On Thu, Jul 11, 2013 at 08:53:57PM +0200, David Lang wrote: > On Thu, 11 Jul 2013, Jonny T?rnbom wrote: > > > On Wed, Jul 10, 2013 at 08:38:43PM +0200, Michael Biebl wrote: > >> 2013/7/10 Jonny T?rnbom <[email protected]>: > >>> Hi, > >>> > >>> No your unfortunately not correct, uoting the same page you referred > >>> to: > >>> > >>> "none" turns off all storage, all log data received will be dropped. > >>> > >>> If we were to use 'volatile'then it would log to memory only. However > >>> in our case it's an embedded system with limited resources so we do not > >> > >> You missed to mention, that you are using none. > >> The default is automatic, which means volatile in the case > >> /var/log/journal directory does not exist. > >> > >> So no, I don't think what I was saying was incorrect. > >> > > Sorry for the confusion. I did write earlier though that we don't store > > anything coming from journal but could have made it more clear that we > > have configured storage to 'none'. > > > > Any other ideas on the actual problem? > > I don't understand what you think the problem is.
The problem is that we lose messages at boot-up. > You have disabled the ability for the journal to buffer things, and then you > want to know why there isn't a buffer. I have disabled storing of messages from journal (see why below). The storage setting of journal does _not_ affect the socket buffering of the forwarding socket. > reconfigure storage to the default instead of none and it sounds like things > will 'just work' As I wrote in my previous email we are on an embedded system with limited resources. Storing duplicates of messages is not an option. Reconfiguring storage to default will _not_ make it work. We will still drop messages at boot-up since the forwarding socket is getting full. What would solve this particular problem is using journald instead of rsyslog, but as you might have figured out, I'm more interested in continuing using rsyslog. I'm fairly sure we are not the only ones with a Linux system that uses systemd + rsyslog. This problem potentielly affects _every_ one of those systems that primarily uses rsyslog as logging solution. Depending on when rsyslog starts and the configured max_dgram_qlen, systems will likely drop messages at bootup when using the default forwarding socket from journal. I wanted to shed some light on the issue and make you aware of it. Regards, Jonny _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
