That newfangled Journal thing

Posted Nov 24, 2011 11:20 UTC (Thu) by dlang (guest, #313)
In reply to: That newfangled Journal thing by anselm
Parent article: That newfangled Journal thing

you are correct that the original syslog protocol, RFCs, and implementations were seriously lacking in security, reliability and performance.

However, syslog-ng and rsyslog have added many options that address these concerns, all in ways that are optional extensions from the base, and require no significant changes if you don't use them (the syntax of the config file is the biggest change, and rsyslog lets you ignore most of that if you want to)

yes, there is still the hard coded facility and severity lists, however I don't think that anyone who is doing real serious work with syslog really uses those, instead the far more flexible filtering of the modern syslog daemons is used instead.

go take a serious look at rsyslog (the default on just about every distro, even if some of them have old versions). It has a lot of capabilities that you would not have thought of a few years ago.

to post comments

That newfangled Journal thing

Posted Nov 24, 2011 15:15 UTC (Thu) by anselm (subscriber, #2796) [Link]

I'm familiar with rsyslogd, thank you very much. However, I think any long-overdue improvements to the logging infrastructure should not depend on running specific software packages at either end. In particular, rsyslogd is still being fed free-format, unauthenticated syslog-style messages it may be quite a bit more clever in dealing with them than plain syslogd, but there are still opportunities for improvement that rsyslogd alone does not address.

I'm not saying that Lennart's and Kay's proposal should immediately be adopted by everyone. I don't even think Lennart and Kay expect that. We should really consider it as a starting point for tests and a reasonable discussion, rather than dismiss it outright as »heresy« or some of the other things that have been mentioned here.