Grepping logs is terrible

Re:Grepping logs is terrible by onli on Wednesday May 06, 2015 @06:01AM (#9497556)

> Why not bring one more to read the binary dump too?

For one, because it is not packaged for my distribution. For two, because I get exactly nothing in return. All binary logs do for me is forcing me to use an additional tool.

> I'm sorry, but I don't find the "but I can view text on a machine from the last century" argument convincing.

POGO-E02. I really don't know how old this is, but it has USB-2 and I bought it 2 years ago, though it was marked as classic then. Maybe 2009?

> and when doing forensics, we usually do that on a reasonable machine, where all the tools we need are available

I'm normally doing that at my own environment, with the tools I am used to, and on my machine. Nothing of that includes a binary log viewer.

[ Parent | on HN ]

Re:Grepping logs is terrible by Nullabillity on Wednesday May 06, 2015 @07:19AM (#9497781)

> For one, because it is not packaged for my distribution.

Are you running Slackware?

[ Parent | on HN ]

Re:Grepping logs is terrible by onli on Wednesday May 06, 2015 @07:22AM (#9497796)

I wrote that below, that is a Ubuntu 14.04 LTS. The important point is that the theoretical availability - there probably is a PPA somewhere - of journalctl is an additional, unnecessary hurdle.

[ Parent | on HN ]