diff --git a/lib/puppet/application/agent.rb b/lib/puppet/application/agent.rb
index d13a3f983..fd6fdbd8c 100644
--- a/lib/puppet/application/agent.rb
+++ b/lib/puppet/application/agent.rb
@@ -1,480 +1,485 @@
 require 'puppet/application'
 require 'puppet/run'
 require 'puppet/daemon'
 require 'puppet/util/pidlock'
 
 class Puppet::Application::Agent < Puppet::Application
 
   run_mode :agent
 
   def app_defaults
     super.merge({
       :catalog_terminus => :rest,
       :catalog_cache_terminus => :json,
       :node_terminus => :rest,
       :facts_terminus => :facter,
     })
   end
 
   def preinit
     # Do an initial trap, so that cancels don't get a stack trace.
     Signal.trap(:INT) do
       $stderr.puts "Cancelling startup"
       exit(0)
     end
 
     {
       :waitforcert => nil,
       :detailed_exitcodes => false,
       :verbose => false,
       :debug => false,
       :setdest => false,
       :enable => false,
       :disable => false,
       :client => true,
       :fqdn => nil,
       :serve => [],
       :digest => 'SHA256',
       :graph => true,
       :fingerprint => false,
     }.each do |opt,val|
       options[opt] = val
     end
 
     @argv = ARGV.dup
   end
 
   option("--disable [MESSAGE]") do |message|
     options[:disable] = true
     options[:disable_message] = message
   end
 
   option("--enable")
   option("--debug","-d")
   option("--fqdn FQDN","-f")
   option("--test","-t")
   option("--verbose","-v")
 
   option("--fingerprint")
   option("--digest DIGEST")
 
   option("--no-client") do |arg|
     options[:client] = false
   end
 
   option("--detailed-exitcodes") do |arg|
     options[:detailed_exitcodes] = true
   end
 
   option("--logdest DEST", "-l DEST") do |arg|
     handle_logdest_arg(arg)
   end
 
   option("--waitforcert WAITFORCERT", "-w") do |arg|
     options[:waitforcert] = arg.to_i
   end
 
   def help
     <<-'HELP'
 
 puppet-agent(8) -- The puppet agent daemon
 ========
 
 SYNOPSIS
 --------
 Retrieves the client configuration from the puppet master and applies it to
 the local host.
 
 This service may be run as a daemon, run periodically using cron (or something
 similar), or run interactively for testing purposes.
 
 
 USAGE
 -----
 puppet agent [--certname <NAME>] [-D|--daemonize|--no-daemonize]
   [-d|--debug] [--detailed-exitcodes] [--digest <DIGEST>] [--disable [MESSAGE]] [--enable]
   [--fingerprint] [-h|--help] [-l|--logdest syslog|eventlog|<FILE>|console]
   [--masterport <PORT>] [--no-client] [--noop] [-o|--onetime] [-t|--test]
   [-v|--verbose] [-V|--version] [-w|--waitforcert <SECONDS>]
 
 
 DESCRIPTION
 -----------
 This is the main puppet client. Its job is to retrieve the local
 machine's configuration from a remote server and apply it. In order to
 successfully communicate with the remote server, the client must have a
 certificate signed by a certificate authority that the server trusts;
 the recommended method for this, at the moment, is to run a certificate
 authority as part of the puppet server (which is the default). The
 client will connect and request a signed certificate, and will continue
 connecting until it receives one.
 
 Once the client has a signed certificate, it will retrieve its
 configuration and apply it.
 
 
 USAGE NOTES
 -----------
 'puppet agent' does its best to find a compromise between interactive
 use and daemon use. Run with no arguments and no configuration, it will
 go into the background, attempt to get a signed certificate, and retrieve
 and apply its configuration every 30 minutes.
 
 Some flags are meant specifically for interactive use -- in particular,
 'test', 'tags' or 'fingerprint' are useful. 'test' enables verbose
 logging, causes the daemon to stay in the foreground, exits if the
 server's configuration is invalid (this happens if, for instance, you've
 left a syntax error on the server), and exits after running the
 configuration once (rather than hanging around as a long-running
 process).
 
 'tags' allows you to specify what portions of a configuration you want
 to apply. Puppet elements are tagged with all of the class or definition
 names that contain them, and you can use the 'tags' flag to specify one
 of these names, causing only configuration elements contained within
 that class or definition to be applied. This is very useful when you are
 testing new configurations -- for instance, if you are just starting to
 manage 'ntpd', you would put all of the new elements into an 'ntpd'
 class, and call puppet with '--tags ntpd', which would only apply that
 small portion of the configuration during your testing, rather than
 applying the whole thing.
 
 'fingerprint' is a one-time flag. In this mode 'puppet agent' will run
 once and display on the console (and in the log) the current certificate
 (or certificate request) fingerprint. Providing the '--digest' option
 allows to use a different digest algorithm to generate the fingerprint.
 The main use is to verify that before signing a certificate request on
 the master, the certificate request the master received is the same as
 the one the client sent (to prevent against man-in-the-middle attacks
 when signing certificates).
 
 
 OPTIONS
 -------
 
 Note that any Puppet setting that's valid in the configuration file is also a
 valid long argument. For example, 'server' is a valid setting, so you can
 specify '--server <servername>' as an argument. Boolean settings translate into
 '--setting' and '--no-setting' pairs.
 
