Thursday, October 19, 2017

util-linux v2.31 -- what's new?

uuidparse -- this is a new small command to get more information about UUIDs "hash". The command provides info about UUID type, variant and time. For example:

$ (uuidgen; uuidgen -t) | uuidparse
UUID                                  VARIANT TYPE       TIME
8f251893-d33a-40f7-9bb3-36988ec77527  DCE     random
66509634-b404-11e7-aa8e-7824af891670  DCE     time-based 2017-10-18 15:01:04,751570+0200

The command su has been refactored and extended to create pseudo terminal for the session (new option --pty). The reason is CVE-2016-2779, but the issue addressed by this CVE is pretty old and all the problem is silently ignored for for years on many places (on only su(1)). The core of the problem is that unprivileged user (within su(1) session) shares terminal file descriptor with original root's session. The new option --pty forces su(1) to create independent pseudo terminal for the session and than su(1) works as proxy between the terminals. The feature is experimental and not enabled by default (you have to use su --pty).

standard su session (all on pts/0):
               
24909 pts/0    S      0:02          \_ -bash                  
13607 pts/0    S      0:00              \_ su - kzak          
13608 pts/0    S      0:00                  \_ -bash          
13679 pts/0    R+     0:00                      \_ ps af      

su --pty session (root pts/0; user pts/5):
               
24909 pts/0    S      0:02          \_ -bash                  
13857 pts/0    S+     0:00              \_ su --pty - kzak    
13858 pts/5    Ss     0:00                  \_ -bash          
13921 pts/5    R+     0:00                      \_ ps af      

rfkill -- this is a new command in util-linux. The command was originally written by Johannes Berg and Marcel Holtmann and maintained for years as standalone package. We believe that it's better to maintain and distribute it with another commands on one place. The util-linux version is backwardly compatible with the original implementations. The command has been also improved (libsmartcols ouotput, etc.), the new default output:
# rfkill       
ID TYPE      DEVICE                   SOFT      HARD          
 0 bluetooth tpacpi_bluetooth_sw unblocked unblocked          
 1 wlan      phy0                unblocked unblocked          
 4 bluetooth hci0                  blocked unblocked

The library libuuid and command uuidgen support hash-based UUIDs v3 (md5) and v5 (sha1) as specified by RFC-4122 now. The library also provides UUID templates for dns, url, oid, or x500. For example:
 
$ uuidgen --sha1  --namespace @dns --name foobar.com
e361e3ab-32c6-58c4-8f00-01bee1ad27ec

and it's expected to use v3 and v5 UUIDs as hierarchy, so you can use this UUID (or arbitrary other UUID) as a namespace:
 
$ uuidgen --sha1  --namespace e361e3ab-32c6-58c4-8f00-01bee1ad27ec --name mystuff
513f905c-7df2-5afa-9470-4e82382dbf00

I can imagine system where for example per-user or per-architecture partition UUIDs are based on this system. For example use UUID specific for the system root as --namespace and username as --name, or so. 

wipefs and libblkid have been improved to provide all possible string permutations for a device. It means that wipefs does not return the first detected signature, but it continues and tries another offsets for the signature. This is important for filesystems and partitions tables where the superblock is backuped on multiple places (e.g. GPT) or detectable by multiple independent ways (FATs). This all is possible without a device modification (the old version provides the same, but only in "wipe" mode). 

The libfdisk has been extended to use BLKPG ioctls to inform the kernel about changes. This means that cfdisk and fdisk will not force your kernel to reread all of the partition table, but untouched partitions may remain mounted and used by the system. The typical use-case is resizing the last partition on the system disk. 

You can use cfdisk to resize a partition. Yep, cool.

The hwclock command now significantly reduces system shutdown times by not reading the RTC before setting it (except when the --update-drift option is used). This also mitigates other potential shutdown and RTC setting problems caused by requiring an RTC read.



Friday, June 9, 2017

util-linux v2.30 -- what's new?

