Log messages become ever more-important, both in commercial settings for legal reasons as well as basis for anomaly and fault detection. Gathering log messages from diverse sources and making sense out of them is a though task - especially at high message rates. In this talk, we will describe rsyslog's message processing and re-formatting capabilities. Most importantly, we will show that a current syslogd is not just a dumb "file writing service" but rather a highly flexible and powerful tool that can do much more than simple log file processing. For example, it can also be integrated into complex workflows and normalization solutions. The talk offers a theoretical understanding of the relevant rsyslog design as well as practical examples, based on real-world use cases.