 See the configuration file documentation at
 http://docs.puppetlabs.com/references/stable/configuration.html for the
 full list of acceptable settings. A commented list of all settings can also be
 generated by running puppet agent with '--genconfig'.
 
 * --certname:
   Set the certname (unique ID) of the client. The master reads this
   unique identifying string, which is usually set to the node's
   fully-qualified domain name, to determine which configurations the
   node will receive. Use this option to debug setup problems or
   implement unusual node identification schemes.
   (This is a Puppet setting, and can go in puppet.conf.)
 
 * --daemonize:
   Send the process into the background. This is the default.
   (This is a Puppet setting, and can go in puppet.conf. Note the special 'no-'
   prefix for boolean settings on the command line.)
 
 * --no-daemonize:
   Do not send the process into the background.
   (This is a Puppet setting, and can go in puppet.conf. Note the special 'no-'
   prefix for boolean settings on the command line.)
 
 * --debug:
   Enable full debugging.
 
 * --detailed-exitcodes:
   Provide transaction information via exit codes. If this is enabled, an exit
   code of '2' means there were changes, an exit code of '4' means there were
   failures during the transaction, and an exit code of '6' means there were both
   changes and failures.
 
 * --digest:
   Change the certificate fingerprinting digest algorithm. The default is
   SHA256. Valid values depends on the version of OpenSSL installed, but
   will likely contain MD5, MD2, SHA1 and SHA256.
 
 * --disable:
   Disable working on the local system. This puts a lock file in place,
   causing 'puppet agent' not to work on the system until the lock file
   is removed. This is useful if you are testing a configuration and do
   not want the central configuration to override the local state until
   everything is tested and committed.
 
   Disable can also take an optional message that will be reported by the
   'puppet agent' at the next disabled run.
 
   'puppet agent' uses the same lock file while it is running, so no more
   than one 'puppet agent' process is working at a time.
 
   'puppet agent' exits after executing this.
 
 * --enable:
   Enable working on the local system. This removes any lock file,
   causing 'puppet agent' to start managing the local system again
   (although it will continue to use its normal scheduling, so it might
   not start for another half hour).
 
   'puppet agent' exits after executing this.
 
 * --fingerprint:
   Display the current certificate or certificate signing request
   fingerprint and then exit. Use the '--digest' option to change the
   digest algorithm used.
 
 * --help:
   Print this help message
 
 * --logdest:
   Where to send log messages. Choose between 'syslog' (the POSIX syslog
   service), 'eventlog' (the Windows Event Log), 'console', or the path to a log
   file. If debugging or verbosity is enabled, this defaults to 'console'.
   Otherwise, it defaults to 'syslog' on POSIX systems and 'eventlog' on Windows.
 
+  A path ending with '.json' will receive structured output in JSON format. The
+  log file will not have an ending ']' automatically written to it due to the
+  appending nature of logging. It must be appended manually to make the content
+  valid JSON.
+
 * --masterport:
   The port on which to contact the puppet master.
   (This is a Puppet setting, and can go in puppet.conf.)
 
 * --no-client:
   Do not create a config client. This will cause the daemon to start
   but not check configuration unless it is triggered with `puppet
   kick`. This only makes sense when puppet agent is being run with
   listen = true in puppet.conf or was started with the `--listen` option.
 
 * --noop:
   Use 'noop' mode where the daemon runs in a no-op or dry-run mode. This
   is useful for seeing what changes Puppet will make without actually
   executing the changes.
   (This is a Puppet setting, and can go in puppet.conf. Note the special 'no-'
   prefix for boolean settings on the command line.)
 
 * --onetime:
   Run the configuration once. Runs a single (normally daemonized) Puppet
   run. Useful for interactively running puppet agent when used in
   conjunction with the --no-daemonize option.
   (This is a Puppet setting, and can go in puppet.conf. Note the special 'no-'
   prefix for boolean settings on the command line.)
 
 * --test:
   Enable the most common options used for testing. These are 'onetime',
   'verbose', 'ignorecache', 'no-daemonize', 'no-usecacheonfailure',
   'detailed-exitcodes', 'no-splay', and 'show_diff'.
 
 * --verbose:
   Turn on verbose reporting.
 
 * --version:
   Print the puppet version number and exit.
 
 * --waitforcert:
   This option only matters for daemons that do not yet have certificates
   and it is enabled by default, with a value of 120 (seconds). This
   causes 'puppet agent' to connect to the server every 2 minutes and ask
   it to sign a certificate request. This is useful for the initial setup
   of a puppet client. You can turn off waiting for certificates by
   specifying a time of 0.
   (This is a Puppet setting, and can go in puppet.conf. Note the special 'no-'
   prefix for boolean settings on the command line.)
 
 
 EXAMPLE
 -------
     $ puppet agent --server puppet.domain.com
 
 
 DIAGNOSTICS
 -----------
 
 Puppet agent accepts the following signals:
 
 * SIGHUP:
   Restart the puppet agent daemon.
 * SIGINT and SIGTERM:
   Shut down the puppet agent daemon.
 * SIGUSR1:
   Immediately retrieve and apply configurations from the puppet master.
 * SIGUSR2:
   Close file descriptors for log files and reopen them. Used with logrotate.
 
