On Friday 04 April 2014 23.25:09 Stefan Seyfried wrote:
Am 04.04.2014 19:12, schrieb Bruno Friedmann:
Well if only I've still rotating rust for system. I've chosen journald exclusively
I really would not do that, I'd always add syslog-ng in addition.
I cannot count the number of times the journald crapped itself and I had files that could not be read. Even better: when the broken file was present I could not read any journal anymore. Basically journalctl was going in circles:
2013-12-21 00:00:01 .... 2013-12-21 12:34:45 .... 2013-12-21 19:20:31 .... --- reboot --- 2013-12-21 00:00:01 ....
etc. And just with trial and error (removing one file after another) I was finally able to delete 3 weeks of journal logs to at least be able to read the rest.
This happened so often that I finally got tired of filing bugs :-)
With syslog-ng, i sometimes after a crash get 4K of \000 in the file, but that's it. And I can just skip over it.
cause I know some report of being perhaps slow on rust and all system here are now powered on ssd. (Tired of sector defects & co)
Slowness is one problem, but being unreliable is really a PITA.
for example I've rotated my log this morning and now
How do you do that? How do you determine which of the files are no longer needed?
While I'm still experiencing the impact of the different value in journalctl.conf on running system. And also due to some of the same kind of corruption (on old journal in 2013) (I've successfully reduce the lost by playing with the --since=DATE --until=DATE to bisect the faulty. Upstream have always promise that the journal has not problem, just the parser. So I keep them ;-) I'm using a poor dirty man hack rotate way. I've no formal code but my hack follow the idea of Find journal storage D=$(journalctl --header --system | grep "Machine ID" | awk '{print $3}') R=${D}_$(date --utc "+%F_%H%M%S") $B="/var/log/journal" systemctl stop systemd-journald.service mv ${B}/${D} ${B}/${R} systemctl start systemd-journald.service Journal is recreated and old one are still accessible with journalctl --directory=PATH could be exported to another host etc... Not that ideal as you can see, but I know that I don't have 100 lines of incoming logs when the rotate happen. So just a way to keep the journal quite fresh. -- Bruno Friedmann Ioda-Net Sàrl www.ioda-net.ch openSUSE Member & Board GPG KEY : D5C9B751C4653227 irc: tigerfoot ~~~Don't take Life too serious. Nobody gets out alive anyway!~~~ -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-factory+owner@opensuse.org