Streaming logs via rsyslog

[Ed Tanous]

On 08/16/2018 03:21 AM, Deepak Kodihalli wrote:
> Hi,
> 
> We have a requirement to forward BMC logs (the systemd journal) to an 
> external logging server.
> 
> We're proposing doing this by making use of rsyslog. Here are notes 
> based on some initial investigation.
> 

 From the rsyslog github page

"""
Rsyslog's main sponsor Adiscon tries to fund rsyslog by selling custom 
development and support contracts. Adiscon does NOT license rsyslog 
under a commercial license (this is simply impossible for anyone due to 
rsyslog's license structure).
"""

I think this license makes rsyslog a non-starter for most of the people 
in this project, but I'm not a license expert.  We've looked at it in 
the past, and while nice to use in practice, we couldn't overcome the 
license conflicts and legal implications.

Oddly enough, my team did some prototype work in this area a couple 
weeks ago that I've pushed to gerrit for comment.

As part of an experiment we implemented a prototype Redfish endpoint 
that exposed the journald log entries.  It seems to have worked 
relatively well, and it's considerably faster than we thought it would 
be.  1000 entries can be grabbed in about a second including all the TLS 
overhead.

An example from my system is here:
https://imgur.com/a/vtlFvHB

The thought was that at some point we would implement server-sent 
events, which is part of the Redfish 1.5.0 specification, and would 
allow the logs to be streamed off the system using a pretty well defined 
protocol that's not specific to OpenBMC, as well as implement pretty 
decent security.  It's not directly syslog, and I can still see the use 
case for having a syslog compatible mechanism for streaming.

https://gerrit.openbmc-project.xyz/#/c/openbmc/bmcweb/+/12008/