Hacker News Reader

On the disk the live update part would be either a circular buffer (and readers would need to double-check the start/end marks after reading) or just literal append-only streams. In the latter case, reading would be barely more complex than tail -f.

View on HN

Sure, but you have to take pains to make sure that journalctl -f doesn't skip events or print some twice. It can be made to work, for sure, but it just seems easier to print logs via a daemon instead, especially because if you go through a deamon, you turn the disk format from an interface into an implementation detail.

I want my logs readable on a completely read-only disk. Sure, I can start a daemon, but that’s mildly annoying.

Also, the syslog daemon should be extremely reliable, and throwing giant table scans at it makes this more complex.

Reply on news.ycombinator.com