6 ms·

If you need syslogd, isn’t it as simple as yum install syslogd and then you’re sorted?

Sanddancer 13y ago
I can, however, again, it's a pretty poor direction that only serves to fragment systems. Many of the complaints that drove the creation of journald could have been better solved through a better default syslogd configuration. Additionally, the journald solution for needs such as remote logging or logging to multiple locations means that you now need to pipe through a process that has a near sole job of piping to another process. It just gives a very bad feeling of hackishness to me.
- CraigJPerry 13y ago
  I don't think the fragmentation claim stands up to scrutiny. It's so far been adopted by redhat, suse, arch, coreos and with some consideration by debian. The only big name not thinking about it is Ubuntu. I don't think that many of the journald drivers could have been solved by better syslogd configuration, for example journald cryptographically signs each log entry. Even if you get root on my box, you can't edit an entry without me knowing. That's not possible in any meaningful way with syslog. I don't share the view of a hack, the speed improvements of introducing journald have been tremendous and usability is mostly better. For example, the number 1 thing done with syslog output is probably either grep it, so journald improves on this: journalctl _COMM=sshd --since yesterday --until "08:30" OR journalctl /usr/sbin/sshd --since yesterday --until "08:30" Or tail it journalctl -F The places i don't like the user interface are around starting and stopping services. However the old interfaces work fine for now.
  - Sanddancer 13y ago
    Think bigger than Linux. Think those with freebsd boxes, netbsd boxes, solaris boxes, etc. They're all very much relevant, but left out in the cold by deliberate decisions of the systemd folks to eschew compatibility. Functionality-wise, journald has no way of acting on the messages it receives. With syslogd, it's fairly trivial to write a script that will send a nagios alert every time a service is restarted, for example. How does one do that with journald?
    - dignan 13y ago
      systemd itself provides the functionality to run commands at points during the lifecycle of a service[1]. As for the people in mixed environments, you can forward journald to syslog [2]. [1] http://www.freedesktop.org/software/systemd/man/systemd.service.html http://www.freedesktop.org/software/systemd/man/systemd.serv... [2] http://www.freedesktop.org/software/systemd/man/journald.conf.html http://www.freedesktop.org/software/systemd/man/journald.con...
      - Sanddancer 13y ago
        That's a tiny sliver of what you can do with syslog piping. For example, fail2ban works by piping the contents of the auth stream of syslog -- usually also put into auth.log -- into a script that monitors for bruteforce attempts. This kind of reactivity is a lot harder on journald configurations.
        ibotty 13y ago
        ehm. no. it can just stream the output of `journalctl -f`. it can filter even better than before, because fail2ban usually does not care about everything in `auth.log`. i guess i don't see the problem.
        bkor 13y ago
        There have been various tools which have done this. And a lot had huge security bugs. Despite what you claim, this is also easily doable with journal plus similar solutions are available for journal.
    - bkor 13y ago
      The init system differed a lot across distributions. Systemd made it more the same within distributions. Solaris uses something systemd like. *BSD use their own thing. I don't get what you're complaining about, the fragmentation has been reduced :P
  - voltagex_ 13y ago
    Sensible command line UIs? You've made a believer out of me. How does this affect something like a remote syslog? Could I send the syslog output of my router to journalctl?
- astrodust 13y ago
  RedHat Fedora makes no apologies for dropping legacy support. Heck, they threw out ifconfig in Fedora 19. It's good to be dropping things like syslogd from the default distribution, and the only reason it was ditched was because syslogd is behind the times. Yes, syslogd does more. If you want those features, install it. Forcing it on everyone, regardless, serves no purpose.
  - darkarmani 13y ago
    > RedHat Fedora makes no apologies for dropping legacy support. Heck, they threw out ifconfig in Fedora 19. WTF? Is that because Linux was becoming too easy to use? They have to keep changing it up, so the certification classes have new material to teach. Why wouldn't they keep the command around and wrap whatever re-invented mousetrap replaces it so millions of people can keep typing ifconfig?
    - astrodust 13y ago
      It's because change. Change is how you abandon things that are holding you back. It's how you get rid of the various albatrosses, of which there are many, and clean up the environment for new users. ifconfig is absolutely not easy to use.
    - mcpherrinm 13y ago
      ifconfig was deprecated on linux long ago. While it is compatible with other unixes, it doesn't really map onto the capabilities of the modern linux stack well. `ip` really is a better tool, and you're doing yourself a disservice if you're not using it, especially if you have anything more than the basic single IP/default gateway network.
      - darkarmani 13y ago
        > ifconfig was deprecated on linux long ago. While it is compatible with other unixes, it doesn't really map onto the capabilities of the modern linux stack well. Long ago? Centos 6.4 still has it. My Mac (BSD) has it. I never suggested that it is stupid to add software (ip) that is better, but why would they deliberately remove it when it is such an expected command and works across other unixes? I have trouble believing that it consumes much disk space.

