On Tue, 2012-10-09 at 15:57 -0600, Stephen John Smoogen wrote: > On 9 October 2012 15:50, Matthew Miller <mattdm@xxxxxxxxxxxxxxxxx> wrote: > > On Tue, Oct 09, 2012 at 03:41:51PM -0600, Stephen John Smoogen wrote: > >> > If you want audit-like semantics with crashing if we cannot write, then > >> > use something else, not the journal. The journal is supposed to be > >> > robust and do the right thing so that you can leave it unnatteneded and > >> > whatever happens it didn't spill the disk or become unavailable. It's > >> > supposed to be "zero maintainance". > >> > >> So in those cases rsyslog would be required, but would be seen as a > >> post-install step. > >> > >> EG what you are looking at is building a GNOME-OS and for those sorts > >> of tablets, etc the journal is right for that. The other cases like at > >> a Hospital, trading firm or various .gov.XX then having rsyslog > >> installed with audit post would be the way to get the needed features. > > > > If so, this seems unfortunate, because the other features discussed (e.g., > > trustable metadata) would be very welcome in these environments. Can't the > > enterprise have nice things? > > Sorry I didn't mean to make that either/or. The enterprise gets the > journald but does not get to keep its contents unless there is a > program that sends it to say rsyslog. Ah; I think what you meant to say is: "*IF* what you are looking at..." but I'd suggest instead: "If you have strict requirements on time-based logging rotation or certain audit requirements, then something like rsyslog(?) is required in parallel with the journal. In most other cases (desktops, tablets, many servers) the journal is sufficient." No? Dan -- devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/devel
