klog format changes for kernel3.5

[William Heinbockel]

Just saw this...

Looks like Linus accepted the updated udev log code from Kay and Lennart and will be making their appearance in kernel3.5:

http://www.h-online.com/open/news/item/Significant-improvements-coming-in-Li...
https://lwn.net/Articles/492125/

I am not too sure on the format though. Looks similar to auditd, which worries me because of the inconsistencies with quoting and spaces in its grammar.

Thoughts?

[Balazs Scheidler]

I saw that too. I couldn't check, but my impression was that it is possible to query the log in a structured way, and not just the textual format.

----- Original message -----
> Just saw this...
>
> Looks like Linus accepted the updated udev log code from Kay and Lennart
> and will be making their appearance in kernel3.5:
>
> http://www.h-online.com/open/news/item/Significant-improvements-coming-in-Li...
> https://lwn.net/Articles/492125/
>
> I am not too sure on the format though. Looks similar to auditd, which
> worries me because of the inconsistencies with quoting and spaces in its
> grammar.
>
> Thoughts?
> _______________________________________________
> lumberjack-developers mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/lumberjack-developers

[Miloslav Trmač]

----- Original Message -----
> Just saw this...
>
> Looks like Linus accepted the updated udev log code from Kay and
> Lennart and will be making their appearance in kernel3.5:
>
> http://www.h-online.com/open/news/item/Significant-improvements-coming-in-Li...
> https://lwn.net/Articles/492125/
>
> I am not too sure on the format though. Looks similar to auditd,
> which worries me because of the inconsistencies with quoting and
> spaces in its grammar.

The LWN article is a fairly precise description of the API and output format.

I'm afraid the API is rather loose - the "dict" value is a \0-separated (not space-separated as claimed in the article) list of records that are supposedly NAME=value, but no format checking or enforcement happens.

When the values are read from /dev/kmsg, non-ASCII or unprintable characters are escaped using \xNN (which should be enough to handle anything except for NULs embedded in values) , but notably \ itself isn't escaped!  I'll send an email to Kay about that, hopefully we can still get it fixed.
    Mirek