(17-02-2021, 09:38 AM)freem Wrote: I disagree that "developers can do absolutely whatever they want".
All those methods are normal logging, so it's possible to discuss them. Many, too many daemons in my Debian actually rely one of those methods, and it's a pain.

This wasn't meant as an encouragement to developers to do whatever they want... This definitely can be annoying, it would be better if everyone was using a standard method via the system logs. However, this part of the podcast was exactly to say that this type of local logging isn't respectful of any such standard, so not worth talking about other than "some people do local program logs that don't use syslog".

We can obviously dive into the best approach to log for debugging purposes, how to track sessions and context and whatnot, but this is another story.

(17-02-2021, 09:38 AM)freem Wrote: For a start, I'll give some links towards someone else's blog, that I think interesting reads:

I'm not sure I agree with what's discussed in these 2 articles. Especially the "Binary logs need their tools!" section. The point is that text logs can have strong formatting, are interroperable, and selected pieces can be kept in cold storage for auditing.

Just like syslog can have specific fields but the message can be arbitrary, journal has the same thing where the message is arbitrary too (the fields are defined in sytemd.journal-fields(7)). There's only so much structure that you can impose, the rest is still left on the programmer to define what is inside the message.

Moreover, taking a real world example, most of the things I do at work have triggers based on log events, and there is a whole infrastructure built around logs. Forcing a new format that can only be read by passing by a single software would require changing the whole infrastructure, which isn't practical. However, you can definitely use journald as a simple proxy towards filtering or other logs systems.

In the end, the logs are only as valuable as the processing you can do over them. You can keep them in textual format or binary format, or a DB, or big data storage, as long as you're able to perform the operations you want.

(17-02-2021, 09:38 AM)freem Wrote: About the rest, I'll concentrate my arguments into those few words, because it's really, really late:

Great points!

(17-02-2021, 09:38 AM)freem Wrote: As a *very important foreword*, let me remind that the words I criticize are from 2016, the author was younger, and I was, too, so maybe I'd have been more friendly to that text. Maybe.

Looking back at it, I don't think it was such a bad podcast. Even from today's point of view, there's not much to criticize. The only big change is that in the Linux world systemd's journal has taken over as the default logger on multiple distributions.