F21 Self Contained Change: Remote Journal Logging

Florian Weimer fweimer at redhat.com
Tue Apr 22 08:56:34 UTC 2014

On 04/16/2014 06:46 PM, Bill Nottingham wrote:

> I understand the pull vs push distinction ... I'm just not clear why pull
> would ever be a model you'd want to use. (vs something like a local cockpit
> agent.)

Isn't remote Windows event logging pull-only (unless you somehow gate it 
to syslog)?  So it would be consistent.

Back in the old days, there was a lot of loathing going around for 
Windows event logging.  People loved syslog, but really hated the 
Windows counterpart.  The pull model was criticized as well, but I'm not 
sure if it was really pulling stuff or the bad interaction with other 
design considerations (like the need for DLLs with parsers for the log 

Does anybody know what the current Windows experience is like, 
especially related to the pull model?

Florian Weimer / Red Hat Product Security Team

More information about the devel mailing list