Unifying logging by default
[Followups to debian-devel with CC to me, please, as I'm not
subscribed.]
Currently, while the majority of daemons support logging to syslog
and/or journald, a small handful of software ships configured to use its
own logfiles by default. For instance, update-alternatives logs to
/var/log/alternatives.log, aptitude logs to /var/log/aptitude, dpkg logs
to /var/log/dpkg.log, fontconfig logs to /var/log/fontconfig.log, CUPS
logs under /var/log/cups, and so on. This makes it more difficult to get
a unified view of system log data, ship logs off-system, analyze logs
for unusual activity, or any number of other policies a sysadmin may
wish to apply to logging.
While there are *absolutely* configurations in which system
administrators want to log to arbitrary locations and files, I would
like to propose that for consistency we should configure software to
unify logging into syslog and/or journald by default. In particular, I'd
propose that daemons and applications should default to logging to
syslog (working with any installed syslog implementation providing
/dev/log), and that daemons run via systemd units may detect or be
configured to log to stdout/stderr which will be wired to the sysadmin's
preferred log target.
This should Do The Right Thing by default, both on systems running any
syslog daemon and on systems running journald, without a hard dependency
on either one. And sysadmins would still have the option of configuring
any daemon they wish to log to any location they wish.
This would also mean that daemons no longer need to install directories
to /var/log, no longer need to install logrotate configuration files or
suggest/recommend/depend on logrotate, and in some cases may be able to
avoid any special permissions just to open a logfile.
Eventually, as we configure most applications for this default, we could
introduce this into policy as a "should", but for now I'm seeking
interest in slowly adapting applications to shift defaults to unified
logging.
- Josh Triplett
Reply to: