a copy of the audit stream without interfering with auditd. Lennart -- Lennart Poettering - Red Hat, Inc. -- devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/devel
