* Matt Zagrabelny <mzagr...@d.umn.edu> [200204 21:27]: > The contents of /var/log/journal will be binary files that journalctl > will read. IIRC.
This is my objection to the systemd journal. Binary log files are absolutely _horrible_ for the general user, but they are terrific for large data centers. In a large data center, the logs from many machines are being sent via network to a machine whose job it is to collect them, where sysadmins can monitor all the hosts. The binary format is much more efficient. However, on an individual user's machine, you are now forced to use a specialized program to parse the logs. If a journal file is damaged in the middle, the remainder of the file is useless without expertise in the binary format of the file and significantly more (usually prohibitive) forensic effort. If a machine crashes and the user needs to examine the logs offline (e.g. booting from a live image, or copying the logs to a different machine), now he/she needs to learn how to use journalctl on external files; perhaps this is easy, but it is one more thing to learn. Anyone administering their own personal machine knows how to look at text files, and there are a wide variety of tools available to manipulate them. Text log files can be copied to a Windows machine, a BSD system, or even to a smart phone, and are just as usable there; binary journal files are not. When your machine has crashed or your hard disk is having intermittent failures are times when you most need to be able to read log files, and are times when dealing with a binary format may be the hardest. When choosing defaults for the Debian distribution, if one default is more appropriate for the general user and another is better for the experienced sysadmin, the maintainer should almost always opt in favor of the general user. ...Marvin