[systemd-devel] Logging in an enterprise environment

[Cecil Westerhof]

After giving a presentation about systemd/journald I am seen as the 
expert, so they come to me with the challenges they see.

As I understand it, journald is mend to log locally. Two methods to log 
centrally are, if I have understand it correctly:
- mounting and merging through NFS
- systemd-journal-gateway

Whereby the first would be the preferred method.

That would not be always acceptable for our clients. As I understood it 
there are environments where now 700+ systems are monitored from one log 
server. Using NFS for this would ask to much resources. I think that 
systemd-journal-gateway also would not be very handy for this because it 
is a pulling solution.

To make things even more complicated: sometimes they want no local 
logging at all, all logging should be done remotely, so that not one 
user on the system could read the logs.

Would something like this be possible to implement? If so, how much work 
would it be? Probably our company would be prepared to let programmers 
write this functionality.