5 ms·
> Indexing - don't need it. No one does. That's an external problem solved by syslog collectors like Splunk. As someone who deals with up to 500Gb of logs a day
by edwintorok 13y ago
> Indexing - don't need it. No one does. That's an external problem solved by syslog collectors like Splunk. As someone who deals with up to 500Gb of logs a day, I know my shit. Systemd doesn't solve a thing here. In fact it adds overhead to a solved problem.
Does systemd's journal still use a binary format? That is a no-go for me. Inevitably it will get corrupted, and then you rely on the journal reader being able to recover your logs, or fix bugs in it until it does.
I'd be more willing to consider systemd as an alternative if it kept using a human-readable log format, that can be read with cat/tail in a worst-case scenario. If it wants to index it, it can keep an index on the side, no big deal if that gets corrupted/out of date, as it can always be rebuilt.
- FooBarWidget 13y agoI don't buy this argument. SQLite and PostgreSQL's databases are binary too, but that's ok?
- edwintorok 13y agoA database can afford to fsync to ensure consistency, and they've been heavily tested to ensure it works properly. And even then its still possible that the file becomes corrupt, if the OS, or the disk lies about fsync: https://www.sqlite.org/howtocorrupt.html https://www.sqlite.org/howtocorrupt.html Has journald been tested on how well it copes with sudden reboots, kernel panics, powerloss, etc.? When something goes wrong you usually want to be able to still read your logs to figure out what happened, and you may not even be able to boot the system properly.
- reidrac 13y ago> Has journald been tested on how well it copes with sudden reboots, kernel panics, powerloss, etc.? Are you assuming it hasn't been tested in these situations just because you don't know?
- d0 13y agoI think it has not been tested in these situations enough. It's not in production anywhere major yet. The assertion is valid IMHO.
- edwintorok 13y agoDatabases have been around a lot longer than systemd, so I assume they are better tested than journald in this regard. I don't use systemd - because Debian doesn't use it (yet) - so it was rather a question for those who do use systemd. I'm not saying that I'd be happy to have a database as journald backend, I'd be just less concerned.
- reidrac 13y agoOK, I see. Thanks for the clarification. systemd's test suite[1] doesn't seem to cover those cases anyway. [1]: http://cgit.freedesktop.org/systemd/systemd/tree/test http://cgit.freedesktop.org/systemd/systemd/tree/test
- deong 13y agoI wouldn't put my system logs into either of those.
- Sanddancer 13y agoYep. It still uses a binary format. An ugly fucker of one too. You can have it pipe to a real syslogd, but at that point, I'd rather just have it send to one and get that ugly monstrosity that is systemd out of the way.