Hi Ben, Some logger analysis tool has some local agent listening on a single node to collect logs. One of the popular tool called log insight which uses rsyslogd as local client to listen and transferring log to log insight server.
Currently syslog() function does not support structured data with key/value pairs in the log header specified by RFC 5424. https://tools.ietf.org/html/rfc5424 Log analysis tool uses these header to categorize and filter log messages. If sending structured data as main log message, it won't be recognized by the log collector. That's why we have to send raw UDP packet directly to rsyslogd which contains both structured header and main log messages. If using vlog to send udp to rsyslogd by specifying --syslog-target=127.0.0:514, we would see duplicated messages in /var/log/syslog as vlog also calls syslog() for the same message. That is the reason for this patch. BTW, since this parameter is called syslog-target, do we expect user to either specify this to send udp log message or let vlog call syslog() but not both at the same time? Is there other use case to send UDP packet and call syslog() at the same time? Thanks, Michael ________________________________________ From: Ben Pfaff <b...@nicira.com> Sent: Tuesday, April 14, 2015 9:11 PM To: Gurucharan Shetty Cc: Michael Hu; ovs-dev Subject: Re: [ovs-dev] [PATCH] vlog.c: Avoid duplicating log message in rsyslog if enabling syslog-target On Fri, Apr 10, 2015 at 07:30:13AM -0700, Gurucharan Shetty wrote: > On Thu, Apr 9, 2015 at 8:42 PM, Michael Hu <humich...@nicira.com> wrote: > > Currently if --syslog-target=127.0.0.1:514 is enabled, syslog would have > > duplicated log messages. The fix will not call syslog() if already having > > syslog_fd indicating message is sent through udp. > > You forgot to add a Signed-off-by. > When I 'git am' this patch, I get: > Applying: vlog.c: Avoid duplicating log message in rsyslog if enabling > syslog-target > fatal: corrupt patch at line 15 > > I personally think that your patch makes sense. But the documentation > (e.g. 'man ovs-vswitchd') says: > > --syslog-target=host:port > Send syslog messages to UDP port on host, in addition to the > system syslog. The host must be a numerical IP address, not a > hostname. > > So when this feature was added, I think it was mostly meant for a > remote IP address and not local. So your patch breaks the "in > addition" part of the current expectation. I'd like to hear why one would pass --syslog-target=127.0.0:514 at all. Why is this useful, if the system already has a working syslog() facility? Thanks, Ben. _______________________________________________ dev mailing list dev@openvswitch.org http://openvswitch.org/mailman/listinfo/dev
