lumberjack-developers October 2012

lumberjack-developers@lists.fedorahosted.org

7 participants
3 discussions

Implementation-filled fields in https://fedorahosted.org/lumberjack/wiki/FieldList
by Miloslav Trmač 09 Oct '12

09 Oct '12

Hello, when discussing a lumberjack-enabling patch set, it was pointed out that [ugp]id fields should be filled based on SCM_RIGHTS - and the Fedora configuration we are considering actually does that. Both rsyslog's imuxsock and libumberlog add the following fields: * pid * uid * gid (and each adds some other fields that the other does not). Is there a consensus to mark these three as "to be filled by log implementation, not by applications? If so, I'll go ahead and edit the wiki. Thank you, Mirek

5 14

lumberjack cookie
by Rainer Gerhards 09 Oct '12

09 Oct '12

Hi all, at least some of us seem to share a concern that CEE will depart from what it was early this year into a big monster effort that needs complete software overhaul. That would obviously be quite incompatible with what we are trying to do. With the lumberjack-enabled software not yet rolled out widely, I think we have a final time to make a decision on the cookie. Currently we use "@cee" to detect lumberjack-enabled message content. With the potential fork of the efforts, I think it would probably be wiser to change that to something like "@lj:" (or similar). This change would hurt rsyslog (and our Windows products) a little, but I get the impression that this may be a wise step in the long term. Comments (especially from other implementers)? Rainer

5 4

Announcing ceelog-0.1 - comments wanted
by Miloslav Trmač 05 Oct '12

05 Oct '12

Hello, I have just published a 0.1 of ceelog/libceelog at https://fedorahosted.org/ceelog/ : Tarball at https://fedorahosted.org/releases/c/e/ceelog/ceelog-0.1.tar.xz git http://git.fedorahosted.org/cgit/ceelog.git/. A full README is appended below. Comments (on project name, API design, command-line tool wishlist), testing, review, contributions of any kind are very welcome - on the list, in trac, to me privately, in any way you find convenient. Mirek About ===== The ceelog project provides libceelog, a library for receiving, filtering and searching a stream or log of CEE/Lumberjack syslog records, and an associated command-line tool, named ceelog. The goal is to abstract the user from the backend storage (files, some kind of local indexed storage, a remote database) and to provide efficient log processing tools that can be used in applications and scripts for automated log processing. The project's home page is at https://fedorahosted.org/ceelog/ . To get you started ================== The ceelog(1) tool reads the "default" event source and outputs events matching a filter. Currently, the "default" event source is hardcoded to /var/log/messages. Example filters: * A regexp (matches the unstructured event text, or the "msg" field for CEE/Lumberjack structured events) ceelog '/DHCP/' * A field comparison (matches a CEE/Lumberjack field) ceelog 'uid == 0' ceelog 'uid != 0' ceelog 'trusted!uid == 0' ceelog 'username ~ /^guest-/' ceelog 'username !~ /^guest-/' * A combination of the above ceelog 'trusted!uid == 0 && username ~ /^guest-/' See the source code in src/ceelog.c for an example of a subset of the API. Roadmap ======= * Add "Live log file" input source that can handle messages being appended and log rotation. * Document the filter expression format. * Document ceelog(1). * Get as close to 100% test coverage as possible. * Support best-effort saving/restoring the current position in a source. * Add better support for JSON types. * Implement MongoDB input source. * Support searching directly in the input source (e.g. to evaluate the filter server-side). * ceelog(1) improvements: - Input processing (e.g. output only the last N recent events, block for more incoming events) - Output formatting (e.g. only output some structured fields) - Statistics/table output (group matching events by one field, output counts) Bugs ==== Please consider reporting the bug to your distribution's bug tracking system. Otherwise, please report bugs at https://fedorahosted.org/volume_key/ . Bug reports with patches are especially welcome.

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

lumberjack-developers October 2012