systemd-journald, was: Unintended consequences of no default MTA - How best to fix

[Lars E. Pettersson]

On 01/02/2014 04:33 AM, Chris Murphy wrote:
> rsyslog pulls data directly from journal files, so the source data is identical. What's different is how journalctl displays it compared to the message file rsyslog produces from the same journal file. I think this might be more a feature request of rsyslog than systemd, but if you're going to ask two projects to somehow negotiate and coordinate on producing an identical formatting of the journal file, I think it won't go anywhere. If you prefer the formatting of rsyslog then use that. If you prefer the formatting of journalctl use that, it's already available anyway and even has advantages to help you parse it to get what you're looking for.

If we have something (journal(ctl)) that replaces something else 
(syslog), it is good thing to be backwards compatible. As seen the 
differences are minor. Keeping these minor changes is like the saying 
"standards are good, everyone should have one", in practice this does 
not work, and the minor changes (may) pose problems to certain scripts. 
The simple spolution is to make the output the same (which would be easy 
to do as they are created by the same underlying structure, just as you 
mention).

> I think this is the response you're likely to get if you get one at all:
> https://lists.fedoraproject.org/pipermail/devel/2013-July/185783.html

Yes, sadly enough...

>> What improvements? Is it possible to get it "a pixel perfect match" using options?
>
> There are a lot.

I was thinking of Rahuls statement that the output from journalctl and 
syslog was "pixel perfect", which it is not, and he mentioning options. 
As I understand it, no options are available to do the outputs "pixel 
perfect"

Regarding the journal in general, yes, it has many options that make it 
quite usable, and I do use it from time to time. In my situation, with a 
journal of about 3.7 GB, it is extremely slow though, which makes the 
journal hard to use, even "systemctl status <something>" takes time, as 
it has to go through the journal to output the last lines from the log.

This may all be a bug (I filed bug 1047719 on this).

Anyhow, thanks for the information about options etc. Sadly the man page 
is somewhat sparse on examples which makes the transition to journalctl 
a bit hard.

Lars
-- 
Lars E. Pettersson <lars at homer.se>
http://www.sm6rpz.se/