Where should an /opt package write logs

fhslogs

I am installing a custom package to /opt/package_name, storing configuration files in /etc/opt/package_name and static files in /var/opt/package_name/static/ – all following the conventions suggested by FHS. [1] [2] [3]

I also need to store some logfiles. I want them to be discoverable by analysis tools, so they should also be in a conventional location. Should these go in:

  • /var/log/package_name (like a system package, even though this is a custom package)
  • /var/opt/package_name/log (following the /var/opt convention – but is this discoverable?)
  • something else?

Best Answer

I would place them in /var/log/package_name; it satisfies the principle of least surprise better than /var/opt/package_name/log. I don't have a citation for this; it simply matches where I'd look for logs.

I might also forego writing my own log files, and instead log to syslog with an appropriate tag and facility; if I'm looking for clean integration with established analysis tools, I don't believe I can do better for a communications channel:

  • Every generic tool with "log analysis" as a listed feature already watches syslog.
  • Log file release and rotation semantics are handled for me; I don't have to set up a mechanism for logrotate to tell me to let go of the file and open a new one. I don't even have to tell logrotate about new files to rotate!
  • Offloading logs to central logging servers is handled for me, if the site demands it; Existing established tools like rsyslog will be in use if needed, so I don't have to contemplate implementing that feature myself.
  • Access controls (POSIX and, e.g. SELinux) around the log files are already handled, so I don't need to pay as much attention to distribution-specific security semantics.

Unless I'm doing some custom binary format for my log and even then, I prefer syslog-friendly machine-parseable text formats like JSON. I have a hard time justifying my own separate log files; analysis tools already watch syslog like a hawk.