-
-
Notifications
You must be signed in to change notification settings - Fork 57
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add support for rsyslog lumberjack mechanism #92
Conversation
Thank you for your pull request. I won't have time to properly review your changes until next week, so please have a little patience. One question that came to my mind right away: Would it not be easier to add a configurable prefix parameter to the existing code? |
On August 16, 2022 6:25:52 PM GMT+02:00, Hilko Bengen ***@***.***> wrote:
Thank you for your pull request. I won't have time to properly review your changes until next week, so please have a little patience.
Don't worry! I am in no hurry. Thanks for considering it.
One question that came to my mind right away: Would it not be easier to add a configurable prefix parameter to the existing code?
It would be surely possible, and I can do it if you want. I did not do it because it seemed to me that this feature is only relevant with that specified prefix :)
Do you think that an optional `lumberjack_prefix` parameter in the configuration would do?
…--
blallo
|
I think something like --- a/src/config.rs
+++ b/src/config.rs
@@ -12,6 +12,8 @@ pub struct Logfile {
pub users: Option<Vec<String>>,
pub size: Option<u64>,
pub generations: Option<u64>,
+ #[serde(rename="line-prefix")]
+ pub line_prefix: Option<String>,
}
#[derive(Clone,Debug,Default,Serialize,Deserialize,PartialEq)] plus corresponding changes in FileRotate should suffice. |
Hi, sorry for the long silence!
I did not understand your proposed solutions. As a matter of fact, I plugged this capability in the I saw there are a bunch of conflicts, probably because you merged another PR and the Thanks! EDIT: I just saw that the conflict comes from the fact that you applied EDIT 2: I rebased without conflicts (:heart:); seems too good to be true. So I guess this is again the main PR. |
This commit introduces a custom writer that prepends the lumberjack cookie "@Cee:" to each line being written. It does so in a buffered manner, where the buffer size is given by line number, mimicking the BufWriter.
This commit adds a new config section with a single parameter, the boolean "lumberjack", to enable the use of LumberjackWriter as writer for the laurel logs.
@leophys Sorry if I had not stated clearly enough what I was going for. Please have a look at https://github.com/hillu/laurel/tree/feature/lumberjack – here the line prefix is just added to the Does this do what you originally intended? |
Ahahahahah, nice! It is so much cleaner than my current PR! It seems to me that it is exactly what I meant it to do. |
Great, I'm going to push my change then. I would like to give credit to you in the commit message and in the changelog for the next release. What name should I use? |
Yes please!
Thanks! You can use my github handle :) |
Hi! Thanks for this software!
I am opening this PR to add a functionality I am interested in to better integrate the
auditd
machinery together withrsyslog
. The juice of the feature regards the ability for rsyslog to be able to recognize the beginning of a json structure in a log line. This is achieved prepending a cookie (@cee:
) before the log line. In the case oflaurel
as anauditd
plugin, this means that such cookie should be present at the beginning of each line. I thought first of implementing a custom serde serializer, but this is impossible as a serializer has no notion of level and cannot tell when an object is at the beginning of a line. The approach I took here is to use a custom Writer (an implementation ofstd::io::Write
) that mimics aBufWriter
, buffering in an internal buffer per line instead of using the byte size as measure.To enable this mechanism, I added a new section in the configuration file, with a single boolean option
that defaults to
false
(the current behavior).You will notice that there are A LOT of lines in the PR diff. This is because I use (neo)vim and
rust-analyzer
in the language server machinery. It is not feasible for me to work without it and this machinery autoformats the code at each save. I runcargo fmt
on the whole code base and saved it as first commit. The remaining commits in the PR implement what I described above. I beg you to accept this not as a disrespectful act, but rather as a way for you and me to foster public collaboration 😇