F21 Self Contained Change: Remote Journal Logging

[Florian Weimer]

On 04/16/2014 06:46 PM, Bill Nottingham wrote:

> I understand the pull vs push distinction ... I'm just not clear why pull
> would ever be a model you'd want to use. (vs something like a local cockpit
> agent.)

Isn't remote Windows event logging pull-only (unless you somehow gate it 
to syslog)?  So it would be consistent.

Back in the old days, there was a lot of loathing going around for 
Windows event logging.  People loved syslog, but really hated the 
Windows counterpart.  The pull model was criticized as well, but I'm not 
sure if it was really pulling stuff or the bad interaction with other 
design considerations (like the need for DLLs with parsers for the log 
blobs).

Does anybody know what the current Windows experience is like, 
especially related to the pull model?

-- 
Florian Weimer / Red Hat Product Security Team