Re: [RFC PATCH v3 3/3] trace2: write overload message to sentinel files

[Jeff Hostetler <git@jeffhostetler.com>]

On 9/16/2019 8:07 AM, Derrick Stolee wrote:
> On 9/13/2019 8:26 PM, Josh Steadmon wrote:
>> Add a new "overload" event type for trace2 event destinations. Write
>> this event into the sentinel file created by the trace2.maxFiles
>> feature. Bump up the event format version since we've added a new event
>> type.
>>
>> Writing this message into the sentinel file is useful for tracking how
>> often the overload protection feature is triggered in practice.
> 
> Putting meaningful data into the sentinel file is valuable. It's
> important to know a bit about when and why this happened. A user
> would be able to inspect the modified time, and the directory info
> you include is unnecessary. The data you include is only for the
> log aggregator to keep valuable data around overloads.
>   
>> +`"overload"`::
>> +	This event is created in a sentinel file if we are overloading a target
>> +	trace directory (see the trace2.maxFiles config option).
>> ++
>> +------------
>> +{
>> +	"event":"overload",
>> +	...
>> +	"dir":"/trace/target/dir/", # The configured trace2 target directory
>> +	"evt":"2",		    # EVENT format version
>> +}
> That said, do we really need to resort to a new event format and
> event type? Could we instead use the "data" event with a key
> "overload" and put the target dir in the value?
> 
> Thanks,
> -Stolee
> 

If I understand the code here, the overload event/message is
only written to the sentinel file -- it is not written to a
regular trace2 log file, so regular log file consumers will
never see this event, right?

That message could be in any format, right?  And you could write
as much or as little data into the sentinel file as you want.

There's no compelling reason to extend the existing trace2 format
to have a new message type, so I'm not seeing a reason to add the
event-type nor to increment the version number.

The existing trace2 formats and messages/event-types are defined
and driven by the Trace2 API calls presented to upper layers
(consumers of the public trace2_*() functions and macros defined
in trace2.h).  This overload event doesn't fit that model.

I think it'd be better to just directly write() a message -- in
plain-text or JSON or whatever -- in tr2_create_sentinel() and
not try to piggy-back on the existing format machinery in the
tr2_tgt_*.c files.

Jeff