syslog from perl but no date (svlogd)

syslog from perl but no date (svlogd)

[Csillag Tamás]

Hi,

I am replacing syslogd with socklog on my server, I like it because it is
very clean and very simple.

The only problem I came across, is a date logging issue.
Let me explain: (I use socklog configuration created by socklog-conf)
If I run
# echo test | logger
The following line appears in the logs
user.notice: Jul 15 23:52:52 logger: test

But if I run the following perl script:

#!/usr/bin/perl

use Sys::Syslog qw(:DEFAULT setlogsock);

$syslog_socktype = 'unix'; # inet, unix, stream, console
$syslog_facility="mail";
$syslog_options="pid";
$syslog_priority="info";

setlogsock $syslog_socktype;
openlog $0, $syslog_options, $syslog_facility;
syslog $syslog_priority, "test";

The line is the following:
mail.info: example.pl[3449]: test

The problem is that the latter lack's the time/date information.
Most program works as expected but the perl based not.

I know that I can add a -t (or -tt) option to svlogd but it will add
time information to *all* lines AFAIK.

I do not know if this is a perl bug and syslogd works around the
problem, but it works right with it.

is something missing here?

Thanks in advance.

-- 
cstamas

Re: syslog from perl but no date (svlogd)

[Charlie Brady]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: TEXT/PLAIN; charset=X-UNKNOWN, Size: 1304 bytes --]


On Fri, 16 Jul 2004, Csillag[iso-8859-2] Tamás wrote:

> The only problem I came across, is a date logging issue.
> Let me explain: (I use socklog configuration created by socklog-conf)
> If I run
> # echo test | logger
> The following line appears in the logs
> user.notice: Jul 15 23:52:52 logger: test
> 
> But if I run the following perl script:
> 
> #!/usr/bin/perl
> 
> use Sys::Syslog qw(:DEFAULT setlogsock);
...
> The line is the following:
> mail.info: example.pl[3449]: test
> 
> The problem is that the latter lack's the time/date information.
> Most program works as expected but the perl based not.
> 
> I know that I can add a -t (or -tt) option to svlogd but it will add
> time information to *all* lines AFAIK.
> 
> I do not know if this is a perl bug and syslogd works around the
> problem, but it works right with it.

This is a problem with the syslog protocol. As you can see in
http://www.faqs.org/rfcs/rfc3164.html, the content of syslog messages is
ill-defined - essentially anything goes. Moreover, the recommended
TIMESTAMP format is in localtime, which as we've recently discussed here
is ambiguous. I'd recommend that you use -t or -tt in svlogd, and ignore
any timestamp which was supplied by the logging client. I guarantee you'll
be less confused taht way.

---
Charlie

Re: syslog from perl but no date (svlogd)

[Csillag Tamás]

On 07/15, Charlie Brady wrote:
> 
> On Fri, 16 Jul 2004, Csillag[iso-8859-2] Tamás wrote:
> 
> > The only problem I came across, is a date logging issue.
...
> > user.notice: Jul 15 23:52:52 logger: test
> > 
> > But if I run the following perl script:
> ...
> > The line is the following:
> > mail.info: example.pl[3449]: test
> > 
> > I know that I can add a -t (or -tt) option to svlogd but it will add
> > time information to *all* lines AFAIK.
> > 
> > I do not know if this is a perl bug and syslogd works around the
> > problem, but it works right with it.
> 
> This is a problem with the syslog protocol. As you can see in
> http://www.faqs.org/rfcs/rfc3164.html, the content of syslog messages is
> ill-defined - essentially anything goes. Moreover, the recommended
> TIMESTAMP format is in localtime, which as we've recently discussed here
> is ambiguous.
I read them before posting. (I agree)
> I'd recommend that you use -t or -tt in svlogd, and ignore
> any timestamp which was supplied by the logging client. I guarantee you'll
> be less confused taht way.
Yes but in this case I would like to omit 'Jul 15 23:52:52' part to only have
2004-07-16_22:35:35.00431 at the beginning of each line.

I will look to the code if it can be imlemented without messing up the
code.

Do you know what could be a prefered way?

Hmm, maybe some kind of processor can do the hard work for me.
Maybe a perl script? 

I will mail it here if I have a working solution.

-- 
cstamas

Re: syslog from perl but no date (svlogd)

[Csillag Tamás]

On 07/17, Csillag Tamás wrote:
> I will look to the code if it can be imlemented without messing up the
> code.
> 
> Do you know what could be a prefered way?
> 
> Hmm, maybe some kind of processor can do the hard work for me.
> Maybe a perl script? 
> 
> I will mail it here if I have a working solution.

What do you think about this perl script?
____________________________________________________
#!/usr/bin/perl

use warnings;
use strict;

my $l;

while($l=<STDIN>) {
 $l=~/(\d\d\d\d-\d\d-\d\d_\d\d:\d\d:\d\d.\d\d\d\d\d \w+.\w+:) \w\w\w \d\d \d\d:\d\d:\d\d (.+)/;
 if(defined $1 and defined $2) {
   print $1 . " " . $2 . "\n";
 }
 else {
   print $l;
 }
}
___________________________________________________
If I am not mistaken I can put this to svlogd's processor.
(!perl processor.pl | gzip -9)

$ cat file
2004-07-17_08:17:01.42255 user.notice: Jul 15 23:52:52 logger: test
3004-07-17_08:17:01.42255 mail.info: example.pl[3449]: test
4004-07-17_08:17:01.42255 user.notice: Jul 17 23:52:52 logger: test
5004-07-17_08:17:01.42255 mail.info: example.pl[3449]: test

$ cat file | perl processor.pl
2004-07-17_08:17:01.42255 user.notice: logger: test
3004-07-17_08:17:01.42255 mail.info: example.pl[3449]: test
4004-07-17_08:17:01.42255 user.notice: logger: test
5004-07-17_08:17:01.42255 mail.info: example.pl[3449]: test

-- 
cstamas

Re: syslog from perl but no date (svlogd)

[Clemens Fischer]

* Csillag Tamás:

> If I am not mistaken I can put this to svlogd's processor.
> (!perl processor.pl | gzip -9)

i think this is the most appropriate solution for the type of problem you
had, as opposed to changing anything in svlogd(1).

  clemens