On February 11, 2020 6:28:08 PM UTC, Ansgar <ans...@43-1.org> wrote:
>
>The downside is that magic like [rsyslog disabling persistent journal] might
>not be easily discoverable
>and confuse people who for some reason want a persistent journal and
>syslog.
A lot of my machines are configured like that, mainly because of how much
faster things like tail -f /var/log/syslog are vs. journalctl -f. So I keep a
short amount of logs in traditional syslog format (quick access), and much
longer history in journald (better search/filter). I get the best of both
worlds.
It'd be very surprising if rsyslog disabled the persistent journal on upgrade.
Or when installing it.
I think it'd be fine for it to give me the option, default do not disable, via
debconf, not sure if that'd be low or medium.
There's the obvious point that enabling the persistent journal could be
surprising, too. But I think the harm there is relatively minimal (increased
disk usage, but journald will not fill a filesystem) and is easily fixed with
rm. The lack of a persistent journal isn't necessarily noticed until you try to
check the logs, and at that point may be unfixable: the data is gone.
I would more worry about the harm on systems where there are intentionally no
persistent logs, neither journal nor syslog. There could be privacy
implications. But hopefully the release notes cover that use case.
