Discussion
Hmm, I wonder what one could replace #systemd #journald with on #BSD.
This thing logs into basically a database, which you can then ask for things like “everything since last reboot with priority ‘warning’ or above” or “everything emitted by service xyz since 5 minutes ago”.
Can any other #logging system do that? Preferably from the command line?
@argv_minus_one I have been shoving my logs into various databases for the past... uhhh... 10-15ish years. Most recently into VictoriaLogs, running on a 2014-era mac mini (running nixos, currently).
I can do all kinds of fancy queries, get a response within seconds, and it takes less space than gzipped logs would. Can recommend.
The hard part is transforming your logs to give them structure you can later query on. Though, timestamp + program + level + boot id + message is a good start, and easy to do for most apps. (I use Vector for this purpose)
*Some* of this can be done with regular syslogd, like writing a separate log that contains only ‘warning’ and above.
But those time-bounded queries are impossible with regular textual log files as far as I know. You need something database-like to do that.
I'm also not thrilled at the thought of duplicating #log entries (which already consume considerable disk space) into several different files, just so I can see a priority- or service-filtered view of them…
#syslog #logging