F20 System Wide Change: No Default Syslog

[Jaroslav Reznik]

= Proposed System Wide Change: No Default Syslog =
https://fedoraproject.org/wiki/Changes/NoDefaultSyslog

Change owner(s): Lennart Poettering <lennart at poettering net>, Matthew 
Miller <mattdm at fedoraproject org>

No longer install a traditional syslog service by default. (Specifically, 
remove rsyslog from the @core or @standard groups in comps.)

The systemd journal will be the default logging solution. Rsyslog, Syslog-NG, 
and even traditional sysklogd will continue to cover use cases outside of the 
default. 

== Detailed description ==
Let's change the default install to no longer install a syslog service by 
default — let's remove rsyslog from the "comps" default.

The journal has been around for a few releases and is well tested. F19 already 
enabled persistent journal logging on disk, thus all logs have been stored 
twice on disk, once in journal files and once in /var/log/messages. This 
feature hence recommends no longer installing rsyslog by default, leaving only 
the journal in place.

rsyslog will remain the recommended option to install if users require 
/var/log/messages, need support for the syslog network protocol, or need to 
enforce strict data lifecycle policies. It's sufficient to install and start 
rsyslog to get /var/log/messages and BSD syslog support.

Also see previous attempt: [1] and previous mailing list discussion at [2]

[1] https://fedoraproject.org/wiki/Features/systemd-journal
[2] https://lists.fedoraproject.org/pipermail/devel/2012-October/172682.html 

== Scope ==
Simply remove "rsyslog" from all default install groups in "comps".

Packages which strictly require /var/log/messages to exist might need updating 
to gain dependencies on some kind of syslog daemon (but they needed that 
before too, so this is mostly just bugfixing that's useful anyway). If any of 
the packages in the default install is one of those, we need to look at it in 
detail, and find a solution. However, currently no package of the default 
install is requiring a syslog implementation.

Some tools such as logcheck might need to be updated to process data from the 
journal instead of /var/log/message. This should be fairily easy as 
"journalctl" generates the same output as "cat /var/log/messages" previously 
did.

Proposal owners: Commit a change to "comps" to remove "rsyslog" from it. Drop 
in a file /var/log/README informing users where the log files went, and how do 
get to the same data as before. 

Other developers: logcheck needs updating to stay useful. It needs to grep 
through the output of "journalctl", rather than /var/log/messages. 

Release engineering: nothing really. 

Policies and guidelines: Guidelines should clarify that /var/log/message 
doesn't exist on many systems, but that was already the case before -- so 
little changes. QA should add a few tests and release criteria about journal 
functionality. 

Note that logrotate should stay in the default install, as it is required to 
rotate wtmp and btmp (the journal synchronously rotates before writing and 
does not require logrotate for operation).