Subject: [apps-discuss] Profiling RFC5424 for easy use from clients

From: Nico Williams <[email-masked]>
Date: Wed, 1 Oct 2014 12:47:17 -0500

The state of structured data logging from applications is... sad.

The obvious thing to do would be to encode the typical syslog(3C)
function's format string as the MSGID and the varargs as the structured
data.  For various reasons this is a difficult thing to do (in C
anyways, and anywhere where a printf-like format string is used) and
thus, to my knowledge, no syslog client does it.  But it is doable, so
the thought occurs that we should standardize parameter names for
syslog()'s printf format arguments -- call it a profile if you wish.

On a related note, I *wish* RFC5424 had used JSON, not a horrible ad-hoc
structured data encoding.

Finally, if someone would kindly clue me in as to the status of RFC5424
clients with structured data support, I'd greatly appreciate it.  A
decent C RFC5424 client would be super convenient, though I'm afraid if
I really want it then I'll have to write it.

Nico
--

---

From: t.petch <[email-masked]>
Date: Thu, 2 Oct 2014 15:10:44 +0100

Nico

There is a syslog mailing list, which might be the place to ask; on the
other hand, the last syslog query I saw came up on OPSAWG - I am unsure
how many of those involved would see a post to apps-discuss.

At the time of writing RFC5424, JSON had yet to be the beam in anyone's
eye.

Tom Petch

---

From: Nico Williams <[email-masked]>
Date: Thu, 2 Oct 2014 10:48:22 -0500

> how many of those involved would see a post to apps-discuss.

Aha, thanks.  I'll ask there.

> At the time of writing RFC5424, JSON had yet to be the beam in anyone's

Well, numerically the first JSON RFC predates RFC5424...  But what I
really meant by that is that if there's not a lot of use of RFC5424
structured data then we might consider using JSON in the text payload of
syslog messages.  Since RFC5424 seems to be well supported by servers,
that's probably a non-starter, thus my lament: it's ETOOLATE.

Nico
--

---

From: Cabdirisaaq Mahamuud <[email-masked]>
Date: Sat, 4 Oct 2014 00:56:34 +0800

Discuss

On 10/2/14, Nico Williams <[email-masked]> wrote:
> _______________________________________________
> apps-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/apps-discuss
>

---

From: Cabdirisaaq Mahamuud <[email-masked]>
Date: Sat, 4 Oct 2014 01:02:38 +0800

ietfc.5424: Discuss.248x178