On Mon, 7 Mar 2016 18:36, Per Jessen wrote:
ianseeks wrote:
On Monday, 7 March 2016 13:58:56 GMT Per Jessen wrote:
What I'd like to understand is still - why is the forwarding to syslog missing some messages??
Are you using the version of syslog that extracts the journal data or are you still using systemd forwarding? I have no idea what the solution to the problem is but i was wondering which version of syslog is being installed.
Ian, that's a good question, I have also been wondering if the syslog-ng on those systems is backlevel.
a) opensuse 12.3, systemd 195, syslog-ng 3.4.5. No "missed" messages. b) opensuse leap42, systemd 210, syslog-ng 3.7.1, no "missed" messages. c) opensuse 13.1, systemd 208, syslog-ng 3.4.7, no "missed" messages. d) opensuse 13.2, xen, systemd 210, syslog-ng 3.5.6, 1-2-3 messages missed every 5 minutes. e) opensuse 13.2, xen, systemd 210, syslog-ng 3.5.6, 1-2 messages every 15minutes, followed by 34-37 ditto. Very weird.
Looks like it might cron related - in (d), there's a cron-job running every 5 minutes, on (e) there's a cron-job running every 15 minutes.
Hmm, is the (d) + (e) system a upgraded system from a prior (e.g. 13.1) release? b/c from 208 to 210 some of the defaults for journald have changed. On my Fresh install of Leap42.1 (systemd 210) (rsyslog 8.4.0), I had to set some opts to get to the 'No "missed" messages' state: file /etc/systemd/journald.conf, diff -U0 style --- Default (or if unset, according to Docu) +++ MySetting: @@ - #SyncIntervalSec=5m + SyncIntervalSec=1m @@ - #RateLimitBurst=1000 + RateLimitBurst=0 @@ - #ForwardToSyslog=yes + ForwardToSyslog=yes Mysterious was the 'ForwardToSyslog=yes', which according to Docu defaults to yes, but needed to be explicitly set to get to the wanted "no missed messages" success. My box is heavily used for testing, some odd bursts of messages are more the rule than the exception. - Yamaban. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org