Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 542368 - sys-apps/systemd journald may not correctly interpret RFC5424 syslog messages
Summary: sys-apps/systemd journald may not correctly interpret RFC5424 syslog messages
Status: RESOLVED WONTFIX
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: [OLD] Unspecified (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo systemd Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-03-06 16:17 UTC by Mike Gilbert
Modified: 2015-03-15 21:31 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Mike Gilbert gentoo-dev 2015-03-06 16:17:15 UTC
Continuing the conversation from 542306.
Comment 1 Mike Gilbert gentoo-dev 2015-03-06 16:21:45 UTC
"logger foobar" produces a journal entry like this:

{
        "__CURSOR" : "s=c1c2cfaf9a954cdfbf464ab5c4627e43;i=b1fda;b=cb62f6a33f5e40a18686d66913e7bd36;
        "__REALTIME_TIMESTAMP" : "1425658446091191",
        "__MONOTONIC_TIMESTAMP" : "306992125249",
        "_BOOT_ID" : "cb62f6a33f5e40a18686d66913e7bd36",
        "_UID" : "10000",
        "_GID" : "10000",
        "_CAP_EFFECTIVE" : "0",
        "_MACHINE_ID" : "4e39f1235b04c6398c7a5eaa0000000b",
        "_HOSTNAME" : "naomi",
        "_TRANSPORT" : "syslog",
        "PRIORITY" : "5",
        "SYSLOG_IDENTIFIER" : "logger",
        "MESSAGE" : "foobar",
        "_COMM" : "logger",
        "_PID" : "1104",
        "_SOURCE_REALTIME_TIMESTAMP" : "1425658446090675"
}

"logger -u /dev/log" produces a journal entry like this:

{
        "__CURSOR" : "s=c1c2cfaf9a954cdfbf464ab5c4627e43;i=b1fdb;b=cb62f6a33f5e40a18686d66913e7bd36;
        "__REALTIME_TIMESTAMP" : "1425658469237279",
        "__MONOTONIC_TIMESTAMP" : "307015271336",
        "_BOOT_ID" : "cb62f6a33f5e40a18686d66913e7bd36",
        "_UID" : "10000",
        "_GID" : "10000",
        "_MACHINE_ID" : "4e39f1235b04c6398c7a5eaa0000000b",
        "_HOSTNAME" : "naomi",
        "_TRANSPORT" : "syslog",
        "PRIORITY" : "5",
        "MESSAGE" : "1 2015-03-06T11:14:29.236404-0500 naomi floppym - [timeQuality tzKnown=\"1\" is
        "_PID" : "1109",
        "_SOURCE_REALTIME_TIMESTAMP" : "1425658469236661"
}

"logger --rfc3164 -u /dev/log foobar" produces this:

{
        "__CURSOR" : "s=c1c2cfaf9a954cdfbf464ab5c4627e43;i=b1fdc;b=cb62f6a33f5e40a18686d66913e7bd36;
        "__REALTIME_TIMESTAMP" : "1425658833026428",
        "__MONOTONIC_TIMESTAMP" : "307379060485",
        "_BOOT_ID" : "cb62f6a33f5e40a18686d66913e7bd36",
        "_UID" : "10000",
        "_GID" : "10000",
        "_MACHINE_ID" : "4e39f1235b04c6398c7a5eaa0000000b",
        "_HOSTNAME" : "naomi",
        "_TRANSPORT" : "syslog",
        "PRIORITY" : "5",
        "MESSAGE" : "naomi floppym: foobar",
        "_PID" : "1135",
        "_SOURCE_REALTIME_TIMESTAMP" : "1425658833025843"
}

Did we lose anything? I'm not sure what to look for.
Comment 2 Thomas Deutschmann (RETIRED) gentoo-dev 2015-03-08 15:04:38 UTC
Your first command (logger foobar) should have produced RFC5424 output. But due to a bug in util-linux it is producing old RFC3164 format. The output from the first command looks OK for me.


The seccond command (logger -u /dev/log) produces RFC5424 output but information are missing, for example:

- SYSLOG_IDENTIFIER

The message value seems to be invalid: It should only contain the message (no further information like timestamp, username, hostname..) and for me a final quote is missing (the JSON data should be invalid).


In the third command, the SYSLOG_IDENTIFIER is also missing although it is RFC3164 format. This regression will be fixed in the upcoming util-linux version, too.


When testing with logger, please add the "--stderr" option to see the generated output from logger, too.


PS: Due to http://lists.freedesktop.org/archives/systemd-devel/2015-February/028576.html I am expecting *no* RFC5424 format support in the systemd version currently available in Gentoo.
Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev 2015-03-09 13:41:00 UTC
To recap (because I was wrong in some points):

logger will support _3_ formats:

- RFC3164 format, which is used when you specify "--rfc3164" option

- RFC5424, which is used when you specify "--rfc5424" option

- Format without a name (basically RFC3164 without hostname), which is used when your don't use any format option


These changes are already present in util-linux git master (=sys-apps/util-linux-9999).

It is important to understand that the format used *before* util-linux-2.26 wasn't RFC3164... it was the "special" format without a name... ;)


Because logger will revert its behavior from util-linux-2.26 back to its previous known and working behavior, no syslogger *must* learn RFC5424.

We should simply block =sys-apps/util-linux-2.26 for all users. This will solve any problems logger from util-linux-2.26 has/will cause.

I am expecting util-linux-2.26.1 soon.
Comment 4 Thomas Deutschmann (RETIRED) gentoo-dev 2015-03-15 21:07:30 UTC
sys-apps/util-linux-2.26.1 which includes all the fixes is now available and in tree. So the main reason for this bug is solved.

However you maybe want to keep this bug to track RFC5424 progress in systemd until a systemd version with RFC5424 support landed in tree (=systemd still doesn't support RFC5424 at the moment).
Comment 5 Mike Gilbert gentoo-dev 2015-03-15 21:31:18 UTC
I don't think there are any plans to extend it beyond what it currently supports.