 AUTHOR
 ------
 Luke Kanies
 
 
 COPYRIGHT
 ---------
 Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
 
     HELP
   end
 
   def run_command
     if options[:fingerprint]
       fingerprint
     else
       # It'd be nice to daemonize later, but we have to daemonize before
       # waiting for certificates so that we don't block
       daemon = daemonize_process_when(Puppet[:daemonize])
 
       wait_for_certificates
 
       if Puppet[:onetime]
         onetime(daemon)
       else
         main(daemon)
       end
     end
   end
 
   def fingerprint
     host = Puppet::SSL::Host.new
     unless cert = host.certificate || host.certificate_request
       $stderr.puts "Fingerprint asked but no certificate nor certificate request have yet been issued"
       exit(1)
       return
     end
     unless digest = cert.digest(options[:digest].to_s)
       raise ArgumentError, "Could not get fingerprint for digest '#{options[:digest]}'"
     end
     puts digest.to_s
   end
 
   def onetime(daemon)
     if Puppet[:listen]
       Puppet.notice "Ignoring --listen on onetime run"
     end
 
     unless options[:client]
       Puppet.err "onetime is specified but there is no client"
       exit(43)
       return
     end
 
     daemon.set_signal_traps
 
     begin
       exitstatus = daemon.agent.run
     rescue => detail
       Puppet.log_exception(detail)
     end
 
     daemon.stop(:exit => false)
 
     if not exitstatus
       exit(1)
     elsif options[:detailed_exitcodes] then
       exit(exitstatus)
     else
       exit(0)
     end
   end
 
   def main(daemon)
     if Puppet[:listen]
       setup_listen(daemon)
     end
     Puppet.notice "Starting Puppet client version #{Puppet.version}"
 
     daemon.start
   end
 
   # Enable all of the most common test options.
   def setup_test
     Puppet.settings.handlearg("--ignorecache")
     Puppet.settings.handlearg("--no-usecacheonfailure")
     Puppet.settings.handlearg("--no-splay")
     Puppet.settings.handlearg("--show_diff")
     Puppet.settings.handlearg("--no-daemonize")
     options[:verbose] = true
     Puppet[:onetime] = true
     options[:detailed_exitcodes] = true
   end
 
   def setup
     setup_test if options[:test]
 
     setup_logs
 
     exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
 
     if options[:fqdn]
       Puppet[:certname] = options[:fqdn]
     end
 
     Puppet.settings.use :main, :agent, :ssl
 
     # Always ignoreimport for agent. It really shouldn't even try to import,
     # but this is just a temporary band-aid.
     Puppet[:ignoreimport] = true
 
     Puppet::Transaction::Report.indirection.terminus_class = :rest
     # we want the last report to be persisted locally
     Puppet::Transaction::Report.indirection.cache_class = :yaml
 
     if Puppet[:catalog_cache_terminus]
       Puppet::Resource::Catalog.indirection.cache_class = Puppet[:catalog_cache_terminus]
     end
 
     if options[:fingerprint]
       # in fingerprint mode we just need
       # access to the local files and we don't need a ca
       Puppet::SSL::Host.ca_location = :none
     else
       Puppet::SSL::Host.ca_location = :remote
       setup_agent
     end
   end
 
   private
 
   def enable_disable_client(agent)
     if options[:enable]
       agent.enable
     elsif options[:disable]
       agent.disable(options[:disable_message] || 'reason not specified')
     end
     exit(0)
   end
 
   def setup_listen(daemon)
     Puppet.warning "Puppet --listen / kick is deprecated. See http://links.puppetlabs.com/puppet-kick-deprecation"
     unless Puppet::FileSystem.exist?(Puppet[:rest_authconfig])
       Puppet.err "Will not start without authorization file #{Puppet[:rest_authconfig]}"
       exit(14)
     end
 
     require 'puppet/network/server'
     # No REST handlers yet.
     server = Puppet::Network::Server.new(Puppet[:bindaddress], Puppet[:puppetport])
 
     daemon.server = server
   end
 
   def setup_agent
     # We need to make the client either way, we just don't start it
     # if --no-client is set.
     require 'puppet/agent'
     require 'puppet/configurer'
     agent = Puppet::Agent.new(Puppet::Configurer, (not(Puppet[:onetime])))
 
     enable_disable_client(agent) if options[:enable] or options[:disable]
 
     @agent = agent if options[:client]
   end
 
   def daemonize_process_when(should_daemonize)
     daemon = Puppet::Daemon.new(Puppet::Util::Pidlock.new(Puppet[:pidfile]))
     daemon.argv = @argv
     daemon.agent = @agent
 
     daemon.daemonize if should_daemonize
 
     daemon
   end
 
   def wait_for_certificates
     host = Puppet::SSL::Host.new
     waitforcert = options[:waitforcert] || (Puppet[:onetime] ? 0 : Puppet[:waitforcert])
     host.wait_for_cert(waitforcert)
   end
 end
diff --git a/lib/puppet/application/apply.rb b/lib/puppet/application/apply.rb
index f7f85fcc5..304381d31 100644
--- a/lib/puppet/application/apply.rb
+++ b/lib/puppet/application/apply.rb
@@ -1,299 +1,304 @@
 require 'puppet/application'
 require 'puppet/configurer'
 require 'puppet/util/profiler/aggregate'
 
