| 1 |
On Wed, Feb 25, 2015 at 5:13 AM, Duncan <1i5t5.duncan@×××.net> wrote: |
| 2 |
> |
| 3 |
> a) If the system crashes, partially corrupted in-the-crash text logs can |
| 4 |
> be of at least some use after a reboot. Binary journals, not so much. |
| 5 |
|
| 6 |
Have you tested this, or found some other data to support this? I |
| 7 |
think that journalctl does parse truncated files. |
| 8 |
|
| 9 |
> |
| 10 |
> But syslog-ng lets me dump them without ever actually logging them, or |
| 11 |
> route them to a different log file if I prefer, keeping my primary logs |
| 12 |
> clean. =:^) |
| 13 |
|
| 14 |
I was thinking about this and another advantage of split log files is |
| 15 |
that you could have different rotation/retention policies for each. I |
| 16 |
believe journald's log rotation is one-size-fits-all. |
| 17 |
|
| 18 |
-- |
| 19 |
Rich |
Archives