F20 - Unintended consequences of no default MTA - How best to fix

[Lars E. Pettersson]

On 12/31/2013 10:20 PM, Rahul Sundaram wrote:
> Your proposal is irrelevant when we are talking about current reality.

No it is by no means not. By implementing my proposal this mail is not 
lost (as Lennart Poettering stated it in the devel list) by ending up in 
/var/spool/mail. If included in the installation process of Fedora, 
perhaps also mentioning that the user should/could set up their mail 
client to read spool mail, these message will definitely not be lost.

Sadly messages are lost in F20 as distributed now, read question 1 in 
the mail from Suvayu Ali titled "Manipulating journalctl output" dated 
20:57 Jan 1, as an example.

He states that his journal says "Dec 30 04:36:05 <hostname> 
rsnapshot[8265]: /usr/bin/rsnapshot daily: ERROR: /usr/bin/rsnapshot 
daily: completed, but with some errors" but where to find that error? In 
F19 these errors would have been forwarded to the mail spool via 
/etc/aliases. Now it is lost.

> journalctl is not a requirement to read logs.  It is just far more
> easier than grepping through /var/log/messages for the common use
> cases.

As always that depends on the use case (see at the end). One nice thing 
with journalctl though, is the possibility to filter the last 10 minutes 
and similar, that is a bit awkward to do without using awk or similar on 
/var/log/messages (is it possible to filter out a time slice with 
journalctl, man page gives no clue?). But in all, a pure ASCII file is 
so simple that even a novice can handle it. And for grepping, journalctl 
is too slow.

> As I mentioned before desktop environment have graphical
> utilities to read log files.  gnome-system-log for /var/log/messages for
> example.

Yes, but it is a bit hard to filter using that. (On a side note, on my 
system the Date/time field is white text on white background which makes 
it a bit hard to read. (Do you have a solution for that))

> GNOME is also getting a systemd specific log viewer as well
>
> https://mail.gnome.org/archives/gnome-announce-list/2013-September/msg00097.html

OK. Tested that but could not get any usable output from it at the 
moment. Perhaps it is a bit too early to test it yet,

> Other similar utilities are available for other DE's as well.    If it
> is important, the DE should notify the user proactively and not wait on
> them to read some log file

On that I agree. And mail from logwatch is an example of that. 
Notifications another. But when you get notified, you tend to look up 
your logs, and then it is good if these are readily available, fast, and 
easy to handle.

Look at the following use case (Fedora 20). The journal starts in July, 
/var/log content in September. In this use case using simple text files 
is extremely faster than journalctl. Also note the differences is size.

(I have not done any changes to the configuration of the journal, so 
this could be the journal of a normal user (well, perhaps not, in this 
case it is my home web and mail server and it probably produces more 
journal data than a desktop user does))

[root at gw ~]# time journalctl | grep xyz
...
real	25m31.478s
user	11m2.966s
sys	2m36.218s
[root at gw ~]# time grep -r --exclude-dir=journal xyz /var/log
...
real	1m6.362s
user	0m2.253s
sys	0m1.201s
...
[root at gw ~]# du -sh --exclude=journal /var/log
620M	/var/log
[root at gw ~]# du -sh /var/log/journal
3.7G	/var/log/journal
[root at gw ~]#

Lars
-- 
Lars E. Pettersson <lars at homer.se>
http://www.sm6rpz.se/