Re: [lumberjack] [ANN] libumberlog 0.1.1 released!

[Rainer Gerhards]

Congrats,  very useful :-)

Rainer 

Gergely Nagy <algernon(a)balabit.hu&gt; hat
geschrieben:---------------------------------------------------------------
PACKAGE   : libumberlog
VERSION   : 0.1.1
SUMMARY   : First (public) stable release
DATE      : 2012 April 2
HOMEPAGE  : http://algernon.github.com/libumberlog/
---------------------------------------------------------------

DESCRIPTION:

  The libumberlog library is a a thin layer over the traditional
  syslog() function that turns your legacy syslog messages into
  structured logs, so that the message part becomes a JSON string (see
  the example below), with a couple of extra fields added by default: a
  high-precision timestamp, uid, gid, and pid, to name a few.

  The library can be used as a system-wide LD_PRELOAD-ed library,
  turning every syslog() message into the improved format, or it can be
  LD_PRELOAD-ed on a case-by-case basis, or even linked to, in which
  case it provides a few other functions, mentioned below.

EXAMPLE:

  Mar 24 12:01:34 localhost sshd[12590]: @cee:{
      "msg": "Accepted publickey for algernon from 127.0.0.1 port 55519
ssh2",
      "pid": "12590", "facility": "auth",
"priority": "info",
      "program": "sshd", "uid": "0",
"gid": "0",
      "host": "hadhodrond", "timestamp":
"2012-03-24T12:01:34.236987887+0100" }

FEATURES:

  The library supports LD_PRELOAD (and has been used in such capacity on
  production systems), turning legacy messages into something little bit
  more structured, yet, backwards compatible.

  It also introduces a few new functions, namely ul_format() and
  ul_syslog(), that allow one to make use of structured logging even
  better, by allowing them to include arbitrary key-value pairs in the
  message.

  Credits
  =======

  The library has been written by Gergely Nagy <algernon(a)balabit.hu&gt;,
  with invaluable feedback from members of Project Lumberjack, an
  open-source initiative to update and enhance the event log
  architecture.

DOWNLOADS:

  The source is available from the git repository at github:
    git://github.com/algernon/libumberlog.git

  A source tarball has also been released, and is available via github
  aswell, at:
    https://github.com/downloads/algernon/libumberlog/libumberlog-0.1.1.tar.gz

  Documentation and more information about the library is available on
  its homepage at http://algernon.github.com/libumberlog/. For more
  information about Project Lumberjack, please see their homepage at
  https://fedorahosted.org/lumberjack/, and the mailing list at
  https://fedorahosted.org/mailman/listinfo/lumberjack-developers

-- 
|8]

_______________________________________________
lumberjack-developers mailing list
lumberjack-developers(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/lumberjack-developers

[ANN] libumberlog 0.1.1 released!

[Brian Knox]

One question:

Is the spec for "cee enchanced rf3164" going to be:
@cee: { JSON GOES HERE}  (space after @cee:)

or

@cee:{ JSON GOES HERE } (no space after @cee)

I've seen two implementations (rsyslog has a space) so wanted to ask.

I've been playing with the library and the LD_PRELOAD functionality today -
working great!

Brian

On Mon, Apr 2, 2012 at 3:03 PM, Rainer Gerhards <rgerhards(a)hq.adiscon.com&gt;wrote:

