syslog-ng to replace syslogd

[nathan r. hruby]

On Sun, 22 Aug 2004, seth vidal wrote:

>
>> I've added the below comment, but since I get the feeling a nice big
>> flamewar is coming anyway (it's been what.. 2, 3 hours since the last
>> one?) I'll be happy to start it.
>>
>>
>> Oh god.  Please no! The questions from my users will never ever ever end.
>
> What did you do when things switched from apache 1.3 to apache 2? The
> config files changed there, too.
>
> You couldn't do that migration w/o munging files.
>

Actually, it's been fairly easy :)  Most of the config options remained the
same and many of the ones that changed I don't use or were fairly trivial.
My configs were easy to migrate, and most of the others I've seen /
inherited are so horribly written they needed a rewrite before they could
even get ported in the first place :)

I think the analogy is not really a apples->apples one though, as the
syntax, format, and most of the directives were the same or similar.
The syslog -> syslog-ng config formats in no way resemble each other other
than they use the same general vocabulary for describing things.

> moreover, how many users REALLY touch their syslogd config files? I'd
> bet it's something like 2% who ever touch them. Most just rely on the
> defaults to dtrt.
>

Perhaps.  I still think it's overkill.  In my dream of dreams there'd be a
small sysklogd that was easy to configure and fairly secure that allowed
syslog-clients to work well and then use something like syslog-ng on the
backend.

Again, I could be placated with a redhat-config-syslog that made it easy to
satisfy 80% of the syslog needs for users new to Unix/Linux how the admin
who just doesn't want to bother with YACS.  My point is that I think it's
more than 2% altering configs and syslog-ng's config syntax is dense
enough that there's going to be confusion.  Some additional thought,
energy and effort should go into the decisions, as opposed to just making
the switch and forcing people to figure it out.

I don't think that *you* were advocating such a process, but it seems like
that seems to be the going trend.

>> If you want a nicer syslog daemon, how about metalog[1] or at least
>> something with a config syntax that doesn't require a PhD in Physics
>> to
>> understand?
>>
> metalog hasn't been updated or maintained in over a year. A stable
> release in over 2 years.
>
> Syslog-ng is being actively maintained.

I brought metalog up as a sample other logger.  I personally could care less
what package it is so long as it is easy to configure.

-n
-- 
-------------------------------------------
nathan hruby <nhruby at uga.edu>
uga enterprise information technology services
production systems support
metaphysically wrinkle-free
-------------------------------------------