Journal: end of the line for syslog?

[J65nko]

From http://h-online.com/-1382246

Lennart Poettering and Kay Sievers have developed a new Linux logging system with the aim of replacing syslog. The two Red Hat developers hope that their Journal daemon will resolve a number of perceived problems with syslog, the current industry standard for logging on Unix systems.

[Carpetsmoker]

1) Red Hat developed it.
2) Lennart Poettering was involved.
3) It replaces a perfectly working system for no good reason.

Result: High chance of Journal being complete crap.

[Carpetsmoker]

Examples of a journal log entry:

  MESSAGE_ID=c686f3b205dd48e0b43ceb6eda479721
  MESSAGE=User harald logged in
  LOGIN_USER=500
  SEAT=seat0
  _SERVICE=systemd-logind.service
  _EXE=/lib/systemd/systemd-logind
  _COMM=systemd-logind
  _CMDLINE=/lib/systemd/systemd-logind
  _PID=4711
  _UID=0
  _GID=0
  _SYSTEMD_CGROUP=/system/systemd-logind.service
  _CGROUPS=cpu:/system/systemd-logind.service
  PRIORITY=6
  _BOOT_ID=422bc3d271414bc8bc95870f222f24a9
  _MACHINE_ID=a91663387a90b89f185d4e860067801a
  _HOSTNAME=waldi
  LOGIN_USER=500

  MESSAGE_ID=c2c90533e0614ac2964085462f5fe730
  MESSAGE=Sector 4365345 bad: IO error during read operation
  _DRIVER=ahci
  _DEVICE=b8:0
  _SUBSYSTEM=block
  _NODE=/dev/sda
  _UDEV_SYMLINKS=/dev/by-uuid/47111-2i4325-435345 /dev/by-path/pci-32i74625
  SECTOR=4365345
  SMART_BLOB
  [64bit LE int buffer length][buffer]
  _BOOT_ID=422bc3d271414bc8bc95870f222f24a9
  _MACHINE_ID=a91663387a90b89f185d4e860067801a
  _HOSTNAME=waldi
  PRIORITY=2

un-grepable, un-awkable, un-tailable, un-lessable, un-trivially-scriptable, un-just-about-anything-else-you-would-expect-a-unix-system-to-be-able-to-doable

Upside:
At least it's not a binary format ... Although it doesn't really matter like this ...

[phoenix]

Note: there's support within journald for binary output formats.

[graudeejs]

Linux is evolving to WinDos

[Beastie]

Originally Posted by Carpetsmoker

Examples of a journal log entry:
[...]

un-grepable, un-awkable, un-tailable, un-lessable, un-trivially-scriptable, un-just-about-anything-else-you-would-expect-a-unix-system-to-be-able-to-doable

Really horrible and unusable output. I hope it's never adopted anywhere. Sigh!

[graudeejs]

I will be in horrible pain, if I'll have to use Linux at work.
Luckily for my current job I can use any software that I want/like

[vermaden]

Beautiful!

[J65nko]

For some reactions see http://lwn.net/Articles/468049/#Comments

[Carpetsmoker]

Originally Posted by J65nko

For some reactions see http://lwn.net/Articles/468049/#Comments

Some of those comments worry me.

Why not use XML or something like that so that tools can still read and parse it, the log files can still be read even if the system can not boot. and provide a tool that can control access to the log file.

[J65nko]

XML should be used in the same way as brute force. If it still doesn't help or work out, you simply should use more of it.

I like Daniel Bernstein's multilog, which gives finer grained timestamps and does more effort not to lose log info.


BTW did you see http://linux.slashdot.org/comments.p...6&cid=38152602 ?

Signing log messages does not need to be complicated or incompatible with current text-based logging. Hashing messages is incredibly easy to do, and there's really no reason not to do it. I just implemented this in python in less than two minutes.

>>> from hashlib import md5
>>> log = lambda last_message, message: "{}: {}".format( md5(last_message).hexdigest(), message)

The output hashes the last message with the current message:

8a023b9cbebe055e4b080585ccba3246: [ 19.609619] userif-2: sent link up event.
649a2719064f7f276462464527b48a69: [ 29.680009] eth0: no IPv6 routers present

No binaries, still grepable, single host and most importantly, there is now a trail that can be verified.

[nilsgecko]

The great Dennis Ritchie would be rolling over in his grave if this ever became widely-implemented!

[phoenix]

I like the comment about "Lennux". It would be nice if Lennart went off and did his own distro, and stopped polluting Fedora (and thus the whole Linux ecosystem) with his half-baked "improvements". At least that way we could all ignore him.

[J65nko]

This http://lwn.net/Articles/468208/ remark is also interesting:

It's really too bad that the OpenBSD folks have such a bad attitude toward Linux; when they set about making a more secure replacement for some bit of Unix infrastructure, they're quite good at doing it in a way that respects the way people expect (and want) Unix to work.

[Oko]

I think this is a great news for BSDs. Every time Linux community does something outrageously stupid it is poised to lose some of its most competent users. Naturally, after the death of Solaris I would expect these people to migrate to one of BSD flavors thereby strengthening our community. As of Linux being Unix-like, for me OS X (in particularly after recent introducing of PF instead of IPFW as default firewall) is far more true Unix. If I had to decide whether I have to use Linux or OS X as my primary system, I would chose OS X without the second thought.