[Followups to debian-devel with CC to me, please, as I'm not subscribed.] Currently, while the majority of daemons support logging to syslog and/or journald, a small handful of software ships configured to use its own logfiles by default. For instance, update-alternatives logs to /var/log/alternatives.log, aptitude logs to /var/log/aptitude, dpkg logs to /var/log/dpkg.log, fontconfig logs to /var/log/fontconfig.log, CUPS logs under /var/log/cups, and so on. This makes it more difficult to get a unified view of system log data, ship logs off-system, analyze logs for unusual activity, or any number of other policies a sysadmin may wish to apply to logging.
While there are *absolutely* configurations in which system administrators want to log to arbitrary locations and files, I would like to propose that for consistency we should configure software to unify logging into syslog and/or journald by default. In particular, I'd propose that daemons and applications should default to logging to syslog (working with any installed syslog implementation providing /dev/log), and that daemons run via systemd units may detect or be configured to log to stdout/stderr which will be wired to the sysadmin's preferred log target. This should Do The Right Thing by default, both on systems running any syslog daemon and on systems running journald, without a hard dependency on either one. And sysadmins would still have the option of configuring any daemon they wish to log to any location they wish. This would also mean that daemons no longer need to install directories to /var/log, no longer need to install logrotate configuration files or suggest/recommend/depend on logrotate, and in some cases may be able to avoid any special permissions just to open a logfile. Eventually, as we configure most applications for this default, we could introduce this into policy as a "should", but for now I'm seeking interest in slowly adapting applications to shift defaults to unified logging. - Josh Triplett
