On 16/09/2015 21:42, Rich Freeman wrote: > On Wed, Sep 16, 2015 at 12:55 PM, Alan McKinnon <alan.mckin...@gmail.com> > wrote: >> >> It has something to do with systemd's log thingy. >> >> The error only appears in one place in the syslog-ng source, >> in modules/systemd-journal/journal-reader.c: >> >> static inline gboolean >> __seek_to_saved_state(JournalReader *self) >> { >> JournalReaderState *state = >> persist_state_map_entry(self->persist_state, self->persist_handle); >> gint rc = journald_seek_cursor(self->journal, state->cursor); >> persist_state_unmap_entry(self->persist_state, self->persist_handle); >> if (rc != 0) >> { >> msg_warning("Failed to seek to the cursor", >> evt_tag_str("cursor", state->cursor), >> evt_tag_errno("error", errno), >> NULL); >> return __seek_to_head(self); >> } >> journald_next(self->journal); >> return TRUE; >> } >> > > The other posts are getting at the solution - disable journal support > if you're not actually using systemd. > > However, does syslog-ng actually READ logs? My understanding is that > journal cursors are used to read logs, not to write them, and I > associate syslog-ng more with writing logs. > > The concept is that when you query the journal every record gets > returned with a cursor, which is just a guid of some sort. Then you > can run a later query and pass the last cursor you saw back and just > get a list of new records since the last one you read. The use case > is for log monitors and such so that they can periodically poll the > log without having to read the entire thing from the beginning each > time. >
Digging up ancient memory from other people's posts long ago: Doesn't syslog-ng read systemd's log from early userspace startup (before syslog-ng starts) and write those entries to syslog-ng? -- Alan McKinnon alan.mckin...@gmail.com