Re: Heads up: persistent journal has been enabled in systemd
Dmitry Smirnov <onlyjob@debian.org> writes:
> On Wednesday, 5 February 2020 6:30:03 AM AEDT Russ Allbery wrote:
>> The primary benefit that I can see is one fewer daemon running on a
>> default installation, one fewer thing to have security vulnerabilities
>> or some other problems, one fewer thing to keep up to date, and a
>> smaller base installation. To be clear, these benefits are fairly
>> minor, but they do exist.
> The question is whether those benefits are enough to justify replacing a
> very solid and reliable logging system.
I'm confused. Currently, we have both the systemd journal and, in
addition, rsyslog. The proposal is that we would stop running the
separate rsyslog daemon by default and have only the systemd journal.
I believe the journal is already upstream of all traffic that rsyslog sees
in a default installation given that systemd controls /dev/syslog. We
currently are running two logging infrastructures in the default
installation, and the proposal is to run only one. What's being replaced?
Am I misunderstanding something?
I think the strongest argument against running rsyslog by default is that
currently rsyslog is responsible for receiving forwarded messages from the
journal and writing a second copy of them in the conventional text log
files. I believe without rsyslog one would have to use journalctl,
systemctl, or similar programs to read messages, which might be a
confusing change. I'm personally not sure whether avoiding that change is
worth double-writing log messages and running another daemon in the
default install.
It does take a bit of retraining to use journalctl instead (and I'm
personally not horribly fond of its UI, although that's probably because
I'm using it wrong), but it's a lot better at effectively narrowing log
messages to the things of interest once you get used to it. (And anyone
who doesn't like that can just apt-get install rsyslog and be done.)
In a lot of environments, I'd probably install rsyslog anyway for various
reasons, but that's of course trivial to do.
--
Russ Allbery (rra@debian.org) <https://www.eyrie.org/~eagle/>
Reply to: