• arc@lemm.ee
    link
    fedilink
    arrow-up
    5
    ·
    edit-2
    9 months ago

    Concerning logs:

    1. You can still log to text if you want by configuration (e.g. forward stuff to syslog) and you can use any tools you like to read those files you want. So if you like text logs you can get them. You can even invoke journalctl to output logs on an ad hoc / scheduled basis in a variety of text formats and delimited fields.
    2. Binary allows structured logging (i.e. each log message is comprised of fields in a record), indexing and searching options that makes searches & queries faster. Just like in a database. e.g. if you want to search by date range, or a particular user then it’s easy and fast.
    3. Binary also allows the log to be signed & immutable to prevent tampering, allow auditing, intrusion detection etc… e.g. if someone broke into a system they could not delete records without it being obvious.
    4. You can also use splunk with systemd.

    So people object to systemd writing binary logs and yet they can get text, or throw it into splunk or do whatever they like. The purpose of the binary is make security, auditing and forensics better than it is for text.

    As for scripts, the point I’m making is systemd didn’t supplant sysvinit, it supplanted upstart. Upstart recognized that writing massive scripts to start/stop/restart a process was stupid and chose an event driven model for running stuff in a more declarative way. Basically upstart used a job system that was triggered by an event, e.g. the runlevel changes, so execute a job that might be to kick off a process. Systemd chose a dependency based model for starting stuff. It seems like dists preferred the latter and moved over to it. Solaris has smf which serves a similar purpose as systemd.

    So systemd is declarative - you describe a unit in a .service file - the process to start, the user id to run it with, what other units it depends on etc. and allow the system to figure out how to launch it and take care of other issues. It means stuff happens in the right order and in parallel if it can be. It’s fairly simple to write a unit file as opposed to a script. But if you needed to invoke a script you could do that too - write a unit file that invokes the script. You could even take a pre-existing init script and write a .service file that kicks it off.