 class Puppet::Application::Apply < Puppet::Application
 
   option("--debug","-d")
   option("--execute EXECUTE","-e") do |arg|
     options[:code] = arg
   end
   option("--loadclasses","-L")
   option("--test","-t")
   option("--verbose","-v")
   option("--use-nodes")
   option("--detailed-exitcodes")
 
   option("--write-catalog-summary")
 
   option("--catalog catalog",  "-c catalog") do |arg|
     options[:catalog] = arg
   end
 
   option("--logdest LOGDEST", "-l") do |arg|
     handle_logdest_arg(arg)
   end
 
   option("--parseonly") do |args|
     puts "--parseonly has been removed. Please use 'puppet parser validate <manifest>'"
     exit 1
   end
 
   def help
     <<-'HELP'
 
 puppet-apply(8) -- Apply Puppet manifests locally
 ========
 
 SYNOPSIS
 --------
 Applies a standalone Puppet manifest to the local system.
 
 
 USAGE
 -----
 puppet apply [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose]
   [-e|--execute] [--detailed-exitcodes] [-L|--loadclasses]
   [-l|--logdest syslog|eventlog|<FILE>|console] [--noop]
   [--catalog <catalog>] [--write-catalog-summary] <file>
 
 
 DESCRIPTION
 -----------
 This is the standalone puppet execution tool; use it to apply
 individual manifests.
 
 When provided with a modulepath, via command line or config file, puppet
 apply can effectively mimic the catalog that would be served by puppet
 master with access to the same modules, although there are some subtle
 differences. When combined with scheduling and an automated system for
 pushing manifests, this can be used to implement a serverless Puppet
 site.
 
 Most users should use 'puppet agent' and 'puppet master' for site-wide
 manifests.
 
 
 OPTIONS
 -------
 Note that any setting that's valid in the configuration
 file is also a valid long argument. For example, 'tags' is a
 valid setting, so you can specify '--tags <class>,<tag>'
 as an argument.
 
 See the configuration file documentation at
 http://docs.puppetlabs.com/references/stable/configuration.html for the
 full list of acceptable parameters. A commented list of all
 configuration options can also be generated by running puppet with
 '--genconfig'.
 
 * --debug:
   Enable full debugging.
 
 * --detailed-exitcodes:
   Provide transaction information via exit codes. If this is enabled, an exit
   code of '2' means there were changes, an exit code of '4' means there were
   failures during the transaction, and an exit code of '6' means there were both
   changes and failures.
 
 * --help:
   Print this help message
 
 * --loadclasses:
   Load any stored classes. 'puppet agent' caches configured classes
   (usually at /etc/puppet/classes.txt), and setting this option causes
   all of those classes to be set in your puppet manifest.
 
 * --logdest:
   Where to send log messages. Choose between 'syslog' (the POSIX syslog
   service), 'eventlog' (the Windows Event Log), 'console', or the path to a log
   file. Defaults to 'console'.
 
+  A path ending with '.json' will receive structured output in JSON format. The
+  log file will not have an ending ']' automatically written to it due to the
+  appending nature of logging. It must be appended manually to make the content
+  valid JSON.
+
 * --noop:
   Use 'noop' mode where Puppet runs in a no-op or dry-run mode. This
   is useful for seeing what changes Puppet will make without actually
   executing the changes.
 
 * --execute:
   Execute a specific piece of Puppet code
 
 * --test:
   Enable the most common options used for testing. These are 'verbose',
   'detailed-exitcodes' and 'show_diff'.
 
 * --verbose:
   Print extra information.
 
 * --catalog:
   Apply a JSON catalog (such as one generated with 'puppet master --compile'). You can
   either specify a JSON file or pipe in JSON from standard input.
 
 * --write-catalog-summary
   After compiling the catalog saves the resource list and classes list to the node
   in the state directory named classes.txt and resources.txt
 
 EXAMPLE
 -------
     $ puppet apply -l /tmp/manifest.log manifest.pp
     $ puppet apply --modulepath=/root/dev/modules -e "include ntpd::server"
     $ puppet apply --catalog catalog.json
 
 
 AUTHOR
 ------
 Luke Kanies
 
 
 COPYRIGHT
 ---------
 Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
 
     HELP
   end
 
   def app_defaults
     super.merge({
       :default_file_terminus => :file_server,
     })
   end
 
   def run_command
     if options[:catalog]
       apply
     else
       main
     end
   end
 
   def apply
     if options[:catalog] == "-"
       text = $stdin.read
     else
       text = ::File.read(options[:catalog])
     end
     catalog = read_catalog(text)
     apply_catalog(catalog)
   end
 
   def main
     # Set our code or file to use.
     if options[:code] or command_line.args.length == 0
       Puppet[:code] = options[:code] || STDIN.read
     else
       manifest = command_line.args.shift
       raise "Could not find file #{manifest}" unless Puppet::FileSystem.exist?(manifest)
       Puppet.warning("Only one file can be applied per run.  Skipping #{command_line.args.join(', ')}") if command_line.args.size > 0
     end
 
     unless Puppet[:node_name_fact].empty?
       # Collect our facts.
       unless facts = Puppet::Node::Facts.indirection.find(Puppet[:node_name_value])
         raise "Could not find facts for #{Puppet[:node_name_value]}"
       end
 
