Stefan Monnier wrote:
> Makes one wonder why they don't use naive append-only "plain text" logs
> (tho with appropriate delimiters (maybe some kind of CSV) to make
> searches more reliable than with old-style plain text logs)?
>
> What are the advantages of journald's representation?
> I mean, to justify the slow search and large disk space usage, there is
> presumably some upside for some use cases. I can see some weak argument
> against Sqlite based on the size of Sqlite, but what are the advantages
> of journald's representation compared to a naive one?
systemd's design philosophy, observed from the outside, goes
like this:
....bunch trimmed.....
Exactly correct in my view. Systemd's use-case is the desktop, not the server in the datacenter. They will be using log-aggregation software in the datacenter anyway so no use for systemd logging. We don't install desktop software on servers either, no X Windows, no gnome, etc. Network connections are stable, no roaming :-)
Long-term logs are for servers, so systemd doesn't want them.
systemd thinks logs are for finding out what just happened
recently. If you wanted long-term logs, obviously you would
configure a central repository on some other machine and ship
them across the network.
I have nothing but praise for the Debian maintainers of rsyslog,
who have arranged it so that installing rsyslog immediately does
appropriate things to pull data out of systemd.
-dsr-