Re: /bin/sh
Tollef Fog Heen <tfheen@err.no> writes:
> ]] "brian m. carlson"
>> It means that it works completely differently from every existing Unix
>> log parser on the planet. syslog is hardly "no formatting at all".
> syslog and other log files isn't structured particularly well.
That's the understatement of the year. I'm not sure which part of the
traditional syslog format is more fun. Is it the missing year in the
timestamp? Is it the program field that may or may not be present? Is it
the PID field that's sometimes not a PID at all?
There are syslog plain-text file formats that are almost sane and use some
sort of structured key-value syntax that you can parse normally. The
default, however, is not.
I've written a *lot* of syslog parsers for various log analysis problems.
One of the biggest problems for large-scale log analysis if you care about
the timestamps is that parsing human-readable dates into something useful,
like seconds from epoch, is *painfully* slow. For grins, try stracing a
typical syslog log parser that hasn't been extensively optimized and watch
the gettimeofday() and stat("/etc/localtime") calls scroll as fast as your
terminal can display them.
--
Russ Allbery (rra@debian.org) <http://www.eyrie.org/~eagle/>
Reply to: