6 ms·
I don't hate journald because it's not plaintext, I hate it because it's worse than plaintext. Somehow journald manages to provide a database which is 40x slowe
by scraptor 1y ago
I don't hate journald because it's not plaintext, I hate it because it's worse than plaintext.
Somehow journald manages to provide a database which is 40x slower to query than running grep on a compressed text file.
I'm all in favour of storing logs in an indexed structured format but journald ain't it.
- mrweasel 1y agoJournald is an odd one. I don't think it being a binary log/database makes sense. If you have a tiny operation, with a single server, then the binary database doesn't really make sense, having plain text is just easier and faster. If you're a bigger operation, you'll have a central logging solution, in which case you need journald to store the longs as plain text as well, before you can do log shipping. The only use case where the binary format might make sense is if you ship journald logs to another central journald instance. That's just very much an edge case.
- akdev1l 1y agoafaik journald can just forward logs via rsyslog directly to a remote server Why would it need to store plaintext locally?
- mrweasel 1y agoDoesn't that still involve a conversion? I believe that rsyslog can read the journald database, but you're typically not querying syslog data directly, so there's a conversion between rsyslog and logstash, Splunk, Datalog, whatever.
- NewJazz 1y agoSome folks like having some local storage to act as a buffer in case the remote syslog server is down. Not sure if journald can do that on its own.
- bombela 1y agoEven doing zcat | grep is faster than journald. I now turn off journald and use rotated pain text log files. It's more efficient in all metrics.