I was thinking of something like:

DDPPPMFF 2011-12-04 14:44 myproc 1234 procuser INFO "this line" "contains some data"
PFDF proc2 started 1326808384 "That is a silly place to put a time stamp"

Where D = datetime, P = process info, M = meta data, F = free text

That way, by parsing the first field you can know the format of the rest of the (space separated and quoted) line, whilst allowing for different line formats and keeping the flexibility and human readability of ASCII.

A command to read the dates might look something like

$ logcat D my.log
2011-12-04 14:44
1326808384
$ 

Does something like this exist already?

What are the downsides to this approach? I can think of one:

We still can't discover the difference between process name and the process user. Perhaps specific fields would have to be defined. Perhaps like:

DdDtPnPpPuMsFF

But that is starting to get a bit silly.

Actually, while we're at it, lets at tagging:

DDPPPMFFT 2011-12-04 14:44 myproc 1234 procuser INFO "this line" "contains some data" "testing,login,user,authentication"
PFDFT proc2 started 1326808384 "That is a silly place to put a time stamp" "testing,debug,user"

And a command

$ logtag --freq *.log
testing 2
user 2
authentication 1
debug 1
login 1
$
link|improve this question
What are you trying to accomplish exactly? Most *nix processes log to syslog (or should at least) using a semi-standard format "Month Day 24H-Time host process_name[pid]: message" If message is a debugging problem then it's usually "Function_Name File_Name Line_No Error_Code Error_Desc"; otherwise the format of the message is entirely program dependent. The syslogd may record these events in different formats, but it's usually easy to search through them (especially the more advanced/centralized syslogd packages). – Chris S Jan 17 at 14:22
So yes, many things do indeed log to syslog. However, some things don't. Also, as you say, the format of the message is program dependant. I am hoping for/suggesting a way for the program to describe what follows. – zeroXten Jan 17 at 14:39
feedback

1 Answer

All logs should have a few things (for example timestamp) in common, the rest is the meta-data which can change. Android binary logs are an example for such. The names for the meta data tags are kept in an external file and the log only contains the values. IETF syslog also has support for including structured meta-data, see RFC 5424.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.