Re: [gentoo-user] syslog-ng: how to read the log files

[Canek Peláez Valdés]

On Mon, Feb 23, 2015 at 3:41 AM, <covici@××××××××××.com> wrote:
>
> Marc Joliet <marcec@×××.de> wrote:
>
> > Am Mon, 23 Feb 2015 00:41:50 +0100
> > schrieb lee <lee@××××××××.de>:
> >
> > > Neil Bothwick <neil@××××××××××.uk> writes:
> > >
> > > > On Wed, 18 Feb 2015 21:49:54 +0100, lee wrote:
> > > >
> > > >> > I wonder if the OP is using systemd and trying to read the
journal
> > > >> > files?
> > > >>
> > > >> Nooo, I hate systemd ...
> > > >>
> > > >> What good are log files you can't read?
> > > >
> > > > You can't read syslog-ng log files without some reading software,
usually
> > > > a combination of cat, grep and less. systemd does it all with
journalctl.
> > > >
> > > > There are good reasons to not use systemd, this isn't one of them.
> > >
> > > To me it is one of the good reasons, and an important one.  Plain text
> > > can usually always be read without further ado, be it from rescue
> > > systems you booted or with software available on different operating
> > > systems.  It can be also be processed with scripts and sent as email.
> > > You can probably even read it on your cell phone.  You can still read
> > > log files that were created 20 years ago when they are plain text.
> > >
> > > Can you do all that with the binary files created by systemd?  I can't
> > > even read them on a working system.
> >
> > What Canek and Rich already said is good, but I'll just add this: it's
not like
> > you can't run a classic syslog implementation alongside the systemd
journal.
> > On my systems, by *default*, syslog-ng kept working as usual, getting
the logs
> > from the systemd journal.  If you want to go further, you can even
configure
> > the journal to not store logs permanently, so that you *only* end up
with
> > plain-text logs on your system (Duncan on gentoo-amd64 went this way).
> >
> > So no, the format that the systemd journal uses is most decidedly *not*
a reason
> > against using systemd.
> >
> > Personally, I'm probably going to uninstall syslog-ng, because
journalctl is
> > *such* a nice way to read logs, so why run something whose output I'll
never
> > read again?  I recommend reading
> > http://0pointer.net/blog/projects/journalctl.html for examples of the
kind of
> > stuff you can do that would be cumbersome, if not *impossible* with
regular
> > syslog.
>
> Except that I get lots of messages about the system journal missing
> messages when forwarding to syslog, so how can I make sure this does not
> happening?

Could you please show those messages? systemd sends *everything* to the
journal, and then the journal (optionally) can send it too to a regular
syslog. In that sense, it's impossible for the journal to miss any message.

The only way in which the journal could miss messages is at very early boot
stages; but with a proper initramfs (like the ones generated with dracut),
even those get caught. You get to put an instance of systemd and the
journal inside the initramfs, and so it's available almost from the
beginning.

And if you use gummiboot, then you can even log from the moment the UEFI
firmware comes to life.

Regards.
--
Canek Peláez Valdés
Profesor de asignatura, Facultad de Ciencias
Universidad Nacional Autónoma de México