Bug 872193

Summary: sd_journal_send does not collect SYSLOG_IDENTIFIER by default
Product: [Fedora] Fedora Reporter: Eric Paris <eparis>
Component: systemdAssignee: systemd-maint
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: rawhideCC: johannbg, lnykryn, metherid, msekleta, notting, plautrba, systemd-maint, vpavlin
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-12-08 04:34:58 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Eric Paris 2012-11-01 14:16:59 UTC
I consider these 2 to be equivalent:

syslog(LOG_ALERT, "Hello syslog 3 2 1");
sd_journal_send("MESSAGE=Hello journal 1 2 3", "PRIORITY=LOG_ALERT", NULL);

But they aren't.  In journal I get:
Nov 01 10:09:25 localhost.localdomain tmp[8774]: Hello syslog 3 2 1
Nov 01 10:09:25 localhost.localdomain [8774]: Hello journal 1 2 3

In syslog I get:
Nov  1 10:09:25 localhost tmp: Hello syslog 3 2 1
Nov  1 10:09:25 localhost [8774]: Hello journal 1 2 3

I think in all cases we'd like to see tmp[8774] but we only sometimes get the process which sent the message and sometimes don't.

I notice the syslog version picks up
        SYSLOG_IDENTIFIER=tmp

And the second one has no such identifier (It does get CODE_* which is figgin awesome)

Thus we have LESS information in syslog if we convert to use sd_journal_send.  Seems bad/odd...

Comment 1 Eric Paris 2012-11-01 14:18:04 UTC
Unrelated note, my actual journal line is:
sd_journal_send("MESSAGE=Hello journal 1 2 3", "PRIORITY=%d", LOG_ALERT, NULL);

I was doing PRIORITY wrong, but that's unrelated.

Comment 2 Lennart Poettering 2012-11-20 20:31:01 UTC
Ideally we get the client's process "comm" name when we receive a message, and we usually do. Unfortunately that's racy, as the client might be gone already by the time we try to read /proc/$CLIENTPID/comm of it. This needs fixing in the kernel, so that we get SCM_EXEINFO or so which sends over comm, argv, and exe from the client ove the syslog socket in a race-free, secure, unfakable way.

In the meantime I have now change systemd git to send SYSLOG_IDENTIFIER along, from glibc's program_invocation_short_name. This is probably useful anyway, as "comm" is usually truncated.

Comment 3 Fedora Update System 2012-12-05 17:19:27 UTC
systemd-195-10.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/systemd-195-10.fc18

Comment 4 Fedora Update System 2012-12-05 23:15:03 UTC
Package systemd-195-10.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing systemd-195-10.fc18'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-19811/systemd-195-10.fc18
then log in and leave karma (feedback).

Comment 5 Fedora Update System 2012-12-08 04:35:00 UTC
systemd-195-10.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.