The Journal - a proposed syslog replacement [LWN.net]

The Journal - a proposed syslog replacement

Posted Nov 19, 2011 2:16 UTC (Sat) by jubal (subscriber, #67202)
In reply to: The Journal - a proposed syslog replacement by HelloWorld
Parent article: The Journal - a proposed syslog replacement

Mr World, excuse me, are you a sysadmin?

The quoted journald document promises:
breaking compatibility with existing standard and protocols, used not only by Linux systems, but by almost everything else,
coupling journald with systemd, thus making it non-portable, thus locking out non-Linux systems, all Linux systems not using systemd as an init replacement and most appliances,
using *undocumented* binary format for storing compressed and possibly encrypted and/or signed data.

Frankly, these three issues nullify all other described advantages.

to post comments

The Journal - a proposed syslog replacement

Posted Nov 19, 2011 2:55 UTC (Sat) by HelloWorld (guest, #56129) [Link] (3 responses)

> breaking compatibility with existing standard and protocols, used not only by Linux systems, but by almost everything else,
Yeah, except that it doesn't. From said document: "Data can be generated from a variety of sources: [...], userspace messages generated with syslog(3)"

> coupling journald with systemd, thus making it non-portable, thus locking out non-Linux systems, all Linux systems not using systemd as an init replacement and most appliances,
If this is a problem for you, then use something else. Just don't expect Lennart to make his life harder by supporting non-Linux and non-systemd boxes.

> using *undocumented* binary format for storing compressed and possibly encrypted and/or signed data.
Why would one document a file format that isn't stable and may be changed in the future? Especially when you can just use the library to read it...

The Journal - a proposed syslog replacement

Posted Nov 19, 2011 3:40 UTC (Sat) by dskoll (subscriber, #1630) [Link] (2 responses)

Why would one document a file format that isn't stable and may be changed in the future? Especially when you can just use the library to read it...

We're talking about logs here. They could contain important information needed a long time after it is generated, possibly even for legal reasons. If you are given a court order to produce two-year-old logs and can no longer read your old logs because the file format has changed in the meantime... you will not be very happy (and neither will the court.)

Indexing log files for performance is not a bad idea. Making them tamper-evident is a good idea too. But both of those can be done by adding to existing plain-text log file formats. You don't need to throw that out in favour of a binary format.

The Journal - a proposed syslog replacement

Posted Nov 19, 2011 20:59 UTC (Sat) by HelloWorld (guest, #56129) [Link] (1 responses)

> We're talking about logs here. They could contain important information needed a long time after it is generated, possibly even for legal reasons. If you are given a court order to produce two-year-old logs and can no longer read your old logs because the file format has changed in the meantime...
I trust Lennart to develop a solution to this, should this case actually arise. There are two obvious solutions. One is to implement a conversion tool after a format change that will be maintained indefinitely (a tool that simply reads a log file and outputs it again in a new format is unlikely to require a lot of maintenance). Another one is to simply keep the code for reading pre-format-change log files in the library, so that everything just works even with newer tools as long as they use the library.
Also, one should keep in mind that journald is a very young project. I'd guess they'll document the file format eventually when they're sure it does what they need it to do.

The Journal - a proposed syslog replacement

Posted Nov 21, 2011 14:40 UTC (Mon) by regala (guest, #15745) [Link]

> journald is a very young project. I'd guess they'll document the file format eventually when they're sure it does what they need it to do

given we're talking about Lennart and Kay, it will never do what they need it to do long enough to call it "stable format". ;)

The Journal - a proposed syslog replacement

Posted Nov 19, 2011 7:43 UTC (Sat) by slashdot (guest, #22014) [Link]

Being open source makes these problems all easily fixable:
- Anyone can add support for whatever "standard and protocol" he wants
- Anyone can decouple it from systemd
- Anyone can read the source and document the format

But Red Hat ought to hire a PR spokesman for Poettering, to stop him from making these unnecessarily divisive statements, since he could just say that they "haven't yet had the time" to do those things, rather than outright saying "HAHA NO!" to reasonable points like those.