On 2016-12-20 03:54, L A Walsh wrote:
Anton Aylward wrote:
Rotating rust of syslog files isn't going to be any faster.
It was already pre-sorted w/syslog. If you used ng-syslog, you had all the filtering of grep available on each log message, so zero waiting for filtered syslog output.
Apparently converting to text the whole journal needs seeking in the database, and if it is large (I have had a journal fo a gigabyte or two) the disk head movements are considerable. People using an SSD did the job in seconds, whereas people with rotating disk measured it in minutes. I'm not joking, I measured this and posted results in the mail list months ago. I don't know how to exactly seek for them; perhaps grep for 'journalctl' and 'time'. It is possible that producing output on "_COMM" instead, would be faster. I did not know about that command. Then we could repeat the tests I did months ago - but in this machine, I no longer have a journal. I would have to enable it again, and run it for some days to produce content. Why did I disable the journal on disk (temporary and long term)? Because it takes gigabytes... I have an nntp local server (proxy), and it produces tons of log messages per day. With syslog I can dump them all after, say, a week. With journal, I can't. If I want to keep a reasonable long term journal of all important events in my machine, it also keeps the useless debug logs of everything else... I can not purge the database of selected content. With syslog, I can keep logs dating back for a year or two and it is no issue. I simply dump the verbose debug logs of some facilities like nntp. And yes, I'm aware of the advantages of a log database. I worked with them, professionally. We had a system that converted to a binary database the text logs of several machines, so that we could run analysis (real time or later time) of the data. A hugely expensive system.
This is all new to e as well, but I'm willing to accept it, not fight it, to experiment and learn. I figure that Lennart Poettering is smarter than me. What I understand makes sense and what I understand allows me to, slowly, learn more.
==== You want something new? How about logs in rot13? That's the next step to prevent casual browsing of system data entries (as MS uses in the registry).
You got to be kidding. Really? MS uses rot13 in the registry? Wow.
UNIX, Linux has always had for me a joy in learning and a WOW! factor and a 'hey, that's neat!" aspect. I've never had that with Windows (which was always A source of frustration)
Did you ever read "Windows Internals" (by Russinovich)? Eventually divided into 2 volumes with other contributors... The earlier versions were better.
Shows you how to dig in as deep as you want. You just had to work harder for your "oh wow".
or even VMS (and yes even when I used the RATFOR Software Tools).
I read at the time the official MsDOS programmer book (expensive), and it was fascinating. I also read a non official guide to Windows 3 internals, and it also was fascinating. Finally, I read all the Borland C and Turbo Pascal for Windows manuals, and I found them very entertaining books. There was documentation, good reading material, written to be read by people, and it was good and very interesting. And expensive. It was possible to understand how the system worked and why it did things as they did. Of course, there were hidden, non disclosed functionalities... which some people found out and published. But that was another time and age. I no longer do programming for Windows. Nor for Linux... just a little bit. -- Cheers/Saludos Carlos E. R. (testing openSUSE Leap 42.2, at Minas-Anor) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org