       Puppet[:node_name_value] = facts.values[Puppet[:node_name_fact]]
       facts.name = Puppet[:node_name_value]
     end
 
     configured_environment = Puppet.lookup(:current_environment)
     apply_environment = manifest ?
       configured_environment.override_with(:manifest => manifest) :
       configured_environment
 
     Puppet.override({:current_environment => apply_environment}, "For puppet apply") do
       # Find our Node
       unless node = Puppet::Node.indirection.find(Puppet[:node_name_value])
         raise "Could not find node #{Puppet[:node_name_value]}"
       end
 
       # Merge in the facts.
       node.merge(facts.values) if facts
 
       # Allow users to load the classes that puppet agent creates.
       if options[:loadclasses]
         file = Puppet[:classfile]
         if Puppet::FileSystem.exist?(file)
           unless FileTest.readable?(file)
             $stderr.puts "#{file} is not readable"
             exit(63)
           end
           node.classes = ::File.read(file).split(/[\s\n]+/)
         end
       end
 
       begin
         # Compile our catalog
         starttime = Time.now
         catalog = Puppet::Resource::Catalog.indirection.find(node.name, :use_node => node)
 
         # Translate it to a RAL catalog
         catalog = catalog.to_ral
 
         catalog.finalize
 
         catalog.retrieval_duration = Time.now - starttime
 
         if options[:write_catalog_summary]
           catalog.write_class_file
           catalog.write_resource_file
         end
 
         exit_status = apply_catalog(catalog)
 
         if not exit_status
           exit(1)
         elsif options[:detailed_exitcodes] then
           exit(exit_status)
         else
           exit(0)
         end
       rescue => detail
         Puppet.log_exception(detail)
         exit(1)
       end
     end
 
   ensure
     if @profiler
       Puppet::Util::Profiler.remove_profiler(@profiler)
       @profiler.shutdown
     end
   end
 
   # Enable all of the most common test options.
   def setup_test
     Puppet.settings.handlearg("--show_diff")
     options[:verbose] = true
     options[:detailed_exitcodes] = true
   end
 
   def setup
     setup_test if options[:test]
 
     exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
 
     Puppet::Util::Log.newdestination(:console) unless options[:setdest]
 
     Signal.trap(:INT) do
       $stderr.puts "Exiting"
       exit(1)
     end
 
     # we want the last report to be persisted locally
     Puppet::Transaction::Report.indirection.cache_class = :yaml
 
     set_log_level
 
     if Puppet[:profile]
       @profiler = Puppet::Util::Profiler.add_profiler(Puppet::Util::Profiler::Aggregate.new(Puppet.method(:debug), "apply"))
     end
   end
 
   private
 
   def read_catalog(text)
     begin
       catalog = Puppet::Resource::Catalog.convert_from(Puppet::Resource::Catalog.default_format,text)
       catalog = Puppet::Resource::Catalog.pson_create(catalog) unless catalog.is_a?(Puppet::Resource::Catalog)
     rescue => detail
       raise Puppet::Error, "Could not deserialize catalog from pson: #{detail}", detail.backtrace
     end
 
     catalog.to_ral
   end
 
   def apply_catalog(catalog)
     configurer = Puppet::Configurer.new
     configurer.run(:catalog => catalog, :pluginsync => false)
   end
 end
diff --git a/lib/puppet/application/device.rb b/lib/puppet/application/device.rb
index e37325834..f56c4ad27 100644
--- a/lib/puppet/application/device.rb
+++ b/lib/puppet/application/device.rb
@@ -1,255 +1,260 @@
 require 'puppet/application'
 require 'puppet/util/network_device'
 
 class Puppet::Application::Device < Puppet::Application
 
   run_mode :agent
 
   attr_accessor :args, :agent, :host
 
   def app_defaults
     super.merge({
       :catalog_terminus => :rest,
       :catalog_cache_terminus => :json,
       :node_terminus => :rest,
       :facts_terminus => :network_device,
     })
   end
 
   def preinit
     # Do an initial trap, so that cancels don't get a stack trace.
     Signal.trap(:INT) do
       $stderr.puts "Cancelling startup"
       exit(0)
     end
 
     {
       :waitforcert => nil,
       :detailed_exitcodes => false,
       :verbose => false,
       :debug => false,
       :centrallogs => false,
       :setdest => false,
     }.each do |opt,val|
       options[opt] = val
     end
 
     @args = {}
   end
 
   option("--centrallogging")
   option("--debug","-d")
   option("--verbose","-v")
 
   option("--detailed-exitcodes") do |arg|
     options[:detailed_exitcodes] = true
   end
 
   option("--logdest DEST", "-l DEST") do |arg|
     handle_logdest_arg(arg)
   end
 
   option("--waitforcert WAITFORCERT", "-w") do |arg|
     options[:waitforcert] = arg.to_i
   end
 
   option("--port PORT","-p") do |arg|
     @args[:Port] = arg
   end
 
     def help
       <<-'HELP'
 
 puppet-device(8) -- Manage remote network devices
 ========
 
 SYNOPSIS
 --------
 Retrieves all configurations from the puppet master and apply
 them to the remote devices configured in /etc/puppet/device.conf.
 
