<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/4.1.92">
<TITLE>@@weblog</TITLE>
</HEAD>
<BODY>
<BR>
<H1>
<B><FONT SIZE="6"><A HREF="http://bazsi.blogs.balabit.com/2012/02/project-lumberjack-to-improve-linux-logging/">Project Lumberjack to improve Linux logging</A></FONT></B>
</H1>
In a lively discussion at the RedHat offices two weeks ago in Brno, a number of well respected individuals were discussing how logging in general, and Linux logging in particular could be improved. As you may have guessed I was invited because of syslog-ng, but representatives of other logging related projects were also in nice numbers: Steve Gibbs (auditd), Lennart Poettering (systemd, journald), Rainer Gerhards (rsyslog), William Heinbockel (CEE, Mitre) and a number of nice people from the RedHat team.<BR>
<BR>
We discussed a couple of pain points for logging, logging is usually an afterthought during development, computer based processing, correllation of application logs is nearly impossible. We roughly agreed that the key to improve the situation is to involve the community at large, initiate a momentum and try to get application developers on board and have them create structured logs. We also agreed that this will not happen overnight and we need to take a gradual approach.<BR>
<BR>
To move into that direction, the benefits of good logging needs to be communicated and delivered to both application developers and their users.<BR>
<BR>
We also talked about what kind of building blocks are needed to deliver a solution fast, and concluded that we basically have everything available, and even better they are open source. The key is to tie these components together, document best practices and perhaps provide better integration.<BR>
<BR>
Thus project Lumberjack was born, hosted as a Fedora project at <A HREF="https://fedorahosted.org/lumberjack/">https://fedorahosted.org/lumberjack/</A>.<BR>
<BR>
The building blocks that need some care are:<BR>
<BR>
<UL>
<LI>some applications already produce logs in structured format, those should be integrated (auditd for instance)
<LI>we need to define a mechanism to submit structured logs to local logging services for further processing (ELAPI and some enhanced syslog)
<LI>we need to make sure that local logging services cope with structured data (already available for a long time now)
<LI>we need to define a mechanism to store messages in a structured form and a way query them
<LI>last, but not least we need to define a naming scheme for event data which CEE can bring to the table
</UL>
<BR>
Most of these is already possible by using a combination of tools and proper configuration, however learning how to do this is not a trivial undertaking for those who only want to develop or use applications.<BR>
<BR>
Changing that is the primary aim of <A HREF="https://fedorahosted.org/lumberjack/">Project Lumberjack.</A> If you are interested in logging, make sure to check that out.<BR>
<BR>
<BR>
<BR>
<BR>
<BR>
<BR>
<BR>
</BODY>
</HTML>