Re: F20 System Wide Change: No Default Syslog

[Denys Vlasenko]

On 07/17/2013 03:00 PM, drago01 wrote:
>  On Wed, Jul 17, 2013 at 2:57 PM, Denys Vlasenko
> <dvlasenk(a)redhat.com&gt; wrote:
> > On 07/17/2013 02:45 PM, drago01 wrote:
> >>>> instead of administrators simply adding rsyslog or syslog-ng manually
> >>>> at install time or to their ks snippets.
> >>>
> >>> And this too was answered several times already.
> >>> The machine in question may be already borked.
> >>> Our support people will need to figure out -
> >>> over the phone or email! - what has happened on client's
> >>> installation, and having traditional grep/sed/awk
> >>> recipes not working anymore because /var/log/messages
> >>> is not there anymore is an extremely unwelcome discovery
> >>> in an emergency.
> >>
> >> You can use grep / sed / awk on the jounrnal output as well.
> >
> > Please do read the text you are replying to.
>  
>  I did. 
Okay, I will try explaining with an example.

A support engineer receives a panicked call from a customer.
"Help, something wrong with our server!!!oneone".

Engineer does not know what version of OS that server runs,
what is installed there and how it is configured.
So it needs to be investigated. Quite a typical situation.

Engineer asks customer whether he has root login to the server.
Customer has it.
Then engineer asks to run "tail /var/log/messages".
Customer says: "I see
   cannot open ‘/var/log/messages’: No such file or directory
message".

Great, isn't it?

Engineer asks to run journalctl.
Customer says: "I see 'Input/output error' message".

F20 System Wide Change: No Default Syslog

[Jóhann B. Guðmundsson]

On 07/17/2013 01:08 PM, Denys Vlasenko wrote:
>  Engineer does not know what version of OS that server runs,
>  what is installed there and how it is configured.
>  So it needs to be investigated. Quite a typical situation. 
Perhaps for you but for us here on top of the world we dont grant root 
access to people that cant event tell which OS and which release that OS 
is running on so that's quite un-typical situation for me.

JBG

F20 System Wide Change: No Default Syslog

[Denys Vlasenko]

On 07/17/2013 03:21 PM, "Jóhann B. Guðmundsson" wrote:
>  On 07/17/2013 01:08 PM, Denys Vlasenko wrote:
> > Engineer does not know what version of OS that server runs,
> > what is installed there and how it is configured.
> > So it needs to be investigated. Quite a typical situation.
>  
>  Perhaps for you but for us here on top of the world
>  we dont grant root access to people that cant event
>  tell which OS and which release that OS is running
>  on so that's quite un-typical situation for me. 
I don't know about your organization,
but ours is not arrogant enough to tell our customers -
the people who buy our engineering support, and thus
indirectly pay all our salaries,
how, or who is allowed to run their servers.

Because it's *their servers*. Not ours.
IF they have incompetent admins, it's their problems.

F20 System Wide Change: No Default Syslog

[James Hogarth]

> >  
> > Engineer does not know what
> version of OS that server runs,
> > what is installed there and how it is configured.
> > So it needs to be investigated. Quite a typical situation.
>
>
>  Perhaps for you but for us here on top of the world we dont grant root 
access to
people that cant event tell which OS and which release that OS is
running on so that's quite un-typical situation for me.
>  
Also as a long term admin over many environments and many years ... Not
just of Linux ... The "I don't know OS" argument I agree is a straw man.

As Lennart already pointed out this isn't a standard Linux location anyway
so an off site engineer would already have the identification issue... And
it's not like a yum update in f20 would make this change happen for
existing systems...

Personally I'd love to see other applications make use of journald
facilities such as httpd and tomcat... Would simplify some of the
occasionally odd logrotate behaviour for sure...

But I guess that would be even more controversial ;-)

As to those worrying scripts will break and so on in production
environments... Well that's why you test and have to update scripts on
occasion and if you don't want to do that don't use a bleeding edge distro
but rather something like rhel, CentOS, scili etc instead...

I personally love journald (and systemd) on my laptop and am looking
forward to it arriving in EL soonish...

