News for hackers. Stuff that matters.
Re:Linux Hardening Guide by uncledave on Thursday December 31, 2020 @08:33AM (#25592495)
That’s fine until it doesn’t work or the journal is corrupt or you’re pulling the journal off the file system as mentioned further down the post I made. I’ve been there and the entire toolset fell to pieces in front of me.

Plain text is orders of magnitude easier and safer to deal with and easily recoverable even if only partially which is extremely difficult with journald

Re:Linux Hardening Guide by Spivak on Thursday December 31, 2020 @12:24PM (#25594694)
I mean the journald format isn’t magic or anything and 99% of what it stores is plain-text. The only issue with “corruption” is that the tooling is bad at handling it. Which is a valid complaint. But in an alternative universe people would be complaining about plain-text because less crashed on any utf decoding issue.

Basically every journald using distro immediately forwards the logs to syslog so you can just pretend it doesn’t exist and call it a day. I don’t because journald’s metadata and filtering is super powerful but nothing is stopping you from just grepping like usual.