Am 05.02.20 um 06:08 schrieb Russell Stuart: > journald has nits I mention below, but I was prepared to put up with > them and drop rsyslog until one day a server stopped in a nasty way and > journalctl refused to display what lead up to the crash because it's > binary logs were corrupt. As far as I was concerned this made journald > unfit for use on production servers. (rsyslog's logs also get 4k lumps > of nulls and other garbage in them in similar situations, but they > remain usable.)
journal files are append only. If journald notices a corrupt/inconsistent journal file, it will rotate it away and start with a fresh journal file. If you run journalctl, it will do its best to read as much data from the unclean journal as possible. I assume you had some kind of file system corruption. So depending on where that corruption inside the journal file happened, it's possible that journalctl couldn't read behind this corruption. Typically, due to the append only nature of the journal, if a crash happens, only the very last log messages should be lost. journald has matured of the years and journalctl has become more sophisticated with dealing with broken journal files, so I would be very much interested in your experience with more recent systemd versions. Michael
signature.asc
Description: OpenPGP digital signature
