replacing rsyslogd in minimal with journald [was Re: systemd requires HTTP server and serves QR codes]

[Lennart Poettering]

On Tue, 09.10.12 15:45, Tom Hughes (tom at compton.nu) wrote:

> On 09/10/12 15:35, Bryn M. Reeves wrote:
> >On 10/09/2012 03:19 PM, Tom Hughes wrote:
> >
> >>More importantly though, what is the equivalent of "fgrep xxx
> >>/var/log/messages" which is certainly pretty much the most common thing
> >>I do on my logs... I can't see any sort of searching in journalctl?
> >
> >journalctl | fgrep?
> >
> >This one is pretty fine by me tbh.
> 
> Sure, though having just tried that is took 33s to search about a
> months worth of logs instead of the 0.05s that greping the last
> months messages took ;-)

Ist this F18? We made some imprvoements there. 33s is way too long
indeed.

Note that journalctl used like this will probably always be a bit slower
than the pre-serialized form read directly from the fs (which
/var/log/messages is), since we crawl through a ton more metadata, and
do a number of conversions during presentation. But not by this margin.

Please file a bug (but only if this against current F18). Make sure to
base this on the same dataset though. Also, please mention whether this
is on SSD or on rotating media.

There are a number of low-hanging fruits how we can easily optimize this
still, especially for rotating media.

Alsonote that if you use the built-in filtering of journalctl things
should already look a lot better. ("journalctl
_SYSTEMD_UNIT=avahi-daemon.service" instead of "journalctl | grep
avahi-daemon" for example.)

Lennart

-- 
Lennart Poettering - Red Hat, Inc.