Hello,
After several searches of the forums I could not find an answer. I would appreciate any assistance or point me in the right direction if this has already been solved/answered. I apologize if this is a lot of information I tried to be very detailed.
Quick Information:
openSUSE version you are working on -> openSUSE 13.2 (Tumbleweed Repositories)
the name and the version number of the application that you believe is giving you problems -> journalctl (systemd 210)
an appropriate description of the symptoms -> journalctl slow response time.
Background Details:
Many, Many years ago (geeze, now I feel old). I setup ssh to only Allow one user into server by setting the AllowUsers option; I then wrote a perl script which monitored the /var/log/messages file for ssh brute force login attempts. It would pull out the IP address of the attempted login and then would DROP the IP address with a call to iptables. The script was really simple and searching the /var/log/messages file ran very fast (less than a second) it looks something like:
open(MESSAGES, '/usr/bin/tail -f /var/log/messages |');
while(<MESSAGES>)
{
chomp();
if((/Invalid user/ ||
/allowed because not listed in AllowUsers/ ||
/but this does not map back to the addres/) &&
(/\b(\d{1,3}(?:\.\d{1,3}){3})\b/)) { block_punk($1); }
}
The Problem:
After recently upgrading to openSUSE 13.2 I noticed my simple little script started to fail miserably. I did some googling and quickly found that /var/log/messages no longer exists and I should now use journalctl. OK, I can deal with change and adjusted my script to:
open(MESSAGES, '/usr/bin/journalctl -f -u sshd |'); // OpenSuse 13.2 journalctl change
while(<MESSAGES>)
{
chomp();
if((/Invalid user/ ||
/allowed because not listed in AllowUsers/ ||
/but this does not map back to the addres/) &&
(/\b(\d{1,3}(?:\.\d{1,3}){3})\b/)) { block_punk($1); }
}
This now runs but what I noticed is that pulling records from the journal is very slow. I pulled out the new call to journalctl and ran it on the command line; for example when running this command directly:
time journalctl -u sshd |tail -100
I get the results of:
real 1m28.185s
user 1m5.448s
sys 0m28.105s
So it is taking 1 minute 28 seconds to pull the last 100 sshd log entries out of the journal.
And Now Finally A Question:
I appreciate you making it this far. *** Can you please tell me why journalctl is running so slow?***
Thanks For You Patience,
Jim
P.S. Just one more thing. I know there are plenty of ways to prevent brute force ssh attacks (fail2ban, Sshguard, Denyhosts, etc.) and I know I can re-enebale syslog-ng or rsyslog to resolve the issue. But what I really want to know is what is up with journalctl being so slow?
I personally use this over journalctl for simplicity.