>  Congrats,  very useful :-)
>
>  Rainer
>
>  Gergely Nagy <algernon(a)balabit.hu&gt; hat
>  geschrieben:---------------------------------------------------------------
>  PACKAGE   : libumberlog
>  VERSION   : 0.1.1
>  SUMMARY   : First (public) stable release
>  DATE      : 2012 April 2
>  HOMEPAGE  : http://algernon.github.com/libumberlog/
>  ---------------------------------------------------------------
>
>  DESCRIPTION:
>
>   The libumberlog library is a a thin layer over the traditional
>   syslog() function that turns your legacy syslog messages into
>   structured logs, so that the message part becomes a JSON string (see
>   the example below), with a couple of extra fields added by default: a
>   high-precision timestamp, uid, gid, and pid, to name a few.
>
>   The library can be used as a system-wide LD_PRELOAD-ed library,
>   turning every syslog() message into the improved format, or it can be
>   LD_PRELOAD-ed on a case-by-case basis, or even linked to, in which
>   case it provides a few other functions, mentioned below.
>
>  EXAMPLE:
>
>   Mar 24 12:01:34 localhost sshd[12590]: @cee:{
>       "msg": "Accepted publickey for algernon from 127.0.0.1 port 55519
>  ssh2",
>       "pid": "12590", "facility": "auth",
> "priority": "info",
>       "program": "sshd", "uid": "0",
> "gid": "0",
>       "host": "hadhodrond", "timestamp":
>  "2012-03-24T12:01:34.236987887+0100" }
>
>  FEATURES:
>
>   The library supports LD_PRELOAD (and has been used in such capacity on
>   production systems), turning legacy messages into something little bit
>   more structured, yet, backwards compatible.
>
>   It also introduces a few new functions, namely ul_format() and
>   ul_syslog(), that allow one to make use of structured logging even
>   better, by allowing them to include arbitrary key-value pairs in the
>   message.
>
>   Credits
>   =======
>
>   The library has been written by Gergely Nagy <algernon(a)balabit.hu&gt;,
>   with invaluable feedback from members of Project Lumberjack, an
>   open-source initiative to update and enhance the event log
>   architecture.
>
>  DOWNLOADS:
>
>   The source is available from the git repository at github:
>     git://github.com/algernon/libumberlog.git
>
>   A source tarball has also been released, and is available via github
>   aswell, at:
>
>  https://github.com/downloads/algernon/libumberlog/libumberlog-0.1.1.tar.gz
>
>   Documentation and more information about the library is available on
>   its homepage at http://algernon.github.com/libumberlog/. For more
>   information about Project Lumberjack, please see their homepage at
>   https://fedorahosted.org/lumberjack/, and the mailing list at
>   https://fedorahosted.org/mailman/listinfo/lumberjack-developers
>
>  --
>  |8]
>
>  _______________________________________________
>  lumberjack-developers mailing list
>  lumberjack-developers(a)lists.fedorahosted.org
>  https://fedorahosted.org/mailman/listinfo/lumberjack-developers
>  _______________________________________________
>  lumberjack-developers mailing list
>  lumberjack-developers(a)lists.fedorahosted.org
>  https://fedorahosted.org/mailman/listinfo/lumberjack-developers
>

[ANN] libumberlog 0.1.1 released!

[Gergely Nagy]

Brian Knox <briank(a)talksum.com&gt; writes:

>  One question:
>
>  Is the spec for "cee enchanced rf3164" going to be:
>  @cee: { JSON GOES HERE}  (space after @cee:)
>
>  or
>
>  @cee:{ JSON GOES HERE } (no space after @cee)
>
>  I've seen two implementations (rsyslog has a space) so wanted to ask. 
Actually, I do not know. I seem to recall that the original intent was
to not have any unnecessary whitespace in the payload, so libumberlog
doesn't add a space after "@cee:". I still need to fix the lib to emit
JSON that doesn't have unneccessary whitespace, but that's a bit more
work.

>  I've been playing with the library and the LD_PRELOAD
> functionality today -
>  working great! 
I hope it does! My desktop at work, and my router has been running with
it LD_PRELOAD'ed system-wide :)

-- 
|8]

[ANN] libumberlog 0.1.1 released!

[Rainer Gerhards]

The original plan was to use "@cee:<SP>" to better ensure that the cookie
really is cee. HOWEVER, I expect that both methods (even multiple whitespace)
will be in use...

Rainer

>  -----Original Message-----
>  From: lumberjack-developers-bounces(a)lists.fedorahosted.org
>  [mailto:[e-mail]] On Behalf
>  Of Brian Knox
>  Sent: Monday, April 02, 2012 11:29 PM
>  To: lumberjack logging
>  Subject: Re: [lumberjack] [ANN] libumberlog 0.1.1 released!
>  
>  One question:
>  
>  Is the spec for "cee enchanced rf3164" going to be:
>  @cee: { JSON GOES HERE}  (space after @cee:)
>  
>  or
>  
>  @cee:{ JSON GOES HERE } (no space after @cee)
>  
>  I've seen two implementations (rsyslog has a space) so wanted to ask.
>  
>  I've been playing with the library and the LD_PRELOAD functionality
>  today - working great!
>  
>  Brian
>  
>  
>  On Mon, Apr 2, 2012 at 3:03 PM, Rainer Gerhards
>  <rgerhards(a)hq.adiscon.com&gt; wrote:
>  
>  
>  	Congrats,  very useful :-)
>  
>  	Rainer
>  
>  	Gergely Nagy <algernon(a)balabit.hu&gt; hat geschrieben:--------------
>  -------------------------------------------------
>  
>  	PACKAGE   : libumberlog
>  	VERSION   : 0.1.1
>  	SUMMARY   : First (public) stable release
>  	DATE      : 2012 April 2
>  	HOMEPAGE  : http://algernon.github.com/libumberlog/
>  	---------------------------------------------------------------
>  
>  	DESCRIPTION:
>  
>  	 The libumberlog library is a a thin layer over the traditional
>  	 syslog() function that turns your legacy syslog messages into
>  	 structured logs, so that the message part becomes a JSON string
>  (see
>  	 the example below), with a couple of extra fields added by
>  default: a
>  	 high-precision timestamp, uid, gid, and pid, to name a few.
>  
>  	 The library can be used as a system-wide LD_PRELOAD-ed library,
>  	 turning every syslog() message into the improved format, or it
>  can be
>  	 LD_PRELOAD-ed on a case-by-case basis, or even linked to, in
>  which
>  	 case it provides a few other functions, mentioned below.
>  
>  	EXAMPLE:
>  
>  	 Mar 24 12:01:34 localhost sshd[12590]: @cee:{
>  	     "msg": "Accepted publickey for algernon from 127.0.0.1 port
>  55519 ssh2",
>  	     "pid": "12590", "facility": "auth",
> "priority": "info",
>  	     "program": "sshd", "uid": "0",
> "gid": "0",
>  	     "host": "hadhodrond", "timestamp": "2012-03-
>  24T12:01:34.236987887+0100" }
>  
>  	FEATURES:
>  
>  	 The library supports LD_PRELOAD (and has been used in such
>  capacity on
>  	 production systems), turning legacy messages into something
>  little bit
>  	 more structured, yet, backwards compatible.
>  
>  	 It also introduces a few new functions, namely ul_format() and
>  	 ul_syslog(), that allow one to make use of structured logging
>  even
>  	 better, by allowing them to include arbitrary key-value pairs in
>  the
>  	 message.
>  
>  	 Credits
>  	 =======
>  
>  	 The library has been written by Gergely Nagy
>  <algernon(a)balabit.hu&gt;,
>  	 with invaluable feedback from members of Project Lumberjack, an
>  	 open-source initiative to update and enhance the event log
>  	 architecture.
>  
>  	DOWNLOADS:
>  
>  	 The source is available from the git repository at github:
>  	   git://github.com/algernon/libumberlog.git
>  
>  	 A source tarball has also been released, and is available via
>  github
>  	 aswell, at:
>  	   https://github.com/downloads/algernon/libumberlog/libumberlog-
>  0.1.1.tar.gz
>  
>  	 Documentation and more information about the library is
>  available on
>  	 its homepage at http://algernon.github.com/libumberlog/. For
>  more
>  	 information about Project Lumberjack, please see their homepage
>  at
>  	 https://fedorahosted.org/lumberjack/, and the mailing list at
>  	 https://fedorahosted.org/mailman/listinfo/lumberjack-developers
>  
>  	--
>  	|8]
>  
>  	_______________________________________________
>  	lumberjack-developers mailing list
>  	lumberjack-developers(a)lists.fedorahosted.org
>  	https://fedorahosted.org/mailman/listinfo/lumberjack-developers
>  	_______________________________________________
>  	lumberjack-developers mailing list
>  	lumberjack-developers(a)lists.fedorahosted.org
>  	https://fedorahosted.org/mailman/listinfo/lumberjack-developers
>  
>

[ANN] libumberlog 0.1.1 released!

[William Heinbockel]

Awesome!
I think we should specify one way (either with or without SP), but
write parsers that will accept SP* character. May set the
specification to 1 SP, but allow 0-* SP?

The next (final?) step is just to agree to field names and discuss
what we should

Gergely: I wouldn't worry too much about the stripping of the
whitespace. I don't mind SP or TAB, just no CR or LF.

