The Journal - a proposed syslog replacement
Posted Nov 19, 2011 3:40 UTC (Sat) by dskoll
In reply to: The Journal - a proposed syslog replacement
Parent article: The Journal - a proposed syslog replacement
Why would one document a file format that isn't stable and may be changed in the future? Especially when you can just use the library to read it...
We're talking about logs here. They could contain important information needed a long time after it is generated, possibly even for legal reasons. If you are given a court order to produce two-year-old logs and can no longer read your old logs because the file format has changed in the meantime... you will not be very happy (and neither will the court.)
Indexing log files for performance is not a bad idea. Making them tamper-evident is a good idea too. But both of those can be done by adding to existing plain-text log file formats. You don't need to throw that out in favour of a binary format.
to post comments)