The command tailf is dead thing. (RIP ... years ago I had nice time to improve it with inotify:) You have to use "tail -f" from coreutils project.

blkzone -- this new command is excellent example of the open source collaboration. The command has been developed by people from WD, Seagate and SanDisk (thanks to Shaun Tancheff, Damien Le Moal and others). The goal is to have command line interface to run zone commands on block devices that support Zoned Block Commands (ZBC) or Zoned-device ATA Commands (ZAC). For now the supported zone commands are "reset" and "report". See http://www.storagereview.com/methods_of_smr_data_management for more details about zones.

fincore (file in core)-- this is nice useful command to get information about number of memory pages used by file content. For example my fulltext email DB:

# fincore ~/Mail/Maildir/.notmuch/xapian/*.DB
   RES  PAGES  SIZE FILE
 60.1M  15392  4.6G /home/kzak/Mail/Maildir/.notmuch/xapian/position.DB
687.4M 175982  3.5G /home/kzak/Mail/Maildir/.notmuch/xapian/postlist.DB
  328K     82 18.6M /home/kzak/Mail/Maildir/.notmuch/xapian/record.DB
190.5M  48758  2.1G /home/kzak/Mail/Maildir/.notmuch/xapian/termlist.DB

Fortunately RAM is cheap :) Thanks to Masatake Yamato from Red Hat.

lsmem (list memory) and chmem (change memory) -- another new commands. The commands have been originally implemented in Perl for s390-tools, now re-implemented in C in more generic way and to be usable on another architectures too. (thanks to Clemens von Mann and Heiko Carstens from IBM.)

The command fallocate supports an "insert range" operation now.

We continue on hwclock cleanup, some things in the code have been simplified, dead and useless things removed. (thanks to J William Piggott)

The code behind "column -t|--table" uses libsmartcols now. This change dramatically increased number of available features for table formatting. Now it's possible to define header for columns, truncate text in cells, align text to the right, change order of columns, JSON output or create tree-like output. Now almost all libsmartcols features are available on command line, example:
pstree-like output:

 $ ps -h -o pid,ppid,comm | column --table --tree 3 --tree-id 1 --tree-parent 2 --table-hide 2 --table-right 1
 
 1799  bash
 2254  bash
28427  └─mutt
 4263    └─vim
 7409  bash
10641  └─man
10657    └─less
16775  bash
11486  ├─ps
11487  └─column

diskstat:
 
 $ column /proc/diskstats --table --table-columns MAJ,MIN,NAME,READ-COMP,\
      READ-MERG,READ-SECS,READ-TIME,WRITE-COMP,WRITE-MERG,WRITE-SECS,\
      WRITE-TIME,IO-CURR,IO-TIME,WTIME \
      --table-hide MAJ,MIN \
      --table-right 4,5,6,7,8,9,10,11,12,13,14 \
 
NAME   READ-COMP  READ-MERG   READ-SECS  READ-TIME  WRITE-COMP  WRITE-MERG  WRITE-SECS  WRITE-TIME  IO-CURR   IO-TIME      WTIME
sda     13486466     149085  1288469300    9715620    45556082     7788088  1600182109   150180178        0  12935701  159902109
sda1         463        170       19002        131          91           0         161         331        0       334        462
sda2         778         16       63140        276         434         261      507574       12616        0      2382      12889
sda3    10710224     109592  1052352266    8018950    43983768     7022717  1153182094   126210185        0  11002854  134299501
sda4     1630396      32476    67166050    1039837     1197142      665798   343331344    23264993        0   2148041   24306932
sda5     1140435        241   168747746     655625      225373       73891   102920032      637906        0    627834    1293105
sda6        3703       6590       99512        691        4691       25421      240904        8418        0      6402       9108
sdb          448          0       22506       3088        1887           4         128         275        0      1449       3363
sdb1         404          0       19370       3035          12           4         128          60        0      1187       3095
loop0      22086          0      347311       2025       10738           0      844888        2226        0      1129       4265
loop1        947          0       26940        325        1100           0      133316         734        0       411       1058
md8            0          0           0          0           0           0           0           0        0         0          0


passwd in JSON:
 
 $ grep -v nologin /etc/passwd | \
     column --separator : --table --table-name passwd --json \
            --table-columns USERNAME,PWD,UID,GID,GECOS,HOME,SHELL \
            --table-hide PWD
{
   "passwd": [
      {"username": "root", "uid": "0", "gid": "0", "gecos": "root", "home": "/root", "shell": "/bin/bash"},
      {"username": "sync", "uid": "5", "gid": "0", "gecos": "sync", "home": "/sbin", "shell": "/bin/sync"},
      {"username": "shutdown", "uid": "6", "gid": "0", "gecos": "shutdown", "home": "/sbin", "shell": "/sbin/shutdown"},
      {"username": "halt", "uid": "7", "gid": "0", "gecos": "halt", "home": "/sbin", "shell": "/sbin/halt"},
      {"username": "kzak", "uid": "1000", "gid": "1000", "gecos": "Karel Zak,Home,,,", "home": "/home/kzak", "shell": "/bin/bash"},
      {"username": "gamer", "uid": "1001", "gid": "1001", "gecos": null, "home": "/home/gamer", "shell": "/bin/bash"},
      {"username": "test", "uid": "1002", "gid": "1002", "gecos": null, "home": "/home/test", "shell": "/bin/bash"}
   ]
} 
 

findmnt-like output:
 
