F20 System Wide Change: No Default Syslog

[Martin Langhoff]

On Mon, Jul 15, 2013 at 2:45 PM, Lennart Poettering
<mzerqung at 0pointer.de> wrote:
> You'd usually mount your journal files dir, then direct "journalctl -D
> /path/to/the/journal/files/dir" to it. It will then collect all files in
> that dir, interleave them and present them to you.

Thanks! And that -D would be to the dir normally under
/var/log/journal AIUI. My reference earlier to
/var/lib/systemd/catalog was wrong I believe.

=>>  - What guarantees of completeness/consistency  can we expect in
>> practice from the journal in a hard poweroff situation? What is the
>> price in terms of fsync() calls?
>>
> We sync() all journal files to disk 5min after each write the latest

that's new and interesting. AIUI pre-journal, the default was to
sync() on every message for some logs (and overrriden with a hyphen
for some logs). Am I wrong?

Heading offtopic: Are there ways to control sync on a per-service
basis? Or to trigger a sync on things like authentication failures,
OOM shootouts, or kernel oopses?

IOWs, logging potentially catastophic event events is always without
guarantees, but when it works, it logs damn useful info.

(snipped lots of good info, thanks!)

> When the journal starts up and finds a journal file is not marked
> "offline" it will immediately rotate the file and start a new one, in
> order to make sure we never fiddle with files that have incomplete
> transactions in them.

OK. That's sane and failsafe.

> With the default settings, in the worst case you might lose 4:59s of
> logs, but even that is very unlikely.

The trick with this is... you usually have a short window between the
catastrophic event and the problem.

Sometimes the problem cripples the system irretrievably. Can't win in
that case. But there are plenty of "in the middle" cases where if logs
written out in time can help diagnose issues.

> Of course, things are different if some other form of corruption takes
> place, i.e. where the fs gets corrupted so badly due to some external
> condition that the middle of the journal files is bad. We do not provide
> any recovery tools for that case currently.

It's gonna happen at some point :-) Anyway, if the file-format is
append-only and indexes and such are rebuildable, then it's within
reach.

Still, not a happy prospect for the first admin to need it.

cheers,




m
--
 martin.langhoff at gmail.com
 -  ask interesting questions
 - don't get distracted with shiny stuff  - working code first
 ~ http://docs.moodle.org/en/User:Martin_Langhoff