Yamaban wrote:
On Mon, 7 Mar 2016 18:36, Per Jessen wrote:
Ian, that's a good question, I have also been wondering if the syslog-ng on those systems is backlevel.
a) opensuse 12.3, systemd 195, syslog-ng 3.4.5. No "missed" messages. b) opensuse leap42, systemd 210, syslog-ng 3.7.1, no "missed" messages. c) opensuse 13.1, systemd 208, syslog-ng 3.4.7, no "missed" messages. d) opensuse 13.2, xen, systemd 210, syslog-ng 3.5.6, 1-2-3 messages missed every 5 minutes. e) opensuse 13.2, xen, systemd 210, syslog-ng 3.5.6, 1-2 messages every 15minutes, followed by 34-37 ditto. Very weird.
Looks like it might cron related - in (d), there's a cron-job running every 5 minutes, on (e) there's a cron-job running every 15 minutes.
Hmm, is the (d) + (e) system a upgraded system from a prior (e.g. 13.1) release?
No, they're both fairly fresh 13.2 installs, (d) a little older, (e) is brand new.
b/c from 208 to 210 some of the defaults for journald have changed.
On my Fresh install of Leap42.1 (systemd 210) (rsyslog 8.4.0), I had to set some opts to get to the 'No "missed" messages' state:
file /etc/systemd/journald.conf, diff -U0 style --- Default (or if unset, according to Docu) +++ MySetting: @@ - #SyncIntervalSec=5m + SyncIntervalSec=1m @@ - #RateLimitBurst=1000 + RateLimitBurst=0 @@ - #ForwardToSyslog=yes + ForwardToSyslog=yes
Mysterious was the 'ForwardToSyslog=yes', which according to Docu defaults to yes, but needed to be explicitly set to get to the wanted "no missed messages" success.
My box is heavily used for testing, some odd bursts of messages are more the rule than the exception.
These two boxes are also mostly in test-mode, and as they are both xen dom0, not much logging activity. Thanks for your suggestions about journald.conf, I'll check it out. -- Per Jessen, Zürich (0.6°C) http://www.hostsuisse.com/ - virtual servers, made in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org