Documentation Request: Method Justification

[w3ttr3y]

I very much appreciate that you are freely sharing this repository and its evident that you've invested a bit of time and effort. I thought it might be helpful to document why you do are filtering messages like this in order to help people better decide if they should utilize your project. In the end, I hope this will help you gain more users instead of people re-inventing the wheel.

Please don't take this as a criticism or me advocating to change how you do things; this is merely a request to document what you feel are the advantages to your methodology.

For example, why bother listing each program separately? Why not just use $PROGRAM in the destination path?

destination files_known {
    file("/var/log/$YEAR.$MONTH.$DAY/$HOST/$PROGRAM");
};

If you are going to list program, why not have one big filter for "known" programs

filter known_program {
    program("cron") or [...]
}

source foo { [...] }
destination files_known {
  file("/var/log/$YEAR.$MONTH.$DAY/$HOST/$PROGRAM");
}
destination files_unknown {
  file("/var/log/$YEAR.$MONTH.$DAY/$HOST/unknown-$FACILITY");
}
log {
    source(foo);
    filter(known_program);
    rewrite(rewrite_program);
    destination(files_known);
    flags(final);
};
log {
    source(foo);
    destination(files_unknown);
};

[paraenggu]

Thanks for your feedback!

this is merely a request to document what you feel are the advantages to your methodology.

in the first place, personal (company wide) preferences - we like to have a log file per daemon/service and prefer to log almost everything to syslog. Secondly, we've tried to keep things flexible for other use cases (support special filtering or destination needs per daemon/service which are easily overridable per file). However, we never intended to create THE solution for all logging needs out there :-) The configuration was created many years ago and has worked out since then for us - so we decided to simply share it.

For example, why bother listing each program separately? Why not just use $PROGRAM in the destination path?

destination files_known {
file("/var/log/$YEAR.$MONTH.$DAY/$HOST/$PROGRAM");
};

This is an interesting approach which we also tried out in the past, it worked quite well for ~99% of all daemons/services, but there were a few special cases (for example mod_php.conf, where the actual program is apache), apart from that you loose a bit of flexibility (like setting special permissions or other file() related options per log).

Nevertheless, the whole concept was created many years ago and could probably be simplified or re-factored in some ways. But since the advent of systemd/journald the (local) syslog configuration will probably loose attention anyway (except for remote syslog servers).