 Currently must be run out periodically, using cron or something similar.
 
 USAGE
 -----
   puppet device [-d|--debug] [--detailed-exitcodes] [-V|--version]
                 [-h|--help] [-l|--logdest syslog|<file>|console]
                 [-v|--verbose] [-w|--waitforcert <seconds>]
 
 
 DESCRIPTION
 -----------
 Once the client has a signed certificate for a given remote device, it will
 retrieve its configuration and apply it.
 
 USAGE NOTES
 -----------
 One need a /etc/puppet/device.conf file with the following content:
 
 [remote.device.fqdn]
 type <type>
 url <url>
 
 where:
  * type: the current device type (the only value at this time is cisco)
  * url: an url allowing to connect to the device
 
 Supported url must conforms to:
  scheme://user:password@hostname/?query
 
  with:
   * scheme: either ssh or telnet
   * user: username, can be omitted depending on the switch/router configuration
   * password: the connection password
   * query: this is device specific. Cisco devices supports an enable parameter whose
   value would be the enable password.
 
 OPTIONS
 -------
 Note that any setting that's valid in the configuration file
 is also a valid long argument.  For example, 'server' is a valid configuration
 parameter, so you can specify '--server <servername>' as an argument.
 
 * --debug:
   Enable full debugging.
 
 * --detailed-exitcodes:
   Provide transaction information via exit codes. If this is enabled, an exit
   code of '1' means at least one device had a compile failure, an exit code of
   '2' means at least one device had resource changes, and an exit code of '4'
   means at least one device had resource failures. Exit codes of '3', '5', '6',
   or '7' means that a bitwise combination of the preceeding exit codes happened.
 
 * --help:
   Print this help message
 
 * --logdest:
-  Where to send messages.  Choose between syslog, the console, and a log file.
-  Defaults to sending messages to syslog, or the console if debugging or
-  verbosity is enabled.
+  Where to send log messages. Choose between 'syslog' (the POSIX syslog
+  service), 'console', or the path to a log file. If debugging or verbosity is
+  enabled, this defaults to 'console'. Otherwise, it defaults to 'syslog'.
+
+  A path ending with '.json' will receive structured output in JSON format. The
+  log file will not have an ending ']' automatically written to it due to the
+  appending nature of logging. It must be appended manually to make the content
+  valid JSON.
 
 * --verbose:
   Turn on verbose reporting.
 
 * --waitforcert:
   This option only matters for daemons that do not yet have certificates
   and it is enabled by default, with a value of 120 (seconds).  This causes
   +puppet agent+ to connect to the server every 2 minutes and ask it to sign a
   certificate request.  This is useful for the initial setup of a puppet
   client.  You can turn off waiting for certificates by specifying a time
   of 0.
 
 EXAMPLE
 -------
       $ puppet device --server puppet.domain.com
 
 AUTHOR
 ------
 Brice Figureau
 
 
 COPYRIGHT
 ---------
 Copyright (c) 2011 Puppet Labs, LLC
 Licensed under the Apache 2.0 License
       HELP
     end
 
 
   def main
     vardir = Puppet[:vardir]
     confdir = Puppet[:confdir]
     certname = Puppet[:certname]
 
     # find device list
     require 'puppet/util/network_device/config'
     devices = Puppet::Util::NetworkDevice::Config.devices
     if devices.empty?
       Puppet.err "No device found in #{Puppet[:deviceconfig]}"
       exit(1)
     end
     returns = devices.collect do |devicename,device|
       begin
         device_url = URI.parse(device.url)
         # Handle nil scheme & port
         scheme = "#{device_url.scheme}://" if device_url.scheme
         port = ":#{device_url.port}" if device_url.port
         Puppet.info "starting applying configuration to #{device.name} at #{scheme}#{device_url.host}#{port}#{device_url.path}"
 
         # override local $vardir and $certname
         Puppet[:confdir] = ::File.join(Puppet[:devicedir], device.name)
         Puppet[:vardir] = ::File.join(Puppet[:devicedir], device.name)
         Puppet[:certname] = device.name
 
         # this will reload and recompute default settings and create the devices sub vardir, or we hope so :-)
         Puppet.settings.use :main, :agent, :ssl
 
         # this init the device singleton, so that the facts terminus
         # and the various network_device provider can use it
         Puppet::Util::NetworkDevice.init(device)
 
         # ask for a ssl cert if needed, but at least
         # setup the ssl system for this device.
         setup_host
 
         require 'puppet/configurer'
         configurer = Puppet::Configurer.new
         configurer.run(:network_device => true, :pluginsync => Puppet[:pluginsync])
       rescue => detail
         Puppet.log_exception(detail)
         # If we rescued an error, then we return 1 as the exit code
         1
       ensure
         Puppet[:vardir] = vardir
         Puppet[:confdir] = confdir
         Puppet[:certname] = certname
         Puppet::SSL::Host.reset
       end
     end
     if ! returns or returns.compact.empty?
       exit(1)
     elsif options[:detailed_exitcodes]
       # Bitwise OR the return codes together, puppet style
       exit(returns.compact.reduce(:|))
     elsif returns.include? 1
       exit(1)
     else
       exit(0)
     end
   end
 
   def setup_host
     @host = Puppet::SSL::Host.new
     waitforcert = options[:waitforcert] || (Puppet[:onetime] ? 0 : Puppet[:waitforcert])
     @host.wait_for_cert(waitforcert)
   end
 
   def setup
     setup_logs
 
     args[:Server] = Puppet[:server]
     if options[:centrallogs]
       logdest = args[:Server]
 
       logdest += ":" + args[:Port] if args.include?(:Port)
       Puppet::Util::Log.newdestination(logdest)
     end
 
