Tagging log messages

[dra27]

This is related to verbosemode/syslog-message#18. While working on #5, I got caught in some of the evil which is systemd's journal.

On my (FWIW CentOS 7) box, UDP/TCP reporting was giving entries like:

Aug 11 09:20:26 ocamldefang application Hello syslog world!

You can see here Logs's default source of "application". According to RFC 3164, the space after application is sufficient to delimit it, but this is what happened when I switched to Unix domain sockets writing to /dev/log:

Aug 11 11:59:03 ocamldefang journal: ocamldefang application Hello syslog world!

As far as I can understand, what's happening is that because the message doesn't look like a syslog message (for two reasons), journald determines that its destined for it instead and so you get the unwanted ocamldefang journal: prefix (i.e. neither the hostname nor the tag of the actual message have been interpreted). It's not clear whether rsyslogd rejected it or whether journald didn't forward it, but I think this is journald at fault, since it owns the socket. It was at this point that I discovered that when sending on local sockets, the hostname is supposed to be omitted (that is in rsyslogd's documentation, and I expect in other implementations of syslogd?). But this still didn't work:

Aug 11 13:06:31 ocamldefang journal: application Hello syslog world!

The issue seems to be the lack of the usual colon after application. If I change the log source to be application:, then I get the entry expected:

Aug 11 15:01:05 ocamldefang application: Hello syslog world!

Note, for completeness, that if the hostname is sent, but the colon is added then you still get the journal: addition:

Aug 11 13:12:16 ocamldefang journal: ocamldefang application: Hello syslog world!

Which leads finally to the feature request - would it seem reasonable to have this library append a : to the log source if it doesn't end with a non-alphanumeric character?

[hannesm]

would it seem reasonable to have this library append a : to the log source if it doesn't end with a non-alphanumeric character?

that sounds reasonable to me! happy to merge a PR