Bringing syslog-ng into the fold [FC6 ?]

[seth vidal]

On Fri, 2005-10-14 at 14:08 -0400, Elliot Lee wrote:
> On Thu, 13 Oct 2005, Stephen J. Smoogen wrote:
> 
> > One of the things we have to do at our sites is remove the Red
> > Hat/Fedora syslog services and replace them with syslog-ng. The TCP
> > part, the better message congestion issues, and the better ability to
> > group logging together is really needed by larger sites. [We have
> > found that the lossiness of regular syslog can get black marks on
> > reviews.] A long time ago, it was proposed for inclusion around Red
> > Hat Linux 6.0 but was considered too unstable and some other issues.
> > 
> > Could it be evaluated again for either for replacing the older syslog
> > system or working the syslog system so that alternatives could cover
> > it with syslog-ng in extras? What issues would need to be done to help
> > this along?
> 
> There are enough syslog replacement wannabees out there that this isn't a
> slam-dunk decision. Because the client-side interface is built into glibc,
> so many apps use the syslog interface that just putting syslog-ng into the
> distro won't accomplish much for admins.
> 
> (For syslog-ng in particular, I seem to recall when I looked at it that it
> avoided making radical-but-necessary improvements for the sake of
> compatibility, which makes it sound a bit like subversion to me.)
> 
> I think someone needs to evaluate the millions of syslog replacements out
> there, pick the best one overall, and get the client-side API for that
> into glibc. Then it'll just be a matter of starting to convert apps from
> the old API to the new one.
> 

okay I'm confused. Why isn't using syslog-ng a slam-dunk.

1. we don't break compatibility for the api - which means not modifying
lots of difficult programs
2. it makes it easier for this to trickle into rhel
3. it's a known value in that it's used in large-scale and small-scale
operations all over the place.
4. it's an immediate win over syslog in that it is:
   a. more feature-full
   b. actually maintained

-sv