     Puppet.settings.use :main, :agent, :device, :ssl
 
     # Always ignoreimport for agent. It really shouldn't even try to import,
     # but this is just a temporary band-aid.
     Puppet[:ignoreimport] = true
 
     # We need to specify a ca location for all of the SSL-related
     # indirected classes to work; in fingerprint mode we just need
     # access to the local files and we don't need a ca.
     Puppet::SSL::Host.ca_location = :remote
 
     Puppet::Transaction::Report.indirection.terminus_class = :rest
 
     if Puppet[:catalog_cache_terminus]
       Puppet::Resource::Catalog.indirection.cache_class = Puppet[:catalog_cache_terminus].intern
     end
   end
 end
diff --git a/lib/puppet/application/master.rb b/lib/puppet/application/master.rb
index a238ff4b5..c8abe7eeb 100644
--- a/lib/puppet/application/master.rb
+++ b/lib/puppet/application/master.rb
@@ -1,304 +1,309 @@
 require 'puppet/application'
 require 'puppet/daemon'
 require 'puppet/util/pidlock'
 
 class Puppet::Application::Master < Puppet::Application
 
   run_mode :master
 
   option("--debug", "-d")
   option("--verbose", "-v")
 
   # internal option, only to be used by ext/rack/config.ru
   option("--rack")
 
   option("--compile host",  "-c host") do |arg|
     options[:node] = arg
   end
 
   option("--logdest DEST",  "-l DEST") do |arg|
     handle_logdest_arg(arg)
   end
 
   option("--parseonly") do |args|
     puts "--parseonly has been removed. Please use 'puppet parser validate <manifest>'"
     exit 1
   end
 
   def help
     <<-'HELP'
 
 puppet-master(8) -- The puppet master daemon
 ========
 
 SYNOPSIS
 --------
 The central puppet server. Functions as a certificate authority by
 default.
 
 
 USAGE
 -----
 puppet master [-D|--daemonize|--no-daemonize] [-d|--debug] [-h|--help]
   [-l|--logdest syslog|<FILE>|console] [-v|--verbose] [-V|--version]
   [--compile <NODE-NAME>]
 
 
 DESCRIPTION
 -----------
 This command starts an instance of puppet master, running as a daemon
 and using Ruby's built-in Webrick webserver. Puppet master can also be
 managed by other application servers; when this is the case, this
 executable is not used.
 
 
 OPTIONS
 -------
 
 Note that any Puppet setting that's valid in the configuration file is also a
 valid long argument. For example, 'server' is a valid setting, so you can
 specify '--server <servername>' as an argument. Boolean settings translate into
 '--setting' and '--no-setting' pairs.
 
 See the configuration file documentation at
 http://docs.puppetlabs.com/references/stable/configuration.html for the
 full list of acceptable settings. A commented list of all settings can also be
 generated by running puppet master with '--genconfig'.
 
 * --daemonize:
   Send the process into the background. This is the default.
   (This is a Puppet setting, and can go in puppet.conf. Note the special 'no-'
   prefix for boolean settings on the command line.)
 
 * --no-daemonize:
   Do not send the process into the background.
   (This is a Puppet setting, and can go in puppet.conf. Note the special 'no-'
   prefix for boolean settings on the command line.)
 
 * --debug:
   Enable full debugging.
 
 * --help:
   Print this help message.
 
 * --logdest:
   Where to send log messages. Choose between 'syslog' (the POSIX syslog
   service), 'console', or the path to a log file. If debugging or verbosity is
   enabled, this defaults to 'console'. Otherwise, it defaults to 'syslog'.
 
+  A path ending with '.json' will receive structured output in JSON format. The
+  log file will not have an ending ']' automatically written to it due to the
+  appending nature of logging. It must be appended manually to make the content
+  valid JSON.
+
 * --masterport:
   The port on which to listen for traffic.
   (This is a Puppet setting, and can go in puppet.conf.)
 
 * --verbose:
   Enable verbosity.
 
 * --version:
   Print the puppet version number and exit.
 
 * --compile:
   Compile a catalogue and output it in JSON from the puppet master. Uses
   facts contained in the $vardir/yaml/ directory to compile the catalog.
 
 
 EXAMPLE
 -------
   puppet master
 
 DIAGNOSTICS
 -----------
 
 When running as a standalone daemon, puppet master accepts the
 following signals:
 
 * SIGHUP:
   Restart the puppet master server.
 * SIGINT and SIGTERM:
   Shut down the puppet master server.
 * SIGUSR2:
   Close file descriptors for log files and reopen them. Used with logrotate.
 
