[squid-dev] [RFC] Migrate explicit syslog calls to debugs

[Alex Rousskov]

On 07/26/2017 11:04 PM, Amos Jeffries wrote:
> On 27/07/17 16:06, Alex Rousskov wrote:
>>      Squid master process uses many explicit syslog() calls like these:
>>
>>> syslog(LOG_ALERT, "fork failed: %s", xstrerr(xerrno));
>>> syslog(LOG_ALERT, "Suspiciously high workers value: %d",
>>> syslog(LOG_NOTICE, "Squid Parent: will start %d kids", (int)TheKids.count());
>>> syslog(LOG_ALERT, "execvp failed: %s", xstrerr(xerrno));
>>> syslog(LOG_NOTICE, "Squid Parent: %s process %d started",
>>> syslog(LOG_NOTICE, "Squid Parent: %s process %d exited with status %d",
>>> syslog(LOG_NOTICE, "Squid Parent: %s process %d exited due to signal %d with status %d",
>>> syslog(LOG_NOTICE, "Squid Parent: %s process %d exited",
>>> syslog(LOG_NOTICE, "Squid Parent: %s process %d will not"
>>> syslog(LOG_NOTICE, "Squid Parent: unknown child process %d exited", pid);
>>> syslog(LOG_ALERT, "Exiting due to unexpected forced shutdown");
>>> syslog(LOG_ALERT, "Exiting due to repeated, frequent failures");
>>
>>
>> I propose to replace explicit syslog() calls with DBG_CRITICAL and
>> DBG_IMPORTANT debugs() calls _and_ automatically enable syslog-logging
>> of levels 0-1 debugs() calls made by the master process.


> It can easily result in log lines too long for syslog to record easily
> (IIRC some do brain-dead line wrapping at inconvenient lengths). So that
> will need to be accounted for in the design.

AFAICT[1], "too long" here means "more than 400 characters" in extreme
cases and "more than 2000 characters" in most environments, so any
reasonable DBG_CRITICAL and DBG_IMPORTANT messages should be safe. Such
messages ought to be brief anyway. And if some overly detailed messages
are truncated or wrapped awkwardly, it is not a big deal IMHO.

[1]
https://stackoverflow.com/questions/3310875/find-syslog-max-message-length

Do you think that declaring a "keep level-0/1 messages brief" policy
would be sufficient here, killing two logging birds with one stone?


> I wonder if the use of clog you suggested years ago to resolve the early
> startup messages problems should be fixed first.

I am afraid that fix is currently blocked on your response:

http://lists.squid-cache.org/pipermail/squid-dev/2017-June/008792.html


> +1 on having this happen though, whenever it happens.


Thank you,

Alex.