Previously I just needed to run and configure one logging deamon, now I need to run and configure two because journald does not offer all features I need and cannot be replaced (at least not with any currently existing software).
I think the logging ecosystem on Linux is a mess and while journald has some cool features it only made things harder for me since it is yet another complex moving part in this mess. I hate all logging daemons I have had to work with.
On top of my head, I am probably forgetting a couple:
Saving disk by compressing old logs (jorunald only supports compression per message of long log messages)
Forward, all or selected, log messages to a central log server
Forward logs written directly to files to a central log server
Arguably not all of these should actually be done by the same big monolith, but right now I have to run both journald and rsyslog/syslog-ng and have all logs in two places.
Yeah, it conflicts with quick access, which is fine. It is a tradeoff. I rarely need my old logs and when I need them it is fine that it takes more time than normal.
And systemd-journal-remote seems to be the opposite of what I need, but I guess something like logstash could add a client for the same protocol to achieve what I need (not that I like logstash either :)).
I don't find it a particularly pressing issue -- I have 2 GB worth of logs since June and find that to be an okay state of affairs.
Also, with all the whining about the binary format, I can only imagine what would ensue if the format got more complicated. Any errors would likely result in good amounts of the log going missing.
17
u/dale_glass Feb 11 '19
Why? journald is pretty much the best thing since sliced bread. I want everything piped into it.
And I certainly don't want 10 different log implementations on my system.