On Monday 26 December 2011 06:41:01 Claudio Freire wrote:
I feel I'm missing part of the thread. But anyway, I can recognize this as a discussion about the binary log, so let's hack at it:
On Mon, Dec 26, 2011 at 3:00 AM, Rajko M. <rmatov101@charter.net> wrote:
What you loose? 1) Ability to use primitive interface between you and logs that have to be huge just to satisfy that primitive interface.
You're forgetting the ability to use the extensive text analysis tools already present in linux: grep, sed, etc, etc.
2) Need to learn log file format.
That's not an issue with syslog, which has/can use standardized formats. [0]
3) Need to compress log every now and then with logrotate.
Don't kid yourself: binary logs will need compression just as well.
4) Need to expand logs when you want to read archived copies created with logrotate.
Already lots of tools for this. vim can read it just like that, with on-the-fly decompression. You also have zless, zgrep, etc...
And you don't loose the need, with binary logs, you'll need to expand them just as well (ie: use a tool to parse the binary data and present it in human readable terms) [1]
What you gain? 1) Ability to store more information in the same space.
False. You can store all that information ascii-encoded. Say, you can store binary blobs if you need to - just store them in hex/base64. You usually don't need to, that's why all logs store readable text.
2) Ability to write and read logs faster then before.
Speed is not an issue. I've processed gigabytes of text logs quickly enough when doing forensics.
3) Ability to scan for events faster then before.
I doubt this point. If you mean processing speed, see 2. If you mean actually reading the log is faster, you're mistaken. Humans never read logs line by line, except when they're really small, and then this point would be moot anyway. For big logs, you analyze them with log analysis tools. Those can work equally well with binary or text logs. Just a matter of format, not content.
Granted, standardization (either in binary or text form) helps a lot here.
[0] what people is actually after is standardization. I theorize that the whole point about this binary logging fuzz is forcing standardization. Binary logs leave no option than to standardize. But they also bring tons of inconveniences. A more directed effort would focus on standardized and complete logging formats (ie: standard across distributions and apps, while containing all the information that might be required, and perhaps the possibility to add extra information fields if needed)
[1] human readable is not about character set, it's about words. Human readable means an alphanumeric representation that can be easily understood by a human without software aids (other than display).
Thanks Claudio very well put Pete . -- Powered by openSUSE 11.3 (x86_64) Kernel: 2.6.34.10-0.4-desktop KDE Development Platform: 4.6.5 (4.6.5) "release 7" 09:35 up 9:18, 4 users, load average: 0.94, 0.98, 0.76 -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-factory+owner@opensuse.org