Re: [gentoo-user] alternative kernels

[Alec Ten Harmsel]

On 10/31/2014 06:30 PM, Rich Freeman wrote:
> On Fri, Oct 31, 2014 at 6:09 PM, Tom H <tomh0665@×××××.com> wrote:
>> The systemd line was always that if you wanted to ship your logs off
>> to another box, use rsyslog. So I've never understood the embedding of
>> an httpd in systemd. I guess that the httpd server's useful if if you
>> want a basic send-the-logs-to-another-box-as-is, but that, if you want
>> to filter or manipulate the journald output, you have to use rsyslog
>> or syslog-ng.
>>
> If you're going to implement a log manager there is no reason to not
> let it export logs to a central manager.
>
> As far as filtering/manipulating logs goes, you can do plenty of that
> with journalctl already, and it supports dumping your logs in json so
> you can do anything you want with them in another tool.  There aren't
> really any such tools around yet, but I'm sure we'll see them come up.

You guys should check out the ELK stack:
http://www.elasticsearch.org/overview/

Basically, transform logs to JSON with logstash, throw the JSON into
elastic search, and make plots with Kibana. We use it at work; it's
absolutely fantastic.

You can save Kibana dashboards and have them auto-update every 5 or 10
seconds (plenty of other granularities as well), and have a "real-time"
view of, let's say, job errors or running jobs or utilization.

Alec