Re: Event logging vs enhancing printk

[Michel Dagenais <michel.dagenais@polymtl.ca>]

> It would be easier, to fix the printk's, than to put evlogging into any
> particular piece of the kernel.

Fine, let's call evlog "an enhanced printk" and discuss the specific technical
details of the proposition.

> Evlog side-by-side with printk adds significat bloat.

Whenever you change/enhance such things you may need coexistance for a while.
However this is configurable, and to a certain extent temporary, bloat.

> > - Structured data events for which it is easier to apply filtering, querying,
> >   analysis and detection tools.
> 
> this is a post processing problem.
...
> What I hear you asking for, is to make it more of
> the kernels responsibilty easing the problem of analysing the out put,
> as opposed to making that the responsibilty of user space
> postprocessing.

Actually this is pushing the formatting out of the kernel, is more efficient,
and it leaves more flexibility to the logging daemon!