Comment Re:SystemD (Score 1) 154
journald is not "boot logs". It's logs, period. From the kernel, from initrd, from every service that starts on boot, from every service that starts afterwards, and from any userspace application that cares to log to it, including unprivileged, user-made ones.
Also, "journalctl -o json" is a thing. But if you look at what comes out of that, it's not particularly compact. A lot of gains can be made with a better encoding.
And really, the difference between JSON and simple binary isn't that large. JSON is a complicated format that if it breaks can be troublesome.
Indexing is nice. You can ask for what happened 3 boots ago, or at 3 AM a week ago and get an answer near instantly, instead of futzing around trying to figure out which log file it is, and how to grep for a date/time range.