F20 System Wide Change: No Default Syslog

[Lennart Poettering]

On Mon, 15.07.13 14:46, Miroslav Suchý (msuchy at redhat.com) wrote:

> On 07/15/2013 01:23 PM, Lennart Poettering wrote:
> >But anyway, I'd still like to hear the technical reasoning for the
> >opinion you expressed.
> 
> Because you are able to read txt file with *anything*. But you are
> not always able to read binary files. Because journalctl is not
> available.
> 
> Example from real life:
> Sometimes it happen to me, that I'm fixing totally borked computer.
> And I have available only what is in memory - because HDD with /usr
> crashed, but machine is still running (and /var is readable) and
> with vt open. (BTW - coincidently it happened to me just one month
> ago).
> If I want to read last messages, I could not start journactl, but I
> can read /var/log/messages with bash builtins.

Well, assuming that bash is entirely in memory. And also, note that
neither cat, nor cp, nor tail are actually bash builtins and will not
work. It's pretty hard (though certainly possible) viewing files with
just bash builtins. 

But anyway, this is quite anecdotal. 

> And since I'm not always choosing which machine I'm going to fixing,
> I would prefer that /var/log/messages is present as text file as
> default.

It's not hard trying journalctl first, and then looking into
/var/log/messages, if that didn't work. This is a particularly good
idea, given that when you run into problems in the initrd and during
early boot, then syslog won't be available yet anyway. Since most system
issues probably happen during the initrd/early boot process it is hence
a lot more useful to use journalctl anyway. If you care about debugging
broken systems journaclt is almost certainly the better option.

(Let's also not forget that depending on the distro the default path for
syslog messages differs already, for example sometimes is
/var/log/syslog, so you already *now* have to check more than one place
if you want to see the logs on any Linux machine you want. Oh, and
ArchLinux defaults to journal-only already, so you need to check the
journal anyway, if you want to deal with all popular Linux
distributions).

> If somebody explicitly want to remove rsyslog and live only with
> journalctl, then let it be. And I do not care about other logs, they
> can be in binary forms, if you want. But I want to have
> /var/log/messages available in pure text form.

Note that we do include journalctl on all our livecds. Also, most
distributions do include it in some way or another, and you do not need
to boot systemd to use to it access your journal files.

Lennart

-- 
Lennart Poettering - Red Hat, Inc.