Why are there so many log files in a typical Linux system? Why don’t they use one consolidated logs db/file and an api

logs

I just wonder why are there so many log files in a typical Linux system?
Wouldn't it be a better idea to have one system api function for logging and one consolidated table to save all the log entries from all the applications?

Best Answer

It's part of the Unix philosophy. The idea is that text files are free from program lock-in and everyone can use whatever technique they prefer. To take this further, flat files are often used, as opposed to markup languages like XML (although I have seen programs storing things in XML format as well).

In googling I have found this nice writeup about plain text, with comments about the Unix philosophy.

Related Solutions

Debian Logs – How to Write Init.d Script Log Messages to Disk

It looks like the solution is to install bootlogd and put

BOOTLOGD_ENABLE=yes

in /etc/default/bootlogd.

References:

Linux – What’s the difference between ULOG and NFLog

ULOG was the original user space logging added in Kernel 2.4 for ipv4.

NFLOG is the newer, generic (layer3 independent) logging framework for 2.6 kernels based on the original ULOG but implemented via libnfnetlink

Both will send logs to ulogd which will then log via whatever output plugin you choose.

Use ULOG if you are stuck with ulogd-1.x as 1.x might not play nicely with NFLOG. You really should be using ulogd-2.x as 1.x is considered legacy and is EOL.

Otherwise, just use NFLOG

Best Answer

Related Solutions

Debian Logs – How to Write Init.d Script Log Messages to Disk

Linux – What’s the difference between ULOG and NFLog

Related Question