 $ column /proc/self/mountinfo \
     --table-columns ID,PARENT,MAJMIN,ROOT,TARGET,VFS-OPTS,PROP,SEP,TYPE,SOURCE,FS-OPTS \
     --table-hide=SEP,ID,PARENT,ROOT,PROP,FS-OPTS,MAJMIN \
     --table-order TARGET,SOURCE,TYPE,VFS-OPTS \
     --tree TARGET \
     --tree-id ID \
     --tree-parent PARENT
 
TARGET                             SOURCE       TYPE         VFS-OPTS
/                                  /dev/sda4    ext4         rw,relatime
├─/sys                             sysfs        sysfs        rw,nosuid,nodev,noexec,relatime
│ ├─/sys/kernel/security           securityfs   securityfs   rw,nosuid,nodev,noexec,relatime
│ ├─/sys/fs/cgroup                 tmpfs        tmpfs        ro,nosuid,nodev,noexec
│ │ ├─/sys/fs/cgroup/systemd       cgroup       cgroup       rw,nosuid,nodev,noexec,relatime
│ │ ├─/sys/fs/cgroup/blkio         cgroup       cgroup       rw,nosuid,nodev,noexec,relatime
│ │ ├─/sys/fs/cgroup/cpu,cpuacct   cgroup       cgroup       rw,nosuid,nodev,noexec,relatime
│ │ ├─/sys/fs/cgroup/devices       cgroup       cgroup       rw,nosuid,nodev,noexec,relatime
│ │ ├─/sys/fs/cgroup/hugetlb       cgroup       cgroup       rw,nosuid,nodev,noexec,relatime
│ │ ├─/sys/fs/cgroup/pids          cgroup       cgroup       rw,nosuid,nodev,noexec,relatime
│ │ ├─/sys/fs/cgroup/memory        cgroup       cgroup       rw,nosuid,nodev,noexec,relatime
│ │ ├─/sys/fs/cgroup/cpuset        cgroup       cgroup       rw,nosuid,nodev,noexec,relatime
... and so on ... 
 
 
Thanks to all contributors. The next version v2.31 is planned for September 2017.

Friday, January 6, 2017

10 years with util-linux project!

I can't believe that it's already 10 years we have active community around basic Linux utils.

Yes, we had util-linux before (and many thanks to Adrian Bunk and Andries E. Brouwer), but I believe that with git and close collaboration between Linux distributions and Linux kernel community it better now :-)
  • ~11000 commits
  • ~460 unique contributors
  • ~630 regression tests
  • ~100 utils, 5 shared libs with public API
  • ~16 major releases (from v2.13 to v2.29)
  • ~26 translated languages
  • ~10000 e-mails on mailing list

  • ported to GNU Hurd, FreeBSD and XOS
  • used by all mainstream Linux distros (as well as by Systemd haters ;-)
  • modern autotools based build system

  • merges from another projects
    • libblkid, libuuid and fsck from e2fsprogs
    • sulogin, last, utmpdump  and mounpoint from sysvinit
    • su from coreutils

  • many new utils (lsblk, findmnt, wipefs, rtcwake, unshare, nsenter, prlimit, blkdiscard, flock, fstrim, ipcmk, ldattach, lscpu, lsipc, lslocks, lslogins, resizepart, setarch, setpriv, switch_root, swaplabel)

  • many rewrites (libblkid probing code, mount, fdisks, etc.)

  • new shared libraries
    • libmount
    • libfdisk
    • libsmartcols

...the first original announce: https://lkml.org/lkml/2006/12/18/12

... gource video with all the ten years https://youtu.be/YcG6hHGD-78 :-)

Thanks to all contributors!


Thursday, October 6, 2016

util-linux v2.29 -- what's new?

The release v2.29 (now rc1) is without dramatical changes, the small exception is libsmartcols where we have many improvements. 

