Dmitry Smirnov <only...@debian.org> writes: > On Wednesday, 5 February 2020 6:30:03 AM AEDT Russ Allbery wrote:
>> The primary benefit that I can see is one fewer daemon running on a >> default installation, one fewer thing to have security vulnerabilities >> or some other problems, one fewer thing to keep up to date, and a >> smaller base installation. To be clear, these benefits are fairly >> minor, but they do exist. > The question is whether those benefits are enough to justify replacing a > very solid and reliable logging system. I'm confused. Currently, we have both the systemd journal and, in addition, rsyslog. The proposal is that we would stop running the separate rsyslog daemon by default and have only the systemd journal. I believe the journal is already upstream of all traffic that rsyslog sees in a default installation given that systemd controls /dev/syslog. We currently are running two logging infrastructures in the default installation, and the proposal is to run only one. What's being replaced? Am I misunderstanding something? I think the strongest argument against running rsyslog by default is that currently rsyslog is responsible for receiving forwarded messages from the journal and writing a second copy of them in the conventional text log files. I believe without rsyslog one would have to use journalctl, systemctl, or similar programs to read messages, which might be a confusing change. I'm personally not sure whether avoiding that change is worth double-writing log messages and running another daemon in the default install. It does take a bit of retraining to use journalctl instead (and I'm personally not horribly fond of its UI, although that's probably because I'm using it wrong), but it's a lot better at effectively narrowing log messages to the things of interest once you get used to it. (And anyone who doesn't like that can just apt-get install rsyslog and be done.) In a lot of environments, I'd probably install rsyslog anyway for various reasons, but that's of course trivial to do. -- Russ Allbery (r...@debian.org) <https://www.eyrie.org/~eagle/>