On Mon, Sep 27, 2021 at 1:11 PM Arjun D R <drarju...@gmail.com> wrote:
> Hi Folks, > > Currently we are using systemd-journald for service logging. We run > journalctl for a bunch of services and redirect those to the custom log > files for every few seconds. This takes up the CPU for that particular > time period since we have lot of IO operations as well. We came to know > that systemd version v236+ supports direct logging > (StandardOutput:file:<log_file>) to the custom log file by the service. I > would like to use that facility but we don't get the prefix that we used to > get when using the journal. > > Is there a way to prepare a custom patch locally to add the necessary > prefix to the stdout before writing to the custom log file? Is that a good > idea? Any other suggestions? > Probably not easily, as it's not systemd that is writing to the log file – it's your service process itself that directly gets a FD for the log file as its stdout. It's not specifically a "direct logging" feature, but rather just an equivalent to `myservice > log_file`. How do you currently get the logs "every few seconds"? Instead of repeated grabbing, have you tried using `journalctl --follow` to monitor logs continuously? This should use far less I/O than repeated `journalctl | tail` which is what it sounds like you're doing. (Wrap in `stdbuf -o0` if necessary.) Alternatively, set up the traditional rsyslogd or syslog-ng – writing to custom log files is basically what they *do*, and both of them are capable of receiving logs from journald (either by directly monitoring .journal files or by having the messages forwarded via socket). -- Mantas Mikulėnas
