[Podman] Re: Podman logs to Splunk HEC

First, can we agree to implement something like https://github.com/cri-o/cri-o/pull/1605 "Stream Log Writer"? Currently, conmon implements a byte-for-byte log stream interpretation. By moving it to where conmon just records what it has read from each pipe won't we avoid multiplying the amount of data written by conmon to disk? Each newline character in the byte stream demarks a log record, where metadata is added to what is written to disk. Once we have that problem solved, then sending that record remotely, or to a file, can be decided by some configuration to conmon, but conmon won't increase the data rate based on the log stream contents. Further, we also need to implement https://github.com/containers/conmon/issues/84, "Provide logging behavior policies applied by conmon to stdout/stderr", so that the SRE can control the max rate of logging from containers, and arguably should be applied to the whole node, and then allowing container writer to determine the behavioral policy of what to do when that rate limit is hit (drop, back-pressure, or just ignore all logs entirely). Thoughts? Perhaps this would be a good GSoC project for somebody? > > https://docs.docker.com/config/containers/logging/json-file/ > > > > > On Tue, Sep 29, 2020, 9:20 PM Daniel Walsh <dwalsh(a)redhat.com&gt; wrote: