On Fri, 12 Jul 2013, Jonny T?rnbom wrote:
Subject: Re: [rsyslog] journal forwarding and unix dgram socket
max_dgram_qlen=10
On Fri, Jul 12, 2013 at 11:37:32AM +0200, Rainer Gerhards wrote:
On Fri, Jul 12, 2013 at 11:44 AM, Jonny T?rnbom <[email protected]>wrote:
On Fri, Jul 12, 2013 at 11:11:04AM +0200, Rainer Gerhards wrote:
On Fri, Jul 12, 2013 at 11:03 AM, Jonny T?rnbom <[email protected]
wrote:
I agree that it is really a problem outside of rsyslog, even if it
affects rsyslog (or any other logging solution for that matter). We are
bugging the "other mailing list" about the issue and will hopefully come
up with a solution.
Now I know atleast that there isn't an easy workaround from rsyslog
side, but I will definitely let you know if what we come up with can
be of help to other rsyslog+systemd users.
Well, technically the problem is that the issue already has happened before
rsyslog is even started. So whatever we would try to do (e.g. increasing
buffers) doesn't help, as it is too late at that point in time. So I don't
see any solution except that the journal gets fixed. If I would see one,
I'd definitely try to implement it, but again: whatever we do -- it's
simply too late, damage already occured...
Rainer
The problem occurs before any logging daemon starts, it is not the fault
of rsyslog or any other logging daemon, indeed. What I meant as
workaround from an rsyslog perspective would perhaps be something like
starting rsyslog really really early in a systemd environment.
With solutions I meant solutions on the "other side", systemd fixes that
affects any syslog daemon starting up. If such a "generic" solution
comes up, I'll notify you about it since it could help other
syslog users (in this case rsyslog users) running systemd. :-)
I think the answer is clear. the Journal needs to store a copy of the messages
until rsyslog is running to be able to receive them.
Even if you increase the size of the kernel pipe buffers, you are just shifting
who has to allocate the memory to store a copy of the logs (the kernel instead
of the Journal), and the added space will be consumed foreverfor that pipe, not
just temporarily for the journal storage.
I'll also point out that before you start up rsyslog and the rest of userspace,
you don't have those programs trying to use the memory, so letting the journal
use it to store the logs until something is ready to read it shouldn't hurt
anything.
But as to your problem "you are loosing startup logs", if you configure the
system to not be allowed to buffer them, complaining that you loose them instead
seems to be a "doctor, it hurts when I bang my head against the wall"type of
question.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
