On Thu, Mar 18, 2021 at 05:57:45PM +0100, Alexander Bluhm wrote: > Since we stash log messages in the kernel, the timestamps added by > syslogd are delayed. The kernel could add the timestamp when it > receives the message by sendsyslog(2). This is more precise and > can be expressed by more digits in the ISO timestamp. > > I have to copyin(9) at the beginning of sendsyslog(2) to have both > kernel timestamp and log message in kernel space. This makes the > code easier, but requires a malloc(9) for each log message. > > Do we want to go into this direction?
I think this makes the code nicer. It is good that the userspace-kernel copying becomes simpler and more uniform. > Note that old syslogd and new kernel produces ugly messages. > Do we need an update path? I don't think it is very important. The appearance of the kernel timestamp might confuse things that parse logs. However, as sysupgrade and manual upgrade through bsd.rd upgrade both the kernel and syslogd at the same time, the issue does not seem big. Actually, the increase of timestamp precision might have a higher risk. To keep timestamp format consistent, and maybe easier for parsers, shouldn't syslogd always use microsecond precision with -Z?
