The Journal - a proposed syslog replacement [LWN.net]

The Journal - a proposed syslog replacement

Posted Nov 18, 2011 17:43 UTC (Fri) by quotemstr (subscriber, #45331)
In reply to: The Journal - a proposed syslog replacement by zoonoo
Parent article: The Journal - a proposed syslog replacement

The systemd people are trying to fix something that's not broken. Binary logging is unnecessary and harmful. Windows uses binary logging for everything and is worse off for it. The beauty of plain-text logs is the ability to use normal tools and easily compose pipelines. When you switch to a binary log format, you either lose these benefits, or have to convert to text before manipulating logs anyway, in which case you lose all the purported benefits of binary logging.

If you want cryptographic signatures in your log file, you can include a signed hash field _in the text format_ without having to discard 30 years of refinement.

to post comments

The Journal - a proposed syslog replacement

Posted Nov 18, 2011 17:48 UTC (Fri) by zoonoo (guest, #80519) [Link] (2 responses)

Hey, I completely agree with you.
My statement was meant to be ironic.

The Journal - a proposed syslog replacement

Posted Nov 18, 2011 22:44 UTC (Fri) by mgedmin (guest, #34497) [Link] (1 responses)

Didn't you know irony and sarcasm do not work on the Internet?

The Journal - a proposed syslog replacement

Posted Nov 19, 2011 4:24 UTC (Sat) by ewan (guest, #5533) [Link]

No way! Sarcasm is totally awesome on the internet.

The Journal - a proposed syslog replacement

Posted Nov 18, 2011 17:53 UTC (Fri) by cmorgan (guest, #71980) [Link] (2 responses)

This is a simplistic way to think about it.

Binary logs have several advantages. Data is split into fields, making it easier to analyze programmatically. Data that isn't easily represented by text or that would span several lines of text could be included. Searching is much easier.

As long as there are easy to use command line tools that will generate text output (maybe call the tool dmesg or whatever) the benefits of using a binary only format would be mostly transparent to end users.

The Journal - a proposed syslog replacement

Posted Nov 18, 2011 18:00 UTC (Fri) by quotemstr (subscriber, #45331) [Link] (1 responses)

> Data is split into fields, making it easier to analyze programmatically.

syslog lines are broken into fields too. How often do you need to break down these logs _further_? The theoretical benefit of programmatic analysis doesn't seem worth the trouble of changing everything and the persistent trouble of a binary log format.

The Journal - a proposed syslog replacement

Posted Nov 18, 2011 18:05 UTC (Fri) by cmorgan (guest, #71980) [Link]

> syslog lines are broken into fields too. How often do you need to break down these logs _further_? The theoretical benefit of programmatic analysis doesn't seem worth the trouble of changing everything and the persistent trouble of a binary log format.

Some people do have a use for breaking the data down further. Being able to organize log entries by nested modules/submodules.

Try to have an open mind. systemd was a great idea for several reasons. So much so that most distributions have adopted or plan to adopt it. If this idea solves issues it too will be adopted. We can't forget that sometimes things evolve. In this case, would you care as much if a tool would provide you with the same looking output that you see today? What difference would there be in that case? Everyone can win (or at least break even).

The Journal - a proposed syslog replacement

Posted Nov 20, 2011 10:26 UTC (Sun) by misc (subscriber, #73730) [Link]

The FAQ clearly say that Journal and regular syslog are not mutually exclusive ( 3rd question ). So I fail to see why people find a dichotomy when there is clearly nothing.