On Wed, 2012-10-17 at 10:44 -0400, Matthew Miller wrote:
With the stipulation that rsyslog would still be available to provide
a
traditional syslog-style text logs, what are reasonable hard requirements
for making systemd the main logging system installed by default? (Or, an
alternate softer implementation: rsyslogd would be installed by default but
would not be in 'core'.)
These are the things I think are critical:
1. Time based rotation policies (implementation landing now.)
ack
2. Mechanism for separation of authpriv data
I think authpriv should be separate by default in Fedora.
3. Disk-based storage on by default (ie /var/log/journal exists)
ack
4. Traditional syslog still easily available via rsyslogd
ack
5. Journal format documented
ack, documented and a promise to not change it arbitrarily (should be
easy because the format has already been though to work that way)
6. Strong QA exploring corner cases and data corruption (procedure
tbd)
7. Clear, simple, and Fedora-centric disaster recovery documentation
I am not sure 6/7 are strong requisites. We certainly shipped stuff that
was hard to deal with when it broke before.
I would love to see this done for F19 but I think it would be unfair to
block the feature just on point 6/7 unless there is a significant higher
risk of issues with the journal than there ever was with malfunctioning
(r)syslog.
Is your worry that because the journal file is a binary format and not a
plain text file that corruption of the journal files is more likely /
more problematic ?
Less critical but important:
a. Use wheel group in addition to adm -- work with the way Fedora/RHEL
currently do things
b. All utilities should always work sensibly with grep (this is not the
case on F18 right now)
I think I would elevate this to blocker status instead.
c. /var/log/messages written with a (syslog-formatted?) note pointing
to journalctl (maybe even showing the new time-based filtering?)
I was wondering if /var/log/messages could be turned into a named pipe
to which journal start spitting out stuff in syslog format when someone
tails it ?
just a wild idea (and can be any other file name in /var/log as long as
it is easily discoverable and doesn't cause issues to existing utilities
that crawl /var/log), but I would strongly miss being able to tail logs
with my pipeline that does coloring etc ...
And, in order for the implementation to really be a *win* for Fedora,
it
would be great if we could coordinate:
- integration with every log analysis tool tool we ship (for some tools,
a crude implementation may just be dumping in the output of journalctl,
using a temp file as worst case)
- integration with every monitoring system where it make sense
- bonus points: make these integrations benefit from systemd's fancy
features.
Are these reasonable? Are there other important things I'm missing?
The plan sounds very reasonable in general.
Simo.
--
Simo Sorce * Red Hat, Inc * New York