Scribe (Log Aggregation)
maang.io System Design Series
Scribe is Facebook's canonical log-aggregation design: a lightweight agent on every host receives log messages by category and forwards them up a hierarchy to central aggregators, buffering to local disk when downstream is unavailable. That store-and-forward resilience is the pattern behind every large-scale log firehose — and studying it clarifies what modern equivalents (Kafka, Fluentd) are really doing.
This deep dive comes in three parts:
- Foundations & Core Concepts — the per-host agent, categories, and store-and-forward.
- Internals — the aggregation hierarchy, disk buffering, fault tolerance, and successors, with worked examples.
- Interview — Staff/Principal Q&A: designing reliable log collection at scale.
Scribe (Log Aggregation) — Part 2: Internals & Store-and-Forward
maang.io System Design Series
What is this?
Back to the mailroom. In Part 1 we watched a memo drop into the local slot and, somehow, arrive at headquarters. Now we go behind the counter and watch what the mailroom clerk actually does with each memo: which bin it goes in, how bundles get trucked out, and — the interesting part — exactly what happens the moment a clerk learns the road downstream is washed out. Where do the memos go? How does the backlog get replayed when the road reopens? And under what conditions does a memo actually get lost?
That's this chapter. A Scribe agent is, at its heart, a message queue feeding a configurable tree of "stores," where one special store type — the buffer store — is the entire fault-tolerance story. Once you see how those pieces fit, the whole system snaps into focus.
The one-line idea: A Scribe agent routes each incoming message, by category, into a store. Stores compose: a BufferStore wraps a fast primary (forward downstream over the network) and a durable secondary (a local-disk file). When the primary is healthy, messages flow through it; when it fails, they spill to the secondary and get replayed once the primary recovers. That composition is store-and-forward.
Let's build it up from the write path.
Sign in to continue reading
The rest of this lesson is available with a free account. Signing in with Google or Microsoft is free.
Sign in to read the full lesson