Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Grepping logs is terrible

asylum.madhouse-project.org

Post reply on HN
Print view View original

41–50 of 105 posts

Re: Grepping logs is terrible

#41

Post by realusername »

leni536 wrote: post #10

I don't have experience with binary logs. I think the fragility of binary logs is not baseless though. AFAIK there was (is?) a problem in systemd's journal where a local corruption of the log could cause a global unavailability of the logged data. People like text logs because local corruptions remain local. Some lines could be gibberish, but that's all. I'm not suggesting that this couldn't be done with binary logs,…

I was thinking exactly the same, once you want to create a binary efficient format which you can query, you then have the same problems as a database. And if there is something we have learned in the history of computing, it's that databases are hard to design properly, and especially from scratch.

Re: Grepping logs is terrible

#42

Post by Jedd »

onli wrote: post #39
Jedd wrote: post #37

Earlier quoted context omitted.

(Background: I'm not a journal apologist. For a fact I'm finding it challenging to make the mental shifts required to become adept with this new suite of system tools on my myriad Debian boxen.) > That's a lot more information than you could get from a binary log without any tools. Arguably you need a tool to get the information you showed above - a single line from an apache log. The tool may have been grep, cat, vi…

It is not only different. It is also less universal. With a text based logging system, I can take the usb stick with the system that does not boot on my headless homeserver to any computer and read the logs there. I could even boot the original linux system on that server, running a really old kernel and practically no userland tools, and read them there. Cause that server was using journald, that was not possible. S…

I know it's pretty weak to say so, but that universality is a result of the stage of the migration -- that particular problem will undeniably reduce over time.

But you're right that there are some work flows and use cases where it'll bite you big time. A recent migration to systemd on my Debian lvm-on-dmcrypt laptop caused me some hours of pain, so I'm not unsympathetic.

Back in the early 90's I was involved in managing a very large network of MS-DOS + Windows 3.x machines. The migration to Windows 95 introduced the same concerns, with similar responses. That's the nice thing about working in IT long enough.

Re: Grepping logs is terrible

#43

Post by paulfurtado »

onli wrote: post #39
Jedd wrote: post #37

Earlier quoted context omitted.

(Background: I'm not a journal apologist. For a fact I'm finding it challenging to make the mental shifts required to become adept with this new suite of system tools on my myriad Debian boxen.) > That's a lot more information than you could get from a binary log without any tools. Arguably you need a tool to get the information you showed above - a single line from an apache log. The tool may have been grep, cat, vi…

It is not only different. It is also less universal. With a text based logging system, I can take the usb stick with the system that does not boot on my headless homeserver to any computer and read the logs there. I could even boot the original linux system on that server, running a really old kernel and practically no userland tools, and read them there. Cause that server was using journald, that was not possible. S…

Could you not view the journal on another system? I'm curious why:

journalctl -D ///var/log/journal

wouldn't work in this case

Re: Grepping logs is terrible

#44

Post by chronid »

paulfurtado wrote: post #43
onli wrote: post #39

Earlier quoted context omitted.

It is not only different. It is also less universal. With a text based logging system, I can take the usb stick with the system that does not boot on my headless homeserver to any computer and read the logs there. I could even boot the original linux system on that server, running a really old kernel and practically no userland tools, and read them there. Cause that server was using journald, that was not possible. S…

Could you not view the journal on another system? I'm curious why: journalctl -D / / /var/log/journal wouldn't work in this case

You assume the other system is a linux box with systemd installed. That may be true, or may not be true at all. :)

Re: Grepping logs is terrible

#45

Post by ygra »

tatterdemalion wrote: post #9

This applies more generally than just to logs. I love Unix, but "everything is text" is not actually great. It's better that Unix utils output arbitrary ASCII than that they output arbitrary binary data, but it's obvious why people don't do serious IPC 'the Unix way.' Imagine if instead of exchanging JSON, or ProtoBufs, or whatever, your programs all exchanged text you had to regex into some sort of adhoc structure.…

> There's no actual reason that the terminal couldn't interpret structured data into text for us so that, in the world of intercommunicating processes on the other side of the TTY, everything is well-structured, semantically comprehensible data.

I think you just described PowerShell (or things that follow down the same path, e.g. TermKit) ;-)

Re: Grepping logs is terrible

#46

Post by [deleted] »

paulfurtado wrote: post #43
onli wrote: post #39

Earlier quoted context omitted.

It is not only different. It is also less universal. With a text based logging system, I can take the usb stick with the system that does not boot on my headless homeserver to any computer and read the logs there. I could even boot the original linux system on that server, running a really old kernel and practically no userland tools, and read them there. Cause that server was using journald, that was not possible. S…

Could you not view the journal on another system? I'm curious why: journalctl -D / / /var/log/journal wouldn't work in this case

[deleted]

Re: Grepping logs is terrible

#47

Post by onli »

Jedd wrote: post #42
onli wrote: post #39

Earlier quoted context omitted.

It is not only different. It is also less universal. With a text based logging system, I can take the usb stick with the system that does not boot on my headless homeserver to any computer and read the logs there. I could even boot the original linux system on that server, running a really old kernel and practically no userland tools, and read them there. Cause that server was using journald, that was not possible. S…

I know it's pretty weak to say so, but that universality is a result of the stage of the migration -- that particular problem will undeniably reduce over time. But you're right that there are some work flows and use cases where it'll bite you big time. A recent migration to systemd on my Debian lvm-on-dmcrypt laptop caused me some hours of pain, so I'm not unsympathetic. Back in the early 90's I was involved in manag…

Thanks for the sympathy ;)

> The migration to Windows 95 introduced the same concerns, with similar responses.

For me, that is the second big large negative point, apart from the missing universal access (which like you said might get better over time, maybe). This route of having a binary journal with its dedicated journal viewers feels awful lot like being on windows. It's the same negative feeling I get when I get in contact with Gnomes regedit clone. Stepping back to Windows 95 is hardly progress.

Re: Grepping logs is terrible

#48

Post by onli »

chronid wrote: post #44
paulfurtado wrote: post #43

Earlier quoted context omitted.

Could you not view the journal on another system? I'm curious why: journalctl -D / / /var/log/journal wouldn't work in this case

You assume the other system is a linux box with systemd installed. That may be true, or may not be true at all. :)

Yes, exactly. That would've worked if my other system would have had journalct. It is a Ubuntu 14.04 LTS, and to my knowledge it does not have a package for that. Even if it had and I just did not know, that is kind of the point why binary journals (and systemd) suck.

Re: Grepping logs is terrible

#49

Post by bigbugbag »

The title is misleading, I was expecting to discover a better way of dealing with logs in the general case. Instead I got served an attempt of the author to generalize its way as if his quite specific use case could apply to the outside world.

Reading this was a waste of my time.

Being a universal open format text is a better format than binary, unless you don't care about being able to read your data in the future. There's already enough issue with filesystems and storage media, no need to add more complexity to the issue.

Re: Grepping logs is terrible

#50

Post by leni536 »

cthalupa wrote: post #31
leni536 wrote: post #11

Earlier quoted context omitted.

Why does it have to be proprietary?

It doesn't have to be - but let's look at reality here. NIH syndrome is everywhere, we have millions of competing protocols and formats, everyone thinks they can build a better solution than someone else, etc. I suppose that if there was a large push to universally log things in binary the possibility exists that sanity would prevail and we'd get one format that everyone agreed upon, but I don't see any reason that t…

It's not like text formats are universal. Thankfully we have settled on utf-8. The same could happen to a slightly more structured universal binary format that would be more suitable for many applications (like logging) and would have an established toolset just like 'text' now.
Post reply on HN