Re: Heads up: persistent journal has been enabled in systemd

[Hideki Yamane <henrich@iijmio-mail.jp>]

Hi,

 Thanks for your heads up.

On Sat, 1 Feb 2020 04:05:55 +0100
Michael Biebl <biebl@debian.org> wrote:
> with today's upload of systemd 244.1-2 I finally enabled persistent
> journal by default [1]. It has been a long requested feature.

 I read this thread and other info, my thought is


Pros)

 Well, as I read upstream's documentation[1], I prefer persistent journal
 if they implemented features as they said. Especially journald logging
 feature seems to be more reliable (tamper-proof) than normal syslog's one.
 e.g. if someone hacked your system and you found it, then logs are
 NOT reliable information easily. However, if you've enabled persistent
 journal, it's hard to falsify it.


 This change is non-destructive, users can change its default setting to
 go back to rsyslog as Michael notes.


Cons)

 There are some regression at "reading" logs (e.g. we must specify syslog
 facilities by number)[2]

 Users should learn new "How to use journalctl" things.


Note)
 
 Ubuntu already did this change on upgrades and it is smooth.
 



 So, my conclusion is

 Use "reliable logging system" is good for our users, so I prefer it as
 the default. If you need more flexibility, then you can install rsyslog
 or something for your logging system - yes, you have a choice! :)


[1] https://docs.google.com/document/pub?id=1IC9yOXj7j6cdLLxWEBAGRL6wl97tFxgjLUEHIX3MSTs
[2] https://github.com/systemd/systemd/issues/9716



-- 
Regards,

 Hideki Yamane     henrich @ debian.org/iijmio-mail.jp