5 ms·
Why does it have to be a custom network protocol when using syslog would not only suffice, but also allow for devices that don't run custom code (e.g., switches
by mmarx 11y ago
Why does it have to be a custom network protocol when using syslog would not only suffice, but also allow for devices that don't run custom code (e.g., switches or routers) to be monitored?
- krakensden 11y agoSyslog is a little bit warty- if I didn't use it elsewhere[1], I wouldn't necessarily reach for it. It seems like it should also be fairly trivial to just use your OS' syslog as a shim, if you wanted this to be a syslog endpoint. [1]: many more people should than do
- mmarx 11y agoTrivial, maybe. Not only does it add a single point of failure, though, as the logs get aggregated on the syslog host, the only “benefit” rtail retains is looking at the logs in a browser instead of tail(1).
- krakensden 11y agoNot sure why syslogd as a single point of failure is worse than rtail-server being a single point of failure- there are some very, very stable & battle-tested syslogd implementations. Additionally, it doesn't really seem like that's the case- as long as you were willing to reconfigure syslog on the hosts, you could do syslog -> rtail => rtail-server (-> is local, => is network), as rtail works via UDP.