Re: [gentoo-user] syslog-ng: how to read the log files

Marc Joliet <marcec@×××.de> wrote:

> Am Mon, 23 Feb 2015 00:41:50 +0100
> schrieb lee <lee@××××××××.de>:
>
> > Neil Bothwick <neil@××××××××××.uk> writes:
> >
> > > On Wed, 18 Feb 2015 21:49:54 +0100, lee wrote:
> > >
> > >> > I wonder if the OP is using systemd and trying to read the journal
> > >> > files?
> > >>
> > >> Nooo, I hate systemd ...
> > >>
> > >> What good are log files you can't read?
> > >
> > > You can't read syslog-ng log files without some reading software, usually
> > > a combination of cat, grep and less. systemd does it all with journalctl.
> > >
> > > There are good reasons to not use systemd, this isn't one of them.
> >
> > To me it is one of the good reasons, and an important one.  Plain text
> > can usually always be read without further ado, be it from rescue
> > systems you booted or with software available on different operating
> > systems.  It can be also be processed with scripts and sent as email.
> > You can probably even read it on your cell phone.  You can still read
> > log files that were created 20 years ago when they are plain text.
> >
> > Can you do all that with the binary files created by systemd?  I can't
> > even read them on a working system.
>
> What Canek and Rich already said is good, but I'll just add this: it's not like
> you can't run a classic syslog implementation alongside the systemd journal.
> On my systems, by *default*, syslog-ng kept working as usual, getting the logs
> from the systemd journal.  If you want to go further, you can even configure
> the journal to not store logs permanently, so that you *only* end up with
> plain-text logs on your system (Duncan on gentoo-amd64 went this way).
>
> So no, the format that the systemd journal uses is most decidedly *not* a reason
> against using systemd.
>
> Personally, I'm probably going to uninstall syslog-ng, because journalctl is
> *such* a nice way to read logs, so why run something whose output I'll never
> read again?  I recommend reading
> http://0pointer.net/blog/projects/journalctl.html for examples of the kind of
> stuff you can do that would be cumbersome, if not *impossible* with regular
> syslog.

Except that I get lots of messages about the system journal missing
messages when forwarding to syslog, so how can I make sure this does not
happening?

-- 
Your life is like a penny.  You're going to lose it.  The question is:
How do
you spend it?

         John Covici
         covici@××××××××××.com