Hi, We're currently using systemd in our embedded environment. With that we are also using rsyslog, which fetches messages through the forwarding socket provided by journald.
The problem we run into is that the time in between journal.socket is created and rsyslog.service is started is so long that the socket gets full. Now when looking at the default configuration in systemd, it's set to 8MB, however the /proc/sys/net/unix/max_dgram_qlen is default defaulting to 10. This means that only 10 (actually 11) messages will be queued up in the socket and everything after that will be lost up until something starts reading from the socket == rsyslog starts. Now of course this mostly affects bootup, but I'd like to hear your ideas and thoughts around it. Of course one could change the max_dgram_qlen size, but thats a global setting, and starting rsyslog as early as possible after journal.socket isn't necessarily enough if anything in between is pumping out more than 11 messages. Any ideas/thougts? (I've just now quickly read about imjournal, perhaps it might be a solution?) Br, Jonny _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
