Logging to files works since the unix epoch 1970.

I think it is time for a change.

My reasons:

  • rotating files is a pain: Server needs to get reloaded after rotating ...
  • logging structured data means this workflow:
    • nice high level data structures gets serialized to a byte string
    • later the byte string needs to be constructed to a nice high level data structures again. Can break if two processes log to the same file.
  • Yes, grep is nice for most cases. But complex queries (spanning several lines) are hard.

But what to choose?

My environment:

  • Linux severs
  • Mostly Python software
  • Satellite systems:
    • Our software runs in intranets of customers.
    • The satellite runs on its own, but gets managed from our central office
    • Network connection between satellite and central office is sometimes slow or down.


  • Network outage between satellite and central office can happen daily. Some sort of buffering is needed
  • grep-replacement: We need simple way to "grep" the logs from the shell (on satellite and central office)
  • structure data support: We need to be able to log structured data (json or yaml)
  • Support for Python virtualenvs: We run several virtualenvs on one linux server. Logs need to be kept separated from each virtualenv

2 Answers 2


You might be able to use: https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-ubuntu-14-04

Logstash forwards the logs to the central logging server.

Also, rsyslog can be configured to forward to a central store, and cache logs locally with the following config setting:

$WorkDirectory /rsyslog/work # default location for work (spool) files Through extended configuration, it can even be configured to log to a MySQL server. Configuration can generate complex entries.


You might want to log to SQLite databases instead of plain text files for the following reasons:

  • SQLite is part of the python standard runtime library. Thus, databases can be created, filled and maintained very easily
  • binary distribution consists of a single (scriptable) commandline executable, the sqlite shell, which can be used to easily query the logs
  • sqlite provides a locking mechanism that prevents files getting clobbered by a concurrent write access
  • JSON and YAML data could either be serialized and stored as text (SQLite allows text field size of 231-1 bytes) or if structure is limited in size and consistent across log entries, the database tables could be structured accordingly
  • querying the databases by means of using SQL can be much faster, and more convenient than using grep on text files. SQLite also implements indexed full-text search to speed up the search for strings
  • Largely decreased the need for log rotation: theoretical maximum number of rows in SQLite databases (which corresponds to a number of possible log entries) is 264. Even without log rotation, recent entries can quickly be queried if time stamp is explicitly integrated as field in the tables

The recommendation would be to use a separate local SQLite database for any virtualenv. The logs could then be collected by the satellite. As soon as the network is available, satellite database can be queried from central office. Alternatively satellite and central office could as well use any other RDBMS for integrating data (in general database management systems also include a command line client for administering or quickly querying - or as you named it - "grepping" the database)

Admittedly there are some limitations:

  • I want to avoid self-made solutions. SQLite is a great database. But to solve a lot of things are still missing: What database schema would be useful? How to get the log messages from into the database ...
    – guettli
    Commented Jan 2, 2016 at 11:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.