RFC Metadata

[meschbach]

Formats RFC 5424 frame metadata including date & time of the record, host name, and process name. Built off the work for Octet Counting Framing.

[lhl]

Hey, thanks for the PR. Mind ELI5 about RFC 5424? Is this metadata layer for syslog backwards compatible/won't break anything for existing users? If so, happy to merge this upstream!

[meschbach]

Hey lhl!

RFC 5424 provides a format for communicating information which would implicitly be added with a local syslog implementation. Typical the metadata includes the priority, timestamp, hostname, application, and application PID.

The standard is intentionally vague on the underlying transport, however I’ve seen implementations on UDP, TCP, and TLS over TCP. The later two have an additional standard in RFC 6587 which provide new-line based framing (non-transparent framing) or a prefix containing a ASCII representation of the count of bytes in the frame to deal with the stream based nature. I’ve used a strategy so a client may choose either now.

Compatibility is an interesting question. Looking through I expanded the metadata fields (priority was already there) to include additional fields. If one is using PaperTrail it will import the additional metadata properly, possibly using different values for the hostname and process. If one wrote a parser to consume just the priority then then message it will break their system. I’ll breakout the new header format into a strategy on Monday to provide full compatibility for those who would like to stick with the original data format.

Happy to answer any additional questions you might have about this.

[meschbach]

Sorry, I got distracted by something shiny. I've restored the original default behavior which will maintain full backwards compatibility while also adding an example of using the newer framing + headers.

[edrolo-paulm]

🍿 😄
How's this going?