HomeFreeBSD

Add RFC 5424 syslog message parsing to syslogd.

Description

Add RFC 5424 syslog message parsing to syslogd.

Syslogd currently uses the RFC 3164 format for its log messages.One
limitation of RFC 3164 is that it cannot be used to log entries with
sub-second precision timestamps. One of our users has expressed a desire
for doing this for doing some basic performance measurements.

This change attempts to make a first cut at switching to RFC 5424 based
logging. The first step is to alter syslogd's input path to properly
parse such messages. It alters the logmsg() prototype to match the
fields of RFC 5424. The parsemsg() function is extended to parse both
RFC 3164 and 5424 messages and call into logmsg() accordingly.

Additional changes include:

  • Introducing proper parsing of timestamps, so that they can be printed in any desired output format. This means we need to infer the year and timezone for RFC 3164 timestamps.
  • Removing ISKERNEL. This can now be realised by simply providing an APP-NAME (== "kernel").
  • Extending RFC 3164 parsing to trim off the TAG prefix and using that to derive APP-NAME and PROCID.
  • Increase MAXLINE. RFC 5424 mentions we should support 2k messages.

Differential Revision: https://reviews.freebsd.org/D14926

Details

Provenance
edAuthored on
Differential Revision
D14926: Add RFC 5424 syslog message parsing to syslogd.
Parents
rS332098: MFC r331761: align i386 cpu_reset() with amd64 version
Branches
Unknown
Tags
Unknown