2015-03-06 22:07 GMT+01:00 Tyson Whitehead <[email protected]>: > On March 6, 2015 15:45:09 Tyson Whitehead wrote: >> That makes a lot more sense now. >> >> Thanks so much to both you guys. > > BTW, am I correct to assume that the imuxsock module is a better match than > the imjournal module for trying to get any last dieing messages off the box > before it wedges itself up.
That's a good question. As long as the message is properly stored in the journal and the journal file was not corrupted when the system dies, imjournal/rsyslog should pick up those messages upon the next (re)boot. The journal is a bit prone though to corrupt the journal files if the system is shutdown uncleanly and journald will rotate those corrupt files away (You typically see those in /var/log/journal having a journal~ file extension). Theoretically, using imjournal, you should be able to capture more messages from early boot and late shutdown, since journald is started earliers and stopped later then rsyslog. Michael -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth? _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
