> On Tue, 3 Feb 2015, Michael Biebl wrote: >> 2015-02-03 21:13 GMT+01:00 David Lang <david <at> lang.hm>: >>> It would be useful. Questions relating to interacting with the journal and >>> systemd are common and going to be more common, but there aren't a lot of us >>> here with experience with that environment. >> >> Are you interested in the "big picture" or do you have specific questions? > > I think big picture is useful. I have specific questions about the overhead > of > the different options (including the option in the very recent versions of > systemd to have it leave /dev/log alone)
It would be a huge help to have something about socket passing mentioned somewhere on the appropriate (imuxsock?) module page. Using myself as an example of a new user, I have now spent quite a bit of time totally confused puzzling over the default configurations for rsyslog under Fedora 20 ### syslog.socket [Unit] Description=Syslog Socket Documentation=man:systemd.special(7) Documentation=http://www.freedesktop.org/wiki/Software/systemd/syslog DefaultDependencies=no Before=sockets.target shutdown.target Conflicts=shutdown.target [Socket] ListenDatagram=/run/systemd/journal/syslog SocketMode=0666 PassCredentials=yes PassSecurity=yes ReceiveBuffer=8M ### syslog.service [Unit] Description=System Logging Service Requires=syslog.socket [Service] Type=notify ExecStart=/sbin/rsyslogd -n StandardOutput=null #### MODULES #### # The imjournal module bellow is now used as a message source instead of imuxsock. $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) $ModLoad imjournal # provides access to the systemd journal $ModLoad imklog # provides kernel logging support (previously done by rklogd) #### GLOBAL DIRECTIVES #### $WorkDirectory /var/lib/rsyslog $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat $IncludeConfig /etc/rsyslog.d/*.conf $OmitLocalLogging on $IMJournalStateFile imjournal.state as this make no sense unless you know that rsyslog understands systemd socket passing. My best guess before I happened to stumble across this thread and discover that was maybe the way it was suppose to work was it ignored the passed sockets and picked everything up from the imjournal module. Of course this left the question of why even load the imuxsock module at all given the $OmitLocalLogging on. It also lead me to trying to setup something different as the whole reason I'm doing this is to get remote logging of a periodic system crash. I figured a trip through the journal files would likely mean I wouldn't see the last gasp. Somethings still aren't clear to me though. I take it - $OmitLocalLogging on means the imuxsock module ignores /dev/log and only accepts logs messages on /run/systemd/journal/syslog socket passed from systemd as this makes sense. The above setup still doesn't make sense though as - shouldn't I get duplicate log messages as each message should be picked up by the imuxsock module (directly from journald) and the imjournal module (indirectly via the journald journal files) Am I missing something or is there some sort of additional journal magic going on here? Thanks! -Tyson _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
