4 ms·

IMO unstructured is more or less useless in production, most logs cannot be easily parsed, and it influences you to omit useful information. Plus who wants to w

• justinsaccount 11y ago
  Absolutely.. The worst part of logging is that the apis are broken and often use things like 'sprintf' type formatting. sprintf is lossy serialization. My favorite example is ssh. Thousands of man hours have likely been wasted writing parsers for ssh logs that are generated from code like this: authlog("%s %s%s%s for %s%.100s from %.200s port %d %s%s%s", authmsg, method, submethod != NULL ? "/" : "", submethod == NULL ? "" : submethod, authctxt->valid ? "" : "invalid user ", authctxt->user, get_remote_ipaddr(), get_remote_port(), compat20 ? "ssh2" : "ssh1", authctxt->info != NULL ? ": " : "", authctxt->info != NULL ? authctxt->info : ""); Which if the apis were better could have just looked like authlog({ "authmsg": authmsg, "method": method, "submethod": submethod, "valid": authctxt->valid, "user": authctxt->user, "addr": get_remote_ipaddr(), "port": get_remote_port(), "ver": compat20 ? "ssh2" : "ssh1", "info": authctxt->info}); (obviously C would need something a bit different) The updated(2009) syslog RFC supports structured data, but it's been 6 years and nothing uses it: https://tools.ietf.org/html/rfc5424#section-6.3 https://tools.ietf.org/html/rfc5424#section-6.3