[systemd-devel] live remote logging?

[Cliff Brake]

Hello,

We have a system that is composed of 8 embedded ARM CPUs, and one server.
 The embedded ARM units are booting an initramfs that uses systemd.

We would like to store the logs from the 8 embedded systems on the server.
 In the past, we would use the syslog networking logging.

What type of architecture should we use?  Ideally we'd like to be able to
use the live remote logging that is discussed in the systemd design
document.

I've come up with several ideas:

1) scp/rsync the journal files to the server.
   * how do we know when a file is ready to be scp'd?
   * is there any way to get reasonable update rate?  It seems running
rsync every 10s might get expensive.

2) use the systemd-journal-gatewayd in v195
   * is there any way to stream the journal with this, or is this more of a
query interface?
   * I assume, we then we loose the journal file format

3) write our own app that monitors the journal and copies over data
   * how would this operate, would we use mmap + file change notifications,
or journal C api?
   * with mmap, would we watch all the files in the journal directory?

4) wait for the live remote logging features
   * any timeline for when this will be available?

5) run syslog along side journal and use the syslog network logging features
   * then the anti-systemd members of the team say -- why don't we just
ditch systemd and go back to sysvinit and syslog ...  :-)
   * then we lose the query benefits of the journal on the server.

Additionally, on the server, it seems like it makes sense to use the
journal files for the log storage.
  1) how would log rotation be managed (discard old logs)?
  2) can the systemd-journal-gatewayd be used on a independent directory of
log files?

Appreciate any ideas.

Thanks,
Cliff

-- 
=================
http://bec-systems.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/systemd-devel/attachments/20121031/eb565cfb/attachment-0001.html>