On Wed, Jul 17, 2013 at 06:58:33PM +0100, M A Young wrote:
I generally make a copy of a log file and edit the copy, but I'd oppose anything that took away the ability for log files to be edited.
Another reason why you might to edit the journal is when you have to keep logs for a precise time for regulatory reasons. This isn't a problem under the classic logging and rotation.
Gah! Why would you edit the journal for that? I think that's very much the wrong approach. Right now, the solution there is to set the journal to the longest common acceptable lifetime, and then use rsyslog-based logging for policy implementation. As discussed in another subthread, this requires configuration and so does not affect the question of the defaults.
I think this is probably the right thing to do; in a large-scale environment, one doesn't really want any long-term logs on the individual systems at all if possible, right?
(Note that time-based limits _at all_ came up in the previous round of discussions on what it would take to make journal the default logging solution, and they were added to match the that request.)