Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux syslog on the way out?

itworld.com

Post reply on HN
Print view View original

11–20 of 46 posts

Re: Linux syslog on the way out?

#11

Post by naner »

maratd wrote: post #7

This is a waste of time. Syslog is the standard for logging on *nix. You will bork everything if you replace it with something incompatible. Everybody knows this. So whatever you replace it with must be Syslog compatible. If that's the case ... there are numerous alternatives to choose from. Like rsyslog. Which is already standard on RHEL, nevermind Fedora. Rsyslog has this nifty feature where you can immediately tra…

I disagree. A lot of these old *nix tools are showing their age and could use a refresh based on known deficiencies. Creating new tools won't harm the old ones so I don't see a problem.

Re: Linux syslog on the way out?

#12

Post by jbk »

maratd wrote: post #7

This is a waste of time. Syslog is the standard for logging on *nix. You will bork everything if you replace it with something incompatible. Everybody knows this. So whatever you replace it with must be Syslog compatible. If that's the case ... there are numerous alternatives to choose from. Like rsyslog. Which is already standard on RHEL, nevermind Fedora. Rsyslog has this nifty feature where you can immediately tra…

Not to mention that Journal will depend on systemd which is Linux-only :D

Re: Linux syslog on the way out?

#13

Post by saljam »

Plan 9 has an extra permission for files; "append." When set, this means programs are only allowed to append text to the end of the file. Both simplifying logging (just open the file and write) and making it more secure (no arbitrary writes.)

I wonder if Lennart and Kay would accept a solution that simple...

Re: Linux syslog on the way out?

#14

Post by pstoneman »

The bit I really don't like is that it enforces systemd - and it sounds like it's part of it. I think one of the strengths of Unix/Linux is the architecture of many simple tools, each doing one job well, and one job only - which this sounds like it violates? Ick.

Re: Linux syslog on the way out?

#15

Post by rbanffy »

naner wrote: post #11
maratd wrote: post #7

This is a waste of time. Syslog is the standard for logging on *nix. You will bork everything if you replace it with something incompatible. Everybody knows this. So whatever you replace it with must be Syslog compatible. If that's the case ... there are numerous alternatives to choose from. Like rsyslog. Which is already standard on RHEL, nevermind Fedora. Rsyslog has this nifty feature where you can immediately tra…

I disagree. A lot of these old *nix tools are showing their age and could use a refresh based on known deficiencies. Creating new tools won't harm the old ones so I don't see a problem.

> Creating new tools won't harm the old ones

Except when they become the default tool despite known deficiencies the previous ones didn't have.

Re: Linux syslog on the way out?

#16

Post by rbanffy »

dredmorbius wrote: post #6

My first (shallow) read of the proposal is that it solves one relatively high-risk, low-probability case by throwing a great deal of complexity at standard operations on which a great deal of existing infrastructure exists: log analyzers, summarizers, rotation systems (broken as they may be), and just simple shell tools. Immediately prior to launching myself into Linux, I briefly toyed with Windows NT 4.0 WS, and amo…

A second read makes me believe it solves no problem except disk space usage. The fact it's binary and signed protects against nothing - whoever has control of the machine also controls the signing keys of the log and can generate whatever log they want, with whatever event they want.

Are we doomed to repeat every stupid mistake Microsoft made? Is the "if you don't know Windows you are doomed to reimplement its bugs" the new thing?

Re: Linux syslog on the way out?

#17

Post by jleader »

It makes me smile sadly when one of the problems cited is "Syslog is only one of many logging systems on a Linux machine", and the solution proposed is the addition of another logging system.

Re: Linux syslog on the way out?

#18

Post by dredmorbius »

rbanffy wrote: post #16
dredmorbius wrote: post #6

My first (shallow) read of the proposal is that it solves one relatively high-risk, low-probability case by throwing a great deal of complexity at standard operations on which a great deal of existing infrastructure exists: log analyzers, summarizers, rotation systems (broken as they may be), and just simple shell tools. Immediately prior to launching myself into Linux, I briefly toyed with Windows NT 4.0 WS, and amo…

A second read makes me believe it solves no problem except disk space usage. The fact it's binary and signed protects against nothing - whoever has control of the machine also controls the signing keys of the log and can generate whatever log they want, with whatever event they want. Are we doomed to repeat every stupid mistake Microsoft made? Is the "if you don't know Windows you are doomed to reimplement its bugs"…

The solution to integrity, IMO, is distributing the log (multiple independent logservers). You can hash individual line items if you want, or sign them, or do any number of other things to make it easier to find discrepancies. There's the problem of log lossieness in general, which is a tough nut to crack. Some form of log entry UUID might also be useful (though hostname + millisecond/jiffy timestamp comes close).

And count me in among those who find the bug-for-bug reimplementation of Microsoft's fatal errors just a tad annoying.

Re: Linux syslog on the way out?

#20

Post by bingaling »

saljam wrote: post #13

Plan 9 has an extra permission for files; "append." When set, this means programs are only allowed to append text to the end of the file. Both simplifying logging (just open the file and write) and making it more secure (no arbitrary writes.) I wonder if Lennart and Kay would accept a solution that simple...

That's the curious thing about syslogging to a network log server, it is append only (assuming the log server isn't compromised.)

It is an existing solution that simple.

Post reply on HN