On Fri, Feb 23, 2024, 2:57 PM Dan Ritter <d...@randomstring.org> wrote:
> Stefan Monnier wrote: > > Makes one wonder why they don't use naive append-only "plain text" logs > > (tho with appropriate delimiters (maybe some kind of CSV) to make > > searches more reliable than with old-style plain text logs)? > > > > What are the advantages of journald's representation? > > I mean, to justify the slow search and large disk space usage, there is > > presumably some upside for some use cases. I can see some weak argument > > against Sqlite based on the size of Sqlite, but what are the advantages > > of journald's representation compared to a naive one? > > > systemd's design philosophy, observed from the outside, goes > like this: > ....bunch trimmed..... Exactly correct in my view. Systemd's use-case is the desktop, not the server in the datacenter. They will be using log-aggregation software in the datacenter anyway so no use for systemd logging. We don't install desktop software on servers either, no X Windows, no gnome, etc. Network connections are stable, no roaming :-) Long-term logs are for servers, so systemd doesn't want them. > systemd thinks logs are for finding out what just happened > recently. If you wanted long-term logs, obviously you would > configure a central repository on some other machine and ship > them across the network. > > > I have nothing but praise for the Debian maintainers of rsyslog, > who have arranged it so that installing rsyslog immediately does > appropriate things to pull data out of systemd. > > -dsr- > >