The old good cal(1) is more user-friendly now. It's possible to specify month by name (e.g. "cal January 2017") and use relative placeholders, for example:

        cal now
        cal '1 year ago'
        cal '+2 months'

fdisk(8) allows to wipe newly created partitions -- the feature is possible to control by new command line option --wipe-partitions[==auto|never|default]. 
 The default in the interactive mode is to ask user when a filesystem or RAID signature is detected. The goal is to be sure that new block devices are usable without any collisions and extra wipefs(8) step (because users are lazy and mkfs-like programs are often no smart enough to wipe the device). 

findmnt --verify is probably the most attractive new feature for admins. The command scans /etc/fstab and tries to verify the configuration. The traditional way is to use "mount -a" for this purpose, but it's overkill. The new --verify does not call mount(2), but it checks parsability, LABEL/UUID/etc. translation to paths, mountpoints order, support for specified FS types. The option --verify together with --verbose provides many details. 

For example my ext4 filesystems:

# findmnt --verify --verbose -t ext4
/ 
   [ ] target exists
   [ ] LABEL=ROOT translated to /dev/sda4
   [ ] source /dev/sda4 exists
   [ ] FS type is ext4
   [W] recommended root FS passno is 1 (current is 2)
/boot
   [ ] target exists 
   [ ] UUID=c5490147-2a6c-4c8a-aa1b-33492034f927 translated to /dev/sda2
   [ ] source /dev/sda2 exists
   [ ] FS type is ext4
/home
   [ ] target exists
   [ ] UUID=196972ad-3b13-4bba-ac54-4cb3f7b409a4 translated to /dev/sda3
   [ ] source /dev/sda3 exists
   [ ] FS type is ext4
/home/misc
   [E] unreachable on boot required target: No such file or directory 
   [ ] UUID=e8ce5375-29d4-4e2f-a688-d3bae4b8d162 translated to /dev/sda5
   [ ] source /dev/sda5 exists
   [ ] FS type is ext4
 
0 parse errors, 1 error, 1 warning


When you create multiple loop block devices from one backing file then Linux kernel does not care about possible collisions and the same on-disk filesystem is maintained by multiple independent in-memory filesystem instances. The result is obvious -- data lost and filesystem damage.

Now mount(8) rejects requests to create another device and mount filesystem for the same backing file. The command losetup --nooverlap reuse loop device if already exists for the same backing file. All the functionality calculate with offset and sizelimit options of course, so it's fine to have multiple regions (partitions) in the same image file and mount all of them in the same time. The restriction is that the regions should not overlap. Thanks to Stanislav Brabec from Suse! 

Heiko Carstens from IBM (thanks!) has improved lscpu(1) for s390. Now it supports "drawer" topology level, static and dynamic MHz, machine type and a new option --physical. 

The most important libsmartcols change is probably better support for multi-line cells. Now the library supports custom cell wrap functions -- this allows to wrap your text in cells after words, line breaks, etc. See multi-line cells (WRAPNL column) output: 

TREE           ID PARENT WRAPNL
aaaa            1      0 aaa
├─bbb           2      1 bbbbb
│ ├─ee          5      2 hello
│ │                      baby
│ └─ffff        6      2 aaa
│                        bbb
│                        ccc
│                        ddd
├─ccccc         3      1 cccc
│ │                      CCCC
│ └─gggggg      7      3 eee
│   ├─hhh       8      7 fffff
│   │ └─iiiiii  9      8 g
│   │                    hhhhh
│   └─jj       10      7 ppppppppp
└─dddddd        4      1 dddddddd
                         DDDD
                         DD

The another change is support for user defined padding chars; we use this feature for LIBSMARTCOLS_DEBUG_PADDING=on|off, for example: 

   $ LIBSMARTCOLS_DEBUG=all LIBSMARTCOLS_DEBUG_PADDING=on findmnt 2> /dev/null

For me really important is that we have regression tests for all libsmartcols table and tree formatting code now :-) 

Igor Gnatenko from Red Hat (thanks!) continues to work on Python binding for libsmartcols, see https://github.com/ignatenkobrain/python-smartcols and see example below.

The idea is to use libsmartcols as output formatter for Fedora/RHEL dnf (package manager for RPM-based Linux distributions, yum replacement). This is also reason why libsmartcols has been massively extended and improved in the last releases. 

That's all. Thanks also to Werner Fink, Sami Kerola, Ruediger Meier and many others contributors! 

