Uploaded image for project: 'CFEngine Community'
  1. CFEngine Community
  2. CFE-533

Make syslog entries from log_* in action consistent with other syslog entries

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Unconfirmed
    • Priority: Low
    • Resolution: Unresolved
    • Affects Version/s: None
    • Fix Version/s: None
    • Component/s: None
    • Labels:
      None

      Description

      When you syslog via an action attribute, with e.g.:

      body action u_repaired_syslog

      { log_level => "log"; log_repaired => "udp_syslog"; log_string => "$(this.handle): $(x)"; }

      It shows up this way on the syslog server:
      <pre>
      2013-04-09T21:15:01-07:00 host.f.q.d.n daemon err this_handle_name my log message
      </pre>

      But I expect this to show up in the typical cf3 form:
      <pre>
      2013-04-09T22:34:37-07:00 host daemon err cf3 Regular expression error "nothing to repeat" in expression "* * * * * mycronjob" at 0
      </pre>

      There are primarily two differences between the entry and normal CF3 syslog logging:
      1. The app or program name in the entry is unset. The "cf3" program name is very useful for redirecting syslog messages.
      2. The hostname is in the FQDN form, which is okay, but it is unlike CF3's normal syslogging.

      I believe this is being done in libpromises/logging.c:
      <pre>
      snprintf(message, rfc3164_len, "<%u>%.15s %s %s", pri, cf_strtimestamp_local(now, timebuffer) + 4, VFQNAME,
      log_string);
      </pre>

      Other parts of the code seem to use system syslog() or openlog() functions; see libpromises/cfstream.c . I suppose there is a reason for this inconsistency. If not, it would make sense to consolidate and use the standard system syslog library, or at least the same functions.

      In addition, it looks like there is a hack/workaround for syslog APP-NAME already in place. If you separate the log_string by space, the first field becomes the syslog APP-NAME, e.g.:

      <pre>
      body action u_repaired_syslog {
      log_level => "log";
      log_repaired => "udp_syslog";
      log_string => "cf3 $(this.handle): $";
      }
      </pre>

      and the result now contains the program name I want (with correct tabbing):
      <pre>
      2013-04-09T23:04:09-07:00 host.f.q.d.n daemon err cf3 this_handle_name: my log message
      </pre>

      If this is the expected behavior, the documentation needs to be updated.

      Altogether this type of logging seems a little bit awkward. It seems like it would be a better fit if instead there were a "reports:" attribute to change the log location. But I have just started using it, so I may not yet see the wisdom of this design.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                Unassigned
                Reporter:
                chrishiestand Chris Hiestand
              • Votes:
                0 Vote for this issue
                Watchers:
                1 Start watching this issue

                Dates

                • Created:
                  Updated:

                  Summary Panel