> On the logging question, does the ForwardToSyslog option not do what you'd like?
Of course not. Now you have two logging services. Hardly a replacement.
Of course not. Now you have two logging services. Hardly a replacement.
The idea is that systemd wanted to not implement a bunch of different logging APIs within systemd itself. They wanted one logging API across all of the systemd components; and, then, if the end user needs logs to some other target, they use one utility (journald) to spit it out to that other target.
I believe the thinking that went into this decision was sound. The alternative would be for every component in systemd to know about multiple logging targets, which would be exactly what people are accusing systemd of being (but isn't, in this case): bloated. systemd and all of its components log one way, allowing for a very simple logging code path. journald allows you to use those logs in many ways.
So, either, systemd would need to expand to include support for a bunch of different logging mechanisms, or it would support one simple logging API and provide a way to export those logs to other targets.
Are you here arguing that systemd should be made larger and more complicated, in order to support other kinds of logging (like syslog and plain text files) without the help of journald?
To me, this looks like modularization and componentization at a reasonable level of abstraction. It simplifies the logging code for every component, while also providing a means for end users to consume the logs in the ways they prefer, including plain text.
It's not modularization. It's scope creep in pure form.
Lennart wrote a pretty good summary of why journald exists, and I think it holds up to scrutiny pretty well:
https://docs.google.com/document/pub?id=1IC9yOXj7j6cdLLxWEBA...
One could argue about what the right "one log" target is, but I doubt one would come up with syslog. syslog-ng and rsyslog were incremental improvements, and solve some of the issues, but they're 18 and 12 years old, respectively, and both pre-date containers, widespread cloud computing (AWS came in 2006), service-based architectures, etc. When they were new, we still had servers that did one thing.
One can also argue about whether journald is the right implementation, even if we acknowledge that a new standard is needed, we don't have to agree that journald is the right one. But, I wasn't writing the code, and what they came up with is pretty good. I don't have any major complaints about it, except that I have to learn some new stuff.
So, I respect the argument that they should have chosen an existing standard for logging, but I also see the reasons why they chose to build something new. I think if I'd been involved in the decision, I probably would have come down on the side of journald, in the end (but would have needed some convincing).
Of the reasons he wrote it, half of them is not met by journald, and the other half could be implemented without much trouble on top of syslog. Hard to call it "holding up to scrutiny pretty well".
And I fail to see how journald is better than syslog in the age of containers.
Hopefully, you'll be able to direct your energies into maintaining one of the distros that has chosen to stick with the old way of doing things (Devuan seems to be the most promising one coming up, but I guess there are several others). I'm not opposed to folks having choices, as long as I don't have to maintain them.
[#] LXC/libvirt type containers I see as merely cheap VMs, though I like them very much.
As for Docker, you can continue to use the logging tools you're used to, or you can have it output to the journal. Docker supports many logging drivers: https://docs.docker.com/engine/admin/logging/overview/