Re: Unifying logging by default
On Thu, Feb 21, 2019 at 10:26:36PM +0100, Gabor Gombas wrote:
> On Wed, Feb 20, 2019 at 02:44:37PM -0800, Josh Triplett wrote:
>
> > Both syslog and journald support multi-line log messages; I'd *love* to
> > see /var/log/aptitude and /var/log/apt/history.log end up in syslog or
> > journald.
>
> Both journald and syslog have problems with retention policies,
Syslog implementations tend to have quite detailed policies and
mechanisms what to store where and for how long. I like having a uniform
ruleset and routing mechanism for that.
Journald certainly has a much simpler approach there, and doesn't allow
expiring "some but not all" old entries; I'd love to see that added. But
in any case, it does have automatic expiration at a uniform time, and
works well for in-memory logging as well. Also, I like that I can
effectively say "keep things as long as you can, as long as I have
enough disk space".
> In a production environment, I want to keep package upgrade history
> going back several months or even years - but I want to purge cron job
> execution history after a week.
I understand that. Would it work well for you if rsyslog's default
configuration had a category for these kinds of long-term persistent
messages and had a different policy for them by default, so that if you
install rsyslog you get all the distinct logfiles you want by default?
(That would then allow controlling all system messages with syslog
configuration, rather than also having to individually configure
services.)
Reply to: