[evlog-dev] Program name issue

"O'Riordain, Seosamh" <[email protected]> Thu, 30 Oct 2003 11:56:39 -0000
Newsgroups	gmane.linux.kernel.event-logging
Message-ID	<0CA17FFA5554E4439FC308750A6661E505C820F1@iloexc01.emea.cpqcorp.net>
This is a multi-part message in MIME format.

------_=_NextPart_001_01C39EDC.E068F4B6
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi,

I've been looking at using evlog as a replacement for syslog, and also
for being a central log consolidator. Now it provides plenty of
excellent features that
I can and want to use. The only thing it doesn't provide compared to
syslog, is the program=20
name. See below, for a comparison in output of syslog and evlog created
by doing an rsh=20
to a machine.=20

/var/log/messages extract
Oct 30 11:33:46 angel2 pam_rhosts_auth[27509]: allowed to root@angel3 as
root
Oct 30 11:33:46 angel2 login(pam_unix)[27510]: session opened for user
root by (uid=3D0)
Oct 30 11:33:46 angel2 login -- root[27510]: ROOT LOGIN ON pts/1 FROM
angel3

evlview -n --syslog
Oct 30 11:33:46 angel2 allowed to root@angel3 as root
Oct 30 11:33:46 angel2 session opened for user root by (uid=3D0)
Oct 30 11:33:46 angel2 ROOT LOGIN ON pts/1 FROM angel3

On the central log server, when viewing the logs for this host (current
or archived) one would=20
not be able to tell what program caused these or whether one used rsh or
some other login mechanism,=20
say ssh.

My questions become, was this a deliberate decision not to provide the
program name
in evlog ?
What would it take to provide this functionality ?
Thanks.

/Regards/Seo


------_=_NextPart_001_01C39EDC.E068F4B6
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">
<META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version =
6.0.6396.0">
<TITLE>Program name issue</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->

<P><FONT SIZE=3D2 FACE=3D"Arial">Hi,</FONT>
</P>

<P><FONT SIZE=3D2 FACE=3D"Arial">I've been looking at using evlog as a =
replacement for syslog, and also</FONT>

<BR><FONT SIZE=3D2 FACE=3D"Arial">for being a central log consolidator. =
Now it provides plenty of excellent features that</FONT>

<BR><FONT SIZE=3D2 FACE=3D"Arial">I can and want to use. The only thing =
it doesn't provide compared to syslog, is the program </FONT>

<BR><FONT SIZE=3D2 FACE=3D"Arial">name. See below, for a comparison in =
output of syslog and evlog created by doing an rsh </FONT>

<BR><FONT SIZE=3D2 FACE=3D"Arial">to a machine. </FONT>
</P>

<P><FONT SIZE=3D2 FACE=3D"Arial">/var/log/messages extract</FONT>

<BR><FONT SIZE=3D2 FACE=3D"Arial">Oct 30 11:33:46 angel2 =
pam_rhosts_auth[27509]: allowed to root@angel3 as root</FONT>

<BR><FONT SIZE=3D2 FACE=3D"Arial">Oct 30 11:33:46 angel2 =
login(pam_unix)[27510]: session opened for user root by (uid=3D0)</FONT>

<BR><FONT SIZE=3D2 FACE=3D"Arial">Oct 30 11:33:46 angel2 login -- =
root[27510]: ROOT LOGIN ON pts/1 FROM angel3</FONT>
</P>

<P><FONT SIZE=3D2 FACE=3D"Arial">evlview -n --syslog</FONT>

<BR><FONT SIZE=3D2 FACE=3D"Arial">Oct 30 11:33:46 angel2 allowed to =
root@angel3 as root</FONT>

<BR><FONT SIZE=3D2 FACE=3D"Arial">Oct 30 11:33:46 angel2 session opened =
for user root by (uid=3D0)</FONT>

<BR><FONT SIZE=3D2 FACE=3D"Arial">Oct 30 11:33:46 angel2 ROOT LOGIN ON =
pts/1 FROM angel3</FONT>
</P>

<P><FONT SIZE=3D2 FACE=3D"Arial">On the central log server, when viewing =
the logs for this host (current or archived) one would </FONT>

<BR><FONT SIZE=3D2 FACE=3D"Arial">not be able to tell what program =
caused these or whether one used rsh or some other login mechanism, =
</FONT>

<BR><FONT SIZE=3D2 FACE=3D"Arial">say ssh.</FONT>
</P>

<P><FONT SIZE=3D2 FACE=3D"Arial">My questions become, was this a =
deliberate decision not to provide the program name</FONT>

<BR><FONT SIZE=3D2 FACE=3D"Arial">in evlog ?</FONT>

<BR><FONT SIZE=3D2 FACE=3D"Arial">What would it take to provide this =
functionality ?</FONT>

<BR><FONT SIZE=3D2 FACE=3D"Arial">Thanks.</FONT>
</P>

<P><FONT SIZE=3D2 FACE=3D"Arial">/Regards/Seo</FONT>
</P>

</BODY>
</HTML>
------_=_NextPart_001_01C39EDC.E068F4B6--


-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive?  Does it
help you create better code?   SHARE THE LOVE, and help us help
YOU!  Click Here: http://sourceforge.net/donate/