I've got a pretty big issue with how shinken deals with logs.
Actually, we are using the logger class /level for everything.
For example :
("[Livestatus Broker] Starting Livestatus application")
Then all those logs are sent via Brok to logstore.
They are both stored using the Class = 2 (aka program states).
But they don't come with the same scope/meaning.
This is problematic for all Livestatus queries. With Thruk for example, when calculating a SLA, the LiveStatus uses this filter :
Filter: class = 2
So we are fetching tons of useless logs. and then we are "eating" a lot of memory.
I think we should separate what I call "syslog" log with "Shinken internal logs"
Maybe we could create a custom logging level and only this level will be stored into logstore ?
What do you think about this ?