Docs mention syslog, GUI refers to syslog, there's no syslog

[esi_y]

So I don't know if it's just anachronism or I missed something but PVE is full of references to syslog, almost all wrong. If it was called system log, log(s) or journal (not my preference), I would not mind, but when I see e.g. syslog tab in GUI ... would have expected to see collated logs from the whole cluster there. Not the case. (I know it would be hard to do meaningfully.) There's no syslog by default on Debian to begin with.

The docs [1] have 11 references to "syslog", half of which are used semantically wrong.

Please don't tell me it's called that because every admin thinks of libc syslog(3) calls instead of syslog server.

The docs [1] at the end kind of try to save it with even reference to "Syslog protocol (RFC 5424)" and then go on to say "traffic" and UDP 514 - well, that's RFC 5426 and I have not found it anywhere in PVE.

I put it here before I file a bugreport so that everyone can tell me why I should not and how they have never gotten confused by this (not even the first time when they were to collect logs out of the cluster and found ... no syslog).

[1] https://pve.proxmox.com/pve-docs/pve-admin-guide.html

 

[esi_y]

 

[fiona]

Hi,
Proxmox VE 8 following suite with Debian 12 is the first release where rsyslog is not installed by default: https://www.debian.org/releases/boo...information.en.html#changes-to-system-logging
You can still install it if you want of course.

But yes, the documentation can be improved.

 

[esi_y]

I do not mean to be nitpicking, I really do not. Yesterday I was helping someone and for a moment we lost ourselves whether something is in their "log" or syslog (where the nodes collect it), so we would know if e.g. network conn was up.

In the GUI, it's already under the section "System", so it could be called "Log". Same for the docs (most occurrences).

 

[fiona]

I do not mean to be nitpicking, I really do not. Yesterday I was helping someone and for a moment we lost ourselves whether something is in their "log" or syslog (where the nodes collect it), so we would know if e.g. network conn was up.

In the GUI, it's already under the section "System", so it could be called "Log". Same for the docs (most occurrences).

But yes, the documentation can be improved.

I said that I agree

 

[esi_y]

I said that I agree

Thanks, I also meant the GUI - new users refer to what they see in GUI as-is, usually.

 

[fiona]

Thanks, I also meant the GUI - new users refer to what they see in GUI as-is, usually.

https://lists.proxmox.com/pipermail/pve-devel/2024-February/061751.html
Feel free to open a bug report for the documentation, I don't have time to look over that right now.

 

[esi_y]

https://lists.proxmox.com/pipermail/pve-devel/2024-February/061751.html

Thanks for this! I personally would have preferred just "Log" (it's already in System section) or "Systemd Log" if one is academic, but better than the old name.

Feel free to open a bug report for the documentation, I don't have time to look over that right now.

I will! It was like 6 or so instances.

 

[fiona]

After discussing with other developers, the argument is that Syslog is more precise, because the messages are exactly those captured via the syslog standard/mechanism. "System Log" doesn't capture that fact and is worse in this regard. See: https://lists.proxmox.com/pipermail/pve-devel/2024-February/061764.html

 

[fiona]

Thanks for this! I personally would have preferred just "Log" (it's already in System section) or "Systemd Log" if one is academic, but better than the old name.

Just "Log" is even less precise. Users will just ask themselves what kind of log.

 

[esi_y]

I am afraid I have to retract my thanks then here. Because every person coming to forum will be talking about their "syslog" and tweaking timestamps, googling, looking for logs of different nodes on the wrong one ... and be wondering what are those journalctl commands people post when it should have to do with "syslog".

I am sorry, Dietmar thinks of syslog(3), admins think of syslog(8). The GUI is for the other audience - my argument only, of course.

 

[esi_y]

Just "Log" is even less precise. Users will just ask themselves what kind of log.

Node Log? But this is nitpicking now too, because this is in GUI under system item of the node alone. (It should be clear it does not collect logs and has nothing to do with syslogd.) I also try to be practical and do not suggest "Journal" out of some academic debate because no one would search it under that name for sure.

