[systemd-devel] [ANNOUNCE] Journal File Format Documentation

[Lennart Poettering]

On Tue, 23.10.12 20:52, "Jóhann B. Guðmundsson" (johannbg at gmail.com) wrote:

> On 10/23/2012 06:40 PM, Lennart Poettering wrote:
> >The journal currently cannot do this for you, but what it already can is
> >split up the journal per-user. This is done by default only for login
> >users, (i.e. actual human users), but with the SplitMode= setting in
> >journald.conf can be enabled for system users as well, or turned off
> >entirely. We could extend this switch to allow other split-up schemes.
> >
> >But note that the price you pay for interleaving files on display grows
> >with the more you split things up (O(n) being n number of files to
> >interleave), hence we are a bit conservative here, we don't want to push
> >people towards splitting up things too much, unless they have a really
> >good reason to.
> 
> If I'm understanding this correctly would it not better
> simply/suffician support splitting the journal up via cli instead of
> doing it "real time" ?

We might add this as a tool one day, but I think it's a good rule to
write logs once, and not touch them afterwrads if at all possible, in
order not to corrupt what is already written safely. Hence: it's
probably a good idea to focus on writing things the right way the first
time, instead of focusing on on rewriting them afterwards.

Related to the tool you are suggesting I think a tool to merge split off
files might be very useful too, to counter the scalability issues of
interleaving too many separate files on display.

Lennart

-- 
Lennart Poettering - Red Hat, Inc.