 AUTHOR
 ------
 Luke Kanies
 
 
 COPYRIGHT
 ---------
 Copyright (c) 2012 Puppet Labs, LLC Licensed under the Apache 2.0 License
 
     HELP
   end
 
   # Sets up the 'node_cache_terminus' default to use the Write Only Yaml terminus :write_only_yaml.
   # If this is not wanted, the setting ´node_cache_terminus´ should be set to nil.
   # @see Puppet::Node::WriteOnlyYaml
   # @see #setup_node_cache
   # @see puppet issue 16753
   #
   def app_defaults
     super.merge({
       :node_cache_terminus => :write_only_yaml,
       :facts_terminus => 'yaml'
     })
   end
 
   def preinit
     Signal.trap(:INT) do
       $stderr.puts "Canceling startup"
       exit(0)
     end
 
     # save ARGV to protect us from it being smashed later by something
     @argv = ARGV.dup
   end
 
   def run_command
     if options[:node]
       compile
     else
       main
     end
   end
 
   def compile
     begin
       unless catalog = Puppet::Resource::Catalog.indirection.find(options[:node])
         raise "Could not compile catalog for #{options[:node]}"
       end
 
       puts PSON::pretty_generate(catalog.to_resource, :allow_nan => true, :max_nesting => false)
     rescue => detail
       Puppet.log_exception(detail, "Failed to compile catalog for node #{options[:node]}: #{detail}")
       exit(30)
     end
     exit(0)
   end
 
   def main
     require 'etc'
     # Make sure we've got a localhost ssl cert
     Puppet::SSL::Host.localhost
 
     # And now configure our server to *only* hit the CA for data, because that's
     # all it will have write access to.
     Puppet::SSL::Host.ca_location = :only if Puppet::SSL::CertificateAuthority.ca?
 
     if Puppet.features.root?
       begin
         Puppet::Util.chuser
       rescue => detail
         Puppet.log_exception(detail, "Could not change user to #{Puppet[:user]}: #{detail}")
         exit(39)
       end
     end
 
     if options[:rack]
       start_rack_master
     else
       start_webrick_master
     end
   end
 
   def setup_logs
     set_log_level
 
     if !options[:setdest]
       if options[:node]
         # We are compiling a catalog for a single node with '--compile' and logging
         # has not already been configured via '--logdest' so log to the console.
         Puppet::Util::Log.newdestination(:console)
       elsif !(Puppet[:daemonize] or options[:rack])
         # We are running a webrick master which has been explicitly foregrounded
         # and '--logdest' has not been passed, assume users want to see logging
         # and log to the console.
         Puppet::Util::Log.newdestination(:console)
       else
         # No explicit log destination has been given with '--logdest' and we're
         # either a daemonized webrick master or running under rack, log to syslog.
         Puppet::Util::Log.newdestination(:syslog)
       end
     end
   end
 
   def setup_terminuses
     require 'puppet/file_serving/content'
     require 'puppet/file_serving/metadata'
 
     Puppet::FileServing::Content.indirection.terminus_class = :file_server
     Puppet::FileServing::Metadata.indirection.terminus_class = :file_server
 
     Puppet::FileBucket::File.indirection.terminus_class = :file
   end
 
   def setup_ssl
     # Configure all of the SSL stuff.
     if Puppet::SSL::CertificateAuthority.ca?
       Puppet::SSL::Host.ca_location = :local
       Puppet.settings.use :ca
       Puppet::SSL::CertificateAuthority.instance
     else
       Puppet::SSL::Host.ca_location = :none
     end
   end
 
   # Sets up a special node cache "write only yaml" that collects and stores node data in yaml
   # but never finds or reads anything (this since a real cache causes stale data to be served
   # in circumstances when the cache can not be cleared).
   # @see puppet issue 16753
   # @see Puppet::Node::WriteOnlyYaml
   # @return [void]
   def setup_node_cache
     Puppet::Node.indirection.cache_class = Puppet[:node_cache_terminus]
   end
 
   def setup
     raise Puppet::Error.new("Puppet master is not supported on Microsoft Windows") if Puppet.features.microsoft_windows?
 
     setup_logs
 
     exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
 
     Puppet.settings.use :main, :master, :ssl, :metrics
 
     setup_terminuses
 
     setup_node_cache
 
     setup_ssl
   end
 
   private
 
   # Start a master that will be using WeBrick.
   #
   # This method will block until the master exits.
   def start_webrick_master
     require 'puppet/network/server'
     daemon = Puppet::Daemon.new(Puppet::Util::Pidlock.new(Puppet[:pidfile]))
 
     daemon.argv = @argv
     daemon.server = Puppet::Network::Server.new(Puppet[:bindaddress], Puppet[:masterport])
     daemon.daemonize if Puppet[:daemonize]
 
     announce_start_of_master
 
     daemon.start
   end
 
   # Start a master that will be used for a Rack container.
   #
   # This method immediately returns the Rack handler that must be returned to
   # the calling Rack container
   def start_rack_master
     require 'puppet/network/http/rack'
 
     announce_start_of_master
 
     return Puppet::Network::HTTP::Rack.new()
   end
 
   def announce_start_of_master
     Puppet.notice "Starting Puppet master version #{Puppet.version}"
   end
 end