Stefan Seyfried <stefan.seyfried(a)googlemail.com> writes:
Am 26.12.2011 07:41, schrieb Claudio Freire:
Ability to write and read logs faster then before.
Speed is not an issue.
I've processed gigabytes of text logs quickly enough when doing forensics.
If you've really ever done real forensics, you'd probably value signed
tamper-proof log entries.
That just proves that you've never done forensics. Relying on
tamper-proofness is a bad idea. The whole feature is a typical thing some
people seem to assume that everyone needs. I imagine the reader software
will be designed to detect such `tampering' and invalidate it one way or
Just imagine a dying disk flipping bits at random with a probability of
X. At some point either the signature will be invalid, or the data.
Having discarded valuable redundancy by using a binary format, how do you
detect the validity and how do you cope with situations like these?
readable is not about character set, it's about words. Human
readable means an alphanumeric representation that can be easily
understood by a human without software aids (other than display).
I really want to see someone read /var/log/messages without software
aid. I cannot.
And there is no reason why "less" will not gain the ability to read
journal entries, just like it is able to read messages.gz.
I don't want to depend on that particular less feature, at least not in
real-life stress situations.
It pains me to see that some people seem to scale their experience with 2
or 3 computers to a farm of 10000+ computers. It's a LOT different.
Let's not forget this is new territory for anyone that hasn't done a
similar migration (for the better or worse) in the past, promises mean
nothing, *experience* is what counts.
I could bore you all with stories about a similar movements in the
financial industry (it was more about latency and parsing speed rather
than tamper safety, etc.). But the fact is that the plain text standard
FIX is still by far the most wide-spread despite several attempts to
binarify it. I can't help but see similarities between the discussions
back then and now.
To unsubscribe, e-mail: opensuse-factory+unsubscribe(a)opensuse.org
To contact the owner, e-mail: opensuse-factory+owner(a)opensuse.org