[systemd-devel] Fwd: [systemd-commits] Makefile.am src/bootchart - Make bootcharts go to the journal

[Colin Guthrie]

'Twas brillig, and Kok, Auke-jan H at 16/04/13 00:33 did gyre and gimble:
> FYI - this is a first pass to putting the bootcharts into the journal,
> exactly as coredump does. Ultimately, I will probably make bootcharts
> not go to disk other than the journal by default.
> 
> A single one-liner can be used to get the latest bootchart automatically:
> 
> $ journalctl -b MESSAGE_ID=9f26aa562cf440c2b16c773d0479b518
> --field=BOOTCHART > bootchart.svg

Just out of curiosity, what is the rational behind doing this? I think
it's really cool that we can store arbitrary things in the journal, but
I have concerns about storing potentially large stuff in there. The
bootchart is likely not that big, but especially with coredumps (which
has patches now thankfully) a small period of "dump frenzy" can fill up
your logs and cause rotation. This could be exploited at some point in
the future by an attacker to cover their tracks making you think some
software had just gone haywire when reviewing your (rotated) journals.

Was there anything particularly wrong or problematic previously with
writing out to a file? Other than a log of previous boots, what
advantage does it have to keep them in the journal?

I'm mostly playing devils advocate here. I do kinda like the fact it's
in there personally, but then I like shiny things.


Col

-- 

Colin Guthrie
gmane(at)colin.guthr.ie
http://colin.guthr.ie/

Day Job:
  Tribalogic Limited http://www.tribalogic.net/
Open Source:
  Mageia Contributor http://www.mageia.org/
  PulseAudio Hacker http://www.pulseaudio.org/
  Trac Hacker http://trac.edgewall.org/