On 03/03/2016 12:17 PM, Carlos E. R. wrote:
Wait. My point was about the size of the logs,
No your point was about the time it took to run that command. Yes, you've discussed size, repeatedly, but this thread isn't sufficiently differentiated. I was referring specifically to Message-ID: <56D7FBEB.5000001@telefonica.net> Date: Thu, 3 Mar 2016 09:55:07 +0100 where you said:
But I'd prefer not to have journal running. Or at least impede some entries from going into it, like email or nntp.
Telcontar:~ # time journalctl --no-pager | grep "fetchnews\|postfix\|fetchmail" | wc -l 202170
real 0m7.878s user 0m6.173s sys 0m1.351s
I said that instead of the "grep" in that pipeline you should use the proper journalctl filters. Yes, those times are outrageous, I agree, but its because you are getting journalctl to format and output *ALL* of its entries. There is no need for that. That you could, by proper configuration, have separate logs for those process, is quite another matter; I've touched on that. As for size, each journalctl record is much more comprehensive than a syslog record. The format you've requested output is just the syslog compatible form, which is much less than journald actually has. In addition, the ability to filter without 'grepping' means that the database also contains hash-chains for indexing. If you were to add a parallel index to your /var/log/messages (etc..etc) to allow equally comprehensive searches and filtering then the size would go up too. My whole point here is that the indexes *DO* exist and you can specify directly to journalctl to make use of them instead of outputting the whole and grepping. An analogy would be to have a database ... select all field from table | sort vs select all field from table using index order-by ... -- Let us never forget that government is ourselves and not an alien power over us. The ultimate rulers of our democracy are not a President and senators and congressmen and government officials, but the voters of this country.” -- Franklin D. Roosevelt -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org