On Tue Nov 16 19:55:02 2010, POWERMAN wrote:
Show quoted text> Yeah, I've read the RFC. But including HOSTNAME is just "RECOMMENDED",
> "SHOULD", and so on.
I don't see any such language specific to the hostname, only the
allowance that any message on port 514 is technically "valid". But even
so, I'm not convinced that deliberately emitting messages that violate
the recommendation is a good idea.
Show quoted text> And a most of standard tools (actually, all I've
> tested) doesn't include HOSTNAME. For example:
>
> 1) glibc: /usr/bin/logger (from util-linux-ng-2.17.2) using standard
> syslog(3):
> $ echo test | strace -ff logger 2>&1 | grep ^send
> send(1, "<13>Nov 17 02:39:42 logger: test", 32, MSG_NOSIGNAL) = 32
>
> 2) /usr/bin/logger, using it's own implementation:
> $ echo test | strace -ff logger -d -u /dev/log 2>&1 | grep ^write
> write(3, "<5>Nov 17 02:47:30 <someone>: te"..., 35) = 35
>
> 3) Sys::Syslog
> $ strace -ff perl -e 'use Sys::Syslog qw(:standard :macros); openlog
> ("myapp","pid",LOG_USER); syslog(LOG_INFO,"test")' 2>&1 | grep ^send
> send(3, "<14>Nov 17 02:42:32 myapp[26576]"..., 39, MSG_NOSIGNAL) =
> 39
Both of those only talk to the unix log socket. The messages that the
module send also need to be consumable by network log daemons.
Show quoted text>
> And common sense also says it doesn't really interesting to spam local
> logs with local hostname in every line, and doesn't really important to
> included hostname in messages sent to remote log if this hostname can't
> be trusted.
Can't you just configure your syslogger to omit that field in the
written logs? The client-to-logger wire format shouldn't matter.
I guess I'm not understanding what benefit is provided by this change
that justifies added complexity and violating the recommendation of the RFC.
