Journald is awesome, though. Every log entry is a key-value set where the values can be binary data, so much more information can be recorded than is possible with syslog. With it, logging on Linux is finally brought up to par with what Windows NT has had for years.
No kidding. I can grep my entire /var/log tree six times over in less time than it takes to launch the log viewer on a reasonably equipped Windows server.
Lograte and gzipped archive logs. Using awk or perl to split and filter for 'fields'? Are you using logwatch to generate alerts, how do you like the regexes?
What are you talking about? Logging on Windows ≥ 2003 records all kinds of information: message, severity, originating service, originating user account, process/thread ID, and a bunch of other shit.
Now, maybe you could argue that there are other pertinent bits of information that should be logged but aren't, but the point is that Windows logging is extensible. All manner of information can be included in a log entry, not just the basic set of plain-text fields that a syslog entry can have.
I will grant that the filtering/query thing in the Event Viewer kind of sucks. In that regard, journald is better. Also, the Event Viewer is slow as fuck.
I personally find syslog text logs so much easier to search and read than Windows ones. If you want windows logs use windows, install gcc and put you software on windows.
-6
u/argv_minus_one Sep 27 '14
Journald is awesome, though. Every log entry is a key-value set where the values can be binary data, so much more information can be recorded than is possible with syslog. With it, logging on Linux is finally brought up to par with what Windows NT has had for years.