Hi,
----- Original Message -----
From: Lennart Poettering <mzerqung(a)0pointer.de>
Subject: Re: logrotate(8) and copytruncate as default
journald is the only writer, it doesn't need locking. The changes it
does are done in a way so that concurrent readers will either see the
changes or not, but never half-written changes.
I see. How is that done? Does journald also renames the current file and
creates a new one and continues writing to that new file??
I'm asking because, if not, then journald could also suffer from the same
buffering issue that kernel seems to do with locking. Ie. As the file size grows
copy-truncate takes time, kernel is unable to buffer all the writes that happen
during that time, so it starts dropping a few, which results in data loss.
Also note that locking on Linux is seriously broken. You can get a
lock
on any file you can read, thus you can freeze everybody else who might
want a lock. Or in other words: if a logging daemon takes a lock on its
lock files, then you can use this to make that service freeze forever.
Yeah, I realised that. I posted a small script earlier in this thread.
With locking, you start seeing data loss as the file size grows >= 2MB.
Thank you.
---
Regards
-Prasad
http://feedmug.com