Am 19.11.19 um 11:26 schrieb Martin Wilck:
On Tue, 2019-11-19 at 10:01 +0100, Stefan Seyfried wrote:
And what's wrong with using "journalctl -k -b"?
First, it does not work.
seife@vbox-seife:/local> journalctl -k -b Hint: You are currently not seeing messages from other users and the system. Users in the 'systemd-journal' group can see all messages. Pass -q to turn off this notice.
Well, it tells you what to do to make it work, does it not?
I think "access to all logs" is a much bigger security concern than "access to dmesg".
Second, performance.
Try this on a 500-days-uptime machine running on slow rotating rust.
You should update more often :-) Joke aside, I haven't tried. I'm curious, how long does it take?
Long. Very long, at least the first try until the files are in VFS cache. Journal is ridiculously slow on rotating rust. It's even slow on ramdisk. Something like 30seconds for a "systemctl status fooo", only for retrieving the last logs from journal is not uncommon.
Anyway, would "dmesg" actually be useful on such a machine? The kernel log buffer might have wrapped and lost messages after such a long uptime. More often than not, you're only interested in the latest messages, for which you can use something like "journalctl --since -10m -k", which is much quicker than "journalctl -b -k".
Still "dmesg |tail" is orders of magnitude faster.
It takes a bit of changing habits, but I've come to like the journalctl command a lot.
I've come to thoroughly hate it since I had to tame landscapes with SOC6 and SOC7 (where the journal was in RAM only, but still the ridiculous amount of logging in openstack combined with the ridiculous performance of journalctl made running "supportconfig" an 8hours+ job. Most of the time was spent in something like "journalctl -b > journal.txt". I believe we even got a PTF for supportutils working around the issue).
Martin
N�����r��y隊Z)z{.���r�+�맲��r��z�^�ˬz��N�(�֜��^� ޭ隊Z)z{.���r�+��0�����Ǩrg== -- Stefan Seyfried
"For a successful technology, reality must take precedence over public relations, for nature cannot be fooled." -- Richard Feynman -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-factory+owner@opensuse.org