#!/bin/python3
 
import smartcols
 
tb = smartcols.Table()
name = tb.new_column("NAME")
name.tree = True
age = tb.new_column("AGE")
age.right = True
 
ggf = tb.new_line()
ggf[name] = "John"
ggf[age] = "70"
 
gfa = tb.new_line(ggf)
gfa[name] = "Donald"
gfa[age] = "50"
 
fa = tb.new_line(gfa)
fa[name] = "Benny"
fa[age] = "30"
 
ln = tb.new_line(fa)
ln[name] = "Arlen"
ln[age] = "5"
 
ln = tb.new_line(fa)
ln[name] = "Gerge"
ln[age] = "7"
 
fa = tb.new_line(gfa)
fa[name] = "Berry"
fa[age] = "32"
 
ln = tb.new_line(ggf)
ln[name] = "Alex"
ln[age] = "44"
 
print(tb)
  
NAME        AGE
John         70
├─Donald     50
│ ├─Benny    30
│ │ ├─Arlen   5
│ │ └─Gerge   7
│ └─Berry    32
└─Alex       44

Tuesday, March 22, 2016

util-linux v2.28 -- what's new?

The release v2.28 does not contain any dramatical changes and huge improvements. It's another release to keep users happy and absorb new features provided by kernel. We all love this kind of release, right? :-)

The fdisk programs (sfdisk, cfdisk and fdisk) have been improved to wipe old filesystem, RAID and partition tables from the device before libfdisk writes a new partition table.

The fdisk-like programs traditionally care about begin of the device, but it's insufficient. This new feature has been introduced to avoid collisions between new partition table and old unwanted signatures and it's possible to control it by --wipe[=auto|never|always]. For backward compatibility on non-terminals (non interactive fdisk execution) the feature is disabled by default.

We have a new command lsns, see http://karelzak.blogspot.cz/2015/12/lsns8-new-command-to-list-linux.html and sfdisk provides new functionality, see: http://karelzak.blogspot.cz/2015/09/whats-cooking-in-sfdisk-for-v228.html
 
Linux kernel 3.14 is really not a hot news, but standard Linux userspace still does not support DEADLINE scheduler. chrt since v2.28 supports the DEADLINE scheduling class and the new options --sched-runtime --sched-period and --sched-deadline.

The command logger supports RFC 5424 structured data through the new options --sd-id and --sd-param. For example:
   logger --rfc5424 --sd-id zoo@123     \  
          --sd-param tiger=\"hungry\"   \            
          --sd-param zebra=\"running\"  \            
          --sd-id manager@123           \            
          --sd-param onMeeting=\"yes\"  \            
          "this is message"
produces:
 <13>1 2015-10-01T14:07:59.168662+02:00 ws kzak - - [timeQuality tzKnown="1" isSynced="1" syncAccuracy="218616"][zoo@123 tiger="hungry" zebra="running"][manager@123 onMeeting="yes"] this is message

The library libsmartcols has been massively improved (thanks to Igor Gnatenko for testing and reviews). Now it's possible to specify title for table, table supports multi-line cells, it's possible to print subset of table and the library supports continuous printing.

Igor works on Python binding, it's available at https://github.com/ignatenkobrain/python-smartcols.

The portability of the util-linux package is not our primary goal, but in many cases port code to the another libc or another operation system (if possible) is a way how to detect code disadvantages, obsolete functions etc. v2.28 is possible to compile on OSX and improved has been also support for kFreeBSD and GNU Hurd (of course you cannot compile Linux specific stuff, but build-system is smart enough to automatically disable utils irrelevant for your OS).

This is in connection with our regression tests suite, where many things have been improved to make the tests more stable in all random environments. (thanks to Ruediger Meier).

The complete list of all changes (~480 patches) is at
http://ftp.kernel.org/pub/linux/utils/util-linux/v2.28/v2.28-ReleaseNotes

and in details at: http://ftp.kernel.org/pub/linux/utils/util-linux/v2.28/v2.28-rc1-ChangeLog

Thanks to all (~40) contributors!

Tuesday, December 1, 2015

lsns(8) new command to list Linux namespaces

The namespaces are commonly used way how to isolate global (ipc, mount, net, ...) resource instances. Unfortunately, we have no command line tool to list namespaces. The new command lsns(8) tries to fill this gap.

