Results 1 to 2 of 2

Thread: Followup questions regarding journald

  1. #1

    Default Followup questions regarding journald

    I would like to ask some additional questions regarding thread, journalctl and syslog-ng on 13.2:


    1. After the user uninstalls systemd-logger and installs syslog-ng, will logrotate work for syslog-ng?
    2. Is journald log archived, and is it configurable like syslog has been (ie., size, time)?
    3. I've read a couple of threads on reddit on log corruption. How do you recover? Do you lose everything or just the current month, assuming it is configurable?
    4. Scripts that currently process the log, there input will come from reading journalctl output(??) ?
    5. What replaces logger to write to the log?


    Thank you.

  2. #2

    Default Re: Followup questions regarding journald

    Quote Originally Posted by opensuseforumorg42 View Post
    After the user uninstalls systemd-logger and installs syslog-ng, will logrotate work for syslog-ng?
    logrotate is completely unrelated to systemd-logger.
    In fact, systemd's journal doesn't even use logrotate.

    I don't know whether the syslog-ng package sets up logrotate by default, but I can say that the rsyslog package (which has used as default on openSUSE instead of syslog-ng since years) does.
    So I'm inclined to say yes as answer to your question.

    Is journald log archived, and is it configurable like syslog has been (ie., size, time)?
    Yes. It is stored in /var/log/journal/ (in binary form).
    Although if with "archived" you mean "compressed"/"zipped" regularly (like logrotate does), then the answer is no. But it is stored compressed anyway I think.

    The configuration is in /etc/systemd/journald.conf.
    Not exactly the same as syslog though.

    I've read a couple of threads on reddit on log corruption. How do you recover? Do you lose everything or just the current month, assuming it is configurable?
    I never had a log corruption here, so I don't really know.
    It would depend on the amount of corruption though, I suppose.

    But why are you interested, if you want to install syslog-ng anyway?

    Scripts that currently process the log, there input will come from reading journalctl output(??) ?
    What scripts do you mean?
    If a script parses /var/log/messages, it will not get anything from journalctl obviously, just what is in /var/log/messages.
    The journal daemon does pass everything to a running syslog daemon by default though. So everything that's in the journal, should be in /var/log/messages (or other files, depending on the syslog configuration) as well.

    What replaces logger to write to the log?
    Nothing.
    systemd's journal replaces the standard system log, so everything that uses standard logging facilities should use the journal automatically.

    And to clear out a possible misconception:
    systemd-logger does not do anything. It is a mostly empty package (it basically just contains a README file and a sysvinit script for compatibility and conflicts with other syslog packages).
    Uninstalling it does _not_ disable the journal, or change anything at all.

    If you want to disable the on-disk journal (you don't really need it if you install syslog-ng, as syslog-ng keeps an on-disk log anyway, in text form), just remove the folder /var/log/journal. journalctl will still work, but is restricted to the current boot of course, as the journal is not saved anywhere.
    Last edited by wolfi323; 16-Dec-2014 at 01:29.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •