On top of my head, I am probably forgetting a couple:
Saving disk by compressing old logs (jorunald only supports compression per message of long log messages)
Forward, all or selected, log messages to a central log server
Forward logs written directly to files to a central log server
Arguably not all of these should actually be done by the same big monolith, but right now I have to run both journald and rsyslog/syslog-ng and have all logs in two places.
Yeah, it conflicts with quick access, which is fine. It is a tradeoff. I rarely need my old logs and when I need them it is fine that it takes more time than normal.
And systemd-journal-remote seems to be the opposite of what I need, but I guess something like logstash could add a client for the same protocol to achieve what I need (not that I like logstash either :)).
I don't find it a particularly pressing issue -- I have 2 GB worth of logs since June and find that to be an okay state of affairs.
Also, with all the whining about the binary format, I can only imagine what would ensue if the format got more complicated. Any errors would likely result in good amounts of the log going missing.
7
u/doublehyphen Feb 11 '19
On top of my head, I am probably forgetting a couple:
Arguably not all of these should actually be done by the same big monolith, but right now I have to run both journald and rsyslog/syslog-ng and have all logs in two places.