F20 System Wide Change: No Default Syslog

[Zbigniew Jędrzejewski-Szmek]

On Wed, Jul 17, 2013 at 02:37:32PM +0100, James Hogarth wrote:
>  Personally I'd love to see other applications make use of
> journald
>  facilities such as httpd and tomcat... Would simplify some of the
>  occasionally odd logrotate behaviour for sure... 
For httpd, see
https://bugzilla.redhat.com/attachment.cgi?id=748695 by
Jan Kaluža.

>  But I guess that would be even more controversial ;-) 
But
useful!

Zbyszek
-- 
they are not broken. they are refucktored
                           -- alxchk

F20 System Wide Change: No Default Syslog

[Alexey I. Froloff]

On Wed, Jul 17, 2013 at 03:08:59PM +0200, Denys Vlasenko wrote:
>  Then engineer asks to run "tail /var/log/messages".
>  Customer says: "I see
>     cannot open ‘/var/log/messages’: No such file or directory
>  message". 
And this happens every time in, say, Debian.  Great, isn't it?

>  Engineer asks to run journalctl.
>  Customer says: "I see 'Input/output error' message". 
How would
/var/log/messages file help in case of a corrupted
filesystem/disk?

-- 
Regards,    --
Sir Raorn.   --- http://thousandsofhate.blogspot.com/

F20 System Wide Change: No Default Syslog

[Denys Vlasenko]

On 07/17/2013 03:36 PM, Alexey I. Froloff wrote:
>  On Wed, Jul 17, 2013 at 03:08:59PM +0200, Denys Vlasenko wrote:
> > Then engineer asks to run "tail /var/log/messages".
> > Customer says: "I see
> >    cannot open ‘/var/log/messages’: No such file or directory
> > message".
>  And this happens every time in, say, Debian.  Great, isn't it?
>  
> > Engineer asks to run journalctl.
> > Customer says: "I see 'Input/output error' message".
>  How would /var/log/messages file help in case of a corrupted
>  filesystem/disk? 
Are you trying to say that system log is generally useless for
troubleshooting?  Heh  :)

F20 System Wide Change: No Default Syslog

[Alexey I. Froloff]

On Wed, Jul 17, 2013 at 03:40:15PM +0200, Denys Vlasenko wrote:
>  >> Then engineer asks to run "tail
> /var/log/messages".
>  >> Customer says: "I see
>  >>    cannot open ‘/var/log/messages’: No such file or directory
>  >> message".
>  > And this happens every time in, say, Debian.  Great, isn't it?
>  > 
>  >> Engineer asks to run journalctl.
>  >> Customer says: "I see 'Input/output error' message".
>  > How would /var/log/messages file help in case of a corrupted
>  > filesystem/disk?
>  Are you trying to say that system log is generally useless for
>  troubleshooting?  Heh  :) 
I am trying to say, that there is no "standard log
file".  And
log must be read for "troubleshooting".  Even tail wont save you
from "Input/output error" message.

All your arguments sounds like "I got used to old behavior and
don't want to change anything because I am".  It's a bit
childish, don't you think so?

-- 
Regards,    --
Sir Raorn.   --- http://thousandsofhate.blogspot.com/

F20 System Wide Change: No Default Syslog

[M A Young]

On Wed, 17 Jul 2013, Alexey I. Froloff wrote:

>  How would /var/log/messages file help in case of a corrupted
>  filesystem/disk? 
You stand a considerably better chance of reading a text file than a 
database when it has partial corruption. Of course if the file, filesystem 
or disk is completely trashed then you a stuck either way.

 	Michael Young

F20 System Wide Change: No Default Syslog

[Alexey I. Froloff]

On Wed, Jul 17, 2013 at 02:56:56PM +0100, M A Young wrote:
>  > How would /var/log/messages file help in case of a corrupted
>  > filesystem/disk?
>  You stand a considerably better chance of reading a text file than a 
>  database when it has partial corruption. 
Please, show exact numbers and your
calculations.

-- 
Regards,    --
Sir Raorn.   --- http://thousandsofhate.blogspot.com/