Re: Heads up: persistent journal has been enabled in systemd
* Matt Zagrabelny <mzagrabe@d.umn.edu> [200204 21:27]:
> The contents of /var/log/journal will be binary files that journalctl
> will read. IIRC.
This is my objection to the systemd journal. Binary log files are
absolutely _horrible_ for the general user, but they are terrific for
large data centers.
In a large data center, the logs from many machines are being sent via
network to a machine whose job it is to collect them, where sysadmins
can monitor all the hosts. The binary format is much more efficient.
However, on an individual user's machine, you are now forced to use a
specialized program to parse the logs. If a journal file is damaged in
the middle, the remainder of the file is useless without expertise in
the binary format of the file and significantly more (usually
prohibitive) forensic effort. If a machine crashes and the user needs
to examine the logs offline (e.g. booting from a live image, or copying
the logs to a different machine), now he/she needs to learn how to use
journalctl on external files; perhaps this is easy, but it is one more
thing to learn. Anyone administering their own personal machine knows
how to look at text files, and there are a wide variety of tools
available to manipulate them. Text log files can be copied to a Windows
machine, a BSD system, or even to a smart phone, and are just as usable
there; binary journal files are not.
When your machine has crashed or your hard disk is having intermittent
failures are times when you most need to be able to read log files, and
are times when dealing with a binary format may be the hardest.
When choosing defaults for the Debian distribution, if one default is
more appropriate for the general user and another is better for the
experienced sysadmin, the maintainer should almost always opt in favor
of the general user.
...Marvin
Reply to: