| |||||||||||||
The Journal - a proposed syslog replacementThe Journal - a proposed syslog replacementPosted Nov 19, 2011 3:40 UTC (Sat) by dskoll (subscriber, #1630)In reply to: The Journal - a proposed syslog replacement by HelloWorld Parent article: The Journal - a proposed syslog replacement
Why would one document a file format that isn't stable and may be changed in the future? Especially when you can just use the library to read it... We're talking about logs here. They could contain important information needed a long time after it is generated, possibly even for legal reasons. If you are given a court order to produce two-year-old logs and can no longer read your old logs because the file format has changed in the meantime... you will not be very happy (and neither will the court.) Indexing log files for performance is not a bad idea. Making them tamper-evident is a good idea too. But both of those can be done by adding to existing plain-text log file formats. You don't need to throw that out in favour of a binary format.
(Log in to post comments)
The Journal - a proposed syslog replacement Posted Nov 19, 2011 20:59 UTC (Sat) by HelloWorld (guest, #56129) [Link]
> We're talking about logs here. They could contain important information needed a long time after it is generated, possibly even for legal reasons. If you are given a court order to produce two-year-old logs and can no longer read your old logs because the file format has changed in the meantime...
I trust Lennart to develop a solution to this, should this case actually arise. There are two obvious solutions. One is to implement a conversion tool after a format change that will be maintained indefinitely (a tool that simply reads a log file and outputs it again in a new format is unlikely to require a lot of maintenance). Another one is to simply keep the code for reading pre-format-change log files in the library, so that everything just works even with newer tools as long as they use the library. Also, one should keep in mind that journald is a very young project. I'd guess they'll document the file format eventually when they're sure it does what they need it to do.
The Journal - a proposed syslog replacement Posted Nov 21, 2011 14:40 UTC (Mon) by regala (subscriber, #15745) [Link]
> journald is a very young project. I'd guess they'll document the file format eventually when they're sure it does what they need it to do
given we're talking about Lennart and Kay, it will never do what they need it to do long enough to call it "stable format". ;)
|
|||||||||||||