2 ms·

what value is syslog adding? The standardized network protocol? Exactly. Every piece of software under the sun either logs to syslog by default or has a config

by moe 15y ago

what value is syslog adding? The standardized network protocol? Exactly. Every piece of software under the sun either logs to syslog by default or has a config-switch/patch to make it so. Yes, syslog the protocol is pretty nasty. Yes, syslog daemons are pretty nasty. But they get the job done and you are free to put anything (including redis) at the end of the pipe. Coping with syslog is by far easier than trying to make all "legacy software" including the kernel speak something else entirely.

tptacek 15y ago
But who's suggesting that? Nobody is saying "let's have the kernel log to Redis". By all means, hot potato the kernel stuff and the wrapper stuff and your authlog and whatever through syslog before it gets dumped into Redis. But if you control it, why bother with syslog? Syslog is a piece of junk. Don't bother. Any ad hoc scheme you come up with that uses a real backend store will be better than syslog.
- moe 15y ago
  But if you control it, why bother with syslog? I'd ask this backwards: Why bother with a homegrown solution when syslog exists and gets the job done? A home-grown solution takes at least a couple weeks to stabilize, likely much longer before the last bugs are ironed out. Syslog takes about a day to beat into shape. Any ad hoc scheme you come up with that uses a real backend store will be better than syslog. You know better than that. Shipping messages reliably is a surprisingly tedious problem. First you realize you need a disk-spool. Then you realize that spool should be size-capped anyhow. Eventually your boss says you need a network topology more complex than A->B for some idiotic but inevitable reason. And then next month you run into some redis limitation and realize some kind of datastore abstraction would have been a better idea to begin with. Hmm, perhaps dump to plain-text files until we figure that one out? See the pattern here? At the end you have reinvented syslog. Sure, yours may be nicer or at least different. But that's a whole lot of work to avoid something that, despite all its warts, already works.

by moe 15y ago

tptacek 15y ago

But who's suggesting that? Nobody is saying "let's have the kernel log to Redis". By all means, hot potato the kernel stuff and the wrapper stuff and your authlog and whatever through syslog before it gets dumped into Redis. But if you control it, why bother with syslog? Syslog is a piece of junk. Don't bother. Any ad hoc scheme you come up with that uses a real backend store will be better than syslog.

moe 15y ago
But if you control it, why bother with syslog? I'd ask this backwards: Why bother with a homegrown solution when syslog exists and gets the job done? A home-grown solution takes at least a couple weeks to stabilize, likely much longer before the last bugs are ironed out. Syslog takes about a day to beat into shape. Any ad hoc scheme you come up with that uses a real backend store will be better than syslog. You know better than that. Shipping messages reliably is a surprisingly tedious problem. First you realize you need a disk-spool. Then you realize that spool should be size-capped anyhow. Eventually your boss says you need a network topology more complex than A->B for some idiotic but inevitable reason. And then next month you run into some redis limitation and realize some kind of datastore abstraction would have been a better idea to begin with. Hmm, perhaps dump to plain-text files until we figure that one out? See the pattern here? At the end you have reinvented syslog. Sure, yours may be nicer or at least different. But that's a whole lot of work to avoid something that, despite all its warts, already works.