I would suggest that you use imjournal instead. That interface works by allowing
the journal to write it's files and then rsyslog uses the journal interface to
query for new logs.
Make sure you are running the latest version (both systemd and rsyslog) because
there is a bug in earlier versions of systemd that result in a endless loop when
reading the journal files.
David Lang
On Fri, 5 Jul 2013, Jonny T?rnbom wrote:
Hi,
We're currently using systemd in our embedded environment. With that we
are also using rsyslog, which fetches messages through the forwarding
socket provided by journald.
The problem we run into is that the time in between journal.socket is
created and rsyslog.service is started is so long that the socket gets
full.
Now when looking at the default configuration in systemd, it's set to
8MB, however the /proc/sys/net/unix/max_dgram_qlen is default defaulting
to 10. This means that only 10 (actually 11) messages will be queued up
in the socket and everything after that will be lost up until something
starts reading from the socket == rsyslog starts.
Now of course this mostly affects bootup, but I'd like to hear your
ideas and thoughts around it. Of course one could change the
max_dgram_qlen size, but thats a global setting, and starting rsyslog as
early as possible after journal.socket isn't necessarily enough if
anything in between is pumping out more than 11 messages.
Any ideas/thougts? (I've just now quickly read about imjournal, perhaps
it might be a solution?)
Br,
Jonny
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
