Re: [RFC] changes to rsyslog - default to RFC 5424 format

2021-12-19 Thread Michael Biebl
On 18.12.21 21:57, Roger Lynn wrote: On 18/12/2021 15:00, Michael Biebl wrote: I'm not a user of logwatch, so I don't know, if logwatch nowadays can handle RFC 5424 timestamps, but even if so, I think the benefits outweigh the potential breakage. And it's easy enough for users to create a drop-i

Re: [RFC] changes to rsyslog - default to RFC 5424 format

2021-12-18 Thread Roger Lynn
On 18/12/2021 15:00, Michael Biebl wrote: I'm not a user of logwatch, so I don't know, if logwatch nowadays can handle RFC 5424 timestamps, but even if so, I think the benefits outweigh the potential breakage. And it's easy enough for users to create a drop-in config snippet with $ActionFileDefa

Re: [RFC] changes to rsyslog - default to RFC 5424 format

2021-12-18 Thread Philip Wyett
On Sat, 2021-12-18 at 15:58 +0100, Michael Biebl wrote: > Am 23.11.21 um 23:53 schrieb Scott Kitterman: > > On Tuesday, November 23, 2021 3:49:17 PM EST Simon Josefsson wrote: > > > Michael Biebl writes: > > > > Hi, > > > > > > > > we are early in the bookworm release cycle, so I guess it's the >

Re: [RFC] changes to rsyslog - default to RFC 5424 format

2021-12-18 Thread Michael Biebl
Am 23.11.21 um 23:53 schrieb Scott Kitterman: On Tuesday, November 23, 2021 3:49:17 PM EST Simon Josefsson wrote: Michael Biebl writes: Hi, we are early in the bookworm release cycle, so I guess it's the perfect time to bring up this topic. Sorry for hijacking the thread, but perhaps now is

Re: [RFC] changes to rsyslog - default to RFC 5424 format

2021-11-23 Thread Scott Kitterman
On Tuesday, November 23, 2021 3:49:17 PM EST Simon Josefsson wrote: > Michael Biebl writes: > > Hi, > > > > we are early in the bookworm release cycle, so I guess it's the > > perfect time to bring up this topic. > > Sorry for hijacking the thread, but perhaps now is a good time to stop > using

Re: [RFC] changes to rsyslog - default to RFC 5424 format

2021-11-23 Thread Simon Josefsson
Michael Biebl writes: > Hi, > > we are early in the bookworm release cycle, so I guess it's the > perfect time to bring up this topic. Sorry for hijacking the thread, but perhaps now is a good time to stop using the legacy syslog time format and use the standardized RFC 5424 format? It is the d

Re: [RFC] changes to rsyslog

2021-11-23 Thread RL
Holger Levsen writes: > On Wed, Nov 17, 2021 at 10:57:11AM +0800, Paul Wise wrote: >> > Do you know of a tool that does what logcheck does, but operating >> > directly on the journal?  Logcheck is the only reason I still have >> > rsyslog installed on the servers I maintain. > > same here, I use

Re: [RFC] changes to rsyslog

2021-11-20 Thread Trent W. Buck
Paul Wise writes: > On Tue, 2021-11-16 at 17:57 -0500, Zack Weinberg wrote: >> Do you know of a tool that does what logcheck does, but operating >> directly on the journal?  Logcheck is the only reason I still have >> rsyslog installed on the servers I maintain. > > https://github.com/cyberitsolu

Re: [RFC] changes to rsyslog

2021-11-20 Thread Holger Levsen
On Wed, Nov 17, 2021 at 10:57:11AM +0800, Paul Wise wrote: > > Do you know of a tool that does what logcheck does, but operating > > directly on the journal?  Logcheck is the only reason I still have > > rsyslog installed on the servers I maintain. same here, I use (and tune) logcheck on all syste

Re: [RFC] changes to rsyslog

2021-11-16 Thread Paul Wise
On Tue, 2021-11-16 at 17:57 -0500, Zack Weinberg wrote: > Do you know of a tool that does what logcheck does, but operating > directly on the journal?  Logcheck is the only reason I still have > rsyslog installed on the servers I maintain. There are some similar things: journalctl --grep https:

Re: [RFC] changes to rsyslog

2021-11-16 Thread Zack Weinberg
> I would thus like to proceed and change the priority of rsyslog from > important to optional, which in turn would mean, it is no longer installed by > default. Do you know of a tool that does what logcheck does, but operating directly on the journal? Logcheck is the only reason I still have

Re: [RFC] changes to rsyslog

2021-11-13 Thread Bastian Blank
On Sat, Nov 13, 2021 at 04:40:04PM -0500, Roberto C. Sánchez wrote: > I'm not sure if this a directly relevant question (apologies if it is > not), but is there migration path to allow bringing legacy log data > *into* the systemd journal[*] to allow for accessing log data through a > single interf

Re: [RFC] changes to rsyslog

2021-11-13 Thread Roberto C . Sánchez
On Sat, Nov 13, 2021 at 10:43:48PM +0100, Michael Biebl wrote: > On 13.11.21 22:40, Roberto C. Sánchez wrote: > > On Sat, Nov 13, 2021 at 10:32:23PM +0100, Michael Biebl wrote: > > > > > > - Existing systems will continue to have rsyslog installed (but they can > > > safely uninstall rsyslog) > >

Re: [RFC] changes to rsyslog

2021-11-13 Thread Michael Biebl
On 13.11.21 22:40, Roberto C. Sánchez wrote: On Sat, Nov 13, 2021 at 10:32:23PM +0100, Michael Biebl wrote: - Existing systems will continue to have rsyslog installed (but they can safely uninstall rsyslog) I'm not sure if this a directly relevant question (apologies if it is not), but is the

Re: [RFC] changes to rsyslog

2021-11-13 Thread Roberto C . Sánchez
On Sat, Nov 13, 2021 at 10:32:23PM +0100, Michael Biebl wrote: > > - Existing systems will continue to have rsyslog installed (but they can > safely uninstall rsyslog) > I'm not sure if this a directly relevant question (apologies if it is not), but is there migration path to allow bringing legac