I can, however, again, it's a pretty poor direction that only serves to fragment systems. Many of the complaints that drove the creation of journald could have been better solved through a better default syslogd configuration. Additionally, the journald solution for needs such as remote logging or logging to multiple locations means that you now need to pipe through a process that has a near sole job of piping to another process. It just gives a very bad feeling of hackishness to me.

CraigJPerry 13y ago
I don't think the fragmentation claim stands up to scrutiny. It's so far been adopted by redhat, suse, arch, coreos and with some consideration by debian. The only big name not thinking about it is Ubuntu. I don't think that many of the journald drivers could have been solved by better syslogd configuration, for example journald cryptographically signs each log entry. Even if you get root on my box, you can't edit an entry without me knowing. That's not possible in any meaningful way with syslog. I don't share the view of a hack, the speed improvements of introducing journald have been tremendous and usability is mostly better. For example, the number 1 thing done with syslog output is probably either grep it, so journald improves on this: journalctl _COMM=sshd --since yesterday --until "08:30" OR journalctl /usr/sbin/sshd --since yesterday --until "08:30" Or tail it journalctl -F The places i don't like the user interface are around starting and stopping services. However the old interfaces work fine for now.
- Sanddancer 13y ago
  Think bigger than Linux. Think those with freebsd boxes, netbsd boxes, solaris boxes, etc. They're all very much relevant, but left out in the cold by deliberate decisions of the systemd folks to eschew compatibility. Functionality-wise, journald has no way of acting on the messages it receives. With syslogd, it's fairly trivial to write a script that will send a nagios alert every time a service is restarted, for example. How does one do that with journald?
  - dignan 13y ago
    systemd itself provides the functionality to run commands at points during the lifecycle of a service[1]. As for the people in mixed environments, you can forward journald to syslog [2]. [1] http://www.freedesktop.org/software/systemd/man/systemd.service.html http://www.freedesktop.org/software/systemd/man/systemd.serv... [2] http://www.freedesktop.org/software/systemd/man/journald.conf.html http://www.freedesktop.org/software/systemd/man/journald.con...
    - Sanddancer 13y ago
      That's a tiny sliver of what you can do with syslog piping. For example, fail2ban works by piping the contents of the auth stream of syslog -- usually also put into auth.log -- into a script that monitors for bruteforce attempts. This kind of reactivity is a lot harder on journald configurations.
      - ibotty 13y ago
        ehm. no. it can just stream the output of `journalctl -f`. it can filter even better than before, because fail2ban usually does not care about everything in `auth.log`. i guess i don't see the problem.
      - bkor 13y ago
        There have been various tools which have done this. And a lot had huge security bugs. Despite what you claim, this is also easily doable with journal plus similar solutions are available for journal.
  - bkor 13y ago
    The init system differed a lot across distributions. Systemd made it more the same within distributions. Solaris uses something systemd like. *BSD use their own thing. I don't get what you're complaining about, the fragmentation has been reduced :P
- voltagex_ 13y ago
  Sensible command line UIs? You've made a believer out of me. How does this affect something like a remote syslog? Could I send the syslog output of my router to journalctl?
astrodust 13y ago
RedHat Fedora makes no apologies for dropping legacy support. Heck, they threw out ifconfig in Fedora 19. It's good to be dropping things like syslogd from the default distribution, and the only reason it was ditched was because syslogd is behind the times. Yes, syslogd does more. If you want those features, install it. Forcing it on everyone, regardless, serves no purpose.
- darkarmani 13y ago
  > RedHat Fedora makes no apologies for dropping legacy support. Heck, they threw out ifconfig in Fedora 19. WTF? Is that because Linux was becoming too easy to use? They have to keep changing it up, so the certification classes have new material to teach. Why wouldn't they keep the command around and wrap whatever re-invented mousetrap replaces it so millions of people can keep typing ifconfig?
  - astrodust 13y ago
    It's because change. Change is how you abandon things that are holding you back. It's how you get rid of the various albatrosses, of which there are many, and clean up the environment for new users. ifconfig is absolutely not easy to use.
  - mcpherrinm 13y ago
    ifconfig was deprecated on linux long ago. While it is compatible with other unixes, it doesn't really map onto the capabilities of the modern linux stack well. `ip` really is a better tool, and you're doing yourself a disservice if you're not using it, especially if you have anything more than the basic single IP/default gateway network.
    - darkarmani 13y ago
      > ifconfig was deprecated on linux long ago. While it is compatible with other unixes, it doesn't really map onto the capabilities of the modern linux stack well. Long ago? Centos 6.4 still has it. My Mac (BSD) has it. I never suggested that it is stupid to add software (ip) that is better, but why would they deliberately remove it when it is such an expected command and works across other unixes? I have trouble believing that it consumes much disk space.