 

[fiona]

I am afraid I have to retract my thanks then here. Because every person coming to forum will be talking about their "syslog" and tweaking timestamps, googling, looking for logs of different nodes on the wrong one ... and be wondering what are those journalctl commands people post when it should have to do with "syslog".

I am sorry, Dietmar thinks of syslog(3), admins think of syslog(8). The GUI is for the other audience - my argument only, of course.

I'm sure many/most admins are familiar with the systemd journal nowadays.

If you can't accept decisions made by Proxmox VE developers, you are always free to fork it and do your own. Endless discussions just thwart development progress and help nobody...

 

[esi_y]

I'm sure many/most admins are familiar with the systemd journal nowadays.

Best example is someone mentioning "this was in my syslog" - in my syslog I have all the nodes' logs. Every admin understands it that way. No one says I received these items through libc syslog() calls, really.

If you can't accept decisions made by Proxmox VE developers, you are always free to fork it and do your own. Endless discussions just thwart development progress and help nobody...

No they do not, that's why I put it here and do not spam pve-devel. Because half a year later someone can chip in to here that indeed it confused them too. And I can add links to threads later on to here where it caused at least some confusion for reference.

The discussion with "developers" should have been reflected there with the rationale in the mailing list too. NB The docs refer to "traffic" syslog rather than the "mechanism". So if I am going by the docs, find Syslog in my GUI and go to check in the docs, I will be completely messed up by that source too. Why is there even any UDP reference?

(I do not have problem to accept anything, I can express my opinion still, correct?)

 

[fiona]

But other people would be confused by "System Log", because they won't know what kind of system log.

 

[esi_y]

But other people would be confused by "System Log", because they won't know what kind of system log.

In this sense we could argue endlessly, even the "Certificates" under "System" are ... what kind of "system" (cluster? this node only?), what kind of "certificates" (CA is there? is it shared? is it local copy, etc.).

If syslogd was dead, I would not have any issue with anachronisms for the sake of brewity / clarity.

The other day someone wrote "this was found in my syslog all the way till time X" ... talking of networked system I would be immediately able to infer oh so if that was still flowing out of the nodes over UDP, the networking must have worked all till that timestamp ... but no ...soon after we found out this is PVE GUI "syslog" we were talking about.

For me if there was just one tab under "System" called "Log", it's clear (as to any admin). The only improvement there for clarity would have to do actually with "System" to name it "Machine" as PVE is all about clusters so that could cause confusion too.

But I really do not need to "argue endlessly", I am happy enough I was free to express it here, you (one other person?) disagree, if you are happy (with status quo) let's keep it here, someone might have other arguments.

 

[fiona]

In this sense we could argue endlessly

Yes, please don't and consider other people's time.

 

[esi_y]

Yes, please don't and consider other people's time.

It's actually more time-saving to stop engaging (in a particular topic) when it stops adding value. I do not find it cool to (even seemingly) patronise others by implying their time is less valuable. I do not mind, as is obvious over time here, but others might. Just my opinion (which I am happy to delete if you do the same with the post i replied to).

 

[esi_y]

The docs [1] at the end kind of try to save it with even reference to "Syslog protocol (RFC 5424)" and then go on to say "traffic" and UDP 514 - well, that's RFC 5426 and I have not found it anywhere in PVE.

I put it here before I file a bugreport so that everyone can tell me why I should not and how they have never gotten confused by this (not even the first time when they were to collect logs out of the cluster and found ... no syslog).

[1] https://pve.proxmox.com/pve-docs/pve-admin-guide.html

I will file this one later on then.

 

[fiona]

After discussing with other developers, the argument is that Syslog is more precise, because the messages are exactly those captured via the syslog standard/mechanism. "System Log" doesn't capture that fact and is worse in this regard. See: https://lists.proxmox.com/pipermail/pve-devel/2024-February/061764.html

As Fabian pointed out, Dietmar's argument is not actually correct:
https://lists.proxmox.com/pipermail/pve-devel/2024-February/061787.html