For the exact same logs:
journalctl takes 10s to search through 4GiB. And misses most of the matches.
(rip)grep takes (0.1)0.5s to search through 605MiB.
In other words. journalctl consumes much more space, and a lot more time, to return an order or magnitude less results to the same query.
What does journalctl offers, that makes this resource, time and correctness tradeoff worth it?
For the exact same logs:
journalctl takes 10s to search through 4GiB. And misses most of the matches.
(rip)grep takes (0.1)0.5s to search through 605MiB.
In other words. journalctl consumes much more space, and a lot more time, to return an order or magnitude less results to the same query.
What does journalctl offers, that makes this resource, time and correctness tradeoff worth it?