Examples:

# lsns
        NS TYPE  NPROCS   PID USER   COMMAND
4026531836 pid      276     1 root   /usr/lib/systemd/systemd --system --deserialize 15
4026531837 user     276     1 root   /usr/lib/systemd/systemd --system --deserialize 15
4026531838 uts      276     1 root   /usr/lib/systemd/systemd --system --deserialize 15
4026531839 ipc      276     1 root   /usr/lib/systemd/systemd --system --deserialize 15
4026531840 mnt      269     1 root   /usr/lib/systemd/systemd --system --deserialize 15
4026531857 mnt        1    63 root   kdevtmpfs
4026531963 net      275     1 root   /usr/lib/systemd/systemd --system --deserialize 15
4026532189 mnt        1   545 root   /usr/lib/systemd/systemd-udevd
4026532390 net        1   776 rtkit  /usr/libexec/rtkit-daemon
4026532478 mnt        1   776 rtkit  /usr/libexec/rtkit-daemon
4026532486 mnt        1   847 colord /usr/libexec/colord
4026532518 mnt        3  6500 root   -bash
and list namespace content:
# lsns 4026532518
  PID  PPID USER COMMAND
 6500  6372 root -bash
19572  6500 root └─/usr/bin/mc -P /tmp/mc-root/mc.pwd.6500
19575 19572 root   └─bash -rcfile .bashrc
help output with columns description:
# lsns -h
  
Usage:
 lsns [options] [namespace]
  
List system namespaces.
  
Options:
 -J, --json             use JSON output format
 -l, --list             use list format output
 -n, --noheadings       don't print headings
 -o, --output list      define which output columns to use
 -p, --task pid         print process namespaces
 -r, --raw              use the raw output format
 -u, --notruncate       don't truncate text in columns
 -t, --type name        namespace type (mnt, net, ipc, user, pid, uts)
  
 -h, --help     display this help and exit
 -V, --version  output version information and exit
  
Available columns (for --output):
          NS  namespace identifier (inode number)
        TYPE  kind of namespace
        PATH  path to the namespace
      NPROCS  number of processes in the namespace
         PID  lowers PID in the namespace
        PPID  PPID of the PID
     COMMAND  command line of the PID
         UID  UID of the PID
        USER  username of the PID
  
For more details see lsns(8).
The important detail is that you can see only namespaces accessible from currently mounted /proc filesystem. The lsns(8) is not able to list persistent namespaces without processes where the namespace instance is hold by bind mounts of the /proc/[pid]/ns/[type] files and the output may be affected by unshared PID namespace and unshared /proc (see unshare(8) for more details).

... it will be probably available in util-linux v2.28 (~ January 2016).

Tuesday, October 6, 2015

logger v2.28

logger is small util to send log messages from command line. It supports (relatively) a new systemd journal as well as classic syslog. The syslog is still de-facto standard for enterprise admins and the latest logger version add support for RFC5424. This RFC introduces "structured-data" and since v2.28 logger is going to support this feature too.

The structured data is parse-able part of the message in format:

 [SD-ID[@digits] SD-PARAM="value" SD-PARAM="value" ...]
for exmaple:
 <13>1 2015-10-01T14:07:59.168662+02:00 ws kzak - - [timeQuality tzKnown="1" isSynced="1" syncAccuracy="218616"] message
is complete message. The message structured data contains one element with ID "timeQuality". This is standardized element, the custom user defined elements have to use "@digits" suffix in the ID name. It's possible to have arbitrary number of the structured data elements.

And now this functionality is completely exported to logger command line to provide control over the elements, v2.28 is going to introduce two new options, --sd-id to specify structured data element ID and --sd-param to specify one SD-PARAM=value pair, for example:

 logger --rfc5424 --sd-id zoo@123                \
                  --sd-param tiger=\"hungry\"    \
                  --sd-param zebra=\"running\"   \
                  --sd-id manager@123            \
                  --sd-param onMeeting=\"yes\"   \
                  "this is message"   
produces:
  <13>1 2015-10-01T14:07:59.168662+02:00 ws kzak - - [timeQuality tzKnown="1" isSynced="1" syncAccuracy="218616"][zoo@123 tiger="hungry" zebra="running"][manager@123 onMeeting="yes"] this is message
message with three SD elements: timeQuality build-in element, zoo@123 and manager@123 user defined elements.

Now all you need is smart server side or log indexing tool that understand RFC5424 (e.g. rsyslog).