Re: Unifying logging by default
Josh Triplett <josh@joshtriplett.org> writes:
> While there are *absolutely* configurations in which system
> administrators want to log to arbitrary locations and files, I would
> like to propose that for consistency we should configure software to
> unify logging into syslog and/or journald by default. In particular, I'd
> propose that daemons and applications should default to logging to
> syslog (working with any installed syslog implementation providing
> /dev/log), and that daemons run via systemd units may detect or be
> configured to log to stdout/stderr which will be wired to the sysadmin's
> preferred log target.
I've seen three main reasons why packages do not use syslog:
* The log data is not line-structured. Example: /var/log/apt/history.log
Dumping that as-is into syslog sounds like an awful idea. This would
therefore block on an upstream feature request to change log formats
first, with all that entails.
* Performance. Good examples here are Apache and INN, both of which have
per-request logs that are intentionally not line-buffered and are logged
directly to files, since losing some log messages is not as much of a
concern as performance and disk I/O. I've tried to reroute things like
that through syslog in the past, only to find syslog now taking a
substantial portion of all available system resources trying to keep up.
* The package does its own log analysis. INN again is an excellent
example: it has a bespoke but very comprehensive and incredibly useful
log analysis package that ships with the software and requires access to
the raw logs. Anything that moves those logs out of their expected
locations will break that tool, which is a significant regression for
our users.
I think you're going to need a much more concrete and specific proposal
with worked examples of how to deal with cases like this. As is, I think
this proposal is much too vague to really discuss, let alone implement.
--
Russ Allbery (rra@debian.org) <http://www.eyrie.org/~eagle/>
Reply to: