Stefan Seyfried <stefan.seyfried@googlemail.com> writes:
Am 26.12.2011 07:41, schrieb Claudio Freire:
2) Ability to write and read logs faster then before. Speed is not an issue. I've processed gigabytes of text logs quickly enough when doing forensics.
If you've really ever done real forensics, you'd probably value signed tamper-proof log entries.
That just proves that you've never done forensics. Relying on tamper-proofness is a bad idea. The whole feature is a typical thing some people seem to assume that everyone needs. I imagine the reader software will be designed to detect such `tampering' and invalidate it one way or the other. Just imagine a dying disk flipping bits at random with a probability of X. At some point either the signature will be invalid, or the data. Having discarded valuable redundancy by using a binary format, how do you detect the validity and how do you cope with situations like these?
[1] human readable is not about character set, it's about words. Human readable means an alphanumeric representation that can be easily understood by a human without software aids (other than display).
I really want to see someone read /var/log/messages without software aid. I cannot.
And there is no reason why "less" will not gain the ability to read journal entries, just like it is able to read messages.gz.
I don't want to depend on that particular less feature, at least not in real-life stress situations. It pains me to see that some people seem to scale their experience with 2 or 3 computers to a farm of 10000+ computers. It's a LOT different. Let's not forget this is new territory for anyone that hasn't done a similar migration (for the better or worse) in the past, promises mean nothing, *experience* is what counts. I could bore you all with stories about a similar movements in the financial industry (it was more about latency and parsing speed rather than tamper safety, etc.). But the fact is that the plain text standard FIX is still by far the most wide-spread despite several attempts to binarify it. I can't help but see similarities between the discussions back then and now. Sebastian -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-factory+owner@opensuse.org