[systemd-devel] Logging in an enterprise environment

[Holger Winkelmann [TP]]

Hi Cecil,

----- Original Message -----
> After giving a presentation about systemd/journald I am seen as the
> expert, so they come to me with the challenges they see.
> 
> As I understand it, journald is mend to log locally. Two methods to log
> centrally are, if I have understand it correctly:
> - mounting and merging through NFS
> - systemd-journal-gateway
> Whereby the first would be the preferred method.

The first will fail shorts if the Environment is distributed somehow, mounting
NFS drives is not always a option. We prefer some gateway solution which forwards
the log messages to a aggregation host.
 
> That would not be always acceptable for our clients. As I understood it
> there are environments where now 700+ systems are monitored from one log
> server. Using NFS for this would ask to much resources. I think that
> systemd-journal-gateway also would not be very handy for this because it
> is a pulling solution.

We think of forwarding the messages when arrived locally. But we should think about
local caching as well. What about the aggregator or network is not available?

> To make things even more complicated: sometimes they want no local
> logging at all, all logging should be done remotely, so that not one
> user on the system could read the logs.
> 
> Would something like this be possible to implement? If so, how much work
> would it be? Probably our company would be prepared to let programmers
> write this functionality.

My open question would be: If you aggregate the logs, with your example from 700 hosts,
should we use the Journald Fileformat on the central location as well? Does it scale?
should we write one journal file per host? can jpurnalctl deal with 7000 files and
the huge content?

Further we would like to discuss the transport between the host and the aggregator.
many ideas come along like AMQP, pure TCP, Syslog(seems to limited), HTTP?

Holger

> systemd-devel mailing list
> systemd-devel at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/systemd-devel
> 

-- 
Holger Winkelmann


email: hw at travelping.com