Am 28.05.2014 15:17, schrieb Stephen Gallagher:
On 05/27/2014 08:30 AM, Reindl Harald wrote:
> maybe someone of the server SIG could try to explain the
> systemd-maintainers that calculation and that this is unacceptable
> on real-world servers because it burries any interesting
> information
> the way systemd in Rawhide now logs make it unacceptable on
> production servers and that said from someone running Fedora on a
> lot of real-world servers for 6 years now
>
https://bugzilla.redhat.com/show_bug.cgi?id=1072368#c8
> if the "Stopping", "Stopped", "Removed",
"Starting" and "Reached"
> messages would only have a prefix to filter them out with rsyslog,
> currently you can't distinct them between system-wide messages
> such flooing up to a self-DOS belongs in a debug level
It seems to me that a more useful (and generic) solution to this would
be to create a rules-engine for specifying what messages get sent
through the syslog output (and if sent, optionally prefixed).
The internal journal message containing these start/stop notifications
have a number of useful structuring elements that would make it easy
to filter on, if such a rules engine was devised.
hm - they are *all* un-needed because you have the
information redundant and i have already rsyslog
rules to not clutter /var/log/messages on F19/F20
all that log records are only interesting most of the time for a
systemd-developer or in case of debug while "replay" a bootlog
without any hint that it is triggered just by a cronjob isn't
that helpful in general
that the systemd developers want that messages and point
to journald and filtering is nice, but they have to accept
that there are workflows which are using classical syslog
even if it is only because mysql-logging
/var/log/secure:
May 28 15:05:01 localhost systemd-logind[381]: New session 42457 of user root.
May 28 15:05:01 localhost systemd-logind[381]: Removed session 42457.
May 28 15:05:01 localhost su: pam_unix(su:session): session opened for user wwwcron by
(uid=0)
May 28 15:05:01 localhost su: pam_unix(su:session): session closed for user wwwcron
/var/log/cron:
May 28 15:05:01 localhost CROND[1315]: (wwwcron) CMD (*************)
___________________________________
# Log systemd-logind to /var/log/secure
:programname, isequal, "systemd-logind" -/var/log/secure
:programname, isequal, "systemd-logind" ~
:msg, contains, "Starting Session" ~
:msg, contains, "Started Session" ~
:msg, contains, "Stopping Session" ~
:msg, contains, "Stopped Session" ~