On Tue, Apr 3, 2012 at 2:13 AM, Rainer Gerhards
<rgerhards(a)hq.adiscon.com&gt; wrote:
>  The original plan was to use "@cee:<SP>" to better
> ensure that the cookie
>  really is cee. HOWEVER, I expect that both methods (even multiple whitespace)
>  will be in use...
>
>  Rainer
>
> > -----Original Message-----
> > From: lumberjack-developers-bounces(a)lists.fedorahosted.org
> > [mailto:[e-mail]] On Behalf
> > Of Brian Knox
> > Sent: Monday, April 02, 2012 11:29 PM
> > To: lumberjack logging
> > Subject: Re: [lumberjack] [ANN] libumberlog 0.1.1 released!
> >
> > One question:
> >
> > Is the spec for "cee enchanced rf3164" going to be:
> > @cee: { JSON GOES HERE}  (space after @cee:)
> >
> > or
> >
> > @cee:{ JSON GOES HERE } (no space after @cee)
> >
> > I've seen two implementations (rsyslog has a space) so wanted to ask.
> >
> > I've been playing with the library and the LD_PRELOAD functionality
> > today - working great!
> >
> > Brian
> >
> >
> > On Mon, Apr 2, 2012 at 3:03 PM, Rainer Gerhards
> > <rgerhards(a)hq.adiscon.com&gt; wrote:
> >
> >
> >       Congrats,  very useful :-)
> >
> >       Rainer
> >
> >       Gergely Nagy <algernon(a)balabit.hu&gt; hat geschrieben:--------------
> > -------------------------------------------------
> >
> >       PACKAGE   : libumberlog
> >       VERSION   : 0.1.1
> >       SUMMARY   : First (public) stable release
> >       DATE      : 2012 April 2
> >       HOMEPAGE  : http://algernon.github.com/libumberlog/
> >       ---------------------------------------------------------------
> >
> >       DESCRIPTION:
> >
> >        The libumberlog library is a a thin layer over the traditional
> >        syslog() function that turns your legacy syslog messages into
> >        structured logs, so that the message part becomes a JSON string
> > (see
> >        the example below), with a couple of extra fields added by
> > default: a
> >        high-precision timestamp, uid, gid, and pid, to name a few.
> >
> >        The library can be used as a system-wide LD_PRELOAD-ed library,
> >        turning every syslog() message into the improved format, or it
> > can be
> >        LD_PRELOAD-ed on a case-by-case basis, or even linked to, in
> > which
> >        case it provides a few other functions, mentioned below.
> >
> >       EXAMPLE:
> >
> >        Mar 24 12:01:34 localhost sshd[12590]: @cee:{
> >            "msg": "Accepted publickey for algernon from 127.0.0.1
> port
> > 55519 ssh2",
> >            "pid": "12590", "facility":
> "auth", "priority": "info",
> >            "program": "sshd", "uid": "0",
> "gid": "0",
> >            "host": "hadhodrond", "timestamp":
> "2012-03-
> > 24T12:01:34.236987887+0100" }
> >
> >       FEATURES:
> >
> >        The library supports LD_PRELOAD (and has been used in such
> > capacity on
> >        production systems), turning legacy messages into something
> > little bit
> >        more structured, yet, backwards compatible.
> >
> >        It also introduces a few new functions, namely ul_format() and
> >        ul_syslog(), that allow one to make use of structured logging
> > even
> >        better, by allowing them to include arbitrary key-value pairs in
> > the
> >        message.
> >
> >        Credits
> >        =======
> >
> >        The library has been written by Gergely Nagy
> > <algernon(a)balabit.hu&gt;,
> >        with invaluable feedback from members of Project Lumberjack, an
> >        open-source initiative to update and enhance the event log
> >        architecture.
> >
> >       DOWNLOADS:
> >
> >        The source is available from the git repository at github:
> >          git://github.com/algernon/libumberlog.git
> >
> >        A source tarball has also been released, and is available via
> > github
> >        aswell, at:
> >          https://github.com/downloads/algernon/libumberlog/libumberlog-
> > 0.1.1.tar.gz
> >
> >        Documentation and more information about the library is
> > available on
> >        its homepage at http://algernon.github.com/libumberlog/. For
> > more
> >        information about Project Lumberjack, please see their homepage
> > at
> >        https://fedorahosted.org/lumberjack/, and the mailing list at
> >        https://fedorahosted.org/mailman/listinfo/lumberjack-developers
> >
> >       --
> >       |8]
> >
> >       _______________________________________________
> >       lumberjack-developers mailing list
> >       lumberjack-developers(a)lists.fedorahosted.org
> >       https://fedorahosted.org/mailman/listinfo/lumberjack-developers
> >       _______________________________________________
> >       lumberjack-developers mailing list
> >       lumberjack-developers(a)lists.fedorahosted.org
> >       https://fedorahosted.org/mailman/listinfo/lumberjack-developers
> >
> >
>
>  _______________________________________________
>  lumberjack-developers mailing list
>  lumberjack-developers(a)lists.fedorahosted.org
>  https://fedorahosted.org/mailman/listinfo/lumberjack-developers